U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

86–900PDF 2014

HEALTHCARE.GOV: CONSEQUENCES 

OF STOLEN IDENTITY 

HEARING 

BEFORE THE

COMMITTEE ON SCIENCE, SPACE, AND 

TECHNOLOGY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

SECOND SESSION 

JANUARY 16, 2014 

Serial No. 113–62 

Printed for the use of the Committee on Science, Space, and Technology 

( 

Available via the World Wide Web: http://science.house.gov 
(II) 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

HON. LAMAR S. SMITH, Texas, Chair 

DANA ROHRABACHER, California 

RALPH M. HALL, Texas 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

FRANK D. LUCAS, Oklahoma 

RANDY NEUGEBAUER, Texas 

MICHAEL T. MCCAUL, Texas 

PAUL C. BROUN, Georgia 

STEVEN M. PALAZZO, Mississippi 

MO BROOKS, Alabama 

RANDY HULTGREN, Illinois 

LARRY BUCSHON, Indiana 

STEVE STOCKMAN, Texas 

BILL POSEY, Florida 

CYNTHIA LUMMIS, Wyoming 

DAVID SCHWEIKERT, Arizona 

THOMAS MASSIE, Kentucky 

KEVIN CRAMER, North Dakota 

JIM BRIDENSTINE, Oklahoma 

RANDY WEBER, Texas 

CHRIS COLLINS, New York 

VACANCY 

EDDIE BERNICE JOHNSON, Texas 

ZOE LOFGREN, California 

DANIEL LIPINSKI, Illinois 

DONNA F. EDWARDS, Maryland 

FREDERICA S. WILSON, Florida 

SUZANNE BONAMICI, Oregon 

ERIC SWALWELL, California 

DAN MAFFEI, New York 

ALAN GRAYSON, Florida 

JOSEPH KENNEDY III, Massachusetts 

SCOTT PETERS, California 

DEREK KILMER, Washington 

AMI BERA, California 

ELIZABETH ESTY, Connecticut 

MARC VEASEY, Texas 

JULIA BROWNLEY, California 

MARK TAKANO, California 

ROBIN KELLY, Illinois 
(III) 

C O N T E N T S 

January 16, 2013 

Page 

Witness List ............................................................................................................. 2 

Hearing Charter ...................................................................................................... 3 

Opening Statements 

Statement by Representative Lamar S. Smith, Chairman, Committee on 

Science, Space, and Technology, U.S. House of Representatives ..................... 7 

Written Statement ............................................................................................ 8 

Statement by Representative Eddie Bernice Johnson, Ranking Member, Committee on Science, Space, and Technology, U.S. House of Representatives .... 9 

Written Statement ............................................................................................ 10 

Witnesses: 

Mr. David Kennedy, Chief Executive Officer, TrustedSEC, LLC 

Oral Statement ................................................................................................. 13 

Written Statement ............................................................................................ 16 

Mr. Waylon Krush, Co-Founder and CEO, Lunarline, Inc. 

Oral Statement ................................................................................................. 30 

Written Statement ............................................................................................ 32 

Mr. Michael Gregg, Chief Executive Officer, Superior Solutions, Inc. 

Oral Statement ................................................................................................. 40 

Written Statement ............................................................................................ 42 

Dr. Lawrence Ponemon, Chairman and Founder, Ponemon Institute 

Oral Statement ................................................................................................. 49 

Written Statement ............................................................................................ 52 

Discussion ................................................................................................................. 57 

Appendix I: Answers to Post-Hearing Questions 

Mr. David Kennedy, Chief Executive Officer, TrustedSEC, LLC ........................ 88 

Mr. Waylon Krush, Co-Founder and CEO, Lunarline, Inc. ................................. 102 

Mr. Michael Gregg, Chief Executive Officer, Superior Solutions, Inc. ................ 108 

Dr. Lawrence Ponemon, Chairman and Founder, Ponemon Institute ................ 113 

(1) 

HEALTHCARE.GOV: CONSEQUENCES OF 

STOLEN IDENTITY 

THURSDAY, JANUARY 16, 2014 

HOUSE OF REPRESENTATIVES, 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY, 

Washington, D.C. 

The Committee met, pursuant to call, at 9:13 a.m., in Room 2318 

of the Rayburn House Office Building, Hon. Lamar Smith [Chairman of the Committee] presiding. 
2 
3 
4 
5 
6 
7 

Chairman SMITH. The Committee on Science, Space, and Technology will come to order. 

Welcome to today’s hearing titled ‘‘HealthCare.gov: Consequences 

of Stolen Identity.’’ I will recognize myself for an opening statement 

and then the Ranking Member. 

When the Obama Administration launched HealthCare.gov, 

Americans were led to believe that the website was safe and secure. As the Science, Space, and Technology Committee learned at 

our hearing last November, this was simply not the case. We heard 

troubling testimony from online security experts who highlighted 

the many vulnerabilities of the Obama website. These flaws pose 

significant risks to Americans’ privacy and the security of their personal information. 

One witness, Mr. David Kennedy, who has been re-invited for today’s hearing, testified that there are ‘‘clear indicators that even 

basic security was not built into the HealthCare.gov website.’’ In 

addition, all four experts testified that the website is not secure 

and should not have been launched. Mr. Kennedy will update the 

Committee on the security of the website since November 30, 2013, 

which was the Administration’s self-imposed deadline for when it 

would be fixed. 

Since the November hearing, other events have emerged that 

prompted the need for today’s hearing. In December, a former senior security expert at the Centers for Medicare and Medicaid Services stated that she recommended against launching the 

HealthCare.gov website on October 1st because of ‘‘high-risk security concerns.’’ 

A letter addressed to the Committee from Mr. Kennedy and independently signed by seven other security researchers who reviewed 

his analysis of vulnerabilities presents some very troubling information. To paraphrase one of the experts, Mr. Kevin Mitnick, who 

was once the world’s most wanted hacker, breaking into 

HealthCare.gov and potentially gaining access to the information 

stored in these databases would be a hacker’s dream. According to 

Mr. Mitnick, a breach may result in massive identity theft never 

seen before. Without objection, Mr. Kennedy’s letter will be made 

a part of the record. 

Chairman SMITH. Further, a recent report by the credit bureau 

and consumer data tracking service Experian forecasts an increase 

in data breaches in 2014, particularly in the healthcare industry. 

Specifically, the report states: ‘‘The healthcare industry, by far, will 

be the most susceptible to publicly disclosed and widely scrutinized 

data breaches in 2014. Add to that the Health Care Insurance Exchanges, which are slated to add seven million people into the 

healthcare system, and it becomes clear that the industry, from 

local physicians to large hospital networks, provide an expanded 

attack surface for breaches.’’ Experian provides the identity 

verification component of the Health Insurance Marketplace enrollment process. 

Because of increased accessibility to HealthCare.gov, concerns 

continue to grow about the security of personal information. The 

work of this Committee will help Congress make decisions about 

what actions may be necessary to further inform and safeguard the 

American people. 
8 

We are here today to discuss whether the Americans who signed 

up for healthcare plans have put their personal information at risk. 

If Americans’ information is not secure, then the theft of their identities is inevitable and dangerous. 

[The prepared statement of Mr. Smith follows:] 

PREPARED STATEMENT OF CHAIRMAN LAMAR S. SMITH

When the Obama Administration launched Healthcare.gov, Americans were led to 

believe that the website was safe and secure. As the Science, Space, and Technology 

Committee learned at our hearing in November, this was not the case. 

We heard troubling testimony from online security experts who highlighted the 

many vulnerabilities of the Obamacare website. These flaws pose significant risks 

to Americans’ privacy and the security of their personal information. 

One witness, Mr. David Kennedy, who has been re-invited for today’s hearing, testified that there are ‘‘clear indicators that even basic security was not built into the 

Healthcare.gov website.’’ 

In addition, all four experts testified that the website is not secure and should 

not have been launched. Mr. Kennedy will update the Committee on the security 

of the website since November 30, 2013, which was the Administration’s self-imposed deadline for when it would be fixed. 

Since the November hearing, other events have emerged that prompted the need 

for today’s hearing. In December, a former senior security expert at the Centers for 

Medicare and Medicaid Services stated that she recommended against launching the 

Healthcare.gov website on October 1st because of ‘‘high risk security concerns.’’ 

A letter addressed to the Committee from Mr. Kennedy and independently signed 

by seven other security researchers who reviewed his analysis of vulnerabilities presents some very troubling information. 

To paraphrase one of the experts, Mr. Kevin Mitnick, who was once the world’s 

most wanted hacker, breaking into Healthcare.gov and potentially gaining access to 

the information stored in these databases would be a hacker’s dream. According to 

Mr. Mitnick, ‘‘A breach may result in massive identity theft never seen before.’’ 

Further, a recent report by the credit bureau and consumer data tracking service 

Experian forecasts an increase in data breaches in 2014, particularly in the 

healthcare industry. Specifically, the report states: ‘‘The healthcare industry, by far, 

will be the most susceptible to publicly disclosed and widely scrutinized data 

breaches in 2014. Add to that the Healthcare Insurance Exchanges, which are slated to add seven million people into the healthcare system, and it becomes clear that 

the industry, from local physicians to large hospital networks, provide an expanded 

attack surface for breaches.′′ 

Experian provides the identity verification component of the Health Insurance 

Marketplace enrollment process. 

Despite increased accessibility to Healthcare.gov, concerns continue to grow about 

the security of personal information. 

The work of this Committee will help Congress make decisions about what actions 

may be necessary to further inform and safeguard the American people. 

We are here today to discuss whether the Americans who have signed up for 

health plans have put their personal information at risk. If Americans’ information 

is not secure, then the theft of their identities is inevitable and dangerous. 
9 

Chairman SMITH. That concludes my opening statement, and the 

gentlewoman from Texas, Ms. Johnson, is recognized for hers. 

Ms. JOHNSON. Thank you very much, Mr. Chairman. 

Since we held our November 19th hearing highlighting security 

issues at HealthCare.gov, up to 110 million people have had their 

debit card or credit card information compromised by a hack of 

Target store records. But Target was not alone in being successfully hacked: The Washington Post, Facebook, Gmail, LinkedIn, 

Twitter, YouTube, Yahoo, JP MorganChase, SnapChat, and my 

friends at the Dallas-based Neiman Marcus stores have all announced security breaches. 

However, do you know one system that has not been successfully 

hacked since the last hearing? HealthCare.gov. Also since the last 

hearing the Center for Medicare and Medicaid Services (CMS) staff 

and contractors have been working around the clock to improve the 

performance and security of HealthCare.gov. There have been numerous fixes to the website that have improved the site’s responsiveness compared to its first 60 days. Millions of Americans have 

been able to access the site and obtain medical coverage. 

During that entire time top security contractors, including Blue 

Canopy, Frontier Security and the Mitre Corporation have been 

working to test the system and identify weaknesses that need to 

be addressed. The Chief Information Security Officer has also been 

running weekly penetration tests to support security mitigation 

steps for CMS. Further, CMS says that none of the Majority’s witnesses’ concerns voiced in that November hearing have turned into 

any actual breach of security. 

The last hearing did not feature a single witness who had any 

actual information about the security architecture of 

HealthCare.gov, nor what is being done to maintain the integrity 

of the website. Today, we have the same kind of hearing. As smart 

and experienced as these witnesses are, not one of them has actual 

knowledge of the security structure at HealthCare.gov. The best 

that they can do is speculate about vulnerabilities. I think it would 

be good for Members to remember that. 

I am concerned that the intentions in this hearing appears to be 

to scare Americans away from the HealthCare.gov site. This appears to present a continuation of a cynical campaign to make the 

Affordable Care Act fail through lack of participation. While we are 

holding this hearing, both the House Oversight and Government 

Reform Committee and the Energy and Commerce Committee are 

holding similar events, all with the apparent goal to create a sense 

of fear, thereby manufacturing an artificial security crisis. 

It is my hope that all of our witnesses can agree that it is important to make HealthCare.gov work for the American people to help 

give all our citizens access to affordable healthcare. I do not want 

to believe that any of the witnesses testifying today want the site 

to be hacked or shut down, or even see the program fail, or see 

Americans go without healthcare insurance. 

This country faces a lot of real issues and real policy challenges. 

If we are truly interested in hacking and identity theft, we should 

have representatives of the largest retail institutions in the country 

here to discuss the challenges they face in protecting people’s information. Instead, it appears that the Majority has allowed the Com-
10 

mittee to become a tool of political messaging to a degree that I 

have never witnessed any time in my time in Congress, and I am 

in my 22nd year. 

Thank you. I hope that the Committee hearing will be the last 

of this topic, absent some actual allegations of wrongdoing, so that 

we can focus on legitimate oversight issues facing the country and 

this Committee. 

Mr. Chairman, before I yield, I would also like to comment on 

the letter you want to put in the record. I was hoping after reading 

it that you would have some testimony or give the people opportunity other than a 24-hour showing of this letter, but you don’t 

have to take my word on this. Mr. Kennedy’s own document reads, 

this report is for public use. The report is not appended to his testimony, and I imagine it was not added because it would violate our 

48-hour rule. He did not give us testimony in time but late yesterday afternoon presented this report out of the blue, and I am 

guessing your counsel told him to make it a letter because we routinely accept outside letters from groups and experts all the time 

with minimal notice. 

So the report now pretends to be a letter addressed to you and 

to me. However, I cannot remember another time that a witness 

for the Committee also felt they had to write us a letter. I think 

it is an elaborate way to try to get testimony before the Committee 

in violation of the 48-hour rule. 

As the substance of the report, it includes what amounts to testimony from experts who are not appearing before this Committee 

and is against the practice of the Committee to accept testimony 

from people who are not personally available to answer our questions. 

The one thing I do know is that none of the individuals who 

signed these statements in the packet have worked on 

HealthCare.gov or the security protocols behind the website. In 

other words, they know no more about the actual security of the 

site than does Mr. Kennedy. In deference to the Chairman, I will 

withdraw my objection but I would point out that this report includes language that I consider vulgar and beneath the dignity of 

the Committee. That alone should be reason to keep it out. 

Even if the Chairman is comfortable with the way our rules are 

being stretched, if you insist, I will withdraw, but I want the record 

to reflect that we have gone beyond professional behavior of this 

Committee. Thank you. 

[The prepared statement of Ms. Johnson follows:] 

PREPARED STATEMENT OF RANKING MEMBER EDDIE BERNICE JOHNSON

Since we held our November 19th hearing highlighting security issues at 

healthcare.gov, up to 110 million people have had their debit card or credit card information compromised by a hack of Target store records. But Target was not alone 

in being successfully hacked: The Washington Post, Facebook, Gmail, LinkedIn, 

Twitter, Youtube, Yahoo, JP MorganChase, SnapChat, and my friends at the Dallasbased Neiman Marcus stores have all announced security breaches. 

However, do you know one system that has not been successfully hacked since 

that last hearing? Healthcare.gov. 

