U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

72–885 2012

H.R. 2221, THE DATA ACCOUNTABILITY AND 

PROTECTION ACT, AND H.R. 1319, THE INFORMED P2P USER ACT 

HEARING 

BEFORE THE

SUBCOMMITTEE ON COMMERCE, TRADE, 

AND CONSUMER PROTECTION 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED ELEVENTH CONGRESS 

FIRST SESSION 

MAY 5, 2009 

Serial No. 111–36 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 


smartinez on DSK6TPTVN1PROD with HEARING
COMMITTEE ON ENERGY AND COMMERCE 

HENRY A. WAXMAN, California, Chairman 

JOHN D. DINGELL, Michigan 

Chairman Emeritus 

EDWARD J. MARKEY, Massachusetts 

RICK BOUCHER, Virginia 

FRANK PALLONE, JR., New Jersey 

BART GORDON, Tennessee 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

BART STUPAK, Michigan 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

Vice Chairman 

LOIS CAPPS, California 

MICHAEL F. DOYLE, Pennsylvania 

JANE HARMAN, California 

TOM ALLEN, Maine 

JAN SCHAKOWSKY, Illinois 

HILDA L. SOLIS, California 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

ANTHONY D. WEINER, New York 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

CHARLIE MELANCON, Louisiana 

JOHN BARROW, Georgia 

BARON P. HILL, Indiana 

DORIS O. MATSUI, California 

DONNA CHRISTENSEN, Virgin Islands 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

CHRISTOPHER MURPHY, Connecticut 

ZACHARY T. SPACE, Ohio 

JERRY MCNERNEY, California 

BETTY SUTTON, Ohio 

BRUCE BRALEY, Iowa 

PETER WELCH, Vermont 

JOE BARTON, Texas 

Ranking Member 

RALPH M. HALL, Texas 

FRED UPTON, Michigan 

CLIFF STEARNS, Florida 

NATHAN DEAL, Georgia 

ED WHITFIELD, Kentucky 

JOHN SHIMKUS, Illinois 

JOHN B. SHADEGG, Arizona 

ROY BLUNT, Missouri 

STEVE BUYER, Indiana 

GEORGE RADANOVICH, California 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

PARKER GRIFFITH, Alabama 

ROBERT E. LATTA, Ohio 

(II) 


smartinez on DSK6TPTVN1PROD with HEARING
(III) 

SUBCOMMITTEE ON COMMERCE, TRADE, AND CONSUMER PROTECTION

BOBBY L. RUSH, Illinois 

Chairman 

JAN SCHAKOWSKY, Illinois 

Vice Chair 

JOHN SARBANES, Maryland 

BETTY SUTTON, Ohio 

FRANK PALLONE, New Jersey 

BART GORDON, Tennessee 

BART STUPAK, Michigan 

GENE GREEN, Texas 

CHARLES A. GONZALEZ, Texas 

ANTHONY D. WEINER, New York 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

KATHY CASTOR, Florida 

ZACHARY T. SPACE, Ohio 

BRUCE BRALEY, Iowa 

DIANA DEGETTE, Colorado 

JOHN D. DINGELL, Michigan (ex officio) 

CLIFF STEARNS, Florida 

Ranking Member 

RALPH M. HALL, Texas 

DENNIS HASTERT, Illinois 

ED WHITFIELD, Kentucky 

CHARLES W. ‘‘CHIP’’ PICKERING, 

Mississippi 

GEORGE RADANOVICH, California 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

MICHAEL C. BURGESS, Texas 


smartinez on DSK6TPTVN1PROD with HEARING

smartinez on DSK6TPTVN1PROD with HEARING
(V) 

C O N T E N T S 

Page 

Hon. Bobby L. Rush, a Representative in Congress from the State of Illinois, 

opening statement ................................................................................................ 1 

Hon. George Radanovich, a Representative in Congress from the State of 

California, opening statement ............................................................................. 2 

Hon. John Barrow, a Representative in Congress from the State of Georgia, 

opening statement ................................................................................................ 4 

Hon. Cliff Stearns, a Representative in Congress from the State of Florida, 

prepared statement .............................................................................................. 5 

Hon. Mary Bono Mack, a Representative in Congress from the State of 

California, prepared statement ........................................................................... 6 

Hon. Tim Murphy, a Representative in Congress from the Commonwealth 

of Pennsylvania, prepared statement ................................................................. 6 

Hon. Lee Terry, a Representative in Congress from the State of Nebraska, 

opening statement ................................................................................................ 7 

Hon. Phil Gingrey, a Representative in Congress from the State of Georgia, 

opening statement ................................................................................................ 8 

Hon. Marsha Blackburn, a Representative in Congress from the State of 

Tennessee, prepared statement .......................................................................... 151 

WITNESSES

Eileen Harrington, Acting Director, Bureau of Consumer Protection, Federal 

Trade Commission ............................................................................................... 9 

Prepared statement .......................................................................................... 12 

Answers to submitted questions ...................................................................... 153 

David M. Sohn, Senior Policy Counsel, Center for Democracy and Technology 36 

Prepared statement .......................................................................................... 38 

Answers to submitted questions ...................................................................... 157 

Robert W. Holleyman II, President and Chief Executive Officer, Business 

Software Alliance ................................................................................................. 48 

Prepared statement .......................................................................................... 50 

Answers to submitted questions ...................................................................... 161 

Martin C. Lafferty, Chief Executive Officer, Distributed Computing Industry 

Association ............................................................................................................ 57 

Prepared statement .......................................................................................... 59 

Stuart K. Pratt, President and Chief Executive Officer, Consumer Data Industry Association ................................................................................................ 88 

Prepared statement .......................................................................................... 90 

Answers to submitted questions ...................................................................... 164 

Marc Rotenberg, Executive Director, Electronic Privacy Information Center .... 101 

Prepared statement .......................................................................................... 103 

Answers to submitted questions ...................................................................... 167 

Robert Boback, Chief Executive Officer, Tiversa, Inc. .......................................... 113 

Prepared statement .......................................................................................... 115 

Thomas D. Sydnor, Senior Fellow and Director, Center for the Study of 

Digital Property, Progress and Freedom Foundation ....................................... 127 

Prepared statement .......................................................................................... 129 


smartinez on DSK6TPTVN1PROD with HEARING

smartinez on DSK6TPTVN1PROD with HEARING
(1) 

H.R. 2221, THE DATA ACCOUNTABILITY AND 

PROTECTION ACT, AND H.R. 1319, THE INFORMED P2P USER ACT 

TUESDAY, MAY 5, 2009 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON COMMERCE, TRADE, 

AND CONSUMER PROTECTION, 

COMMITTEE ON ENERGY AND COMMERCE, 

Washington, DC. 

The subcommittee met, pursuant to call, at 2:00 p.m., in Room 

2123 of the Rayburn House Office Building, Hon. Bobby L. Rush 

(chairman) presiding. 

Members present: Representatives Rush, Stupak, Barrow, 

Radanovich, Stearns, Bono Mack, Terry, Murphy of Pennsylvania, 

Gingrey and Scalise. 

Staff present: Christian Fjeld, Counsel; Marc Gromar, Counsel; 

Valerie Baron, Legislative Clerk; Brian McCullough, Minority Senior Professional Staff; Will Carty, Minority Professional Staff; and 

Sam Costello, Minority legislative Analyst. 

OPENING STATEMENT OF HON. BOBBY L. RUSH 

Mr. RUSH. The subcommittee will now come to order. 

Today the subcommittee is holding a legislative hearing on two 

bills: H.R. 2221, the Data Accountability and Trust Act, and H.R. 

1319, the Informed P2P User Act. The chair will recognize himself 

for 5 minutes for the purposes of an opening statement. 

Today the subcommittee is holding a legislative hearing on the 

two above-mentioned bills. They were both introduced by two distinguished members of the subcommittee, my colleagues Ms. Bono 

Mack and Mr. Barrow, and H.R. 2221, which is the Data Accountability and Trust Act, also known as DATA, was introduced by myself and Mr. Stearns. Ms. Bono Mack and Mr. Barrow introduced 

H.R. 1319. Both of these bills represent strong bipartisan efforts to 

address high-profile problems affecting American consumers. 

H.R. 1319, the Informed P2P User Act, addresses the increasingly frequent problem of consumers inadvertently exposing their 

private sensitive information by way of peer-to-peer file-sharing 

programs. Too often when consumers download these programs 

onto their computers with the intent of sharing and downloading 

certain files on the network, they are unaware that they are also 

sharing other files they otherwise might want to keep private. For 

instance, recent media reports have focused on consumers unknowingly sharing their tax returns and their Social Security numbers 


smartinez on DSK6TPTVN1PROD with HEARING
2 

on P2P networks. Such inadvertent file sharing can be the result 

of deceptive or misleading disclosures by P2P software companies 

or they might emanate from simple confusion on the part of consumers. Whatever the case, the intent of H.R. 1319 is to provide 

consumers with the power of informed consent before they 

download P2P software onto their computers and share folders and 

files with network participants. 

The second bill that we will be discussing today is H.R. 2221, the 

Data Accountability and Trust Act. This is the third Congress in 

which this bill has been introduced. Mr. Stearns as chairman of 

this subcommittee in the 109th Congress originally introduced the 

bill as H.R. 4127, and with the help of then-Ranking Member Schakowsky, it eventually passed the full Energy and Commerce Committee by a unanimous vote. However, no further action was taken 

on the bill as a result of jurisdictional disputes. In the subsequent 

110th Congress, I reintroduced the bill as H.R. 958, but we were 

unable to take any action. Once again in this current Congress, I 

have reintroduced the bill with Mr. Stearns, Mr. Barton, Ms. Schakowsky and Mr. Radanovich as H.R. 2221 with the intent that it 

does eventually become law. 

H.R. 2221 has two basic components. First, the bill requires that 

persons processing electronic data that contains personal information must take steps to ensure that the data is secure. Second, the 

bill establishes a notification procedure and process that a company 

must take when a data breach occurs in order to allow affected consumers to protect themselves. Companies do not have to initiate 

such notices of they determine that ‘‘there is no reasonable risk of 

identity theft, fraud or other unlawful acts.’’ H.R. 2221 also imposes special requirements on data brokers but accommodates 

other laws that govern how certain data brokers are regulated. 

These bills may require some revision, and while this may not be 

the first time we have taken up data security, and H.R. 2221 already reflects significant changes forged by compromise made in 

the 109th Congress, the bill may be dated and in need of an update. This subcommittee is looking forward to working in a bipartisan fashion and seeking bipartisan cooperation based on our historical bipartisanship, and I expect that bipartisanship to be at 

work on both of these bills. 

Lastly, I want to just announce for the record that I have an intention to hold a joint hearing on consumer privacy with Chairman 

Boucher and the Subcommittee on Communications, Technology, 

and the Internet and to work on comprehensive legislation. This is 

just a part of a larger process. 

Mr. RUSH. With that, I yield back the balance of my time and 

recognize now for the purposes of an opening statement the ranking member on this subcommittee, Mr. Radanovich, for 5 minutes. 

OPENING STATEMENT OF HON. GEORGE RADANOVICH 

Mr. RADANOVICH. Thank you, Mr. Chairman. Good afternoon, everybody. 

I would first like to thank the witnesses before us today and the 

organizations that have offered comments and suggestions assisting the important work of crafting a robust and workable data security bill. Both that bill and the P2P bill that we have, there are 


smartinez on DSK6TPTVN1PROD with HEARING
3 

core concerns about the unauthorized or inadvertent sharing of 

sensitive information. I want to commend Mr. Stearns, Ms. Schakowsky, Mr. Barton, Mr. Dingell, Mr. Whitfield and now Mr. Rush 

and Mr. Waxman, all of whom were chairmen and/or ranking members who have helped bring attention to these issues. I also want 

to recognize Ms. Bono Mack’s leadership on digital security over 

the years and on her bill to prevent inadvertent file sharing on 

peer-to-peer networks. 

File sharing presents privacy and security issues but also relates 

to online safety more generally, and being a father, I am glad to 

see that a bill that improves children’s digital safety and will help 

protect from some of the atrocities that are being committed using 

these networks on line. 

