U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

29–759 PDF 2007

S. Hrg. 109–893

CYBER SECURITY: RECOVERY AND

RECONSTITUTION OF CRITICAL NETWORKS

HEARING

BEFORE THE

FEDERAL FINANCIAL MANAGEMENT, GOVERNMENT 

INFORMATION, AND INTERNATIONAL 

SECURITY SUBCOMMITTEE

OF THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE

ONE HUNDRED NINTH CONGRESS

SECOND SESSION

JULY 28, 2006

Available via http://www.access.gpo.gov/congress/senate

Printed for the use of the Committee on Homeland Security 

and Governmental Affairs

(

(II)

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

SUSAN M. COLLINS, Maine, Chairman 

TED STEVENS, Alaska 

GEORGE V. VOINOVICH, Ohio 

NORM COLEMAN, Minnesota 

TOM COBURN, Oklahoma 

LINCOLN D. CHAFEE, Rhode Island 

ROBERT F. BENNETT, Utah 

PETE V. DOMENICI, New Mexico 

JOHN W. WARNER, Virginia 

JOSEPH I. LIEBERMAN, Connecticut 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

THOMAS R. CARPER, Delaware 

MARK DAYTON, Minnesota 

FRANK LAUTENBERG, New Jersey 

MARK PRYOR, Arkansas

MICHAEL D. BOPP, Staff Director and Chief Counsel 

MICHAEL L. ALEXANDER, Minority Staff Director 

TRINA DRIESSNACK TYRER, Chief Clerk 

FEDERAL FINANCIAL MANAGEMENT, GOVERNMENT INFORMATION, AND 

INTERNATIONAL SECURITY SUBCOMMITTEE 

TOM COBURN, Oklahoma, Chairman 

TED STEVENS, Alaska 

GEORGE V. VOINOVICH, Ohio 

LINCOLN D. CHAFEE, Rhode Island 

ROBERT F. BENNETT, Utah 

PETE V. DOMENICI, New Mexico 

JOHN W. WARNER, Virginia 

THOMAS CARPER, Delaware 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

MARK DAYTON, Minnesota 

FRANK LAUTENBERG, New Jersey 

MARK PRYOR, Arkansas

KATY FRENCH, Staff Director 

SHEILA MURPHY, Minority Staff Director 

JOHN KILVINGTON, Minority Deputy Staff Director 

LIZ SCRANTON, Chief Clerk 

(III)

C O N T E N T S 

Opening statements: Page 

Senator Coburn ................................................................................................. 1

WITNESSES 

FRIDAY, JULY 28, 2006

George Foresman, Under Secretary for Preparedness, U.S. Department of 

Homeland Security ............................................................................................... 5

Richard C. Schaeffer, Jr., Director of Information Assurance, National Security Agency ............................................................................................................ 7

Karen Evans, Administrator for Electronic Government and Information 

Technology, Office of Management and Budget ................................................ 9

Keith Rhodes, Chief Technologist and Director, Center for Technology and 

Engineering, U.S. Government Accountability Office ....................................... 10

Thomas E. Noonan, President and Chief Executive Officer, Internet Security 

Systems ................................................................................................................. 20

Roberta A. Bienfait, Senior Vice President, Global Network Operations, 

AT&T ..................................................................................................................... 22

Michael A. Aisenberg, Director of Government Relations, VeriSign, Inc., and 

Vice Chair, IT Sector Coordinating Council ....................................................... 24

Karl Brondell, State Farm Insurance Companies, on behalf of the Business 

Roundtable ............................................................................................................ 26

ALPHABETICAL LIST OF WITNESSES

Aisenberg, Michael A.: 

Testimony .......................................................................................................... 24

Prepared statement .......................................................................................... 161

Bienfait, Roberta A.: 

Testimony .......................................................................................................... 22

Prepared statement .......................................................................................... 139

Brondell, Karl: 

Testimony .......................................................................................................... 26

Prepared statement .......................................................................................... 167

Evans, Karen: 

Testimony .......................................................................................................... 9

Prepared statement with an attachment ....................................................... 53

Foresman, George: 

Testimony .......................................................................................................... 5

Prepared statement .......................................................................................... 33

Noonan, Thomas E.: 

Testimony .......................................................................................................... 20

Prepared statement .......................................................................................... 132

Rhodes, Keith: 

Testimony .......................................................................................................... 10

Prepared statement .......................................................................................... 111

Schaeffer, Richard C., Jr.: 

Testimony .......................................................................................................... 7

Prepared statement .......................................................................................... 50

APPENDIX 

Hon. Thomas Jarrett, Secretary and CIO, Delaware Department of Technology and Information, prepared statement .................................................... 174

Page

IV

Questions and responses for the Record from: 

Mr. Foresman ................................................................................................... 181

Mr. Schaeffer .................................................................................................... 197

Mr. Evans .......................................................................................................... 200

Mr. Rhodes ........................................................................................................ 209

Mr. Bienfait ....................................................................................................... 213

Mr. Aisenberg ................................................................................................... 223

Mr. Brondell ...................................................................................................... 226

(1)

CYBER SECURITY: RECOVERY AND 

RECONSTITUTION OF CRITICAL NETWORKS 

FRIDAY, JULY 28, 2006

U.S. SENATE,

SUBCOMMITTEE ON FEDERAL FINANCIAL MANAGEMENT, 

GOVERNMENT

INFORMATION, AND INTERNATIONAL SECURITY, 

OF THE COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 9:35 a.m., in room 

342, Dirksen Senate Office Building, Hon. Tom Coburn, Chairman 

of the Subcommittee, presiding. 

Present: Senator Coburn. 

OPENING STATEMENT OF CHAIRMAN COBURN 

Chairman COBURN. The Subcommittee on Federal Financial 

Management, Government Information, and International Security 

will come to order. 

Today’s hearing is titled ‘‘Cyber Security: Recovery and Reconstitution of Critical Networks.’’ This is the second hearing in a series we will be conducting on cyber security. It is actually the third. 

We have had a high-level secured briefing and hearing on this, as 

well. On July 19, 2005, this Subcommittee held a hearing on the 

importance of cyber security to our Nation’s critical infrastructures. 

The hearing highlighted the importance of forging a public-private, 

and I will emphasize private, partnership to protect critical infrastructure and focused on challenges facing the Department of 

Homeland Security (DHS) in facilitating and leveraging such partnerships. 

Things that we have learned through the September 11 terrorist 

attacks and the response to Hurricane Katrina further emphasize 

these challenges. Today, despite spending millions of dollars over 

the past year, DHS continues to struggle with how to effectively 

form and maintain effective public-private partnerships in support 

of cyber security, including how to protect Internet infrastructure 

and how to recover it in the case of a major disruption. The publicprivate partnership necessary to accomplish DHS’s goals in securing computer networks continues to remain a public-private divide. 

I am grieved to note that our Nation’s security from a cyberbased attack has not improved since we were here last year. The 

objective of today’s hearing is to highlight immediate steps that 

DHS and the private sector can take to formalize a partnership 

2

and to ensure effective response and recovery to major cyber network disruptions. 

Our economy and national security are reliant on the Nation’s information and communications infrastructure, including the Internet. The Internet connects millions of information technology systems and networks together, which, in sum, provide e-commerce to 

the country and critical services allowing the government to function. On July 19, 2005, we learned that these computer networks 

can also control physical infrastructure, such as electrical transformers, chemical systems, and pipelines. 

DHS recently released its National Infrastructure Protection 

Plan (NIPP), 3 years after its due date. This plan highlights the 

importance of cyber security and the Internet to critical infrastructure, stating that the U.S. economy and national security are highly dependent upon the global cyber infrastructure. But according to 

today’s GAO report, DHS fails to adequately plan for recovery of 

key Internet functions. Moreover, the Department has not adequately prepared to effectively coordinate public-private plans for 

reconstitution from a cyber Internet disruption. 

The success of the protection efforts in the NIPP hinges on information sharing between the Federal Government and the private 

sector. However, a number of barriers exist to information sharing. 

Recent incidents at the Department of Veterans Affairs, Department of State, and a national laboratory indicate that the government has trouble protecting sensitive information. The government 

also does not have a good record of sharing sensitive intelligencederived threat data with the private sector. 

GAO identified numerous challenges to development of a plan 

and is here today to present the recommendations to strengthen 

the Department’s abilities. Government agencies and private companies, including telecommunications companies, cable companies, 

peering organizations, and major data carriers, need clarity on 

what is expected of them in a crisis. Overlapping and unclear roles 

and responsibilities lead to frustration and confusion, and will 

hamper recovery efforts in a crisis, which will be deeply injurious 

to our Nation. 

The overarching concern for the Committee is whether the Department of Homeland Security knows what functions of government need to be protected, how those functions interact with State 

and local governments, and what is DHS’s role and responsibility 

in working with the private sector during a cyber or telecommunication-based incidence of national significance. 

The recently released DHS plan requires the use of a risk assessment method that has been criticized as not focusing on what really needs to be protected in the information technology and telecommunication sectors, and focusing heavily on physical assets. 

The risk assessment methodology should be reevaluated, as it could 

lead to significant wasteful spending. 

While this sector has physical assets to protect, government 

needs to understand that this sector is about protecting critical 

functionality, not assets. The private sector and government must 

work together to ensure the Nation’s critical infrastructure can 

function in the reliable and stable fashion that the American public 

expects. 

3

Therefore, private industry must devise plans in coordination 

with the government to ensure critical functions do not fail or can 

be recovered quickly when faced with an incident of national significance. The National Communications System has worked under 

this concept for years. 

Both government and private industry admit there are vulnerabilities in the networks that can and have been exploited or damaged by accident or natural causes. A perfect system cannot be 

built. We realize that. The difficult part of any organization, especially government, is how does it respond, recover, and reconstitute 

after an incident. 

The Homeland Security Act of 2002 and Presidential Directives 

lay out a clear mandate on cyber security at the Department of 

Homeland Security. They require DHS to assess our vulnerability 

to a cyber attack, develop a plan to fix it, and implement that plan 

using measurable goals and milestones. In order to implement the 

plan, the Department has the admittedly difficult task of engaging 

and securing action from diverse players, which include State and 

local governments, other Federal agencies, and especially and most 

importantly, key industry actors. 

The nature of terrorists is to attack private citizens, as we recently saw in the horrific railway attacks in India. There can be 

no excuse for not effectively engaging the private sector, even 

though it is hard. We ask no less of our food safety, airline safety, 

and pharmaceutical industries. The issue is lack of leadership and 

lack of courage. 

Nobody wants to micromanage the private sector or DHS. However, America does expect the Department of Homeland Security 

and the private sector to take every reasonable measure to protect 

us from terrorism. I am not convinced that threshold has been met. 

