U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

71–258 PDF 2012

SONY AND EPSILON: LESSONS FOR DATA 

SECURITY LEGISLATION 

HEARING 

BEFORE THE

SUBCOMMITTEE ON COMMERCE, MANUFACTURING, 

AND TRADE 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

JUNE 2, 2011 

Serial No. 112–55 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

FRED UPTON, Michigan 

Chairman 

JOE BARTON, Texas 

Chairman Emeritus 

CLIFF STEARNS, Florida 

ED WHITFIELD, Kentucky 

JOHN SHIMKUS, Illinois 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

Vice Chairman 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

BRIAN P. BILBRAY, California 

CHARLES F. BASS, New Hampshire 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BILL CASSIDY, Louisiana 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

CORY GARDNER, Colorado 

MIKE POMPEO, Kansas 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

HENRY A. WAXMAN, California 

Ranking Member 

JOHN D. DINGELL, Michigan 

EDWARD J. MARKEY, Massachusetts 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

LOIS CAPPS, California 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

ANTHONY D. WEINER, New York 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

DONNA M. CHRISTENSEN, Virgin Islands 

(II)

(III) 

SUBCOMMITTEE ON COMMERCE, MANUFACTURING, AND TRADE

MARY BONO MACK, California 

Chairman 

MARSHA BLACKBURN, Tennessee 

Vice Chair 

CLIFF STEARNS, Florida 

CHARLES F. BASS, New Hampshire 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BILL CASSIDY, Louisiana 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVE B. MCKINLEY, West Virginia 

MIKE POMPEO, Kansas 

ADAM KINZINGER, Illinois 

JOE BARTON, Texas 

FRED UPTON, Michigan, ex officio 

G.K. BUTTERFIELD, North Carolina 

Ranking Member 

CHARLES A. GONZALEZ, Texas 

JIM MATHESON, Utah 

JOHN D. DINGELL, Michigan 

EDOLPHUS TOWNS, New York 

BOBBY L. RUSH, Illinois 

JANICE D. SCHAKOWSKY, Illinois 

MIKE ROSS, Arkansas 

HENRY A. WAXMAN, California, ex officio 

(V) 

C O N T E N T S 

Page 

Hon. Mary Bono Mack, a Representative in Congress from the State of 

California, opening statement ............................................................................. 1 

Prepared statement .......................................................................................... 3 

Hon. G.K. Butterfield, a Representative in Congress from the State of North 

Carolina, opening statement ............................................................................... 4 

Hon. Marsha Blackburn, a Representative in Congress from the State of 

Tennessee, opening statement ............................................................................ 5 

Prepared statement .......................................................................................... 6 

Hon. Cliff Stearns, a Representative in Congress from the State of Florida, 

opening statement ................................................................................................ 6 

Hon. Pete Olson, a Representative in Congress from the State of Texas, 

opening statement ................................................................................................ 7 

Hon. Henry A. Waxman, a Representative in Congress from the State of 

California, prepared statement ........................................................................... 53 

Hon. Edolphus Towns, a Representative in Congress from the State of New 

York, opening statement ...................................................................................... 53 

WITNESSES

Jeanette Fitzgerald, General Counsel, Epsilon Data Management, LLC ........... 8 

Prepared statement .......................................................................................... 10 

Answers to submitted questions ...................................................................... 55 

Tim Schaaff, President, Sony Network Entertainment International ................ 17 

Prepared statement .......................................................................................... 19 

Answers to submitted questions ...................................................................... 58 

(1) 

SONY AND EPSILON: LESSONS FOR DATA 

SECURITY LEGISLATION 

THURSDAY, JUNE 2, 2011 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON COMMERCE, MANUFACTURING, AND

TRADE, COMMITTEE ON ENERGY AND COMMERCE, Washington, DC. 

The subcommittee met, pursuant to call, at 12:05 p.m., in room 

2123 of the Rayburn House Office Building, Hon. Mary Bono Mack 

(chairwoman of the subcommittee) presiding. 

Members present: Representatives Bono Mack, Blackburn, 

Stearns, Harper, Lance, Guthrie, Olson, McKinley, Pompeo, 

Kinzinger, and Butterfield. 

Staff present: Charlotte Baker, Press Secretary; Allison Busbee, 

Legislative Clerk; Paul Cancienne, Policy Coordinator, Commerce, 

Manufacturing and Trade; Brian McCullough, Senior Professional 

Staff Member, Commerce, Manufacturing and Trade; Gib Mullan, 

Chief Counsel, Commerce, Manufacturing and Trade; Shannon 

Weinberg, Counsel, Commerce, Manufacturing and Trade; Michelle 

Ash, Democratic Chief Counsel; Felipe Mendoza, Democratic Counsel; and Will Wallace, Democratic Policy Analyst. 

OPENING STATEMENT OF HON. MARY BONO MACK, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF CALIFORNIA 

Mrs. BONO MACK. Good afternoon. If the room would please come 

to order. Guests, kindly take your seats. Thank you. So good afternoon. 

In today’s online world, your name, birth date, and mother’s 

maiden name are often used to verify your identity. But in the 

wake of massive data breaches at Sony and Epsilon, we are now 

painfully more aware that this very same information can be used 

just as easily to falsify your identity. The time has come for Congress to take action. And the chair now recognizes herself for an 

opening statement. 

With nearly 1.5 billion credit cards now in use in the United 

States and more and more Americans banking and shopping online, cyber thieves have a treasure chest of opportunities today to 

get rich quick. Why crack a vault when you can hack a network? 

The Federal Trade Commission estimates that nearly 9 million 

Americans fall victim to identity theft every year, costing consumers and businesses billions of dollars annually, and those numbers are growing steadily and alarmingly. 

2 

In recent years, sophisticated and carefully orchestrated cyber attacks designed to obtain personal information about consumers, especially when it comes to their credit cards, have become one of the 

fastest-growing criminal enterprises here in the U.S., as well as 

across the world. Just last month, the Justice Department shut 

down a cyber crime ring believed to be based in Russia, which was 

responsible for the online theft of up to $100 million. 

The boldness of these attacks and the threat they present to 

unsuspecting Americans was underscored recently by massive data 

breaches at Epsilon and Sony. In some ways, Sony has become 

Ground Zero in the war to protect consumers’ online information. 

The initial attacks on Sony’s PlayStation network and online entertainment services, which put some 100 million customer accounts 

at risk, were quickly followed by still more attacks at other Sony 

divisions and subsidiaries. Since then, the company, to its credit, 

has taken some very aggressive steps to prevent future cyber attacks such as installing new firewalls, enhancing data protection, 

and enhancing their encryption capabilities, expanding automated 

software monitoring, and hiring a new chief information security 

officer. 

These are all important new safeguards, but with millions of 

American consumers in harm’s way, why weren’t these safety protocols already in place? For me, one of the most troubling issues 

is how long it took Sony to notify consumers and the way in which 

the company did it—by posting an announcement on its blog. In effect, Sony put the burden on consumers to search for information 

instead of providing it to them directly. That cannot happen again. 

While I remain critical of Sony’s initial handling of these data 

breaches, as well as its decision not to testify at our last hearing— 

and that goes for Epsilon as well—it is clear that since then, the 

company has been systematically targeted by hackers and cyber 

thieves who are constantly probing Sony’s security systems for 

weaknesses and opportunities to infiltrate its networks. 

So today, I am not here to point fingers. Instead, let us point the 

way, a better, smarter way to protect American consumers online. 

As I have said, you shouldn’t have to cross your fingers and whisper a prayer whenever you type in a credit card number on your 

computer and hit ‘‘Enter.’’ E-commerce is a vital and growing part 

of our economy. We should take steps to embrace and protect it and 

that starts with robust cyber security. 

As chairman of the subcommittee, I believe the lessons learned 

from the Sony and Epsilon experiences can be instructive. How did 

these breaches occur? What steps are being taken to prevent future 

breaches? What is being done to mitigate the effects of these 

breaches? And what policies should be in place to better protect 

American consumers in the future. Most importantly, consumers 

have a right to know when their personal information has been 

compromised, and companies have an overriding responsibility to 

promptly alert them. These recent data breaches only reinforce my 

long-held belief that much more needs to be done to protect sensitive consumer information. 

Americans need additional safeguards to prevent identity theft, 

and I will soon introduce legislation designed to accomplish this 

goal. My legislation will be crafted around 3 guiding principles. 

3 

First, companies and entities that hold personal information must 

establish and maintain security policies to prevent the unauthorized acquisition of that data. Second, information considered especially sensitive such as credit card numbers should have even more 

robust security safeguards in place. And finally, consumers should 

be promptly informed when their personal information has been 

jeopardized. 

The time has come for Congress to take decisive action. We need 

a uniformed national standard for data security and data breach 

notification and we need it now. While I remain hopeful that law 

enforcement officials will quickly determine the extent of these latest cyber attacks, they serve as a reminder that all companies have 

a responsibility to protect personal information and to promptly notify consumers when that information has been put at risk. And we 

have a responsibility as lawmakers to make certain that this happens. 

