U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

88–530 PDF 2014

DATA SECURITY: EXAMINING EFFORTS TO 

PROTECT AMERICANS’ FINANCIAL INFORMATION 

HEARING 

BEFORE THE

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS 

AND CONSUMER CREDIT 

OF THE

COMMITTEE ON FINANCIAL SERVICES 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

SECOND SESSION 

MARCH 5, 2014 

Printed for the use of the Committee on Financial Services 

Serial No. 113–68 

( 

(II) 

HOUSE COMMITTEE ON FINANCIAL SERVICES 

JEB HENSARLING, Texas, Chairman 

GARY G. MILLER, California, Vice Chairman 

SPENCER BACHUS, Alabama, Chairman 

Emeritus 

PETER T. KING, New York 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

SHELLEY MOORE CAPITO, West Virginia 

SCOTT GARRETT, New Jersey 

RANDY NEUGEBAUER, Texas 

PATRICK T. MCHENRY, North Carolina 

JOHN CAMPBELL, California 

MICHELE BACHMANN, Minnesota 

KEVIN McCARTHY, California 

STEVAN PEARCE, New Mexico 

BILL POSEY, Florida 

MICHAEL G. FITZPATRICK, Pennsylvania 

LYNN A. WESTMORELAND, Georgia 

BLAINE LUETKEMEYER, Missouri 

BILL HUIZENGA, Michigan 

SEAN P. DUFFY, Wisconsin 

ROBERT HURT, Virginia 

MICHAEL G. GRIMM, New York 

STEVE STIVERS, Ohio 

STEPHEN LEE FINCHER, Tennessee 

MARLIN A. STUTZMAN, Indiana 

MICK MULVANEY, South Carolina 

RANDY HULTGREN, Illinois 

DENNIS A. ROSS, Florida 

ROBERT PITTENGER, North Carolina 

ANN WAGNER, Missouri 

ANDY BARR, Kentucky 

TOM COTTON, Arkansas 

KEITH J. ROTHFUS, Pennsylvania 

MAXINE WATERS, California, Ranking 

Member 

CAROLYN B. MALONEY, New York 

NYDIA M. VELA ́ ZQUEZ, New York 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

MICHAEL E. CAPUANO, Massachusetts 

RUBE ́ N HINOJOSA, Texas 

WM. LACY CLAY, Missouri 

CAROLYN MCCARTHY, New York 

STEPHEN F. LYNCH, Massachusetts 

DAVID SCOTT, Georgia 

AL GREEN, Texas 

EMANUEL CLEAVER, Missouri 

GWEN MOORE, Wisconsin 

KEITH ELLISON, Minnesota 

ED PERLMUTTER, Colorado 

JAMES A. HIMES, Connecticut 

GARY C. PETERS, Michigan 

JOHN C. CARNEY, JR., Delaware 

TERRI A. SEWELL, Alabama 

BILL FOSTER, Illinois 

DANIEL T. KILDEE, Michigan 

PATRICK MURPHY, Florida 

JOHN K. DELANEY, Maryland 

KYRSTEN SINEMA, Arizona 

JOYCE BEATTY, Ohio 

DENNY HECK, Washington 

SHANNON MCGAHN, Staff Director 

JAMES H. CLINGER, Chief Counsel 

(III) 

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS AND CONSUMER CREDIT

SHELLEY MOORE CAPITO, West Virginia, Chairman 

SEAN P. DUFFY, Wisconsin, Vice Chairman 

SPENCER BACHUS, Alabama 

GARY G. MILLER, California 

PATRICK T. MCHENRY, North Carolina 

JOHN CAMPBELL, California 

KEVIN McCARTHY, California 

STEVAN PEARCE, New Mexico 

BILL POSEY, Florida 

MICHAEL G. FITZPATRICK, Pennsylvania 

LYNN A. WESTMORELAND, Georgia 

BLAINE LUETKEMEYER, Missouri 

MARLIN A. STUTZMAN, Indiana 

ROBERT PITTENGER, North Carolina 

ANDY BARR, Kentucky 

TOM COTTON, Arkansas 

GREGORY W. MEEKS, New York, Ranking 

Member 

CAROLYN B. MALONEY, New York 

RUBE ́ N HINOJOSA, Texas 

CAROLYN MCCARTHY, New York 

DAVID SCOTT, Georgia 

AL GREEN, Texas 

KEITH ELLISON, Minnesota 

NYDIA M. VELA ́ ZQUEZ, New York 

STEPHEN F. LYNCH, Massachusetts 

MICHAEL E. CAPUANO, Massachusetts 

PATRICK MURPHY, Florida 

JOHN K. DELANEY, Maryland 

DENNY HECK, Washington 

(V) 

C O N T E N T S 

Page 

Hearing held on: 

March 5, 2014 ................................................................................................... 1 

Appendix: 

March 5, 2014 ................................................................................................... 51 

WITNESSES 

WEDNESDAY, MARCH 5, 2014 

Fortney, David, Senior Vice President, Product Management and Development, The Clearing House Payments Company ................................................ 38 

Garcia, Gregory T., Advisor, Financial Services Information Sharing and 

Analysis Center (FS–ISAC) ................................................................................. 36 

Leach, Troy, Chief Technology Officer, Payment Card Industry (PCI) Security 

Standards Council (SSC) ..................................................................................... 34 

Mierzwinski, Edmund, Consumer Program Director, U.S. PIRG ........................ 39 

Noonan, William, Deputy Special Agent in Charge, Criminal Investigative 

Division, Cyber Operations Branch, United States Secret Service .................. 7 

Zelvin, Larry, Director, National Cybersecurity and Communications Integration Center (NCCIC), U.S. Department of Homeland Security ........................ 9 

APPENDIX 

Prepared statements: 

Waters, Hon. Maxine ........................................................................................ 52 

Fortney, David .................................................................................................. 54 

Garcia, Gregory T. ............................................................................................ 57 

Leach, Troy ....................................................................................................... 67 

Mierzwinski, Edmund ...................................................................................... 73 

Noonan, William ............................................................................................... 84 

Zelvin, Larry ..................................................................................................... 95 

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

Capito, Hon. Shelley Moore: 

Written statement of the American Bankers Association (ABA) ................. 101 

Written statement of the Credit Union National Association (CUNA) ........ 111 

Written statement of the Independent Community Bankers of America 

(ICBA) ............................................................................................................ 116 

Written statement of the National Association of Federal Credit Unions 

(NAFCU) ........................................................................................................ 118 

Written statement of the National Retail Federation (NRF) ........................ 122 

Heck, Hon. Denny: 

Letter to Financial Services Committee Chairman Jeb Hensarling requesting a data security hearing, dated January 10, 2014 ....................... 136 

Sinema, Hon. Kyrsten: 

Written responses to questions submitted to Larry Zelvin ........................... 138 

(1) 

DATA SECURITY: EXAMINING EFFORTS 

TO PROTECT AMERICANS’ 

FINANCIAL INFORMATION 

Wednesday, March 5, 2014 

U.S. HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS

AND CONSUMER CREDIT, 

COMMITTEE ON FINANCIAL SERVICES, 

Washington, D.C. 

The subcommittee met, pursuant to notice, at 10:03 a.m., in room 

2128, Rayburn House Office Building, Hon. Shelley Moore Capito 

[chairwoman of the subcommittee] presiding. 

Members present: Representatives Capito, Bachus, McHenry, 

Pearce, Posey, Fitzpatrick, Luetkemeyer, Stutzman, Pittenger, 

Barr, Cotton, Rothfus; Meeks, Maloney, Scott, Green, Lynch, 

Delaney, and Heck. 

Ex officio present: Representatives Hensarling and Waters. 

Also present: Representatives Royce and Sinema. 

Chairwoman CAPITO. The subcommittee will come to order. Without objection, the Chair is authorized to declare a recess of the subcommittee at any time. 

I now recognize myself for the purpose of making an opening 

statement. 

Over the last 6 months, we have learned about a series of 

breaches of American businesses’ data—millions and millions have 

had their personal data compromised. We will not know the true 

extent of the impact on American consumers until investigators 

from Federal agencies and private entities are done with the investigation. 

These breaches raise, I believe, really legitimate questions about 

the storage and usage of personal data by private industry. The 

prosperous have long sought access to this type of information, but 

the recent breaches demonstrated an evolving sophistication of attacks that seek to exploit and confuse consumers. 

As we have learned in previous subcommittee hearings, these 

criminals often reside in nations that fail to cooperate with United 

States law enforcement agencies. In some cases, these nations not 

only protect these criminals from prosecution but they celebrate 

them as heros. 

The data these criminals steal is often sold on the black market 

and can potentially be used for fraudulent purposes. While possibilities for such fraudulent charges may be the source of stress and 

2 

frustration for consumers, many payment networks have zero fraud 

policies to protect consumers from fraudulent transactions. 

Today, we will learn more about why these breaches are occurring, existing payment security standards, what happens during 

and after a breach, and new payment technologies authorized to 

help prevent future breaches. 

One area that is of critical importance is information-sharing, 

both during and after a breach. 

We have representatives from the National Cybersecurity and 

Communications Integration Center (NCCIC) and the Financial 

Services Information Sharing and Analysis Center (FS-ISAC) who 

will testify about the existing information-sharing efforts between 

the private sector and government agencies. On February 13th, 

members of the retail financial services communities publicly announced their efforts at information-sharing amongst all parties 

that are a part of the payment system. I applaud this effort instructing all parties to strive for a more efficient, thorough, and effective information-sharing system to prevent data breaches in the 

future. 

The final area that this hearing will cover is future payment systems that may provide consumers with a more secure method of 

transmitting their financial data. I have great interest in the progression and diversification of our payment system. In the past, we 

learned about developments in mobile payments. Today, we will 

learn about a cloud-based tokenization proposal which will transfer 

payments without the need to store significant amounts of consumer financial data. 

If sensitive payment data is not being stored unnecessarily, the 

payment systems could be much less attractive to future hackers. 

The high degree of innovation in the payment space is exciting for 

consumers, but we also need to ensure that the new payment systems that are developed increase the level of security and reduce 

the threat of future breaches. 

I would like to thank our witnesses for joining us this morning. 

Each of you plays a critical role in helping to prevent future data 

breaches. 

I now yield time to the ranking member of the subcommittee, 

Mr. Meeks, for an opening statement. 

Mr. MEEKS. Thank you, Madam Chairwoman. 

In recent months, a number of banking and U.S. retailers including Target, Neiman Marcus, and Nike have announced data 

breaches which stole the payment card account and sensitive personal information of millions of Americans. Although forensic investigations of recent breaches are still ongoing, news reports and 

announcements by the retailers themselves indicate that these 

breaches may be the largest breaches ever in the history of our 

country as of today. 

On December 19, 2013, Target announced that 40 million credit 

and debit accounts had been compromised through its in-store credit card magnetic strips, allowing hackers to access customer names, 

credit and debit card numbers, and security codes. Less than a 

month later, on January 10, 2014, Target announced that the 

breach was significantly larger and that the personal information 

of 70 million customers was also stolen. 

3 

Americans need to have the security that when they shop at a 

retail store, or when they use their credit or their debit cards, their 

account and personal information will be protected. We must make 

sure that happens. 

It is further troubling that we see the line fall behind Europe 

and Canada in terms of technology and security standards. Some 

reports even indicate that we are behind certain countries in Latin 

America and Africa, who are using the latest mobile technology for 

processing payments, as a result of the fact that they started late 

in adopting such technology, and therefore immediately adopted 

the latest innovations. 

We have to improve our technology to make sure that we are 

more up-to-date. We need to take our security more seriously in 

this country. The security breaches at Target were only reminders 

of existing national security issues, and there are, indeed, a lot of 

issues which we will seek to clarify in our hearing. How is it that 

this could happen in the world’s most advanced economy and financial market in the world? 

What have we learned, and how do we prevent these serious incidents from ever happening again? And what technologies and 

standards need to be adopted instead so that we can protect Americans and the Nation? 

I want to thank all of the witnesses who are here, and I look forward to your participation and to listening to your testimony. 

Chairwoman CAPITO. Thank you. 

I now recognize Mr. Fitzpatrick for 2 minutes for an opening 

statement. 

Mr. FITZPATRICK. Thank you, Madam Chairwoman, for calling 

this hearing, and I also thank the witnesses for their time today. 

I spend a considerable amount of time at home—as do my colleagues—visiting my discrict, visiting with businesses and financial 

instutions, and also talking to their customers. Most if not all of 

these groups, when asked, would identify cybersecurity, identity 

theft, and national safety as a concern. 

My staff and I spent some time looking into this and quickly 

learned that hackers and thieves are by and large not only attacking financial institutions directly and literally downloading customers’ back accounts to either deceive people into giving up their 

security information or they are stealing outright from some other 

source. Those sources are many times unsuspecting businesses or 

financial institutions that are storing or transferring personal information in ways that are quite vulnerable to attack. 

That is not to say that the burden of data security lies disproportionately with any one group, but I think these facts speak to the 

importance of working in a collaborative manner on developing a 

system that protects personal financial data through the process— 

from the individual, to the business, to the processor, and then to 

the bank or credit union. 

There is a level of trust necessary for an economy to function in 

this new virtual era, where cash is becoming a preferred payment 

method for fewer and fewer people. I look forward to the testimony 

and hearing what these experts can share with us about how we 

can protect people from theft and maintain and possibly restore 

trust in our cybersecurity system. 

4 

And I thank the Chair. 

Chairwoman CAPITO. Thank you. 

I now recognize Mrs. Maloney for 2 minutes for an opening statement. 

Mrs. MALONEY. I want to thank you, Madam Chairlady, and 

Ranking Member Meeks, for holding this incredibly important 

hearing. I would say that most Americans have had their identity 

stolen, including myself, and it is very costly to law enforcement, 

and certainly to our stakeholders, our financial institutions, and individuals. 

And I am particularly interested in the second panel, the industry itself, and what they have to say on new technologies. Why 

can’t we just protect the number and have transactions take place? 

This is something really, really important: When the data breach 

occurs, the party who is most exposed when you look at it is the 

consumer. It is typically the retailer that is in the best position to 

know about the breach, although it is often the bank who discovers 

the breach before the retailer because the bank notices a spike in 

fraudulent transactions and then traces it back to the retailer that 

was breached. 

In my opinion, this makes it all much more reasonable to make 

the banks and financial institutions liable for all the fraudulent 

transactions that occur after the breach. This would give the banks 

and financial institutions an incentive to invest publicly in frauddetecting technologies, which are remarkably effective at identifying fraudulent activities on your credit or debit card. 

If retailers were liable for all fraudulent costs after a breach, 

then there would be probably like a legal Fort Knox. And if payment networks were liable, there would be more robust security 

systems, as well. The point is that sometimes assigning blame, and 

in this case, assigning liablitity, is, in fact, important, because it 

incentivizes different parties to invest or not invest in fraud-reducing technology to protect consumers and our overall economy and 

it makes it more difficult for criminals. 

So I really look forward to this hearing. I think it is incredibly 

important and I look forward to hearing of new innovations to protect identity and therefore, hopefully, our banking system. 

Thank you very much. I yield back. 

Chairwoman CAPITO. Thank you. 

I recognize Mr. Pittenger for 2 minutes for an opening statement. 

Mr. PITTENGER. Thank you, Chairwoman Capito, for allowing me 

to properly make this opening statement. 

And thank you to each of the witnesses for coming today to testify. 

We are here today to listen to experts from Homeland Security 

and the Secret Service and representatives of industry to learn 

about the ongoing effort to protect our fellow citizens’ private information. We have seen over the past several years advancements in 

technology when Americans shop to pay for goods. 

But with these new advancements certainly comes the responsibility of protecting the integrity of the system. As payment systems 

increasingly rely on electronic transmissions of personal financial 

data, Americans have a right and an expectation to know how that 

data is being protected, where it is stored, the extent to which the 

5 

government has access to it, and the protocols that ought to be in 

place in private or public sector entities who mishandle, improperly 

disclose, or otherwise fail to ensure the security of personal financial information. 

Over the last 6 months, several American companies and universities have experienced significant data breaches—my wife and I 

had a breach just yesterday—and while the details of these 

breaches remain under investigation by Federal and State law enforcement authorities, these episodes have disclosed a serious 

threat to financial privacy and data security posed by individuals 

and criminal syndicates. 

We have to remain vigilant in our fight against these individuals 

and organizations. I know it is a difficult task to ask to be prepared 

to prevent 100 percent of the cyber attacks. But the consequences 

of not being equipped to handle the threat could ruin the lives and 

threaten the security of millions of Americans. 

Thank you again for coming before the committee, and I look forward to hearing your testimony. 

Chairwoman CAPITO. Thank you. 

I would like to recognize Mr. Scott for 2 minutes for an opening 

statement. 