Also since the last hearing the Center for Medicare and Medicaid Services (CMS) 

staff and contractors have been working around the clock to improve the performance and security of healthcare.gov. There have been numerous fixes to the website 
11 

that have improved the site’s responsiveness compared to its first 60 days. Millions 

of Americans have been able to access the site and obtain medical coverage. 

During that entire time top security contractors, including Blue Canopy, Frontier 

Security and the Mitre Corporation, have been working to test the system and identify weaknesses that need to be addressed. The Chief Information Security officer 

has also been running weekly penetration tests to support security mitigation steps 

for CMS. 

Furthermore, CMS says that none of the Majority’s witnesses concerns voiced in 

that November hearing have turned into any actual breach of security. 

The last hearing did not feature a single witness who had any actual information 

about the security architecture of healthcare.gov, nor what is being done to maintain the integrity of the website. Today, we have the same kind of hearing. As smart 

and experienced as these witnesses are, not one of them has actual knowledge of 

the security structure at healthcare.gov. The best that they can do is speculate 

about vulnerabilities. I think it would be good for Members to remember that. 

I am concerned that the intention of this hearing appears to be to scare Americans away from the healthcare.gov site. This represents a continuation of a cynical 

campaign to make the Affordable Care Act fail through lack of participation. While 

we are holding this hearing, both the House Oversight and Government Reform 

Committee and the Energy and Commerce Committee are holding similar events. 

All with the apparent goal to create a sense of fear, thereby manufacturing an artificial security crisis. 

It is my hope that all of our witnesses can agree that it is important to make 

healthcare.gov work for the American people to help give all our citizens access to 

affordable health care. I do not want to believe that any of the witnesses testifying 

today want the site to be hacked or shut down, or see the program fail, or see Americans go without medical insurance. 

The country faces a lot of real issues and real policy challenges. If we are truly 

interested in hacking and identity theft, we should have representatives of the largest retail institutions in the country here to discuss the challenges they face in protecting people’s information. Instead, it appears that the Majority has allowed the 

Committee to become a tool of political messaging to a degree I have never witnessed in my time in Congress. 

Thank you, I hope that today’s hearing will be the last on this topic, absent some 

actual allegations of wrongdoing, so that we can focus on all the legitimate oversight 

issues facing the country and this Committee. 
12 

Chairman SMITH. I will recognize myself to respond to the Ranking Member’s comments. 

All Committees, including this one, have a longstanding practice 

of affording Members the courtesy of entering items that they believe are relevant to the topic at hand into the record. I am sure 

the Ranking Member knows this. Members on both sides have generally approached the development of the record in the spirit of bipartisanship and comity. I am disappointed if the gentlewoman 

from Texas would now seek to question a letter I have asked to 

place in the record. We frequently place items in the record that 

express the opinion of various groups or make statements regarding an issue at the request of Members on both sides of the aisle. 

Often, those who have written those letters are not testifying before the Committee and have not been asked to do so, yet their 

opinions are still made part of the record. 

One such example is a 54-page submission that Mr. Maffei requested be placed in the record at a hearing last August. This document, which was not even addressed to the Committee, but instead to the Administrator of the EPA, was entered into the record 

without comments. It includes a letter from six different tribes 

signed by eight different people, none of whom testified before this 

Committee. It includes a letter from a lawyer who represented the 

tribes. He also did not testify before the Committee, yet we made 

his letter a part of the record. Finally, it includes another letter to 

the Administrator of the EPA that purports to be from 15 different 

national organizations, 17 international organizations, 75 Alaskan 

organizations, and numerous other organizations from other states. 

None of these organizations testified before this Committee. 

I placed Mr. Kennedy’s letter in the record here today. He is testifying before us shortly—— 

Ms. EDWARDS. Mr. Chairman. 

Chairman SMITH. —and Members will have the opportunity to 

question him on its contents. 

Ms. EDWARDS. Mr. Chairman. 

Chairman SMITH. I am still in the middle of my statement. 

I regret the Ranking Member has questioned the longstanding 

prerogative of a Member to enter a relevant document into the 

record, especially when Members on her side of the aisle have done 

so many times without objection from the Majority. 

I hope this is not indicative of her desire to make this Committee’s business more partisan. 

That concludes my statement, and I will now introduce the witnesses. 

Ms. EDWARDS. Mr. Chairman. 

Chairman SMITH. I am going to introduce the witnesses, and—— 

Ms. EDWARDS. Mr. Chairman, I object to the entry of the letter 

into the record. 

Chairman SMITH. The letter has already been entered into the 

record and the objection is not timely. 

Ms. EDWARDS. Mr. Chairman, I would ask for a vote on whether 

we enter the letter into the record. 

Chairman SMITH. That is no longer a proper motion because it 

is not timely. 
13 

Ms. EDWARDS. Well, Mr. Chairman, I think you have deeply politicized this hearing. 

Chairman SMITH. Well, I am sorry for the Ranking Member’s 

comments that caused it, and now I will recognize and introduce 

our first witness. 

Mr. David Kennedy is the President and CEO of TrustedSEC 

LLC. Mr. Kennedy is considered a leader in the security field. He 

has spoken at many conferences worldwide including Black Hat, 

DefCon, Infosec World and Information Security Summit, among 

others. Prior to moving to the private sector, Mr. Kennedy worked 

for the National Security Agency and the United States Marines in 

cyber warfare and forensics analysis. Mr. Kennedy received his 

Bachelor’s degree from Malone University. 

Our second witness, Mr. Waylon Krush, is the Co-Founder and 

CEO of Lunarline. He is also a founding member of the Warrior to 

Cyber Warrior program, a free six month cyber security boot camp 

for returning veterans. A veteran of the U.S. Army, Mr. Krush is 

a recipient of the Knowlton Award, one of the highest honors in the 

field of intelligence. Mr. Krush holds a Bachelor’s degree in computer information science from the University of Maryland University College. He is also a certified information systems security professional, certification and accreditation professional, certified information systems auditor, and has more than 3,000 hours of training with the National Cryptologic School. 

Our third witness, Mr. Michael Gregg, is the CEO of Superior 

Solutions Inc., an IT security consulting firm. Mr. Gregg’s organization performs security assessments and penetration testing for Fortune 1000 firms. He has published over a dozen books on IT security and is a well-known security trainer and speaker. Mr. Gregg 

is frequently cited by print publications as a cyber security expert 

and as an expert commentator for network broadcast outlets such 

as Fox, CBS, NBC, ABC and CNBC. Mr. Gregg holds two Associate’s degrees, a Bachelor’s degree and a Master’s degree. 

Our final witness, Dr. Larry Ponemon, is the Chairman and 

Founder of the Ponemon Institute, a research think tank dedicated 

to advancing privacy, data protection and information security 

practices. Dr. Ponemon is considered a pioneer in privacy auditing 

and was named by Security magazine as one of the most influential 

people for security. Dr. Ponemon consults with leading multinational organizations on global privacy management programs. He 

has extensive knowledge of regulatory frameworks for managing 

privacy, data protection and cyber security including financial services, healthcare, pharmaceutical, telecom and Internet. Dr. 

Ponemon earned his Master’s degree from Harvard University and 

his Ph.D. at Union College in Schenectady, New York. He also attended the doctoral program in system sciences at Carnegie Mellon 

University. 

We welcome you all and look forward to your expert testimony, 

and Mr. Kennedy, will you lead us off? 

TESTIMONY OF MR. DAVID KENNEDY, 

CHIEF EXECUTIVE OFFICER, 

TRUSTEDSEC, LLC 

Mr. KENNEDY. Thank you, Mr. Chairman. 
14 

Good morning to everybody in the House Science and Technology 

Committee, to the Honorable Mr. Smith as well as the Ranking 

Member of the House Science and Technology Committee, the Honorable Ms. Johnson. It is great to see you two folks again as well 

as all of the other Ranking Members here today. I appreciate your 

time to hear us discuss the issues with the HealthCare.gov security 

concerns as well as the consequences around stolen identities. 

What I want to first start off with is that to me, this is not a 

political issue. I take no political-party stance and I have no party 

affiliate. For me personally, this is a security issue. Working in the 

security industry for over 14 years including working for the National Security Agency as well as spending a number of years in 

Iraq and Afghanistan, my testimony here today is to talk about the 

issues with security, and that is it. So when I talk about the issues 

that we see here today, it is based on my expertise of working in 

the security industry, doing these assessments on a regular basis, 

being a chief security officer for a Fortune 1000 company for a 

number of years as well as running my own company. 

And I am not alone. The mention of the document that was released yesterday had seven independent security researchers that 

are well known in the security industry including a number of folks 

that have worked for the United States government, do training for 

the United States as well as work closely with the United States 

government. Today is not to talk about the political-party problems 

with it but also discuss just the security issues alone, and that is 

what I am here to talk about today. 

So I would like to give thanks to Kevin Mitnick, Ed Skoudis, 

Chris Nickerson, Chris Gates, Eric Smith, John Strand and Kevin 

Johnson for providing their comments on the issues that we see 

today. We are pretty unified in our approach. Everybody that I 

shared with, I put them under non-disclosure agreements and 

worked with them, and the consistent feedback that we got was 

that HealthCare.gov is not secure today, and nothing has really 

changed since the November 19th testimony. In fact, from our November 19th testimony, it is even worse. 

Additional security researchers have come into play, providing 

additional research, additional findings that we can definitely tell 

that the website is not getting any better. In fact, since the November 19, 2013, testimony, there has only been one-half of a vulnerability that we discovered that has been addressed or even close to 

being mitigated. When I say but one-half is that basically they did 

a little bit of work on it and it is still vulnerable today. 

I want to throw a disclaimer out there that in no way, shape or 

form did we perform any type of hacking on the websites. That is 

a misnomer. The type of techniques that we used is looking at the 

site from a health perspective, doing what we call passive reconnaissance, not attacking the site in any way, shape or form, not 

sending data to the site but really looking at the health of it. I 

would like to put in another analogy. Say my expertise wasn’t 

being in the security industry, it wasn’t anywhere near doing anything security related and I was a person that was a mechanic. I 

had 14 years of being a mechanic. And, a car drove past me that 

was puffing blue smoke out of the muffler, it was leaking oil, the 

engine was making clinking sounds, and basically a lot of sympto-
15 

matic problems: the doors are open, the windows are open and everything else. As a mechanic, I can probably say with a reasonable 

level of assurance that the engine probably has some issues. Same 

thing with technology and Web applications. Web applications are 

no different than a car with an engine problem. There are a lot of 

pieces that make the car work. There are a lot of pieces that make 

a website work. 

From our testimony here today as well as what we have discovered in the past, there is a number of security issues that are still 

there today with the website. To put it in perspective, I would like 

to put for the record that there wasn’t 70 to 110 million credit 

cards taken from Target. That is not accurate. The correct statistic 

is that there were 70 to 110 million personal pieces of information 

taken about individual people that shopped at Target. There were 

40 million credit cards that were taken. The issue with Target isn’t 

specifically around credit cards. Credit cards can be reissued. Your 

credit that gets taken from the credit cards can be debited back 

into your account. You are not liable as a consumer. But what you 

can’t fix is your personal identity. If you look at Target, for example, the 70 to 110 million personal pieces of information, that includes address, email addresses, phone numbers, additional information. That is what you can’t replace, and we have already seen 

a number of individuals that are selectively being targeted from a 

personal information perspective because of that. That doesn’t even 

include Social Security numbers. In fact, I just had another independent security person get targeted yesterday from an email 

claiming to be Target. As soon as they clicked the link, it hacked 

their computer and took full control of it. 

So this issue here doesn’t relate specifically to just credit card 

data because that is obviously not in the HealthCare.gov website. 

The personal information around Social Security numbers, first 

name, last name, email addresses, home of record, those are all a 

recipe for disaster when it comes to what we see from personal information being stolen and theft. So it is not just that. As an 

attacker, if I had access to the HealthCare.gov infrastructure, it 

has direct integration into the IRS, DHS as well as third-party providers as well for credit checks. If I have access to those government agencies, I now can complete an entire online profile of an individual, everything that they do and their entire online presence. 

And this isn’t just HealthCare.gov alone. I am not trying to single out HealthCare.gov alone. I am really focusing on a much larger issue, which is security in the federal government alone is at a 

really bad state. We need to really work together to fix it and work 

on more sweeping changes. Thank you. 

[The prepared statement of Mr. Kennedy follows:] 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 

Chairman SMITH. Thank you, Mr. Kennedy. 

Mr. Krush. 

TESTIMONY OF MR. WAYLON KRUSH, 

CO-FOUNDER AND CEO, LUNARLINE, INC. 

Mr. KRUSH. Chairman Smith, Ranking Member Johnson and 

Members of the Committee, thank you for this opportunity to testify on the important topic of cyber security. 

I am Waylon Krush, Founder and CEO of Lunarline. We are one 

of the fastest-growing cyber security companies. I am also a founder of the Warrior to Cyber Warrior program, as stated earlier. 

I have been asked to speak on cyber security today as it relates 

to HealthCare.gov, and just listening to Mr. Kennedy, I actually 

have some very simple points I want to make right away. 

First of all, if none of us here built HealthCare.gov, if we are not 

actively doing not a passive vulnerability assessment but an active 

vulnerability assessment and doing penetrations and running that 

exploitable code on HealthCare.gov, we can only speculate whether 

or not those hacks will work. So anything that has been said thus 

far, if we are talking about any type of dot gov or dot mil site just 

identifying passively a vulnerability and not actually working on 

the site, knowing how the protocols work in the back end, what 

type of defense in depth, how each one of the assets are locked 

down, nobody here at this table can tell you that they know that 

there is vulnerabilities. 

Another thing I would like to talk about today is in the federal 

government, something a little bit different than we have in the 

commercial organizations is, we use something called the risk management framework, and you know, this Committee has actually 

helped develop that as part of NIST, and I will tell you, that is one 

of the most rigorous processes as it relates to cyber security and 

privacy in the entire world, and when I say the entire world, most 

security standards are just a subset of the risk management framework. It is one of those areas from a security control perspective 

that has been taken to build other security standards or it is basically copy, cut, pasted to create new security standards. This is a 

six-step process. It includes categorization, selection, implementation, validation, authorization and, most importantly, continuous 

monitoring of all the controls. You know, just looking at it, you 

might think well, there is about 360 controls in NIST Special Publication 800–53, revision 4. When you dig a little bit deeper, there 

is actually several thousand information security controls that our 

federal information systems must undergo from a security architecture perspective including they must be continuously testing. 

Another point I would like to make is that if anybody here actually went out to these websites, and I am not talking about passive, 

but if we have extracted addresses, if you went to the website and 

done anything outside the bounds of what is allowed in the federal 

government, you are basically breaking the law. You can’t just go 

out and say I found this vulnerability and then exploit it to try to 

get, you know, media attention or anything like that. If you do 

that, you are breaking the law. It is pretty simple. 

And last but not least, you know, HealthCare.gov is one of many 

hundreds or even thousands of federal information systems out 
31 

there in websites, and you know, I have worked in the threat area. 