[The prepared statement of Mrs. Bono Mack follows:] 

PREPARED STATEMENT OF HON. MARY BONO MACK

With nearly 1.5 billion credit cards now in use in the United States—and more 

and more Americans banking and shopping online—cyber thieves have a treasure 

chest of opportunities today to ‘‘get rich quick.’’ Why crack a vault when you can 

hack a network? 

The Federal Trade Commission estimates that nearly nine million Americans fall 

victim to identity theft every year, costing consumers and businesses billions of dollars annually—and those numbers are growing steadily and alarmingly. 

In recent years, sophisticated and carefully orchestrated cyber attacks—designed 

to obtain personal information about consumers, especially when it comes to their 

credit cards—have become one of the fastest growing criminal enterprises here in 

the United States and across the world. 

Just last month, the Justice Department shut down a cyber crime ring—believed 

to be based in Russia -which was responsible for the online theft of up to $100 million. The boldness of these attacks and the threat they present to unsuspecting 

Americans was underscored recently by massive data breaches at Epsilon and Sony. 

In some ways, Sony has become ground zero in the war to protect consumers’ online information. The initial attacks on Sony’s PlayStation Network and online entertainment services—which put some 100 million customer accounts at risk—were 

quickly followed by still more attacks at other Sony divisions and subsidiaries. 

Since then, the company—to its credit—has taken some very aggressive steps to 

prevent future cyber attacks, such as installing new firewalls.enhancing data protection and encryption capabilities. expanding automated software monitoring.and hiring a new Chief Information Security Officer. 

These are all important new safeguards, but with millions of American consumers 

in harm’s way, why weren’t these safety protocols already in place? 

For me, one of the most troubling issues is how long it took Sony to notify consumers.and the way in which the company did it—by posting an announcement on 

its blog. In effect, Sony put the burden on consumers to search for information instead of providing it to them directly. That cannot happen again. 

While I remain critical of Sony’s initial handling of these data breaches—as well 

as its decision not to testify at our last hearing.and that goes for Epsilon as well— 

it’s clear that since then the company has been systematically targeted by hackers 

and cyber thieves who are constantlyprobing Sony’s security systems for weaknesses 

and opportunities to infiltrate its networks. 

So today, let’s not point fingers. Instead, let’s point the way—a better, smarter 

way—to protect American consumers online. As I have said, you shouldn’t have to 

cross your fingers and whisper a prayer when you type in a credit card number on 

your computer and hit ‘‘enter.’’ E-commerce is a vital and growing part of our economy. We should take steps to embrace and protect it—and that starts with robust 

cyber security. 

As Chairman of this Subcommittee, I believe the lessons learned from the Sony 

and Epsilon experiences can be instructive. How did these breaches occur? What 

steps are being taken to prevent future breaches? What’s being done to mitigate the 

4 

effects of these breaches? And what policies should be in place to better protect 

American consumers in the future? 

Most importantly, consumers have a right to know when their personal information has been compromised, and companies have an overriding responsibility to 

promptly alert them. 

These recent data breaches only reinforce my long-held belief that much more 

needs to be done to protect sensitive consumer information. Americans need additional safeguards to prevent identity theft, and I will soon introduce legislation designed to accomplish this goal. My legislation will be crafted around three guiding 

principles: 

First, companies and entities that hold personal information must establish and 

maintain security policies to prevent the unauthorized acquisition of that data; 

Second, information considered especially sensitive, such as credit card numbers, 

should have even more robust security safeguards; 

And finally, consumers should be promptly informed when their personal information has been jeopardized. 

The time has come for Congress to take decisive action. We need a uniform national standard for data security and data breach notification, and we need it now. 

While I remain hopeful that law enforcement officials will quickly determine the 

extent of these latest cyber attacks, they serves as a reminder that all companies 

have a responsibility to protect personal information and to promptly notify consumers when that information has been put at risk. And we have a responsibility, 

as lawmakers, to make certain this happens. 

Mrs. BONO MACK. And now I would like to recognize the vice 

chairman of the—oh, I am sorry—the ranking member Mr. 

Butterfield for his 5-minute opening statement. 

OPENING STATEMENT OF HON. G.K. BUTTERFIELD, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF NORTH 

CAROLINA 

Mr. BUTTERFIELD. Let me thank you, Chairman Bono Mack, for 

your indulgence. I have been in my office with 28 constituents, one 

of whom was a World War II veteran and several Vietnam veterans 

and they wanted to take pictures and you know that drill. And so 

I had to accommodate them as best I could. But we are here and 

thank you very much for convening this hearing today. And I certainly thank the two witnesses for your presence. 

Madam Chairman, thank you for holding this hearing on data security and the recent breaches that we have seen at Sony and Epsilon. Last month, well over 100 million consumer records have been 

compromised as a result of those breaches, including full names, 

email and mailing addresses, the passwords, and maybe even credit card numbers. Those two major breaches illustrate that no company is safe from attack and that we must always operate at a 

heightened level of security and vigilance. No company wants its 

data compromised, and Sony and Epsilon are certainly no exception. 

Sony was victim to hackers who stole nearly 100 million consumer records, and it took engineers several days to realize that 

there was an intrusion. During that time, hackers had full access 

to Sony’s servers. The breach that occurred at Epsilon was very 

large and involved the names and email addresses of about 50 of 

Epsilon’s clients with conservative estimates of 60 million records 

stolen. Luckily, no critically sensitive information was stolen, but 

it easily could have. 

It is important that businesses do all they can do to protect consumers from having their information fall into the wrong hands. 

For many Americans, shopping, paying bills, and refilling prescripVerDate Nov 24 2008 13:36 Aug 01, 2012 Jkt 037690 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 112\112-55 060211\112-55 CHRIS
5 

tions and communicating with friends and family and even playing 

games are all done online. As people share more and more information online, the potential for personally identifiable information to 

be compromised increases exponentially. Names, physical addresses, dates of birth, Social Security numbers, and credit card numbers are just a few of the types of information that hackers are able 

to access and exploit. 

While 46 States have laws requiring consumer notification when 

a breach occurs, there is currently no federal standard to address 

this. Moreover, there is no federal law requiring companies that 

hold PII to have reasonable safeguards in place to protect this information. Without a federal standard, I am concerned that American consumers remain largely exposed online. And during the 

109th Congress and subsequent Congresses, members of this committee worked in a bipartisan fashion to develop the Data, Accountability, and Trust Act to address the issue of data security. 

The DATA bill of the 111th Congress by my friend and former 

chairman of the subcommittee Mr. Rush from Illinois would have 

required entities holding data containing personal information to 

adopt reasonable and appropriate security measures to safeguard 

it and, in the event of a breach, to notify affected individuals. The 

DATA bill passed the House and the 111th Congress but our 

friends in the Senate did not act. The DATA bill is a good foundation to improve the security of e-commerce, something that is good 

for consumers and good for business. It would give American consumers more peace of mind about online transactions and make 

them more likely to continue and expand their use of online services. 

And so, Madam Chairman, we have learned a lot from the 

breaches at Sony and Epsilon and I expect to learn more today 

from our two witnesses. I want you to know that I stand ready to 

work with you and our colleagues to pass a strong bipartisan data 

security bill like the DATA bill that we saw in the last session. I 

thank today’s witnesses for their testimony and look forward to 

each of you. Thank you very much. I yield back. 

Mrs. BONO MACK. I thank the gentleman. Chairman Upton yielded his 5 minutes for an opening statement to me in accordance 

with committee rules. And as his designee, I now recognize Mrs. 

Blackburn for 2 minutes. 

OPENING STATEMENT OF HON. MARSHA BLACKBURN, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF TENNESSEE 

Mrs. BLACKBURN. Thank you, Madam Chairman. I will submit 

my full statement. 

A couple of comments. I think that the Sony and the Epsilon 

breaches raise a lot of questions with our constituents. What they 

are asking us is, number one, how do you minimize identity theft? 

Number two, they want proper notifications from the venders that 

they are doing business with. And number three, they want to see 

better coordination with law enforcement. They feel as if this is 

missing. And I know that as we address this, what we are going 

to have to look at is better government coordination, incentives for 

industry cooperation in this issue, stricter penalty deterrents 

6 

against hackers, and a flexible framework for risk assessment and 

breach alerts. 

As we do this, I hope that we will continue to look at the threat 

of digital protection of intellectual property. The two are interrelated and they both deserve attention. And I have to tell you, 

with the new music cloud services from Apple, Google, and Amazon, my concern is there that we hold everybody accountable and 

secure the integrity of that system. 

I do want to highlight that on the issue of the illegal downloads 

and file sharing, my home State of Tennessee has just passed and 

signed into law a bill that puts in place penalties for this. They 

have made this a crime in our State, and I am glad they did it because losing content to the rogue Web sites not only becomes an 

issue for the entertainment industry, but it exposes consumers to 

viruses, dangerous products, and increases the likelihood of data 

theft. 