Mr. SCOTT. Thank you very much, Madam Chairwoman. And 

this is indeed a very, very interesting and important hearing as 

more and more Americans shift to electronic payment systems and 

online shopping. 

One of my professors at graduate school in economics and finance 

was an economist, John Kenneth Galbraith, and he produced a 

book about 40 years ago called, ‘‘The New Industrial State.’’ I bring 

that up because he made a very interesting statement. He said, 

‘‘Very shortly we in our country, and perhaps around the world, 

will soon become the victims and servants of the very machine that 

was created to serve us.’’ 

I think we are at that point now. As payment systems increasingly rely on electronic transmission of personal financial data, 

Americans certainly have a right and an expectation to know how 

that data is protected. They need to know where it is stored, who 

has access to that data, and to what extent. 

Americans have a right and an expectation to know the protocols 

that are and ought to be in place when entities, whether public or 

private, mishandle or improperly disclose or otherwise fail to ensure the security of their personal information. 

We have the big picture here. We have to hold everybody accountable. Financial institutions must be held accountable to the 

same accountability as our retailers. 

We have had over 110 million Americans impacted by this situation. Earlier, I had a very interesting conversation with one of our 

panelists, Mr. Troy Leach, and I think he is on to something here 

with the Security Standards Council. Perhaps we are indeed working on this, giving too much information, making too much information available, and that maybe we can cut down on some of that 

information so we don’t make it so easy for hackers to access it. 

I look forward to the hearing, Madam Chairwoman, and I yield 

back. 

Chairwoman CAPITO. Thank you. 

6 

I now recognize the chairman emeritus of the full Financial Services Committee, Mr. Bachus, for 2 minutes for an opening statement. 

Mr. BACHUS. Thank you, Madam Chairwoman. 

One of Yogi Berra’s most famous quotes is, ‘‘It is deja vu all over 

again.’’ A little more than a decade ago, this committee investigated a series of data breaches involving New York City restaurants, cable companies, retail businesses of all kinds, banks, 

universities, and all branches of government from local to State to 

Federal. People’s credit was being ruined, and their good names 

being used for criminal purposes. But identity theft suddenly became a national issue. 

I remember this because I was chairman of the Financial Institutions Subcommittee at the time. I am proud of this committee because at the time, we held numerous hearings like the one today, 

that resulted in the Fair and Accurate Credit Transactions (FACT) 

Act or (FACTA), which was bipartisan legislation passed almost 

unanimously by this committee and signed into law by President 

Bush in December 2003. 

The legislation created a number of protections, which I am convinced have helped prevent numerous cases of identity theft over 

the last 10 years. That is why your full credit card number is no 

longer on store or restaurant receipts, and you can place fraud 

alerts on your credit report. Very significantly, it is why consumers 

are entitled to be provided with free copies of their credit report 

from the three major reporting bureaus. 

But I am having deja vu again because the same arguments that 

were being used then are being used again today against the adoption of marked chip and PIN cards. It won’t be a total solution, and 

it wouldn’t have prevented the Target breach, but it would prevent 

that information from then being used in credit transactions. 

It wouldn’t be a total solution. It wouldn’t be easy. It would be 

complicated. It would be expensive. All of that is true. It was then, 

and it is now. But still, something needs to be done. 

Let me close by saying, Mr. Noonan, you mentioned the National 

Computer Forensic Institute, and I want to compliment the Secret 

Service. They joined with the Alabama district attorney’s office in 

the State of Alabama, Shelby County, and responded with that, 

and it has really helped, and I want to commend the Secret Service 

for that. 

That building that it is housed in was donated by a county and 

a city in Birmingham—a modern facility at no cost to the taxpayers. And it is a way that we can inexpensively respond with innovative thinking. The people being trained there—it is in his testimony on page 8, and I commend you for mentioning that. 

Thank you. 

Chairwoman CAPITO. Thank you. 

With that, I ask unanimous consent to allow members of the full 

Financial Services Committee who are not members of this subcommittee to sit in on today’s hearing. Without objection, it is so 

ordered. 

And with that, I would like to recognize Ms. Sinema for 1 minute 

for an opening statement. 

Ms. SINEMA. Thank you, Madam Chairwoman. 

7 

And thank you, Ranking Member Meeks. 

I believe that it is critical for public and private sector leaders 

to continue to push for the development of a strong cybersecurity 

industry that can protect our economic and national security interests. The nature of cyber means that nongovernment institutions 

and private sector companies alike need tools and resources to protect Americans’ personal information from cyber attacks. 

Several large companies such as Honeywell, Schwab, and America’s Best have some or all of their security space in Arizona; and 

several smaller innovative companies like Bishop Fox and 

Securosis are among the significant and growing number of cybersecurity businesses in my home State. 

Arizona is a hub for innovation. We are ahead of the curve on 

tech growth, thanks to entrepreneurial programs at Arizona State 

University, the University of Advancing Technology, and America’s 

community colleges. 

Thank you for the opportunity to highlight this critically important issue. Through your collaboration with government and innovative private institutions, I believe we can meet the cybersecurity 

challenges of today and tomorrow. 

Thank you, Madam Chairwoman. 

Chairwoman CAPITO. Thank you. 

Mr. Green, for 2 minutes. 

Mr. GREEN. Thank you, Madam Chairwoman. I will be pithy and 

concise. I would like to thank you for the hearing, and thank the 

ranking member, as well. 

And I would like to, if I may, indicate to the public that while 

a hearing is titled, ‘‘Data Security: Examining Efforts to Protect 

Americans’ Financial Information,’’ the actual concern is much 

broader and much bigger. We are also concerned about medical information. We are also concerned about your travel history. We are 

concerned about the materials that you purchase—your reading 

materials. 

This has implications that are far-reaching, that can have an impact on privacy beyond which we can’t imagine currently. I am excited about the hearing and I am interested to find out how we can 

prevent this kind of encroachment on privacy. 

I thank you, and I yield back. 

Chairwoman CAPITO. The gentleman yields back. 

All time has expired for opening statements, and I would like to 

welcome our first panel of distinguished witnesses. Each of you will 

be recognized for 5 minutes to give an oral presentation of your testimony. And without objection, each of your written statements will 

be made a part of the record. 

Our first witness is Mr. William Noonan, Deputy Special Agent 

in Charge, Criminal Investigative Division, Cyber Operations 

Branch, United States Secret Service. 

Welcome, Mr. Noonan. 

STATEMENT OF WILLIAM NOONAN, DEPUTY SPECIAL AGENT 

IN CHARGE, CRIMINAL INVESTIGATIVE DIVISION, CYBER OPERATIONS BRANCH, UNITED STATES SECRET SERVICE 

Mr. NOONAN. Good morning, Chairwoman Capito, Ranking Member Meeks, and distinguished members of the subcommittee. Thank 

8 

you for the opportunity to testify on behalf of the Department of 

Homeland Security regarding the ongoing trend of criminals exploiting cyberspace to obtain sensitive financial and identity information as part of a complex criminal scheme to defraud our Nation’s payment systems. 

Our modern financial system depends heavily on information 

technology for convenience and efficiency. Accordingly, criminals 

motivated by greed have adapted their methods and are increasingly using cyberspace to exploit our Nation’s financial payment 

systems to engage in fraud and other illicit activities. 

The widely reported payment card data breaches of Target, 

Neiman Marcus, White Lodging, and other retailers are just recent 

examples of this trend. The Secret Service is investigating these recent data breaches and we are confident we will bring the criminals responsible to justice. 

However, data breaches like these recent events are part of a 

long trend. In 1984, Congress recognized the risk posed by increasing use of information technology and established 18 USC Sections 

1029 and 1030 through the Comprehensive Crime Control Act. 

These statutes define access device fraud and misuse of computers 

as Federal crimes and explicitly assign the Secret Service authority 

to investigate these crimes. 

In support of the Department of Homeland Security’s mission to 

safeguard cyberspace, the Secret Service has developed a unique 

record of success in investigating cyber crime through the efforts 

of our highly trained special agents and the work of our growing 

network of 35 electronic crimes task forces, which Congress assigned the mission of preventing, detecting, and investigating various forms of electronic crimes, including potential terrorist attacks 

against critical infrastructure and financial payment systems. 

As a result of our cyber crime investigations, over the past 4 

years the Secret Service has arrested nearly 5,000 cyber criminals. 

In total, these criminals were responsible for over $1 billion in 

fraud losses, and we estimate our investigations prevented over 

$11 billion in fraud losses. 

Data breaches like the recently reported occurrences are just one 

part of a complex criminal scheme executed by organized cyber 

crime. These criminal groups are using increasingly sophisticated 

technology to conduct a criminal conspiracy consisting of five parts: 

one, gaining unauthorized access to computer systems carrying valuable, protected information; two, deploying specialized malware to 

capture and exfiltrate this data; three, distributing or selling this 

sensitive data to their criminal associates; four, engaging in sophisticated and distributed frauds using the sensitive information obtained; and five, laundering the proceeds of their illicit activity. 

All five of these activities are criminal violations in and of themselves, and when conducted by sophisticated, transnational networks of cyber criminals, this scheme has yielded hundreds of millions of dollars in illicit proceeds. 

The Secret Service is committed to protecting our Nation from 

this threat. We disrupt every step of their five-part criminal 

scheme through proactive criminal investigations and defeat these 

transnational cyber criminals through coordinated arrests and seizure of assets. 

9 

Foundational to these efforts are our private industry partners as 

well as our close partnerships with State, local, Federal, and international law enforcement. As a result of these partnerships, we 

were able to prevent many cyber crimes, by sharing criminal intelligence regarding the plans of cyber criminals and by working with 

the victim companies and financial institutions to minimize financial losses. 

Through our Department’s National Cybersecurity and Communications Integration Center, the NCCIC, the Secret Service also 

quickly shares technical cybersecurity information while protecting 

civil rights and civil liberties in order to enable other organizations 

to reduce their cyber risks by mitigating technical vulnerabilities. 

We also partner with the private sector and academia to research 

cyber threats and public information on cyber crime trends through 

reports like the Carnegie Mellon CERT Insider Threat Study, the 

Verizon Data Breach Investigations Report, and the Trustwave 

Global Security Report. 

The Secret Service has a long history of protecting our Nation’s 

financial systems from threats. In 1865, the threat we were founded to address was that of counterfeit currency. As our financial 

payment system has evolved from paper, to plastic, and now digital 

information, so too has the investigative mission. 

The Secret Service is committed to continuing to protect our Nation’s financial system even as criminals increasingly exploit it 

through cyberspace. Through the dedicated efforts of our special 

agents, our electronic crimes task forces, and by working in close 

partnership with the Department of Justice—in particular, the 

computer crimes and intellectual property section—and local U.S. 

attorneys’ offices, the Secret Service will continue to bring cyber 

criminals who perpetrate major data breaches to justice. 

Thank you for the opportunity to testify on this important topic, 

and we look forward to your questions. 

[The prepared statement of Deputy Special Agent in Charge 

Noonan can be found on page 84 of the appendix.] 

Chairwoman CAPITO. Thank you. 

Mr. Zelvin, you are recognized for 5 minutes. 

STATEMENT OF LARRY ZELVIN, DIRECTOR, NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER 

(NCCIC), U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. ZELVIN. Chairwoman Capito, Ranking Member Meeks, and 

distinguished members of the subcommittee, thank you for the opportunity to appear before you today. In my brief opening comments, I would like to highlight the DHS National Cybersecurity 

and Communications Integration Center (NCCIC’s) role in preventing, responding to, and mitigating cyber incidents, and then 

discuss our activities during the recent point-of-sale compromises. 

As you well know, the Nation’s economic vitality and national security depend on a secure cyberspace where reasonable risk decisions can be made on digital goods, transactions, and online interactions so that they can occur safely and reliably. 

In order to meet this objective, we must share the technical characteristics of malicious cyber activity in a timely fashion so cyber 

defenders can discover, address, and mitigate information techVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
10 

nology threats and vulnerabilities. It is increasingly clear that no 

single country, agency, company, or individual can effectively respond to the ever-rising threats of malicious cyber activity alone. 

Effective responses require a whole-of-nation effort, including 

close coordination among entities like: DHS’s NCCIC; the Secret 

Service; the Department of Justice, to include the Federal Bureau 

of Investigation; the intelligence community; sector-specific agencies, such as the Department of the Treasury; private sector entities, who are simply critical to these efforts; and State, local, tribal, 

territorial, and international governments. In carrying out our particular responsibilities, the NCCIC promotes and implements a unified approach to cybersecurity, which enables the efforts of bringing 

these diverse partners to quickly share cybersecurity information 

in a manner that ensures the protection of individuals’ privacy, 

civil rights, and civil liberties. 

As you may already know, the NCCIC is a civilian organization 

that provides an around-the-clock center where key government, 

private sector, and international partners can work together in 

both physical and virtual environments. The NCCIC is composed of 

four branches: the United States Computer Emergency Readiness 

Team, or US-CERT; the Industrial Control Systems CERT; the National Coordination Center for Communications; and Ops and Integration. 

In response to the recent retailer compromises, the NCCIC specifically leveraged the resources and capabilities of US-CERT, 

whose mission focuses specifically on computer network defense, including prevention, protection, mitigation, and response activities. 

In executing this mission, the NCCIC and US-CERT regularly publish technical and nontechnical information products analyzing the 

characteristics of malicious cyber activities and improving the ability of organizations and individuals to reduce risk. 

When appropriate, all NCCIC components have onsite response 

teams that can assist owners and operators at their facilities. In 

addition, US-CERT has global partnerships with over 200 CERTs 

worldwide that allow the teams to work directly with analysts 

across international borders. 

Increasingly, data from the NCCIC and US-CERT can be shared 

in machine-readable formats, such as the Structured Threat Information Expression, also known as STIX, which is currently being 

implemented and utilized. 

In the recent point-of-sale compromises NCCIC/US-CERT analyzed the malware provided to us by the Secret Service as well as 

other relevant technical data and used these findings, in part, to 

create a number of information-sharing products. The first, which 

is publicly available and can be found on the US-CERT Web site, 

provides a nontechnical overview of risks to point-of-sale systems 

along with recommendations on how businesses and individuals 

can better protect themselves and mitigate their losses in the event 

of an incident that has already occurred. Other products have been 

more limited in distribution and they are meant for cybersecurity 

professionals and provide technical analysis and mitigation recommendations to better enable expert-level protection, discovery, 

response, and recovery efforts. 

11 

As a matter of strategic intent, the NCCIC’s goal is always to 

share information as broadly as possible. These efforts ensured 

that actionable details associated with major cyber events are 

shared with the right partners so they can protect themselves, 

their families, their businesses and organizations quickly and accurately. 

In the case of the point-of-sale compromises, we especially benefited from the close coordination with the Financial Services Information Sharing and Analysis Center, or the FS-ISAC. In particular, the FS-ISAC’s Payments Processing Information Sharing 

Council has been useful in that they provide a forum for sharing 

information about fraud, threats, vulnerabilities, and risk mitigation in the payments industry. 

In conclusion, I want to highlight again that we in DHS and 

across the NCCIC strive every day to enhance the security and resilience across cyberspace and information technology enterprise. 

At every opportunity the NCCIC, in close coordination with our 

partners, publishes technical and nontechnical products to better 

enable our national critical infrastructure, businesses, and our citizens to protect against cyber threats, while also providing onsite 

technical assistance whenever necessary. 

We will accomplish our mission through voluntary means, ever 

mindful of the need to respect privacy, civil liberties, and the law. 

I truly appreciate the opportunity to speak with you today and look 

forward to your questions. 

[The prepared statement of Mr. Zelvin can be found on page 95 

of the appendix.] 

Chairwoman CAPITO. Thank you. 

And I am offering my sincere apologies to you, as the first panel, 

and to the next panel, and to the members of this subcommittee, 

but we are going to call a recess subject to the call of the Chair. 

We expect it to be a half hour, so that would be 11:05; hopefully, 

we can call back in sooner. 

Again, I apologize. 

[recess] 

Chairwoman CAPITO. I am going to go ahead and reconvene the 

hearing. Thank you for your patience. 

Mr. Meeks will be here in a few minutes, but I am going to go 

ahead and begin my questioning so we can move along a little bit. 

Mr. Noonan, in your statement you mentioned that the Secret 

Service had either arrested or gotten 5,000 criminals. Was that the 

number that you used? 

Mr. NOONAN. Yes, ma’am. 

Chairwoman CAPITO. Those, I assume, are all American citizens 

in the United States? Because we hear about how a lot of this is 

occurring offshore. Are you coordinating in any international fashion, or—if you could just kind of give me a little background on 

that? 

Mr. NOONAN. Sure, ma’am. That figure comprises all of the cases 

that we have made arrests on that have any connection back to the 

use of cyber in those crimes. 

So to say that they are domestic or international, it is both. 