I can tell you, my background is not only a soldier but was on the 

U.S. Army’s Information Operations Red Team, Blue Teams, information system security monitoring teams, protocol analysis, signals 

analysis, and including working in critical infrastructure protection 

for AT&T for a few years all across the world. If you go out and 

tell someone—and this is just the truth when we are out actively 

taking down websites—I can sit here all day and speculate about 

a vulnerability but until I have actually exploited that vulnerability, there is no way to tell whether that attack will actually 

work. There is a lot more going on in the background that everybody needs to understand. 

Another note, and last but not least, about HealthCare.gov that 

everyone needs to understand is that with all of the media attention it is currently getting, you would think it is most high payoff 

target in the entire federal government. You would think that 

HealthCare.gov is something that everybody would want to go 

after. That is truly—that is media spin, if anything. 

HealthCare.gov is one of many websites that have personal information in it. It is connected to other systems but saying it is interconnected directly to all these systems and that leaves them vulnerable also shows kind of a lack of knowledge of the backend system capabilities, meaning that those connections are very secure 

and they are authorized on both sides. 

And you know, I have actually been lucky enough to work within 

CMS and HHS on cyber security deployments and configurations so 

out of everybody here at least at this table, I probably have the 

most hands-on knowledge but I can’t come here and just speculate 

about what is actually vulnerable to the system and what is not. 

And the truth is, once again, on the threat side, as we have seen 

in media, you can probably tell that, you know, HealthCare.gov is 

not the one getting attacked. Most cyber criminals, especially those 

with advanced capabilities, they go where the money is, right? 

They are going to go after the Targets, they are going to go after 

the Neiman Marcus, they are going to go after these places that 

contain lots of data related to intellectual property because it just 

makes fiscal sense, right? If the U.S. government spends billions of 

dollars on our research and development and we don’t protect it 

and some other country takes that, you just saved them billions of 

dollars. Thank you. 

[The prepared statement of Mr. Krush follows:] 
32 
33 
34 
35 
36 
37 
38 
39 
40 

Chairman SMITH. Thank you, Mr. Krush. 

Mr. Gregg. 

TESTIMONY OF MR. MICHAEL GREGG, 

CHIEF EXECUTIVE OFFICER, 

SUPERIOR SOLUTIONS, INC. 

Mr. GREGG. Thank you, Chairman Smith, thank you, Ranking 

Member Johnson, Members of the Committee, for having me here 

today. 

My name is Michael Gregg. I am really going to break down my 

speech into three pieces and my presentation: first, how 

HealthCare.gov could potentially be hacked, why HealthCare.gov 

needs independent review by third parties, and also, what would 

be the result of this, what could be the potential impact. 

My concern is that HealthCare.gov is a major target potentially 

for hackers looking to steal not only personal identities but also information that could be used to steal their identity. Although I understand HealthCare.gov does not store that information, it passes 

that information back and forth between third-party government 

sites and other organizations. While there are many different ways 

that the site could be hacked, there are some prominent ones, and 

these are the same ones listed by prominent websites like OWASP. 

It could be things like cross-site scripting, SQL injection. It could 

be LDAP injection, it could be buffer overflow. There are many different ways that this could be done. 

Now, while that sounds foreign to many of you, the fact is, these 

are known attacks that are used against known sites every day 

from Target to Neiman Marcus to Google to many others. Some of 

the things that concern me are in the past we have seen, for example, the 834 data. That is data that is passed to the back end of 

the insurance companies. We have seen and we have heard reports 

of this information being corrupted and not being correct when it 

is being received. That indicates at some point the data is not being 

handled correctly, and all input data, all process data, all output 

data has to be correct. If not, there is some type of problem, meaning that data is not being properly parsed. That same kind of situation could lead to an attacker putting in some type of data and misusing that in some way or launching an attack. 

Also, as I said, HealthCare.gov is a very large attack service. 

This is a very large program or application. It was built very quickly. A large attack surface makes it very hard to secure. So I find 

it hard to believe that during the release and also the update of 

the site that all the items that our previous speaker spoke of as 

far as FISMA, FIPS 199, FIPS 200, were actually taken care of and 

it actually passed all those requirements that they are required to 

by law,and that those were properly completed. 

Microsoft, think of those folks, for example. They have spent almost 30 years trying to secure their operating systems and still we 

see Microsoft products or operating systems being brought under 

attack. To think that HealthCare.gov could be built so quickly and 

then be secured to me is very hard to believe. 

When we have a large application or website to be reviewed, 

typically we do it a couple of different ways. We start at the very 

beginning before the site is actually developed. We do things as far 
41 

as audits. We do vulnerability assessments. We also do PIN testing. All three of these things are required to actually look at and 

examine the site. PIN testing is a very important part of this process because PIN testing means we are looking at the site the same 

way the attacker would. We are saying what would the attacker 

see, what could they use, what could they do with this and how 

could they leverage this potentially for attack. I don’t believe those 

types of assessments have been done to this day and have been 

properly completed. 

So what has been reported currently is that when we see with 

HealthCare.gov that they are running weekly assessments, that 

they are potentially patching the site, but a lot of that activity we 

are talking about is reactive in nature. That means when we are 

finding a problem, we are actually fixing it. That doesn’t mean we 

have already gone out and we have found all possible problems or 

all potential ways that an attacker may leverage that and get access to the site. 

Some might argue that if HealthCare.gov is actually vulnerable, 

why hasn’t it already been attacked? Well, if you think about it 

from an attacker’s standpoint, we have seen that attackers have 

the fortitude and also the patience to wait until the right time. 

Look at Target. Did they attack immediately? No, they waited until 

the right time and the right moment to actually do this. This could 

be the same thing. They are going to wait until after March. They 

are going to wait until the deadline. They are going to wait until 

there is a trove of information for them to go after. Then they are 

going to target it. 

So what could be the impact on consumers? Potentially reduced 

credit ratings. It could be increased difficulty getting loans, could 

be criminal issues. It could be emotional impact. It also could be 

very damaging as far as medical information that could be lost. It 

could be potentially people don’t get hired for a job. It could be they 

get the wrong treatment because someone else has obtained treatment under their name for some other type of disease or some 

other type of problem that they didn’t have. It could be potentially 

them being denied an application or job for some reason. 

And in closing, I would just like to say this. When our organization builds applications, we bring everybody together. We bring the 

end users, the developers. We bring everyone together, the security 

professionals, to make sure the site is secure and that security can 

be built in from the very beginning. I do not believe that has been 

done in this case. Hacking today is big business. It is no longer the 

lone hacker, the individual in their basement. Today is organized 

crime. It is very large groups potentially out of places like Russia 

and Eastern Europe. We can fix these problems, but for these problems to be fixed means that we need an external assessment of this 

site by independent third parties. 

Thank you very much for your time. 

[The prepared statement of Mr. Gregg follows:] 
42 
43 
44 
45 
46 
47 
48 
49 

Chairman SMITH. Thank you, Mr. Gregg. 

And Dr. Ponemon. 

TESTIMONY OF DR. LAWRENCE PONEMON, 

CHAIRMAN AND FOUNDER, 

PONEMON INSTITUTE 

Dr. PONEMON. Thank you, Mr. Chairman, and thank you for inviting me. 

Well, first, let me just start off by saying that I am the research 

wonk to this panel. These people are absolutely brilliant and they 

understand the technical aspects and the security issues. What I 

would like to do is talk a little bit about the consequences of identity theft and medical identity theft. That is really my focus, and 

the basis of my comments is research, research that my institute 

conducts. And sometimes, by the way, they call my institute the 

Pokemon Institute. It is actually Ponemon Institute, which is my 

last name. 

So I understand the purpose of my testimony today is to provide 

assistance in understanding the potentially devastating consequences of a data breach to individuals, to households and society 

as a whole. For more than a decade, we have studied the cost and 

consequences of data breach through extensive consumer studies as 

well as benchmark research on the privacy and data protection 

practices of companies in the private and public sectors. In the area 

of healthcare, we have conducted four annual studies on medical 

identity theft and patient privacy and security protections within 

hospitals and clinics. We also survey consumers on their perceptions about the organizations they trust the most to protect their 

privacy. Among the U.S. federal government sector, for example, 

we are pleased to report some good news, that the USPS, the Postal Service, gets very high marks for trust. Another, and this might 

be a little surprising, the IRS actually is trusted for privacy, not 

for anything else—no, just joking—but definitely for privacy practices, as well as the Veterans Administration, and they were a bad 

guy, right? You right remember, they lost a lot of data. I am a veteran and I was on that list of 26 million. But they turned things 

around and they are trusted for privacy. 

So today I have been asked to testify about the possibility of like 

identity theft on the HealthCare.gov website and the potential consequences to the American public. Identity theft and medical identity theft are not victimless crimes and affect those who are most 

vulnerable in our society such as the ill, the elderly and the poor. 

So beyond doing these numerous research studies that I just 

mentioned, this is an issue that really struck home for me. Last 

year, my mother, she is 88 years old, she lives alone in Tucson, Arizona, and she suffered from a stroke. She was rushed to a hospital 

and admitted immediately, and unbeknownst to her, an identity 

theft was on the premises and made photocopies of her driver’s license, debit cards and credit cards that were in her purse. And by 

the way, she also has all the passwords to everything in a little 

Post-It note in her purse as well. She doesn’t listen to me. That is 

the problem. The thief was able to wipe out her bank account and 

there were charges on her credit card and debit card amounting to 

thousands and thousands of dollars. In addition to dealing with her 
50 

serious health issues, she also had to cope with the stress of recovering her losses and worrying about more threats to her finances 

and medical records. 

The situation with my mom in the hospital and those who are 

sharing personal information on HealthCare.gov are not dissimilar, 

and let me explain. My mother had a reasonable expectation that 

the personal information she had in her wallet would not be stolen, 

especially by a hospital employee, and those who visit and enroll 

in HealthCare.gov have an expectation that people who are helping 

them purchase health insurance will not steal their identity. They 

also have a reasonable expectation that all necessary security safeguards are in place to prevent cyber attackers or malicious insiders 

from seizing their personal data. 

Now, in my opinion, the controversy regarding security of the 

HealthCare.gov website is both a technical issue, as we heard from 

these gentlemen but it is also an emotional issue. In short, security 

controls alone will not ease the public’s concerns about the safety 

and privacy of their personal information. Based on our research, 

regaining the public’s trust will be essential to the ultimate acceptance and success of this initiative. 

So following are some key facts that we learned from our consumer research over the more than a decade of doing these kinds 

of studies. First, the public has actually a higher expectation that 

their data will be protected when they are dealing with government 

sites than commercial sites. In other words, when I am going to the 

Veterans Administration, I have a higher expectation of privacy. 

Whether it is rational or not, that is basically what we see. Second, 

the loss of one’s identity can destroy a person’s wealth and reputation and in some cases their health. Further, the compromise of 

credit and debit cards drives the cost of credit up for everyone, thus 

making it more difficult for Americans to procure goods and services. Third, medical identity theft negatively impacts the most vulnerable people in our Nation. Beyond financial consequences, the 

contamination of health records caused by imposters can result in 

health misdiagnosis and in extreme cases could be fatal. Because 

there are no credit reports to track medical identity theft, it is 

nearly impossible to know if you have become a victim. 

So what is the solution? Let me just give you three ideas. First, 

on the trust issue, let us think about accountability. It is important 

to demonstrate accountability, and the best way to do that, in my 

mind, is rigorous adherence to high standards, and I think we mentioned NIST. NIST is a great standard but very high standards 

above the bar and showing the American people that this particular website or any website that collects sensitive personal information is meeting or exceeding that standard. 

Number two is ownership. What I would like to see is the chief 

information security officer is your chief executive officer. That is 

good news when the CEO steps up to the plate and does what 

needs to be done, and in this case, I would love to see our President 

take ownership of the website and ensure that good security and 

privacy practices are met as a priority, not just by HealthCare.gov, 

but across the board. 

And third is verification. Now, I am an auditor. I have to admit 

this, so I am a little bit biased, or I used to be an auditor at 
51 

PriceWaterhouseCoopers. You know, we can say that we are doing 

all of these good things, but having a third-party expert telling us 

that we are meeting and exceeding the standards is a very good 

idea and a noble idea. 

And with that being said, I think I am actually the first person 

concluding giving you some time back on the clock. 

[The prepared statement of Dr. Ponemon follows:] 
52 
53 
54 
55 
56 
57 

Chairman SMITH. Well—— 

Dr. PONEMON. Oh, no. 

Chairman SMITH. —not exactly. 

Dr. PONEMON. I wasn’t watching the time. I am sorry. 

Chairman SMITH. Thank you, Dr. Ponemon. I appreciate your 

testimony. I will recognize myself for questions. Let me direct my 

first one to Mr. Kennedy. 

Mr. Kennedy, the Administration maintains that there has not 

been a successful security attack on HealthCare.gov. Is that an accurate statement? 

Mr. KENNEDY. Thank you, Mr. Chairman. Basically what we 

know for the monitoring and detection capabilities within the 

HealthCare.gov infrastructure is as of November 17th, they had 

not stood up a security operation center or had the capabilities to 

even detect an actual attack. So it also stated that they detected 

32 attacks overall. However, if you have no monitoring detection 

capabilities, period, how are you detecting all the different attacks 

that are happening? So I would say that the statement is accurate 

because they don’t necessarily know the actual attacks that are occurring in there. 

In addition, I would like to also mention that the Chief Information Security Officer from HHS, Kevin Charest, also said that, ‘‘I 

would say that the HealthCare.gov website did not follow best 

practices.’’ So as a testament to Mr. Krucsh’s testimony, the 800– 

53 and best practices were not followed and did not meet best practices when it was implemented. 

Chairman SMITH. And Mr. Gregg—— 

Mr. KRUSH. Let me talk to—— 

Chairman SMITH. I am sorry, Mr. Krush. You can get time from 

someone else. I would like to ask a question to Mr. Gregg. 

Do you agree generally with the assessment by Mr. Kennedy that 

they don’t have the capability? And furthermore, let me say that 

you did have Administration officials say in November that there 

was 16, I think, security breaches or incidents and then 32 in December. Are those figures plausible, and where do they get them? 

Mr. GREGG. Well, they are potentially plausible if they either 

weren’t monitoring or they didn’t pick up the attacks. For most of 

the sites we look at, and companies we work with, we see anywhere from hundreds potentially, a thousand or more hits a day. 

Now, a lot of that stuff is scripted but for a number to be that low, 

I would either think, one, they are not detecting it, or two, their 

detection capability is not correct. 

Chairman SMITH. Okay. Thank you, Mr. Gregg. 

Dr. Ponemon, do the security standards, protections and breach 

notification standards for Obamacare even meet the minimal 

standards put in place for the private sector? 

Dr. PONEMON. I think the private sector for the most part has— 

and it does vary quite a bit. There are industry standards, for example, that actually are much higher than the standards we see 

in the government. But NIST, for example, and the need to comply 

with certain standards, for example, around cloud computing and 

fed ramp, and there are standards that exist that are actually fairly reasonable. For the most part, though, I think if you are looking 
58 

for best practices, you probably would be looking at industry versus 

the government. 

Chairman SMITH. Thank you, Dr. Ponemon. 

