U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

57–673 PDF 2010

ONLINE PRIVACY, SOCIAL NETWORKING, 

AND CRIME VICTIMIZATION 

HEARING 

BEFORE THE

SUBCOMMITTEE ON CRIME, TERRORISM, 

AND HOMELAND SECURITY 

OF THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED ELEVENTH CONGRESS 

SECOND SESSION 

JULY 28, 2010 

Serial No. 111–144 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 

(II) 

COMMITTEE ON THE JUDICIARY 

JOHN CONYERS, JR., Michigan, Chairman 

HOWARD L. BERMAN, California 

RICK BOUCHER, Virginia 

JERROLD NADLER, New York 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

MELVIN L. WATT, North Carolina 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

WILLIAM D. DELAHUNT, Massachusetts 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO PIERLUISI, Puerto Rico 

MIKE QUIGLEY, Illinois 

JUDY CHU, California 

TED DEUTCH, Florida 

LUIS V. GUTIERREZ, Illinois 

TAMMY BALDWIN, Wisconsin 

CHARLES A. GONZALEZ, Texas 

ANTHONY D. WEINER, New York 

ADAM B. SCHIFF, California 

LINDA T. SA ́ NCHEZ, California 

DANIEL MAFFEI, New York 

JARED POLIS, Colorado 

LAMAR SMITH, Texas 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

ELTON GALLEGLY, California 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

DARRELL E. ISSA, California 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TOM ROONEY, Florida 

GREGG HARPER, Mississippi 

PERRY APELBAUM, Staff Director and Chief Counsel 

SEAN MCLAUGHLIN, Minority Chief of Staff and General Counsel 

SUBCOMMITTEE ON CRIME, TERRORISM, AND HOMELAND SECURITY

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia, Chairman 

PEDRO PIERLUISI, Puerto Rico 

JERROLD NADLER, New York 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

STEVE COHEN, Tennessee 

ANTHONY D. WEINER, New York 

MIKE QUIGLEY, Illinois 

TED DEUTCH, Florida 

LOUIE GOHMERT, Texas 

TED POE, Texas 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

J. RANDY FORBES, Virginia 

TOM ROONEY, Florida 

BOBBY VASSAR, Chief Counsel 

CAROLINE LYNCH, Minority Counsel 

(III) 

C O N T E N T S 

JULY 28, 2010 

Page 

OPENING STATEMENTS 

The Honorable Robert C. ‘‘Bobby’’ Scott, a Representative in Congress from 

the State of Virginia, and Chairman, Subcommittee on Crime, Terrorism, 

and Homeland Security ....................................................................................... 1 

The Honorable Louie Gohmert, a Representative in Congress from the State 

of Texas, and Ranking Member, Subcommittee on Crime, Terrorism, and 

Homeland Security ............................................................................................... 2 

The Honorable Bob Goodlatte, a Representative in Congress from the State 

of Virginia, and Member, Subcommittee on Crime, Terrorism, and Homeland Security ........................................................................................................ 4 

WITNESSES 

Mr. Gordon M. Snow, Assistant Director, Federal Bureau of Investigation, 

United States Department of Justice, Washington, DC 

Oral Testimony ..................................................................................................... 5 

Prepared Statement ............................................................................................. 8 

Mr. Michael P. Merritt, Assistant Director, United States Secret Service, 

United States Department of Homeland Security, Washington, DC 

Oral Testimony ..................................................................................................... 13 

Prepared Statement ............................................................................................. 15 

Mr. Joe Sullivan, Chief Security Officer (CSO), Facebook, Inc., Palo Alto, 

CA 

Oral Testimony ..................................................................................................... 23 

Prepared Statement ............................................................................................. 26 

Mr. Marc Rotenberg, Executive Director, Electronic Privacy Information Center (EPIC), Washington, DC 

Oral Testimony ..................................................................................................... 40 

Prepared Statement ............................................................................................. 42 

Mr. Joe Pasqua, Vice President for Research, Symantec, Inc., Washington, 

DC 

Oral Testimony ..................................................................................................... 54 

Prepared Statement ............................................................................................. 56 

APPENDIX 

Material Submitted for the Hearing Record .......................................................... 77 

(1) 

ONLINE PRIVACY, SOCIAL NETWORKING, 

AND CRIME VICTIMIZATION 

WEDNESDAY, JULY 28, 2010 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON CRIME, TERRORISM, AND HOMELAND SECURITY

COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Subcommittee met, pursuant to notice, at 2:19 p.m., in room 

2141, Rayburn House Office Building, the Honorable Robert C. 