So I thank you all for being here and I yield back my time. 

[The prepared statement of Mrs. Blackburn follows:] 

PREPARED STATEMENT OF HON. MARSHA BLACKBURN

I thank the Chair for holding this hearing on securing our online data and privacy. 

This is a timely subject of importance not only for our economy, but also for our 

virtual and physical safety. 

Last year Tennessee ranked 18th for fraud, and 19th for identity theft complaints 

nationwide. But the disturbing proliferation of data theft knows no boundaries in 

the virtual marketplace. And the Epsilon and the two Sony breaches raise the 

stakes of our policy response. 

Just this week, after problems with the Android app for Skype were apparently 

fixed, consumers reported receiving robo-calls soliciting their credit card information. 

Representatives from the industry have an obligation to explain to the American 

people exactly how our data is being hijacked, and what exactly they plan to do 

about it. 

In examining the lifecycle of these data breaches, an obvious and disturbing pattern can been seen in lagging consumer notifications. It’s a trend I fear perpetuates 

industry’s ‘‘culture of damage control’’—a business strategy that accelerates identity 

theft and virtual phishing schemes. 

We need a framework that gives consumers at least a fighting chance to protect 

the ‘‘Virtual You’’—one’s online identity—not just the false sense of security they 

have been fed. 

I look forward to the witnesses’ testimony, and to an open discussion about how 

we can secure our data and privacy in the virtual realm. I yield my time. 

Mrs. BONO MACK. I thank the gentlelady. And the chair recognizes Mr. Stearns for 2 minutes. 

OPENING STATEMENT OF HON. CLIFF STEARNS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF FLORIDA 

Mr. STEARNS. Thank you, Madam Chair. 

I think it is mentioned by the chairwoman, the FTC recently reported 9 million Americans have fallen victim to identity theft. And 

I think it is sort of puzzling, a corporation as strong and comprehensive as Sony, they would, you would think, have the ability 

to certify that their data is secure. As recently mentioned, over 45 

States have adopted a data breach notification requirement, but, of 

course, there is no law on a federal basis. So it is good that you 

folks are here so we can ask you some questions about, you know, 

7 

perhaps if you know who the people were, what was the requirements that you set up in a corporation as extensive as Sony, and 

do you think there is a criminal case here that should be prosecuted? So there are lots of questions so I appreciate your coming 

here. 

As many of you know, I had a bill when I was chairman of the 

subcommittee that we got out of the House. Unfortunately, it did 

not get through the Senate. And I have introduced it with Mr. 

Matheson again, which simply required the Federal Trade Commission to develop these regulations requiring persons that own or 

possess electronic data to establish necessary security policies and 

procedures, as well as notification mechanism. 

So both of our witnesses today certainly have within their power 

to provide the software, the data security provisions that are necessary. I think it must be puzzling to them as well as to us why 

this happened to them considering how sophisticated both of them 

are. I have had the opportunity to talk to them in my office, so it 

is very appreciative that you took the time to come here and talk 

to us and we look forward to your testimony. Thank you. 

Mrs. BONO MACK. I thank the gentleman. And the chair recognizes Mr. Olson for 1 minute. 

OPENING STATEMENT OF HON. PETE OLSON, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. OLSON. I thank the chairwoman for her leadership in calling 

this timely hearing. 

As we all learned this morning, overseas hackers from China 

hacked into Google email accounts. Like Sony, Epsilon, and now 

Google, my home State of Texas has experienced a massive data 

breach in April of this year when almost 3.5 million Texans had 

their personal information, their names, mailing addresses, and Social Security numbers compromised from the office of the Texas 

Comptroller of Public Accounts, and it was posted to a public server. 

There is a clear need for government, businesses, and citizens to 

work together to protect citizens’ personal information. I look forward to working with the chairwoman on comprehensive data security legislation. 

I thank the witnesses for coming. I yield back the balance of my 

time. 

Mrs. BONO MACK. I thank the gentleman and turn our attention 

to the panel. We have a single panel of very distinguished witnesses joining us today. Welcome. Each of you have a prepared 

statement that will be placed into the record, but if you could summarize your statements in your remarks, we would appreciate it. 

On our panel, we have Jeanette Fitzgerald, General Counsel for 

Epsilon Data Management, LLC. Also testifying is Tim Schaaff, 

President, Sony Network Entertainment International. Good afternoon, and thank you both very much for coming. You will each be 

recognized, as I said, for 5 minutes. To help you keep track of time, 

there is a clever little device in front of you: red, yellow, green. And 

when the light turns yellow, please summarize as you would a traffic light. 

8 

So Ms. Fitzgerald, you are recognized for 5 minutes. And please 

remember the microphone and pull it close to your mouth if you 

would. 

STATEMENTS OF JEANETTE FITZGERALD, GENERAL COUNSEL, EPSILON DATA MANAGEMENT, LLC; AND TIM SCHAAFF, 

PRESIDENT, SONY NETWORK ENTERTAINMENT INTERNATIONAL 

STATEMENT OF JEANETTE FITZGERALD 

Ms. FITZGERALD. Ranking Member Butterfield, and distinguished 

members of—— 

Mrs. BONO MACK. Sorry. Excuse me. Would you pull the microphone up? 

Ms. FITZGERALD. Closer? Better? 

Mrs. BONO MACK. Thank you. 

Ms. FITZGERALD. Good morning. Chairman Bono Mack, Ranking 

Member Butterfield, and distinguished members of the subcommittee, my name is Jeanette Fitzgerald, and I am the general 

counsel for Epsilon Data Management. Thank you for inviting me 

to present Epsilon’s testimony on data security. I hope that I can 

provide information today in going forward that will act as a helpful resource as you consider data security legislation that is in the 

best interest of both consumers and business. My full written testimony has been submitted for the record. I will summarize it here 

and hope to leave you with three main points. 

First, who is Epsilon and how do we provide important data 

management services for our clients? Second, how the attack of 

March 30 occurred and what we are doing to apprehend the perpetrators and improve our own data security. And finally, why we 

think national data breach notification legislation is important. 

Epsilon is the leading provider of permission-based email marketing services. Our clients, some of the world’s largest and bestknown consumer and financial services brands count on us to send 

their email messages to their customers, the individual consumer. 

And as we all know, major brands use email messages to provide 

consumers with timely information about new products and sales 

and events, among other things. Epsilon ensures that these email 

messages comply with applicable legal requirements, including 

CAN-SPAM Act. 

To earn and keep our clients’ trust, Epsilon became the first in 

the industry in 2006 to certify that its information security program complied with the standards issued by the International Association of Standardization, known as ISO. ISO, a highly regarded 

organization, is recognized by over 160 countries around the world, 

including the United States, as identifying best practices for information security management. The standards are demanding, requiring over a year to earn initial certification. We are proud that 

Epsilon leads the industry and that we have achieved yearly recertification, which requires proof that the company is improving its 

security program each year. 

Notwithstanding our internal security procedures and our compliance with these rigorous data security standards, as you know, 

Epsilon was the victim of a criminal hacking incident at the end 

9 

of March. Since our information security program was designed to 

identify and respond to attacks and threats, we were quickly able 

to detect the unauthorized download activity, which triggered 

Epsilon’s security incident response program. 

Our investigation, both internal and with an independent third 

party, is coordinated closely with the Secret Service and is still ongoing. But we can say that the initial investigation confirms that 

only email addresses and, in some cases, first and last names were 

affected by this attack. Again, only email addresses and, in some 

cases, first and last names were affected. The details of what happened after the attack are in my written statement that has been 

submitted for the record. We are greatly troubled that this criminal 

incident has called into question our commitment to data security. 

But I want to leave you with four main points about what happened and how Epsilon responded. 

First, our internal response to the criminal attack was immediate. We isolated computers and changed employee access rights. 

Second, our forensics investigation began within hours. We also 

reached out to law enforcement just as quickly. Third, notification 

to our clients also occurred on the same day, and we released a 

public statement and posted additional public information on our 

Web site shortly thereafter. And finally, now and going forward, we 

reiterate our commitment to working with the Secret Service, apprehending the hackers, and improving our own security. 

Companies like Epsilon are on the frontlines in the fight against 

data theft. We also believe Congress has an important role to play 

in protecting consumers. To that end, Epsilon fully supports legislation that would create a uniform standard for data breach notification. The current patchwork of over 45 individual State breach 

notification laws is confusing. A uniform national law, on the other 

hand, would provide predictability and equitable protection for consumers, regardless of their State of residence. 

Chairman Bono Mack, Ranking Member Butterfield, and members of the subcommittee, we look forward to working with you as 

the legislative process moves forward. I sincerely hope that the information I am able to provide at this hearing is helpful to the subcommittee as it considers this critical issue. Thank you. 

[The prepared statement of Ms. Fitzgerald follows:] 

10 


71258.001
11 


71258.002
12 


71258.003
13 


71258.004
14 


71258.005
15 


71258.006
16 


71258.007
17 

Mrs. BONO MACK. Thank you, Ms. Fitzgerald. And Mr. Schaaff, 

you are recognized for 5 minutes. 