If America is to be safe from the damage of a cyber attack, we 

will need a plan, a budget tied to that plan, and Congressional 

commitment to the implementation of the plan. One year ago, the 

Department announced the creation of the position of Assistant 

Secretary for Cyber and Telecommunications Security to elevate 

the importance of cyber critical infrastructure protection. Today, 

this position remains vacant. This vacant post was designed by the 

Department to lead the Nation in buttressing our critical information technology and telecommunications systems against threats. 

The Department, working in conjunction with the private sector, 

needs to find that person and set that person to the task of reforming the plan and then implementing it. A leader can and will be 

found, and I am encouraging DHS to exhaust every effort to fill 

this position, ensure the proper authorities are in place to succeed, 

and ensure that this person receives adequate support from the top 

leadership at DHS to fulfill the mission. 

To that end, I look forward to hearing from our witnesses, NSA, 

DHS, OMB, GAO, AT&T, VeriSign, and Internet Security Systems, 

as well as the Business Roundtable. I welcome each of you. 

The Department of Homeland Security’s testimony came in late 

last night. It is unavailable to me, the Chairman of this Subcommittee. It will not be accepted as part of it and it is a message 

to anybody else that wants to play games with the Subcommittee. 

You are going to send us the information that you want to testify 

4

about on a timely basis so we can do our job. And this is an example of exactly what is happening at DHS on cyber security. You 

can’t meet the goals. You can’t meet the expectations. This Subcommittee hearing was noticed June 12—61⁄2 weeks ago, and for 

the testimony to come in last night is unacceptable and it will not 

be accepted. 

Let me welcome our guests. First is the Hon. George Foresman. 

He was first confirmed by the U.S. Senate on December 18, 2005. 

He is responsible for synchronizing national preparedness efforts 

under the direction of Homeland Security Secretary Michael 

Chertoff and Deputy Secretary Michael Jackson. He previously 

served in the Commonwealth of Virginia as Assistant to the Governor for the Commonwealth Preparedness and Homeland Security 

Advisor, a cabinet-level position. In this capacity, he was the principal advisor and overall coordinator for homeland security and 

preparedness efforts, as well as relations with military commands 

and installations throughout the Commonwealth. He is nationally 

recognized in the fields of emergency preparedness and homeland 

security. 

Richard Schaeffer is the Information Assurance Director at the 

National Security Agency (NSA). He is responsible for the Information Assurance Directorate at that agency. The Directorate’s mission is to provide products and services critical to protecting our 

Nation’s critical information and information systems. Moreover, he 

is responsible for defining and implementing the information assurance strategy to protect the Department of Defense’s global information grid and supporting the ongoing military operations against 

terrorism. 

Next is the Hon. Karen Evans. She is Administrator of E–Government and Information Technology (IT), Office of Management 

and Budget. She is here as a break from her vacation. I want to 

tell you how much I appreciate you doing that. She oversees the 

implementation of IT throughout the Federal Government, including advising the Director on the performance of IT investments, 

overseeing the development of enterprise architectures within and 

across those agencies, directing the activities of the Chief Information Officer Council, and overseeing the usage of E–Government 

funds to support interagency partnerships and innovation. She also 

has responsibilities in the areas of capital planning and investment 

control, information security, privacy, accessibility of IT for persons 

with disabilities, and access to, dissemination of, and preservation 

of government information. 

Next is Keith Rhodes, Chief Technologist, Government Accountability Office (GAO). Mr. Rhodes is currently the Chief Technologist at GAO and Director of the Center for Technology and Engineering. He has been the senior advisor on a range of assignments covering continuity of government and operations, export 

control, computer security, privacy, e-commerce, E–Government, 

voting systems, and various unconventional weapons systems. Before joining GAO, he was supervisory scientist leading weapons and 

intelligence programs at the Lawrence Livermore National Laboratory. 

I would like to recognize each of you. Thank you for taking the 

time to be here. Mr. Foresman, you are recognized for 5 minutes. 

5

1The prepared statement of Mr. Foresman appears in the Appendix on page 33. 

TESTIMONY OF GEORGE FORESMAN,1 UNDER SECRETARY 

FOR PREPAREDNESS, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. FORESMAN. Mr. Chairman, thank you, and thank you for the 

opportunity to appear today to discuss the recovery and the reconstitution of critical cyber networks. Congressional discussion on 

this particular topic is absolutely essential and it is critical to the 

success that we need to achieve as a Nation toward strengthening 

our levels of preparedness. 

Mr. Chairman, I would like to highlight several key issues today 

and outline the Department’s roadmap for success in advance of a 

very important discussion on the security and the protection of our 

cyber communications networks. 

The findings of the GAO report on the development of a joint 

public-private plan for recovering critical cyber infrastructure and 

the recent Business Roundtable’s recommendations for strengthening cyber preparedness both echo the overall resounding themes 

that the Department of Homeland Security is pursuing in its work 

to lead a national effort to protect America’s cyber assets. While 

these reports offer somewhat differing recommendations on the 

exact steps that we need to take, the shared national vision further 

reflects two very important and sometimes overlooked issues. 

First, the risk posed to the critical cyber infrastructure is becoming both better and more widely understood, both in the public sector and in the private sector. Second, the importance of mitigating 

these risks, whether on the individual, corporate, or government 

level, is also better understood. We know we must be ready for the 

cyber version of Hurricane Katrina or the September 11 attacks. 

Mr. Chairman, let me outline for you the Department’s three 

strategic priorities on the cyber preparedness front. They include, 

one, preparing for a large-scale cyber disaster; two, working to 

forge more effective partnerships, as you noted in your opening 

statement; and three, fostering a culture of preparedness to prevent cyber incidents and mitigate damage when disruptions do, in 

fact, occur. 

Our primary strategic goal as part of our overall risk management approach is to prepare for high-consequence incidents. These 

would include, for example, a widespread disruption involving the 

Internet or critical communications infrastructure, whether it originates from an attack or from a natural disaster. The Department 

has established the Internet Disruption Working Group, the IDWG, 

to address the resiliency and recovery of Internet functions in the 

event of a major cyber incident. The IDWG is not examining all individual risks, but rather focusing on nationally significant Internet disruptions in a prioritized fashion. The IDWG is developing 

not only policy recommendations for cyber response, but also operational proposals and protocols to improve the deployment of Federal resources in the event of such an event and how to ensure coordination with local, State, and private sector partners of these assets. 

I am also pleased to share with you that the Department conducted its first national cyber security exercise, Cyber Storm, this 

6

past February, and this was the largest multinational cross-sector 

cyber exercise to date and assessed the policies and procedures associated with a cyber-related incident of national significance. The 

Department will soon be releasing a public exercise report on this 

effort that will outline findings to help bolster protective measures 

for potential cyber attacks. I will also note that these lessons, like 

those of Hurricane Katrina and other incidents, will not sit idle. 

They will be incorporated into our operations processes under the 

National Response Plan and these will be retested during Cyber 

Storm II in 2008, if not before. 

Cyber Storm demonstrated the close cooperation and information 

sharing needs across Federal agencies, across international boundaries, and most importantly, between the public and the private 

sectors. The exercise tested for the first time the full range of 

cyber-related response policy, procedures, and communications 

methods required in a real-world crisis. We know that there were 

successes. We also know that there is room for improvement. 

Another significant accomplishment in preparing for a nationally 

significant cyber disruption is last month’s completion, as you 

noted, of the National Infrastructure Protection Plan. The NIPP 

sets forth a comprehensive risk management framework and clearly defines critical infrastructure protection roles and responsibilities for DHS, Federal sector-specific agencies, other Federal, State, 

local, tribal, and territorial agencies, as well as our private sector 

security partners. The plan addresses the physical, human, and 

cyber elements of the critical infrastructure issues which cross all 

sectors. This release of the NIPP is an important milestone, as it 

accompanies 17 sector-specific plans that will help build a safer 

and more secure and more resilient America by enhancing protection of the Nation’s critical infrastructure and key resources to include the cyber community. 

Our second strategic goal is to improve the Department’s partnership programs and practices. Homeland Security Presidential 

Directive 7, the Administration’s policy on critical infrastructure 

protection, explicitly recognizes the importance of partnerships, 

which are essential for many sound reasons. In the cyber security 

arena, the Department is working to nurture existing partnerships 

and establish new relationships with three key stakeholder communities, the private sector, Federal departments and agencies, and 

the State, local, and tribal governments, as well as academia. 

Third, we must create a culture of preparedness, both to prevent 

a cyber disaster and to mitigate damages if a widespread disruption occurs. We are working every day to influence how individual 

citizens, government, and the private sector prepare for the security challenges of the coming decade. As with our other strategic 

priorities, this goal demands a focused and disciplined approach. 

We need interconnected strategies and processes, not individual actions. Just as our cyber systems are interconnected, so must be our 

approach to dealing with disruptions. 

Our national cyber security efforts are rapidly maturing and we 

have clear legislative and presidential direction and private sector 

interest. There is no magic wand that will allow us to do this overnight. There is, however, a growing coalescing of effort between 

government and the private sector as just two of the key entities. 

7

1The prepared statement of Mr. Schaeffer appears in the Appendix on page 50. 

Chairman COBURN. I need for you to summarize, if you will. 

Mr. FORESMAN. Yes, sir, and I am finishing up. To create a longterm culture of preparedness, we are developing clear organizational doctrine which memorializes strategic policies, clarifies roles 

and responsibilities, and defines measures of accountability. The 

road ahead is critical and we are committed to ensuring success. 

Thank you. 

Chairman COBURN. Thank you. Mr. Schaeffer. 

TESTIMONY OF RICHARD C. SCHAEFFER, JR.,1 DIRECTOR OF 

INFORMATION ASSURANCE, NATIONAL SECURITY AGENCY 

Mr. SCHAEFFER. Good morning, Mr. Chairman. 

Chairman COBURN. Good morning. 

Mr. SCHAEFFER. I appreciate the opportunity to be here today to 

talk briefly about the NSA’s information assurance mission and its 

relationship to the work of the Department of Homeland Security 

and others concerned with helping operators of crucial information 

systems prepare for and recover from hostile acts or other disruptive events. 

The NSA’s information assurance mission focuses on protecting 

what National Security Directive 42 defines as national security information systems, systems that handle classified information or 

are otherwise critical to military or intelligence activities. 

Historically, most of our work has been sponsored by and tailored 

for the Department of Defense. Today, national security systems 

very often rely on commercial products or infrastructure or interconnect with systems that do. This creates significant common 

ground between defense and broader U.S. Government and homeland security needs. More and more, we find that protecting national security systems demands teaming with public and private 

institutions to raise the information assurance level of products 

and services more broadly. If done correctly, this is a win-win situation that benefits the whole spectrum of information technology 

users, from warfighters and policy makers to Federal, State, local 

governments and operators of critical infrastructure and major arteries of commerce. 