‘‘Bobby’’ Scott (Chairman of the Subcommittee) presiding. 

Present: Representatives Scott, Lofgren, Quigley, Deutch, 

Gohmert, Goodlatte, and Lungren. 

Staff present: (Majority) Bobby Vassar, Subcommittee Chief 

Counsel; Jesselyn McCurdy, Counsel; Ron LeGrand, Counsel; Joe 

Graupensperger, Counsel; Liliana Coronado, (Fellow) Federal Public Defender’s Office Detailee; Veronica Eligan, Professional Staff 

Member; (Minority) Caroline Lynch, Counsel; Kimani Little, Counsel; Art Baker, FBI Detailee; and Kelsey Whitlock, Legislative Assistant. 

Mr. SCOTT. Subcommittee will now come to order. And I want to 

apologize for starting late. We had a Judiciary Committee bill on 

the floor, and the rules prohibit us having a bill on the floor and 

meeting at the same time, so I am glad that that bill didn’t take 

very long. 

I am pleased to welcome you today to this hearing before the 

Subcommittee on Crime, Terrorism and Homeland Security about 

Internet Privacy, Social Networking and Crime Victimization. 

The Internet presents individuals, in their personal and professional capacities, numerous opportunities to share personal information. Some of the information disclosed by individuals is done so 

incidental to the use of the Internet. 

So for example, in order to use various online accounts for services such as e-mail, shopping and messaging, consumers also must 

establish passwords, reveal credit card numbers, and divulge other 

personally identifiable information. 

In other circumstances, the sharing of information is central to 

a particular use of the Internet. For example, some Internet users 

actively share information, much of it extremely personal, through 

social networking sites. 

Both categories of information present unique privacy challenges. 

This hearing will examine these issues and risks of criminal victimization. 

2 

Of course, we know that criminals are constantly devising new 

ways to infect the computers of Internet users with various types 

of malware. Much of this malware is intended to capture the private information of individuals and report it back to the criminal 

to be used in the next step to the scheme, often involving some 

form of identity theft. 

We have Federal and state laws prohibiting this type of crime, 

but it is important that consumers know what they can do to protect themselves and that we demand that the Internet companies 

take appropriate steps to ensure the security of this information. 

This is part of what we will focus on today, but we also want to 

pay particular attention to the special risk to victimizations based 

on participation in social networking. 

Based on the widespread popularity of social networking sites, 

such as Facebook, there is no doubt that these sites provide an enjoyable and unique experience to their users. Those who use these 

sites are able to share information with their friends, find old 

friends, and establish new friendships. And in so doing, they share 

and broadcast some of the most sensitive and intimate details of 

their lives. 

Unfortunately, there are those who seek out and exploit the details to perpetrate criminal acts. For example, personal details 

shared on these sites may allow criminals to guess a user’s forgotten password clues for various online accounts. 

Burglars have targeted people’s homes based on information 

found on Facebook pages that the resident is on vacation and not 

at home. And based on fears about possible victimization of young 

people by Internet predators, Facebook has agreed to install a 

panic button on user pages hosted on its U.K. Web site so suspicious behavior can be reported to the authorities immediately. 

One scheme that has proliferated involves hijacking of a 

Facebooker’s user’s account by a criminal who sends a financial distress call to the user’s friends on that Facebook page, asking them 

to wire money to an account which is, unbeknownst to them, actually that of the criminal. 

To discuss all these types of issues, we have a panel of witnesses 

representing a broad spectrum of experience and various Internet 

privacy issues from perspectives of law enforcement, industry, and 

privacy advocacy. 

Before we proceed with their testimony, it is my pleasure to recognize the Ranking Member of the Subcommittee, my colleague 

from Texas, Judge Gohmert. 

Mr. GOHMERT. Thank you, Mr. Chairman. I do appreciate you 

holding this hearing on a very important topic, privacy, social networking and crime victimization have become competing interests 

as the Internet continues to revolutionize the way we conduct commerce, seek employment, keep up with family and friends, make 

new friends, and communicate in general. 

The Internet’s impact on communication and on society is often 

compared to the impact that the invention of the printing press 

had on the literary market. We are in the midst of a technology 

evolution like never seen before. 