Huge data security breaches shocked us all starting back in 2005 

with the ChoicePoint breach and millions of people in the United 

States had discovered that they are victims of identity theft. Billions are lost by consumers and by businesses as they spend money 

and time to repair their finances. Particularly in difficult economic 

times when credit is increasingly tough to secure, the potential disruption and obstruction of commercial activity in every sector of 

the U.S. economy cannot be ignored. Internet-based and other electronic transactions are fundamental these days and ensuring consumer confidence in these systems is essential. The Congress, and 

this committee in particular, are charged with the responsibility to 

ensure that the entities possessing and dealing in sensitive consumer data keep the doors locked and the alarm on. 

The health of our modern network system of commerce demands 

it. Very simply, H.R. 2221 would create a uniform national data 

breach notification regime. I believe that notification must be based 

on the actual risk of potential harm from identity theft or other 

malfeasance and the mandates that we put on covered entities 

must be the same across the country. Allowing individual States to 

alter the rules will only lead to consumer confusion and unnecessary business expenses, costs that will inevitably be passed on to 

the consumer. Let us get a good bill that robustly protects consumers while not adding requirements that only add costs. 

The world has changed since we last considered this bill, and I 

am anxious to hear about those developments. Some parts of the 

bill may now be obsolete, given the actions of the private sector, 

actions by both those who hold sensitive information and by companies who now offer products directly to consumers to monitor their 

credit. We must take all of this into account and get a workable 

bill that we can all support. 

While the data security bill is one with which the committee has 

some experience, Ms. Bono Mack’s bill, H.R. 1319, is a relatively 

new one. She was out in front on the issue last Congress, introducing an earlier version of the bill last September. Since then we 

have seen multiple news stories about the problems the bill attempts to addressing, inadvertent sharing of sensitive files across 

peer-to-peer networks. I want to state at the outset that it is not 

the committee’s intent to simply demonize P2P software. There are 

many legitimate and important uses of this innovative program 

and I am glad that the P2P industry is here to talk about the uses 

of their products. However, the systems present some interesting 


smartinez on DSK6TPTVN1PROD with HEARING
4 

problems as well. Last month the P2P security company Tiversa, 

who is here to testify, found the schematics of Marine One, President Obama’s new helicopter, on a P2P server in Iran. In other reporting it was found that millions of sensitive personal records including Social Security numbers, medical records, credit reports 

and tax returns with names and addresses were easily found on 

P2P networks. 

The problem of inadvertent sharing is enhanced by the actual architecture of the programs. It is often unclear to a user what may 

be leaked, and it can be difficult to change settings to prevent it. 

After Mr. Waxman examined this in the former committee down 

the hall, it appears that 2 years later many P2P providers have not 

taken adequate steps to address this. We need to take a close look 

at the problem and the bill. We do not want to sweep technologies 

into a potential regime that we do not intend nor do we want to 

exclude technologies that we can all agree should be covered. How 

we define P2P software is critical. 

Mr. Chairman, I look forward to the comments on these bills and 

I would like to express my gratitude to the majority for their intent 

to develop these bills. Thank you, Mr. Chairman. 

Mr. RUSH. The chair thanks the gentleman. 

The chair now recognizes Mr. Barrow for 2 minutes. Mr. Barrow 

is a sponsor of one of the bills and certainly I am grateful to him 

for his legislative work. Mr. Barrow, you are recognized for 2 minutes for the purposes of an opening statement. 

OPENING STATEMENT OF HON. JOHN BARROW 

Mr. BARROW. Thank you, Mr. Chairman. 

We live in a world where digital technology has connected people 

and their ideas, their information and products, making possible all 

kinds of new kinds of collaboration and innovation. There is no 

doubt that this has made us all a lot more productive. It has also 

made it possible for folks to invade our personal records and reveal 

private information about us and our families that we choose not 

to disclose. 

The purpose of today’s hearing is to discuss threats to data security and ways we can work to fill in the gaps that leave our personal records vulnerable. I had the opportunity to work with Congresswoman Mary Bono Mack on H.R. 1319, the Informed Peer to 

Peer User Act, and I hope that this hearing will shed some light 

on the privacy and security risks that are associated with peer-topeer file-sharing programs. A lot of folks who connect to these networks don’t even realize that their most personal and private files 

are visible to everyone else on the network at any time. A lot of 

folks are posting their tax returns, financial records and personal 

messages on the Internet and don’t even know it. I hope that our 

work on this committee will come up with a strategy that will let 

individuals know in a way that they can understand and use that 

the information on the computers could be at risk. We have truth 

in lending and we have truth in labeling. I think it is time we had 

truth in networking also. 

I want to thank Congresswoman Mary Bono Mack for allowing 

me to work with her on the Informed Peer to Peer User Act and 

I want to thank Chairman Waxman and Ranking Member Barton 


smartinez on DSK6TPTVN1PROD with HEARING
5 

for bringing these important issues to the forefront in our committee, and most importantly, I want to thank every one of you on 

this panel today for being here to lend your expertise on this important subject. 

Thank you, and I yield back the balance of my time. 

Mr. RUSH. The chair thanks the gentleman. The chair now recognizes the other author of one of these bills that we are hearing 

today, Ms. Bono Mack—I am sorry—Mr. Stearns, I am sorry, the 

former ranking member of the subcommittee, Mr. Stearns of Florida, who is recognized for 2 minutes for the purposes of an opening 

statement. 

Mr. STEARNS. Thank you, Mr. Chairman, and I— 

Mr. RUSH. I didn’t mean to confuse you with Ms. Bono Mack. 

OPENING STATEMENT OF HON. CLIFF STEARNS 

Mr. STEARNS. She is much better looking. 

Mr. Chairman, thank you very much, and I think in your opening statement you pretty much outlined my feeling about this. Obviously this is a bill that was introduced on October 25, 2005. It 

was H.R. 4127, and as you pointed out, we passed this bill by 

unanimous consent. Ms. Schakowsky and I worked together on that 

bill and we had compromises. We got the bill. So I am very pleased 

that you have taken the initiative, the leadership to offer this bill 

again, and I am very glad to be an original cosponsor with you. I 

am hoping it has the same kind of success that we had, Ms. Schakowsky and I, because it is a very, very important bill. 

Recently some hackers broke into a Virginia State website used 

by pharmacists to track prescription drug abuse. They took all 

these names and it is 8 million patients and they deleted them 

from the site and they are asking for money to replace them, so in 

a way they are asking for ransom, and if this Virginia website had 

an encrypted data security full-blown protection of this information, it would have been difficult, if not impossible, for these hackers to get in and to take this information. It is 8,257,000 names. 

And that is why this bill is so important so I am very pleased to 

support it. 

Also, the gentlelady from California’s bill, the Informed P2P User 

Act, which is again very important. With the diverse connectivity 

we have in networks, and of course with the increased broadband 

that we are starting to see, people are going to go more to this 

peer-to-peer downloading and this centralized resources in your 

computer and these servers going back and forth between each 

other, you have got to have some notification to the users what is 

occurring or a lot of their applications and their information will 

be also taken. 

So it is very appropriate these two bills come together, I think, 

and Mr. Chairman, I commend you and your staff for bringing 

them both because in a way we are talking about data security 

with both of them and protection of the consumer, and I thank you, 

Mr. Chairman. 

Mr. RUSH. The chair thanks the gentleman. Now the chair recognizes Ms. Bono Mack of California for 2 minutes for the purposes 

of an opening statement. 


smartinez on DSK6TPTVN1PROD with HEARING
6 

OPENING STATEMENT OF HON. MARY BONO MACK 

Ms. BONO MACK. I thank the chair and Ranking Member Radanovich and the distinguished panel for being here today. Thank you 

for holding a hearing on important privacy legislation. Today my 

comments will focus entirely on H.R. 1219, the Informed P2P User 

Act, but before I dig into the issue of P2P, I would like to thank 

Ranking Member Barton as well as my colleague, Congressman 

Barrow, for their willingness to work together on H.R. 1319. As you 

have seen, this is a bipartisan bill and their support has been essential. I thank them both. 

The risks associated with peer-to-peer file-sharing programs has 

been widely reported by the media and thoroughly investigated by 

Congress. Many of our witnesses today have testified before other 

Congressional committees on the dangers associated with P2P filesharing programs, and each time the committee was given a status 

update of the dangers. Additionally, industry claimed ignorance 

and stated they would handle the problem through self-regulation. 

This hands-off approach has not worked and any set of voluntary 

best practices put forth by the P2P industry can no longer be seen 

as credible. To paraphrase Groucho Marx, you want me to believe 

you and your voluntary measures instead of my own two eyes. How 

many more medical records and tax returns is it going to take for 

us to act? How many state secrets will be made available to those 

who want to harm us? How much more damage are we going to 

allow P2P file-sharing programs to do to our economy? I believe 

enough is enough and the time to act is now. 

Industry’s opportunity to self-regulate has passed. P2P file-sharing programs like Lime Wire and Kazaa before it have proven they 

are either incapable of solving the problem of inadvertent file sharing on their own or they have absolutely no intention of solving the 

problem at all. Either way, this behavior is unacceptable, as the 

committee charged with consumer protection, we have a responsibility to our constituents to act. 

I am also aware that some of you have concerns about some of 

the language of H.R. 1319. Please note that my office is very willing to listen to your concerns and work with you to craft a bill that 

is not overly broad but still carries out the current intent of H.R. 

1319. I believe that if we work together we should be able to 

produce a bill that protects our constituents and preserves the legitimate use of P2P applications. 

I look forward to today’s discussion, and I thank the chairman 

very much for holding this hearing. I yield back. 

Mr. RUSH. The chair thanks the gentlelady. Now the chair recognizes the gentleman from Pennsylvania, Dr. Murphy, for the purposes of an opening statement. The gentleman is recognized for 2 

minutes. 

OPENING STATEMENT OF HON. TIM MURPHY 

Mr. MURPHY OF PENNSYLVANIA. Thank you, Mr. Chairman, and 

by the way, I would also like to welcome a Pittsburgher, Mr. 

Boback of Tiversa, he and I have spoken a number of times in the 

past, as well as this incredibly distinguished panel. The expertise 

you all have, I am excited about you being here. 


smartinez on DSK6TPTVN1PROD with HEARING
7 

The sad thing about this is, this is a discussion that has not 

begun today. I think some of you have testified in past years and 

I know that Mr. Boback and I have spoken years ago. When we 

look at what has been released about the documents from Marine 

One, a couple terabytes of information on the Joint Strike fighter 

jet, a whole host of so much information, it makes me wonder why 

anybody trusts to have any files on the computers at all. It reminds 

me of the way that Rome acted during the time the Barbarians 

were beginning to invade various parts of Germany, and I am sure 

some Roman emperor, some Roman generals were saying nothing 

to worry about, we have this system under control, even when they 

were sacking Rome, and I believe that is where we are now. It is 

not safe. The portals created by these peer-to-peer networks are 

huge and the fact that our Department of Defense keeps anything 

on any computer that is accessible from the outside still astounds 

me. I applaud this bill, and I think this is important because it 

does move a long way towards protecting consumers and families 

who inadvertently have their files stolen and accessed whether it 

is their tax records, medical records or anything else. But the best 

thing we need to remember for so many folks whether they are 

John and Jane Doe in their home somewhere or it is our defense 

department or is any corporation that no matter what we do here, 

they are still responsible for keeping the information inaccessible 

to the Internet because those folks from other countries who continue to send out press releases denying they are doing it and yet 

all paths seem to lead back to those countries, we have to understand that the wealth of information we have on our computer networks and what we have done to protect those is all for naught if 

we continue to put those on computers. 

With that, Mr. Chairman, I yield back. 

Mr. RUSH. The chair thanks the gentleman. Now the gentleman 

from Nebraska, Mr. Terry, is recognized for 2 minutes for the purposes of an an opening statement. 

OPENING STATEMENT OF HON. LEE TERRY 

Mr. TERRY. Thank you, Mr. Chairman. I want to thank you for 

holding today’s hearing, but more specifically, we have been down 

this road a couple times before and I think it is imperative that we 

move these bills. 