This convergence of interests has been underway for some time 

and we can already point to several examples of the kind of fruitful 

collaboration it inspires. For instance, the NSA and the National 

Institute of Standards and Technology have been working together 

for several years to characterize cyber vulnerabilities, threats and 

countermeasures to provide practical cryptographic and cyber security guidance to both IT suppliers and consumers. 

Among other things, we have compiled and published security 

checklists that harden computers against a variety of threats. We 

have shaped and promoted standards that enable information 

about computer vulnerabilities to be more easily cataloged and exchanged, and ultimately, the vulnerabilities themselves to be automatically patched. And we have begun studying how to extend our 

joint vulnerability management effort to directly support compliance programs, such as those associated with the Federal Information Security Management Act. All of this is unclassified and adVerDate 0ct 09 2002 08:46 May 22, 2007 Jkt 029759 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 C:\DOCS\29759.TXT SAFFAIRS PsN: PAT
8

vances of cyber security in general, from national security and 

other government networks to critical infrastructure and other 

commercial and private systems. 

The NSA partners similarly with the Department of Homeland 

Security. In 2004, DHS joined the NSA in sponsoring the National 

Centers of Academic Excellence Program to foster training and 

education programs to support the Nation’s cyber security needs 

and increase the efficiency of other Federal cyber security programs. The NSA has supplied trained personnel and other technical support to the U.S. Computer Emergency Readiness Team, 

and we routinely alert one another to possible or emerging hostile 

cyber threats. In fact, DHS has just named an integree to work in 

the NSA–Central Security Service Threat Operations Center, 

which has as one of its missions to monitor the operations of the 

global network in real time to identify network-based threats to 

DOD and intelligence community networks. 

NSA and DHS cooperate on investigations and forensic analysis 

of cyber events and malicious software, and together, we look for 

and mitigate the vulnerabilities in various technologies that would 

render them susceptible to similar attacks. We each bring to these 

efforts complementary experience, insight, and expertise based on 

the different problem sets and user communities on which we concentrate, and we each then carry back to those communities the 

dividends of our combined wisdom and resources. 

With regard to post-incident response, the NSA supplies technical personnel, advice, and equipment to support an efficient response and recovery to disasters. The NSA has worked with the 

DHS Infrastructure Protection Division to plan for interoperable 

communications systems needed to support response and recovery. 

We did this for Hurricane Katrina and do it for other disasters, as 

well. 

When it comes to reconstructing networks, however, beyond just 

communications systems, bringing in replacement technology may 

be the easy part. The real challenge is knowing what to reconstruct. That means maintaining an up-to-date understanding of 

what set of data, functions, and connections available to what set 

of users qualify as critical. 

Looking forward, NSA and DHS interests will continue to merge 

and the opportunities needed for shared network and mutual support will continue to grow. 

Finally, beyond technical convergence, in the post-September 11 

world, the NSA and DHS are bound together by the need to provide for communications across once unbridgeable chasms of classification and practice, from the President all the way to first responders and the owners and operators of critical infrastructure. 

As a starting point, the NSA and NIST have established a suite of 

unclassified algorithms that can be implemented in commercial offthe-shelf offerings as well as specialized high-end government 

equipment. This sets the stage for interoperable encryption and 

message authentication and is an important step, although just one 

step in the broader effort to ensure that the Nation can recognize 

and respond to impending emergencies or their aftermath. 

9

1The prepared statement of Ms. Evans with an attachment appears in the Appendix on page 

53. 

Once again, thank you, Mr. Chairman, for giving me the opportunity to appear before you today and for your leadership in this 

area. 

Chairman COBURN. Thank you, Mr. Schaeffer. 

Next, Ms. Evans, just a side note. Thanks for all your help on 

our Government Accountability and Transparency Act. It passed 

the Committee unanimously yesterday. 

TESTIMONY OF KAREN EVANS,1 ADMINISTRATOR FOR ELECTRONIC GOVERNMENT AND INFORMATION TECHNOLOGY, 

OFFICE OF MANAGEMENT AND BUDGET 

Ms. EVANS. Congratulations. Good morning, Mr. Chairman, and 

thank you for inviting me to speak about ‘‘Cyber Security: Recovery 

and Reconstitution of Critical Networks.’’ My testimony today will 

focus on OMB’s activities to improve security and resilience of the 

Federal Government’s cyber critical assets. 

Last year, the Director of OMB issued a regulation on maintaining telecommunication services during a crisis or an emergency. 

The regulation required each agency to review its telecommunications capability in the context of planning for contingencies and 

continuity of operation situations. OMB also asked each agency to 

confirm that they were complying with directives issued by the National Communications System (NCS), and guidance issued by the 

Federal Emergency Management Agency (FEMA). 

In August 2005, all large agencies submitted reports on the status of their telecommunications services. OMB and the NCS analysis revealed the need for additional guidance to the agencies regarding the use of redundant and physically separate telecommunications service entry points into buildings and the use of physically 

diverse local network facilities. 

In October 2005, the NCS hosted a Route Diversity Forum for 

representatives from over 70 Federal agencies. In addition, the 

NCS developed a Route Diversity Methodology, enabling agencies 

to self-assess their own facilities. 

When an agency initiates new telecommunications procurements, 

the agency must determine the appropriate level of availability, 

performance, and restoration that is required. The General Service 

Administration’s upcoming Networx procurement will specify telecommunications infrastructure security requirements to protect 

contract network services, infrastructures, and information processing resources against cyber and physical threats, attacks, or system failures. The Networx program will ensure that telecommunications capabilities are continuously ready to meet the needs of the 

Federal agencies during national emergencies. 

On December 17, 2003, the President signed Homeland Security 

Presidential Directive 7, ‘‘Critical Infrastructure Identification, 

Prioritization, and Protection.’’ This directive established the national policy for Federal departments and agencies to identify and 

prioritize U.S. critical infrastructure and to protect it from terrorist 

attacks. OMB worked with the Department of Homeland Security 

to evaluate the protection plans. We have provided each agency 

10

1The prepared statement of Mr. Rhodes appears in the Appendix on page 111. 

with a written response explaining our approval, our disapproval 

of the agency’s cyber security plan, and highlighting areas where 

improvements were needed. 

Additionally, each year, agency CIOs, chief information officers, 

and program officials conduct IT security reviews for systems that 

support their programs. As part of their evaluations, agencies are 

asked to categorize their information systems into high, moderate, 

and low impact and document the security controls implemented 

for each. 

Last, the National Cyber Response Coordination Group is the 

principal Federal interagency mechanism to coordinate the preparation for and response to cyber incidences of national significance. 

OMB is a member of the group, along with other agencies having 

a statutory role in cyber security, cyber crime, or protection of critical infrastructure. During a cyber incident, the member agencies 

would integrate their capabilities in order to assess the scope and 

severity of the incident, govern response and remediation efforts, 

and advise senior policy makers. The group would also use their established relationships with the private sector and State and local 

governments to help manage the cyber crisis and develop recovery 

strategies. 

In conclusion, each agency is responsible for ensuring the continued availability of its mission-essential services. Strategic improvements in security and continuity of operations planning can make 

it more difficult for attacks to succeed and can lessen the impact 

of attacks when they occur. The Administration will continue to 

work with the agencies, Congress, and GAO to ensure appropriate 

risk-based and cost-effective IT security programs, policies, procedures are put in place to protect the Federal Government’s critical 

cyber infrastructure. 

I would be happy to take any questions, sir, that you may have. 

Chairman COBURN. Thank you, Ms. Evans. Mr. Rhodes. 

TESTIMONY OF KEITH RHODES,1 CHIEF TECHNOLOGIST AND 

DIRECTOR, CENTER FOR TECHNOLOGY AND ENGINEERING, 

U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. RHODES. Thank you, Mr. Chairman. We appreciate the opportunity to testify on our Internet reconstitution report being released today that we completed at your request. 

Last summer when GAO testified before your Subcommittee, we 

discussed the work that remained for DHS to fulfil its cyber security responsibilities in 13 key areas, including developing a plan for 

recovering the Internet when it is disrupted. Despite Federal policy 

requiring DHS to develop this integrated public-private plan, to 

date, no such plan exists. 

Today, at your request, we will briefly discuss the growing 

threats to the Internet, where our Nation is in its efforts to develop 

this plan, and recommendations to both DHS and the Congress to 

facilitate public and private efforts to recover the Internet when 

major disruptions occur. 

First, threats. Criminal groups, foreign intelligence services, 

hackers, and terrorists are all threats to our Nation’s computers 

11

and networks. A recent intelligence report on global trends forecasts that terrorists may develop capabilities to conduct both cyber 

and physical attacks against infrastructure nodes, including the 

Internet. In fact, the Internet itself has been targeted and attacked 

and private companies who own the majority of the Internet infrastructure deal with cyber and physical disruptions on a regular 

basis. 

For example, viruses and worms are often used to launch ‘‘denial 

of service’’ attacks that result in traffic being slowed or stopped. 

Several recent cyber attacks highlight the importance of having robust Internet recovery plans, including a 2002 coordinated denial 

of service attack that targeted all 13 Internet route servers. 

For most of these attacks, the government did not have a role in 

recovering the Internet, but recent physical attacks like the terrorist attacks of September 11, 2001, and Hurricane Katrina, highlight the need for public-private coordination associated with Internet recovery. DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public-private plan, but 

these efforts are not yet complete nor are they comprehensive. 

Specifically, DHS has developed high-level plans for infrastructure protection and national disaster response, but components of 

these plans that are to address Internet recovery are incomplete 

and inadequate. For example, the National Response Plan Cyber 

Annex does not reflect the National Cyber Response Coordination 

Group’s current operating procedures. DHS has started a variety of 

initiatives to tackle this problem, including working groups to facilitate response and exercises to practice recovery efforts. However, these efforts are immature and the relationships among 

groups like the Internet Disruption Working Group and others are 

not evident. 

Regarding challenges that have impeded progress, first, it is unclear what government entity is in charge, what the government’s 

role should be, and when it should get involved. Expanding on each 

of these, DHS National Cyber Security Division and the National 

Communications System have overlapping responsibilities. In addition, there is a lack of consensus about the role DHS should play. 

The government is pursuing the grandiose plan approach with the 

NIPP and the National Response Plan, while the private sector 

wants more of an assist or tactical role from the government that 

our report lays out in detail. And triggers that clarify when the 

Federal Government should be involved are unclear. 

Second, our Nation is working in a legal framework that doesn’t 

specifically address the government’s roles and responsibilities in 

the event of an Internet disruption. In addition, the Hurricane 

Katrina recovery effort showed that the Stafford Act can create a 

roadblock when for-profit companies that own and operate critical 

infrastructures need Federal assistance during national emergencies. 

Third, the private sector is reluctant to share information with 

DHS because it does not always see value in sharing, does not necessarily trust the government, and views DHS as an organization 

lacking effective leadership. 