Mr. Kennedy, another question for you. Is Mr. Krush right in 

what he said in his oral testimony that passive reconnaissance of 

HealthCare.gov is not sufficient to raise concerns about the 

website’s security? 

Mr. KENNEDY. Thank you, Mr. Chairman. I would like to address 

that direct on, which would be, passive reconnaissance, you have 

the ability to enumerate exposures and vulnerabilities. Any security researcher or tester that has been in the industry for a number 

of years, especially in the technical side, will be able to collaborate 

that. In fact, all seven of the security researchers also said the 

same exact thing, that the website itself is vulnerable. This isn’t 

speculation. These are actual exposures that are on the website 

today that could lead to personal information being exposed as well 

as other critical flaws of actually attacking individual people just 

by visiting the website. 

To answer your question, by doing passive reconnaissance, you 

can absolutely identify exposures. There are absolutely techniques 

out there without actually attacking the site for doing it, and I 

would question that the other seven security researchers that also 

testified that looked at the same type of research, came to the same 

exact conclusion as myself. 

Chairman SMITH. Okay. Thank you, Mr. Kennedy. 

Mr. Krush, I do have a question for you. Apparently you have 

contracts with a company that does work for CMS. Is that accurate? 

Mr. KRUSH. That is accurate. 

Chairman SMITH. And what is the amount of those contracts, 

both past and present? 

Mr. KRUSH. I actually don’t know that off the top of my head but 

I have—— 

Chairman SMITH. Okay. I think—— 

Mr. KRUSH. —tens of millions of dollars of contracts in the federal government right now. 

Chairman SMITH. All right. Okay. So you have tens of millions 

of dollars of business with CMS directly or indirectly? 

Mr. KRUSH. Not CMS. 

Chairman SMITH. With a company that does work for CMS? 

Mr. KRUSH. No, that—those amounts are very high. I am talking 

across the government. I am not—I just don’t know specifically 

with CMS. That is why I can actually talk from a technical perspective and not speculate on some of the—— 

Chairman SMITH. With CMS, according to your Truth in Testimony that you filed, I think it is $1.5 million that you do have in 

those contracts. 

Mr. KRUSH. Okay. That sounds good. 

Chairman SMITH. If you will take my word for it? 

Mr. KRUSH. Yes. 

Chairman SMITH. In that case, isn’t it natural that we might suspect that your testimony is a result of your being paid by—directly 

or indirectly by CMS and here you are not going to actually testify 
59 

against them if you have $1.5 million worth of contracts with 

them? Isn’t that a reasonable assumption? 

Mr. KRUSH. Well, Chairman Smith, actually as it relates to CMS, 

if you look at the GAO docket, I actually have been protesting with 

them. You know, on the contracting side, me and CMS are not necessarily best of friends. I am here to talk about the cyber security 

in what—— 

Chairman SMITH. I know what you would rather be talking about 

but it still seems to me $1.5 million in contracts does perhaps influence your testimony. That is all I have to say on that. My time is 

up, and the gentlewoman from Texas is recognized for her questions. 

Ms. JOHNSON. Thank you very much. Very interesting hearing. 

Mr. Krush, you were cut off earlier when you were going to make 

a comment on Mr. Kennedy’s testimony. Would you like to make 

that now? 

Mr. KRUSH. I actually have a few here, so just across the board. 

Earlier Mr. Gregg talked to the fact that, you know, the 

HealthCare.gov didn’t implement what we call FIPS 199 and FIPS 

200. Just to clarify what that is for everyone here, FIPS 199 is Federal Information Processing Standard 199. It requires you to categorize an information system in accordance with the confidentiality, integrity and availability of an information system. We 

know that that was completed because there was a letter from Ms. 

Tavener out as part of the authorization process that 200 is the 

baseline controls for all federal information systems. We also know 

that that was completed because they had an ATO letter that specified some of the vulnerabilities and what actual the process dealing with the healthcare.gov was. So I just wanted to talk to that 

point. 

And, you know, talking about also waiting, from Target’s perspective, waiting until, you know, a certain time to act. I don’t 

think any of us here have also worked on the Target.com website 

or the backend database, and I would tell you that a lot of the advanced attackers, you know, unless you have done the forensic 

sampling and you have actually picked up the crumbs, you don’t 

know when they actually attacked, and I think that that is under 

investigation right now. 

HealthCare.gov, Mr. Kennedy brought up the point that there 

was no security operation centers. Some of those one point whatever million dollars that have been allocated to my company was 

actually related to those early on. There is actually two security operation centers within HHS you might want to know. They have 

a centralized one which does monitoring of the entire enterprise, 

and on top of that, CMS has its own security operation center, and 

I can tell you from a technology perspective, some of the technologies they have implemented is, you know, top notch. It is what 

you would expect in a top-tier security operations in the U.S. federal government. 

Ms. JOHNSON. Thank you. According to Mr. Gregg’s testimony 

that this site is a major target, but the attacks won’t be accurate 

or of interest or of value until after March, what do you anticipate 

that March will bring? 
60 

Mr. KRUSH. Nothing. You know, the truth is, when it comes to 

March, if an attacker wants something off the site, they are going 

to continuously do whatever they can to gain access. I think one 

of the things that was also said is that, you know, there is a certain number of incidents, and those numbers do sound low, but 

once again, everybody here, none of us have worked in the security 

operations center, which does exist within CMS, and so we don’t 

necessarily know what the escalation requirements are. So, for example, most government websites literally are enumerated passively, meaning—and this is still considered an incident via DHS. 

If you go through and you do scans on a website, meaning that you 

are looking for open protocols and services, that is considered an 

incident. Now, does every organization report those? No, because 

you would have hundreds of thousands of reports a day. 

However, some of the—I got a call last night from actually a 

news reporter and they called me up to talk about Mr. Kennedy’s, 

you know, analysis he had done on the website, and I just want 

to be clear that, you know, if him and his security researchers actually did go to a dot gov, they did passively enumerate and actually 

pulled data in an unauthorized manner, then that is a very significant issue. I went to the course while I was in the military for the 

FBI, and I can tell you that that is of grave—it is great concern 

to us when anybody goes out to federal government website without permission and is actually passively enumerating then executing something to pull data off that website. 

Ms. JOHNSON. Thank you very much. 

Dr. Ponemon, you indicated that your mother had this incident 

happen with her identity. What about that stolen information affected her healthcare? 

Dr. PONEMON. You know, in the case of my mom, she would fall 

into the category of an identity—she is an identity theft victim but 

not a medical identity theft victim because really, her medical 

records were not exposed, and so that would be a different crime, 

and thank goodness she is a medical identity theft victim because 

that is bad news. It is really hard. 

Ms. JOHNSON. Thank you. 

Dr. PONEMON. Thank you. 

Ms. JOHNSON. My time is expired but I hope someone will ask 

the value of someone having hacked the HealthCare.gov. 

Chairman SMITH. Thank you, Ms. Johnson. 

Mr. Hall has said that because Mr. Broun has a time commitment that is almost immediate, he is going to allow Mr. Broun to 

go ahead of him in the questioning, so Mr. Broun is recognized. 

Mr. BROUN. Thank you, Mr. Chairman, and thank you, Mr. Hall, 

for giving me this opportunity. 

It has come to the Oversight Subcommittee of this Committee’s 

attention that there is or at least was an Affordable Care Act Information Technology Exchanges Steering Committee chaired by senior White House officials, established back in May 2012, almost a 

year and a half before the rollout of HealthCare.gov. The White 

House steering committee’s charter explicitly directed the formulation of working groups, including one on security. It also turns out 

that a chairman of this Obamacare website steering committee is 

the U.S. Chief Technology Officer in the White House Science Of-
61 

fice, who also happens to be the immediate past CTO of the Department of Health and Human Services. 

Upon learning this, I, as Chairman of the Oversight Subcommittee, along with the full Committee Chairman, Mr. Smith, 

and Research and Technology Subcommittee Chairman, Dr. 

Bucshon, sent a letter to the White House requesting that Mr. 

Todd Park, the U.S. CTO and HealthCare.gov’s steering committee 

chairman, make himself available to the Committee to answer 

questions regarding the security issues with HealthCare.gov by 

January 10th, last Friday. 

The White House has ignored that letter and the Committee’s request until just yesterday when it provided a last-minute response 

that rebuffed this Committee—let me repeat: rebuffed this Committee. And that letter did not come from the Senate-confirmed 

President’s Science Advisor, to whom the letter was addressed, but 

from the politically appointed OSTP Legislative Affairs Director. 

My question for the panel simply is this: don’t the American people deserve answers from those who are in charge of overseeing implementation of the Obamacare website’s security protocol? After 

all, Mr. Park is an Assistant to the President. As the Chief Technology Officer of the United States and the chair of 

HealthCare.gov’s steering committee, wouldn’t Mr. Park, or 

shouldn’t he, know and be involved in the security details of the 

website? Starting with Mr. Kennedy. 

Mr. KENNEDY. Thank you, sir. When we look at a website and 

its security, there are multiple people that need to be involved to 

understand the progress of it. I would agree with your assessment 

that there should be some involvement in that case. 

In addition, I also would like to clarify that a lot of information 

that we are getting around these security exposures has actually 

been vast. The Chief Information Security Officer from HHS saying 

it didn’t follow best practices. You have a number of other individuals saying the security operations center hadn’t been started yet. 

You have the HealthCare.gov infrastructure, which is completely 

independent and was started completely independent of HHS being 

part of that. So this is a mismanaged issue. I don’t understand how 

we are still discussing whether or not the website is insecure or 

not. It is. There is no question about that. 

Mr. BROUN. It is insecure? 

Mr. KENNEDY. It is insecure, absolutely 100 percent. There is no 

questioning that. People from HHS have said that. You know, it is 

not a question of whether or not it is insecure. It is what we need 

to do to fix it. 

And just to point to Mr. Krush’s point, he also said to Reuters, 

which is the article that he also mentioned earlier, Krush said he 

has not reviewed Kennedy’s findings or done any work on 

HealthCare.gov’s site itself. So, you know, this is all purely speculation. It is a bunch of hogwash, and personally, it seemed to be 

politically biased, unfortunately. 

Mr. BROUN. Thank you, Mr. Kennedy. I appreciate your long answer but this is actually a yes or no answer. 

Mr. Krush, do the American people deserve to know? 

Mr. KRUSH. Yes. 

Mr. BROUN. Okay. Mr. Gregg? 
62 

Mr. GREGG. Yes, they do. However, I would like to add, I understand the NIST process and others quite well. I co-authored a book 

on it, also developed a course for Villanova University on certification and accreditation. Finally, his statement ends to a scan. A 

scan is not passive. A scan is active. But yes, they do deserve an 

answer on this. 

Mr. BROUN. Doctor? 

Dr. PONEMON. Ditto, yes. 

Mr. BROUN. And I agree, the answer is yes. I am very disappointed with the Administration. We have asked for information. 

The American people deserve to have that information, and I will 

do everything that we can to try to get Mr. Park to give us that 

information or the Administration. 

Mr. Chairman, my time has run out so I yield back. 

Chairman SMITH. Okay. Thank you, Dr. Broun. The gentlewoman from Maryland, Ms. Edwards, is recognized for her questions. 

Ms. EDWARDS. Thank you, Mr. Chairman, and thank you to our 

witnesses today. 

Just very quickly, Mr. Kennedy, do you have any federal contracts for security? Any? 

Mr. KENNEDY. As of right now, no. 

Ms. EDWARDS. Have you had? 

Mr. KENNEDY. Yes, I have. 

Ms. EDWARDS. And what were they? 

Mr. KENNEDY. Working for the federal government? 

Ms. EDWARDS. Yes, federal security contracts. 

Mr. KENNEDY. Yes. 

Ms. EDWARDS. What were they? 

Mr. KENNEDY. I would be happy to disclose those. 

Ms. EDWARDS. I would appreciate it in writing, if you would. 

Mr. KENNEDY. Sure. 

Ms. EDWARDS. If you would tell us the federal contracts that you 

have had in dealing with information security in the areas that you 

claim to be an expert in. 

Mr. KENNEDY. I would be happy to write that. 

Ms. EDWARDS. And Mr. Krush, I just want to ask you really 

briefly if you could tell us security standards, compare those that 

are used for the federal government as to the private sector. You 

have alluded to that a bit, if you could just very quickly? 

Mr. KRUSH. Sure. So one thing to understand, and just to go 

back to Mr. Gregg, you know, I have also co-authored a book on, 

we have taken over 10,000 pages of information from the National 

Institute of Standards and Technology, the Department of Defense 

instructions, the intelligence community directives and also, you 

know, some of the SAP programs and consolidated that, and that 

book is actually used in places such as Syracuse University to 

teach people that actually want to understand this very rigorous 

federal process. I am also co-author of NIST Special Publication 

800–53 alpha. That is the process where we actually do the assessments per se. So—— 

Ms. EDWARDS. I trust your expertise. I just want to know the 

rigor of the standards for the federal government compared to the 

private sector. 
63 

Mr. KRUSH. Sure. So that is a great question, Ms. Edwards. One 

of the things to understand is that NIST Special Publication 800– 

53 starting at revision 2, and we are now up to revision 4, integrated all of the commercial standards. At rev 3, so meaning, you 

know, the most ISO, Carnegie Mellon, a lot of these organizations 

that had kind of best practices out there, they were integrated into 

that revision. By revision 4, we have actually integrated the Department of Defense standards, the intelligence community standards, also a lot of standards that are kind of outside the realms, 

they are threat-based. As you will find, most auditing organizations 

don’t look for those. 

Ms. EDWARDS. So are the—— 

Mr. KRUSH. There is definitely rigor compared from a commercial 

organization to what you will get in the government, and I have 

worked on both sides. Fifty percent of my contracts are with Fortune 50 and 100 companies, so I can tell you the depth and rigor 

that you implement on a federal information system, as it should 

be, is just more much intense than what you see in the commercial 

markets. 

Ms. EDWARDS. And is HealthCare.gov, is the rigor attached to 

HealthCare.gov any different from any of these other federal systems that you have indicated? 

Mr. KRUSH. No, this process is the same across the U.S. government. 

Ms. EDWARDS. Thank you. So I wonder if the standards that you 

described are above—and I think you said this—are above those 

that you would find in the commercial sector? 

Mr. KRUSH. I would say yes. 

Ms. EDWARDS. Thank you. 

Mr. Gregg, you mentioned some information or speculation about 

medical records vis-a ́-vis HealthCare.gov. Are you aware of any 

medical record that is maintained on HealthCare.gov? 

Mr. GREGG. No, the information is simply passed through. 

Ms. EDWARDS. Exactly. Is there any medical record, personal 

medical record, contained on HealthCare.gov? 

Mr. GREGG. No. 

Ms. EDWARDS. Thank you. 

And then Dr. Ponemon, just out of curiosity, you talked about 

your mother’s experience, which just sounds really horrible, but she 

didn’t experience identity theft through HealthCare.gov. Isn’t that 

correct? 

Dr. PONEMON. Absolutely not. 

Ms. EDWARDS. Right. Thank you. 

And I just wonder, Mr. Krush, if you could help me, if you will. 