Every year, or even more frequently, there is some new gadget 

that is faster and smaller than its predecessor, or capable of doing 

3 

something that was never thought possible. This has certainly been 

true in all aspects of personal computing and the development and 

access to the Internet. 

The Internet has not only facilitated communication, but other 

aspects of everyday life, as well. We no longer have to go to the 

post office to pay a bill. We can buy books, food, furniture, just 

about every other thing without going to a store. We can now look 

for a new home or a new car at any hour of the day simply by logging on. 

Unfortunately, with these benefits and conveniences come new 

ways to commit crimes and new ways to exploit our personal information. The conveniences generally seem to outweigh the risk. But 

by educating ourselves about the potential risk and vulnerabilities 

created by these conveniences, Internet users can help prevent the 

spread of identity theft and other crimes on the Web. 

Identity thieves who hack into your personal computer or a merchant computer, steal your personal information, have received considerable attention by the media and Congress. People have become 

aware of identity theft, interchanging their habits to prevent becoming a victim. 

You don’t have to look any further than the popularity of personal shredding machines to realize that habits do often change 

when there is awareness of the risk. 

But there are new schemes and new variations of old schemes 

employed by criminals to defeat the security measures and actions 

taken by a concerned public. For instance, within the last few 

months, staff of this Committee received e-mails supposedly from 

a former staffer asking that money be wired immediately to a certain account as a sender claimed to be the victim of a robbery while 

touring London. 

When the sender could not answer basic questions, the communications stopped. Later, it was learned the former staffer’s Internet address book had been compromised, and everyone in it received the same plea for help. This scam has also apparently been 

attempted using social networking sites. 

The dramatic increase in the popularity of social networking 

sites has perhaps overshadowed some of the risk of sharing too 

much information in those forums. Unlike the sensitive but relatively limited information needed to make an online purchase, 

these social networking sites provide the opportunity and the temptation to incrementally put more and more personal information 

into cyberspace. 

Most users who have no real sense of who can see this information, or what can be done with it or what steps can be taken to 

prevent it from being exploited, and all of this information is a potential treasure trove for identity thieves and for the facilitation of 

other crimes. Some in the information industry refer to personal information as ‘‘The new currency of crime.’’ 

According to a recent national survey of 2,000 online households 

conducted by the Consumer Reports National Research Center, two 

out of three online U.S. households use social networks, nearly 

twice as many as a year ago. But millions who use these services 

put themselves and their families at risk by exposing very sensitive 

personal information. If a picture is really worth 1,000 words, some 

4 

of the visuals that are posted on these sites say way too much, and 

in all likelihood can assist a predator in choosing their prey. 

Again, I want to thank the Chairman for holding this hearing. 

I firmly believe that making the public aware of some of the new 

dangers associated with the ever-expanding Internet is an important tool for Internet users, particularly teenagers and children, to 

protect themselves. 

This is particularly true here in Congress, where we have software and hardware that is so secure that only we and the Chinese 

have access to all our secrets. 

With that, I yield back, and thank you for the time, Chairman. 

Mr. SCOTT. Thank you. And we have one panel of witnesses with 

us. Excuse me, does the gentleman from Virginia have a comment? 

Mr. GOODLATTE. Just briefly, Mr. Chairman, I want to thank you 

for holding this hearing. As the co-chairman of the bipartisan Congressional Internet Caucus and chairman of the House Republican 

High-Tech Working Group, this is a very, very important discussion about how to prevent crime and keep people safe on the Internet. 

It is a rapidly evolving technology, and we have got to make sure 

that the Internet does not become the wild, Wild West of the 21st 

century. But there are a lot of exciting new developments going on 

not only to make new services available to people, but also to empower them to, in many ways, get a better handle on controlling 

their access to the Internet in terms of the information that they 

provide and that they can determine how to provide it. 

In addition, social networking technologies like Facebook—and 

Facebook, quite frankly, has been a leader in this regard—have 

done a great service to the Internet by making greater transparency for the people who are legitimately and honestly using the 

Internet. If you go on a technology like Facebook, you have got to 

disclose who you are, and therefore you can see, as you participate, 

who you are and decide for yourself who you want to share that 

information with. 

But it also is a move away from people thinking that they can 

anonymously undertake activities on the Internet to perform various types of criminal activities. The more we promote that type of 

activity, the fact that you identify yourself and who you are, and 

you decide for yourself what information you are going to share, I 

think the greater progress we will make in being able to crack 

down on the people who want to think that they are operating in 

the shadows of the Internet and conducting crime. 