STATEMENT OF TIM SCHAAFF 

Mr. SCHAAFF. Thank you. Chairman Bono Mack, Ranking Member Butterfield, and other distinguished members of the subcommittee, thank you for providing Sony with this opportunity to 

testify on cyber crime and data security. 

My name is Tim Schaaff and I am president of Sony Network 

Entertainment International, a subsidiary of Sony Corporation 

based in California, where we employ approximately 700 people in 

five offices around the State. I am chiefly responsible for the business and technical aspects of Sony’s PlayStation Network and Curiosity, an online service that allows consumers to access movies, television shows, music and video games. Sony Network Entertainment, Sony Online Entertainment—another subsidiary of Sony’s— 

and millions of our customers were recently the victims of an increasingly common digital age crime—a cyber attack. Indeed, we 

have been reminded in recent days of the fact that no one is immune from the threat of cyber attack. Businesses, government entities, public institutions, and individuals can all become victims. 

The attack on us, we believe, is unprecedented in its size and 

scope. Initially anonymous, the underground group associated with 

last year’s WikiLeaks-related cyber attacks openly called for and 

carried out massive denial-of-service attacks against numerous 

Sony internet sites in retaliation for Sony bringing action in Federal Court to protect its intellectual property. During or shortly 

after those attacks, one or more highly skilled hackers infiltrated 

the servers of the PlayStation Network and Sony Online Entertainment. 

Sony Network Entertainment and Sony Online Entertainment 

have always made a concerted and substantial effort to maintain 

and improve their data security systems. We hired a well respected 

and experienced cyber security firm to enhance our defenses 

against the denial-of-service attacks threatened by anonymous, but 

unfortunately, no entity can foresee every potential cyber security 

threat. 

We have detailed for the subcommittee in our written testimony 

the timeline from when we first discovered the breach. But to briefly summarize, the first indication of a breach occurred on Tuesday, 

April 19 of this year. On Wednesday, April 20, we mobilized an investigation and immediately shut down all of the PlayStation Network services in order to prevent additional unauthorized activity. 

After two highly respected technical forensic firms were retained to 

assist in a time-consuming and complicated investigation, on Friday, April 22, we notified PlayStation Network customers via post 

on the PlayStation blog that an intrusion had occurred. After a 

third forensic firm was retained, on Monday, April 25, we were 

able to confirm the scope of the personal data that we believed had 

been accessed. And although there was no evidence credit card information had been accessed, we could not rule out the possibility. 

Therefore, the very next day, Tuesday, April 26, we issued a public notice that we believed the personal information of our customers had been taken. And that while there was no evidence that 

18 

credit card data was taken, since we could not rule out the possibility, we had to acknowledge that it was possible. We also posted 

this on our blog and began to email each of our accountholders directly. We did not merely make statements on our blog. 

On Sunday, May 1, Sony Online Entertainment, a multi-player 

online videogame network, also discovered that data may have 

been taken. On Monday, May 2, just one day later, Sony Online 

Entertainment shut down this service and notified customers directly that their personal information may have also been compromised. Throughout this time, we felt a keen sense of responsibility to our customers. We shut down the networks to protect 

against further unauthorized activity. We notified our customers 

promptly when we had specific, accurate, and useful information. 

We thanked our customers for their patience and loyalty and addressed their concerns arising from this breach with identify theft 

protection programs for the U.S. and other customers around the 

world where available, as well as a welcome-back package of extended and free subscriptions, games, and other services. And we 

worked to restore our networks to stronger security to protect our 

customer’s interests. 

Let me address the specific issues you are considering today: notification of consumers when data breaches occur. Laws and common sense provide for companies to investigate breaches, gather 

the facts, and then report data losses publicly. If you reverse that 

order issuing vague or speculative statements before you have specific and reliable information, you either send false alarms or so 

many alarms that these warnings may be ignored. We therefore 

support federal data breach legislation and look forward to working 

with the subcommittee on the particulars of the bill. 

One final point—as frustrating as the loss of networks for playing games was for our customers, the consequences of cyber attacks 

against financial or defense institutions can be devastating for our 

economy and security. Consider the fact that defense contractor 

Lockheed Martin and the Oakridge National Laboratory, which 

helps the Department of Energy secure the Nation’s electric grid, 

were also cyber attacked within the past 2 months. 

By working together to enact meaningful cyber security legislation, we can limit the threat posed to us all. We look forward to 

this initiative to make sure that consumers are empowered with 

the information and tools they need to protect themselves from 

cyber criminals. Thank you very much. 

[The prepared statement of Mr. Schaaff follows:] 

19 


71258.008
20 


71258.009
21 


71258.010
22 


71258.011
23 


71258.012
24 


71258.013
25 


71258.014
26 


71258.015
27 


71258.016
28 


71258.017
29 


71258.018
30 


71258.019
31 


71258.020
32 


71258.021
33 


71258.022
34 


71258.023
35 


71258.024
36 


71258.025
37 


71258.026
38 


71258.027
39 


71258.028
40 

Mrs. BONO MACK. Thank you, Mr. Schaaff. And I would like to 

thank both of you for your opening statements, as well as for your 

unique insight into these disturbing data breaches. I am confident 

that the lessons learned with assist us in our efforts to develop new 

online safeguards for American consumers. 

And I am going to recognize myself for the first 5 minutes of 

questioning. 

And, Mr. Schaaff, given the extreme makeover of Sony’s online 

security protocols, it does beg the question why weren’t many of 

these safeguards, such as having a chief security information officer in place before the April data breaches? 

Mr. SCHAAFF. We believe that the security that we had in place 

was very, very strong and we felt that we were in good shape. 

However, as the attacks indicated, the intensity and sophistication 

of the hack was such that even despite those best measures that 

we had taken, it was not sufficient. And as we recognize moving 

forward that the scrutiny that we are likely to be under from the 

hackers will continue, we have made additional commitments to 

enhance the security of our networks. 

In addition, we had been working for some months now, more 

than 18 months to expand both the capacity and security of our 

network. We are a new business but we are a very fast-growing 

business. 

Mrs. BONO MACK. All right. Let me jump ahead. 

Mr. SCHAAFF. Sure. 

Mrs. BONO MACK. You indicated with Sony in the May 3 letter 

that you contacted the FBI on April 22, which was 2 days after it 

determined the breach had in fact occurred. Why did Sony wait 2 

days to notify law enforcement? 

Mr. SCHAAFF. My understanding is that we notified them as soon 

as we had something clear that we could report that indicated 

some sign of external intrusion that would be unauthorized or illegal. 

Mrs. BONO MACK. Your testimony indicates four servers were 

taken offline on April 19 before you pulled the plug on all 130 servers. Can you tell us what information was different that was stored 

on those initial four servers? 

Mr. SCHAAFF. Well, these were part of a larger network of machines and we believed this was just the first entry point that the 

hacker may have used to get into the network, and upon discovering them, we immediately shut them down. But there were other 

servers that were also attacked by the hackers as well. 

Mrs. BONO MACK. Some media reports indicate Sony’s servers 

may not have had up-to-date patches or firewalls prior to the attack. Is that true? 

Mr. SCHAAFF. That is actually patently false. The Apache servers 

were fully up to date, fully patched. And in fact, we had had several layers of firewalls in place, also contrary to so many of the 

things you may have read on the internet. As you know, the internet is not always a reliable source of factual information. 

Mrs. BONO MACK. And you state that you believe the cyber attack on Sony was unprecedented in both size and scope. Can you 

explain why you believe it is unprecedented? 

41 

Mr. SCHAAFF. Well, we believe that the sophistication of the attack, the collection of activities that were undertaken, the period 

of time in which the hackers were carefully exploring the network, 

and then ultimately the scope of the service that was breached 

makes it quite a remarkable attack. And despite the deep security 

measures that we had taken, it was nevertheless insufficient to 

guard against these attacks. 

Mrs. BONO MACK. Was the consumer data you held encrypted? 

And why or why not? 

Mr. SCHAAFF. So, of course, the credit card information that was 

held was encrypted. Password login data was protected using cryptographic hash functions. And these practices are in line with industry practice. 

Mrs. BONO MACK. Thank you. Ms. Fitzgerald, would greater security requirements have prevented your breach? And if not, what 

added protection are your new security measures providing? 

Ms. FITZGERALD. At the time, we had very extensive security as 

I noted in my opening statement and the written statement I provided. We have continued through the investigation to evaluate additional things that may be done to strengthen both our networks 

and any of the access points. We have also decided to hire some 

outside experts to even evaluate the network further and see if 

there is anything else in different parts of our network that need 

to be adjusted. 

Mrs. BONO MACK. Coming as a consumer who received multiple 

notices about your breach, there are also indications that consumers received notice of the breach from your business customers 

for which, in some cases, they hadn’t had a purchase or customer 

relationship for 4 or 5 years. Do you ever purge your data and why 

do you hold onto information for as long as you do? 