Chairwoman CAPITO. It is both. 

12 

Mr. NOONAN. Yes. We have a very unique success of bringing 

international, transnational cyber criminals to justice here domestically, but that figure that we have provided for you there is domestic and international. 

Chairwoman CAPITO. Okay. 

Mr. Zelvin, you are from Homeland Security, and Mr. Noonan is 

with the Secret Service. I think sometimes we find that when there 

is coordination between Federal agencies, who is in charge, I guess 

is always a good question. I know it is a collaborative effort, but 

who is really leading this in your mind, from your agency’s perspective? 

Mr. ZELVIN. Yes, ma’am. It is a team effort so there is a variety, 

depending on which area you are looking at. As you are looking at 

the law enforcement aspect, the Secret Service and the Federal Bureau of Investigation have the primacy, depending on the cyber 

case. When you look at the intelligence field, obviously the National 

Security Agency, the Central Intelligence Agency, and others have 

primacy, whether you are talking about electronics intelligence or 

human intelligence. 

We at the NCCIC specifically really focus on those network defense measures—understanding the intrusions, understanding how 

to plug those holes, and then preventing them from reoccurring. 

We have the responsibility, as well, of protecting the Federal dotgov space, and that is a big part of our effort, and then we work 

across the private sector at 16 critical infrastructures, and as I 

mentioned in my opening statement, the international partnerships. 

Chairwoman CAPITO. Mr. Noonan, would you concur with Mr. 

Zelvin in terms of who is in charge or the coordinative aspect of 

what you are doing? I know we talk a lot about coordination, and 

both of you did in your statements, but I am trying to make sure 

that if Mr. Meeks and I say we are both in charge, but then something goes wrong, and I say, ‘‘But he was in charge,’’ so— 

Mr. NOONAN. Yes, for sure. In an investigation like this law enforcement generally takes charge of the investigative piece— 

Chairwoman CAPITO. Right. 

Mr. NOONAN. —and information-sharing we do through a bunch 

of different mechanisms. Our primary source for information-sharing is through the NCCIC, but we also partner, as well, with the 

FS-ISAC. Obviously, the Secret Service has a rich history of working in the financial services sector. 

Chairwoman CAPITO. Right. 

Mr. NOONAN. So the FS-ISAC, who is going to be on the next 

panel, is another great partner that we use to push information out 

to the financial services sector. 

In addition to that, we have 35 electronic crimes task forces. And 

those electronic crimes task forces that we have aren’t just made 

up of law enforcement; they are made up of the private sector, so 

we have members from the private sector working side by side with 

agents, where we share information back and forth, as well as academia. So that is another method that the Secret Service uses to 

push information that is going to better protect the private industry and the critical infrastructure that we have. 

13 

Chairwoman CAPITO. When there is a data breach from a retailer, say, such as what happened with Target—and I know the 

investigation is ongoing so not specifically that, I am just using it 

as an example—is the way that you are made aware of this 

through individuals whose cards have been corrupted, or does the 

company itself, whatever company it is, is it incumbent upon them 

to come to you? How does that reach your level of understanding 

of what is going on? 

Mr. NOONAN. It depends on the case, ma’am. I brought up in my 

oral remarks that we have a proactive approach to law enforcement. And there is a reactive approach, in which the crime has already occurred, and we are chasing the clues back to the criminal 

to identify who the criminal is to affect an arrest. 

Chairwoman CAPITO. Right. 

Mr. NOONAN. The proactive approach of what we do in law enforcement is we are out working with sources, we are out working 

undercover operations, we are working with private sector banking 

investigators, and in our proactive approach there are many times 

where we identify a potential breach before it has occurred. And we 

find that it is more valuable—it is critical for law enforcement, 

then, to make notification to that industry, to that private sector 

partner, to be able to stop the crime from occurring. 

Chairwoman CAPITO. Okay. Let me stop you there because I am 

running out of time, but I am curious to know, in the case of a retailer where this could have an effect on their future sales, do you 

find that they are willing to make this breach public and really better inform everybody who could be affected by such a breach? 

Mr. NOONAN. Again, it depends on the company— 

Chairwoman CAPITO. Right. 

Mr. NOONAN. —and it depends on the case, so— 

Chairwoman CAPITO. Yes. 

Mr. NOONAN. —I can’t give you a yes-or-no answer. 

Chairwoman CAPITO. Right. You can see both sides of it. I would 

think more and more it is in the company’s best interest, obviously, 

to be as open and transparent as possible in something of this nature. 

Mr. Meeks? 

Mr. MEEKS. Thank you, Madam Chairwoman. 

Let me start with Mr. Noonan, and let me maybe ask a question 

that might not even be fair because I am going to ask you how to 

help me do my job. You urge Congress to take legislative action 

that could help to improve the Nation’s cybersecurity, reduce regulatory costs on U.S. companies, and strengthen law enforcement’s 

ability to conduct effective investigations. I think that was part of 

your testimony. 

And, I am sure that all parties agree with this in general, when 

you make the general assessment, but there are differing, at times, 

interests, and sometimes even competing interests that individuals 

would have. For example, there may be different interests between 

card issuers, merchants, and consumers. They can all overlap, but 

ultimately there could be divergent visions of how the government 

can best solve these problems. 

So, we are going to be trying to dig into this and talking to a 

number of different folks, but I would like to get your opinion. How 

14 

would you suggest as lawmakers we balance these interests and 

create a plan that can satisfy the core concerns of all parties? Because we have this balancing act that we have to do but we need 

to—we want to help you also, so how would you suggest we do 

that? 

Mr. NOONAN. Yes, sir. So from the law enforcement perspective— 

and that is what I can provide to you—I think it is important and 

it is critical for companies that have been exposed, companies that 

have knowledge of a potential breach, to bring that to law enforcement’s attention. Law enforcement, at that point, is critical in the 

fact that it can, obviously, collect evidence to try to make a difference, make a physical arrest of a criminal. But I think it is also 

important that at that point in time, is when the information-sharing piece begins. Because if law enforcement is brought in early 

and we are able to draw the cybersecurity concerns out of the investigation, the evidence out of that, and we are able to take that 

information, we are able to minimize that information and protect 

the victim. We are able to then share that information with my 

partners over at the NCCIC and get that out to the greater infrastructure of this Nation so that they can better protect themselves 

from an additional potential attack to other pieces or other avenues 

of infrastructure. 

Mr. MEEKS. Should the notification that goes out to you, go out 

to the consumer or the customer at the same time? For example, 

I was just wondering how long do most companies wait before they 

even notify you and/or notify the customer that their sensitive personal information may have been breached. 

Mr. NOONAN. I would agree, sir. I think that it should be in a 

short period of time that the information should be put out to the 

customers. I, too, fell victim to a data breach as well, where it was 

inconvenient for myself and my family. So I think I am able to better respond as a customer to help support my family, but I think 

there is also a law enforcement concern there, as well, where there 

are situations and there are points in time wherein law enforcement may or may not need a window of opportunity to run operations to determine what has happened or who is behind the effort 

or the attack. 

Mr. MEEKS. Let me just also, in that regard, ask Mr. Zelvin a 

question. I know in your testimony you also talked about the various virtual currencies as a means of laundering illicit proceeds, 

and I was wondering whether or not the Secret Service or other 

regulators have taken any action to address some of those concerns? And in your view, do regulators have—do you have sufficient authority to address the risk that these currencies pose as 

identified in your testimony? 

Mr. NOONAN. Yes, sir. Just as early as last year the Secret Service, along with HSI and IRS, was successful in taking down a virtual currency or a digital currency called Liberty Reserve. Liberty 

Reserve was one of those digital currencies which the criminal underground used in which they would launder their money anonymously, and we were effective in taking that marketplace out of the 

criminal underground, as well as we were able and successful in 

arresting the people who were behind the setup of that operation. 

15 

So it is more important than just taking the operation off, but we 

also arrested the people behind it. 

Mr. MEEKS. Thank you. 

Really quick, Mr. Zelvin, what about individual criminal activity 

outside of the United States? What can be done to go after these 

illicit actors? And what tools do you have to ensure that foreign individuals are also held accountable? Does that fit within our— 

Mr. ZELVIN. Ranking Member Meeks, that is a question I would 

recommend for the FBI and the Secret Service—I will talk from the 

US-CERT perspective. We work with 200 like-minded CERTs 

around the world. We are in contact with them in many cases on 

a weekly basis and we are able to work our mitigations. I was in 

London about 3 weeks ago, and when we were meeting with our 

counterparts, they said the point-of-sale product that we had from 

US-CERT was very helpful to them because they were bringing it 

to their industries, because what had happened here in the United 

States they felt was probably happening in the U.K. and around 

Europe, and this was instructive for them, as well. 

Mr. MEEKS. Thank you. 

Chairwoman CAPITO. Thank you. 

Mr. Pearce? 

Mr. PEARCE. Thank you, Madam Chairwoman. 

I appreciate both of the witnesses being here. Mr. Rothfus and 

I have decided we are going to cut up our cards right here among 

us while we are listening to you, so if you have any scissors, pass 

them on up. 

Mr. Zelvin, has the CFPB called you all? Are you all working 

with them in any way? 

Mr. ZELVIN. Congressman, the CFPB? 

Mr. PEARCE. Yes. 

Mr. ZELVIN. The Consumer Financial Protection Bureau? 

Mr. PEARCE. Yes. 

Mr. ZELVIN. No, we haven’t been in contact with them directly. 

Mr. PEARCE. Mr. Noonan? 

Mr. NOONAN. No, sir. 

Mr. PEARCE. No. They are collecting 990 million records. Target 

lost 40 million. They are collecting 990 million. It seems like they 

would be calling the Nation’s best to say, ‘‘What do we do for data 

security?’’ Amazing. 

What kind of protection is available against a Snowden-type attack? In other words, he is working inside and pulls those records, 

downloads a three-mile-high stack of records, and is there any protection? 

Either one of you? 

Mr. NOONAN. From the Federal Government standpoint, when 

we are talking about retail-type positions, there is nothing that we 

have that would stop an insider threat. 

Mr. PEARCE. I guess I didn’t make it clear. The CFPB is—would 

be parallel to the NSA. I don’t want to carry that analogy too far, 

but they are a government agency and they are collecting a massive amount of data—massive—almost a billion credit cards. And 

so I guess I am interested in if somebody inside the agency wants 

to release documents, like Mr. Snowden was inside the agency, it 

16 

wasn’t planned, and the agency didn’t approve of it, so is there any 

protection for the Snowden-type attack from inside the agencies? 

Mr. ZELVIN. Congressman, I can answer the question broadly, 

not specifically. So broadly, the insider threat is one of the most 

difficult things we face. I think the one that is probably almost as 

bad is if somebody was into what we call the supply chain. 

The ability to defend against the insider threat is developing 

quickly but we are not where we need to be by a long shot. There 

are things in the financial community which are leading the way 

that we are taking as lessons, but as you rightly point out, it is a 

vulnerability and a weakness that we need to get better on, and 

we need to do so quickly. 

Mr. PEARCE. Okay. 

Mr. Noonan, your testimony had some numbers in it, but I don’t 

know that I saw the scope. In other words, I saw 4,900—that is the 

people that we had—that you have had 4,900 arrests. What is the 

scope? How many cyber attacks are there each day, roughly? 

Mr. NOONAN. I can’t comment on the number of attacks that 

occur every day. 

Mr. PEARCE. Because it is too secret, or you just don’t know? 

Mr. NOONAN. No, we don’t compile our data in that manner. We 

have active investigations, so— 

Mr. PEARCE. What would you guess? Hundreds of thousands a 

day? Is that too high? 

Mr. NOONAN. I think there are cyber criminals who are probing 

our systems every day. I think every moment, they are probing our 

systems. 

Mr. PEARCE. Yes, every day, hundreds of thousands, and I suspect that your agency is probably strained for resources. To put it 

in perspective, in your testimony you talk about the 11 that you 

have indicted; how many convictions have you been able to get 

through the system? 

Mr. NOONAN. Numerous convictions. We have had— 

Mr. PEARCE. Numerous. How many? Like 20,000? 

Mr. NOONAN. No, sir. 

Mr. PEARCE. 22,000? What is numerous? 

Mr. NOONAN. I would say that it is in the range of several hundred a year. 

Mr. PEARCE. Several hundred. In the paragraph right above 

where you are talking about the 11, you are talking about how one 

system has 80,000 users. That is an illicit system—80,000 users 

and we are getting 11. That is absolutely frightening, the scope 

that is coming at us and the system is, again, very difficult to work 

in, with almost no protections against inside attacks where people 

knowingly download and give away information. 

Snowden gave away, again, 1.8 million documents, and I just— 

I worry the CFPB has not even talked to you. Mr. Cordray got 

somewhat offended at the line of questioning and began to rewrite 

the question. I didn’t accuse him of—going to do it, I just said that 

any agency—this information is widely viewable by almost everybody in the agency and widely accessible, and yet they haven’t even 

called the best people in the Nation. 

I would recommend that the next time we have the CFPB come 

in and sit down and talk about the protections, maybe they have 

17 

better operations than these two guys were able to present, but I 

find it stunning that they have not even contacted either one of 

you. 

Thank you. I yield back. 

Mr. LUETKEMEYER [presiding]. Thank you. 

Now, the Chair recognizes the gentlelady from New York, Mrs. 

Maloney. 

Mrs. MALONEY. Thank you so much. And I feel this is an incredible challenge for our country. Just talking to four friends on the 

panel, all four of us have had our identity stolen. The fact that 40 

billion people lost their—40 million, I guess it was, from Target. 

That is staggering. 

So the cost to individuals, law enforcement, and institutions is 

absolutely huge. One of the problems I see is that the reaction time 

is so slow. By the time we put something in place, say the data 

breach chip by 2015, the hackers will have gone on to the next 

stage of how to hack that. 

And it seems to me the next phase is going to be online. Most 

of the transactions are online. So the tokenism idea and technology 

seems the most promising to me. 

When you do find a breach, Mr. Noonan, and you said that you 

are sometimes the first to notice it—who do you notify? Do you notify the financial institution, the consumer, or the retailer, or all 

three? What do you when you notice a breach? What do you do? 

Mr. NOONAN. It depends on who the victim is, ma’am. If it is a 

retailer, we would obviously contact the security department of 

that retailer and we would suggest to them different steps to look 

at their system to be able to determine if, in fact— 

Mrs. MALONEY. Okay. Do you tell them to also notify the bank 

and notify the consumer? Who does— 

Mr. NOONAN. Yes, ma’am. 

Mrs. MALONEY. Okay. 

Mr. NOONAN. So the part we would do is we would have them 

work closely with the financial institutions and the processing system which they use. 

Mrs. MALONEY. Now you also said that—and also retailers have 

said—that the reason that they don’t immediately disclose a data 

breach is that public disclosure would hinder law enforcement efforts to catch the criminal. Is that true? 

Mr. NOONAN. Not in all cases, ma’am. 

Mrs. MALONEY. And why would public disclosure hinder an investigation? 

Mr. NOONAN. Just at a point in time where there was potentially 

an undercover operation, it could hamper the conclusion of that undercover operation. So the time that we are talking is a very small 

window of time. 

Mrs. MALONEY. I believe most public policy and resources are directed when we have good data, so who is keeping the data on how 

big a problem it is in the United States? It is huge in terms of the 

national security and financial security and economic security of 

our country. 

Somebody has to be tracking the overall picture of the extent and 

the depth of it and the techniques. Who is doing that if the CIA 

18 

is not doing it? Who is doing the overall—we have to be collecting 

that data in a broad way to analyze trends and movements. 

Who is collecting that data? Somebody has to be collecting it. If 

they aren’t, then someone should be. Who is collecting that data— 

the FBI, the CIA, Homeland Security? 

Mr. ZELVIN. Congresswoman, let me answer the question this 

way: We are all collecting data in areas in which we have the ability to see the information. 

Mrs. MALONEY. Okay, but then who is getting the overall picture 

for our national security and economic security? 

Mr. ZELVIN. Again, it is being looked at by Homeland Security. 

We in the NCCIC look at the overall picture. But it is a matter of 

looking at the Internet service providers, and managed security 

service providers, and others, and taking that data and aggregating 

it. 

But I will tell you that we still don’t have the visibility on everything. It is still just a snapshot. But those snapshots are useful because they show trends and then our ability to provide mitigations. 

So if you look at these security reports that Mr. Noonan has 

here, they will talk about things like spearphishing and man-inthe-middle attacks and all these other things, and we are defending 

against those things, so we have a lot of work to do as we take this 

data to build security measures so they are not successful. But that 

aggregation, it doesn’t exist; we are just compiling data from a lot 

of sources. 

Mrs. MALONEY. Before 9/11, we had 18 different intelligence organizations working independently, not sharing their information. 