Now, there are lots that people have to learn about that as they 

do it so that they can understand how they best can protect themselves, and the technologies need to evolve further to root out people who would conduct criminal activity on the Internet. 

But I think that is what we should be learning about today and 

encouraging today so that the Internet can continue to grow and 

continue to be the educational tool, the tool for commerce, the tool 

for entertainment that it has become and is enjoyed by hundreds 

of millions of Americans and billions of people around the world. 

So I look forward to hearing from our witnesses today. 

Thank you, Mr. Chairman. 

5 

Mr. SCOTT. Thank you. And I would like to thank you for your 

hard work on a lot of the technology issues that many of us have 

trouble understanding. You and our other colleague from Virginia, 

Mr. Boucher, have done a lot of work in a bipartisan way in cooperation, which is very helpful to the Committee. So we want to 

thank you for your leadership. 

Our first witness today will be Gordon Snow, who is assistant director of FBI’s cyber division. He has had a distinguished career 

with the FBI, including positions as a section chief in cyber national security section and the director, the National Cyber Investigative Joint Task Force. 

Our second witness will be Michael Merritt, who is assistant director of the Secret Service’s Office of Investigations. He oversees 

the Secret Service’s criminal investigations, including those of electronic and financial crimes. 

Our third witness will be Joe Sullivan, who is the chief security 

officer for Facebook. He is a former assistant U.S. attorney and has 

the daily responsibility for overseeing Facebook’s security policies. 

Our fourth witness will be Mark Rotenberg, who is the executive 

director of the Electronic Privacy Information Center. His organization is one of the leading advocates of online privacy rights and has 

taken a special interest in these interests as they relate to social 

networking. 

Our fifth and final witness will be Joe Pasqua, who is the vice 

president of research for Symantec Corporation. He has led the efforts in that corporation in areas such as online safety, reputationbased security and data protection. 

Each of our witnesses’ written statements will be entered into 

the record in its entirety. We ask our witnesses to summarize his 

or her testimony in 5 minutes or less. And to help stay within the 

time, there is a timing device at the table which will begin green, 

and when 1 minute is left, it will turn to yellow, and turn red when 

5 minutes have expired. 

Also want to recognize our colleague from Florida, Mr. Deutch. 

Did you have a comment? Okay. Thank you very much. 

So we will begin with Assistant Director Snow. 

TESTIMONY OF GORDON M. SNOW, ASSISTANT DIRECTOR, 

FEDERAL BUREAU OF INVESTIGATION, UNITED STATES DEPARTMENT OF JUSTICE, WASHINGTON, DC 

Mr. SNOW. Good afternoon, Chairman Scott, Ranking Member 

Gohmert and Members of the Subcommittee. I appreciate the opportunity to testify before you today regarding the FBI’s efforts to 

combat cybercrime as it relates to social networking sites. 

Regardless of which social networking is used, online—— 

Mr. SCOTT. Mr. Snow, could you bring your mic a little closer to 

you? 

Mr. SNOW. Regardless of which social networking site is used, online users continue to be fooled by persons claiming to be somebody 

else. Individuals can misrepresent everything about themselves 

while they communicate online, their names and business affiliations, and also their gender, age and location, identifiers that are 

far more difficult to fake in person. 

6 

Years ago, we called these type of people ‘‘confidence men,’’ or 

con men. Today, we refer to them as being engaged in social engineering. 

There are a variety of Internet fraud schemes being used by 

cyber criminals at any given time. By way of example, a recent 

fraud scheme involves a cyber criminal gaining access to an 

unsuspecting users’ e-mail account or social networking account, 

claiming to be the account holder and sending messages to many 

of the users’ friends. 

In the message, the con man states that he is on travel and has 

been robbed of his credit cards, passport, money and cell phone. He 

also states the need for money is immediate. Without realizing the 

message is from a criminal, the victims of the fraud account holder 

contacts often wires money to an overseas account without validating the claim. 

Another tool used by criminals to exploit social networking sites 

is a technique called phishing. Phishing schemes attempt to make 

Internet users believe that they are receiving messages from a 

trusted source. 

Phishing attacks on members come in various formats, including 

messages within the social networking site, either from strangers 

or from compromised friends’ accounts, links or videos within a social networking profile leading to something harmful, or e-mails 

sent to users claiming to be from the social network site itself. 