Ms. FITZGERALD. So let me step back a second to remind everyone how Epsilon plays in this. Epsilon is a service provider to the 

well-known names that you may have received notifications from, 

and they have the relationship with the consumer. What data we 

hold is determined by the client, and the client then tells us what 

to hold and what we then do with it in terms of sending out notices 

or any sort of marketing messages is entirely up to the client. It 

is not—— 

Mrs. BONO MACK. Do you advise them on when it might be a 

good time to purge data? 

Ms. FITZGERALD. It depends on what they want to do with the 

data. And there is also opt-out data that would have been held because in order to comply with CAN–SPAM, you have to maintain 

records of who has opted out. So if, 2 years ago, you opted out and 

you haven’t had any activity, that list would still be there because 

you have to comply with CAN–SPAM. So we have to be able to duplicate or de-duplicate and take those names out any time that we 

do a mailing. 

Mrs. BONO MACK. OK. Thank you. My time has expired. I will 

recognize the ranking member, Mr. Butterfield, for his 5 minutes. 

Mr. BUTTERFIELD. Thank you, Madam Chairman. 

Mr. Schaaff, let me start with you and if I have any time remaining, I will go over to Ms. Fitzgerald. 

42 

Mr. Schaaff, I understand that your internal investigation has 

not turned up any evidence suggesting that credit card data was 

taken from the network, but to me, that doesn’t necessarily mean 

that the data was not taken, just that you haven’t turned up any 

digital fingerprints that would allow you to know with certainty 

that it was taken. And I think you see what I am saying there. 

Help me with that. How certain are you that the data was not 

taken in the attack? 

Mr. SCHAAFF. Well, as you know, we have been engulfed in an 

intensive investigation over the past 6 weeks since the breach occurred, and we have looked deeply at the logs related to the databases. And in those logs we have found no clear evidence that there 

was any access made to the credit card information, and we found 

plenty of evidence that suggests that that data was not accessed. 

That is the basis for today’s statements that we do not believe the 

credit card information was compromised. 

Mr. BUTTERFIELD. Now, in your testimony, you mentioned that 

the attack took place on April 19, that the PlayStations were shut 

down on April 20, and that you did something on April 22. Help 

me with that if you could shed some light on what you did on April 

22. 

Mr. SCHAAFF. On April 22, this was the point at which we first 

notified consumers that there had been an intrusion. We were trying to understand what had happened to the network, and we were 

actively beginning the investigation of that breach. And at the 

point that we were able to determine that there had been an intrusion, we immediately notified consumers so that they would be 

aware of what had occurred, even though at that time we were not 

yet able to confirm precisely which data may have been compromised. 

Mr. BUTTERFIELD. So is it your testimony that on April 22, you 

began the process of notifying the consumers? 

Mr. SCHAAFF. Well, we notified them on the PlayStation blog of 

the intrusion, but then on April 26, we followed that up with an 

additional notification regarding more specifics related to the actual data that may have been breached and we began immediately 

notifying consumers starting from that date via email of the breach 

as well. 

Mr. BUTTERFIELD. But the April 22 announcement was simply on 

the internet? It was on the blog? 

Mr. SCHAAFF. That was posted on the PlayStation blog. The 

PlayStation blog is one of the most active and popular blogs on the 

web. It is currently ranked about number 20, just behind the White 

House blog. So it is a very, very expected place for our consumers 

to look for information. 

Mr. BUTTERFIELD. Do you have any way of knowing how many 

consumers actually read the statement? 

Mr. SCHAAFF. I don’t know the answer to that off the top of my 

head. We can investigate and—— 

Mr. BUTTERFIELD. But 7 days after the breach was when official 

notification was issued? 

Mr. SCHAAFF. We were not able to determine until the day that 

we had notified consumers. We were searching for evidence that 

43 

would allow us to confirm the status of the credit card information 

and not being able—— 

Mr. BUTTERFIELD. Do you think 7 days was a reasonable time? 

Mr. SCHAAFF. Actually, what has been interesting from my perspective is that we have continued this investigation in the successive weeks, and as you hear me speaking today, some of our conclusions with respect to credit card information have changed somewhat from our original statements. And that change has occurred 

because of the continuing investigation. In the abundance of caution, we acknowledge the possibility that credit cards would have 

been taken in our announcements on the 26th. But as you can see, 

the situation changes as the investigation proceeds, and we felt it 

would have been irresponsible if we had notified consumers earlier 

with partial or incomplete information. 

Mr. BUTTERFIELD. But you have, based on your experience here, 

made some corrections and some adjustments in the credit card 

data that you collect? 

Mr. SCHAAFF. We have been working to increase the security of 

the entire network and additional controls related to credit card 

data have also been put in place, yes. 

Mr. BUTTERFIELD. And how do these measures compare to those 

for the other types of personal information that you have, the credit card data versus the other information? 

Mr. SCHAAFF. Yes, excuse me. The credit card information is the 

most highly protected and guarded information. It is all encrypted 

and so even if it is taken, it is not likely to be useful to the hacker. 

Mr. BUTTERFIELD. Is it true that user passwords were hashed 

and not encrypted? Is that true? 

Mr. SCHAAFF. That is true. It is true that they were hashed using 

cryptographic hash functions. That is an industry practice which is 

very standard. It is not an unusual practice at all. 

Mr. BUTTERFIELD. Industry standard. Well, why don’t you use 

any type of encryption in your procedures? 

Mr. SCHAAFF. It is a form of protection that is very, very closely 

related to encryption, and I am not an expert in cryptography so 

I am not sure that I could answer the question in a more detailed 

way. 

Mr. BUTTERFIELD. What is irreversible encryption? 

Mr. SCHAAFF. Irreversible encryption is my understanding of the 

definition of a cryptographic hash. I am sorry. This is—wait. OK. 

Mr. BUTTERFIELD. Ms. Fitzgerald, your testimony states that 

Epsilon’s internal investigation revealed that the login credentials 

of the employee who reported unusual and suspicious download activity had been compromised. And in layman’s terms, I suppose, I 

assume this means that the employees credentials had been hijacked and been used by a hacker to carry out the intrusion into 

your network and to steal consumers’ email addresses. Can you 

please tell me a little bit more about what that means, that the 

employee’s login credentials were compromised? 

Ms. FITZGERALD. Well, what we had understood during the investigation is that the credentials were somehow used based on the 

logs, though not necessarily by that person, to actually download 

that information. That is why we then immediately—our system 

kicked into place and immediately we saw that there was improper 

44 

downloads and so our security system kicked in and then we knew 

that there was a problem and we shut their access down and anybody else who had credentials at that level and took that computer 

off the system. 

Mr. BUTTERFIELD. Thank you. My time has expired. 

Mrs. BONO MACK. I thank the gentleman and recognize the gentleman from Florida, Mr. Stearns, for 5 minutes. 

Mr. STEARNS. Thank you, Madam Chair. Let me be sure I understand, Ms. Fitzgerald, exactly what was taken. It is our understanding emails were taken and the name of the people whose 

email was taken. Is that correct? 

Ms. FITZGERALD. I am sorry. Was that to me? 

Mr. STEARNS. Yes. 

Ms. FITZGERALD. I am sorry. 

Mr. STEARNS. What was actually taken, as I understand it, is 

emails—— 

Ms. FITZGERALD. It was email addresses, and in some cases, first 

and last names. 

Mr. STEARNS. First and last names. OK. And that was all? 

Ms. FITZGERALD. Yes. 

Mr. STEARNS. And you said that you notified all 50 to 75 customers. Is that correct? 

Ms. FITZGERALD. There were about 50 customers of our clients, 

that were affected. 

Mr. STEARNS. OK. 

Ms. FITZGERALD. And we notified them. 

Mr. STEARNS. Would you provide the committee the complete list 

of those? 

Ms. FITZGERALD. The names of those clients are subject to agreements that we have with them, and we are supposed to keep those 

confidential. 

Mr. STEARNS. So you cannot provide us—— 

Ms. FITZGERALD. So we notified them promptly so they could—— 

Mr. STEARNS. No, I know you notified them, but you cannot provide the committee with these names? Is that what you are saying 

today? 

Ms. FITZGERALD. Not at this point, no. 

Mr. STEARNS. Now, I have in our material that some of these 

people are J.P. Morgan Chase, Capital One, Citibank, Best Buy, 

Verizon, Target, Home Shopping Network, and Verizon. Is that 

part of the 50 to 75? 

Ms. FITZGERALD. I recognize most of those names as being ones 

that sent us notification—— 

Mr. STEARNS. They are people that have huge number of people, 

so the impact of this 50 to 75, we cannot even comprehend how 

many Verizon has. So can you extrapolate, not telling us in detail, 

but if Verizon is one of your customers and you had a breach with 

the emails and names, does that mean that perhaps millions of 

names from Verizon had been breached? 