The most important reform was that we created the Department of 

Homeland Security and combined all of our intelligence so we are 

working in a coordinated way. 

We have to do the same thing with cybersecurity. Somebody has 

to be in charge of the overall picture. 

And I know everybody is doing a good job in their department, 

and I would say the private sector is doing a pretty good job, too. 

Who is coordinating with finding the top things the private sector 

is doing with the top things the government is doing? 

This is a number one national security issue; it is not just an economic issue. And so, who is doing that? Is it Homeland Security? 

Somebody has to be pulling it all together. Who is in charge of 

doing that? 

Mr. ZELVIN. Congresswoman, I will tell you, I think it is our responsibility at the NCCIC, as you describe it, to bring that all together, especially on the network defense side—so to be able to 

work with the private sector; to work with the critical infrastructure sectors; to work with State, local, tribal, territorial; to work 

with our international partners. That is what we are doing on a 

daily basis. 

Last year alone, the Center had 240,000 cyber incidents reported 

to us. But again, that is probably a fraction of the greater whole. 

But our numbers are increasing upwards at about 60 percent a 

year as far as— 

Mrs. MALONEY. And is the private sector also sending you their 

information? 

19 

Mr. ZELVIN. Yes, Congresswoman, they are, but it is done on a 

voluntary basis. They have no requirement to do so. The Federal 

Government has requirements to report to US-CERT under policy 

and other requirements, but the private sector reporting is voluntary and that is why one of the initiatives that has been asked 

for is the data breach reporting requirement. 

Mrs. MALONEY. Okay. Thank you. 

Mr. LUETKEMEYER. I thank the gentlelady. 

With that, it is my turn to ask the questions, so the Chair now 

allows himself 5 minutes to engage the witnesses, as well. 

I want to follow up on Mr. Pearce’s comments with regards to the 

CFPB. I was kind of stunned, taken aback that you gentleman 

hadn’t heard of or weren’t aware of the CFPB, and I would certainly echo the concerns of Mr. Pearce from the standpoint that in 

committee, they actually testified themselves that they have access 

and take in at least 80 percent of the credit card transactions per 

day that occur in this country. 

That sort of access, that sort of accumulation of data in one agency is, quite frankly, scary. You are looking at what happened with 

Target and Neiman Marcus and some of the other merchants, and 

now you have a government agency that has 80 percent of all the 

credit card transactions going on in this country on a daily basis 

accumulating in their files and they are not coordinating with each 

of you? That certainly scares the dickens out of me, so I would certainly urge you to contact those folks and see once if there is a way 

that you can coordinate with them to see if there is something that 

they find which needs to be checked out. 

With that, I was curious—I assume that you have jurisdiction to 

go to any individual company or group or industry, whatever, if 

there is a challenge or some sort of a cyber breakdown within that 

group that deals with personal information. Is that correct? 

Mr. NOONAN. The authority to go actually into the organization 

itself? 

Mr. LUETKEMEYER. Yes. 

Mr. NOONAN. We would use the court process to be able to work 

with that company so— 

Mr. LUETKEMEYER. Okay. 

Mr. NOONAN. —if somebody was reluctant or there was a company that was reluctant, we could potentially use the court process 

to do that, sir. 

Mr. LUETKEMEYER. The reason I asked the question is that 

when—we are talking mostly this morning about financial institutions and merchants, but there are other entities out there that 

have personal information, sometimes have monetary transactions 

that occur. One of the things, for instance, you are looking at different kinds of, for instance, schools, associations—I kind of made 

a list here of other groups—hospitals—medical information is huge 

these days, as well as credit bureaus. 

So have you taken any actions or coordinated with any of those 

kind of groups before with regards to this? 

Mr. NOONAN. Yes, sir. Again, through our electronic crimes task 

forces, we would partnering with those different institutions, as 

well. 

20 

We go after any sort of cyber criminal which is seeking to benefit 

through the monetization of whatever that they are trying to accomplish or steal. So in many of these situations that you have 

brought up, personally identifiable information is a piece that is of 

great concern to us, which the criminal underground can monetize 

and gain from. 

So any opportunity that we can work with a potential victim 

company before it occurs or as it has occurred to be able to go at 

those cyber criminals who are— 

Mr. LUETKEMEYER. One of the reasons I bring that up is a lot 

of those folks, for instance, are not as aware of the ability of somebody to get into their records because they probably don’t deal with 

financial matters as much. But yet, they are probably more at risk 

than anybody else because their systems probably aren’t protected 

as well as, I would think, for instance, financial institutions. So, 

just kind of an observation. 

One of the questions I also had was, what about penalties? Do 

you guys ever catch anybody? How many folks have you caught in 

the last 5 years? 

Mr. NOONAN. As a matter of fact, yes. I am talking about international, the higher-level cyber criminals. 

Going back, starting in 2005, the Secret Service successfully arrested Roman Vega out of the Ukraine. He was sentenced to 18 

years, sir. In 2008, out of Estonia, Alexander Suvorov was sentenced to 7 years. In 2010, Russian Israeli citizen Vladislav 

Horohorin received 88 months, and Igor Shevelev, a citizen of the 

Ukraine, was sentenced to 13 to 40 years in New York. 

Mr. LUETKEMEYER. Are they serving time in the United States? 

Mr. NOONAN. They are serving time here domestically, sir. 

Mr. LUETKEMEYER. They sound like they are all—and you indicated they are all from foreign countries— 

Mr. NOONAN. They are all international, transnational— 

Mr. LUETKEMEYER. Okay. 

Mr. NOONAN. —cyber criminals that we were able to successfully 

arrest internationally, and have extradited back to the United 

States where they are serving their sentences domestically here in 

the United States— 

Mr. LUETKEMEYER. Now, are there other tools or other things 

that you need to be able to do your job better or to have better access to be able to bring charges against individuals? Is there something we need to do to help you do your job better? 

Mr. NOONAN. Sir, what we are doing, which is bringing great 

success in the arena of going after international cyber criminals, is 

our partnerships with our international law enforcement partners 

as well as the international offices that we have and the international working groups that we have overseas. Because cyber 

crime knows no borders, we think it is important to be working 

outside of our own borders and developing these partnerships. 

So anything that we can get—continue to grow in the area of our 

international partnerships is where we find value right now in 

bringing these targets to justice. 

Mr. LUETKEMEYER. Okay. Thank you. 

My time has expired. 

Mr. NOONAN. Thank you. 

21 

Mr. LUETKEMEYER. With that, we will recognize the ranking 

member of the full Financial Services Committee, Ms. Waters. 

Ms. WATERS. Thank you very much. And I ask unanimous consent to submit my opening statement for the record. 

Mr. LUETKEMEYER. Without objection, it is so ordered. 

Ms. WATERS. I would like to thank our witnesses for being here 

today. We are also very interested in this subject, and I think that 

there was a bipartisan effort to support this hearing. 

I would like to know, in light of the fact that the intrusion of 

Target came through a set of compromised vendor credentials, 

what, if any, updated guidance is being given to companies to 

heighten their due diligence of vendors to ensure they are, in fact, 

legitimate actors? 

Mr. NOONAN. So surrounding the information of the potential— 

of the attacks that have occurred over the past several months, as 

we learn information on those attacks we are able to learn what 

criminal tools the perpetrators are utilizing. We take that information, and we analyze that information with the help of the NCCIC, 

and the NCCIC is the main operation that sends out the information to other industry. 

It is also partnered closely with the FS-ISAC, which is the Financial Services Information Sharing and Analysis Center, to take 

the information learned and push the tactics and trends of what is 

happening out to industry. And Mr. Zelvin could probably comment 

a little bit more on exactly how they are doing that. 

Mr. ZELVIN. Yes, ma’am. We got the malware, or the malicious 

software, from the Secret Service. We analyzed it. 

We actually put out three different products. Informational products—the first one went to law enforcement so they could go out 

and hopefully find the actors who did this. The second one was a 

more technical product that went out to cyber defenders not only 

at the financial services companies and the retailers but also to the 

cyber defense community, managed security service providers, and 

Internet service providers, but the people who really understand 

one-zeros and backslashes and hashtags. Lastly, we have on the 

US-CERT Web site for consumers and the general population guidance on what they can do to protect themselves, and if they have 

been a victim, what they can do to recover from these events. 

Ms. WATERS. So you do have some specific vendor information so 

that these companies can make a decision about whether or not 

they are credible vendors? 

Mr. ZELVIN. Yes, ma’am. The government has put out information, the Financial Services ISAC has put out information, and 

also, the industry writ large is working hard at the problem. So, 

it is being attacked from a number of areas. 

Internationally, I will tell you we have gotten some focus there 

in working with our partners, because this is a global problem, not 

just a U.S. problem. 

Ms. WATERS. I would like to ask Mr. Noonan a question about 

Attorney General Eric Holder’s recent urging of Congress to establish a national standard for notifying Americans of data breaches 

in light of the theft, of course, of customer data at Target and other 

major retailers. Would you support a national breach notification 

22 

standard? And if so, do you have any specific recommendations for 

how that should be crafted? 

I heard what you just said about all the things that are being 

done, but I think what is being urged by Attorney General Holder 

is a little bit different. Are you familiar with that? And what do 

you think? 

Mr. NOONAN. Yes, ma’am. The Secret Service does support any 

initiative which would bring a data breach to the attention of a law 

enforcement agency with jurisdiction to be able to help bring criminals to justice and also to help in the aid of information-sharing. 

Ms. WATERS. So you would consider that Congress does not need 

to establish a national standard for notifying Americans of data 

breaches? I appreciate that you have come up with some ways to 

approach this, including the notification of Americans, but there is 

nothing in law where we have set a standard. 

Do you think Congress should do that or could be helpful to you 

in doing that? Would you want to put something like that together 

as a recommendation for us to place in law? 

Mr. NOONAN. Yes. Absolutely. 

Ms. WATERS. Okay. Mr. Zelvin? 

Mr. ZELVIN. Ma’am, I would absolutely agree. Last year at the 

Center, we had 240,000 incidents reported, but we know that is 

only a fraction of what is actually happening out there. There is 

no requirement. 

We would be supportive of that. We think it should be a publicprivate discussion to build what is the most appropriate way to 

come up with that standard, but we would support it. 

Ms. WATERS. Thank you so very much. 

Mr. Chairman, I yield back the balance of my time. 

Mr. LUETKEMEYER. Thank you. 

With that, we recognize the gentleman from Alabama, the chairman emeritus of the full Financial Services Committee, Mr. Bachus, for 5 minutes. 

Mr. BACHUS. I thank the gentleman from Missouri. 

The Target incident has focused a lot of attention on data 

breaches at the point of sale, and I will ask Mr. Noonan, does the 

National Computer Forensic Institute (NCFI) have experience with 

these type of cases, and are there any lessons we can draw or any 

successful prosecutions? 

Mr. NOONAN. Yes, sir. NCFI is an operation where the Secret 

Service brings State and locals to understand cyber crime the same 

way that Secret Service understands cyber crime. 

We teach them computer forensics; we teach them network intrusion capabilities; we teach them cell phone forensics, as well, and 

a litany of other courses to bring State and local law enforcement 

to the same level of understanding of cyber crime as the Secret 

Service. We utilize that facility as a capacity-building to help local 

law enforcement understand and be able to go after the small and 

medium-sized compromises, as well. 

A great success that we have out of the NCFI is a case in which 

a national restaurant chain was compromised in the same way that 

Target was compromised, through a POS case—intrusion case. Our 

office in Manchester, New Hampshire, worked this case and they 

worked it with the support of State and local law enforcement. And 

23 

it was the State and local law enforcement that we were able to 

train at NCFI in understanding the forensics that were going on 

that actually were critical in bringing, in that case, three international, transnational cyber criminals to justice. 

So it is a force multiplication effort of the Secret Service, by 

training State and local law enforcement that are in your communities to have the same level of training, the same level of tools 

that the Secret Service has to go after these types of criminals. 

Not to mention that State and locals can’t use that same equipment and that same training to do other types of cyber crime that 

is important to them in their communities, as well. So we know 

that agents or officers that we have trained and detectives that we 

have trained have also used those skills to bring homicide suspects 

to justice, pedophile suspects to justice, and a litany of other suspects. 

It doesn’t stop at State and local law enforcement. We also have 

trained numerous State and local prosecutors as well as judges at 

that facility. So in the past 4 years, we have trained over 2,000 

State and local members there. 

Mr. BACHUS. Let me ask both of you this question, and it really 

goes into what Congresswoman Waters was saying: With Target, 

they delayed announcing anything until a blogger basically put on 

his blog that there had been a security breach, and then they disclosed the 40 million on their debit cards. But I think, Mr. Zelvin, 

you may have referred to this, they didn’t report the 70 million on 

the personally identifiable information, which actually is almost a 

worse problem than the credit or the debit cards, because you can 

change the debit card. They didn’t change the PPIs, and it is pretty 

hard to change your address or your grandmother’s maiden name 

or the community you were born in, which are all used for passwords, so, there was all kinds of information. You are probably not 

going to change your phone number, and so those things are pretty 

difficult. 

And there has been a lot of discussion, and I have advocated before for some uniform Federal standard for disclosing this information—who you disclose it to and the timeframe. Because right now, 

they operate under—it depends on what State, and the disclosure 

laws are all different in different States. 

So if you would like to address the need for a—what we will call 

a uniform Federal standard? 

Mr. ZELVIN. Congressman, I think one of the better examples is 

on the Federal side, the dot-gov side, the Federal departments and 

agencies, at least in the Executive Branch. You have a requirement 

to report if you had an intrusion, if you had a denial of service, if 

you have had a number of cyber events. That doesn’t exist outside 

the dot-gov domain. 

So it really is incumbent upon that company to decide what they 

want to do and how they want to do it, and I know they talk about 

it at the highest levels, they bring in their security professionals 

who bring their attorneys, and then there is a decision made and 

the decision is either to disclose or not to disclose. They have to 

make a risk management decision of whether or not it is better to 

say something. 

24 

I think we would—what I worry about is someday there could be 

that cyber 9/11, Pearl Harbor, whatever your analogy is, and the 

Congress will be asking, ‘‘What do you need?’’ This will be top on 

our list because if we don’t know, we can’t help to protect and secure the Nation. 

Mr. BACHUS. Mr. Noonan? 

Mr. NOONAN. Yes, sir. I would agree that a lot of times companies have to make a decision based on—they do make a decision 

based on a business need as opposed to what is right for the victim. 

Mr. BACHUS. Right. 

Thank you. 

Chairwoman CAPITO. The gentleman’s time has expired. 

Mr. Scott? 

Mr. SCOTT. Thank you very much. 

In light of everything that has happened, do each of you believe 

that our retailers are held accountable and responsible for cybersecurity at the same standard and level as our financial institutions? 

Mr. ZELVIN. Congressman, let me answer your question this way: 

We don’t have national standards; we are building them now. That 

is part of the President’s Executive Order and—forgive me—let me 

make sure I get the name right—there is the Cyber Critical Infrastructure Community Voluntary Program, the C3 program. 

Mr. SCOTT. But don’t our financial institutions have standards 

now? My point is that, are the retailers held to that same level as 

our financial institutions? Because quite honestly, if not, much of 

what we are doing here is in vain: 110 million Americans have suffered mainly because, in my humble opinion, retailers are not held 

to as high a standard in this issue as the financial institutions, and 

it is critical that we get those two on the same page quickly. 

Mr. ZELVIN. Agreed, sir. The standards can be legislated; they 

can be put out by regulators; they can be enforced by the industry 

themselves. And I think your point is there are certain places in 

industry where they don’t have standards and it would be very 

helpful to do so. 

Mr. SCOTT. Let’s talk about that for a moment because, as you 

notice from the questions from our committee, we are eager here 

in Congress to respond to this issue. This is almost like a Poseidon 

tidal wave coming at us. 

As you rightly point out in your testimony, there are now over 

2 billion Internet users. There are over 12 billion computers and 

other instruments that are used, and satellite devices, and so forth. 

And in the next 10 years that is estimated to possibly double. 

So the issue becomes, can we win this? Can we with this battle? 

That is especially true because not only—even if we just existed 

over the next 10 years at the same level of sophistication of these 

technical devices, which we have become sort of servants to instead 

of servants to us. 

So the question becomes, with the rapid advancements in technology—just think: Ten years ago, we didn’t have what we have 

now, and what we have now, my God, is going to be ancient 10 

years from now and we are going to have double the people with 

it. So I think the American people are looking for some confidence 

here that their vital security is at stake, and then more than that, 

the Nation’s security is at stake. 

25 

Let me ask you an interesting question, Mr. Noonan. What was 

very interesting about your comment, because I wanted to get to— 

you said you caught some people and you mentioned sentencing of 

these people. Are there any possibilities for parole in this or negotiation or anything like that? 