I am going to pile on a little bit Mr. Murphy’s comments that I 

view this as nibbling around the edges of cybersecurity. We are 

pointing to specific problems and trying to come up with specific solutions. All the while we are losing sight of the forest. I am not saying these shouldn’t be done but I just think we need to think about 

in a grander scheme of cybersecurity and how it all ties in with our 

national security now, our financial security, and hopefully we can 

start elevating the level of discussion here but I want to congratulate the authors of both of the bills here. I think you have done a 

decent job here of finding the right solution for these specific problems and I support them. Yield back. 

Mr. RUSH. The chair thanks the gentleman and now the chair 

recognizes the gentleman from Georgia, Dr. Gingrey, for 2 minutes 

for the purposes of an opening statement. 


smartinez on DSK6TPTVN1PROD with HEARING
8 

OPENING STATEMENT OF HON. PHIL GINGREY 

Mr. GINGREY. Mr. Chairman, thank you for calling this hearing 

today that focuses on two bipartisan pieces of legislation, H.R. 

2221, the Data Accountability and Trust Act, and H.R. 1319, the 

Informed Peer to Peer User Act. I also want to commend both you 

and Ranking Member Radanovich for your collective leadership and 

for the spirit of comity in which this subcommittee is operating, 

Mr. Chairman. 

At a time when our society is becoming ever more reliant on 

technology, whether for e-commerce or HIT, health information 

technology, we need to ensure the security of an individual’s identity and personal information. Unfortunately, we have seen significant breaches of information that have led to identity theft, fraud 

and allegations that were first reported in the Wall Street Journal 

that Chinese hackers—it is bad enough what Ranking Member 

Stearns was saying about the pharmaceutical and prescription 

drug information but Chinese hackers stole several terabytes of 

data related to design and electronic systems of the Joint Strike 

fighter. That is some serious business. 

H.R. 2221 is legislation that was first written in the 109th Congress by my colleague from Florida, Mr. Stearns. It is now being 

spearheaded by you, Mr. Chairman, and I applaud you on this effort. This legislation requires entities holding data that contains 

personal information to implement enhanced security measures to 

prevent future breaches. In instances in which unauthorized access 

does occur, then the consumers must be notified shortly thereafter 

that their files were compromised. 

Similarly, H.R. 1319 is legislation that was introduced by Ms. 

Bono Mack of California, full committee Ranking Member Barton 

and my colleague from Savannah, Georgia, Mr. Barrow, and it is 

designed to protect consumers through additional information 

about the practice of peer-to-peer file sharing over the Internet. 

Simply referred to as P2P file sharing around the IT industry, this 

practice certainly has a number of benefits. However, too often personal information is compromised over the peer-to-peer program for 

various reasons, many of which of course are inadvertent. H.R. 

1319 would add an additional layer of security that would prohibit 

peer-to-peer programs from sharing files until the program receives 

informed consent from the user on two separate occasions. 

Mr. Chairman, we need to maintain security on the Internet in 

this growing technologically-based world, and I do support both bipartisan bills. I look forward to hearing from the witnesses, and I 

yield back. 

Mr. RUSH. The chair thanks the gentleman and the chair thanks 

all the members of the subcommittee for their opening statements. 

It is now my pleasure to introduce our outstanding expert panel. 

These panelists have come from far and near to be with us today, 

and we certainly welcome them and we certainly want to tell each 

and every one of you beforehand that we thank you so much for 

taking the time out from your busy schedule to participate with us 

in this hearing. 

I would like to first of all introduce you now. From my far left 

is Ms. Eileen Harrington. Ms. Harrington is the acting director of 

the Bureau of Consumer Protection for the Federal Trade CommisVerDate Mar 15 2010 03:34 May 25, 2012 Jkt 072885 PO 00000 Frm 00014 Fmt 6633 Sfmt 6633 E:\HR\OC\A885.XXX A885

smartinez on DSK6TPTVN1PROD with HEARING
9 

sion. Next to Ms. Harrington is Mr. David M. Sohn, who is the senior policy counsel for the Center for Democracy and Technology. 

Next to Mr. Sohn is Mr. Robert W. Holleyman, II. Mr. Holleyman 

is the president and CEO of Business Software Alliance. Seated 

next to him is Mr. Martin C. Lafferty. He is the chief executive officer of Distributed Computing Industry Association. Next to Mr. 

Lafferty is Mr. Stuart K. Pratt, president and CEO of the Consumer Data Industry Association, and then next to him is Mr. 

Marc Rotenberg, who is the executive director of the Electronic Privacy Information Center. The gentleman next to Mr. Rotenberg is 

Mr. Robert Boback. He is the CEO of Tiversa, Incorporated. And 

lastly but not least, the gentleman seated next to Mr. Boback is 

Mr. Thomas D. Sydnor. He is the senior fellow and director of the 

Center for the Study of Digital Property of the Progress and Freedom Foundation. 

Again, I want to thank each and every one of the witnesses for 

appearing today. It is my pleasure to extend to you 5 minutes for 

the purposes of opening statement, and we will begin with Ms. 

Harrington. 

STATEMENTS OF EILEEN HARRINGTON, ACTING DIRECTOR, 

BUREAU OF CONSUMER PROTECTION, FEDERAL TRADE 

COMMISSION; DAVID M. SOHN, SENIOR POLICY COUNSEL, 

CENTER FOR DEMOCRACY AND TECHNOLOGY; ROBERT W. 

HOLLEYMAN II, PRESIDENT AND CHIEF EXECUTIVE OFFICER, BUSINESS SOFTWARE ALLIANCE; MARTIN C. 

LAFFERTY, CHIEF EXECUTIVE OFFICER, DISTRIBUTED COMPUTING INDUSTRY ASSOCIATION; STUART K. PRATT, PRESIDENT AND CHIEF EXECUTIVE OFFICER, CONSUMER DATA 

INDUSTRY ASSOCIATION; MARC ROTENBERG, EXECUTIVE 

DIRECTOR, ELECTRONIC PRIVACY INFORMATION CENTER; 

ROBERT BOBACK, CHIEF EXECUTIVE OFFICER, TIVERSA, 

INC.; AND THOMAS D. SYDNOR, SENIOR FELLOW AND DIRECTOR, CENTER FOR THE STUDY OF DIGITAL PROPERTY, 

PROGRESS AND FREEDOM FOUNDATION 

STATEMENT OF EILEEN HARRINGTON 

Ms. HARRINGTON. Thank you very much, Chairman Rush, Ranking Member Radanovich and members of the subcommittee. I am 

Eileen Harrington, the acting director of the FTC’s Bureau of Consumer Protection. I appreciate the opportunity to appear to present 

the Commission’s testimony on data security and peer-to-peer file 

sharing. The Commission’s views are set forth in its written testimony. My oral presentation and answers to your questions represent my views. 

Let me start with data security. Companies must protect consumers’ sensitive data. If they don’t, that data could fall into the 

wrong hands, resulting in fraud and consumers losing confidence in 

the marketplace. The Commission has undertaken substantial efforts described fully in its written testimony to promote data security. Let me highlight three particular efforts for you: our law enforcement activities, our pending rulemaking on health information 

security and our study of emerging technologies. 

Today the Commission announced its 26th law enforcement action against a business that we allege failed to have reasonable 


smartinez on DSK6TPTVN1PROD with HEARING
10 

procedures to protect consumers’ personal information. Case number 26 is against mortgage broker James Nutter and Company for 

allegedly failing to implement basic computer security measures. In 

settling these charges, the company has agreed to maintain reasonable security measures in the future and to periodic outside audits 

of its security practices. The Commission’s data security cases are 

well publicized and send a strong message to the business community: you must have reasonable data security measures in place. 

Second, a few weeks ago the Commission issued a proposed rule 

to require that consumers be notified when the security of their 

health information is breached. The proposed rule arises from a 

mandate in the Recovery Act to address new types of web-based entities that collect or handle consumers’ sensitive health information. Covered entities include those that offer personal health 

records which consumers can use as an electronic individually controlled repository for their medical information. Personal health 

records have the potential to provide numerous benefits for consumers but only if they have confidence that the security of the 

health information they put it in will be maintained. 

Third, the Commission continues to examine new technologies to 

identify emerging privacy and data security issues. In February, for 

example, the Commission staff released a report recommending 

principles for industry self-regulation of privacy and data security 

in connection with behavioral advertising. We are also considering 

a petition submitted by EPIC raising data security concerns about 

cloud computing services provided by Google. 

Finally, a few words about the proposed data security bill, H.R. 

2221. The Commission strongly supports the goals of the legislation, which are to require companies to implement reasonable security procedures and provide security breach notification to consumers. We also strongly support the provisions that would give 

the Commission the authority to obtain civil penalties for violations. We have provided technical comments to committee staff, 

particularly with regard to the scope of the proposed legislation 

and the data broker provisions and very much appreciate the opportunity to provide input. 

Turning to P2P file sharing, let us be clear about one thing. The 

FTC’s interest is the safety and privacy of consumers’ personal documents and information, not copyright piracy. Although P2P technologies may offer benefits to computing, they have also been associated with significant data security risks. The press has reported 

disturbing instances of sensitive documents being shared via P2P 

networks. Sensitive documents likely have been shared under three 

scenarios. First, some consumers may have shared documents because they failed to read or understand information about how to 

keep files from being shared or did not understand the consequences of altering default settings. Second, some consumers 

may have unknowingly downloaded malware that caused their files 

to be made available on P2P networks. Third, some businesses and 

other organizations that hold sensitive personal information such 

as tax or medical records have not implemented procedures to 

block installation of P2P file-sharing software on their company or 

organization-owned computers and networks. Some of the most 

highly publicized instances of personal information being shared 


smartinez on DSK6TPTVN1PROD with HEARING
11 

over P2P networks occurred because businesses failed to prevent 

the installation of P2P software on their systems or because their 

employees placed sensitive corporate documents onto home computers that had downloaded P2P software. 

The FTC has worked with the P2P industry as it has set standards for disclosure and default settings that protect consumers’ 

files and information. We have received reports about the performance of seven P2P companies and are currently reviewing them to 

see whether these companies comply with the industry standards. 

We will make the results of our review public this summer. We 

also educate consumers about the risks associated with these programs. In addition to a 2008 consumer alert, the FTC’s Internet 

website, onguardonline.gov, highlights information about the risks 

of P2P file-sharing software. 

Finally, we support legislation that requires distributors of P2P 

file-sharing programs to provide timely, clear and conspicuous notice and obtain consent from consumers regarding the essential aspects of those programs. H.R. 1319 may provide very useful protections for consumers. The agency has worked with committee staff 

on previous versions of the bill and we look forward to working 

with committee staff again regarding this proposed legislation, and 

we thank you very much for giving the FTC the opportunity to 

present its views today. 

[The prepared statement of Ms. Harrington follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
12 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 19 here 72885A.001
13 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 20 here 72885A.002
14 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 21 here 72885A.003
15 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 22 here 72885A.004
16 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 23 here 72885A.005
17 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 24 here 72885A.006
18 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 25 here 72885A.007
19 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 26 here 72885A.008
20 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 27 here 72885A.009
21 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 28 here 72885A.010
22 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 29 here 72885A.011
23 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 30 here 72885A.012
24 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 31 here 72885A.013
25 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 32 here 72885A.014
26 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 33 here 72885A.015
27 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 34 here 72885A.016
28 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 35 here 72885A.017
29 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 36 here 72885A.018
30 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 37 here 72885A.019
31 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 38 here 72885A.020
32 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 39 here 72885A.021
33 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 40 here 72885A.022
34 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 41 here 72885A.023
35 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 42 here 72885A.024
36 

Mr. RUSH. The chair now recognizes Mr. Sohn for 5 minutes. 

STATEMENT OF DAVID M. SOHN 

Mr. SOHN. Chairman Rush, Ranking Member Radanovich, members of the subcommittee, thank you for the opportunity to participate in today’s hearing. The Center for Democracy and Technology 

is very pleased to see this subcommittee focusing on data privacy 

and security issues. Based on my conversations with subcommittee 

staff, I am going to focus my comments this afternoon on the Data 

Accountability and Trust Act with just a few words at the end 

about the Informed P2P User Act. 