Ms. FITZGERALD. There could be many. 

Mr. STEARNS. Just yes or no. 

Ms. FITZGERALD. Yes. 

45 

Mr. STEARNS. Yes, oK. Now, with Sony, the question is, as I understand it, the password for the Sony PlayStation was breached. 

Is that correct? 

Mr. SCHAAFF. Well, we believe that there were a number of different types of information accessed, including first name and last 

name, address, date of birth, login, password, login address—— 

Mr. STEARNS. For the Sony PlayStation? 

Mr. SCHAAFF. For the Sony PlayStation Network, yes. 

Mr. STEARNS. OK. And what about their credit cards? 

Mr. SCHAAFF. As I said, we had originally stated that there was 

a possibility. We could not rule out the possibility that the credit 

card information had been accessed. At this point in time, we do 

not see any evidence that it has been. 

Mr. STEARNS. OK. When you look at the person’s credit card together with personal information, his password for Sony 

PlayStation, would one person have all of that breached for that 

one person or is it segmented so somebody got their password, 

somebody got their credit card, somebody got their person or is all 

this information together when it was breached? 

Mr. SCHAAFF. It is difficult for us to know exactly which data 

was taken, but it is likely that they would have been taken together, but we don’t know for which accounts that would have 

been. 

Mr. STEARNS. And what is a conservative estimate the number 

of people were affected by this breach? 

Mr. SCHAAFF. Well, so we have announced that there were approximately 77 million accounts that could have been accessed. 

When we took the network offline, obviously all of our customers 

were affected for the period of time that the network has been 

down, but that is part of the reason why we have provided the 

identity theft insurance, identity theft protection program, and 

these welcome back programs was to appreciate and acknowledge 

the loss of access to the network that our customers experienced 

and to address the concerns that they may have regarding the loss 

of their personal information. 

Mr. STEARNS. Is it true that you brought suit to protect your IP 

against the hackers of PlayStation III device? 

Mr. SCHAAFF. That is true. 

Mr. STEARNS. Why did you bring this suit? 

Mr. SCHAAFF. Well, just like the music industry and the movie 

industry, the PlayStation business is built upon intellectual property. Content providers invest millions of dollars to create titles 

that we then help them to distribute in our business and the employment of literally tens of thousands of people around the country. 

Mr. STEARNS. Knowing what has happened to you with this 

breach, would you say that you would do it again? 

Mr. SCHAAFF. I am sorry. I didn’t hear the question. 

Mr. STEARNS. Knowing what has happened with this breach, 

would you go ahead and have done that suit again in hindsight? 

Mr. SCHAAFF. Well, I think this is one of the great challenges 

right now is how do companies protect their content businesses? I 

mean I think we made the right decision. Did it have consequences? It appears to have had some fairly negative conVerDate Nov 24 2008 13:36 Aug 01, 2012 Jkt 037690 PO 00000 Frm 00051 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 112\112-55 060211\112-55 CHRIS
46 

sequences for the company. But if we hadn’t done something, I 

think it would be playing out in a different company later on. 

Mr. STEARNS. OK. 

Mr. SCHAAFF. I think this is a big issue for the Nation. 

Mr. STEARNS. Now, assuming we have federal legislation, do you 

think federal legislation to address security breaches would help? 

Because I understand both of you are in States where we have 

state legislation and that didn’t seem to necessarily force you to 

have a secure data security department. So why would federal legislation make it better than the States who have already passed? 

And you didn’t comply, evidently, with the States. 

Mr. SCHAAFF. Well, actually, I think that the issue regarding the 

States’ rights—I am not a lawyer. Let me mention up front I am 

not a lawyer. 

Mr. STEARNS. Right. 

Mr. SCHAAFF. But my understanding here is that there are a variety of laws in a number of the States, but the laws are often 

seemingly in conflict and they can create very complicated situations for us to understand how we should behave properly with regard to notification obligations. Regarding the security of the network, I think the evidence of Epsilon, of Sony, of many other companies that have been reported in the news in the last several 

weeks indicates that despite spending millions of dollars to secure 

your networks, despite all of the best methods known to us, our 

networks are not 100 percent protected. It is a process that requires continual investment, and we do that, but I think without 

additional support from the government, it is unlikely we will all 

collectively be successful, and that will threaten the livelihood of 

the internet, the growing internet economy. 

Mr. STEARNS. Thank you. 

Mrs. BONO MACK. The gentleman’s time has expired. The chair 

recognizes Mr. Guthrie for 5 minutes. 

Mr. GUTHRIE. Thank you, Madam Chairman, for having this 

hearing. I appreciate it very much. 

So just to follow up on what Mr. Stearns said, the patchwork of 

state laws, the different state jurisdictions complicated your ability 

to respond? You didn’t say that. Is that what I heard? 

Mr. SCHAAFF. I was responding specifically to the issue about the 

notification obligation. 

Mr. GUTHRIE. Right, the notification state laws. 

Mr. SCHAAFF. It is my understanding that there are some conflicting obligations there. 

Mr. GUTHRIE. So a federal standard would be—— 

Mr. SCHAAFF. A federal standard that would preempt the states 

would be extremely helpful. 

Mr. GUTHRIE. OK. I just want to get kind of the nature—so Epsilon is a vendor for you? Is Epsilon a vendor for Sony? So did the 

hacker go to Epsilon into Sony or Sony to Epsilon to get to the 

other—how did that work? 

Mr. SCHAAFF. I am sorry. Let me clarify. These are actually two 

completely separate breach events. 

Mr. GUTHRIE. OK. 

Mr. SCHAAFF. So the activity at Epsilon was completely unrelated to—as far as we know—what happened at Sony. 

47 

Mr. GUTHRIE. So you are not a vendor with Epsilon? This is two 

completely separate—oK. So the other customers—oK. I was thinking—I apologize. But your other customers, they came—the Epsilon, they got to your system, and then through your system were 

able to—at least the companies that you notified, the Verizons, the 

Krogers that was mentioned earlier, that was how that breach 

worked? 

Ms. FITZGERALD. So as a vendor, our ability to send out email addresses on behalf of those clients requires us to maintain those 

email addresses for them. 

Mr. GUTHRIE. Right. 

Ms. FITZGERALD. And that is how the hackers got in and got that 

information. 

Mr. GUTHRIE. OK. OK. Has Sony been victim before of any type 

of breach? And if so, how did that—not to this level, I know, 

but—— 

Mr. SCHAAFF. We certainly experience a constant level of fraud, 

and we are under regular probing by hackers and others. I mean 

I think it is a standard part of anybody who is in the internet business these days. 

Mr. GUTHRIE. And for both of you, too, I know I am manufacturing background and we did ISO 9000, which was a set of standards for quality control. They have ISO 14000, a set of standards 

for environmental—and they are good practices to follow, but they 

leave a lot of interpretation to the businesses because otherwise 

they are formed by committee, and it would be difficult to change 

every time something needs to be changed. I am not familiar with 

this particular standard that you are talking about, but is it sufficient if you follow the ISO standards to—I guess my question is 

your industry is so fast-changing that when you are in the automotive industry, which I am in, you put a standard in place, it 

takes a while for things to innovate that the standard is out of 

date. It appears to me when I saw ISO that it would be difficult 

for them to keep up with the changes in the industry or, I guess 

what I am saying, the ability of people who hack to innovate to find 

new ways into your system. So is it sufficient—I guess ISO being 

certified sufficient, you think? 

Ms. FITZGERALD. We don’t use the ISO as the only thing we do. 

We have lots of audits by our clients. We have 70 audits we have 

to do. And then, frankly, we have our own security program where 

we are continually trying to upgrade our systems and to make sure 

that we make things as tight as we can, but the hackers are very 

sophisticated. This wasn’t some guy in a garage just coming after 

us. These are sophisticated guys. And I have talked to the Secret 

Service enough times now to know that we are not the only one 

and that they are working with the FBI. And there is a concerted 

effort to go after these guys. 

Mr. SCHAAFF. Um-hum. Yes, I would concur. I mean I think 

these guidelines and standards are important for the industry to 

move forward, but they are far from sufficient. And if they had 

been sufficient, I, you know, I wouldn’t be here. And I think that 

we are all under attack and without additional measures to be 

taken and without kind of constant renewal of our practices, it is 

not going to be sufficient to fight the latest attacks. 

48 

Mr. GUTHRIE. OK. Thank you. I guess one thing that I am really 

kind of concerned about as we move forward, I know Sony—any 

time you spend money because somebody did something illegal, 

that is an inefficiency to everybody. But the two- or three-store 

small business in Kentucky that maintains their clients files and 

just having the resources to be able to respond to protect their clients, to protect their customers. And just do you have any estimate 

of how much money just these events are going to cost your firm 

and hits, you know, the economy overall because that is what—— 

Mr. SCHAAFF. I believe we have made statements publicly esti- mating a cost something in the range of $170 million for this particular incident. And obviously, as you note, for smaller businesses, 

number one, the ability to secure their networks as effectively is 

less because of the economics of that. And the evidence that I have 

seen in various reports suggest that the prevalence of successful attacks on small and midsize businesses is even higher than we see 

with the larger companies. It is a scary situation. 