Mr. NOONAN. In the Federal system, my understanding is that 

there can be downward departures of sentences, but not that I 

know of as— 

Mr. SCOTT. That is interesting. Why so? Because you see, these 

national conspiracies, as you so aptly put it, are very sophisticated. 

And it could be that they are even more sophisticated than you or 

us or where we are. 

So why are there plea agreements? Why don’t we have stiff, hard 

criminal sanctions and put these folks who do wrong in jail for 

what they are doing to the country? 

The other point I wanted to ask is that you mentioned that all 

of these were foreigners attacking us. Now, that begs the question, 

why aren’t they attacking—I don’t want them to attack France or 

Germany or Great Britain—but the question is, why us? Is there 

something that these other nations are doing that deters them, and 

we are vulnerable where other nations aren’t? Is that a possibility, 

since the only ones that you have been able to get ahold of and put 

away, hopefully for a while, are foreigners? 

Mr. NOONAN. Sir, we know that these cyber criminals are not 

just attacking the United States. This is a global issue. This is not 

just a national issue to the United States; this is a global issue. 

These particular criminals are attacking wherever they can find 

wealth and monetize that data. 

Mr. SCOTT. How are we doing compared to these other nations? 

Are these other nations putting them away as they should? Is there 

coordination with other nations? 

Mr. NOONAN. Yes, sir. We are coordinating very closely with 

other nations. And to be honest, we have a very, very rich success 

rate of getting some significant, stiff sentences. 

Albert Gonzalez was a domestic target that we arrested in the 

TJX and Heartland Payment Systems breach. He was sentenced to 

20 years in prison here in the United States. 

We also have a litany of other huge sentences. I brought up earlier Roman Vega out of the Ukraine was sentenced to 18 years in 

prison. Recently, out of Romania, Mr. Oprea was sentenced to 15 

years in prison here domestically for, again, point-of-sale breaches 

we are talking about today. 

Chairwoman CAPITO. The gentleman’s time— 

Mr. SCOTT. And the national breach law is what you recommend 

we do? 

Mr. NOONAN. Yes, sir. 

Mr. SCOTT. Okay. 

Chairwoman CAPITO. Thank you. 

Mr. Stutzman? 

Mr. STUTZMAN. Thank you, Madam Chairwoman. 

And I thank both of the witnesses for being here today. 

I would like to follow up just a little bit on the questions that 

you just talked about in, I guess, retailers. I come from a small 

business background and have small business—or a retail small 

26 

business as well, and obviously any sort of credit card is a convenience for both consumer and for the retailer, but the role that retailers play—granted, I am small, but there are large retailers out 

there. Can you share with us a little bit of what—how is that data 

stored? Do they keep that data? 

For us, we don’t—we have no interest in it other than the transaction, and so I guess I am trying to follow up and understand why 

would we expect the retailers to be held to a different standard— 

or at the same standard as the financial institutions? Is there an 

effort out there by retailers even trying to do that? 

I guess I would be concerned about that to some extent, because 

the more information that is held in different groups’ hands, the 

more opportunity there is going to be for breaches. I don’t know if 

either of you had a comment on that? 

Mr. NOONAN. Yes, sir. Actually on your next panel you have a 

witness from PCI who is going to be able to discuss some of those 

issues, but regulations have changed over the course of the years, 

so back in 2005, TJX intrusion happened where cyber criminals 

were able to go after a database where retailers were able to, at 

that time, store credit card data unencrypted in servers. So, the 

criminals were able to exfiltrate a whole database of stored credit 

card data in 2005. 

Because of that intrusion, industry changed. No longer can you 

store credit card data on a database within your system. 

So what the criminals then did is they looked at, where is the 

path of least resistance, and they attacked Heartland Payment Systems, which was a credit card processing company. Credit card 

data during that period of time crossed over the system from the 

retailer to the credit card processing company to the bank, and in 

that system it was not encrypted data during that period of time. 

Again, after that intrusion happened, the standards changed and 

from point to point credit card data and data information had to 

be encrypted. 

Today, the criminals are going after, again, where is the edge of 

the fence? So, they have gone after the point-of-sale systems. 

In domestic retail shops, from the point that you swipe your credit card at the terminal, that data goes to a back-of-the-house server, to a computer in the back that you see it, it is probably in the 

storage room or something of that nature. And that data, from the 

point that it is swiped at the keypad to the back of the computer, 

that is where it is vulnerable and it is not encrypted. Once it hits 

that computer and goes through the processing system, that is 

where it is encrypted and protected. 

So what happens is continually we change the standard and 

these complex, sophisticated criminal actors are going to go after 

and have been going after this data in whatever they see as the 

most advantageous, weakest point in the system. 

Mr. STUTZMAN. So are you saying that typically, the weakest 

point is through retailers’ entry points? How do they use the retailers’ entry points? When I am swiping a card, are they able to follow 

that data from— 

Mr. NOONAN. What they have done is they have actually installed malware into the computer system where it makes the 

switch from the swipe into the encryption piece, so before it is 

27 

encrypted they have malware which actually captures the data at 

that point and exfiltrates the data back out to a different system 

where the criminal is able to collect it. 

Mr. STUTZMAN. Do retailers have the ability to—is there software 

out there that can prohibit that sort of activity, or what could retailers do to protect that information? 

Mr. NOONAN. I am unsure at this point. That would be an industry question to bring up, sir. 

Mr. STUTZMAN. All right. 

Thank you. I will yield back. 

Chairwoman CAPITO. The gentleman yields back. 

Mr. Heck? 

Mr. HECK. Thank you, Madam Chairwoman. 

I would like to begin by asking unanimous consent to enter into 

the record the letter dated January 10, 2014, from 17 signatories 

to Chairman Hensarling requesting this hearing. At the same time, 

I would like to express my public appreciation to you for conducting 

this hearing. 

Chairwoman CAPITO. Thank you. Without objection, it is so ordered. 

Mr. HECK. Thank you. 

Mr. Noonan, it is a little hard to look at this phenomenon without coming away with an answer to the question of, ‘‘Are we winning or losing?’’ of, ‘‘We are losing,’’ at least as measured—not in 

terms of the number of attacks, but the number of successful attacks and the dollar amount that has successfully been effectively 

stolen. 

So for those of us who aren’t especially geeky, among whom I 

would count myself, can you put this in the simplest terms possible: What is the most important takeaway for those of us sitting 

here about what it is we can do as Members of Congress to help 

change that trend line? What is the most important action we could 

take, policy we could enact, in whatever form, to help? 

Mr. NOONAN. It is my belief that if Congress were to assist in 

coming up with a reporting requirement where if there is a data 

breach or a company has knowledge of a data breach, that they 

were to bring that to law enforcement’s attention. That is my perspective. That is the Secret Service perspective. Because we are 

able to, at that point, help with the information-sharing piece that 

has to go forward to better protect what is going on after the fact. 

In other words, it is best for industry to have a point of contact 

at law enforcement—I make the analogy with a fire: Don’t wait 

until your house is on fire to have the phone number to the fire 

department. 

If industry partners with law enforcement and already has a personal, a trusted relationship with law enforcement, we, law enforcement, are better able to assist a victim company walk through 

the process. And in doing so, we are able to grab and gather the 

cybersecurity-related information and share that, then, with the 

greater infrastructure in an effort to prevent other attacks. 

We use, again, a number of different efforts to share that information. We use the NCCIC, where they are able to push it out 

through their sources to greater industry. We are able to use our 

electronic crimes task forces. We are able to push that out to our 

28 

trusted partners in the private sector as well as academia. And we 

are able to use our partners at the FS-ISAC to be able to take that 

information and push it. 

So I think the important part of this whole mechanism that we 

are talking about is the information-sharing apparatus of when a 

breach does occur, what can we learn from that breach, and how 

can we share that information to prevent others? 

Mr. HECK. I want to ask a follow-up corollary to that, which is 

really a follow up to the question—he has left now—Mr. Luetkemeyer asked, which I didn’t think you answered; I didn’t think you 

were evading it but I didn’t think you actually answered it, and I 

really thought it was a very good question, especially given that 

the nature of this activity does not respect boundaries of countries 

whatsoever. He asked you, ‘‘What could we do to help you be more 

effective internationally?’’ 

And basically what you said is, ‘‘Well, these international partnerships are really important to us.’’ 

But the question, sir, is, what can we do to help you be more effective as it relates to your ability to engage in effective enforcement internationally? 

Mr. NOONAN. You can continue to support the Secret Service in 

our efforts of continuing to expand our presence in our international field offices and expanding that footprint. You can help us 

in furthering our international working groups that we have. We 

have working groups in the Ukraine; we have international working groups— 

Mr. HECK. Just use one example. 

Mr. NOONAN. I’m sorry. 

Mr. HECK. I got it. I have one other question that I want to ask, 

and I apologize— 

Mr. NOONAN. Sure. No problem. 

Mr. HECK. —for interrupting. I want to go back to Target. 

It is my understanding that neither Target-branded debit cards 

or credit cards were breached, or successfully—and first of all, I 

would like to know if I have accurate information in that regard. 

And if it is true, what was the difference? And is there a lesson 

to be learned there if it is true? What were they doing such that 

information wasn’t used against— 

Mr. NOONAN. Sure. So, I just checked, and that information is 

not accurate. Those cards— 

Mr. HECK. They were breached. 

Mr. NOONAN. —were breached as well, so that was taken. 

Mr. HECK. Thank you. 

Mr. NOONAN. Yes, sir. 

Mr. HECK. I yield back the balance of my entire 6 seconds. Thank 

you, Madam Chairwoman. 

Chairwoman CAPITO. The gentleman yields back. 

Mr. McHenry? 

Mr. MCHENRY. I thank the chairwoman. 

I just have a broad question for both of you, and if you could answer this. I read news reports that merchants and universities are 

finding out about data breaches from the government, from financial institutions, from credit card companies, banks, the whole lot. 

Why are merchants failing to detect those security breaches? 

29 

Mr. NOONAN. I can’t answer why they are not detecting the security breaches, but law enforcement as well as other parts of the private sector—banks, processing companies—have a unique perspective of looking at compromised data. So we can be working with 

bank investigators—you can take any bank for example—and when 

they start seeing different anomalies with their customer base of 

reporting fraud losses, the initial point of report is going to be back 

to the bank investigator or back to the bank. 

So when they start seeing high percentages of fraud loss coming 

from the same merchant or the same retailer, that is a concern, so 

they would either bring it to law enforcement’s attention or actually bring it to the retailer’s attention at that point. So not necessarily would the retailer have the exposure themselves of that— 

Mr. MCHENRY. Okay. But to that end, Mr. Noonan, when you announced the data breach with Visa and Target in August of 2013, 

right, it was made public then. Am I right on the timeline? 

Mr. NOONAN. Negative. On Target? It wasn’t until December at 

some point. 

Mr. MCHENRY. Okay. So when did you all identify the malware 

for that data breach? 

Mr. NOONAN. The data breach, when it was brought to—when we 

were working closely side by side with the forensic examiners 

that—the third-party forensic examiners that Target had hired, 

within a week we were able to have that data and be able to push 

that out to— 

Mr. MCHENRY. So, you turned it around in a week’s time? 

Mr. NOONAN. Yes, sir. 

Mr. MCHENRY. Okay. So on the next panel, we have a witness 

from the Financial Services Information and Sharing and Analysis 

Center, and they are going to—they are actually conducting a 

study which, ‘‘engages machine-to-machine threat intelligence exchange in a way that will more quickly inform financial infrastructure front line operators and aid their preventative and incident response decision-making.’’ They are calling this the Cyber Threat Intelligence Repository. 

Are you both familiar with this initiative? 

Mr. ZELVIN. We are, sir. At the NCCIC, we are one of the leading 

proponents and creators of the STIX and TAXII framework to 

which you are referring. 

Mr. MCHENRY. So will this speed the response? Tell us the value 

of it. 

Mr. ZELVIN. Sure, Congressman. I think one of the best ways to 

highlight this is in September 2012, our financial sector was being 

attacked about 3 times a week with something called ‘‘distributed 

denial of service attacks.’’ We were getting information by the hundreds of thousands, and technical information. We were getting 

those—and I am going to use some generalisms just to illustrate 

the point—in PDFs, so, in a very user-unfriendly format for a cybersecurity defender. 

We started using spreadsheets like Excel, which was a little bit 

better, but there are a variety of different data formats that companies use so there wasn’t a one-size-fits-all. The STIX and TAXII 

format will enable to us adjust the information so somebody doesn’t 

have to e-mail it, we don’t have to process it, we then e-mail it 

30 

back. This will do it in an automatic way so what had been taking 

us days that we got down into hours will hopefully take us seconds. 

Mr. MCHENRY. So you move from PDFs to Excel— 

Mr. ZELVIN. To a machine-to-machine format that will take the 

human out of the equation. Again, it will be up to the—where the 

destination goes how they are going to want to process— 

Mr. MCHENRY. My time is short, but can you tell us the legal restrictions that prohibit greater data-sharing? What are the things 

we could do to make the dissemination of data better? 

Mr. ZELVIN. Congressman, I am going to highlight something 

that is—the question that was asked of Mr. Noonan, and you may 

have asked it. One of the things that we would really ask Congress 

to do is just better define clarity on information-sharing. What is 

information that the private sector and others can share with us? 

I will tell you, we meet with a lot of C-suite executives, the security folks, and they say, ‘‘By all means, government, here, you can 

have this information. Proliferate it widely. Others are being attacked. This will help us all.’’ 

Then they have others in the company who are giving good advice—their lawyers—saying, ‘‘Look, there is no legal means that allows this. We are assuming some risk, some liability here.’’ If we 

could get some clarity as to what can be shared with us and have 

that in law, that will really speed the process. And also, it should 

be respectful of privacy and civil liberties. 

We should not do this without having some governance on us, 

but it should not stop us from doing it, either. 

Mr. MCHENRY. I thank the chairwoman for her advocacy on this 

important issue. 

Chairwoman CAPITO. Mr. Rothfus? 

Mr. ROTHFUS. Thank you, Madam Chairwoman. 

In Pittsburgh, we are fortunate to have premier academic institutions like Carnegie Mellon University and the University of 

Pittsburgh right at our doorsteps. Both of these universities are 

doing exceptional work in the area of data security. 

And, Mr. Noonan, you highlighted in your testimony the work of 

Carnegie Mellon. 

As you, I think, would both agree, we need to be using these 

great resources in our fight to combat data-breachers. 

I am wondering, Mr. Noonan, if you would elaborate a little bit 

on how the Secret Service—and then, Mr. Zelvin, if you could perhaps comment on what DHS has been doing with these and similarly situated universities around the country? 

Mr. NOONAN. Yes, sir. Thank you. 

The University Carnegie Mellon, we work closely with their Software Engineering Institute. We actually have a full-time agent who 

is assigned there, so he is sitting at Carnegie Mellon, partnered 

with them. Through academia and observing what is occurring in 

a lot of these cyber incidents, we are able to develop other tools— 

technical tools—which the Software Engineering Institute is able to 

help us identify different situations, different forensic solutions, different ways of looking at data, which better helps us do our cases, 

our investigations, our information-sharing. 

Like the institution at Carnegie Mellon, we also have representation at the University of Tulsa, where we have the Cell Phone or 

31 

Mobile Device Forensics Facility, which we worked closely with students—graduate student level students there—and we look at how 

mobile devices can be affected by criminals. We take highly complex criminal cases and we push them to our agent who sits with 

the University of Tulsa to examine how to get at those forensic capabilities and those forensic hurdles in mobile devices, too. 

So it is very important for us to team with academia to decide 

what is on the horizon of the next threat. 

Mr. ROTHFUS. Mr. Zelvin, is DHS similarly engaged with the academic institutions? 

Mr. ZELVIN. Congressman, we are. Carnegie Mellon is one of our 

most critical partners in not only understanding threats but also 

in the mitigation, so it is an intimate relationship and something 

that we hold in the highest regard. 

Mr. ROTHFUS. I want to follow up a little bit on what Representative McHenry was talking about. I think everyone can agree that 

effective data security is dependent on a voluntary collaboration between the government and members of the private sector. Key to 

establishing this sort of trust-based public-private partnership is 

adequate legal liability protection for private entities that share information with the government. 

And to that end, could you please elaborate on the current policy 

regarding legal liability protection for private entities that opt to 

share threat information with agencies like yours? Maybe each of 

you can— 

Mr. ZELVIN. Congressman, that is one of the central issues with 

sharing at government is the concern of either breaking the law or 

potentially having court action in a civil case. So, there is great desire on behalf of the Executive Branch to have the legal liabilities 

in place so one would not be punished for sharing with government. Again, the information should be clarified as to what can be 

shared, but if you do share that information, one should be able to 

do so without penalty. 