But before I do that, I would like to make a general point. Both 

of the bills that are the focus of today’s hearing reflect the fact that 

technology has greatly expanded the ability to collect, store, use 

and share personal data. The modern information economy that 

this makes possible has many benefits but it also has greatly 

changed the privacy landscape and it has expanded the risk of inappropriate disclosure of personal data. Unfortunately, the law has 

simply not kept pace with these changes. In particular, the United 

States has no general privacy law establishing any kind of fair 

baseline of principles or expectations to govern consumer privacy, 

and in the absence of that kind of overall legal framework, when 

new privacy issues arise, Congress is essentially left to legislate on 

a one-off basis without any clear guiding principles and without 

necessarily much consistency. The result, what we have today, is 

a confusing patchwork of laws in this area. So based on that, CDT 

would certainly urge the subcommittee to put a high priority on the 

enactment of baseline federal privacy legislation and we are very 

happy to hear Chairman Rush saying today that he plans a joint 

hearing and does plan to work on comprehensive privacy legislation. 

Now I would like to turn to the Data Accountability and Trust 

Act. CDT supports the idea of a nationwide data breach notification 

standard so long as that standard is as least as effective as the 

laws already in place at the State level. The key point to understand here is that data breach notification is already the law of the 

land because it is required by all but a few of the States. So from 

a consumer perspective, replacing State notification laws with a 

weak federal standard could actually be a step backwards, and 

even replacing them with a good federal standard still doesn’t offer 

a lot of tangible progress. The principal consumer gains from H.R. 

2221 therefore come from section 2 of the bill, namely the provision 

for requiring data security procedures and especially the provisions 

requiring information brokers to let consumers review what is in 

their data broker files. Based largely on these provisions, the CDT 

does support the framework set forth in the bill. 

My written testimony offers some suggestions for improvements 

to the bill. For example, the breach notification provisions could be 

improved by requiring a company that suffers a breach but determines that there isn’t enough risk to notify consumers to nonetheless provide a brief explanation to a regulator basically just to keep 

everybody honest. For the provisions on security standards and 

consumer access to information broker files, CDT recommends taking a close look at the scope of those requirements. In particular, 


smartinez on DSK6TPTVN1PROD with HEARING
37 

the bill uses a definition of personal data that is really quite limited, which may make sense for breach notification provisions but 

might make less sense for the provisions in section 2. 

Preemption deserves a mention as well. It is important to note 

that preempting State laws in this area is a very significant step. 

The only reason we are here talking about breach notification 

today is that notification laws were pioneered by the States and especially California. States were able to do that because the GrammLeach-Bliley Act preempted inconsistent State laws but otherwise 

left States free to experiment. Fortunately, the authors of H.R. 

2221 have been careful with preemption. CDT does believe that 

preemption makes sense for the specific issue of breach notification 

and the bill does provide for that. I would just say that as the bill 

moves forward, Congress needs to keep in mind that the price of 

preemption must be strong federal action and that overbroad preemption has to be avoided. Overall, CDT does appreciate the careful work of Chairman Rush and the other sponsors of this bill and 

we stand ready to cooperate with them on possible improvements 

as the bill moves forward. 

Finally, just a couple words on the Informed P2P User Act. CDT 

absolutely supports the principle that file-sharing software should 

clearly communicate to users how their files may be made available 

to third parties. Inadvertent sharing of personal files is a very serious privacy matter. As set forth in my written testimony, however, 

legislating this area does pose some difficulties. CDT has reservations about the potential unintended breadth of the bill and also 

has some reservations about Congress starting down the path of 

imposing specific design mandates for software developers. That 

said, we share the broad goal and my written testimony offers 

some ideas for modifications to consider if the subcommittee chooses to proceed with the bill. 

Thanks again for the opportunity to testify. 

[The prepared statement of Mr. Sohn follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
38 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 45 here 72885A.025
39 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 46 here 72885A.026
40 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 47 here 72885A.027
41 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 48 here 72885A.028
42 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 49 here 72885A.029
43 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 50 here 72885A.030
44 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 51 here 72885A.031
45 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 52 here 72885A.032
46 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 53 here 72885A.033
47 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 54 here 72885A.034
48 

Mr. RUSH. The chair thanks the gentleman. The chair recognizes 

now for 5 minutes of opening statement Mr. Holleyman. 

STATEMENT OF ROBERT W. HOLLEYMAN II 

Mr. HOLLEYMAN. Mr. Chairman, Ranking Member Radanovich, 

other members of this subcommittee, I want to thank you for the 

opportunity to testify today. The Business Software Alliance represents the leading developers of software and hardware. Of the 

software that is sold around the world, roughly 90 percent of that 

is from companies who are U.S.-based companies and our members 

believe strongly that the type of inquiry that this committee is engaged in today is important not only to ensure that our customers 

are using software properly but also to ensure that the promise of 

electronic commerce and equally important the promise for the type 

of sensitive data that the government will hold and does hold that 

we could have greater confidence because that will add enormous 

efficiencies to our system. 

As we look at the issue of breaches, the data is astounding in 

terms of the problems that we have seen. I won’t repeat all of the 

information that has been so widely covered in the press and by 

the subcommittee except that I will note that the trend is that data 

breaches are growing. In 2008, it is estimated that there was a 47 

percent increase in data breaches over the prior year, and the average cost of each breach is growing, and for the ninth year in a row, 

identity theft has topped the list of FTC consumer complaints, 

about 26 percent of all their complaints, and according to the Privacy Rights Clearinghouse, a staggering 270 million records containing sensitive personal information have been affected since 

2005. And certainly we have heard on this panel today, we have 

heard in your opening statements about Heartland Payment Systems, the single largest fraud-related data loss ever in the United 

States. Estimates of over $100 million individual credit and debit 

card accounts were compromised and the consequences of that have 

been enormous. 

And finally, to the point that I made about the importance of 

government data, nearly 20 percent of all data breaches involve 

government, federal, State and local governments, and as we move 

to the promise of governments holding even more sensitive data regarding our health records as people live longer, as our population 

grows, as we build the kind of openness and confidence in government, we have to ensure that that important nexus is also protected. 

With that, Mr. Chairman, I would like to comment on your pending bill. We believe that this bill, Mr. Rush, makes significant contributions to restoring and building a goal of consumer citizen 

trust. We support its effort to establish a uniform national standard and provide the preemption of State laws. We also believe that 

it is important to recognize that it would prevent excessive notification. We do need notification but not all breaches are equal, and 

part of what we need both in business but part of what consumers 

need is to ensure that when the notification occurs, it is the result 

of something that is meaningful. Third, we support exempting from 

notification data that has been rendered unusable, unreadable and 

indecipherable. We would recommend that the limitation in the bill 


smartinez on DSK6TPTVN1PROD with HEARING
49 

that refers to encryption be broader so that we are looking at what 

the test is, and really this creates market-based incentives that 

supplement the regulatory authority that is given. It is that combination that will ensure that more holders of data ensure that 

even if there is a breach, that the party that has carried out the 

breach or the unlawful entity can’t do anything with that data, and 

that is an important safeguard. Fourth, we believe that your bill 

takes an appropriate risk-based approach to securing data and we 

support the grant of authority and would recommend that it be 

limited to the FTC and State attorneys general rather than extending a private right of actions. 

A couple of comments about H.R. 1319. We welcome this effort 

by Ms. Bono Mack and other members of the subcommittee to address this issue. Consumer privacy can be and is being compromised because of certain peer-to-peer file-sharing applications. 

We also appreciate this subcommittee’s willingness, the committee’s willingness to look at the current breadth of this bill to identify where it could be appropriately limited. We do believe that 

there are two goals in this. One is to protect consumer security and 

promote trust and the second is to ensure that technological innovation continues to proceed. It is this balance that must be struck 

and it must be struck carefully. We are all concerned that the bill, 

if it is in its current form, could pull in some of the very legitimate 

applications and uses of peer-to-peer technology that are important 

for every consumer, important for legitimate companies. As it seeks 

to look at some of the bad actors or some of the peer-to-peer software that we widely know as an anti-piracy organization that have 

led to the widespread theft of software, music, movies and other 

content, we also know that the bill in its current form could sweep 

in any Internet-aware features of software such as automatic updates for anti-virus software such as the crash analysis feature of 

operating systems or the web browsers on our computers. We know 

that that is not the intent of this bill but as written it could reach 

that breadth, and so we would urge the committee to recognize 

that while some effort should be made, it is important to enhance 

security. We also want to ensure that the technological progress 

and growth proceeds and that will benefit all users of legitimate 

software. 

So on behalf of BSA, thank you for this opportunity and look forward to your questions. 

[The prepared statement of Mr. Holleyman follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
50 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 58 here 72885A.035
51 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 59 here 72885A.036
52 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 60 here 72885A.037
53 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 61 here 72885A.038
54 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 62 here 72885A.039
55 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 63 here 72885A.040
56 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 64 here 72885A.041
57 

Mr. RUSH. The chair thanks the gentleman. The Mr. Chairman, 

Mr. Lafferty, for 5 minutes. 

STATEMENT OF MARTIN C. LAFFERTY 

Mr. LAFFERTY. Chairman Rush, Ranking Member Radanovich, 

subcommittee members, thank you for holding this important hearing. I am Marty Lafferty, CEO of the Distributed Computing Industry Association. 

Both of the bills under consideration have far-reaching consequences. Our expertise relates primarily to H.R. 1319. DCIA is 

a trade group focused on P2P and related technologies. Our mission 

is to foster commercial development of these technologies so that 

their benefits can be realized by all participants in the distribution 

chain including content rights holders and Internet service providers. We currently have 125 member companies including P2P, 

cloud computing, file sharing and social network software distributors, broadband operators, content providers and service and support companies. P2P has evolved greatly in the 8 years since 

Napster first brought the term P2P file sharing to prominence. 

Fully licensed ad-supported P2P, subscription P2P, paid download 

P2P, commercial enterprise P2P, P2P TV, hybrid P2P and live P2P 

streaming now deserve to be separated from the narrow subset of 

functionality associated with file sharing. DCIA member companies 

increasingly use P2P for the delivery of authorized entertainment 

and corporate communications content where rights holders rather 

than end users introduce files or live streams for online delivery. 

We strongly urge the committee to apply the term ‘‘file sharing’’ 

without the P2P prefix as a more accurate descriptor for the focus 

of H.R. 1319. 

The Committee on Oversight and Government Reform held a 

hearing on this topic in July 2007 at which one of our member companies testified. Within weeks of that hearing, the DCIA established the Inadvertent Sharing Protection Working Group. Over 

several months we recruited participants among leading P2P and 

other tech sector companies and engaged with FTC staff to address 

issues associated with unintended publishing of confidential data 

by file sharers. This effort began by providing demonstrations for 

FTC staff of how current file share programs work in terms of 

users uploading material for distribution. It continued through a 

process involving private sector and regulatory participants to develop a program of voluntary best practices for file-sharing software developers to protect users against inadvertently sharing personal or sensitive data. This program was announced in July of 

2008. Its summary, included in our written testimony, begins by 

defining terms relevant to 1319 such as recursive sharing, sensitive 

file types and user-originated files. It then outlines seven steps 

that are required to be in compliance: default settings, file-sharing 

controls, shared folder configurations, user error protections, sensitive file type restrictions, file sharing status communications and 

developer principles. The principles address feature disablement, 

uninstallation, new version upgrades and file-sharing settings. In 

August 2008, the DCIA announced that compliance monitoring 

would begin in December to allow developers time to integrate required elements of the ISPG program into their planned upgrades 


smartinez on DSK6TPTVN1PROD with HEARING
58 

and new releases. Compliance monitoring resulted in reports from 

top brands that use P2P for downloading, live streaming, open environment sharing and corporate Internet deployments and for 

both user-generated and professionally produced content. Specifically, seven leading P2P representative program distributors submitted detailed reports to FTC staff in February 2009. In March 

the DCIA prepared and submitted a summary. We also noted that 

software implementations of the popular BitTorrent protocol typically require users to conduct a deliberate conversion process from 

whatever native file format their content is in to a torrent file before it can be published, thus minimizing this risk of user error. 

The entire report plus data tables of individual company submissions are in our written testimony but here are highlights. 

All respondents now have clearly disclosed install default settings that only permit sharing files downloaded from the network. 

They do not share user-generated files by default. A hundred percent also provide complete uninstallation of their file-sharing software that is simple to do and explained in plain language, for example, by using the standard add/remove program in Windows. 