Users fall victim to the schemes due to higher level of trust typically displayed while using social networking sites. Users often accept into their private sites people they do not actually know, or 

they sometimes fail to set privacy settings on their profile which 

might help avoid these attacks. 

Cyber-thieves also used data mining techniques on social networking sites to extract sensitive information about the victims. 

For example, a ‘‘Getting To Know You’’ quiz sent to a large list of 

social networking site users, while not appearing malicious, may 

mimic the same questions that are asked by financial institutions 

or e-mail account providers when the individual has forgotten their 

password. An e-mail address in the answer to the quiz questions 

can provide the cyber-criminal with the tools to enter your bank account, your e-mail account or credit card in order to transfer money 

or siphon off your savings and investments. 

The potential for considerable profits in this realm is enticing 

young criminals and resulted in the creation of a large economy 

known as the cyber-underground. The underground is governed by 

rules and logic that closely mimic those of the legitimate business 

world, including a unique language, a set of expectations about its 

members’ conduct, and a system of stratification based on knowledge and skill, activities and reputation. 

Beyond cyber-crime, valuable national security information can 

also be inadvertently exposed by military or government personnel 

via their social networking site profile. In a recently publicized 

case, an individual created a fake profile on multiple social networking sites posing as an attractive female intelligence analyst 

and extended friend requests to government contractors, military 

and other government personnel. Many of the friend requests were 

accepted. According to press accounts, the deception provided its 

7 

creator with access to a fair amount of sensitive data, including a 

picture from a soldier taken on patrol in Afghanistan that contained embedded data identifying his exact location. 

Mr. Chairman, the Department of Justice and the FBI, in collaboration with our inter-agency partners, have been working closely with the new cyber-security office at the White House to address 

the President’s national efforts to investigate and prosecute cybercrime. To this end, we have established cyber-squads in each of our 

56 field offices around the country, with more than 1,000 specially 

trained agents, analysts and digital forensic experts. 

Still, we cannot combat this threat alone. Some of the best tools 

in the FBI’s arsenal are our longstanding partnerships with federal, state, local and international law enforcement agencies, as 

well as with private sector and academia. 

These relationships include our partnerships with the National 

White Collar Crime Center at the Internet Crime Complaint Center, the National Cyber Forensic and Training Alliance, and the 

InfraGard program. We also partner with the Information Sharing 

and Analysis Centers and the National Center for the Missing and 

Exploited Children. 

Chairman Scott, Ranking Member Gohmert and Members of the 

Subcommittee, in the interest of time today, I have touched upon 

some of the more pervasive methods of criminal activity via social 

networking. I would be more than happy to further expand upon 

any of these issues during questioning, and I appreciate the opportunity to come before you today and share the work with FBI is 

doing to address the threat posed by cyber-criminals in this country 

and around the world. 

[The prepared statement of Mr. Snow follows:] 

8 

PREPARED STATEMENT OF GORDON M. SNOW


Snow-1.eps
9 


Snow-2.eps
10 


Snow-3.eps
11 


Snow-4.eps
12 


Snow-5.eps
13 

Mr. SCOTT. Thank you, Mr. Snow. 

We have been joined by the gentlelady from California, Ms. 

Lofgren, who has taken a strong interest in this issue, and thank 

you for coming. 

Mr. Merritt? 

TESTIMONY OF MICHAEL P. MERRITT, ASSISTANT DIRECTOR, 

UNITED STATES SECRET SERVICE, UNITED STATES DEPARTMENT OF HOMELAND SECURITY, WASHINGTON, DC 

Mr. MERRITT. Good afternoon, Chairman Scott, Ranking Member 

Gohmert and other distinguished Members of the Committee. 

Thank you for the opportunity to testify on the Secret Service’s role 

investigating cyber and computer-related crimes. 

As the original guardian of the Nation’s financial infrastructure, 

the Secret Service has a long, distinguished history of protecting 

American consumers and financial institutions from fraud. Over 

the last 145 years, our criminal investigators have confronted all 

types of financial fraud, from paper to plastic to computer-based attacks targeting our financial payment schemes. 

In recent years, our investigations have revealed a significant increase in the quantity and complexity of cyber cases involving various computer networks in the United States. Broader access to advanced computer technologies and the widespread use of the Internet have fostered the growth of transnational cyber criminals, 

which has resulted in a marked increase in computer-related 

crimes targeting our Nation’s financial infrastructure. 