Of the experience that you have had in developing and working on 

federal information systems, is it your conclusion that you would 

feel safe in putting your personal information through 

HealthCare.gov? 

Mr. KRUSH. Ms. Edwards, I actually put that in my testimony. 

I would put my personal information on HealthCare.gov. I said this 

more than once, and you know, I continue to stand by that. 

Ms. EDWARDS. Thank you. 

And Mr. Kennedy, lastly, I want to go back to your federal work 

I mean that I can find disclosed. I know that you got a small busi-
64 

ness loan from the Small Business Administration for ‘‘businesses 

that do not qualify for credit in the open market.’’ Again, what is 

the other federal security work that you have done? 

Mr. KENNEDY. I would be happy to disclose that in written testimony. 

Ms. EDWARDS. Can you just give me an example right here on 

the record? 

Mr. KENNEDY. I would need to get permission from my customer. 

I work on non-disclosure agreements and confidentiality of information. 

Ms. EDWARDS. Okay. What I would like to do, I will write you 

a letter. Your financial disclosure that you have submitted in this 

record requires that. Did you put that in your financial disclosure? 

Mr. KENNEDY. No. No, I—listen to me. My experience—— 

Ms. EDWARDS. Did you—— 

Mr. KENNEDY. The question you asked me was, did I have federal experience in the—— 

Ms. EDWARDS. It is my time, Mr. Kennedy. 

Mr. KENNEDY. Yes, ma’am. 

Ms. EDWARDS. Did you put that financial disclosure information 

in the record as required by our Committee? 

Mr. KENNEDY. I am not required to put that in there. 

Ms. EDWARDS. Thank you very much. 

Mr. KENNEDY. Thank you. It is not on behalf of TrustedSEC. 

Thank you. 

Chairman SMITH. Thank you, Ms. Edwards. The gentleman from 

Texas, Mr. Neugebauer, is recognized for his question. 

Mr. NEUGEBAUER. Thank you, Mr. Chairman. 

So, Mr. Gregg, I ask you this question: could a security breach 

of HealthCare.gov result in people’s medical files being accessed? 

Mr. GREGG. Yes, sir, it could. The information could be accessed, 

and then the real damage would come afterwards, how that information could be used. It could be used potentially to gain information of financial data. It could be used for identity theft. It could 

be misused many different ways. And that damage, as Mr. Kennedy alluded to earlier, is not just something as simple as replacing 

a credit card. This can be long-term. It can be very damaging to 

an individual. 

Mr. NEUGEBAUER. Now, there was a recent GAO report that documented that there was a 111 percent increase in federal agency 

data breaches in the past three years. Specifically, the GAO report 

noted that there were 22,156 incidents revealing sensitive personal 

information since 2012, up from 10,000 in 2009. Interestingly 

enough, the Centers for Medicare and Medicaid Services, the 

HealthCare.gov operator, had the second-most breaches in the report for Fiscal Year 2012. Mr. Krush said that the hackers are 

going where the money is and not necessarily interested in these 

government sites, but yet we see a substantial increase in the number of incidents that are happening. Mr. Kennedy, do you agree 

with Mr. Krush that people really aren’t interested in these government sites or what is your opinion on that? 

Mr. KENNEDY. Thank you, sir. I do not agree with Mr. Krush’s 

testimony there. I believe that the hackers move where the money 

is and there is a lot of money to still be made in the personal infor-
65 

mation side as well as other government agencies that look to do 

demise to us, especially on our information technology-related 

issues. Having direct access into DHS, IRS is a treasure trove for 

additional attackers out there. There is a lot of money for the organized crime, there is a lot of money for what we call state-sponsored attacks, so I would not agree with his assessment. There is 

plenty of money to be made in the government space and there are 

breaches happening all the time there. 

Mr. NEUGEBAUER. If I go to a government site and I am a hacker, what are the treasures out there that I am going to glean that 

are going to help me do whatever bad thing I have in mind? 

Mr. KENNEDY. Sure. I think that is in the question. It depends 

purely on the motivation of the attacker. So you have really three 

criteria of the attackers. You have your average black hat that may 

be politically motivated to prove a specific point or street credibility. You have your organized crime, which is specifically looking 

for monetary value or persistent access into organizations. There is 

also a huge black market right now that surpassed the credit card 

industry for what we call carders. Selling compromised infrastructures and organizations is a huge market right now. If I can say, 

hey, I compromised Government X or HealthCare.gov, I can sell 

that to an attacker for thousands of dollars to make a big buck off 

of it. 

Additionally—so you have that portion of it, the identity theft, 

the fraud, other areas there. Then you have the state-sponsored 

element, which is other government entities attacking infrastructure in order to infiltrate, gain access and intelligence on us, and 

that is a huge business right now. We see it obviously happening 

off of different, multiple other government entities, as well as Eastern European countries. 

Mr. NEUGEBAUER. Would you feel comfortable putting your personal information in HealthCare.gov? 

Mr. KENNEDY. Absolutely not. 

Mr. NEUGEBAUER. Yes. Mr. Gregg? 

Mr. GREGG. No, sir, I would not. 

Mr. NEUGEBAUER. Dr. Ponemon, would you? 

Dr. PONEMON. I am not sure. 

Mr. NEUGEBAUER. You know, I want to go back to you, Dr. 

Ponemon. One of the things that, you know, you talked about was 

that you wanted to talk about the consequences of stolen identity. 

Dr. PONEMON. Sure. 

Mr. NEUGEBAUER. Yes. So one of the things I think might be 

helpful is people that are forced to go to access their healthcare 

through government—HealthCare.gov, what would you advise 

them to do? You know, they are going to have to access that. As 

they are filling out that information, are there some preventative 

things that they can do that would minimize some of the potential 

consequences if the system is breached? 

Dr. PONEMON. Well, obviously, if the site is secure, that is a good 

step, right, but as an individual, whether we are doing it on 

HealthCare.gov or whether it is a website like Amazon.com, we 

need to be smart. We need to understand that our data could be 

at risk. The bad guys are really smart. For example, we should not 

be using the same password over and over again. Our computer 
66 

should have the most current version of antivirus or anti-malware 

technology. These commonsensical approaches do make a difference 

and that should be across the board. 

But again, if you have data that is extremely sensitive and confidential, then basically your guard, your level of concern should go 

up. And a lot of people don’t think about these issues well enough 

or they don’t think that they will become a victim. But as we know, 

with 110 million records here and 90 million records there, everyone, every single person in this room is a victim of some data loss 

and probably at least had one data breach notification in the last 

five years. So it is a big problem. 

Mr. NEUGEBAUER. Thank you, Mr. Chairman. I yield back. 

Chairman SMITH. Thank you, Mr. Neugebauer. 

The gentlewoman from Oregon, Ms. Bonamici, is recognized for 

her questions. 

Ms. BONAMICI. Thank you very much, Mr. Chairman, and thank 

you to our witnesses for being here today. 

This hearing is ostensibly about HealthCare.gov but I just want 

to make a big picture comment that the Affordable Care Act is certainly about more than a website; it is about an issue of great importance, which is about the availability of healthcare to all Americans. 

Now, when I saw the title of this hearing, I was pretty interested. I actually have a background in consumer protection. I used 

to work at the Federal Trade Commission, have worked on identity 

theft issues. I was a little baffled frankly about why we are doing 

this in the context of HealthCare.gov and in the Science Committee. 

That being said, we all acknowledge that there have been some 

serious technological problems rolling out the Affordable Care Act, 

but I am really concerned that some people listening, our constituents, might really be concerned that there are risks involved in enrolling through the website that aren’t really there. So I want to 

clarify a couple of things. 

First of all, I want to make it clear to our constituents that identity theft is already a federal crime, that if someone knowingly 

commits identity theft, that is a federal crime. If they do it—aggravated identity theft, there are enhanced penalties. So I want to 

make clear that if there is identity theft, that is already against 

the law. The Department of Justice prosecutes that. The Federal 

Trade Commission has several laws dealing with it. So identity 

theft is an issue we should be concerned about but I am baffled 

about why we are talking about it in the terms of HealthCare.gov. 

So, Mr. Krush, I want to ask you a couple of questions. First, I 

want to acknowledge and thank you for your service to this country. I understand, Dr. Ponemon, you are a veteran as well. Thank 

you for your service. 

Mr. Krush, you talked about how some people are suggesting 

that HealthCare.gov is a major target for hackers. Based on your 

background, your military and cyber security background, could 

you discuss the range of hackers and their different motives and 

talk about where HealthCare.gov is on the scale of high payoff targets. And you mentioned this in your testimony, but will you talk 

about that range just a bit, please. 
67 

Mr. KRUSH. Yes. Actually, it is very interesting in that, you 

know, we are here on the Committee of Science, Space, and Technology, and I will tell you something from a high payoff target perspective, especially when you are dealing with advanced attackers, 

the more a nation—nation-sponsored attackers and those even on 

the criminal organizations, they are after some very specific targets. And, you know, I am not going to go into those but I will tell 

you from a government perspective in all reality if you are looking 

at the .mil and the .gov kind of domains, you know, HealthCare.gov 

is not really a huge high payoff target. 

Space systems, technology related to weapons systems, intellectual property stores, information related to clearances, information 

related to quite possibly not only personal information on a person 

that may be weaknesses such as relationship issues where they can 

be played on or through blackmail. There is—websites that include 

information on criminals that are actually part of the court systems, literally we keep all of this information online now. As you 

can imagine from an attacker’s perspective, you could literally, you 

know, not delete the paper but there are ways that you can get into 

a system and change an outcome of quite possibly, you know, cases 

or what actually you have done in the past. So there is lots of highprofile targets. 

Ms. BONAMICI. Thank you. Thank you so much. I want to follow 

up a little bit. It is my understanding that we have already established that there aren’t medical records on HealthCare.gov, and 

Mr. Gregg confirmed that in response to Representative Edwards’ 

question. Do you agree with that, there are no medical records on 

HealthCare.gov? 

Mr. KRUSH. Correct. Those would be at the providers. 

Ms. BONAMICI. And would you agree that there is more personal 

information in a federal tax return than there is in a 

HealthCare.gov insurance application? 

Mr. KRUSH. I agree. 

Ms. BONAMICI. Mr. Kennedy, do you agree with that? 

Mr. KENNEDY. I do agree. 

Ms. BONAMICI. Mr. Gregg? 

Mr. GREGG. I do agree. 

Ms. BONAMICI. Dr. Ponemon? 

Dr. PONEMON. I agree. 

Ms. BONAMICI. Terrific. Okay. So about 80 percent of the people 

in this country file their tax returns online. Mr. Krush, do you file 

your tax returns online? 

Mr. KRUSH. I do. 

Ms. BONAMICI. Mr. Gregg, do you file your tax returns online? 

Mr. GREGG. No. 

Ms. BONAMICI. Dr. Ponemon, do you file your tax returns online? 

Dr. PONEMON. I am old-fashioned. No. 

Ms. BONAMICI. Mr. Kennedy? 

Mr. KENNEDY. I am old-fashioned as well. 

Ms. BONAMICI. So when you understand that about 80 percent of 

the people in this country file their tax returns online, we are talking about security with HealthCare.gov when there is more personal information on a federal tax return. I just want to highlight 
68 

that, that we are talking about security with HealthCare.gov when 

the majority of people file their tax returns online. 

All of you call for third-party—third parties to conduct security 

testing, and the MITRE Corporation, Blue Canopy, and Frontier 

Security have all been doing that for months. In your opinion, are 

those companies competent to do the work, yes or no? Dr.—or Mr. 

Krush? 

Mr. KRUSH. Yes. 

Ms. BONAMICI. Mr. Kennedy? 

Mr. KENNEDY. Yes. 

Ms. BONAMICI. Mr. Gregg? 

Mr. GREGG. Yes. 

Ms. BONAMICI. Dr. Ponemon? 

Dr. PONEMON. I only have knowledge of MITRE and the answer 

is yes. 

Ms. BONAMICI. Thank you. Mr. Krush, to be clear, there have 

been no cases of a person’s identity being stolen through 

HealthCare.gov at this point, is that correct? 

Mr. KRUSH. That is correct. 

Ms. BONAMICI. Okay. I just want to clear that up because the 

title of the hearing suggests that one of the consequences of signing 

up through HealthCare.gov is going to be identity theft. So I wanted to clarify that. 

So I—my time is expired. Thank you, Mr. Chairman. I yield. 

Chairman SMITH. Thank you, Ms. Bonamici. 

The gentleman from Texas, the Chairman Emeritus Mr. Hall, is 

recognized for questions. 

Mr. HALL. Thank you, Mr. Chairman, and thank you for the 

hearing and the witnesses. I like old-fashioned people. I don’t know 

why. But I will ask my fellow Texan there, Mr. Gregg. There has 

been talk about March the 31st, and I think you mentioned that 

since the deadline for open enrollment is not until March the 31st, 

wouldn’t hackers be kind of foolish to exploit the website now because they potentially would have the opportunity to retrieve a 

heck of a lot more information after that date? 

Mr. GREGG. Well—— 

Mr. HALL. Do they think like that or is that too—— 

Mr. GREGG. No, sir. They do in many ways look for the big payoff, and as was mentioned earlier, cybercrime can be broken down 

into two areas. One is the individuals looking for military, looking 

for that type of information, but a big other portion of it today is 

monetarily driven. We see a lot of that out of places like Eastern 

Europe. We see it out of places like Russia. And those individuals 

are looking for personal information. They are looking for things 

that they can make a financial payoff from. And to wait until the 

time was right would very much be to their advantage. While it is 

true information is not held on HealthCare.gov, information is 

passed through that site that they could potentially manipulate or 

take advantage of. 

Mr. HALL. Thank you. And I have heard of a lot of problems, but 

given the problems of the website to date, would you say it is highly likely that there will be breaches to the healthcare website? 

Mr. GREGG. Yes, sir. I do believe it is very possible or it is probable at this current state of the site that that could happen. 
69 

Mr. HALL. And once one has occurred, how quickly can experts 

find out about the breach? 

Mr. GREGG. That all depends. We have seen in previous cases 

with things like Gh0st RAT, GhostNet Trojan. We have seen in 

cases like with Google and Aurora and others, in some instances 

those organizations didn’t know until weeks or months later. 

Mr. HALL. How quickly should the American people be notified 

in the event of a breach? 

Mr. GREGG. Immediately. 

Mr. HALL. Within hours, days, weeks, or just right now? 

Mr. GREGG. Right now. 

Mr. HALL. That is pretty clear. Once a breach has occurred and 

people have been notified, what actions should people take? 

Mr. GREGG. Immediately start to do things like Dr. Ponemon 

mentioned as far as change passwords, change IDs, especially notify and talk to your credit card companies—— 

Mr. HALL. Now is—— 

Mr. GREGG. —look at your credit card statements, also check 

your credit rating and look at the credit rating organizations because many times, just like a period of about a week ago I got an 

email from Amazon that someone tried to open up an account 

under my name and I immediately called my credit card provider 

and found out someone had charged about $5,000 worth of merchandise under my name because someone had stolen my credit 

card. So you immediately need to take action for that stuff to put 

a stop to it if the credit card company doesn’t catch it. 