And six out of seven, which is all where this is applicable, now 

offer a simple way to stop sharing any folder, subfolder or file by 

using easily accessed controls. 

In April 2009, subcommittee staff invited the DCIA to participate 

in redrafting H.R. 1319. We formed a DCIA member subgroup to 

conduct this work. The process is underway and we are glad to coordinate that work with staff. Among our greatest concerns is that 

the bill as drafted would have unintended consequences. The 

present draft goes way beyond the specific concerns discussed here 

and would apply to additional functionality and technologies that 

have nothing to do with recursive sharing of sensitive file types. 

Applying these requirements to numerous products, services and 

companies would be burdensome and counterproductive. To the extent that legitimate consumer concerns persist in the area that the 

bill intends to address, we strongly believe they can best be handled by ongoing self-regulation under the oversight of the appropriate federal authority as we initiated with the ISPG. 

The bill as constructed would unnecessarily burden U.S.-based 

technology firms with innovation freeze and constraints while being 

unenforceable against overseas competitors’ software available to 

U.S. consumers. The great concern also is how it might stifle yet 

undeveloped new and potentially very useful and valuable software 

applications. On the other hand, the DCIA has committed to selfregulation through the ISPG to address the subject matter of this 

bill and is making substantial progress. So rather than a problematic new legal measure, we believe that formalized requirements 

for compliance with that process will be more effective in achieving 

the purpose of the bill. 

We look forward to working with the subcommittee on these 

issues in a productive manner and will benefit all your constituents. Thank you for your continued interest in our industry. 

[The prepared statement of Mr. Lafferty follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
59 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 68 here 72885A.042
60 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 69 here 72885A.043
61 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 70 here 72885A.044
62 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 71 here 72885A.045
63 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 72 here 72885A.046
64 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 73 here 72885A.047
65 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 74 here 72885A.048
66 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 75 here 72885A.049
67 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 76 here 72885A.050
68 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 77 here 72885A.051
69 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 78 here 72885A.052
70 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 79 here 72885A.053
71 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 80 here 72885A.054
72 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 81 here 72885A.055
73 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 82 here 72885A.056
74 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 83 here 72885A.057
75 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 84 here 72885A.058
76 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 85 here 72885A.059
77 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 86 here 72885A.060
78 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 87 here 72885A.061
79 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 88 here 72885A.062
80 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 89 here 72885A.063
81 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 90 here 72885A.064
82 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 91 here 72885A.065
83 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 92 here 72885A.066
84 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 93 here 72885A.067
85 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 94 here 72885A.068
86 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 95 here 72885A.069
87 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 96 here 72885A.070
88 

Mr. RUSH. The chair thanks the gentleman. The chair now recognizes Mr. Pratt for 5 minutes for the purposes of an opening statement. 

STATEMENT OF STUART K. PRATT 

Mr. PRATT. Chairman Rush, Ranking Member Radanovich and 

members of the subcommittee, thank you for this opportunity to 

appear before you today. My name is Stuart Pratt, president and 

CEO of the Consumer Data Industry Association. Our 250 member 

companies provide our Nation’s businesses with data tools necessary to manage risk and a wide range of consumer transactions, 

and these products include credit, mortgage reports, identity 

verification tools, law enforcement investigative products, fraud 

check transaction identification systems, decision sciences technologies, location services and collections. My comments today will 

focus exclusively on H.R. 2221, and we applaud its introduction. 

CDIA’s members agree that sensitive personal information 

should be protected. We also agree that consumers should receive 

breach notices when there is a significant risk of them becoming 

victims of identity theft. Our members agree with the Federal 

Trade Commission recommendations which embrace these two concepts. I would only add that if a federal law is to be enacted, it 

should be a true national standard. 

We believe that data security and breach notification provisions 

in H.R. 2221 would be most effective if they were better aligned 

with requirements found in other current laws. Alignment is key 

to ensuring that all who are affected by the Act are successful in 

complying with new duties under DATA and also with their current duties found under other laws such as the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act. Let me discuss some of 

the ways that 2221 interplays with existing duties found in current 

laws. 

Section 56 defines the term ‘‘information broker.’’ Absent aligning 

this definition with other current laws, our members’ products will 

be affected. This bill would require information brokers to have 

reasonable procedures to verify the accuracy of personal information, provide consumers with access to these data and ensure a system by which consumers can dispute information. All of our members operate consumer reporting agencies as this term is defined in 

the Fair Credit Reporting Act. They produce data products defined 

as consumer reports. Consumer reports are used to make determinations of a consumer’s eligibility for a service or a product and 

the FCRA establishes duties for accuracy, access and correction as 

it relates to these products. Our members agree that where data 

is used to make a decision regarding consumers’ eligibility for a 

product or service, consumers should have these rights. 

Since there are similar duties under the FCRA and DATA, we 

propose the definition of information broker should be amended to 

exclude the term ‘‘consumer reporting agency’’, and while we appreciate the inclusion of section C3C which attempts to address our 

concern, we believe that since the FCRA’s duties are well understood and the FTC has direct enforcement powers, that we should 

have a complete exemption. 


smartinez on DSK6TPTVN1PROD with HEARING
89 

Regarding disclosure, section C3 allows an information broker 

under certain circumstances to not disclose personal information to 

a consumer. This section does not exempt an information broker’s 

fraud prevention tool from the duty to verify accuracy. Fraud prevention tools are designed to identify the possibility of fraud and 

to apply an accuracy standard of fraud prevention tools is unworkable since these tools are designed to warn a lender or utility or 

other business about the possibility of fraud. Fraud prevention 

tools consider how data has been used in previous identified cases 

of fraud and employ many other relational strategies. We would 

urge the expansion of C3B to include fraud prevention tools so that 

they are completely exempted from the accuracy standard requirement, not because the tools are designed poorly but because these 

tools cannot line up with an accuracy standard in the first place. 

Your bill also as indicated establishes both a requirement for 

data security and a requirement for security breach and we have 

absolutely no qualms about either of those requirements. Our 

member in fact comply with those types of requirements today and 

our only request is that where our member companies are already 

operating as a consumer reporting agency under the Fair Credit 

Reporting Act or where they are operating as a financial institution 

under the Gramm-Leach-Bliley Act, that they would be exempted 

from these data security and these security breach notification duties because they already have those duties under the Fair Credit 

Reporting Act and also under the Gramm-Leach-Bliley Act and in 

particular the safeguards rules which include breach notification. 

So this process of alignment will make this bill more effective. If 

we can make this truly a national standard, you certainly will have 

filled some gaps along the way. I think that Mr. Sohn said it very 

well. In the meantime, we live with a range of State laws. We have 

worked constructively with many, many States in establishing 

those statutes and in establishing definitions of the crime of identity theft and we will continue to do that and we look forward concurrently to working with you in the committee. Thank you. 

[The prepared statement of Mr. Pratt follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
90 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 100 here 72885A.071
91 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 101 here 72885A.072
92 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 102 here 72885A.073
93 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 103 here 72885A.074
94 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 104 here 72885A.075
95 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 105 here 72885A.076
96 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 106 here 72885A.077
97 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 107 here 72885A.078
98 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 108 here 72885A.079
99 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 109 here 72885A.080
100 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 110 here 72885A.081
101 

Mr. RUSH. The chair thanks the gentleman, and now the chair 

recognizes Mr. Rotenberg for 5 minutes. 

STATEMENT OF MARC ROTENBERG 

Mr. ROTENBERG. Mr. Chairman, Mr. Radanovich, members of the 

committee, thank you very much for the opportunity to be here 

today. EPIC is a nonprofit research organization here in Washington. 

We have a particular interest in this issue of security breach notification. EPIC was the organization that had urged the Federal 

Trade Commission to investigate the data practices of a company 

called ChoicePoint because we believed that that company was 

making the personal information of American consumers vulnerable to misuse. The FTC did not heed our warning and instead we 

all read in the newspapers when an investigation broke in Los Angeles that revealed that the records of 145,000 American consumers had been sold to a criminal ring engaged in the act of identity theft. I promise you, after that news story appeared, the FTC 

and many State attorneys general became very interested in this 

problem. 

Now, we learned of the problem with ChoicePoint in part because 

of a good law that had been passed in the State of California which 

required companies that suffered from a security breach to notify 

people who are impacted, and as a result of the ChoicePoint notification, many other States began to understand the need for security breach notification. Now, this has been an evolving process. I 

think there are now 44 States in the United States that have security breach notification, and while we certainly support an effort to 

establish a high standard across the country, I do want to warn 

you that one of the consequences of this bill would be to effectively 

tie the hands of the State from further updating their laws or enforcing stronger laws, and I think this would be a mistake. I read 

recently, for example, that the California State Senate has just approved new changes to its notification law that would provide individuals with better information about the type of personal information that was improperly disclosed and how it might be misused. 

This need to be able to continue to update security breach notification I think should be a consideration as the committee looks at 

legislation to establish a national standard. 

One of the other points I would like to make about the legislation 

concerns the relationship in the realm of notification between the 

individuals who are impacted and the role of the Federal Trade 

Commission, which is also notified under the bill. There is understandable concern that if individuals receive too many breach notices, they will serve no purpose, and so there is a need to set a 

standard so that people are not receiving lots and lots of these notices which they will come to ignore. But with respect to the role 

of the Federal Trade Commission, I think the bill could be 

strengthened by requiring companies in all circumstances to notify 

the Commission where substantive breaches have occurred, and 

moreover to put on the Commission an obligation to be more transparent about the information that it receives regarding the problems of breach notification in the United States. There is also a 

risk with the legislation as it is currently drafted that the FTC will 


smartinez on DSK6TPTVN1PROD with HEARING
102 

obtain information about security breaches, may choose not to act 

on the information it receives and that information will effectively 

remain secret both to the public and to this committee and the 

problem will continue to grow, so I hope that is an area that can 

be considered as well. 

We talk also about the safe harbor provisions, essentially companies that have certain security practices such as encryption should 

be encouraged to put in place and maintain those practices but 

again we think that notification can be made to the Federal Trade 

Commission in those instances where security breaches occur even 

if it may not be necessary to notify the target population. 

Finally, I would like to point out that since when the bill was 

originally introduced there have been significant changes both in 

the Internet and also in communications technology. Facebook, for 

example, now has 200 million users. Four years ago when this bill 

was first considered, there were many, many fewer people using 

these social network services. This has two implications. First of 

all, there is a new way to notify people online. It is no longer necessary to talk just about a website but also a social network presence. It also means that there is a new risk in data collection that 

needs to consider the growing significance of social network services. And finally, I might mention that text messaging has become 

a very effective way to notify people about things that might concern them regarding security. We propose in our testimony that 

where possible, text messaging be used as a supplement to the 

other notification procedures including mail and e-mail. 

So thank you again for the chance to testify and I would be 

pleased to answer your questions. 

[The prepared statement of Mr. Rotenberg follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
103 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 113 here 72885A.082
104 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 114 here 72885A.083
105 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 115 here 72885A.084
106 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 116 here 72885A.085
107 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 117 here 72885A.086
108 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 118 here 72885A.087
109 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 119 here 72885A.088
110 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 120 here 72885A.089
111 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 121 here 72885A.090
112 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 122 here 72885A.091
113 

Mr. RUSH. The chair now recognizes Mr. Boback for 5 minutes. 

STATEMENT OF ROBERT BOBACK 

Mr. BOBACK. Chairman Rush, Ranking Member Radanovich and 

distinguished members of the committee, I thank you for giving us 

the opportunity to testify here today. 

As many of you discussed in your opening statements the security risks associated with peer-to-peer, our company, Tiversa, which 

I am the CEO of, has unique insight on this in that Tiversa has 

the unique technology that allows us to span out globally to see all 

information that is occurring on all the peer-to-peer clients, so it 

is just a Lime Wire or a Kazaa or a BearShare, it is everyone, all 

encompassing, and we see it in real time. So therefore this provides 

us a great insight to provide information to the committee here 

today. 