Current trends show an increase in network intrusions, hacking 

attacks, malicious software, and account takeovers, resulting in 

data breaches affecting every sector of the American economy. In 

addition, social networking sites have become prime targets for 

cyber-criminals to expand their prospects for facilitating malicious 

or fraudulent activity. 

As documented in the 2010 Secret Service Verizon data breach 

investigative report, the use of social engineering tactics to obtain 

personally identifiable information has increased. While cybercriminals operate anonymously in a world without borders, the law 

enforcement community is limited by jurisdictional boundaries. 

Thus, the international scope of these cyber-crime cases has increased the time and resources required for successful investigation 

and adjudication. 

In addition, the level of collaboration among these transnational 

cyber-criminals has raised the complexity of these cases and the 

potential for greater harm. 

To address the emerging threats posed by these transnational 

groups, the Secret Service has adopted a multifaceted approach to 

investigating these crimes while working to prevent future attacks. 

A central component of our approach is the training provided 

through our electronic crime special agent program. Today, roughly 

1,300, or more than half of our field office special agents, have received training in forensic identification and the preservation and 

retrieval of electronically stored evidence. 

In addition, since 2008, the Secret Service, through the National 

Computer Forensics Institute, has provided computer forensics 

training to 836 state and local law enforcement officials repVerDate Aug 31 2005 12:12 Dec 14, 2010 Jkt 000000 PO 00000 Frm 00017 Fmt 6633 Sfmt 6601 H:\WORK\CRIME\072810\57673.000 HJUD1 PsN: DOUGA
14 

resenting over 300 agencies from all 50 states and two territories. 

As cyber-crimes continue to increase in size, scope and depth, the 

Secret Service is committed to sharing information and best practices with our law enforcement partners, academia, and the private 

sector. 

To accomplish this, we have established 29 electronic crime task 

forces, including the first international task force, based in Rome, 

Italy. 

Currently, membership in our ECTFs includes approximately 

5,500 partners from law enforcement and the private sector and 

academia. These partners have access to the resources provided 

through our international network of ECTFs. To coordinate these 

investigations at the headquarters level, the Secret Service has enhanced our cyber-intelligence section to focus on generating new 

leads in support of our cyber-investigations. 

The men and women who work in this section have been instrumental in our success in infiltrating online cyber-criminal networks 

around the world. These successful investigations include two of 

the largest known network intrusion cases to date, TGX and the 

Heartland Payment Systems case. These intrusions resulted in the 

compromise of approximately 40 million accounts and 130 million 

accounts respectively and the indictment of dozens of suspects. 

As detailed in my written statement, the Secret Service has implemented a number of initiatives to combat the scourge of cyber 

and computer-related crimes. Today, social networking sites provide yet another target-rich environment for cyber-criminals to exploit personal identifiable information. 

Responding to the growth in these types of crimes and the level 

of sophistication these criminals employ will demand an increase in 

resources and greater collaboration between law enforcement and 

the private sector. Accordingly, the Secret Service will focus its resources on increasing public awareness through education, providing training for our local law enforcement partners, and adjusting our investigative techniques to stay ahead of the criminal 

trends. 

The Secret Service is committed to our mission of safeguarding 

our Nation’s critical financial infrastructure and will continue to 

aggressively investigate cyber and computer-related crimes to protect American consumers and financial institutions from harm. 

Chairman Scott, Ranking Member Gohmert and distinguished 

Members of the Committee, this concludes my prepared statement. 

Thank you again for this opportunity to testify on behalf of the Secret Service. I will be pleased to answer any questions at your convenience. 

Thank you. 

[The prepared statement of Mr. Merritt follows:] 

15 

PREPARED STATEMENT OF MICHAEL P. MERRITT


MPM-1.eps
16 


MPM-2.eps
17 


MPM-3.eps
18 


MPM-4.eps
19 


MPM-5.eps
20 


MPM-6.eps
21 


MPM-7.eps
22 

Mr. SCOTT. Thank you, Mr. Merritt. 

Mr. Sullivan, I believe you came off a vacation to be with us 

today. We certainly appreciate that. We certainly notice that, and 

thank you for being with us. 

Mr. Sullivan? 