Mr. HALL. This is not like Target where you can check with your 

bank or your credit card company for even suspicious activity or 

something you think might be happening and that—— 

Mr. GREGG. That—— 

Mr. HALL. I think that is what you are telling me. 

Mr. GREGG. Yes, sir, that is correct. 

Mr. HALL. And how do you find out if—how did you find out if 

your Social Security number—is that the way they got to you? 

Mr. GREGG. No, sir, they got a credit card number from me. 

Mr. HALL. Credit card? 

Mr. GREGG. Yes, credit card. 

Mr. HALL. And if medical information had been compromised, 

what would you do about it? 

Mr. GREGG. It would be very tough. With medical information or 

someone has intentionally obtained medical services under your 

name, you may not find out until you actually get the bill, or if 

they have sent that to another address, you may not find out until 

you maybe get denied for a job because they said you had a preexisting condition they didn’t know of. 

Mr. HALL. Well, just briefly, what are the steps involved in repairing a breach? 

Mr. GREGG. It is very tough. 

Mr. HALL. And should a website be shut down while these remedies are being considered? 

Mr. GREGG. I would say yes, it should, and I mean it is very 

tough because, first, you have to contest those charges. And if it 

is related to medical, as soon as you contest it under HIPAA and 

other laws, then you have no access to the records or information 
70 

because it is not your information anymore. So it can be very difficult. 

Mr. HALL. Well, my time is almost gone. I believe that all of you 

would agree that while no website can be 100 percent safe, every 

precaution needs to be taken to ensure the security of the site. 

Now, Mr. Chairman, there are far too many questions surrounding the launch of the healthcare website, and until these are 

resolved, the security of Americans’ personal information is going 

to remain at risk. That is your understanding. Is that why we are 

having this hearing? 

Chairman SMITH. That is exactly correct, Mr. Chairman. 

Mr. HALL. And I thank you for the work on this issue and I 

thank each of you. And thank you, Mr. Chairman, for a good hearing. 

Chairman SMITH. Thank you, Mr. Hall. Would you yield me the 

balance of your time? 

Mr. HALL. I yield my balance of my time today, tomorrow, or 

next week or any time. 

Chairman SMITH. Mr. Kennedy, I would like for you to reemphasize the point you made in response to my initial question about 

why the government doesn’t even know whether it has been hacked 

or not—that is HealthCare.gov. Why the government really can’t 

say or state credibly that there had been no successful security attacks. 

Mr. KENNEDY. Yes, sir. So if you look at the HealthCare.gov infrastructure, it was built independently of HHS, including the Security Operations Center piece. There is contractual language on 

that. There is testimony from the Congress that also states that as 

well. So the Security Operations Center, as of November 17, had 

not been built or implemented, which means that they didn’t have 

the security monitoring or detection capabilities to detect the attacks that are being mentioned here today. So to reemphasize, they 

don’t know. 

Chairman SMITH. And they don’t know. That is why they can say 

there hasn’t been any. They are not in a position to know one way 

or the other. 

Mr. KENNEDY. That is correct. 

Chairman SMITH. Okay. Thank you, Mr. Kennedy. 

Mr. KENNEDY. Yes, sir. 

Chairman SMITH. The gentleman from California, Mr. Takano, is 

recognized for his questions. 

Mr. TAKANO. Thank you, Mr. Chairman. 

Mr. Krush, would you like to respond to that? 

Mr. KRUSH. Sure, I would love to. Actually, we have been talking 

about all of these supposed breaches that have been going on related to HealthCare.gov. If they couldn’t monitor those, how in the 

world do you have a number? The number would be zero if there 

was no capability to actually look at what kind of attacks are coming through the ether. 

Mr. TAKANO. Okay. Thank you very much. 

Mr. Gregg, I would like to focus on a couple of areas of your testimony. First, you argue that the site HealthCare.gov really needs 

a third party working to probe the system for weaknesses; and second, you assert that medical records are at risk on HealthCare.gov 
71 

and you list the kind of damage that can be done with stolen medical records. And you state previously in a post—Huffington Post 

post that ‘‘however, the United States has some of the very best 

minds in the world when it comes to cyber security and there is 

no doubt that HealthCare.gov can be fixed if the right people are 

given the chance to test it.’’ Do you still feel that way? 

Mr. GREGG. Yes, sir. That is one of the reasons why I am here 

today—— 

Mr. TAKANO. Okay. 

Mr. GREGG. —is because I believe with independent third-party 

assessment and the right assessment done, we can get to the bottom of this. 

Mr. TAKANO. Okay. Well, thank you. I just want know were you 

aware prior to your testimony today that MITRE, Blue Canopy, 

and Frontier Security were all working on third-party verification? 

Mr. GREGG. MITRE, yes; the others, no. 

Mr. TAKANO. Okay. You were aware that MITRE was aware, so 

I don’t understand how, you know, in your testimony you still assert that third-party work needs been done but you had knowledge 

that a third-party audit was actually being conducted by MITRE? 

Mr. GREGG. Yes. One, the article was written before that. It was 

written before that time. And two, I do not know if MITRE has finished their research or not or what the findings of those are. 

Mr. TAKANO. Okay. But you did raise this question as if thirdparty verification—I was led to the impression that third-party 

verification wasn’t being done, but in fact, you had knowledge it 

was being done? 

Mr. GREGG. Not at the time of the article. 

Mr. TAKANO. Okay. But in your testimony you lead us to believe 

that you raise it as a concern but it has—— 

Mr. GREGG. You quoted the article and you quoted a statement 

directly from the article that I said that needed to be done. At that 

time nothing had been done. 

Mr. TAKANO. But it is not in your—— 

Mr. GREGG. Is that the question? 

Mr. TAKANO. The testimony that you submitted for this Committee doesn’t acknowledge it but yet you are telling me here you 

had knowledge of it that it was being done. 

Mr. GREGG. I—— 

Mr. TAKANO. Your testimony leads us to believe that it was not 

being done. 

Mr. GREGG. As of this hearing, I do have knowledge. 

Mr. TAKANO. Okay. But your—but you—— 

Mr. GREGG. At the time of the article, no. 

Mr. TAKANO. Okay. Okay. Very well. You know, Dr. Ponemon, 

you talk about the medical records, you know, and identity theft, 

and a lot of your work has shown that 95 percent of the people who 

commit these sort of deeds are motivated by Robin Hood motivations. Would you explain about that a little bit? 

Dr. PONEMON. It is not 90 percent but it is a large percentage. 

I think it is 29 or 30 percent, but it is still pretty significant. A 

Robin Hood crime, as we define it in the research, is where someone, for example, has a family member or friend who basically has 

an illness and they are not insured and basically they will kind of 
72 

look the other way if you will and allow that person to use their 

insurance credentials so that when they show up at a hospital or 

clinic, they are getting better treatment than just right off the 

street. 

Mr. TAKANO. Well, common sense would sort of tell me if that is 

sort of the big motivation, what would motivate someone to go 

and—— 

Dr. PONEMON. Sure. 

Mr. TAKANO. —try to steal someone’s identity, that expanding 

healthcare coverage, providing quality coverage for more and more 

people would reduce this—the likelihood of this sort of crime. 

Dr. PONEMON. You have to understand I will be biased in that 

because I think we all deserve good healthcare. So if basically you 

had good healthcare, the value of a credential would be meaningless, right, because we all have that credential. So there is no value 

if you will in stealing someone’s credential because everyone is 

going to have a credential that will give them reasonable 

healthcare. 

Mr. TAKANO. So actually, if we made this healthcare website— 

you know, if it was very successful and more and more people got 

enrolled, the actual—we would reduce the risk of the misuse of 

medical records? 

Dr. PONEMON. It could work one way or another. It is really hard 

to determine that. In theory, you are right. I mean you could basically say that 29 or 30 percent, the Robin Hood portion of the 

crime, the medical identity theft might actually be nonexistent. 

Mr. TAKANO. So we would remove—we could possibly remove a 

huge motive for people to try to hack into this system if they were 

trying. 

Dr. PONEMON. Well, yes, but remember, the value of a medical 

record is more than just getting the insurance. You see, that is only 

a very small part of it. There is a lot of information, rich information, and you—we have done studies and the Russian Federation, 

other parts of the world, and if you had a look at the most valuable 

piece of information right now on an individual basis, it would be 

a medical record. And in fact, just yesterday in Fox News, business 

news, they did an article on the value of different types of information, and medical information in the black market is much, much 

more valuable than, say, credit or debit card information or authentication data. 

Mr. TAKANO. Okay. Well, thank you very much, Dr. Ponemon. 

Dr. PONEMON. And thank you. 

Mr. TAKANO. Thank you. 

Chairman SMITH. Thank you, Mr. Takano. 

The gentleman from Indiana, Mr. Bucshon, is recognized for his 

questions. 

Mr. BUCSHON. Well, thank you all for being here. It is a fascinating hearing. We had a previous hearing, which was also very 

fascinating. And we were four for four no one would get on the 

website last time, but we are three for four this time. 

In my view, this is about confidence the American people have 

in their government and whether or not their government is doing 

everything they can to protect their privacy. It is not about 

healthcare at all. We could be talking about any other website that 
73 

the federal government has. And we know the GAO came out and 

reported thousands of breaches across the federal government, so 

to argue that this website is going to be secure and that nothing 

is going to happen I think is a false argument because it is going 

to be breached. There is going to be information stolen. 

I think from my perspective—I was a medical doctor before. I 

think when you throw in the healthcare part of it, it becomes very 

personal for people. I understand people out there in my district 

are concerned about the Department of Defense being hacked, 

maybe a few people, but when you start talking about the potential 

for information that they perceive, whether it is real or whether it 

is perceived, is personal information. I think all of us in hearings 

like this and across government and the Administration, in both 

political parties, need to recognize the fact we need to do whatever 

we can to regain the confidence of the American people that we are 

protecting their personal information as best we can. Even though 

I do recognize the website itself doesn’t have that on there, it does 

have portals that people that are smart can potentially access that. 

And this is actually one of the biggest problems in electronic 

medical records, that we have. My medical practice established an 

electronic medical record in 2005. I love electronic medical records 

but there are two issues. There is of course security issues and 

then there is compatibility issues about getting medical information across different types of electronic medical records. 

So, I think it is unfortunate that all of you are somewhat subjected to a national discussion about healthcare, and I appreciate 

all of you trying to confine your comments to the security aspects 

and not the larger national debate about how we provide quality 

affordable healthcare to all our citizens, which I think is a goal we 

all have and certainly as a medical doctor I have. So it really 

doesn’t matter if HealthCare.gov is a low-propensity target by some 

hackers out there. In the minds of the American people when you 

mention their healthcare, this is the biggest target in the federal 

government in their minds. Whether that is real or perceived 

doesn’t really make a difference. 

So Mr. Krush, the GAO came out with this report, as you know, 

in 2012, saying there were 22,156 data breaches, 4,000 at CMS 

alone. And you have a relationship with CMS so you have to recognize that we can’t make the case that any website is going to be 

secure to try to make a political argument to prove that the way 

we are managing healthcare is the right way to go. I mean that is 

not the discussion, is it? The discussion is how do we protect information? You would have to agree with that, wouldn’t you? 

Mr. KRUSH. I absolutely agree with that. I will just say that I 

agree with that and with the idea that the process that we use, you 

know, to secure the data on federal information systems is just 

very rigorous, and that is my complete argument here. 

Mr. BUCSHON. Yes. And I would agree with that. I think when 

it comes to the confidence, I know we have discussed third-party 

people out there looking at this. And I will be honest with you. I 

am a Member of Congress and I have no idea whether there is a 

third-party person out there—and there obviously is—looking at 

this. So our charge is to get that to the American people, because 

if the American people don’t know—and I can tell you as a political 
74 

person trying to get a message across to 700,000 people is difficult 

and that is just 700,000 people. We need to do better getting the 

information out that there are actually people that are in government that are looking at this to preserve people’s personal records. 

That is my view. Mr. Kennedy, how do we do that? 

Mr. KENNEDY. Well, I think if you look at the broader picture 

here and not just HealthCare.gov but just in the federal space, endto-end testing, proactive security measures, things that are definitely outlined as being best-of-breed security practices need to be 

performed. And I am not saying that NIST doesn’t have those. It 

is just that they are loosely followed. And, to comply with FISMA 

is not necessarily a rigorous process. 

So what I have to say to that is, we have to focus on putting security in the very forefront, in the very beginning stages of what 

we hire a contractor or we go after an organization, throughout the 

entire process of that. HealthCare.gov is a prime example of the 

failures of being able to implement security in a rigorous manner 

or in a process that includes security throughout the entire life 

cycle. And if you do that, you have a better product. You have 

something that people can stand by and say, listen, we are doing 

our reasonable amount of assurance here and we are protecting 

your information, not just, kind of slapping it together and throwing it out there. 

Mr. BUCSHON. My time is expired. I would like to say let’s all of 

us work together to regain the confidence of the American people. 

Thank you. 

Ms. EDWARDS. Parliamentary inquiry—— 

Chairman SMITH. Thank you. 

Ms. EDWARDS. —Mr. Chairman. 

Chairman SMITH. Thank you, Dr. Bucshon. 

I am sorry? 

Ms. EDWARDS. Mr. Chairman, I have a parliamentary inquiry. 

Chairman SMITH. The gentlewoman is recognized for her parliamentary inquiry. 

Ms. EDWARDS. Thank you. Mr. Chairman, isn’t it true that the 

Committee and House rules require witnesses to submit factually 

correct financial disclosures forms? 

Chairman SMITH. There are certain limitations to that, but within those limitations, I think that is the case and I think all of our 

witnesses have done so today. 

The gentleman from— 

Ms. EDWARDS. Mr. Chairman? 

Chairman SMITH. Yes. The gentlewoman continues to be recognized. 

Ms. EDWARDS. Mr. Chairman—— 

Ms. JOHNSON. Point of order—— 

Ms. EDWARDS. —I yield to—— 

Ms. JOHNSON. Point of order, Mr. Chairman. 

Chairman SMITH. The gentlewoman is recognized. 

Ms. JOHNSON. I make a point of order that the witness testifying 

today has not complied with the House Committee’s rules regarding financial disclosure. And under those circumstances, I request 

that the testimony be stricken from the record. I am very—— 

Chairman SMITH. Obviously, I object to that and—— 
75 

Ms. JOHNSON. I expected that. 

Chairman SMITH. —I am afraid that the gentlewoman is not the 

one to make that determination. 

Ms. JOHNSON. I am not finished. 

Chairman SMITH. Well, does the gentlewoman have—— 

Ms. JOHNSON. I am recognized, Mr. Chairman, and I have—— 

Chairman SMITH. Does the gentlewoman have something to say 

that is pertinent to her inquiry? 