To address these inadequacies, our statement includes nine specific recommendations for DHS, including determining who should 

12

be in charge given the convergence of voice and data communications, developing a plan that is consistent with what the private 

sector infrastructure owners need during a time of crisis, and incorporating lessons learned from incidences and exercises. 

In addition, the Congress should consider clarifying the legal 

framework that guides roles and responsibilities for Internet recovery. 

In summary, Dr. Coburn, exercises to date and a recently issued 

report by the Business Roundtable found that both the government 

and private sector are poorly prepared to effectively respond to 

cyber events. Although DHS has various initiatives underway, 

these need to be better coordinated and driven to closure. Until 

that happens, the credibility of the Department will not be where 

it needs to be to build effective public-private relationships needed 

to effectively respond to major Internet disruptions. 

This concludes our statement. Thank you, Mr. Chairman, and we 

are prepared to answer any questions the Subcommittee may have. 

Chairman COBURN. Thank you very much. 

Mr. Foresman, your response to Mr. Rhodes’ report? 

Mr. FORESMAN. Mr. Chairman, let me offer two responses. One, 

as we have gone through that report, we clearly agree that the 

road ahead, whether we are talking about GAO or the private sector, we agree on the road ahead. 

I would, however, not agree with him in terms of the perception 

that he might leave in the relationship with the private sector. My 

fourth day on the job back in January, one of the first groups I met 

with in this particular case was the Business Roundtable and one 

of the key issues we talked about were cyber security, the concern 

about reconstitution and recovery of the Internet, and I think that 

as you said in your statement, Mr. Chairman, this is not easy and 

there are a lot of folks who have said, well, it is not where it should 

be, and I would agree. But we need to have definitive milestones. 

We need to have definitive deliverables. 

But I will tell you, sir, just as your comment to us that we need 

to work closely with the private sector, getting agreement across 

the various elements in the private sector, whether it is the information technology sector or the telecommunications sector, this is 

not easy. We are not in a position to force them. We are coalescing 

the road ahead. 

So I would agree that we share the vision. I think his assessment 

in terms of progress is much bleaker than what is the actual 

progress to date. 

Chairman COBURN. Why would the private sector be reluctant to 

give DHS information on this? 

Mr. FORESMAN. Mr. Chairman, I think there are three things. 

There are those elements of the private sector that are reluctant 

to give us information and there are those elements of the private 

sector that are not reluctant to give us information. A conversation 

with a handful of people does not, I think, effectively reflect the 

private sector as a whole because the private sector is rapidly big. 

But as you know, there are a couple of issues here. One, there 

is the concern of our private sector partners out there, the proprietary nature of the information that they have in a business competitive environment. They want further and stronger assurances 

13

that proprietary information is not going to be shared with competitors. 

The second issue, and frankly is a legitimate issue, is government and the private sector have typically operated in a regulatorregulatee relationship over the past 20 or 25 years. When we talk 

about the IT community, it is not, if you will, regulated by government, and clearly there are the institutional——

Chairman COBURN. Thank goodness. 

Mr. FORESMAN. Yes, sir, and clearly, the institutional barriers to 

getting beyond a 25- or a 50-year culture to get into a collaborative 

partnership is not a culture that you change overnight. And so I 

think it is part policy, it is part culture, but we are seeing more 

and more every day as we collaborate with the private sector. As 

our US–CERT, for instance, gets specific information provided to us 

through a variety of sources, such as the NSA, we rapidly get that 

information out to the private sector and they rapidly come back 

to us with information. So it sometimes comes down to who did you 

talk to last and what is it that they said to you? 

Chairman COBURN. Well, the group that I talked to last were the 

ISPs and the telecommunications companies, and I would tell you 

in that meeting, uniformly, there was no trust of DHS with any of 

their proprietary data, and that was in a classified briefing I had 

3 months ago. How do you establish the leadership role and the 

trust that allows the private sector to do what they know how to 

do that you don’t know how to do? 

Mr. FORESMAN. Well, Mr. Chairman, this comes down to the continued interaction. As Ms. Evans identified and as other folks have 

identified, we have got a number of working groups where we have 

got government and the private sector sitting side by side, developing sector-specific plans, for instance, under the National Infrastructure Protection Plan, and trust is not a function of me coming 

into the room and sitting with our private sector partners and saying, trust me. We have to prove it. 

This is the benefit of these joint planning activities. As much as 

we would like them to be done in immediacy overnight, they are 

not. But just as it is taking time to develop those plans, one of the 

important byproducts is that we are raising trust every day when 

we put these people in the room together. 

Chairman COBURN. I will be submitting some questions to you 

separate from that. I would hope that we could get a timely response. 

Mr. FORESMAN. Mr. Chairman, I will ensure that you get a timely response and I will acknowledge that we were remiss in not hitting the deadline on getting our testimony to you. I accept full responsibility and I will give you my personal assurance that we will 

correct those issues in the future. 

But I also want to underscore, by no means were we trying to 

not get information to you. This is a critically important area. This 

Subcommittee is one of the few committees across the Congress 

that has shown a continuing interest in this area. It is not an easily understood area, and frankly, this level and more of this type 

of dialogue is going to be absolutely critical to our success. 

Chairman COBURN. Mr. Schaeffer, at NSA, tell me about your relationship with the private sector and trust and relationship and 

14

information sharing and how have you developed that and how do 

you utilize that. Have you emphasized recovery more than physical 

asset protection? 

Mr. SCHAEFFER. Well, sir, I think our relationship with industry 

or the private sector is on a number of levels. Clearly, there are, 

as I mentioned in my testimony and others did, as well, the dependence upon the private sector to deliver the technology, the capabilities that we need within the national security community, 

and quite frankly, across the entire Nation, is dependent upon the 

reliability, the security of that technology. So we have a very deep 

relationship with the private sector in establishing on a one-on-one 

basis the availability of vulnerability information of the products 

that they provide, assisting them in increasing the overall security 

or assurance of those products, and then we also work with the infrastructure providers themselves to understand the vulnerabilities 

within those environments and help them address the situation, 

the improvements that can be made in that environment. 

Most of our relationships that are strong come from a one-on-one 

basis with the agency. We participate. We collaborate with industry 

associations and do that in a very open and, I think, positive way. 

But I think as Mr. Foresman outlined, it is a situation that takes 

a tremendous amount of work with individual companies, then 

with industry or association groups, and then in larger forums to 

build the trust and confidence that information that is exchanged 

with the government, and in this case NSA, receives the appropriate level of protection. It is something that we work on every 

day. It takes that sort of attention and commitment. 

And we have seen actually tremendous progress over the last 

several years as the community at large, the public-private community, has come to better understand the risks associated with operating in this highly networked environment and the need for close 

collaboration amongst public-private enterprises to better understand the vulnerabilities and ways of mitigating them. 

I think we are an example of where it has worked because we 

have developed the trust and confidence over a long period of time 

with companies, trade groups, industry associations, and so forth, 

and I see promise in what DHS is leading, in what DHS is participating in, and quite frankly, what I see the entire IT industry participating in. We are just at the bottom of a very steep hill. 

Chairman COBURN. Has NSA’s main focus been on functionality? 

Mr. SCHAEFFER. No, sir. NSA’s main focus has been on the assurance of the functionality that is provided in the devices, so——

Chairman COBURN. That is what I mean. But the goal is function. The ultimate goal for security is to maintain function, or to 

recover function. 

Mr. SCHAEFFER. Yes, sir. That is correct. 

Chairman COBURN. All right. Mr. Rhodes, you mentioned the 

working groups aren’t communicating. We don’t have cross-reference. You also mentioned a role that is more grandiose rather 

than recovery. Talk for a minute, if you would, about the working 

groups that have been established and what you see that needs to 

be changed there so that we accomplish this goal of protecting and 

recovering functionality. 

15

Mr. RHODES. The big struggle with the working groups seems to 

be that there are a lack of roles and responsibilities and clear lines 

of authority. There seems to be a not clear definition of how the 

working groups relate to one another——

Chairman COBURN. In other words, they could come up with a 

really appropriate plan, but have no authority to get that plan implemented? 

Mr. RHODES. And no milestones. Your original point about budget against effect, a recommendation with money, a recommendation 

with schedule, not just—they can come up with that, but then what 

is their schedule? What is their time line? What is their relationship? That is the main struggle we see. 

Also, working groups without authority. What purpose do they 

serve? If they don’t—if no one has the hammer, if no one has the 

authority to get anyone to do anything, then it is just another 

group that meets to meet instead of meeting to get something done. 

As you say, they could have very fine recommendations, but where 

do they go from there? 

Chairman COBURN. OK. One last question for you, the comment 

on the Stafford Act. I don’t believe we have gotten anything, and 

I may be wrong, from the Administration on modifying the Stafford 

Act so that we can help the telecommunications industry and the 

Internet industry to recover by assisting them with either protection or transportation or security as they bring these systems back 

up. Would you agree that is something that we ought to hear from 

the Administration? And we may have, I am just not aware of it. 

Mr. RHODES. We haven’t seen anything, either, but when you 

look at the tactical needs, the tactical view that private industry 

takes, they are talking about just those things—fuel, access, transportation. They are not talking about, tell me how to bring the 

Internet back up. They are saying, let me get into the disaster area 

with my business credential or some emergency credential issued 

by the U.S. Government so I can go to the location to do the job 

that the government can’t. 

Chairman COBURN. And modify the law so that the government 

assets——

Mr. RHODES. And modify the law——

Chairman COBURN [continuing]. And assist that effort. 

Mr. RHODES. Absolutely. I mean, what we hear from private—

and it is not just relative to the Internet, it is whether we are talking to the chemical industry or we are talking to gas and oil or we 

are talking about the power grid or folks like that, they are all saying, let me do my job. I am not the enemy because I am for profit. 

Chairman COBURN. Yes. 

Mr. RHODES. I am the infrastructure. Let me go into the area I 

am supposed to in order to fix it. 

Chairman COBURN. Right. Which we saw lots of problems with 

during Hurricane Katrina. 

Mr. RHODES. Absolutely, and saw it during September 11, 2001, 

also. 

Chairman COBURN. All right. Ms. Evans, not long ago, the Federal Government’s critical infrastructure protection coordination efforts were run out of the White House and some in private sector 

viewed this, and I think probably still do, as a higher AdministraVerDate 0ct 09 2002 08:46 May 22, 2007 Jkt 029759 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 C:\DOCS\29759.TXT SAFFAIRS PsN: PAT
16

tion priority than it is now. Should these initiatives remain within 

DHS or should we consider the prior model? 

Ms. EVANS. The model that we have right now is in place as a 

follow-on from the Homeland Security Act as well as the President’s HSPD–7, which clearly outlines that the Secretary of Homeland Security has the responsibilities for these activities. This does 

not mean that the Administration does not view this as a priority, 

because oversight activities still occur out of the White House and 

the Executive Office of the President, with the Office of Management and Budget, myself, as well as the Homeland Security Council. So the Administration is very much committed to this and continues to have cyber security reconstitution, continuity of operations, as a priority. 