Mr. ROTHFUS. Mr. Noonan, can you comment on, from your perspective, the current policy with respect to information-sharing? 

Mr. NOONAN. Yes, sir. I don’t believe there is a policy as of right 

now. So I would concur with Mr. Zelvin. I think there is an issue 

with companies coming forward so they are given some sort of protection, but I cannot comment on existing policy, sir, no. 

Mr. ROTHFUS. In both of your written testimonies, you discuss 

the increasingly international nature of the threat landscape and 

the need for close partnerships with foreign law enforcement agencies. Which countries are you most concerned about in terms of 

data security? 

Mr. NOONAN. A number of the international cases that we are 

talking about today are Eastern European, Russian-speaking cyber 

criminals. I don’t want to affiliate these type of criminals with one 

particular country because again, there are no borders. 

We see Eastern European, Russian-speaking cyber criminals who 

are here domestically in our country that we are able to arrest and 

bring to justice. We see these types of criminals all over the world. 

I say this in the fact that these are the most sophisticated, in our 

opinion, cyber criminals who are attacking our Nation’s financial 

infrastructure. So as far as saying—in trying to lock it down to a 

32 

particular country of origin, there is not one in particular. We are 

seeing them across-the-board. 

But again, the Russian-speaking cyber criminal is using the Russian language as a form of OPSEC, if you will, to provide some anonymity to them. Because they use the Internet, they are wallowing in the anonymity of the Internet. 

Mr. ROTHFUS. Mr. Zelvin, would you agree with the Russianspeaking actors out there? Are there other countries about which 

you have particular concerns? 

Mr. ZELVIN. Congressman, I worry about actors in Asia; I worry 

about actors in Europe, to include Eastern Europe. It is literally a 

global threat environment. So on the financial side, I would agree 

with Mr. Noonan, it is more the Eastern European criminal actors, 

but there is also extraordinary criminal activity in Asia, as well. 

Mr. ROTHFUS. Thank you. 

And thank you, Madam Chairwoman. 

Chairwoman CAPITO. Thank you. 

Mr. Barr? 

Mr. BARR. Thank you, Madam Chairwoman. 

I wanted to kind of know from the witnesses what the worst-case 

scenario would be. In your all’s professional judgment, what would 

be the greatest cybersecurity threat to America’s financial system? 

Mr. NOONAN. In my opinion, it is a financial services attack that 

goes unnoticed. So a long, long period of exposure to a financial 

services sector company is my opinion of what the worst case could 

be. 

It is through the actions of law enforcement that proactively go 

out and seek these out that brings it to industry’s attention. And 

I also think it is important that when industry itself notices it, that 

they bring it to our attention. 

It is important for us—law enforcement, the government—to be 

able to either prevent the attack from happening or see it as it is 

happening to be able to stop the bleeding from happening. If the 

bleeding occurs for a long, long period of time and there is a long 

period of exposure, that, in the financial services sector, would be 

probably the more important, more area of concern for that sector. 

Mr. BARR. Mr. Noonan, what would prevent a victim or targeted 

company from failing to notice this attack? 

Mr. NOONAN. In my opinion, it is how advanced these criminal 

actors are. So when we are talking about significant criminal actors 

that—you have to understand, when they are going after the financial services sector, they are going into these targeted victim companies stealthily. Their job is to go undetected, because if they are 

detected and they go into these situations loud and disrupt everything, they are going to lose what their goal is and that is their 

financial gain; that is their grabbing the data and being able to 

monetize that data. 

So if law enforcement and industry learns about the theft of that 

data and we are able to do something about it, it minimizes the 

criminal profit in what they are attempting to do. 

Mr. BARR. Have we been able to assess or gauge the capabilities 

of some of these hackers? Specifically, the kind of nightmare scenario would be something along the lines of a hacker being able to 

erase electronic data from a large financial institution, or worse, efVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00038 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
33 

fectuate transactions through hacking into a large, systemically important financial institution. 

Are we aware of whether or not cyber terrorists have that capability at this point? 

Mr. ZELVIN. Congressman, let me answer that and then maybe 

go back to your original question. There are actors out there who 

have extraordinary sophistication, who are patient and are looking 

for vulnerabilities and are absolutely capable of finding them 

quickly, and it is just whether or not they have the intent and the 

access and then the ability. 

As I look at the worst-case scenario, to answer the first part of 

your question, I think that if somebody was to find an intrusion in 

the transactional systems that the financial sector uses, that would 

be pretty catastrophic. If there is a loss of confidence within the 

systems themselves where data has been compromised, that would 

be pretty catastrophic. If consumers lose the convenience that they 

rely upon, are unable to use their credit cards and their ATMs, 

that would be pretty catastrophic. 

There are others but those are the three that really come to my 

mind. You really get to that high impact, low probability. 

The sector, the institutions are doing extraordinary work at this 

every hour of every day. But ultimately, there are vulnerabilities 

and the actors are using some very creative and clever means to 

come at us, so you have to be very good every single day because 

they are trying to come at you every single minute of every day. 

Mr. BARR. And in terms of technological advancements in terms 

of creating defenses to this, there is talk about these chip cards and 

more extensive use of PINs, particularly with credit cards. But I 

did notice that in the case of the Target situation, that PINs were 

procured by the hackers, as well. So how effective is expanded use 

of PINS as a defense mechanism? 

Mr. NOONAN. Any added security measure is going to definitely 

help in the monetization of whatever data is stolen. It would not 

assist in the theft of the data itself. 

Mr. BARR. Right. 

Mr. NOONAN. Chip and PIN technology will help in limiting the 

criminal monetization of that data, but it would not help in the 

theft of that data. That data could still be used on card-not-present 

purchases. 

So a cyber criminal, though he cannot re-encode that data onto 

a credit card and use that counterfeit credit card, he could go online and type in the 16-digit number and the other information 

that is exposed there and still accomplish financial loss to the victim bank or the victim institution. 

Mr. BARR. Thank you. 

I yield back the balance of my time. 

Chairwoman CAPITO. Thank you. 

The gentleman yields back, and that concludes questioning for 

the first panel. 

I want to thank both of you gentlemen. I think this has been 

very enlightening, and I again apologize for the delay and thank 

you for your patience. You are dismissed. 

While we are changing over, I am going to ask for unanimous 

consent to submit several statements for the record from the IndeVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00039 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
34 

pendent Community Bankers of America; the National Retail Federation; the National Association of Federal Credit Unions; the 

American Bankers Association; and the Credit Union National Association. 

Without objection, it is so ordered. 

All right. I want to thank the second panel for coming in. We 

have a second panel of distinguished witnesses. 

Again, thank you for your patience. I know you have been sitting 

here, as well, while we had our technical difficulties. 

Each of you will be recognized for 5 minutes to give an oral presentation of your testimony. And without objection, each of your 

written statements will be made a part of the record. 

Our first witness is Mr. Troy Leach, chief technology officer, PCI 

Security Standards Council. 

Welcome, Mr. Leach. 

STATEMENT OF TROY LEACH, CHIEF TECHNOLOGY OFFICER, 

PAYMENT CARD INDUSTRY (PCI) SECURITY STANDARDS 

COUNCIL (SSC) 

Mr. LEACH. Thank you. 

My name is Troy Leach, and I am the chief technology officer for 

the PCI Security Standards Council, a global industry initiative 

that is focused on security payment card data. Our approach to an 

effective security program is people, process, and technology as key 

parts of data protection. Our community of over 1,000 of the 

world’s leading businesses tackles security challenges from simple 

issues—for example, the word ‘‘password’’ is still one of the most 

commonly used passwords—to very complex issues, like proper 

encryption key management. 

We understand when consumers are upset when their payment 

card data is put at risk and the harm that is caused by breaches. 

The Council was created as a forum for all stakeholders—banks, 

merchants, manufacturers, and others—to proactively protect consumers’ cardholder data against emerging threats. 

Our standards focus on removing cardholder data if it is no 

longer needed. Our mantra is simple: If you don’t need it, don’t 

store it. If you do need it, then protect it through a multilayered 

approach and devalue it through innovative technologies that reduce incentives for criminals to steal it. 

Let me explain how we do that. The data security standard is 

built on 12 principles that cover everything from strong access control, monitoring and testing of networks, risk assessment, and 

much more. This standard is updated regularly through feedback 

from our global community. 

In addition, we have developed other standards that cover payment software, security manufacturing of cards, point-of-sale devices, and much more. We also develop standards and guidance on 

emerging technologies, like tokenization and point-to-point 

encryption, that remove the amount of card data that is kept in 

systems, rendering it useless to cyber criminals. 

Another technology, EMV chip, has widespread use in Europe 

and other markets and is an extremely effective method of reducing 

card fraud in face-to-face environments. That is why the Council 

supports the deployment of this technology. In fact, today we alVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00040 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
35 

ready certified a securing of chip terminals and manufacturing of 

chip cards. 

However, EMV chip is only one piece of the puzzle. In addition, 

controls are needed to protect the integrity of payments online, on 

the telephone, and in other channels. These controls include 

encryption, proper access, response from tampering, malware protection, and more. 

These are all addressed within the PCI standards today. Used together, EMV chip and PCI standards can provide strong protections for payment card data. 

But effective security requires more than just standards and 

technology. Without ongoing adherence and supporting programs, 

these are only tools and not solutions. 

The Council makes it easy for businesses to choose products that 

have been independently lab-tested and certified as secure. The 

Council’s certification and training programs have educated tens of 

thousands of individuals including assessors, merchants, technology companies, and government. And finally, we conduct global 

campaigns to raise awareness of payment card security. 

The recent compromises demonstrate the importance of a multilayered approach to payment card security, and there are clear 

ways in which the government can help—for example, by leading 

stronger law enforcement efforts worldwide, particularly because of 

the global nature of these threats; and by encouraging stiff penalties for these crimes. Promoting information-sharing between the 

public and private sector also merits attention. 

The Council is an active collaborator with government. We work 

with NIST, DHS, and many other government entities, and we are 

ready and willing to do more. We believe that the development of 

standards to protect payment card data is something that we are 

uniquely qualified to do. The global reach, expertise, and flexibility 

of PCI have made it an extremely effective mechanism for protecting consumers if implemented correctly. 

The recent breaches underscore the complex nature of payment 

card security. A multifaceted problem cannot be solved by a single 

technology, mandate, or regulation. It cannot be solved by a single 

sector of society. 

Businesses, standards bodies, policymakers, and law enforcement 

must work together to protect the financial and privacy interests 

of consumers. 

Today, as this committee focuses on recent breaches, we know 

that criminals are focusing on inventing the next attack. There is 

no time to waste. The PCI Council and business must continue to 

provide multilayered security protections while Congress leads efforts to combat global cyber crimes that threaten us all. 

We thank the committee for its attention to this, and we look forward to finding a way forward with addressing large security concerns of our time. 

[The prepared statement of Mr. Leach can be found on page 67 

of the appendix.] 

Chairwoman CAPITO. Thank you. 

Our next witness is Mr. Greg Garcia, advisor, Financial Services 

Information Sharing and Analysis Center. 

Welcome. 

36 

STATEMENT OF GREGORY T. GARCIA, ADVISOR, FINANCIAL 

SERVICES INFORMATION SHARING AND ANALYSIS CENTER 

(FS–ISAC) 

Mr. GARCIA. Thank you, Chairwoman Capito, Ranking Member 

Meeks, and members of the subcommittee. 

I am Greg Garcia, president of Garcia Cyber Partners, a cybersecurity policy and business development consulting firm. I am testifying here today as an advisor to the Financial Services Information Sharing and Analysis Center, or FS-ISAC. 

In light of the recent data breaches in the retail sector, this hearing is timely as we consider how commercial and critical infrastructure sectors can prevent and defend against such attacks from happening in the future. 

During my tenure as Assistant Secretary at Homeland Security 

and as an executive with the financial services sector and IT sectors, I have consistently held up the FS-ISAC as a model operation. 

It is a model for how trusted collaboration, timely intelligence, and 

information-sharing are essential elements of any risk management strategy. They are effective tools against cyber adversaries 

who would subvert the integrity of the critical infrastructures that 

maintain the cyber, physical, and economic security of this country 

and the world. 

So accordingly, I would like to spend just the next few minutes 

describing some of the major elements of the model and put it in 

the context of the recent data breaches that are the subject of this 

hearing. 

The FS-ISAC was founded in 1999 in acknowledgement of a 

Presidential Directive, PDD 63, which urged private industry to 

self-organize around the mission of sector-specific critical infrastructure protection. The FS-ISAC provides a formal structure for 

its 4,500 member institutions to share valuable and actionable 

cyber intelligence within the sector and with their industry and 

government partners. This collaborative activity ultimately benefits 

the Nation. 

At FS-ISAC, we use all the tools at our disposal to stay ahead 

of adversaries. And just a few of these tools include the secure FSISAC member Web portal, where threat indicators are published; 

e-mail listservs; threat assessment conference calls; best practices 

advisories; incident response and mitigation protocols; cyber exercises; and information-sharing partnerships across the sector, with 

other sectors, and with government and cyber operations and intelligence entities, such as the NCCIC. 

We recognize that the threats we face are sophisticated and are 

frequently changing, and that immediate sharing of threat details 

and patterns is effective in heading off the changing nature of the 

threats. 

We also share this sensitive information without the risk that 

any member company would exploit another’s misfortune from 

cyber attack for competitive advantage. Members know we are all 

in this together, that an attack on one can very quickly escalate to 

attack on many if all eyes and ears are not working together. 

And our organization ensures that even smaller community institutions have access to threat information alongside the largest financial institutions in the Nation. By way of specific example, 

37 

allow me to walk you through some of the actions taken by the FSISAC in the wake of the retailer data breaches that recently occurred. 

First, when information from forensic investigations became 

available FS-ISAC published a joint document with the DHS National Cybersecurity and Communications Integration Center 

(NCCIC), the U.S. Secret Service, and ISAC partners regarding the 

breach. We provided relevant mitigation recommendations and network security best practices from an industry owner and operator 

perspective. These security practices are intended to help vendors 

and merchants to secure their point-of-sale systems and to defend 

against malware that are used in those system attacks. 

Second, FS-ISAC encouraged its association members to share 

the joint document broadly with their members, and we also met 

with and provided the document to a number of retailer associations and encouraged them to share the document with their members. 

Third, as information about the attacks was becoming available, 

members were able to leverage FS-ISAC’s all-hazards playbook and 

related best practices to better protect and communicate with their 

customers and the general public. 

Fourth, FS-ISAC provided an assessment of the point-of-sale 

malware to its members on its biweekly threat calls and the assessment examined the malware in several ways—the usage patterns 

in the short term, the growing popularity and availability of the 

malware tools, and threat indicators for network defenders. 

Finally, we continue to work with multiple associations representing the retailers to explore ways in which we can help them 

enhance the security of their systems. 

Since these data breaches occurred, there has been considerable 

discussion in the public domain about accountability and assignment of costs associated with these breaches. Indeed, financial institutions have absorbed considerable costs associated with canceling and reissuing credit and debit cards to their customers. 

But as I stated at the beginning of my testimony, it is clear to 

us that we are all in this together, that security is a shared responsibility, and that is why the FS-ISAC was pleased to see the announcement on February 13th of a new partnership between merchant and financial trade associations that will focus on exploring 

the paths to increased information-sharing, better card security 

technology, and maintaining the trust of customers. Discussion regarding the partnership was initiated by the Retail Industry Leaders Association and the Financial Services Roundtable and was 

joined by a dozen other influential financial associations. 

Madam Chairwoman, that concludes my testimony and I look 

forward to answering any questions the subcommittee may have 

for me. 

[The prepared statement of Mr. Garcia can be found on page 57 

of the appendix.] 

Chairwoman CAPITO. Thank you. 

Our next witness is Mr. David Fortney, senior vice president, 

product manager and development, The Clearing House Payments 

Company. 

Welcome. 

38 

STATEMENT OF DAVID FORTNEY, SENIOR VICE PRESIDENT, 

PRODUCT MANAGEMENT AND DEVELOPMENT, THE CLEARING HOUSE PAYMENTS COMPANY 

Mr. FORTNEY. Thank you. Good afternoon, Chairwoman Capito, 

Ranking Member Meeks, and members of the subcommittee. 

My name is David Fortney. I am the senior vice president of 

product management for The Clearing House, and I thank you for 

the opportunity to talk today about issues that are critical to all 

Americans—the security of our payment system and also the protection of sensitive consumer financial information. 

The Clearing House is the Nation’s oldest bank association and 

payments company. Our mission includes ensuring the safety, 

soundness, and efficiency of the payments system. 

We provide payment services to our 23 owner banks and other 

financial institutions, clearing and settling nearly $2 trillion daily. 

The organization’s owner banks collectively represent over half of 

the Nation’s deposits and over 70 percent of Visa and MasterCardbranded credit cards. 