This information that we are finding is very sensitive. There are 

security measures. I commend the Honorable Ms. Bono Mack for 

bringing this here today. The reason why is that many security 

professionals around the world in high-ranking positions in corporations in the United States and abroad aren’t even aware of 

this, so again, for her insight to bring this to the committee and 

bring 1319 forward, it is very important, because, again, the awareness is still not where it needs to be. For instance, in the last 60 

days, despite the measures that have been taken by the peer-topeer clients, despite which I also admit are improving, Lime Wire 

is improving its protocols to decrease the amount of breaches that 

have happened, but in the last 60 days Tiversa has downloaded 

breaches in the amount of 3,908,000 breaches, individual breaches 

in the last 60 days. I find it very important that 2221 and 1319 

are actually discussed on the same day. The reason why is, this is 

where breaches are happening. As Mr. Gingrey of Georgia called 

out, obviously we all saw the Wall Street Journal article April 21st 

about the Joint Strike fighter. It wasn’t reported in the Wall Street 

Journal, this was peer-to-peer. The information unfortunately is 

still on the peer-to-peer. This was discovered in January 2005. We 

discovered it. We reported it to the DOD. It is still here. It is still 

out there. It has never been remediated. Awareness is not where 

it needs to be. Oversight is not where it needs to be in order to address these problems. That is the type of national security ends. 

Now, there are also the consumer ends. From Tiversa, we process 

1.6 billion searches per day every day. Google is about 1.7 billion 

per day, so we were about nine times what Google is processing on 

a daily basis. In those searches we are able to see what the users 

are looking for around the world, and in those searches we see people searching for your financial records. They are not looking to 

apply for a credit card. They are not looking for health insurance. 

They are looking for your health insurance because they want to 

quickly go online and buy online pharmaceuticals using your medical insurance card as medical identity theft. No credit monitoring 

will stop that. They want to get your Social Security number filed 

with your tax return. We did a study with the Today show showing 

that in that instant 275,000 tax returns were found in one search 

on the peer-to-peer, so a minimum of 275,000 Social Security numbers on one time. Now, we have done other searches where it has 


smartinez on DSK6TPTVN1PROD with HEARING
114 

been over half a million on one time and yet I would also strongly 

urge the FTC that on the website where it would identify to users 

that this information is coming from the peer-to-peer, there is not 

one mention of peer-to-peer on where are they getting your information. Nine million victims every year of identity theft and the 

number one mention on the FTC’s website is dumpster diving. It 

doesn’t add up. The numbers don’t add up to dumpster diving. Consumers are not aware of this problem, not from a national security 

standpoint. Executives don’t know it. Security executives do not 

know this problem. Consumers aren’t aware of this problem. They 

need to know that their information is out there and it is being 

sought after on an enormous scale such that even in our research 

in the last few months we have had a 60 percent increase in 

searches for information that will lead to identity theft and fraud. 

This is a serious growing problem that consumers again are not 

aware of, so we applaud 2221 for a national breach. I will tell you 

that as we find these breaches, these 3,900,000 breaches, as we can 

we return the information and alert the companies to the breach. 

Again, we do it out of our duty of care policy. There are no strings 

attached to that. 

I will tell you that there are thousands of cases that our employees have provided to users, to companies nationwide that they completely disregard the breach. Many of those are actually cited in my 

written testimony, so you would think that you are safe if you do 

not use peer-to-peer. Well, I will show you in the written testimony 

there are users out there that all they did was go to the hospital 

and they provided their information there and now that is one of 

the things, so individuals need to have an identity theft protection 

service as well as a national breach notification such as 2121, and 

I thank you for the opportunity and welcome questions. 

[The prepared statement of Mr. Boback follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
115 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 126 here 72885A.092
116 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 127 here 72885A.093
117 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 128 here 72885A.094
118 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 129 here 72885A.095
119 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 130 here 72885A.096
120 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 131 here 72885A.097
121 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 132 here 72885A.098
122 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 133 here 72885A.099
123 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 134 here 72885A.100
124 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 135 here 72885A.101
125 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 136 here 72885A.102
126 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 137 here 72885A.103
127 

Mr. RUSH. Thank you very much. Now the chairman recognizes 

Mr. Sydnor. Mr. Sydnor, you are recognized for 5 minutes for opening statement. 

STATEMENT OF THOMAS D. SYDNOR 

Mr. SYDNOR. Thank you, Chairman Rush, Ranking Member 

Radanovich and members of the subcommittee. My name is Thomas Sydnor and I am a senior fellow at the Progress and Freedom 

Foundation. I am here speaking today on my own behalf, and I am 

also the author of two studies on the causes of inadvertent file 

sharing, File-Sharing Programs and Technological Features to Induce Users to Share, published by the United States Patent and 

Trademark Office, and Inadvertent File Sharing Revisited, published by the Progress and Freedom Foundation, and I am here 

today to testify in support of H.R. 1319, the Informed Peer-to-Peer 

User Act. 

Mr. RUSH. Mr. Sydnor, would you please excuse me just for a moment? I want to alert the members that there is a little over 5 minutes for a vote, a three-series vote. There are three votes in the series, and that will be the last votes of the day. So if members want 

to leave to go and vote after this witness completes his opening 

statement, then the chair will recess the committee and reconvene 

at the conclusion of this series of votes. So we would ask that the 

members please return promptly so that we can complete the questioning of these witnesses and complete this hearing. 

Mr. Sydnor, would you please continue? 

Mr. SYDNOR. Thank you, Mr. Chairman. 

I am testifying today in support of the bill because my written 

statement and my past published work on inadvertent sharing I 

think shows that in the past we have tried to rely on voluntary 

self-regulation and it has failed. Voluntary self-regulation should 

be an incredibly important part of our technology policy and for 

that reason it must be taken seriously. Unfortunately, in the context of distributors of filing sharing programs used mostly for unlawful purposes, it has been tried, voluntary self-regulation. It has 

failed miserably in the past, and I can report that it is failing again 

right now. 

I want to consider just as an example the file-sharing program 

Lime Wire 5. The DCIA has hailed Lime Wire 5 as the gold standard for the implementation of its new voluntary best practices, and 

Lime Wire itself has a result of this hearing generated great publicity for itself by telling Congress that at long last Lime Wire 5 

put the final nail in the coffin of inadvertent sharing of sensitive 

files, and the program is that last statement is not even arguably 

correct, and to show why, I want you to consider a hypothetical 

based upon the recent reports from Today Investigates showing 

that in New York State alone researchers could find over 150,000 

inadvertently shared tax returns. The report also showed the realworld consequences of inadvertent sharing by profiling the Bucci 

family, who had their tax returns stolen by an identity thief because they had inadvertently shared their tax returns because 

their preteen daughters were using a file-sharing program reported 

to be Lime Wire. But the real problem in such a case is that a tax 

return is really only the tip of the iceberg. Such episodes usually 


smartinez on DSK6TPTVN1PROD with HEARING
128 

occurring mean that a family is sharing all of its personal data file 

stored on the family computer. All the parents’ work and personal 

documents, scans of legal, medical and financial records, scanned 

documents providing identifying information about the family’s 

children, all of the family’s digital photos, all of its home videos, 

entire music collection, probably thousands of files. 

Now, consider two families that have been affected by this type 

of catastrophic inadvertent file sharing, and just assume it was 

caused by an earlier version of Lime Wire. Consider what happens 

if they upgrade to Lime Wire 5. One family doesn’t know they have 

a problem. They are unaware that a problem exists but they hear 

reports like Lime Wire 5 has ensured the complete lockdown of the 

safety and security of Lime Wire users and so they upgrade to 

Lime Wire 5. Will that correct their inadvertent sharing of sensitive documents problem? It will not. By default, simply by being 

installed, the family will continue to share documents that are by 

any a reasonable definition sensitive. They will continue to share 

the family photo collection. They will continue to share scanned 

legal, medical and financial records, perhaps even tax returns, continue to share data about their children. They will continue to 

share all their home videos. They will continue to share their entire music collection. So they will continue to be exposed to the full 

range of risks: identity theft, data on their children getting into the 

hands of the pedophiles that use their networks, and the risk of a 

lawsuit. 

Now, the other family does know their problem. They detect it 

and they resolve it by uninstalling Lime Wire, remove it from their 

computer. So this family actually has put the final nail in the coffin 

of their inadvertent file-sharing problem but they hear about Lime 

Wire, they kids reinstall it because now it is completely secure. 

What will happen? By default, simply by being installed, that program will revive, will call back from the dead the family’s inadvertent file-sharing problem. It will automatically begin re-sharing 

all the data files that were shared before except for some types 

simply by being installed. That is not acceptable behavior, it is not 

acceptable practice, and I think it indicates why the committee 

should be commended for its work on H.R. 1319. Thank you. 

[The prepared statement of Mr. Sydnor follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
129 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 140 here 72885A.104
130 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 141 here 72885A.105
131 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 142 here 72885A.106
132 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 143 here 72885A.107
133 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 144 here 72885A.108
134 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 145 here 72885A.109
135 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 146 here 72885A.110
136 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 147 here 72885A.111
137 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 148 here 72885A.112
138 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 149 here 72885A.113
139 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 150 here 72885A.114
140 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 151 here 72885A.115
141 

Mr. RUSH. The chair thanks this witness and all the witnesses. 

Now the chair will ask that this committee stand in recess until 

such time as we return from a series of three votes. I would ask 

the witnesses if you please would wait so that the members can 

come back and ask questions. Thank you so much. The committee 

is in recess. 

[Recess.] 

Mr. RUSH. The hearing will now come to order. The chair recognizes himself for 5 minutes for the purposes of questioning the witnesses. 

I would like to start out with some very simple questions to get 

on the record how the witness may view the legislation we are contemplating today. I will ask each and every one of you if you would 

just answer with a yes or no if you can, and if not, give me a very 

brief explanation of your answer. So my first question is with regard to H.R. 1319, do you support the legislation in its current 

form? If not, do you support the intent of the bill with revisions? 

And my second question, do support H.R. 2221 as it is currently 

drafted? If not, do you support the intent of the bill with some revisions? I will start with Mrs. Harrington. 

Ms. HARRINGTON. The Federal Trade Commission strongly supports the intent of both bills. We would like to continue working 

with committee staff on revisions to each but we are very—and we 

are particularly supportive of the enforcement authority and tools 

that both bills give the FTC of civil penalty authority. 

Mr. RUSH. Thank you. 

Mr. Sohn? 

Mr. SOHN. CDT has significant reservations about H.R. 1319 as 

drafted but we certainly support the intent. We do think it may be 

tricky to figure out the drafting details but we are certainly happy 

to work with the committee on that. On H.R. 2221, we generally 

do support the bill as drafted. There are some modifications we 

have suggested and we absolutely support the intent. 

Mr. RUSH. Thank you. 

Mr. Holleyman? 

Mr. HOLLEYMAN. I actually agree fully with Mr. Sohn’s comment 

that we support the intent of both bills. We have some recommendations in our written testimony. I believe strongly that action is needed. I think it may be more difficult to make some of the 

definitions in 1319 but are certainly eager to work with the committee to ensure the intent is fulfilled. 

Mr. RUSH. Mr. Lafferty? 

Mr. LAFFERTY. I will just speak to 1319. We absolutely support 

the intent of the bill, the clear, conspicuous notice and the informed 

consent for very important file-sharing modalities that could have 

major impact on consumers. We just don’t think it can be legislated. We have worked hard to try to come up with suggestions for 

a redraft and it is very difficult to get the language not to reach 

out and touch other kinds of technologies and future software applications that would be impacted and disadvantage U.S. firms 

from overseas competitors. So we support the intent but not the 

language. 

Mr. RUSH. Mr. Pratt? 


smartinez on DSK6TPTVN1PROD with HEARING
142 

Mr. PRATT. The CDIA has no position on H.R. 1319. With regard 

to H.R. 2221, we certainly support the intent. We have outlined in 

our written testimony the range of suggestions about how we could 

align the bills with other federal laws and if we could accomplish 

that goal, I think we would feel more comfortable with the final 

work product. Thank you. 

Mr. RUSH. Thank you. 

Mr. ROTENBERG. Mr. Chairman, we do support the intent of H.R. 

2221 and generally support the legislation as drafted. We have a 

number of suggestions in our testimony for how to strengthen it. 

With respect to 1319, we don’t have a position for or against the 

bill. With respect to the intent behind 1319, we think it may be 

possible to get to some of the concerns regarding security through 

other legislation but we would certainly be happy to work with the 

committee to see how it can be accomplished. 