I do think that the model that we have in place right now is an 

effective model and can work, because the actual work and execution happens in the agencies. The President holds the Secretary accountable for these actions. The President holds him accountable 

for getting these plans in place with clear milestones. This clearly 

has been talked about, and to achieve the results. 

We, in the White House, do not do the actual execution. The 

work is done out in the agencies. And so it doesn’t diminish that 

the Administration doesn’t view this as a priority by having a person clearly responsible for the execution of these activities at a department level. 

Chairman COBURN. Any of you can respond to this if you want. 

It just seems to me that 75 percent of this is private sector. Why 

wouldn’t the Administration’s view say, OK, you are the guys that 

know all this. You are the guys who are responsible for it. Your 

bottom line depends on it staying up and working. Why don’t you 

go tell us what you think we ought to do rather than us tell you 

what we think you ought to do? Why shouldn’t the debate be, private industry, come tell us what to do. Why shouldn’t the organizational framework be, let us listen to them and then let us create 

the framework based on what they suggest we ought to do rather 

than top-down? Why not private industry up? 

Mr. FORESMAN. Mr. Chairman, if I might, that is exactly what 

we are doing, and that is why we have the National Infrastructure 

Protection Plan. That is why we have the development through the 

sector coordinating councils. The role of the Federal Government is 

not to tell the private sector what to do. It is to create the environment to provide for a national approach, and what I mean by that 

is the Federal Government is uniquely positioned to bring together 

the elements of local government, State government, tribal and territorial, the private sector partners, because this is a homeland security issue. It is a national security issue. 

So our job is to get all of the players around the table and to go 

through and get the best and the brightest in the room to say, 

what is it that we, as a Nation, need to be doing, because this is 

not a Federal issue. It is clearly a national issue. 

Chairman COBURN. Do you think that is happening right now? 

Mr. FORESMAN. Senator, I don’t think it is happening to the degree that it should, and I think, as all of the folks have pointed out, 

this continues to be a growth effort, a growing effort on the part 

of this Nation in the post-September 11 era. When I was vice 

17

chairing the Gilmore Commission prior to September 11, we raised 

the whole issue of critical infrastructure protection and the fact 

that a significant amount of work needed to be done. I don’t think 

we have reached the optimal level of private sector direction and 

input into it, but at the end of the day, I don’t think we were going 

to start—we are not going to start at the perfect position. This is 

very much a learning process for everyone, Federal, State, local, 

public sector, and private sector. 

Chairman COBURN. Well, the private sector is being attacked all 

the time now and they are responding, both in terms of physical 

assets and software and encryption and everything else. They are 

doing the things because they are seeing the attacks anyway. It 

just seems to me we have got it backwards. We ought to have the 

private sector come together and say, here is how we think you 

ought to mobilize State and local governments. Here is how we 

think you ought to set up the structure to best maintain this. Here 

is how we think you assure protection. 

What would happen to this economy if you had a 4-week disruption, interruption of the Internet? We would be on our back, and 

everybody knows that, and yet the urgency to make sure that can’t 

happen, or if it did happen to recover quickly, I don’t see anywhere 

except in the private sector. 

Mr. FORESMAN. Mr. Chairman, I would respectfully disagree in 

this context. We are aware of a variety of things we obviously cannot get into in an open hearing——

Chairman COBURN. I understand that. 

Mr. FORESMAN [continuing]. But we are aware of a significant 

number of things that have occurred in recent time that the private 

sector was not aware of had government not made them aware of 

it. So we are doing our part to give them the information. They, 

in turn, are assessing the situation, bringing recommended solution 

sets back to us, implementing solution sets in the broadest of 

terms, and so our role wasn’t to go to them and say, here is the 

problem. Here is what we want you to do to fix it. We made them 

aware of the problem. We know that they are the owners and the 

providers of a lot of the critical IT backbone. They assessed it. They 

took steps. And this happens hundreds, if not thousands, of times 

every month. I would very much underscore that US–CERT, as just 

one example, there is daily ongoing dialogue between Federal agencies and the private sector, not in the context of here is what you 

have to do, but here is the problem and please come back to us. 

Now, I will tell you that there are going to be times that the private sector is going to assess the risk differently than we do in government and then they are forced to make a business decision 

about whether they are going to invest the time and effort into it 

to address it. So this is all part of the trust process that we can 

get to an equal common ground. 

Chairman COBURN. Fair enough. One last question for Ms. 

Evans, and I will have questions for each of you. I also would like 

for you to have staff stick around here to hear our other panelists 

because routinely I see Administration witnesses leave before those 

that have a different position and constructive criticism can be 

heard. 

18

Ms. Evans, do you have enough staff to handle the cyber security 

of critical infrastructure and Federal information security management? 

Ms. EVANS. My answer would be yes, sir, that I do. We have subject matter experts for each of the areas that I am responsible for 

and the way that we manage within OMB is that we have portfolios of agencies and we work very closely with all parts of OMB 

so that we are managing the issues across the board as they affect 

each of the agencies. So it isn’t just my staff, but it is the entire 

resources that are available within OMB because we take a portfolio approach to this. 

There is one thing that I would like to follow up on, Mr. 

Foresman’s comment, and this is what the government is doing as 

a whole, at least from a Federal perspective. We do view it as we 

are buying services, because we don’t own the infrastructure. There 

are activities that we have done and that we are continuing to do. 

In my written testimony, I have included the information security 

line of business. 

But as you know, we spend $65 billion on information technology, so in the course of that spending, we make it very clear 

what the services are that we need, what the risk is associated 

with the services and the information we need to protect, and as 

Mr. Foresman said, then it is up to industry to offer us the solutions back, and the way that we structure those procurements is 

not to tell them, we want you to do X, Y, and Z, but to really frame, 

this is the service, this is the recovery level, this is the level of risk 

that we are willing to accept. Here is the type of protection that 

we think we need to have. And then we do look to private industry 

to give us the solutions that can best service those needs, because 

as you have said, sir, it is about the functionality and the mission 

critical nature of the services that we provide that we need to have 

that reliability. 

Chairman COBURN. I would like you to repeat that number so everybody can hear what you spend annually on IT. 

Ms. EVANS. Sixty-five billion dollars. 

Chairman COBURN. This Subcommittee will have a hearing on 

whether or not that is spent properly or not. I can tell you, from 

the Defense Travel System, you certainly haven’t spent the money 

properly. So we will be looking at that. 

Ms. EVANS. Well, we are looking forward to it, yes, sir. [Laughter.] 

Chairman COBURN. Sixty-five billion dollars is a lot of IT. 

Thank you. You will each receive questions. Thank you for the 

report from GAO. I thank each of you for your service to our country and I would dismiss this panel and ask our next panel to come 

forward. 

I am going to start introducing our witnesses while they are 

being seated. Thomas Noonan is Chairman, President, and Chief 

Executive Officer for Internet Security Systems (ISS). He is responsible for the overall strategic direction, growth, and management of 

the company. Under his leadership, ISS revenues soared from 

start-up in 1994 to nearly $330 million in its first decade. The company has grown to more than 1,200 employees with operations in 

26 countries. In 2002, President Bush appointed Mr. Noonan to 

19

serve on the National Infrastructure Advisory Council, a homeland 

defense initiative that protects information systems that are critical to the Nation’s infrastructure. He currently chairs the NIAC 

Evaluation Enhancement of Information Sharing and Analysis 

Working Group. 

Robin Bienfait, Senior Vice President, Global Network Operations, AT&T, welcome. She is the first woman in company history 

to be responsible for AT&T’s global network, including local, data, 

and voice network worldwide. I pay them a lot of money every 

month. In addition, she leads teams that manage network security 

and global network disaster recovery. And additionally, she previously led AT&T’s international and domestic core network operations and technical support division and has held a variety of 

other technical and leadership positions of increasing responsibility 

since joining AT&T in 1985. She is a graduate of the Georgia Institute of Technology with a Master’s degree in management of technology. She also holds a Bachelor’s degree in engineering from Central Missouri State University and an Associate in Business degree 

from Maryland University, European Division. 

Michael Aisenberg, Director of Government Relations for 

VeriSign, serves as the company’s principal liaison with the Administration and Federal agencies, including the Departments of 

Homeland Security, Defense, State, and Justice. He manages a 

portfolio of policy issues, including global infrastructure security, 

digital signatures, e-health, intellectual property and government 

procurement on behalf of the world’s leading Internet trust and 

identity provider. He is the Vice Chairman and Chair-Elect of the 

Information Technology Sector Coordinating Council. In 2004, he 

was elected Chairman of the ITAA’s Information Security Committee. He leads VeriSign’s participation in the President’s National Security Telecommunications Advisory Committee. He holds 

a B.A. from the University of Pennsylvania, a J.D. from the University of Maine Law School. He attended Georgetown University 

Law Center in 1975 and 1976, and upon graduation served 5 years 

as an attorney advisory and legislative counsel at the FCC. 

Karl Brondell, Strategic Consultant State Farm Insurance Companies, representing the Business Roundtable here today. He is a 

CPCU, a strategic consultant in the Strategic Resources Department of State Farm Insurance Company. He is the past Chairman 

of the Board of Directors for the Insurance Placement Facilities of 

Pennsylvania and Delaware. He is a member of the national CPCU 

International Insurance Section Committee and an at-large Board 

of Director for Villanova University’s Executive MBIA Alumni Association. He received a Bachelor’s degree from Benedictine College, Acheson, Kansas. I, by the way, have visited there. He has 

a Master’s degree from Villanova University in Villanova, Pennsylvania. He earned the Charter Property and Casualty Underwriter 

Designation and holds an Associate in Claims certificate and a certificate for general insurance. 

Welcome to you all. We will start with you, Mr. Noonan. 

20

1The prepared statement of Mr. Noonan appears in the Appendix on page 132. 

TESTIMONY OF THOMAS E. NOONAN,1 PRESIDENT AND CHIEF 

EXECUTIVE OFFICER, INTERNET SECURITY SYSTEMS 

Mr. NOONAN. Mr. Chairman, thank you for the opportunity to 

appear before you today. My name is Tom Noonan. I am President 

and Chief Executive Officer of Internet Security Systems. We are 

a leading provider of preemptive cyber security technologies for 

large-scale enterprises, and I represent the technology industry 

today. 

We operate five cyber security centers around the world, two in 

the United States, the rest in Asia through Tokyo, Australia, Brussels, and a partner operation in Latin America. We protect our customers by monitoring the Internet for cyber threats 24 hours a day, 

365 days a year, providing preemptive protection for customers. 

This is critical preemption before reconstitution, obviously. We utilize that security intelligence, technology, and expertise to preempt 

the strikes that would cripple critical networks and stay ahead of 

the threats. 

I want to stress three important messages about our Nation’s security landscape this morning, and this comes from my 13 years in 

this industry as one of the founders of this company and a person 

that has been working to advocate better security practices in both 

the private and public sector. 