Mr. GUTHRIE. Well, thank you. I yield back to the chairwoman. 

Mrs. BONO MACK. I thank the gentleman and the chair notes 

that we are being called to the floor for votes. My intention is to 

try to get through two more member questioning 5-minute segments before we recess. So the chair now recognizes Mr. Olson for 

5 minutes. 

Mr. OLSON. I thank the chairwoman. And again, I thank the witnesses for coming and giving us your expertise, your time today. 

As I stated in my opening statement, my home State of Texas 

experienced a serious and troubling data breach earlier this year. 

Names, addresses, social security numbers, and in some cases, 

birthdates and drivers’ license numbers of state retirees and unemployment beneficiaries were posted unencrypted on a public server. 

In response, our state attorney general and the FBI have launched 

a criminal investigation into this data breach. Unfortunately, these 

kind of breaches are happening more frequently and they cause 

businesses tens of billions of dollars annually. The Federal Trade 

Commission estimates that 9 million individuals in the United 

States have their identities stolen every year. This is the equivalent of approximately 17 identities stolen every minute. That 

means that during the course of this hearing, if all of my colleagues 

and I take up our full 5 minutes, 85 IDs across this country will 

have been stolen. 

In response to the Texas data breach, the comptroller of public 

accounts launched a Web site called Texas Safeguard, which was 

created as a tool for Texans to receive up-to-date information about 

the breach, along with recommended security steps to take. And of 

note, they actually put a toll-free number up for folks to call and 

the comptroller is offering credit monitoring at no charge. There is 

also a frequently-asked-questions page which outlines six steps 

people can take to protect themselves. 

But this burden is placed upon these victims of this breach and 

they have got to spend their own time enrolling in credit monitoring, placing fraud alerts on their credit files, requesting credit 

reports, and so on, and so on, and so on. Ms. Fitzgerald, Mr. 

Schaaff, given the breaches your companies have experienced and 

all the heartache and lost revenue, all the upset customers, all the 

49 

resources you have had to expend to determine how these breaches 

occurred, I don’t want to put words in your mouth, but you do 

think that there is a clear need for a comprehensive federal data 

breach and notification law, one that will create a uniform standard and preempt the current patchwork of state laws? Yea, nay? 

Ms. FITZGERALD. I do believe that it would be great if we had a 

federal data breach notification law that did preempt all of the 

state laws so it would be straightforward and companies would 

know exactly what they needed to take care of and who they needed to notify and when they needed to notify? 

Mr. OLSON. Mr. Schaaff? 

Mr. SCHAAFF. Sony is also very supportive of such legislation and 

we would be very happy to participate and help in the formation 

of that legislation. 

Mr. OLSON. All right. Thank you. And Ms. Fitzgerald, this is just 

for you, but why did you choose to contact law enforcement, the 

FBI, and the Secret Service as soon as you became aware of the 

incident? And is this a typical response for Epsilon to get law enforcement involved when a breach occurs when you don’t necessarily know the extent of it? 

Ms. FITZGERALD. Well, we knew pretty quickly that there had 

been some data that had been downloaded and taken by somebody 

who wasn’t authorized, and therefore, it was a criminal act in our 

mind. And so we went to look for law enforcement, the right ones 

to help us go after the bad guys. 

Mr. OLSON. OK. And for you, Mr. Schaaff? I know you and 

PlayStation had one heck of an April. But why did you conclude 

that notifying PlayStation Network customers via the PlayStation 

blog was, as you stated, ‘‘one of the best, fastest, and most direct 

means of communicating with customers?’’ 

Mr. SCHAAFF. In the years that PlayStation has been in business, 

we have managed this blog and it has become a very, very popular 

source of information for our customers about new game titles and 

all kinds of information related to PlayStation. And we know that 

it is a good way to get a message out to customers quickly. Of 

course, that wasn’t the only way we communicated with our customers. We did follow up with public announcements through other 

channels, as well as email, direct emails to the consumers following 

the breach. 

Mr. OLSON. OK. And one final question about sort of how you are 

prepared for this. I mean I know, Ms. Fitzgerald, for your testimony Epsilon had reactive plans in place ready to go if some sort 

of breach happened, and I assume that is the same for Sony. 

Mr. SCHAAFF. Absolutely. 

Mr. OLSON. But, I mean, is there a specific entity within both of 

your companies that is proactive? I mean somebody you have got 

in your company that sort of looks at your security systems and 

tries to penetrate it, tries to find the weaknesses; I mean sort of 

a proactive approach instead of reacting to a breach, preventing a 

breach by recognizing weaknesses within the company? 

Mr. SCHAAFF. We have a successful approach the security involved both proactive as well as reactive approaches, and we definitely have those kinds of resources in place in my company and 

in Sony Corporation as a whole, an important part of our process. 

50 

Ms. FITZGERALD. And I would agree with that also. Epsilon has 

that. 

Mr. OLSON. OK. I see I am down to 16 seconds. I thank the witnesses again for your time. And at the risk of getting crosswise 

with the chairwoman and Mr. Stearns left, but go Mavericks. 

Mr. SCHAAFF. Thank you. 

Mrs. BONO MACK. The chair recognizes Mr. Harper for 5 minutes. 

Mr. HARPER. Thank you, Madam Chair. I would ask you, Mr. 

Schaaff, why did it take Sony approximately 7 days to notify customers that their personal data had been compromised? 

Mr. SCHAAFF. Well, the basic essence here was the find the right 

balance between notifying customers as soon as we had some sense 

that something had gone wrong but not being irresponsible in that 

notification and creating undue stress or concern within the customer base. We immediately began an investigation and we were 

able to notify customers within a couple of days that we had had 

an unauthorized external intrusion. But it took us several more 

days to be able to clearly discern what information had been taken 

and even at that point, we were not able to rule out the possibility 

that credit card information had been taken. Nevertheless, we went 

ahead and made a public statement regarding the potential of 

those losses. 

Mr. HARPER. I just want to be clear. So how long was it before 

any customers got notification? 

Mr. SCHAAFF. We first discovered unusual activity on the 19th. 

We shut down the network on the 20th of April, and we notified 

consumers on the 22nd of April. So it was basically 2 days. 

Mr. HARPER. Did you notify all the consumers at that point? 

Mr. SCHAAFF. Well, so at that point we were intensely involved 

in this investigation to try to figure out what to notify the customers about. And so at that time we notifying using the blog that 

we believed that there had been an intrusion. And then beginning 

on the 26th when we made a lot of public announcements related 

to specific information that may have been lose we initiated 

through news channels, obviously our blog, as well as through a direct email campaign to the customers detailed information about 

the nature of the loss. 

Mr. HARPER. How many notifications did each consumer receive? 

Mr. SCHAAFF. Well, my understanding is that in regard to the 

Sony PlayStation breach, that should have been approximately 77 

million emails that were sent. 

Mr. HARPER. Now, I understand but were they notified more 

than one time as you learned additional information? 

Mr. SCHAAFF. Well, we notified via the blog on the 22nd. We provide updates on that blog on a regular basis as to kind of the concurrent state of affairs, but I believe in terms of the email notifications related to the potential loss of data, that was a one-time 

event. 

Mr. HARPER. Do you believe the news that you passed on, looking 

back now, do you believe it was done quickly enough? 

Mr. SCHAAFF. What I would say is that we tried very, very hard 

to find the right balance there, and I believe that if we had responded earlier, it would have probably been irresponsible. Even to 

51 

this day we question whether we should have taken a little bit 

more time to finish the investigation with regard to the credit card 

information. I believe we probably struck the right balance, but it 

was a tough call. 

Mr. HARPER. And I know there was a letter that was sent out 

on May 3 where you had indicated that there was no evidence of 

misuse of the customers’ personal information that was accessed 

during that breach. We are a month past that point. Is that still 

your position on that? 

Mr. SCHAAFF. When we talked to the credit card companies, they 

have still told us that they see no signs of unusual activity related 

to this breach. 

Mr. HARPER. And do you know where the attacks originated? 

Mr. SCHAAFF. Unfortunately, at this time we don’t. 

Mr. HARPER. OK. 

Mr. SCHAAFF. We are working with law enforcement and others 

to try to figure that out, but at this time we don’t have any 

clear—— 

Mr. HARPER. Of course, we certainly hear media reports or speculation, and I know you don’t have it with any certainty, but there 

was one report that initially suggested that Amazon’s pay-per-use 

cloud service may have been used. Is there any accuracy to that or 

any proof of that? 

Mr. SCHAAFF. Well, so what I know is the FBI is investigating 

that report, and at this time I don’t have any other information 

about whether that is true or not. 

Mr. HARPER. Now, does Sony Online Entertainment and Sony 

Network Entertainment, are they using the same server models 

and security protections and the software? 