The recent escalation of merchant data breaches demonstrates 

the increasing sophistication of cyber criminals and also underscores the urgent need for financial institutions, merchants, and all 

who touch the payment system to work together to protect against 

current and future threats. 

I will focus my testimony today on two payment systems technologies that are on the horizon and will reduce the risk of future 

breaches: EMV; and tokenization. 

First, EMV cards contain computer chips and they are designed 

to protect against counterfeiting, as compared to the magnetic 

stripe-based cards used today. However, EMV alone would not 

have prevented the theft of card information in the recent 

breaches, as it relies on merchants receiving and processing the 

same static information that account numbers have today. As we 

have heard from prior testimony, those account numbers would 

still be significantly valuable to cyber criminals for committing 

fraud online, where most fraud occurs. 

Additionally, as EMV was designed prior to the Internet, prior to 

mobile phones or tablets, it does not address transactions initiated 

via those means. 

The second technology I would like to discuss is one that we have 

been directly involved in at The Clearing House. It is called 

tokenization. 

Tokenization addresses online and mobile phone payments by 

substituting a limited-use random number, called a digital token, 

for the customer’s account number during the transaction. Working 

behind the scenes, the secure digital token acts just like a regular 

account number as it goes through the system and requires very 

little change in how customers and merchants operate. A customer’s true account number is never present in the smartphone or 

in the merchant’s system, preventing any malware residing on 

those systems from capturing that sensitive information in the first 

place. 

The implementation of these two technologies—EMV and 

tokenization—will require cooperation amongst the banks and merVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00044 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
39 

chants as the tangible benefits can only be achieved by moving in 

tandem. 

Turning to e-commerce, today customers provide personal financial and other data to e-commerce merchants, online wallets, alternative payment providers, merchant aggregators, and others. This 

proliferation of live sensitive customer account data increases the 

risk of breach-related fraud. When my bank recently sent me a new 

card after a compromise, I needed to update that card information 

on 47 different merchant and payment provider Web sites. In a 

tokenized environment, customer account data is held securely behind the bank firewalls and consumers won’t need to update account information when cards are reissued. 

The scale of the payment system is enormous, with hundreds of 

millions of consumers, millions of merchants, thousands of banks 

and credit unions, and hundreds of networks and processors. The 

only way to gain broad adoption of a new technology such as 

tokenization is to develop an open standard that is scalable and 

widely adopted. Open standards promote innovation and allow customers and merchants to choose the best point-of-sale technology 

that works best for them. 

Two years ago, The Clearing House and its owner banks began 

working together to create an open tokenization standard that we 

call Secure Token Exchange. We are working with mobile wallets, 

networks, merchants, and payment processors to pilot and trial the 

standard. The initial pilot began late last year and we will soon expand the trial phase to encompass additional banks, merchants, 

and cities. 

This initiative has acted as a catalyst with an increasing number 

of payment system participants now working on tokenization. We 

remain very much at the center of this activity. 

For example, The Clearing House is now working with the card 

networks, standard bodies, merchants, and processors on digital 

tokenization efforts with the goal of upholding the core openness, 

safety, and soundness principles. We also joined the coalition referred to by the prior witness, a coalition of merchant and financial 

industry trade associations, to form a cybersecurity partnership. 

Thank you again for the opportunity to testify on these critical 

issues, and I would be happy to answer any questions you may 

have. 

[The prepared statement of Mr. Fortney can be found on page 54 

of the appendix.] 

Chairwoman CAPITO. Thank you. 

Our final witness is Mr. Edmund Mierzwinski, consumer program director, U.S. PIRG. 

Welcome. 

STATEMENT OF EDMUND MIERZWINSKI, CONSUMER 

PROGRAM DIRECTOR, U.S. PIRG 

Mr. MIERZWINSKI. Thank you, Madam Chairwoman, Ranking 

Member Meeks, and members of the subcommittee. 

As I did at a Senate hearing last month, I want to try to shift 

the discussion from what it has been in the media anyway, which 

is simply data breach notification—I am glad today we are talking 

40 

about a lot more than data breach notification—to many of the 

other issues surrounding data security. 

First, regarding the Target breach, I am very concerned that Target dragged out notification to consumers for a long time. If it was 

because of investigations conducted with law enforcement that is 

one thing, but if it is simply because they wanted to drag it out 

for a long time, I am very disappointed. 

I am also disappointed in the product that they gave consumers—credit monitoring lite, a product that only tells you if your 

Experian credit report has any changes made to it, but not if your 

other two major credit reports have any changes made on them. 

Further, in order to accept that product, even though it was free, 

consumers had to agree to a mandatory arbitration clause limiting 

their rights against Experian in the future, and that is simply unacceptable to me. 

But at the same time, I don’t hold Target, Neiman Marcus, or 

any other company completely to blame for the breaches that have 

occurred in their stores or in their payment systems. The reason 

for that is they are working with the banks and the card networks, 

and the banks and the card networks are forcing them to use an 

obsolete payment system known as the mag-stripe card. For 50 

years, or maybe 40 years, we have used the mag-stripe card without upgrading it. 

I am very pleased to hear that the banks are now talking about 

open standards to upgrade the systems out there. That is very encouraging to me. But for 40 years, they acted as monopolists with 

closed standards and required merchants to accept a card essentially like a car from the 1950s—no airbags, no ABS brakes, no additional safety features, no safety glass. 

Merchants were forced to continue to adopt new and different 

and ever-changing changes to their systems. It was just very difficult for them and it is not all the merchants’ fault, and the banks 

need to be held accountable and the card networks that were formerly owned by the banks and still are largely controlled by the 

banks. 

I have in my written testimony 10 recommendations that I want 

to go through quickly. 

First, Congress should make all plastic equal. Credit cards are 

safe by law; debit cards have zero liability by promise only. Plus, 

with a debit card, again, you are required to use an unsafe system 

on the signature-based network instead of a PIN-based network. 

You are encouraged, anyway, to use it without a PIN, and that 

is just unfair and unreasonable to consumers who not only are 

breached, who will not only face the problem of fraud or identity 

theft, but also lose money from their existing account until the 

bank replaces it, if it honors the zero liability promise. So first, 

why shouldn’t debit cards have the same consumer protection as 

credit cards? 

Second, be careful not to endorse any specific technologies. Go 

forward with open standards that push innovation and that all participants in the system are subject to the same rules. Previously, 

the banks have forced merchants to be subject to a different set of 

rules than they have been subject to, and companies that are under 

41 

Gramm-Leach-Bliley are subject to a different set of rules than the 

merchants are subject to—an easier, softer set of rules. 

Third, look into whether the open standards bodies are truly 

open. I don’t think they have been in the past; I am encouraged 

to think that they may be in the future. 

Fourth, Congress should stay away from an issue that has been 

debated in State legislatures, which is that banks try to get the 

merchants, by law, to pay all of their costs. They already do pay 

most of the banks’ costs. It is impossible to do that by law. 

Finally, don’t preempt the States. Even if you come up with a 

uniform standard, don’t preempt the States. You don’t need to. The 

States will move onto other issues as long as your standard is good 

enough, but if it isn’t, we need the States as first responders. 

Make sure you allow for private enforcement by consumers of 

any law in State attorneys general as well as a good Federal law. 

Don’t include a harm trigger in your law. Force companies that 

lost their information to tell us about it. 

Investigate overpriced credit monitoring. I have already talked 

about the fact that it is given for free to consumers, but it is something the committee should investigate and the CFPB has been 

looking into quite a bit, as well. 

Finally, Congress should investigate the over-collection of consumer information generally on the Internet by companies we don’t 

even do business with—not only by our banks, and not only by the 

retailers with whom we do business. There are dozens if not hundreds of additional business-to-business companies collecting information about us that are not regulated. 

Thank you. 

[The prepared statement of Mr. Mierzwinski can be found on 

page 73 of the appendix.] 

Chairwoman CAPITO. Thank you very much, and I want to thank 

all of the witnesses. 

I will yield myself 5 minutes to begin the questioning. 

My first question is for Mr. Garcia. On the FS-ISAC, it is a sharing organization with the financial services community, are there 

now private entities who are in that—retailers and such that are 

a member of that community or is it mostly just financial services? 

Mr. GARCIA. It is mostly financial services, although we do have 

a retailer member now and we include insurance companies, and 

payment processors. Any organizations that have—that essentially 

are regulated as financial institutions or have banking credit subsidiaries are eligible for membership in the FS-ISAC. 

Chairwoman CAPITO. Would, say, like a Target be eligible for 

membership to— 

Mr. GARCIA. Yes. And they are a member. 

Chairwoman CAPITO. And they are a member. 

Mr. GARCIA. Yes. 

Chairwoman CAPITO. So are you going to encourage other retailers—because obviously this is where the—some of the breaches 

most recently have taken place— 

Mr. GARCIA. Absolutely. We have had a lot of conversations with 

the retail sector, and certainly Target’s membership in the FSISAC, I think, serves as leadership and opportunity to bring on the 

broader retail sector, provided each individual organization is eligiVerDate Nov 24 2008 14:08 Sep 16, 2014 Jkt 088530 PO 00000 Frm 00047 Fmt 6633 Sfmt 6633 K:\DOCS\88530.TXT TERRI
42 

ble for ISAC membership according to the regulatory status, as I 

mentioned. 

Chairwoman CAPITO. All right. Thank you. 

Mr. Fortney, you mentioned two different types of technologies, 

the EMV chip and the tokenization. Is anybody using the 

tokenization now in the United States with whom we would all be 

familiar? 

Mr. FORTNEY. Tokenization has been used in what I would call 

point-to-point or proprietary type of environments, but what is— 

Chairwoman CAPITO. Give me an example of that. 

Mr. FORTNEY. So, an example would be that instead of using a 

true account number in a product that maybe one bank issues, instead embed a digital token. That has been done. Or individual 

merchants— 

Chairwoman CAPITO. In financial transactions, not retail. 

Mr. FORTNEY. Correct. 

Chairwoman CAPITO. Okay. 

Mr. FORTNEY. What is new with this is really talking about it in 

terms of an open standard that could be used widely in which everyone agrees to the same rules— 

Chairwoman CAPITO. Is anybody outside the United States using 

tokenization in a retail spectrum? 

Mr. FORTNEY. I believe the United States is ahead in this particular area, although there is a lot of interest for the technology 

globally, and some— 

Chairwoman CAPITO. Okay. 

Mr. FORTNEY. For instance, some of the institutions in our owner 

base do operate globally. They have strong interest in using this 

technology across the globe. 

Chairwoman CAPITO. Okay. The EMV chip is used in Europe, 

correct? 

Mr. FORTNEY. That is correct. 

Chairwoman CAPITO. Okay. Now I think I read this or heard that 

Target—and I am using Target as an example, but it might not be 

the correct example—had originally looked at the EMV chip as one 

of the mechanisms that they would use and actually might have 

even used it at some point and then ceased using it. Is that correct? 

Mr. FORTNEY. I read the same thing, and I think it really goes 

to—it is really impossible for a single entity to introduce a new 

technology in payment with—and have impact without moving in 

tandem with a number of other retailers at the same time and the 

banks at the same time. 

Chairwoman CAPITO. Yes. I think in that same article it said 

that it was discontinued because of the ease of service at the checkout. It was holding people up for one reason or another. Anyway, 

yes, I was just curious about that. 

Mr. Leach, I know from our previous conversation when we 

talked about the EMV chip, it is not the be-all and end-all to solve 

these issues. Could you expound on that a little bit for us, please? 

Mr. LEACH. Sure. I would be happy to do so. 

As you know, our PCI standards are applied in Europe already 

today, and so we are looking at ways that we can remove the exposure of card data. So in a chip transaction, mag-stripe transaction, 

the card information is still exposed. And as Mr. Noonan in the 

43 

previous panel explained, you can take that information and create 

fraud in online, telephone order, and other channels. 

So our focus is on removing that card information completely 

from the merchant environment through tokenization, point-topoint encryption, and other means, so as soon as the customer puts 

their information into a point-of-sale terminal, it is removed, and 

it is no longer available to the criminal if they are able to get into 

that system. 

Chairwoman CAPITO. Okay. We have been talking a lot about 

cards, and one of the things I mentioned in my opening statement 

is my interest in mobile payments, and I don’t think of those as 

cards, although they are attached to a card number. 

What about security around these? Is that something that is part 

of what you are looking at for standards, Mr. Leach? 

Mr. LEACH. It is. And we think that this new, innovative technology—and there is actually going to be a press release on the 

framework next week on this—is very exciting. We think that by 

removing card data, we can actually improve the security of mobile 

transactions, as well. 

Chairwoman CAPITO. Okay. Thank you. 

Mr. Meeks? 

Mr. MEEKS. Thank you, Madam Chairwoman. 

And let me, as a guy who is not tech-savvy at all, say that I appreciate your testimony. 

I guess I will start with Mr. Leach. Again, in trying to figure out 

what we can do as Members of Congress, there is currently no Federal law establishing security standards that merchants and data 

brokers are required to meet. 

My first question is, does this matter? And what is the appropriate role of the Federal Government, in your estimation, in setting a dynamic and effective security standard, and what should 

the private sector’s role be? 

And then, in light of the recent breaches at major U.S. retailers, 

do the existing PCI standards need to be updated? 

Mr. LEACH. I will start with the last question, because it is very 

interesting the timing of these breaches and our most recent update to the standards. Many of the actual incidents that are being 

reported in the media of how these criminals were able to get into 

these systems are actually already addressed in our PCI standards 

today. When these forensic investigations are completed, they typically provide a report of what PCI requirements have failed in 

those environments in order for a criminal to actually access and 

steal consumers’ cardholder information. 

There is enforcement of our standards in the industry today. It 

is by contract, so it is a financial institution and their contractual 

relationships with their merchants is how we enforce in our industry today. 

For government involvement, I think the FS-ISAC and information-sharing so that we can take what we learn from these investigations and put that into our standards is where we need to have 

improvement. I think there has actually been in the last couple of 

years more engagement between the government and the private 

sector, and we encourage that to go forward. 

44 

Mr. MEEKS. Let me ask, I guess, Mr. Mierzwinski: You testified 

today, as you did before the Senate Banking Committee in early 

February, where you urged that we should not embrace any specific technology but use and encourage the users to use the highest 

existing standard to prevent by action of rules of existing players 

from blocking additional technological improvements and security 

innovations. 

And I am listening, and I am hearing, on one end, and if I get 

a chance, I will ask Mr. Fortney about tokenization and how that 

can become a large-scale viable—but could you please elaborate on 

some of the basic pros and cons of each smart chip card variation, 

keeping in mind the differences in cost and the susceptibility to 

fraud, and how any of the resulting fraud losses are divided between merchants and card issuers and consumers? 

Mr. MIERZWINSKI. Thank you, Congressman. Again, today is really the first time that I have heard the words ‘‘open standards’’ from 

the bank and card network industry. They may have talked about 

it in the past but I have understood the PCI standards body to be 

totally controlled by the banks and the card networks, and that has 

been harmful to innovation. 

Today, EMV is kind of a standard, but it has different levels of 

protection, and the card networks would like you to believe that 

they are moving toward something called ‘‘chip and signature,’’ and 

that is good enough. But chip and signature is designed by them 

to ride on the old signature-based platform. Anybody can forge a 

signature. 

Chip and PIN is a better solution. Tokenization is also a better 

solution to part of the problem. Online, using virtual account numbers for each transaction, is another part of the solution. 

So I think as long as we are developing standards in a truly open 

body where you can promote innovation, we are much better off. 

Mr. MEEKS. Mr. Fortney, would you alter your answer at all? 

What is your opinion on the same question? 

Mr. FORTNEY. Yes, so, first of all, in the United States, as Mr. 

Mierzwinski points out, as the chip cards are introduced it is not 

necessarily going to be mandating a PIN. You can call it chip and 

choice, that there will be certain transactions that require a PIN 

just as they do today, such as an ATM machine or certain retailer 

transactions. Other transactions may be requiring the signature, 

and certainly underneath a certain dollar amount there may not be 

either of those. 

But regardless of all that, that chip card is fundamentally more 

secure than the mag-stripe card and is a big advance forward. 

Mr. MEEKS. Thank you. 

Mr. LUETKEMEYER [presiding]. Thank you. 

With that, I will yield myself 5 minutes. 

One of the things that is concerning to me is at this point, from 

what I understand, the banks normally are the ones left holding 

the bag normally whenever you have one of these breaches, and is 

there something, Mr. Leach, in the discussion with your group, to 

find a way to put some liability on the other—the merchant who 

didn’t maybe have the latest technology or didn’t exercise the 

greatest care with his data so that it was breached? Or am I wrong 

on that? Is there a sharing of liability there? 