Ms. JOHNSON. —not finished my statement. I am very concerned 

about the testimony we heard from Mr. Kennedy a moment ago. He 

testified on the record that he did not disclose government contracts in his truth-and-testimony form that he and his company 

have received, and our Committee Rules require—— 

Chairman SMITH. He also said he was not—— 

Ms. JOHNSON. —a witness disclosure—— 

Chairman SMITH. —required under the—— 

Ms. JOHNSON. —requirement to be filed out by each—filled out 

by each witness. On that form Mr. Kennedy answered the question 

saying ‘‘not applicable.’’ This means that he did not comply with 

the rules of our committee, and as such, I ask that he be removed—— 

Chairman SMITH. That is not necessarily—— 

Ms. JOHNSON. —from—the testimony from the Committee—— 

Chairman SMITH. —a legitimate—— 

Ms. JOHNSON. —until he accurately and fully discloses the federal grants and contracts that the entity he represents have received on or after October 1, 2011—— 

Chairman SMITH. Mr. Kennedy, do you want to respond whether 

you were required to disclose that or not? 

Mr. KENNEDY. Thank you, sir. The question was have I done 

work in the federal space prior in the past or currently. The answer 

to that is on behalf of TrustedSEC, we do not work in the public 

sector or government, which is what I disclosed in the statement 

there. In addition, I have worked for NASA as well as other federal 

government agencies in my capacity as a Chief Security Officer for 

a Fortune 1000 company, as well as my prior roles as a security 

consultant for former entities. So to answer the question there on 

what was submitted, I do not do work for the public sector. I am 

plenty busy in the private sector keeping everybody else protected. 

Thank you. 

Chairman SMITH. Thank you, Mr. Kennedy. I think you have answered the question. 

And I would like to continue our questions. And the gentleman 

from Massachusetts, Mr. Kennedy, is recognized for his. 

Mr. KENNEDY OF MASSACHUSETTS. Thank you, Mr. Chairman, 

and thank you to the witnesses for being here today. 

I want to start out by saying I know—I think Teresa Fryer was 

mentioned earlier in this hearing, and I know that she is actually 

testifying I think at this moment or just moments ago in front of 

the Committee on Oversight and Government Reform. And her testimony before was referenced about—some of the—her remarks on 

HealthCare.gov and she just recently said today that the 

HealthCare.gov website is secure based on a December 18 security 

assessment. She stated that the system exceeds the best practices 
76 

to ensure security and that the risk mitigation policies are being 

implemented and executed as planned. As a result, attacks have 

been successfully prevented. She recommends that a new ATO 

should be given when the current one expires just to make sure 

that we are all up to date on the current testimony. 

Now, a couple of, I think, points of clarification: Mr. Kennedy, I 

think one of us here supports the ACA, but I will leave that up for 

the gallery to decide. The—now, I noticed at the—I think in your 

initial testimony and the initial testimony of the witnesses, you 

were nodding your head when Mr. Krush said that unless you are 

actually able to dive into the inner workings of the website, which 

you have made clear that you did not hack into, you did not do 

anything illegal, but that you would not have any way of knowing 

in detail what part was vulnerable to attack unless you had done 

so. Is that accurate? 

Mr. KENNEDY. We can’t tell the inside of HealthCare.gov without 

actually testing it. That is 100 percent accurate. What we can see 

are symptoms of a much larger issue. And if you wouldn’t mind for 

just—if I can read a—one of the things that I submitted from Ed 

Skoudis just as an example if you are okay with that, sir. 

Mr. KENNEDY OF MASSACHUSETTS. Yes, go ahead. 

Mr. KENNEDY. Thank you. Mr. Skoudis said, ‘‘I have worked on 

dozens of large-scale breach cases over the past 12 years looking 

at the root cause of vulnerabilities of attacker methods. Reviewing 

the security issues discovered in HealthCare.gov, I can tell you this 

is a breach waiting to happen. Or given the numerous 

vulnerabilities, perhaps a breach has already happened. These are 

exactly’’—and he emphasized on that—‘‘the kind of security flaws 

bad guys exploit on large-scale breaches.’’ 

Mr. KENNEDY OF MASSACHUSETTS. So, Mr. Kennedy—and I appreciate that, but the point is—and I think we have heard it actually reiterated a number of times here—is that we don’t know. You 

don’t know. You testified before that HHS doesn’t know. If HHS 

doesn’t know, you don’t know, so much of this is in fact—it is a concern but it is speculative, right? 

Mr. KENNEDY. It is an underlying portion of HealthCare.gov, absolutely, yes. 

Mr. KENNEDY OF MASSACHUSETTS. Okay. So—now—thank you. 

And, Mr. Krush, do you—out of your expertise, can you just give 

me off the top of your head what you believe to be the biggest data 

breaches—recent data breaches? This is something that is fairly 

common. Obviously, Target and Neiman Marcus in the news today. 

How many—are you aware of others? 

Mr. KRUSH. Well, interestingly enough, you know, the thing— 

when it comes to data breaches, I think Target is a perfect example 

of someone that had the capability to identify a breach. The thing 

that is of most concern to me is that there are a lot of industry and 

even government organizations that don’t have the capability to do 

that. 

Mr. KENNEDY OF MASSACHUSETTS. So, sir, Target, Neiman 

Marcus obviously in the news now. Do you recall Heartland Payment Systems data breach back in 2008? Does that ring a bell with 

you? 

Mr. KRUSH. It does. 
77 

Mr. KENNEDY OF MASSACHUSETTS. At least from some estimates 

134 million credit cards exposed. How about TJX Companies in 

2006, 94 million credit cards exposed; Epsilon, which exposed the 

emails of millions of customers stored in over 108 different retail 

chains; RSA Security, top-notch security firm; Sony Playstation 

Network, over 77 million Playstation Network accounts exposed, all 

private sector, yes? 

Mr. KRUSH. Yes. 

Mr. KENNEDY OF MASSACHUSETTS. This is something the private 

sector invests billions of dollars a year in trying to protect, yes? 

Mr. KRUSH. Yes. 

Mr. KENNEDY OF MASSACHUSETTS. This is something that is very 

difficult and has to be on the cutting edge in order to defend 

against, yes? 

Mr. KRUSH. Yes. 

Mr. KENNEDY OF MASSACHUSETTS. Are you aware of how many 

times the House of Representatives has voted to cut funding or appeal the Affordable Care Act this Congress? 

Mr. KRUSH. I am not. 

Mr. KENNEDY OF MASSACHUSETTS. Would the number close to 50 

seem accurate to you? 

Mr. KRUSH. Unfortunately, I just don’t have that insight. 

Mr. KENNEDY OF MASSACHUSETTS. Okay. 

Mr. KRUSH. I can talk about risk assessment—— 

Mr. KENNEDY OF MASSACHUSETTS. Well, take my word for it. 

Mr. KRUSH. —if you like. 

Mr. KENNEDY OF MASSACHUSETTS. Take my word for it. 

I yield back the balance of my time. 

Chairman SMITH. Thank you, Mr. Kennedy. 

The gentleman from Oklahoma, Mr. Bridenstine, is recognized 

for his questions. 

Mr. BRIDENSTINE. Thank you, Mr. Chairman. I appreciate the 

time. 

I would like to start by asking our witnesses a question. Are you 

familiar with Tony Trenkle? He was the Chief Information Officer 

for the Centers for Medicare and Medicaid Services. And his job 

was to oversee the development of HealthCare.gov and his job was 

to,—as—you know, the last thing before launching the website he 

had a security waiver he was supposed to sign. Do you guys remember any of this by chance? And he didn’t sign it. He refused 

to sign it and he resigned. His boss, Marilyn Tavenner, CMS Administrator, who is not a Chief Information Officer, who arguably 

would not be qualified to sign off on a security waiver, she signed 

it. He didn’t. He is qualified. She did, she is not qualified. She is 

an appointee of the President of the United States. 

Interestingly, her boss, Secretary of Health and Human Services 

Kathleen Sebelius, testified before Congress that she had no idea 

that a security waiver was supposed to be signed, that it didn’t get 

signed, and that her subordinate, another Barack Obama appointee, signed it. She didn’t know. It would seem to me you have 

a qualified person not signing it and then having to resign, and the 

Administration was not clear about why that person had to resign, 

namely Tony Trenkle. In fact, they didn’t answer the question why. 

But it would appear—and this gives me concern—that people are 
78 

making decisions for political reasons, not in the best interest of security of our citizens. 

And so some of you on this panel are CEOs, I think three of you. 

And then, one leads a research institution. Just a quick yes-or-no 

answer, in your institutions if this was going on, would you guys 

have an issue with it? Would somebody in your organization be 

fired? We will start with you, Mr. Kennedy, and just go down the 

row. 

Mr. KENNEDY. Coming from being a Chief Security Officer for a 

Fortune 1000 company, I would say the answer to that would be 

yes. That would raise a major concern for me. 

Mr. KRUSH. I would just talk to the point that the authorizing 

official, if it was the CSO and he or she was the one authorized 

to sign for the system, you know, this is actually one of the breakdowns in the risk management framework right now. You have 

what is called—you usually have the CIO or the director that are 

in charge of maybe a program, an organization, and they are directed as the authorizing official. I would say if we are going to 

look at one of the weaknesses in the process government-wide is 

that that Chief Information Security Officer should be where the 

buck stops always. Right now, there is—— 

Mr. BRIDENSTINE. So you are acknowledging that he should have 

signed it if it was secure, and his refusal is a big breach of trust 

here with the American people? 

Mr. KRUSH. I acknowledge that under the current process—— 

Mr. BRIDENSTINE. And then he was forced to resign, arguably. 

Mr. KRUSH. The current process allows for the authorizing official to be whoever is directly in charge of the entire information 

system. So, that being said, I think that that is a weakness in the 

process. Right now, it should be the Chief Information Security Officer where it stops. They are supposed to know the system, the security capabilities, and they are supposed to be the ones that 

should be responsible, but that is not the process that we are currently using in the government. 

Mr. BRIDENSTINE. Well, it was the process that was supposed to 

be used until he refused and then resigned. Going down the line? 

Mr. GREGG. I would also say yes and I would add to that that, 

as we talked about earlier, with external third parties looking at 

this, that is just a piece of it, them looking at it. The other part 

is those items are actually implemented and they are signed off on. 

Dr. PONEMON. It is my turn, I suppose. Yes, it is a big ethical 

issue in my opinion. I think the key variable is that the security 

of our country and the citizens of our country should be more than 

a political issue. 

Mr. BRIDENSTINE. Agreed. 

Dr. PONEMON. But I don’t think the solution is to have local 

CSOs, people who are middle-level management. It should be a 

major, major function of the government to have a CSO for the entire United States and then—— 

Mr. BRIDENSTINE. I am going to bring back my time. I have only 

have 30 more seconds but I appreciate your answer and you can 

submit it for the record. 

Dr. PONEMON. Absolutely. 
79 

Mr. BRIDENSTINE. But I would like to just say that I am not 

going to put this in for the record, Mr. Chairman, because I don’t 

want it to create any issues on the other side of the aisle, but this 

comes from an article from CBS News dated November 6, 2013. So 

people watching at home have access to it. It is on the internet. It 

has all been disclosed. 

And I would like to say, finally, in my last five seconds this is 

exactly why the American people have lost trust in their government. This is exactly why the American people have lost trust in 

their government. 

Mr. Chairman, I yield back. 

Chairman SMITH. Thank you, Mr. Bridenstine. 

The gentleman from Illinois, Mr. Hultgren, is recognized for his 

questions. 

Mr. HULTGREN. Thank you, Mr. Chairman. Thank you all for 

being here. This is such an important topic and something I am 

certainly hearing from my constituent as I travel around my District of great concern and wanting answers and so I appreciate you 

being here. 

I have got a couple of different questions. I am going to address 

the first one to Mr. Krush if I could. According to your written testimony, you say that based on what you have read publicly thus 

far, ‘‘HealthCare.gov is most likely categorized as a moderate system referring to the National Institute of Standards and Technology or NIST’s security levels of low, moderate, and high.’’ I wonder, is that an appropriate categorization for this kind of personal 

data that we are talking about here being available and accessible 

through the HealthCare.gov website, including people’s medical 

files? 

Mr. KRUSH. So usually we reserve high for, you know, grave danger to national security, to the confidentiality, integrity, and availability could, you know—for most of the high systems. So usually 

to me when something is categorized with that, it is usually life or 

death. And since HealthCare.gov is not that, it—there are some 

areas where, depending on the organization, there is something 

called organizationally defined parameters. That allows the organization to say if they process, store, transmit, manage, or review privacy data, it allows them to make the recommendation to go to 

high. But from what I have read thus far about the site, because 

of the interactions with the other websites, meaning the handing 

off through the controlled APIs and the way that it deals with 

interconnections, it still would be moderate. If one of those interconnections are high, then they—then what they have to do is actually—they do—well, we are going to do this anyway. They have to 

develop what is called an ISA, an Interconnection Security Agreement. And what that requires both sides to do is agree on the cyber 

security rules, including on how quickly they report any instance 

related to those. 

Mr. HULTGREN. Let me jump in here real quick. I would say 

again for my constituents this is of high concern to them and I 

think for us as well. And I would agree with my colleagues of how 

important this is in people’s lives. And, boy, talking about medical 

care, it sounds like life and death to me oftentimes is making sure 

that our medical records are protected. 
80 

I am going to jump to Mr. Gregg. Is there any evidence that 

HealthCare.gov meets NIST’s data security standards and who 

should certify that HealthCare.gov complies with the Federal Information Security Management Act? 

Mr. GREGG. I have not seen that evidence as far as whether or 

not they have been certified so I cannot say on that. 

Mr. HULTGREN. Okay. Let me open this up to any others. Mr. 

Kennedy, Dr. Ponemon, let me open this up to you all, any 

thoughts you might have. National Institute of Standards and 

Technology, NIST again, provides agencies with the guidance they 

need to develop and launch networks and websites that are fully 

and properly secure. Should NIST’s role be expanded or increased 

with any new authority and responsibility specifically in regards to 

HealthCare.gov? Would NIST be best qualified to verify and certify 

how well agencies meet their security standards’ compliance? And 

in today’s case, should NIST review HealthCare.gov? Start with 

Mr. Kennedy. 

Mr. KENNEDY. I would agree with that. I think if you look at not 

just technology-specific areas. You have the CDC, the Centers for 

Disease Control. Prevention, which is really about getting information to the American people about diseases, things like that. The 

same oversight needs to be there and the expanse of NIST needs 

to be there for more of a governance structure over our security 

practices inside the government. Again, NIST is more of a guidance 

role right now to adhere to. I think the expansion on this is really 

to bring more security integration throughout the whole government, the whole federal government, to really build best practices 

in. Right now, it is kind of intermittent not whether they do it or 

not. So I agree that, yes. 

Mr. HULTGREN. Okay. Any other comments or thoughts? 

Mr. KRUSH. They currently write the guidelines, the NIST—National Institute of Standards and Technology special publications 

and also they write different guidance on different types of technologies. I think just understanding systems from a risk perspective, if you have one organization that is in charge of the information security for every single government organization, it is—you 

will never come to the same risk decision. The problem lies in the 

fact that somebody at HHS is going to know about HHS systems 

and the security and the requirements better than someone, you 

know, in an office somewhere up at NIST. 