Mr. SCHAAFF. We comply with the same types of industry practices and are subject to the same policies as far as being a part of 

the Sony Corporation. The specific architecture of each of those 

services is probably different because the types of services that we 

provide are different. But, you know, across the industry, most 

internet service providers are building their services out of largely 

the same basic components so there is probably a lot of commonality there. 

Mr. HARPER. Thank you. Madam Chair, I yield back the balance 

of my time. 

Mrs. BONO MACK. I thank the gentleman. And at this point in 

time we are going to recess the committee to head over to the floor 

for vote. And our intention is to return as soon after as we can 

from the series of votes. It should be about 45 minutes is my guess. 

Things could change. So the subcommittee stands recessed until 

after the last vote on the floor. 

Ms. FITZGERALD. Thank you. 

[Recess.] 

Mrs. BONO MACK. The subcommittee will reconvene and come to 

order obviously. I wanted to thank you very much for indulging us 

and apologize that there has been a slight little change of plans 

with the minority headed over to the White House for a very important meeting with the President. We have agreed that we would 

conclude questions. 

52 

But before I do that, I would like to offer the two of you the opportunity to give us any final thoughts you might have and any 

recommendations for legislation as we move forward in the process 

here. So I recognize each of you for 5 minutes to do that. And you 

don’t have to take the full 5 minutes if you would like, but the time 

is yours if you would like it. 

Ms. FITZGERALD. Thank you. Honestly, as we have thought about 

this, we would greatly appreciate the opportunity to work with you 

and your staff and any members of your subcommittee to create a 

national data breach notification standard. The details within it 

would have to be worked out as we think through what would be 

all the ramifications. And I think clearly I would not be the only 

one with experience, but we would love to work with that on you. 

Mrs. BONO MACK. Mr. Schaaff? 

Mr. SCHAAFF. Thank you. I want to thank you again for the opportunity to come and speak today and especially thank you for all 

the work you have done related to intellectual property protection. 

This is a really critical part of the work we are trying to do to build 

and grow our business. 

As you heard in our testimony today and in the private session 

where we shared more technical details regarding the breach yesterday, despite taking what we believe to be extremely appropriate 

and substantial steps to build a safe and protected network, hackers were able to get into the network. The thing that is frightening 

about this is it is easy to focus on Sony and look at the things that 

we might be able to do in the future to strengthen our network, but 

the reality is because we are all building our networks out of the 

same basic ingredients, if there is a weakness in the way that we 

have built things, chances are, the weaknesses may lie in the components that we rely on from the variety of vendors that we all 

build our products out of. And I think that we are working together 

as industry to try to strengthen our processes and our practices 

and our technologies, but I think the conclusion that I would leave 

you with today is that without further assistance from the government, I think that we are all going to have a world of hurt in this 

internet economy. And we really would appreciate and request your 

assistance. 

And regarding the specific legislation, we are also extremely supportive of this and would welcome the opportunity to contribute 

and speak to you further regarding its development. Thank you. 

Mrs. BONO MACK. Well, I thank you both very much. And Mr. 

Schaaff, I would also like to address a comment earlier about the 

question of would you or would you not file suit again to protect 

your intellectual property, and I wanted to commend you on your 

answer. And I am glad that you did it then. And you know, too 

often people are afraid of being hacked and the retribution because 

of the decisions you make. 

Mr. SCHAAFF. It can be a lonely place. 

Mrs. BONO MACK. Well, I want to applaud you for that. And 

again, thank you both very much for the spirit with which you 

came before us today and the spirit of cooperation. I think the committee is very excited about the opportunity to work with you and 

to craft good legislation. 

53 

So we have a unique opportunity now as a subcommittee to make 

certain that the future cyber attacks on American consumers will 

never again be a silent crime. 

So at this point I would like to remind all members they have 

10 business days to submit questions for the record, and I ask witnesses to please respond promptly to any questions they receive. 

And the hearing is now adjourned. 

Mr. SCHAAFF. Thank you very much. 

Ms. FITZGERALD. Thank you very much. 

[Whereupon, at 2:14 p.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

PREPARED STATEMENT OF HON. HENRY A. WAXMAN

I would like to thank Chairman Bono Mack and Ranking Member Butterfield for 

following this important issue. Data security is not a partisan issue. It is an issue 

that affects all of us because sooner or later everyone is vulnerable to cyber attacks: 

private sector companies of all sizes; federal, state and local governments; and the 

American public. 

Just yesterday, we learned of an attempted attack on Google email accounts that 

included efforts to steal email passwords and other information from high-ranking 

government and military officials—a stark reminder of the financial and national 

security risks posed by hackers. 

At last month’s hearing titled ‘‘The Threat of Data Theft to American Consumers,’’ 

we reviewed how the federal government investigates data breaches and what it 

should do to ensure that private sector companies protect the personal information 

of their consumers. 

Today we are going to hear from Sony and Epsilon, two companies that recently 

suffered massive data breaches. 

We have all heard the numbers: the personal information in over 100 million user 

accounts was compromised in the Sony breach. The customers of more than 50 

major corporations were affected by the Epsilon breach, including customers of Target, Best Buy, JP Morgan, and US Bank. 

While we will delve into the specifics of these two breaches, the point isn’t to 

make an example of these two companies. We need to know how these breaches 

happened and to find out what these companies are doing, and what they can do 

better. And we need to understand the appropriate federal role in this area. We 

need a government that can partner with companies to make sure they do a better 

job protecting the information they demand of consumers. 

As I said at the last hearing, the private sector can, and must, safeguard personal 

information. If companies do not take reasonable steps to guard their data and they 

suffer a cyber attack or data breach, the cost to consumers can be immense. 

When it comes to data security, prevention is the best medicine and certainly the 

cheapest. Yet too many companies are not doing enough prevention and consumers 

are paying the price. 

We in Congress also have a role; we can conduct oversight and legislate when 

needed. The recent attacks on Sony, Epsilon, and now Gmail are proof that it is indeed time to legislate. In particular, Congress should pass the Data Accountability 

and Trust Act; H.R. 2221 from the 111th Congress. 

The bill requires companies to have reasonable data security measures in place 

and to notify consumers once a breach has occurred. It passed the House last Congress with strong support from both sides of the aisle. We should take swift action 

to pass it in this Congress. 

I look forward to today’s hearing and working together to ensure that the private 

sector is doing all that it can to protect the personal information of the American 

people. 

PREPARED STATEMENT OF HON. EDOLPHUS TOWNS

Thank you Chairman Bono-Mack and Ranking Member Butterfield for holding 

this hearing today on the importance of Data Security to our nation. The information age has ushered in a new era in technology that offers many Americans the 

ability to access, store and transfer massive amounts of information at any given 

time. With the advent of the internet and the advancement of e-commerce, AmeriVerDate Nov 24 2008 13:36 Aug 01, 2012 Jkt 037690 PO 00000 Frm 00059 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 112\112-55 060211\112-55 CHRIS
54 

cans have been able to engage in a variety of online activities that require personal 

information to be shared in cyber space. 

Unfortunately more often than not this information is compromised by computer 

savvy individuals that use this information to access the identity of their victims. 

Data breaches have become more common in recent years due to the massive 

amounts of personal information that are stored on computer servers which many 

people thought were secure. In April of this year Sony Corporation and Epsilon Data 

Management revealed they had been involved in two of the biggest data breaches 

this year. Sony made public that its Play Station Network had been breached on 

April 26th, 2011; however the breach took place one week prior to their notification 

of Play Station account holders. The Sony Play Station Network has over 77 million 

accounts that were compromised due to this lapse in security. It is my hope that 

this hearing will shed light on how this breach was able to take place and why it 

took a week for Sony to notify its account holders. 

Epsilon Data Management LLC is one of the largest email marketing companies 

in the country. Over 40 billion emails are sent from this company annually to consumers. On April 1, 2011 Epsilon revealed that an unauthorized entry to its email 

system had occurred, exposing the personal information of several million customers 

of companies employing Epsilon for marketing purposes. Reportedly consumer information had been available for months. 

Consumers must feel safe in knowing that the information that they share with 

companies involved in e-commerce is safe and secure. The recent data breaches at 

the Sony Corporation and Epsilon Data Management raise questions about what 

protocols are in place to protect consumers against hackers who would do them 

harm. Currently there is no comprehensive federal law that requires all companies 

that hold consumer’s personal information to implement reasonable measures to 

protect that data. 

I look forward to working with my colleagues on this committee to ensure the 

American people that their personal information is kept safe from malicious cyber 

attacks. 

Thank you madam chair, I yield my time. 

55 


71258.046
56 


71258.047
57 


71258.048
58 


71258.029
59 


71258.030
60 


71258.031
61 


71258.032
62 


71258.033
63 


71258.034
64 


71258.035
65 


71258.036
66 


71258.037
67 


71258.038
68 


71258.039
69 


71258.040
70 


71258.041
71 


71258.042
72 


71258.043
73 


71258.044
74 

Æ 


71258.045