First, threats to the critical infrastructure are real, and without 

a doubt, they are growing. The question is not if but when. The explosive growth of new Internet technologies, from wireless to voiceover Internet telephony, has engendered new threats that are far 

outpacing the security responses of many private and governmental 

users. 

Second, the intelligence protocols and technologies necessary to 

protect against emerging cyber threats are, by and large, robust 

and widely available. In other words, we have the tools at our disposal today to safeguard our critical infrastructure. 

And finally, despite our knowledge of these threats and our overall ability to protect ourselves, we as a Nation are not doing nearly 

enough to preempt the types of attacks that could debilitate our 

critical network infrastructure. Leadership is desperately needed at 

the Federal level, not to replicate existing private sector efforts but 

rather to extend the impact of those efforts by encouraging the private sector to collectively increase in cooperation with the government. 

This means five things for me this morning. First, appointing an 

Assistant Secretary of Homeland Security for Cyber Security and 

Telecommunications who will help secure the Federal Government’s own networks as well as those of the broader economy. 

Second, clearly delineating and hardening the roles and responsibilities of many public-private entities working today to secure 

cyberspace. 

Three, ensuring that the Federal Government makes use of existing industry resources to gather and analyze data on cyber security 

threats and methods. 

Four, creating a national plan to restore connectivity on a 

prioritized basis. 

21

And five, providing sustained Federal funding—that $65 billion 

sounds like a lot, but sustained Federal funding and active Congressional oversight to ensure that the Department of Homeland 

Security is getting the job done for this country. 

I think we know cyber threats are serious and they are growing 

in sophistication. The rules of criminal hacking today are no longer 

shaped by teenage malfeasants, but by confederated crime operations that are driven by the economics of opportunity, incentive, 

and risk, just like traditional theft, burglary, and extortion. 

I think it is this professionalization of cyber crime that is unsettling for many reasons, not the least of which are indications that 

those who would seek to do harm to our Nation have been working 

to improve their technological abilities. Particularly unsettling is 

not just the threat to privacy information, which we read about in 

the newspaper, or our e-commerce applications, but more importantly to the very control networks of the automated systems that 

control and regulate our Nation’s industrial systems, like SCADA. 

Control systems are now Internet-connected and they are susceptible to major attacks. Under contract with customers, ISS has conducted real world penetration tests with large power plants and 

others to show that they are at risk. 

Put simply, Mr. Chairman, the fact that our Nation’s critical infrastructure has yet to fall victim to a significant and coordinated 

cyber attack does not mean that it can’t happen. Emerging technologies coupled with an exponential increase in the use of new applications on the Internet have opened many new avenues to attack 

and keeping up with this large increase in vulnerabilities is a 

daunting task. It is only complicated by the shrinking window that 

we are seeing between the time a vulnerability is disclosed and the 

time that it is exploited by criminal interests. 

I think there is good news, Mr. Chairman. Our Nation already 

has the technological capabilities to protect the critical infrastructure. Private industry is operating positively against many of the 

requirements associated with technology, vulnerability, discussion, 

etc. But what is missing is genuine leadership on the part of the 

Federal Government. We, as a Nation, can protect our critical infrastructure, and in fact, we already are, but that requires also 

Federal leadership. 

I think your role here boils down to two things. The first one is 

minding the store, and I know that Secretary Chertoff and the Department of Homeland Security are working around the clock to 

protect the Nation, but we need to be able to talk to the person 

who is minding the store and that is the Assistant Secretary. 

Second, it is difficult for the Federal Government to preach 

strong cyber security practices across our economy when the Federal networks themselves are so woefully unprotected. While steps 

have been taken in recent years to improve agency security practices through FISMA, most Federal agencies are still getting failing 

marks when it comes to securing their networks. 

When it comes to strengthening Federal leadership, I just want 

to reiterate these five points in closing. Appointment of the Assistant Secretary for Cyber Security and Telecommunications. The job 

has been open for over a year. 

22

1The prepared statement of Ms. Bienfait appears in the Appendix on page 139. 

Two, a clear delineation and hardening of the roles and responsibilities of these countless public-private entities. 

Three, ensuring that the Federal Government makes full use of 

existing industry resources. We are absolutely willing and able to 

participate as a private sector. 

Four, we need to develop the national plan to restore connectivity 

on a prioritized basis. 

And five, sustained Federal funding. 

So there is no silver bullet here, Mr. Chairman. Securing our Nation’s infrastructure from cyber attack requires a heightened degree of public-private coordination and I think it is a challenge but 

it is one we are up to. We are pleased at ISS to be partnering with 

you and I thank you for the opportunity to participate this morning. 

Chairman COBURN. Thank you. Ms. Bienfait. 

TESTIMONY OF ROBERTA A. BIENFAIT,1 SENIOR VICE 

PRESIDENT, GLOBAL NETWORK OPERATIONS, AT&T 

Ms. BIENFAIT. Good morning, Mr. Chairman. 

Chairman COBURN. Good morning. 

Ms. BIENFAIT. My name is Robin Bienfait and I am Senior Vice 

President of AT&T’s Global Network Operations. I want to thank 

you for allowing me to share with you what we have done and 

what we are generally doing to ensure the reliability and 

restorability of AT&T network services. We are committed to a 

strong public-private partnership and we hope our experience is 

helpful. 

We believe there are keys to network security and disaster recovery and I will focus on the following areas: The strength of the public-private partnership; the lessons learned, especially from Hurricane Katrina and the 2003 Midwest and Northeast power outages; 

and a series of policy recommendations. 

Our country relies on cyber and physical infrastructure that is 

provided by a very close partnership among all the providers and 

users of this infrastructure. Each partner, both in the public and 

private sector, has a responsibility to keep their part of the infrastructure working. They also each have a responsibility to be able 

to recover or restore their piece of the infrastructure. 

At AT&T, our goal is to have a network where failures are prevented or identified and corrected before they affect our customers. 

Since 1991, we have invested more than $300 million in our mobile 

network disaster recovery infrastructure and capabilities. We have 

also invested $200 million in a system that proactively monitors 

and manages the networks of some of our largest customers. 

We have more than 500 fully loaded emergency communication 

vehicles that we can quickly deploy to respond to any disaster anywhere in the United States. We have the basic building blocks of 

our network infrastructure installed in 150 technology trailers and 

it is ready to roll at a moment’s notice. 

I would like to draw on the examples of Hurricane Katrina and 

the 2003 blackouts to illustrate our approach to response and resVerDate 0ct 09 2002 08:46 May 22, 2007 Jkt 029759 PO 00000 Frm 00026 Fmt 6633 Sfmt 6633 C:\DOCS\29759.TXT SAFFAIRS PsN: PAT
23

toration efforts and to show you how our incident command structure makes every minute count. 

For Hurricane Katrina, we followed our prescribed command and 

control approach to a tee. AT&T began moving equipment and 

teams from around the country toward the Gulf States in the days 

before the storm made landfall. The first team restored AT&T service to its prior levels, a second team maintained and monitored 

AT&T’s facilities so as to prevent new issues from arising, and a 

third team came in to help others. 

AT&T worked around the clock to respond to this crisis and safeguard its network and support the efforts to respond to the disaster. AT&T was also able to direct its effort to benefit its customers, other telecommunication competitors and their customers, 

first responders, and evacuees, as needed. AT&T also helped to provide relief to those directly affected by the hurricane and flooding 

and assistance to charitable relief efforts. 

Thanks to these efforts and the intense dedication of the employees involved, AT&T’s network remained essentially intact. We were 

able to carry at least 95 percent of all calls in the Gulf Coast area 

that came to our network. Of the five percent of our capacity in the 

area that was initially lost, we restored half of that capacity within 

a couple of hours. 

Related to the blackouts, as you know, in 2003, large portions of 

the Midwest, Northeast, and Ontario, Canada, experienced an electrical power blackout affecting 50 million people. Power was not restored for 4 days in some parts of the United States. Because of 

the reliability and redundancy that we designed and built into our 

network infrastructure, Internet traffic, data services, and voice 

calls flowed across our network without interruption. 

These and other experiences have reinforced lessons that we 

must incorporate in future planning and are the basis of our following policy recommendations. More detailed recommendations 

are available in my written testimony. 

Establish and practice disaster recovery processes in anticipation 

of emergencies. Communication resources can be brought where 

needed very quickly, but it is essential that those clear lines of 

command and control at all times are there to direct those resources effectively and to the area of greatest need. A single agency 

must be identified, funded, empowered to act as a national cyber 

incident commander for any required cyber infrastructure recovery 

and reconstitution efforts. 

Coordinate restoration and recovery efforts. Everyone available 

should be participating and there needs to be coordination so the 

efforts are not duplicated or in conflict with one another. Logistical 

information, such as what roads are closed and what medical precautions are needed, must be readily available. Moreover, a recommendation we made after September 11 still has not been widely implemented. Companies such as AT&T that are crucial to the 

response to disasters should have special credentials designed for 

employees and accredited in advance in order to assess disaster 

areas. 

Minimize the amount of regulation and data reporting requirements during a disaster and maximize the amount of coordination 

and cooperation between public and private sector. 

24

1The prepared statement of Mr. Aisenberg appears in the Appendix on page 161. 

Interoperability and spectrum availability. A crisis on the scale 

we saw in the Gulf Coast and smaller challenges, as well, demand 

a well-coordinated information and communications delivery system. We must resolve the spectrums needed and highlighted by the 

9/11 Commission. 

Consider subsidizing some of the emergency preparation by infrastructure companies. The government is likely to call on such capabilities in use or would otherwise need to duplicate resources ineffectively. 

We can never anticipate every contingency in an emergency, nor 

can we assure a foolproof communications network all the time 

under all circumstances. Nonetheless, at AT&T, we have done 

much to ensure reliability and restorability of communication networks, and together as an industry and as a Nation, we can do 

more. I thank you for holding this hearing to advance this important discussion. 

Chairman COBURN. Thank you, Ms. Bienfait. Mr. Aisenberg 

TESTIMONY OF MICHAEL A. AISENBERG,1 DIRECTOR OF GOVERNMENT RELATIONS, VERISIGN, INC., AND VICE CHAIR, IT 

SECTOR COORDINATING COUNCIL 

Mr. AISENBERG. Thank you, Mr. Chairman. Thank you for the 

opportunity to appear before the Subcommittee today. 

VeriSign’s 4,600 employees operate intelligent infrastructures 

that enable and protect billions of interactions every day across the 

world’s voice and data networks. I, too, have three key points I 

would like to make today. 

First, those who make policy in the United States must understand the economic value and critical interdependencies we have 

developed on our information networks. 

Second, we must understand and accommodate to the global nature of both our information networks and the attacks that are 

being continually mounted against them. 