Mr. RUSH. Mr. Boback? 

Mr. BOBACK. Mr. Chairman, we strongly support both 2221 as 

well as 1319 in clearly raising awareness and providing some responsibility and structure to a very needed process both on the 

peer-to-peer as well as just federal data breach notification. 

Mr. SYDNOR. Mr. Chairman, I will confine my comments to H.R. 

1319. Yes, absolutely strongly support the intent of the bill. I am 

aware that there are legitimate concerns about making sure that 

we don’t necessarily sweep in entirely—potentially entirely legitimate uses of peer-to-peer technology and would be happy to continue to work with the committee and anyone else to try to get to 

a place where everyone is comfortable. 

Mr. RUSH. The chair thanks the witnesses. The chair’s time is 

concluded. The chair now recognizes Ms. Bono Mack from California for 5 minutes for questioning. 

Ms. BONO MACK. I thank the chairman and our panelists also for 

your time today. 

Mr. Lafferty, I would like to read to you a bolded warning in the 

user guide on the Lime Wire website entitled ‘‘Using Lime Wire 

and P2P software safely.’’ The warning states, and I quote, ‘‘Please 

ensure that any folder on your computer that contains personal information is not included in your Lime Wire library.’’ So tell me, 

Mr. Lafferty, if I were to complete a default installation of Lime 

Wire 5.1.2, what files and folders will the mere installation of the 

program included in my Lime Wire library? 

Mr. LAFFERTY. With Lime Wire 5 and later versions of Lime 

Wire, sensitive file types, which are a large number of extensions 

of files to protect your spreadsheets, your Word documents, PDFs, 

things that might have sensitive data, are unshared by default. So 

I would completely refute the testimony of Tom Sydnor earlier. It 

just isn’t true. When you—neither example that he gave with the 

family that kept—just upgraded the version or the one that 

uninstalled it and reinstalled it, in both cases all the sensitive file 

types are unshared by default. It is over. They are no longer 

accessed or shared. To re-share any of those files, you would have 

to individually take the file and go through—ignore several warnings to put those individual files into the mode where they could 

be shared and then be asked whether you want to share that with 

specific friends or the network at large. So Lime Wire 5 has done 


smartinez on DSK6TPTVN1PROD with HEARING
143 

away with the concept of shared folders really and now it is a fileby-file— 

Ms. BONO MACK. There are specific warnings? What do they say? 

And it is not—it is still actually sort of an inherent default. You 

have little boxes that come up. I believe there are four different 

boxes that are there. And one does say my documents, so you just 

that that could be an Excel spreadsheet which in fact would probably be saved under a my documents folder, would it not? 

Mr. LAFFERTY. If you chose to put the my documents folder into 

a shared mode, it would still— 

Ms. BONO MACK. Is that the default for an Excel spreadsheet for 

the standard user? 

Mr. LAFFERTY. I don’t understand the question. 

Ms. BONO MACK. Where is a default Excel spreadsheet saved on 

your computer, on your hard drive? Is it not necessarily defaulted 

to my documents? 

Mr. LAFFERTY. It is probably different for every person, but the 

point is— 

Ms. BONO MACK. Probably different? What is the default? Where 

does—Mr. Sydnor, perhaps you have the answer to that. 

Mr. LAFFERTY. It doesn’t really matter where it is that. That file 

type won’t be shared. 

Ms. BONO MACK. How could it not matter? With all due respect, 

how could it not matter where it is? That is the root of the whole 

problem here. 

Mr. LAFFERTY. Because it won’t be shared. 

Ms. BONO MACK. Unless you check simply one of the four— 

Mr. LAFFERTY. Unless you choose that individual file if it has 

that Excel spreadsheet. 

Ms. BONO MACK. That individual file? 

Mr. LAFFERTY. Individual file, correct. 

Ms. BONO MACK. Mr. Sydnor, do you care to comment on that? 

Mr. SYDNOR. Yes. That is not quite an accurate statement about 

how the Lime Wire my library feature works. My library in Lime 

Wire 5 basically are the set documents that are going to be managed in Lime Wire and thereby that set of documents is going to 

be much easier to share because they are going to be in the library 

and there will be a button to click to share them, and that is why 

Lime Wire users’ guide has the warning that you read, please ensure that any folder in your computer that contains personal information is not included in your Lime Wire library. Now, by default 

when you install Lime Wire 5.1, and I did it last night again, the 

default option is to have Lime Wire put all the files stored in your 

my documents folder and all of its subfolders into the Lime Wire 

library. That alone will not share them but it will make them 

available for sharing and much easier to share and therefore the 

behavior of the program simply not consistent with the advice in 

the users’ guide. As to my testimony earlier, it was quite correct. 

The difference—the reason I think we are getting confused is, when 

I say sensitive files, I mean files that would actually be sensitive 

to share over a network like Gnutella so you have, for example, 

scans of your family medical records and tax returns, those can be 

stored in image file formats often and those will be shared by default, and if you upgrade to Lime Wire 5, it will continue to share 


smartinez on DSK6TPTVN1PROD with HEARING
144 

those file types if you were sharing them before, and if you install 

Lime Wire 5 on your computer and a previous version of Lime Wire 

has ever been there, then it will automatically begin re-sharing 

files that were shared previously. So simply installing the program 

can indeed resume sharing of files even if you are installing on a 

computer where there is no version of Lime Wire currently installed. I am correct about that. I reran the test again this morning 

before the hearing. 

Ms. BONO MACK. Thank you. I know my time is expired and I 

hope we have a second round. Thank you, Mr. Chairman. 

Mr. RUSH. The chair intends to have a second round. The chair 

now recognizes the gentleman from Georgia, Mr. Barrow, for 5 

minutes. 

Mr. BARROW. I thank the chair. I want to try and get my arms 

around the inadequacy of the current situation and talk about 

what it is this legislation proposes to do in order to try and alter 

the situation for the better. 

Ms. Harrington, am I correct in understanding that there are 

very limited tools available to the FTC right now to deal with this 

issue, that basically the only option you have under current law is 

to initiate a specific enforcement action against somebody, a factspecific action based on a specific instance and that basically you 

are pretty much limited to, is it adjunctive proceedings? Is that 

about the extent of it? 

Ms. HARRINGTON. That is right. 

Mr. BARROW. No civil penalties whatsoever? 

Ms. HARRINGTON. No civil penalties. 

Mr. BARROW. No rulemaking authority, no prescribing of proper 

procedures or best practices, you just have to go after individual 

cases and all you can do is tell folks to stop doing what they are 

doing when you prove that they have done it? 

Ms. HARRINGTON. The rulemaking authority available to the 

Commission is under the Magnusson-Moss amendments to the FTC 

Act and those are laborious and take a very long time, the procedures to use. 

Mr. BARROW. So what we are proposing to give the FTC under 

1319 would give you all some authority you don’t have right now. 

Are the civil penalties helpful to you all in trying to bring some 

order to this situation? 

Ms. HARRINGTON. There are two things that are helpful. Civil 

penalty authority is very helpful, and also to the extent that some 

practices in these very fact-specific situations might be injurious 

but neither deceptive nor unfair, then having additional statutory 

authority is very helpful. 

Mr. BARROW. Earlier on in the testimony, we heard some folks 

raise some issues about the international end of things. We all 

know we are connected to a worldwide web and that any effective 

regulation of this marketplace in our country is going to involve 

dealings with folks who can cross the boundaries in cyberspace 

pretty much at will. What was your concern, if not the 

extraterritoriality of the law, the extraterritorial effect of us being 

able to regulate this? How do you think we can address that supposed shortcoming of us attempting to regulate this on our own 

shores? 


smartinez on DSK6TPTVN1PROD with HEARING
145 

Ms. HARRINGTON. Well, first of all, the subcommittee was instrumental in giving the Commission additional authority under the 

U.S. Safe Web Act, which we used to get information about overseas targets and to enlist help from other governments and that is 

very useful. But that said, if there are overseas software providers 

who are making available file-sharing software that is injurious to 

U.S. consumers, we can certainly assert our jurisdiction over those 

practices that occur within the United States but we may not be 

able to reach the purveyors if they are in other countries and particularly in countries that aren’t particularly interested in helping 

out. 

One of the things that we are very concerned about is that the 

dominant players in this industry, which are in the United States, 

do the best thing and the right thing and we think that setting 

some legislative standards such as the ones that are set forth in 

the bill would really help. We want the U.S. players to be the best 

players so that they continue to be the dominant players and the 

ones that consumers can use with some confidence. 

Mr. BARROW. The impression I get from what you are saying, 

this is how I hear what you are saying, is that if we police the marketplace where everybody shops, we don’t have to worry about the 

marketplace where few very people shop or hardly anybody goes. 

Is that a fair way of putting it? 

Ms. HARRINGTON. Well, we certainly should police the marketplace where everybody stops if that marketplace is subject to our 

jurisdiction. 

Mr. BARROW. But the high-volume users, the ones that have the 

lion’s share of the market, if we can make sure that what they are 

doing is right and appropriate and folks who trade at these places 

will not have to worry about losing their stuff, we don’t have to 

worry quite so much about those areas that might be hard to reach. 

Why strain at a gnat and swallow an elephant in the process. 

Ms. HARRINGTON. You know, that is certainly the intention. 

There is always a risk that overseas operators can gain in market 

share in the United States by doing—you know, by gaining some 

sort of competitive advantage over the regulated entities in our 

marketplace but, you know, that is not a worry right now that is 

keeping me awake at night. 

Mr. BARROW. I will wait for a second round, Mr. Chairman. 

Thank you, ma’am. 

Mr. RUSH. Thank you. 

The chair now recognizes the gentleman from Louisiana, Mr. 

Scalise, for 5 minutes. 

Mr. SCALISE. Thank you, Mr. Chairman. Really I can open this 

up to the whole panel on H.R. 1319. Do you think this will help 

prevent a legal use of peer-to-peer software including stealing personal records, copyright violations and things like sharing child 

pornography? 

Ms. HARRINGTON. I think it will help under some circumstances 

and under others we need more. The data security bill actually 

could be very helpful here too because, as I mentioned in my oral 

statement, there are really three scenarios where sensitive information is shared. One is when consumers don’t know, don’t understand, and this bill will hopefully go a long way I think there. It 


smartinez on DSK6TPTVN1PROD with HEARING
146 

is not going to help when the problem is malware, and it is not 

going to help when the problem is a business that has not prohibited and barred from its system and its computers file-sharing software and it is not going to help if the problem is that an employee 

of a company takes sensitive information home and puts it on his 

or her computer and that computer has file-sharing software or 

malware on it that extracts that, so it is going to go a long way 

to help in scenario one. 

Mr. SCALISE. Anybody else want to touch on that? 

Mr. SOHN. I will just say I do think the intent and the focus of 

the bill is certainly on the inadvertent disclosure so that the privacy-related concerns, I think that would be the main impact and 

is the main thrust of the bill. 

Mr. SCALISE. Let me ask about the data breaches that have occurred, I think FTC had dealt with it, the largest one I have seen, 

the TJX, which I think initial estimates were about 45 million 

Visa/MasterCard records were breached. Ultimately it turned out 

somewhere close to 100 million were breached, and you all had 

brought charges against them, and subsequently other companies. 

Is there now an industry standard for data protection? What is 

your feeling on where we are today versus some of those cases a 

few years ago? 

Ms. HARRINGTON. Well, there are certainly well-established good 

practices that in the cases that we have brought were not followed. 

For example, you know, downloading available patches, preventing 

against well-known attacks and kinds of attacks are well-settled, 

you know, necessary practices. They are not even best practices. 

They are necessary. And those companies did not follow those practices. 

Mr. SCALISE. Anybody else want to add anything to that? We are 

getting into now an area of moving towards electronic medical 

records. There was some funding language in the stimulus bill to 

start going down that road more as people’s health information 

gets put on the Web more and more. What kind of protections are 

there today, what kind do we need, whether it is in either these 

two bills or another vehicle to protect people’s health records as 

they become available on the Internet so that they are only available to the doctors who need to be reviewing them? 