Mr. HULTGREN. I think that my fear is accountability, too. Sometimes I see it in bureaucracies, there is a desire to protect, hey, if 

we have a breach, don’t let anybody know. I want to make sure 

that doesn’t happen. 

Mr. Gregg, do you have any thoughts on this? 

Mr. GREGG. No, but I would agree many times this stuff is covered up and it is not released immediately. We even see with Target that we are getting some information, but yet to see the full 

picture. 

Mr. HULTGREN. Okay. Dr. Ponemon, real quick, what are some 

of the serious consequences that consumers face in the wake of 

medical identity theft? Are there financial consequences in addition 

to medical consequences? 
81 

Dr. PONEMON. Yes, and our research we find that a fairly large 

percentage of our sample suffered some financial consequences, and 

sometimes it is just staggering. It could be thousands or tens of 

thousands of dollars. Keep in mind that the people who are at risk 

are not necessarily wealthy people, people who are low income. And 

so on a proportional level it could be their total yearly income just 

basically the costs associated with cleaning up your medical record. 

Mr. HULTGREN. Doctor, you are right, and I think that is my fear 

is those who are most vulnerable are right on the edge—— 

Dr. PONEMON. Absolutely. 

Mr. HULTGREN. —something happens there, they don’t have anything to fall back on. People with significant resources do. 

Thank you again for being here. Chairman, I appreciate the opportunity and I yield back. 

Chairman SMITH. Thank you, Mr. Hultgren. 

The gentleman from Texas, Mr. Weber, is recognized for his 

questions. 

Mr. WEBER. Thank you. 

Mr.—is it Krush or Krush? I have heard it both ways. 

Mr. KRUSH. It is Krush but in the Army I used to say Krush. 

Mr. WEBER. It is Krush, okay. All right. Well, just call you for 

dinner is the main thing, right? 

Mr. Krush, you said, I think, that you were lucky enough to have 

worked for the HHS or was it the CMS? 

Mr. KRUSH. So I was fortunate enough to work early on on the 

central office at HHS. 

Mr. WEBER. Okay. 

Mr. KRUSH. I have also provided training actually related to the 

risk management framework and we develop online training for 

CMS. 

Mr. WEBER. I want to draw attention to the word luck. You said 

you were lucky but then later you said you had contracts totaling 

around $10 million? $1 million? $10 million? 

Mr. KRUSH. $1 million. 

Mr. WEBER. $1 million. Okay. 

Mr. KRUSH. But I would say when I was talking about luck, I 

was actually talking about the individuals that are at the central 

office are probably some of the most talented cyber security people 

I have met. And that is just the truth. I have worked with them 

when they were contractors and now they are—— 

Mr. WEBER. Okay. And then you said I am working for the 

CMS—and I wrote it down—you weren’t ‘‘best of friends’’ with—— 

Mr. KRUSH. That is correct, with CMS. 

Mr. WEBER. —was the words you used. 

Mr. KRUSH. We actually had a recent protest with them. 

Mr. WEBER. Okay. 

Mr. WEBER. But you had government contracts so you might not 

have been best of friends, but you weren’t enemies, right? 

Mr. KRUSH. Absolutely not. 

Mr. WEBER. Yes, you weren’t enemies. It wasn’t maybe a marriage, but at that dollar rate, you might be interested in a longterm relationship? What do you think? 

Mr. KRUSH. At those dollar amounts—— 

Mr. WEBER. Yes, sir. 
82 

Mr. KRUSH. —a long-term relationship? If it was a little bit more 

probably. 

Mr. WEBER. Okay. I see. You are going to play hard to get. So 

were you hired on experience and good performance? 

Mr. KRUSH. Absolutely. 

Mr. WEBER. Okay. So you think performance is important? 

Mr. KRUSH. Absolutely. 

Mr. WEBER. So would you say that the performance in rolling out 

HealthCare.gov was sterling or problematic? 

Mr. KRUSH. It was problematic. 

Mr. WEBER. Very problematic. Can you understand how some 

Americans would question the ability of the company that put together HealthCare.gov? 

Mr. KRUSH. I can. 

Mr. WEBER. Sure, makes sense. So it is no surprise to you that 

their credibility has been called into question. 

Mr. KRUSH. Um-hum. 

Mr. WEBER. Do you fault us for doing our due diligence to try to 

protect the American public? 

Mr. KRUSH. I do not. 

Mr. WEBER. So you think it is a good thing what we are doing 

here? 

Mr. KRUSH. I think that every time—unfortunately, we are as a 

nation fairly reactive, just like, you know, industry. We wait until 

something big happens before we talk about it. You know, cyber security—— 

Mr. WEBER. That is a yes or no. It is a good thing we are doing 

here because I am running out of time. 

Mr. KRUSH. Oh, absolutely it is a good thing— 

Mr. WEBER. Yes, good. Well, I am glad—— 

Mr. KRUSH. —to talk about it. 

Mr. WEBER. Good. I am glad to hear you say that. 

Mr. Kennedy, you also think it is a good thing? 

Mr. KENNEDY. Absolutely I do. 

Mr. WEBER. How about—Mr. Gregg? 

Mr. GREGG. Yes, I do. 

Mr. WEBER. Doctor? 

Dr. PONEMON. Yes, I do. 

Mr. WEBER. Okay. Well, I am glad to hear that we are finally 

doing something that is advantageous. You know, that is kind of 

rare for Congress. 

Mr. Krush, on February the 19th, 2013, you tweeted ‘‘don’t just 

worry about China breaking into systems.’’ And then you went on 

Fox News and talked about it. Do you recall that? 

Mr. KRUSH. I don’t remember that tweet but, yes, I am very— 

actually, I don’t tweet that much at all but I did go on Fox News 

related to the APT, correct. 

Mr. WEBER. Yes, I know. You don’t do a lot of tweeting. I looked 

at them. 

Mr. KRUSH. Yes. 

Mr. WEBER. When you tweeted out ‘‘don’t just worry about China 

breaking into systems,’’ what did you mean by that? 
83 

Mr. KRUSH. Actually, I think, sir, that was probably—when I was 

tweeting, I just reposted a news article and that was probably just 

the title. 

Mr. WEBER. But you recognize that we have a lot of cyber security attacks hitting our government, like a million a year. 

Mr. KRUSH. Oh, absolutely. I have helped to develop many security operation centers in the government and industry, and there 

are organizations constantly knocking at our door and trying to 

knock it down. 

Mr. WEBER. But China would only attack those military 

websites. They would never go for HealthCare.gov, would they? 

Mr. KRUSH. Interestingly enough, most organizations, you know, 

state-sponsored organizations—and I put this in my testimony— 

they are always looking for jump points, .gov, .mil, period. 

Mr. WEBER. So the people in China that are attacking us, is their 

level of proficiency low, medium, high? 

Mr. KRUSH. Very high. 

Mr. WEBER. So we are well advised to warn the American people 

that they are going to have information on HealthCare.gov that 

may be spread across the globe? 

Mr. KRUSH. You are well advised to warn everybody in the federal government and even in industry that cyber security and privacy absolutely needs to be one of your top priorities. 

Mr. WEBER. Okay. Well, I appreciate you understanding that, 

Mr. Chairman, I yield back. 

Chairman SMITH. Thank you, Mr. Weber. 

The gentleman from New York, Mr. Collins, is recognized for his 

questions. 

Mr. COLLINS. Thank you, Mr. Chairman. And I find that it has 

been about two months since our last meeting. Mr. Kennedy, welcome back. 

As one of the last witnesses, I tend to see that there are times 

people will try to defend the indefensible, and the best way to defend the indefensible is to confuse the issue and muck it up and 

raise other things. I have heard and seen some of that today. So 

I would like to come back here at the end and remind everyone 

that all four witnesses last time, including the Democrat witness, 

testified absolutely the website was not secure on October 1. They 

testified that absolutely the website was not secure on November 

19. We couldn’t get agreement as to whether we should shut it 

down immediately or not, but the testimony indicated that October 

1 was a date certain set by the Obama Administration to launch 

HealthCare.gov irrespective of whether it was ready, and I think 

the American public know it was not ready. 

So I think it brings into question if it was a date certain, it 

wasn’t let’s launch the website when it is ready. Let’s launch it 

when it will do the job and handle the traffic. Let’s launch it when 

it was secure. No. It was let’s launch it on October 1 because we 

promised it would be October 1 whether it is ready, whether it is 

secure, doesn’t matter. Launch it. And we did. And the American 

public in watching this hearing can see for themselves that that 

was the overriding concern, certainly not security. 

So now, here we are today, and yes, we have a different witness, 

but I guess I would ask our witness, Mr. Krush, whether you think 
84 

the website was ready to be launched on October 1 or not? That 

is a yes or no. 

Mr. KRUSH. That is a no. 

Mr. COLLINS. And do you think it was secure then on October 1? 

Mr. KRUSH. So if you have read my testimony and my previous 

testimony, you will see that I said the process was followed and a 

risk-based decision was made. That is why it is called risk management framework and not the no-risk process. 

Mr. COLLINS. So I guess what I come back to here is that there 

are those today that tried to say this was a politicized hearing and 

so forth, which I don’t think it is. I think we are just back to talking to the American public who are being told that, to sign up, they 

must share this delicate information, including Social Security 

numbers. 

I think the fact that Target or Neiman Marcus happened to have 

had their issues doesn’t defend this. Two wrongs don’t make a right 

by any stretch of the imagination. But I am trying to point out and 

remind folks this website was launched on October 1 for only one 

reason: political reasons. It was not ready. The Administration 

knew it was not ready. If it is not ready, it is not secure. It wasn’t 

secure. We know it wasn’t secure. Now, we are being told today to 

trust the Administration and, Mr. Krush, to trust some of your 

judgment. Something happened in the last week or two or month. 

It is now secure. Well, I guess I am not quite ready to accept that 

just because you say it is so. That doesn’t necessarily make it so. 

So, I am just trying to bring us back to where we were October 1, 

where we were on November 19, where we are today. And certainly, I am confident three of our witnesses today, Mr. Kennedy, 

do you think it is secure today? 

Mr. KENNEDY. Absolutely not. 

Mr. COLLINS. Mr. Gregg? 

Mr. GREGG. No, I do not. And usually when sites are rolled out, 

they are rolled out in a beta first—— 

Mr. COLLINS. Right. 

Mr. GREGG. —very small group, and then to a large group. 

Mr. COLLINS. Mr. Ponemon, do you believe it is secure today? 

Dr. PONEMON. You know, it is hard to tell. I am not—these people are the experts, but they simply—based on what I am hearing, 

again as a citizen of this country, I am concerned. I am not happy 

with what I am hearing here today. 

Mr. COLLINS. Okay. And, Mr. Krush, I will let you answer that 

as well, please. 

Mr. KRUSH. I think my testimony and everything I have been 

saying here is none of us worked on HealthCare.gov, so speculating 

that it is either secure or not is just not something I am willing 

to say. 

Mr. COLLINS. So you would say today you would not state affirmatively to the American public that it is secure? 

Mr. KRUSH. Based on the information that I have read, a riskbased decision was made. There was a mitigation strategy that was 

very clear. They are doing weekly scans. They are doing daily 

scans. They are doing mitigation and remediation. 

Mr. COLLINS. Okay. I was kind of hoping for a yes or no. 

Mr. KRUSH. I would say that is pretty secure. 
85 

Mr. COLLINS. So you are stating, yes, it is secure? 

Mr. KRUSH. I am stating based on the information I have right 

now I would say it is secure. 

Mr. COLLINS. Okay. Well, we can have that difference of opinion 

and I guess I will leave it at that for the American public to make 

their own decisions. 

Mr. Chairman, I yield back. 

Chairman SMITH. Thank you, Mr. Collins. 

The gentlewoman from Illinois, Ms. Kelly, is recognized for her 

questions. 

Ms. KELLY. Thank you, Mr. Chair. 

Mr. Krush, unlike some of the other witnesses, you have extensive experience working on federal government websites from the 

inside developing countermeasures against potential attacks and 

ensuring that websites are as secure as possible. Is it true that 

what might appear like a security vulnerability or even a successful exploit from the outside does not actually always result in a security threat? 

Mr. KRUSH. That is correct, Ms. Kelly. Actually, we like to set 

up things called honey pots meaning that we will set up—we want 

to know what the attackers are actually doing to our websites and 

our systems, so we set up ports, protocols, and services that may 

not have anything to do with the website to kind of find out who 

is coming in, what they are doing, and so that we can then build 

countermeasures internally to deal with those type of things. 

Ms. KELLY. I have also been told that a site security team will 

leave the appearance of a weakness in place so that hackers will 

waste their time. There are other times, as I understand it, seeming weaknesses are purposely put in place and what IT professionals—like you just said, honey pots, where a genuine hack or 

even a white hacker gets caught trying to penetrate a system. And 

you just said that that was true. Do you imagine with 

HealthCare.gov that is—honey pots are in place or—— 

Mr. KRUSH. So, Ms. Kelly, because I didn’t set up the honey pot, 

I can’t speculate on that either, but it is a very normal practice and 

best practice in the government to set up honey pots so that we can 

understand what our adversaries or external organizations are trying to gain access to and what type of things they are actually 

doing to our websites. 

Ms. KELLY. Okay. And lastly, the HealthCare.gov website uses 

remote authentication to help verify that the users are who they 

claim they are in order to help cut down on medical fraud. These 

sorts of security practices can sometimes make websites clunky and 

the user interface problematic. Can you address this issue for us? 

Is it possible that these sorts of kinks and glitches experienced on 

HealthCare.gov were do to its enhanced security measures by any 

chance? 

Mr. KRUSH. The great thing about security is if it is done right, 

it won’t work. No, I am joking. So a lot of times when we lock down 

systems in the federal government, if we followed every single security control that is put forward for us, we would turn that box or 

that system into a completely unusable, you know, locked-down box 

meaning I couldn’t log into it as an administrator but neither could 

you. So what we do is we look at the controls from a security engi-
86 

neering perspective and decide what are the best, you know, security controls to implement and how that is going to affect our operational user base. And so to answer your question that is a possibility but I didn’t actually do the identity management system so, 

once again, I can’t really talk to that fact. 

Ms. KELLY. Thank you so much. I yield the rest of my time. 

Chairman SMITH. Okay. Thank you, Ms. Kelly. 

I don’t see any other Members here to ask questions so this concludes our hearing today. Thank you all again for your contributions to the subject at hand. We heard a lot of good testimony and 

we will continue to be in touch. 

We stand adjourned. 

[Whereupon, at 11:12 a.m., the Committee was adjourned.] 
(87) 

Appendix I 

ANSWERS TO POST-HEARING QUESTIONS
88 

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. David Kennedy 
89 
90 
91 
92 
93 
94 
95 
96 
97 
98 
99 
100 
101 
102 

Responses by Mr. Waylon Krush 
103 
104 
105 
106 
107 
108 

Responses by Mr. Michael Gregg 
109 
110 
111 
112 
113 

Responses by Dr. Lawrence Ponemon 
114 
115 
116 

Æ