Third, largely owned and operated by the private sector, our network security and ability to withstand and recover from the continuing attacks against them depends on effective partnership between government and we, the industry stewards. 

Americans must keep a clear focus on the critical economic and 

national security role which our information networks have come 

to fulfill. In less than two decades, the industrial nations have 

evolved an irreversible dependency and interdependency by our 

banking, finance, transportation, health care, education, power, 

manufacturing, and government service sectors on the networks 

managed by the companies, mostly American, which make up the 

ICT sector. 

Each day, $3 trillion pass over secure Federal financial networks. 

If these electronic transactions do not have Internet sites, such as 

NYSE.net, BankofAmerica.com, and Treasury.gov, available, secure, and running, the U.S. economy begins to grind to a halt at 

the rate of $130 billion per hour. 

As you have noted, Mr. Chairman, cyber security is indeed a responsibility which we all share and in which we all have a stake. 

25

We must recognize that information networks are global, increasingly managed by interests beyond U.S. control, but at the same 

time subjected to threats and attacked by actors from around the 

world. The role of an effective government cyber security function 

and government-industry partnership is central to the BRT report’s 

critical conclusion. America needs a much improved cyber security 

activity, not just in DHS, but across government and industry interests. 

But while its conclusions are consistent with others from industry, the BRT report’s suggestions about the extent and effectiveness 

of industry engagement with DHS are, I believe, out of touch with 

important progress being made in public-private collaboration in 

the last 18 months. There have been many, and there are increasingly significant collaborative engagements between the cyber industry and DHS, some of which were outlined by Secretary 

Foresman. 

In 2005, commented engagement with industry began to be regularly sought by new DHS leadership. Involvement in DHS policy 

processes from their beginning rather than at the end began to be 

practiced. Examples include the national cyber security exercise 

Cyber Storm, concluded in February of this year, DHS’s Internet 

Disruption Working Group, the IDWG, the government Security 

Operations Community, GFirst, the just-released NIPP process, 

and the ongoing sector-specific plans just under development. 

Mr. Chairman, my sector colleagues and I have found these activities valuable and a marked departure from what we experienced prior to 2005. This steady improvement and expansion of industry involvement with DHS cyber and network security activities 

must continue. 

But while these milestones and improvement in the relationship 

between cyber sector industry interests and the NCSD and NCC 

staff are important and significant, they are not a solution, but a 

beginning. 

Mr. Chairman, we are at least twice as good in our cooperation 

as we have been, but we are not half as good as we need to be. 

Indeed, many of us believe that notwithstanding these improved 

public and private engagements, the operational posture is still 

fraught with risk. If a September 11-type attack were to take down 

the NYSE today, I doubt the Exchange could restore its networkdependent functions in the same 4 days it did in 2001, and indeed, 

perhaps not in 4 weeks, and the principal reason for this is DHS, 

or rather the bureaucratic impediments, many of which have already been discussed this morning, to the kind of action that the 

private sector was able to engage in in 2001 and was thwarted at 

during Hurricane Katrina. 

We need to act without delay to ensure that our networks and 

critical dependent sectors are resilient enough to withstand the 

daily attacks being mounted against them. And as the GAO is reporting today, they must be supported by the appropriate tools 

from government as well as industry to assure the ability to recover with minimum collateral impact on our economy and security. 

To conclude, Mr. Chairman, going forward, several steps are necessary. First, DHS’s modest cyber security budget must be insuVerDate 0ct 09 2002 08:46 May 22, 2007 Jkt 029759 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 C:\DOCS\29759.TXT SAFFAIRS PsN: PAT
26

1The prepared statement of Mr. Brondell appears in the Appendix on page 167. 

lated from the continuing reprogramming and budgetary cuts now 

underway. 

Second, a cyber security leader with credibility in industry must 

be identified and appointed as DHS’s permanent Assistant Secretary for Cyber Security and Telecommunications without further 

delay. 

Third, critical R&D projects to improve key network security protocols must be funded and launched or relaunched. 

Mr. Chairman, if we do these things, we will not guarantee that 

our adversaries will stop attacking our critical cyber assets, but we 

will improve the likelihood that we will continue to successfully 

withstand those attacks and retain the availability of these infrastructures on which we are now so dependent. Thank you, Mr. 

Chairman. 

Chairman COBURN. Thank you, Mr. Aisenberg. Mr. Brondell. 

TESTIMONY OF KARL BRONDELL,1 STATE FARM INSURANCE 

COMPANIES, ON BEHALF OF THE BUSINESS ROUNDTABLE 

Mr. BRONDELL. Thank you, Mr. Chairman. I am honored for this 

opportunity to testify today on Internet recovery on behalf of the 

Business Roundtable. 

Following the attacks of September 11, Roundtable CEOs formed 

the Security Task Force to address ways the private sector can improve the security of its employees, facilities, communities, and our 

Nation. The Roundtable believes that the business community 

must be a partner with government in disaster preparedness and 

response. The Roundtable commends the Subcommittee and its 

members for their continued interest in improving procedures and 

preparedness to ensure recovery of the Internet following a major 

disruption. Hardening the Internet and strengthening cyber security is one of the priorities of our Security Task Force. 

More than a year ago, the Roundtable began work on an initiative to assess the public and private sector plans and procedures 

for Internet recovery following a cyber catastrophe. We have just 

produced and delivered a report, ‘‘Essential Steps to Strengthen 

America’s Cyber Terrorism Preparedness,’’ which finds that the 

United States is ill-prepared for a cyber catastrophe, with significant ambiguities in public and private sector responses that would 

be needed to restore and recover the Internet following a disaster. 

As the Subcommittee knows, the Internet and the cyber infrastructure serve as a critical backbone for the Nation’s economy and 

its uninterrupted use is a crucial issue for our national and homeland security. But our analysis has exposed significant weaknesses 

that could paralyze the economy following a massive disruption. 

Despite progress having been made over the past decades on 

technical and IT issues, there are other issues that have not received the same attention. The Roundtable’s report identifies three 

significant gaps in our Nation’s response plans to restore the Internet. 

First, we found the United States lacks an early warning system 

to identify potential Internet attacks or determine if the disruptions are spreading rapidly across critical systems. 

27

Second, public and private organizations that would oversee restoration and recovery of the Internet have unclear or overlapping 

responsibilities, resulting in too many institutions with too little 

interaction and coordination. 

Finally, existing organizations and institutions charged with the 

Internet recovery have insufficient resources and support. 

Collectively, these gaps mean that the United States is not sufficiently prepared for a major attack. If our Nation is hit by a cyber 

catastrophe that wipes out large parts of the Internet, there is no 

coordinated public-private plan in place to restart and restore it. 

Let me make another point. Although there is no agreement 

among experts about the likelihood of a widescale cyber disaster, 

they do agree that the risks and the potential outcomes are serious 

enough to mandate careful planning and preparation. 

In my remaining time, let me talk briefly about our recommendations for government and business to consider. We believe it is important to understand that response and recovery to a cyber disaster will be different from natural disasters when the Federal 

Government has the leading role. Industry must undertake principal responsibility following an incident for reconstituting the communications infrastructure and the Internet. We believe that business and government must take action, individually and collectively, to address these issues. 

Let us start with the government. The Roundtable calls on the 

Federal Government to establish clear roles and responsibilities, to 

fund long-term programs, and ensure that national response plans 

treat major Internet disruptions as serious national problems. 

Regarding the private sector, our report urges companies to designate a point person for cyber recovery, update their strategic 

plans, and set priorities to prepare for a widespread Internet outage and its impact on the movement of goods and services. 

When it comes to protecting our Nation, neither the government 

nor business can do it alone. We feel the best security solutions will 

come from a public-private partnership that identifies and acts on 

ways to improve collaboration. Let me discuss a few of the collaboration recommendations. 

First, since the first 24 hours often determine the overall success 

of recovery efforts, we must focus more attention on coordinating 

initial efforts to identify when an Internet attack or disruption is 

occurring. 

Second, we recommend the creation of a federally-funded panel 

of experts from business, government, and academia who would assist in developing plans for restoring Internet services in the event 

of a massive disruption. 

Finally, we believe the Department of Homeland Security, together with business, should conduct large-scale cyber emergency 

exercises with lessons learned integrated into programs and procedures. 

Without change, our Nation will continue to use ad hoc and incomplete tools for managing our critical risk to the Internet and to 

our Nation’s economy and its security. 

Up to this point, I have outlined for the Subcommittee the basis 

for our observations and some of the recommendations to consider. 

Now I would like to spend a moment telling you about the 

28

Roundtable’s plans to find solutions to the gaps that we have identified. 

First, let me say that we are confident that our member companies are able to manage most disruptions that affect Internet operations. For this reason, the Roundtable will focus its efforts on 

those large-scale events that no single company is positioned to 

manage absent widespread cross-industry and government collaboration. 

As an extension of our previous work, the Roundtable will examine the processes, protocols, and practices across the private sector 

before, during, and after a disruptive event. We will assess which 

institutions respond, how early warnings are established, and how 

companies access information and service critical disruptions and 

emergency situations. We believe this will provide a foundation for 

meaningful improvements in our Nation’s ability to protect and 

restore the Internet as well as clarify specific, meaningful, and actionable decisions that will lead to well-coordinated public and private response and reconstitution processes. 

In conclusion, let me again thank the Chairman for the opportunity to present the Business Roundtable’s report on cyber preparedness and to discuss our recommendations for improvements. 

Roundtable CEOs believe strongly that we need a national response to this challenge, not separate business and government responses, and that means better collaboration. I assure you, America’s CEOs and our companies are committed to do their part. 

Thank you. 

Chairman COBURN. Thank you. 

One of the things I take from you all is leadership is important, 

and the fact that we don’t have the position filled is significant. 

You know, that is a real problem in our Nation today and I don’t 

know what the cause of it is. Some people say, well, the salaries 

aren’t high enough. But for us to secure our future, we are going 

to have to make individual sacrifice and that means somebody out 

of private industry needs to come up and fulfill this role. When 

they are trying to recruit and nobody wants to do it because they 

are not willing to sacrifice a little bit of earnings for 3 or 4 years 

and make a commitment to make a difference to our country, we 

are losing the very essence of what it means to be Americans. 

So it is pretty hard to hire somebody into a Federal Government 

agency into a position that is going to mean their salary is going 

to be cut in half if there is no patriotic thought that you can make 

a contribution to our country. Each of you have raised that. Do any 

one of you all want to volunteer for that position? [Laughter.] 

Mr. NOONAN. I know someone that does, sir. 

Chairman COBURN. Well, the man that probably is involved in 

that decision is sitting behind you. I hope you will communicate 

that with Secretary Foresman. 

Mr. NOONAN. I certainly will. 

Chairman COBURN. I appreciate him being here. 

Just quickly, I am going to have several questions and I can’t get 

them all through to you, so I am going to submit them in writing. 