45 

Mr. LEACH. The PCI Council is a technical standards body, so liability and all of the enforcement of our standards is managed 

through those banking relationships between the bank and the 

merchant. What we do is we try to remove that card information 

from ever being stored in a merchant location. 

We heard from other Congressmen earlier who recognize that security is a very hard thing to do day in and day out, and what we 

are trying to do, to the gentleman’s point earlier about 

tokenization, is remove cardholder data from ever being exposed in 

merchant locations so there is no longer an ability for criminals to 

monetize that data. 

Mr. LUETKEMEYER. Mr. Garcia, is there a movement to have 

higher standards for the merchants so that they share some of the 

liability there? 

Mr. GARCIA. We discussed just this recent partnership consortium that has been established between the financial services sector and merchants and payment processors, and I think that is 

going to go a long way to sort of gaining a common understanding 

as to what are our respective vulnerabilities, our respective responsibilities, and how do we work together to stay ahead of the adversaries. 

Mr. LUETKEMEYER. Okay. You made mention a while ago that 

there was a February agreement to that effect. Is that correct? 

Mr. GARCIA. That is correct, February 13th. 

Mr. LUETKEMEYER. Can you explain that just a little bit further? 

Mr. GARCIA. There are about a dozen industry associations that 

are signatory to this. It is just in the beginning phases. It is a partnership that is based on the recognition that we all—this is a 

shared challenge and therefore a shared responsibility, and over 

the coming months we are going to be looking into what are the 

various initiatives and programs we can engage in together to 

think about not just new technological capabilities, but what are 

standards of practice? How do we interact among each other to 

have a more secure ecosystem for the commercial and retail financial environments? 

Mr. LUETKEMEYER. Okay. Do you work with foreign countries, as 

well, foreign clearinghouses? 

Mr. GARCIA. No, not that I am aware of at this point. It is U.S.- 

based. 

Mr. LUETKEMEYER. Okay. With your chip technology changing— 

or perhaps changing—where do you go with that when it comes to 

discussing it with merchants who—for instance, if I want to take 

a trip to Italy and now I want to use my credit card, how is that 

going to work if they don’t have that same technology to be able 

to accept that card? 

This is going to have to be worldwide, I assume. Either Mr. Garcia or Mr. Fortney here? 

Mr. FORTNEY. You have hit upon an issue that has been out 

there for people who travel from country to country, and maybe the 

card technology they work in one country doesn’t work fully in the 

other. There are a number of banks today that will issue cards that 

will work internationally, using EMV, and as the rest of the U.S. 

industry issues those cards over the next year or two, that problem 

should diminish greatly. 

46 

Mr. LUETKEMEYER. One of the problems that we have is with 

convenience comes more exposure, more risk, and that means more 

responsibility on an individual’s part, too. Is there something an individual can do to protect his cards, his information better by the 

way he uses it? 

Mr. Fortney? 

Mr. FORTNEY. You are asking an interesting question because I 

don’t really put a lot of the responsibility on the end user. The end 

user, when they are in a payments environment, they need to enter 

their card information in the way in order to get the purchase 

done. So I guess I would prefer to focus on what are ways that we 

can actually improve the system, get rid of these card numbers and 

live static information out of the system and protect the consumers 

in that way? 

Now, to further answer your question, sure there are some things 

that we all would agree are very bad practices, like if you have a 

PIN, don’t write it on the back of your card, and if you are missing 

a card or you see a fraudulent transaction, report it promptly. I 

would encourage people to sign up for the mobile banking alerts 

that most financial institutions offer so that you have rapid information if your card has been used, and if you don’t recognize that 

transaction, take quick action. 

Mr. LUETKEMEYER. Does a consumer need to change his cards 

regularly? In other words, if I have a MasterCard, for instance, do 

I need to call the company and say, once every 6 months get a new 

card with new numbers and—is that a protection or is that just a 

waste of my time? 

Mr. FORTNEY. I don’t think that is really necessary because if 

your card number were to be breached then your institution would 

most likely reissue that card. This really would be a tremendous 

hassle for a consumer to proactively go about asking for a new 

card. 

If you have reason to believe it has been breached, absolutely, 

but not just as a preventative measure. I wouldn’t recommend that. 

Mr. LUETKEMEYER. My wife, this past couple of weeks, has been 

in a different State, and as a result, she has used her credit card, 

and because it was a different State, immediately the credit card 

company, zam, they said, ‘‘Hey, your card is being used in a different State. Is this what you want to—are you there or did somebody steal your card?’’ It was very quick because the first transaction she did, immediately it was like that, the thing popped up 

on our e-mail and I was immediately notified to that effect. 

It was very helpful and it is nice to know that they are that 

quick to respond. So I guess that is another way that the companies are trying to prevent some folks from being abused with regards to that. 

Mr. FORTNEY. Yes, that is correct. And as you saw in your personal experience, many of the banks—really all of the banks now 

have this kind of fraud detection technology and they are looking 

for anything that is outside of the pattern. 

That can certainly create a hassle if you are traveling and it happens to you erroneously, but typically you can call and get that— 

verify the last transaction and the card gets opened up again for 

a full purchase. 

47 

Mr. LUETKEMEYER. Very good. Thank you. 

With that, we will move to the gentleman from Georgia, Mr. 

Scott. 

Mr. SCOTT. Thank you very much, Mr. Chairman. 

Certainly, first, I just want to commend Mr. Leach and the PCI. 

I think you guys are on the right track in lessening the available 

information out there for the bad guys to work with in the first 

place, and I encourage you to continue with that. 

But what really disturbs me about this hearing is that earlier I 

asked the Secret Service and Homeland Security why the United 

States was targeted, is there something other nations are doing 

that we are not doing, and their answer was not an accurate one, 

if I may say, and I want to address that. Because this is a serious 

problem and there is a reason why we are being targeted, and I 

want you all to respond to this. 

The Economist, in its February 15th article, said that America— 

this Nation, the United States—leads the world in payment card 

fraud. It is the only country in which counterfeit card fraud is consistently growing. In fact, the United States currently accounts for 

nearly half—47 percent—of all global payment card losses. 

It goes on to say, in part, that fraudsters target the United 

States because that is where the cards are. At the end of 2013 

there were 1.2 billion debit, credit, and prepaid cards in circulation 

in America. That is over half of the 2 billion—more than in any 

other region. That is nearly five cards per adult here. 

But America also makes things easy for fraudsters. Alone among 

developed countries, it still relies exclusively on cards with magnetic strips, which are far less secure than the chip and PIN technology used elsewhere. So clearly, the gentlemen with Homeland 

Security and the Secret Service are probably not aware of this. 

But now that we are aware of this, Mr. Mierzwinski, let me ask 

you, given this information from The Economist, given how big this 

issue is, let me ask you: What makes the United States payment 

card so vulnerable to fraud more than any other nation, and what 

is it that we do differently than other countries around the world 

regarding this? 

Mr. MIERZWINSKI. Mr. Scott, I think you answered the question 

already. I don’t know how much I can add to it, but we are still 

using a 40- or 50-year-old magnetic stripe obsolete technology. We 

are now starting to move slowly toward chip and PIN, tokenization, 

virtual card numbers on the Internet, and other solutions that are 

going to be better. 

But the second thing that we do in this country is we aggressively rolled out debit cards to be used without PINs. When they 

were exclusively ATM cards they required a PIN, but the big card 

networks wanted them to ride along on their signature-based systems and so they said, ‘‘Merchants and consumers, use the unsafe 

product on the signature-based system.’’ 

So that is why we say, let’s give consumers greater consumer 

protection when they use debit cards. And let’s go back to encouraging the use of PIN-based networks. There are competitor PINbased networks but the big banks don’t want you to use them because they don’t own them. 

Mr. SCOTT. I see. 

48 

Let me ask you this, because I am anxious—and all of us on this 

committee are anxious—to see what we in Congress can do. So let 

me ask you, is there any reason why Congress shouldn’t mandate 

that payment card security standards use the most effective technology in the marketplace? 

Mr. MIERZWINSKI. I agree with you on that completely, and I will 

leave it up to your legislative counsel to help draft it, but absolutely it should be a standard-based system that promotes the 

highest and most innovative standards. 

Mr. SCOTT. And so don’t you feel—let me just ask you this: Why 

is it important, in your opinion—and others can comment on this 

as well—for Congress to improve debit ATM card consumer rights 

and make all plastic equal? 

Mr. MIERZWINSKI. Very simply, cards are not protected and your 

bank account is not protected, and that is a real problem for consumers. I believe that if the consumer rights were increased to the 

level of credit cards—I only use credit cards, by the way, on the 

Internet, and I only use credits cards at the store. It is the safer 

way to go. But if debit cards had higher consumer rights that 

would focus the mind of the banks on improving protections for 

those cards. 

Mr. SCOTT. And you also mentioned that if fraud victims are reimbursed at what you refer to as zero liability, is this zero liability 

policy ubiquitous among all credit card and debit card users? 

Mr. MIERZWINSKI. As far as I—zero liability is something that 

the debit card industry promotes. The credit card law maximizes 

our liability at $50, but with a debit card, you could lose all the 

money in your account under some circumstances. 

Mr. SCOTT. Okay. My— 

Mr. MIERZWINSKI. But as far as I know, all the card companies 

do use zero liability but some have more asterisks, more exceptions. 

Mr. SCOTT. And so my final point is, because I think the American people—I think this is a problem of soaring magnitude, and 

we are going to be in trouble if we don’t get a handle on this. We 

in Congress, there is no national directive here, so I just want to 

ask each of you, do you feel that the most important thing we can 

do right now is this national breach legislation that we have been 

talking about, that we have a national standard, or do you see just 

leaving it at the State level—the various State levels, this hodgepodge that we have? 

Mr. MIERZWINSKI. If you are starting with me, I have already 

testified that I think that we don’t really need a national standard, 

but if you do establish one—because a good, smart company can 

just comply with the strongest State law, but if we are going to 

focus on that as part of the solution, just don’t preempt the States. 

Go to a high, good national standard. You won’t need to preempt 

the States. 

Mr. SCOTT. Okay. 

Anyone else? 

Mr. FORTNEY. Yes. We would support a national standard. We 

just think the most efficient way to deal with these sorts of threats 

is to be consistent and provide standard consumer protection 

versus a haphazard, State-by-State approach. 

49 

Mr. SCOTT. Yes. 

Mr. Garcia? 

Mr. GARCIA. Yes. I would agree with that. I think if you have 40- 

plus State laws that differ in various respects as to what are the 

requirements for breach notification, it doesn’t necessarily improve 

consumer protection to have multiple different forms of communication, and to the extent that you can standardize that kind of 

communication to the consumer base nationally, I think that would 

be more effective and less costly. 

Mr. SCOTT. Okay. Thank you. 

Mr. Leach, would you— 

Mr. LEACH. Consistency is good. Again, we need to find ways to 

get after these bad guys and remove the monetization of card data, 

period. 

Mr. SCOTT. Okay. 

Thank you very much, Mr. Chairman. I appreciate the extra 

time. 

Mr. LUETKEMEYER. Thank you. 

I just have one follow-up question here, and then I think we are 

done for the day and we will let you guys go. 

We have seen in the last year or so a number of breaches, and 

my concern is, how many more are yet to come? And as a result 

of that, when are we going to get some action taken to stop this? 

And so if you could answer those two questions succinctly here, 

we will start with Mr. Mierzwinski? 

Mr. MIERZWINSKI. I apologize— 

Mr. LUETKEMEYER. I guess the question is, how susceptible are 

we to further breaches, and then where are we going to be 5 years 

from now? Are we going to take action? 

Mr. MIERZWINSKI. I think that further breaches are going to 

occur. I just saw Brian Krebs who is tweeting that—he is the guy 

who broke the Target story; he is a cyber journalist, I guess—that 

there was another breach today of a beauty company. And so, there 

will be continued breaches. The question is, what do we do about 

them? 

Five years from now, I predict we are going to have a much more 

sophisticated system. There is innovation coming from phone companies, coming from Internet companies, coming from alternatives. 

It is going to force the banks to do a better job. 

Mr. LUETKEMEYER. Mr. Fortney? 

Mr. FORTNEY. I would agree with most of that. I think it is not 

just on the banks, however. 

It is really on the banks and the merchants and everyone to 

work together to introduce these new technologies. It can’t be done 

from one side. 

Mr. LUETKEMEYER. Mr. Garcia? 

Mr. GARCIA. Asking when we are going to stop cyber attacks is 

tantamount to asking when we are going to stop crime. It is an ongoing challenge. As long as there is technological innovation, there 

is technological innovation on the side of criminals as well, finding 

ways to exploit that. 

So, as I mentioned before, it isn’t just about technology, but it 

is about your practices and your information-sharing and your collaboration. We are all in this together and no single one of us is 

50 

as smart as all of us combined, and that is really what the FSISAC is here to talk about today is how we collaborate when those 

technological solutions aren’t going to fully protect us, but what can 

we do together as a team. 

Mr. LUETKEMEYER. I guess the follow-up to you would be, okay, 

we recognize we have a problem. Your group is one who tries to 

solve a problem. Are you going to kick it into another gear to get 

this done ASAP? 

Mr. GARCIA. As a matter of fact, we have initiated a new program that tries to automate—that does automate our intelligence 

and information-sharing and incident response, because as we 

know, many cyber attacks happen at Internet speed, and as long 

as we are operating at human speed, we are one step behind. So 

we have invested quite a lot of resources—FS-ISAC and its membership—in developing—in automated tools using standardized language for how we characterize threats and attacks such that the 

front-line cyber operators and analysts who are protecting our systems are able to make decisions in a more real-time way and take 

action in a more real-time way against those threats and attacks. 

Mr. LUETKEMEYER. Very good. 

Mr. Leach? 

Mr. LEACH. I would say we can’t address 2014 threats with 2004 

controls. We need to remove the legacy systems that we have—and 

part of that is legacy business process and educating merchants 

that there is no longer a need to store cardholder information beyond the point of getting an authorization. 

I think with the legacy systems that we have today, there is opportunity for us to improve. You asked about what we will see in 

about 5 years. I see us no longer having these value card information for criminals to attack. That is where I hope we are going to 

be in 5 years. 

Mr. LUETKEMEYER. I thank each of the witnesses for being here 

today. As you can see, we are very concerned on this side of the 

table with regards to the privacy of information and the privacy of 

financial transactions that take place with our consumers and our 

constituents and the people of this country. 

And so, we want to work with you. If you can continue to work 

with us to point out places where we can be of help, we certainly 

want to look for that. 

And again, I thank the chairwoman for the opportunity to have 

this hearing. 

The Chair notes that some Members may have additional questions for this panel, which they may wish to submit in writing. 

Without objection, the hearing record will remain open for 5 legislative days for Members to submit written questions to these witnesses and to place their responses in the record. Also, without objection, Members will have 5 legislative days to submit extraneous 

materials to the Chair for inclusion in the record. 

With that, hearing is adjourned. 

[Whereupon, at 1:09 p.m., the hearing was adjourned.] 

(51) 

A P P E N D I X 

March 5, 2014 

52 


88530.001
53 


88530.002
54 


88530.003
55 


88530.004
56 


88530.005
57 


88530.006
58 


88530.007
59 


88530.008
60 


88530.009
61 


88530.010
62 


88530.011
63 


88530.012
64 


88530.013
65 


88530.014
66 


88530.015
67 


88530.016
68 


88530.017
69 


88530.018
70 


88530.019
71 


88530.020
72 


88530.021
73 


88530.022
74 


88530.023
75 


88530.024
76 


88530.025
77 


88530.026
78 


88530.027
79 


88530.028
80 


88530.029
81 


88530.030
82 


88530.031
83 


88530.032
84 


88530.033
85 


88530.034
86 


88530.035
87 


88530.036
88 


88530.037
89 


88530.038
90 


88530.039
91 


88530.040
92 


88530.041
93 


88530.042
94 


88530.043
95 


88530.044
96 


88530.045
97 


88530.046
98 


88530.047
99 


88530.048
100 


88530.049
101 


88530.050
102 


88530.051
103 


88530.052
104 


88530.053
105 


88530.054
106 


88530.055
107 


88530.056
108 


88530.057
109 


88530.058
110 


88530.059
111 


88530.060
112 


88530.061
113 


88530.062
114 


88530.063
115 


88530.064
116 


88530.065
117 


88530.066
118 


88530.067
119 


88530.068
120 


88530.069
121 


88530.070
122 


88530.071
123 


88530.072
124 


88530.073
125 


88530.074
126 


88530.075
127 


88530.076
128 


88530.077
129 


88530.078
130 


88530.079
131 


88530.080
132 


88530.081
133 


88530.082
134 


88530.083
135 


88530.084
136 


88530.085
137 


88530.086
138 


88530.087
139 


88530.088
140 


88530.089
141 


88530.090
142 


88530.091
143 


88530.092
144 


88530.093