Ms. HARRINGTON. Well, the Recovery Act also directed both the 

FTC and the Department of Health and Human Services to do 

rulemaking to set standards for breach notification when consumers’ sensitive health information is placed at risk. The FTC, as 

I mentioned, has just issued a proposed rule dealing with personal 

health records and other non-HIPAA-covered entities that may 

have this sensitive information to set breach notification standards 

and we are continuing also to work with HHS to do a report that 

is due back to Congress in a year on these issues. 

Mr. SCALISE. Any of you all doing any work on that issue? Mr. 

Boback? 

Mr. BOBACK. I would like to also comment on that. There are no 

standards as far as peer-to-peer notifications. There are no standards as far as peer-to-peer security measures. In fact, most companies don’t even have any standards on peer-to-peer. When asked, 

most corporations, large and scale, what information they are doing 


smartinez on DSK6TPTVN1PROD with HEARING
147 

about peer-to-peer, most people, if they respond at all will say that 

they are blocking peer-to-peer and that they have a policy against 

it. That is the extent of it. And I will tell you that—or they will 

say that they have a firewall or an encryption of which nothing— 

firewall does not stop peer-to-peer, encryption does not stop peerto-peer. Intrusion prevention detection and all the standard security measures do not peer-to-peer disclosures from happening, 

which is why in the past 60 days we have had, you know, almost 

4 million disclosures of this type via peer-to-peer because there is 

just no standards. 

Mr. SCALISE. And finally Mr. Holleyman. 

Mr. HOLLEYMAN. Mr. Scalise, we believe that the incentives that 

are in Chairman Rush’s bill that would encourage a marketplace 

to grow for companies who hold sensitive data to use proper security technologies to make that information inaccessible to anyone 

who might actually breach it, that those market-based incentives 

is a great supplement to the enforcement authority that the bill 

would give. So we think the two together can be effective. 

Mr. SCALISE. Thanks. I yield back, Mr. Chairman. 

Mr. RUSH. The chair intends to engage the members of the committee in a second round of questioning and we will allow each 

member an additional 2 minutes for the second round of questioning. The chair recognizes himself now for the second round and 

allocates 2 minutes for the purposes of questioning. 

Mr. Rotenberg and Mr. Sohn, is the definition of personal information under H.R. 2221, is it adequate in terms of data security? 

The bill only addresses financial information. Should we also consider requiring companies to secure sensitive information such as 

medical information or password numbers or et cetera? I mean, 

should we expand the definition of personal information? 

Mr. SOHN. Well, the bill has several different components, and I 

think for purposes of the breach notification component, the definition there is fairly close to what has been done in a lot of the 

States and it reflects a lot of what has been common in the data 

breach notification area. I think for purposes of something like security standards, asking companies to have reasonable procedures 

in place to protect data, there is no reason to restrict it to the rather narrow set of data that is in the definition of personal information now because what is currently in the bill only applies—it is 

not just name and address and some other information. There actually has to be either a Social Security number or a financial account number plus password or a driver’s license number, something like that. So I do think that the bill might consider using a 

broader definition of personal information for some purposes and 

the narrower definition for others. 

Mr. ROTENBERG. Mr. Chairman, in my written statement I made 

a suggestion on this issue of personal information. I do think it is 

appropriate to have a broader standard and also to recognize that 

some of the personal identifiers nowadays aren’t just limited, for 

example, to a Social Security number or driver’s license number. 

There are other types of personal identifiers like a Facebook member number or even the IP address associated with your computer 

that needs to be incorporated as well. So I think those changes can 


smartinez on DSK6TPTVN1PROD with HEARING
148 

be made both to get to more circumstances where the bill should 

reach and also new types of identifiers. 

Mr. RUSH. The chair thanks the witnesses. Now the chair recognizes the gentlelady from California for 2 minutes for additional 

questions. 

Ms. BONO MACK. I thank the chair for the second round. 

Mr. Holleyman, you testified that the P2P bill would cover more 

than just the illegitimate purpose software. You identified a number of legitimate uses of P2P software such as bicoastal collaboration on projects. I think you actually mentioned Palm Springs to 

Chicago airports collaborating. So this is of course when used correctly beneficial use of P2P software. So we all agree that this technology can be extremely helpful but if such programs are covered 

by H.R. 1319, what is the harm? How is notice and consent an 

issue? Back to the Palm Springs-Chicago, yes, I can see them collaborating on plans but I don’t think they necessarily want to collaborate on payroll numbers and the like. So how is notice and consent an issue in this case? 

Mr. HOLLEYMAN. Ms. Bono Mack, our sense is that there is a 

rapid growth in the legitimate uses of P2P, and that it will become 

a de facto part of how we use technology that most people will 

want to use. So our sense is as that part of the market grows, we 

want to ensure that the legislation doesn’t overreach to get into 

things which all of us would generally agree would not necessarily 

need—an initial notice that that is there is fine but the process of 

how you would then disable that needs to be clarified. 

Ms. BONO MACK. Which is growing faster, illegitimate or legitimate uses? 

Mr. HOLLEYMAN. I think our sense as technologists is—and I am 

not a technologist, I play one on TV, but not as technologists but 

our engineers and our companies believe that legitimate purposes 

of peer-to-peer in the next 10 years will certainly grow much faster 

than the illegitimate ones. 

Ms. BONO MACK. In the next 10 years, quickly in 10 seconds, Mr. 

Boback, which has grown faster, legitimate or illegitimate uses? 

Mr. BOBACK. I will tell you that legitimate uses are now emerging so while there is still a growth at this point because the awareness is still decreased and there is not enough awareness as to the 

problem, the legitimate uses and the distribution content is an absolute must going forward. So I am a supporter of peer-to-peer, 

however, the security measures just as in the early stages of the 

World Wide Web need to be addressed as in your bill 1319. 

Ms. BONO MACK. Thank you. 

Mr. RUSH. The chair now recognizes the gentleman from Georgia. 

Mr. BARROW. I thank the chair. I think Ms. Bono Mack is getting 

to the heart of the issue on the peer-to-peer legislation. If I could 

reframe the issue, we want to fix what is broke with this system. 

There is stuff out there that is inside this legislation’s definition of 

peer-to-peer file-sharing program that is malicious. There is stuff 

out there that is inside this definition that is perfectly benign. 

Mr. Holleyman and Mr. Sohn, I am going to pitch this one in you 

all’s direction. How would you all define what we are getting at in 

such a way as to stop the bad stuff and allow all the other stuff 

to continue without having to have a proliferation of warnings and 


smartinez on DSK6TPTVN1PROD with HEARING
149 

opt-outs that basically hobble this technology before it can even get 

started? Take a shot at how you would define this in order to be 

able to reach the stuff you want to reach. 

Mr. HOLLEYMAN. I will start on that, Mr. Barrow. In our testimony, we have actually listed five ways in which we would modify 

the definition in the bill and believe that if those types of changes 

are made, that that would be useful and would help preserve the 

intent of the bill including looking at the type of purposes that 

peer-to-peer file-sharing program is typically used for, going at 

many of those things like copyright infringements, which are a 

huge source of concern to— 

Mr. BARROW. Is that an effective way of defining it though so 

that the regulators can get at what is going on? 

Mr. HOLLEYMAN. We actually think that the regulators would— 

their hand would be strengthened by more precision in the definition rather than the breadth that is in there currently. 

Mr. BARROW. Mr. Sohn, what do you think? 

Mr. SOHN. I also set forth in my testimony some ideas on that 

point of how you might make this more narrow and apply to what 

we think of as file-sharing software. I agree with Mr. Lafferty’s testimony that the key here really isn’t peer-to-peer. Peer-to-peer is a 

kind of architecture. It is really about file-sharing functions that 

could enable documents and other kinds of files on a user’s local 

computer to be made available to third parties, you know, in bulk 

and third parties that haven’t been selected or aren’t even known 

to the user and so we propose four bullet points of items that we 

think could be in the definition but it tends to focus on that, the 

ability to share files with unknown parties with no intervening action or knowledge or selection by the user in terms of who that file 

will be shared with. 

Mr. BARROW. Mr. Chairman, my time is expired but I would like 

to ask the witnesses to go beyond that and actually be prepared to 

work with counsel and us to see if we can actually come up with 

some concrete language to accomplish this. Thank you. I yield the 

mic. 

Mr. RUSH. The chair now recognizes the gentleman from Louisiana for an additional 2 minutes. 

Mr. SCALISE. Thank you again, Mr. Chairman. 

These two bills might not necessarily be the vehicles for it but 

they might. It has been a problem for years, especially with identity theft getting worse with so many documents and authenticators that use Social Security numbers that require Social Security 

numbers to be used or documents that are public record that still 

require people to use Social Security numbers. A number of States 

have gone on their own and tried to ferret those out and prohibit 

Social Security numbers on public documents but it is not universal. There is no real standard still. I think there as standalone 

legislation, it might have been in the last Congress, that really 

didn’t go anywhere but there is a way that we can have some kind 

of standard to protect people’s Social Security numbers so that they 

are not required for certain documents or authenticators so that 

they are not so easily obtainable by third parties that are trying 

to take them for bad purposes? I will start it off with Ms. Harrington and anybody else that wants to take a shot. 


smartinez on DSK6TPTVN1PROD with HEARING
150 

Ms. HARRINGTON. Well, as part of the President’s identity theft 

task force work that we have been engaged in, there are couple of 

important initiatives that we are supporting. One, the task force 

brought about a government-wide examination of government uses 

of Social Security numbers with the goal of minimizing to circumstances where the number is absolutely essential, federal government agencies’ use of Social Security numbers, and I think a lot 

of progress has been made in the government on that. Number two, 

the FTC as part of the identity theft task force work convened a 

workshop and has continued to work on the question of authentication and how better authentication procedures and technologies can 

be developed so that something like the ubiquitous Social Security 

number is no longer needed. But there are lots of commercial settings right now where both consumers and businesses benefit from 

the use of Social Security numbers and may need them, and until 

we have much better authentication measures available, it is a 

very tough question to answer what to use instead of Social Security numbers. For example, consumers have really benefited in 

many instances from being able to quickly get a loan to get a car. 

That whole credit reporting system depends on Social Security 

numbers, and you know, we need a replacement but we don’t have 

one yet. 

Mr. SCALISE. And at least in the government sector where we can 

set up a mechanism where people aren’t required to have it on a 

document that is public record because— 

Ms. HARRINGTON. Right. 

Mr. SCALISE. —clearly in the government arena, there are 

records that are public and some of those records require a Social 

Security number, which obviously poses big, big security breach 

problems that have been documented. In this legislation, if there 

a way to maybe try to address that, I don’t want to interfere with 

the chairman or Ms. Bono Mack’s bill but if there is a way we can 

do something that doesn’t necessarily cause other problems on the 

other side we can try to address a narrow part of that problem. 

Mr. RUSH. The gentleman’s time is expired. 

Mr. SCALISE. Thank you. 

Mr. RUSH. The chair really just wants to again thank the witnesses. We have imposed on your time pretty significantly this 

afternoon and we certainly are appreciative of the fact that you 

have allowed us to do that and you have been a great panel. If you 

would be so kind, we want to keep the record open for at least 72 

hours until there might be members of the subcommittee who will 

in writing ask questions and if you would respond in writing within 

72 hours, the chair would certainly appreciate that. 

So thank you so very much again and you have really done this 

subcommittee quite a great service. The hearing now stands adjourned. 

[Whereupon, at 4:45 p.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 


smartinez on DSK6TPTVN1PROD with HEARING
151 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 162 here 72885A.116
152 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 163 here 72885A.117
153 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 164 here 72885A.118
154 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 165 here 72885A.119
155 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 166 here 72885A.120
156 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 167 here 72885A.121
157 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 168 here 72885A.122
158 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 169 here 72885A.123
159 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 170 here 72885A.124
160 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 171 here 72885A.125
161 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 172 here 72885A.126
162 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 173 here 72885A.127
163 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 174 here 72885A.128
164 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 175 here 72885A.129
165 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 176 here 72885A.130
166 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 177 here 72885A.131
167 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 178 here 72885A.132
168 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 179 here 72885A.133
169 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 180 here 72885A.134
170 


smartinez on DSK6TPTVN1PROD with HEARINGInsert offset folio 181 here 72885A.135