MPM-8.eps
23 

TESTIMONY OF JOE SULLIVAN, CHIEF SECURITY OFFICER 

(CSO), FACEBOOK, INC., PALO ALTO, CA 

Mr. SULLIVAN. Certainly. It is my pleasure to be here. So thank 

you, Chairman Scott, Ranking Member Gohmert and Subcommittee Members for this opportunity. 

As Facebook’s chief security officer, and as a former Federal 

prosecutor who specialized in high-tech crime in Silicon Valley, this 

topic has special meaning for me. At Facebook, I work every day 

on developing high product security standards, engaging people 

outside the company, such as educators, parents, students and 

other Internet users, to learn about and promote safe Internet 

practices. And I also work closely with law enforcement around the 

world to help ensure that those who are responsible for online 

abuse are held accountable. 

While the Internet now connects nearly two billion people, until 

recently, it was a useful but very passive repository of information. 

But in just a few years, it is really evolved to an interactive social 

experience defined by your connections, interests, and your communities. 

These developments enlist people not just as passive viewers but 

also as creators of online content, frequently in a framework that 

is social and involves forums or communities defined by people 

themselves. And since its creation, Facebook has been at the forefront of this change, growing from a network of students at a handful of universities to a worldwide community. 

Today, Facebook and other social technologies have the power to 

enrich people’s lives in ways that were unimagined even 5 years 

ago. Facebook’s become an invaluable communication tool, allowing 

individuals to connect for myriad purposes, to communicate with 

family near and far, for charitable causes, in the political realm for 

grassroots organizing and for local community-building. 

In the same way that Facebook has brought innovation to communication, on the security team and across the company, we try 

and bring innovation to Internet security. We are constantly working to enhance online safety and address new and emerging security threats. 

And because those efforts are frequently behind the scenes, I particularly appreciate the opportunity to highlight a few of them for 

you today. We believe that our proactive efforts and innovations in 

security are the key to providing a positive online experience. 

In my written testimony, I focus on a number of different areas. 

One of those important areas is key partnerships. As a company, 

we reach out to law enforcement and Internet privacy, safety and 

security experts everywhere to learn about best practices and to 

build on them. 

For example, last year we created a Safety Advisory Board consisting of representatives from five of the leading online safety organizations. And we have regular meetings with them and almost 

daily feedback from them on things that we can do in particular 

in the area of teen safety. 

The Board has been a great resource. One example has been 

their contributions to the improved safety and security messaging 

that we have launched in the last few months. 

24 

I am also proud of the strong relationships with the law enforcement agencies here at the table today. The FBI has long been a 

leader in cyber-crime investigation, and we are working closely 

with the FBI on several large, multi-jurisdictional cases right now 

against malware distributors and spammers who have attempted 

to take advantage of the scale of social networking sites. We have 

also worked with them on child safety cases. 

And the Secret Service is resourceful and innovative not only on 

the Internet threat cases that they prioritize, but also on other 

types of electronic crime investigations where we have turned to 

them for assistance. 

Following up on the comments of Congressman Goodlatte, before 

Facebook, I think the common wisdom was that the Internet was 

a place where people should avoid using their real names or sharing information. Facebook was the first major web service that required people to build their profiles and networks using real 

names, while at the same time giving them privacy controls so that 

they can limit who accesses their information. 

This was an important policy and technical architecture choice 

which both allowed people using Facebook to become more connected and made the service safer. In a culture of authentic identity, your actions are observed by your real-world friends, and it 

makes Facebook less attractive to predators and other bad actors. 

And to be honest, those people, they stand out like sore thumbs on 

our site. 

We also make it easier for people to control what they want to 

share, with whom and when. In my written testimony, I give several examples, both in the context of privacy and in security, where 

we give people controls over who sees what and how they manage 

the security of their account. 

On the back end, we are also very proactive. So, for example, we 

became a level one PCI-compliant company, meeting heightened 

data security standards even though, as a business, we don’t even 

meet the standard of those requirements being necessary for our 

business. 

We will also develop proprietary technologies that allow us to 

continuously improve on our online safety efforts. We generally 

don’t discuss the back-end algorithms and things that we use in 

that context, but these technologies allow us to perform ongoing 

authentication checks and also to engage our users in types of community verification. 

Our technology has also helped us to obtain and take legal action 

against people who try to do things that they shouldn’t. Congress 

enacted the CAN-SPAM Act, and I am proud to say that Facebook 

is responsible for the two largest judgments in the history of that 

Act, $873 million against Adam Guerbuez and $711 million against 

the notorious spammer, Sanford Wallace. 