What do you think about the GAO’s report? Mr. Brondell has just 

made a recommendation, we have got all these working groups. 

Here is what you all think we ought to do. We have got working 

29

groups, yet we basically have nobody in charge. What would happen tomorrow if a major event happened? We don’t have the coordination across government to the private sector to establish that. So 

how do we respond? How do we take your recommendation, Mr. 

Brondell, versus the problem? We have got working groups. We 

have got people that are involved in it. How do we get it off dead 

center and make something happen? 

Mr. BRONDELL. First of all, we do applaud that the efforts are 

moving in the right direction. As you heard earlier this morning, 

it is a long road that we are going to have to pull, but as we look 

at a collaborative approach, we do agree and have suggested that 

we do need some focal point within the government that private 

sector can rely upon. We support the addition of the position. We 

hope that it gets filled quickly and goes through the administrative 

process to be in place. 

But to your question of what we would do today if it happened, 

industry would continue to respond as it has in the past and overcome the hurdles based on the experience from past smaller incidents. But the lacking of collaboration, it could damage the overall 

economy with a long delay. 

Chairman COBURN. Mr. Aisenberg. 

Mr. AISENBERG. Senator, we see a steady stream of insults 

against the network on a daily basis. VeriSign routinely repels 

1,000 or more attacks against the naming infrastructure, the DNS, 

every day. Major events happen with greater frequency than makes 

us happy, but we are successful in repelling those now, by and 

large. But every day, the sophistication in those attacks grows. The 

sources of them becomes more diverse and the risks inherent, 

therefore, becomes more severe. 

So you are absolutely right. We need a more coordinated approach. We cannot guarantee, no one can guarantee that an attack 

will not at some point be successful, and I agree, the ability to reconstitute and recover from a serious attack at the moment is not 

as good as we need it to be, and I could not predict how severe or 

how long a major attack that took down the naming system or fundamental other aspects of the Internet could persist and impact the 

economy. Our best defense is the aggressive investment that the 

infrastructure stewards make in massive overhead, massive engineering, constant exercising, constant testing of the security, and 

vigilance, and a little bit of good luck. 

Chairman COBURN. Is there an early warning system out there 

now? 

Mr. AISENBERG. It depends on what you mean by early warning. 

Ms. BIENFAIT. Not one that you would actually, as we would do 

with a hurricane in an emergency scenario, we see a hurricane 

coming and we have got a way to give an early warning——

Chairman COBURN. No, I mean is there a communication network where, whether it is NSA or whoever is experiencing it, all 

of the sudden, this is a major attack and time is of the essence and 

everybody knows it is happening in one area so they can prepare 

if their area is about to get hit. Is that out there now? 

Ms. BIENFAIT. Not across——

Chairman COBURN. Is there an early warning system so that 

there is communication to all the players that something is hapVerDate 0ct 09 2002 08:46 May 22, 2007 Jkt 029759 PO 00000 Frm 00033 Fmt 6633 Sfmt 6633 C:\DOCS\29759.TXT SAFFAIRS PsN: PAT
30

pening. You need to know about it. Here is what we see. You might 

be next. Is that happening now? 

Ms. BIENFAIT. We have something internal to ourselves that we 

can actually see the signatures and the knocking of all the hacking 

attacks against our network——

Chairman COBURN. That is your network? 

Ms. BIENFAIT. That is my network. But we are only doing this 

in our own domain. We are not doing a lot across companies, across 

collaboration——

Chairman COBURN. Is there something that prevents you legally 

from being able to communicate that with the rest of the service 

providers? 

Ms. BIENFAIT. Nothing at this point in time, other than us getting a trusted environment where we could actually do pre-planning ahead of time so that we know what that information might 

look like. We are doing some of that right now, trying to put best 

practices together, but there is not anything formal to the point 

that we know how to pull up a security alert and actually say, hey, 

the collaboration of the different units, I am going to shut down 

this part of my network or I am going to open up that part of my 

network so that this work can flow through. 

Chairman COBURN. And you would all agree that is needed? 

Ms. BIENFAIT. I think it is necessary. 

Chairman COBURN. It is needed, and one of the reasons it is not 

is because there is not a position of leadership and trust which you 

can work through? 

Ms. BIENFAIT. You really have to have a very trusted environment. It is essential——

Chairman COBURN. Otherwise you expose proprietary information. 

Ms. BIENFAIT. Exactly. And we are working through that, it is 

just not moving fast enough. 

Chairman COBURN. OK. 

Mr. AISENBERG. Senator, another aspect of that is that what we 

call the millisecond sectors—electric power, communications, IT—

frequently see insults only after they are actually mounted. Unlike 

intelligence gathering around physical attacks where you hear a tip 

from one individual and you can grow your investigative technique, 

very often when the attacks are mounted against the Internet or 

the communications or power networks, you don’t see the attacks 

until they are already at their zero moment and are massively engaging the infrastructure. 

Chairman COBURN. But, in fact, we know that is a possibility, so 

we can design to prevent that if we have the structure in place to 

communicate it, cross-communicate it without the sharing of proprietary data that would put somebody at a competitive disadvantage. I mean, that is possible. Everybody would agree with that, 

right? 

Mr. NOONAN. Right. There is already a foundation in place, sir, 

but it is not broadly available cross-industry, cross-sector, crossagency and government. There are multiple early warning activities that are operating at various levels of efficacy. These include 

the ISAC, the Information Sharing and Analysis Centers that are 

established as part of the IT, or as part of the Sector Coordinating 

31

Councils. They are not fully operating cross-functionally today, but 

they are a foundation that has been being built for many years. 

There are issues, but we are making progress there. 

I think the early warning vulnerability disclosure activity that is 

underway has actually moved this industry along in a number of 

years. If we know where our vulnerabilities are, there is a pretty 

good chance that is where the attacks are going to be. Whether 

they are malicious and disruptive or whether they are quiet and 

compromising, they are typically getting through our 

vulnerabilities. 

There, I think we have made progress. However, as an industry, 

or both a public and private sector perspective, we don’t have the 

equivalent of turn on CNN and get the hurricane early warning 

system. We simply don’t have that. 

Chairman COBURN. Are there any other comments from any of 

you all on the GAO report? 

[No response.] 

Chairman COBURN. I don’t know if the silence is because—I 

won’t say that. I will just let it go with that. 

None of you would disagree with the fact that there could be 

somebody in a position that could maintain the trust of the providers and the service companies and the Internet industry and 

work for government and maintain the integrity that is required 

for us to solve these problems. Would you agree with that? 

Ms. BIENFAIT. I would agree with that. 

Mr. NOONAN. I would agree. 

Chairman COBURN. So one of the real issues for us to move 

things offline is to fill the position with somebody that has the competency, character, and trust of the industry and the government 

and can put the impetus behind moving forward. If this hearing 

does anything with that, we will have accomplished something. 

I want to thank each of you for being here. This is a difficult 

problem we face, but it is also, besides difficult, it is critical. Our 

country can’t take many more hits. This is one that is preventable, 

provided we do the right thing. It is at least, if not preventable, recoverable if we do the right thing. 

I would hope that we will continue to have good communications. 

We will have other hearings on this. We are going to move. There 

is going to be an Assistant Secretary, I promise you. Even if we 

have to raise the salary for the position, there is going to be one 

because it is just too important. 

We will be submitting some questions to you. I would hope that 

you would return those to us within 2 weeks. 

I thank you for your service, and the hearing is adjourned. 

[Whereupon, at 11:12 a.m., the Subcommittee was adjourned.] 

(33)

A P P E N D I X 


29759.001
34


29759.002
35


29759.003
36


29759.004
37


29759.005
38


29759.006
39


29759.007
40


29759.008
41


29759.009
42


29759.010
43


29759.011
44


29759.012
45


29759.013
46


29759.014
47


29759.015
48


29759.016
49


29759.017
50


29759.018
51


29759.019
52


29759.020
53


29759.021
54


29759.022
55


29759.023
56


29759.024
57


29759.025
58


29759.026
59


29759.027
60


29759.028
61


29759.029
62


29759.030
63


29759.031
64


29759.032
65


29759.033
66


29759.034
67


29759.035
68


29759.036
69


29759.037
70


29759.038
71


29759.039
72


29759.040
73


29759.041
74


29759.042
75


29759.043
76


29759.044
77


29759.045
78


29759.046
79


29759.047
80


29759.048
81


29759.049
82


29759.050
83


29759.051
84


29759.052
85


29759.053
86


29759.054
87


29759.055
88


29759.056
89


29759.057
90


29759.058
91


29759.059
92


29759.060
93


29759.061
94


29759.062
95


29759.063
96


29759.064
97


29759.065
98


29759.066
99


29759.067
100


29759.068
101


29759.069
102


29759.070
103


29759.071
104


29759.072
105


29759.073
106


29759.074
107


29759.075
108


29759.076
109


29759.077
110


29759.078
111


29759.079
112


29759.080
113


29759.081
114


29759.082
115


29759.083
116


29759.084
117


29759.085
118


29759.086
119


29759.087
120


29759.088
121


29759.089
122


29759.090
123


29759.091
124


29759.092
125


29759.093
126


29759.094
127


29759.095
128


29759.096
129


29759.097
130


29759.098
131


29759.099
132


29759.100
133


29759.101
134


29759.102
135


29759.103
136


29759.104
137


29759.105
138


29759.106
139


29759.107
140


29759.108
141


29759.109
142


29759.110
143


29759.111
144


29759.112
145


29759.113
146


29759.114
147


29759.115
148


29759.116
149


29759.117
150


29759.118
151


29759.119
152


29759.120
153


29759.121
154


29759.122
155


29759.123
156


29759.124
157


29759.125
158


29759.126
159


29759.127
160


29759.128
161


29759.129
162


29759.130
163


29759.131
164


29759.132
165


29759.133
166


29759.134
167


29759.135
168


29759.136
169


29759.137
170


29759.138
171


29759.139
172


29759.140
173


29759.141
174


29759.142
175


29759.143
176


29759.144
177


29759.145
178


29759.146
179


29759.147
180


29759.148
181


29759.149
182


29759.150
183


29759.151
184


29759.152
185


29759.153
186


29759.154
187


29759.155
188


29759.156
189


29759.157
190


29759.158
191


29759.159
192


29759.160
193


29759.161
194


29759.162
195


29759.163
196


29759.164
197


29759.165
198


29759.166
199


29759.167
200


29759.168
201


29759.169
202


29759.170
203


29759.171
204


29759.172
205


29759.173
206


29759.174
207


29759.175
208


29759.176
209


29759.177
210


29759.178
211


29759.179
212


29759.180
213


29759.181
214


29759.182
215


29759.183
216


29759.184
217


29759.185
218


29759.186
219


29759.187
220


29759.188
221


29759.189
222


29759.190
223


29759.191
224


29759.192
225


29759.193
226


29759.194
227


29759.195
228


29759.196
229

Æ


29759.197