I see that my time is up, so I would just like to maybe go on a 

little bit and mention that, as we come here today, I think that security requires vigilance, and Congress has been vigilant in enacting targeted statutes to address Internet security problems. It is an 

ongoing chess match, and there is more to be done. 

A couple of examples of things where we hope to continue to 

work closely with the government are building out that national 

25 

database of convicted sex offenders that was called for in the KIDS 

Act that Congress passed a couple years ago. We need access to 

that national database today. And if we had access to it, we would 

use it. 

We need continued investment in cyber-literacy in particular for 

teens and parents. An example, to get really in the weeds, is we 

need broader access to the hashes of known images of exploitation 

of children. With these hashes, we would be able to run that list 

against our site and identify any known image of child pornography and make sure that it was not on our service. Facebook is 

the largest photo-sharing Web site on the Internet, and that type 

of technology would be very helpful. 

We also need, I think law enforcement to receive more resources 

for training. They need better technology in the office, and they 

need better training on how to, in particular, work on the international cases. 

Unfortunately, the vast majority of the significant cyber-crime 

that is going on today is cross-jurisdictional, and it brings up new 

challenges that law enforcement have not had to deal with on a 

day-in, day-out basis. For example, collection of electronic data can 

involve service of legal process in multiple countries and numerous 

jurisdictions across the United States. As a result, these cases 

move too slowly, and many international cases never get prosecuted at all. 

In conclusion, I would just like to say that Facebook has always 

sought to provide a safer environment than was generally available, and we will continue to innovate in order to enhance the safety and security of our community of users. 

And on behalf of Facebook, I thank the Subcommittee for its 

leadership and dedication to Internet innovation and safety. 

[The prepared statement of Mr. Sullivan follows:] 

26 

PREPARED STATEMENT OF JOE SULLIVAN


JS-1.eps
27 


JS-2.eps
28 


JS-3.eps
29 


JS-4.eps
30 


JS-5.eps
31 


JS-6.eps
32 


JS-7.eps
33 


JS-8.eps
34 


JS-9.eps
35 


JS-10.eps
36 


JS-11.eps
37 


JS-12.eps
38 


JS-13.eps
39 

Mr. SCOTT. Thank you very much. 

Mr. Rotenberg? 


JS-14.eps
40 

TESTIMONY OF MARC ROTENBERG, EXECUTIVE DIRECTOR, 

ELECTRONIC PRIVACY INFORMATION CENTER (EPIC), 

WASHINGTON, DC 

Mr. ROTENBERG. Thank you, Chairman Scott, Ranking Member 

Gohmert, Members of the Subcommittee. I appreciate the opportunity to be here this afternoon. 

My name is Mark Rotenberg. I am the executive director of 

EPIC, and we are a leading privacy organization. We are particularly concerned about the privacy issues related to Facebook. 

As you know, Facebook has become enormously influential on the 

Internet. It has more than 500 million members. Someone pointed 

out recently that, if it were a country, it would be larger than the 

United States, Japan, and Germany combined. So it is a very big 

player on the Internet. 

At the same time, Facebook also has an enormous impact by 

what it chooses to do or not do on the privacy of Internet users. 

And when Facebook has changed its privacy policies and the privacy settings of Internet users, it is raised real privacy concerns. 

In fact, my organization, EPIC, has filed two complaints at the 

Federal Trade Commission resulting from these changes in privacy 

settings because we believe they significantly disadvantaged Internet users and created new risks to privacy. 

Now, to be clear, the service is very useful. In fact, in preparing 

for this hearing, I actually posted on my own Facebook wall a question to Facebook users. I said, ‘‘What concerns do you have that I 

should share with Committee Members?’’ 

And many people responded, some who I know well, some who 

I don’t know particularly well, but the comments were helpful. And 

I incorporated them in my prepared statement for you today to give 

you some sense of the concerns that Facebook users have. 

And this point about changing the privacy settings came back 

again and again and again. And I bring this to your attention 

today, because I know in this discussion about the risk of online 

victimization, which is a real threat, oftentimes people talk about 

the need to better educate users, to warn users about what they 

should or should not post. 

And while I agree in some circumstances that is helpful, user 

education can only go so far if a user has made a determination 

not to disclose certain types of information to certain organizations 

and the company in possession of that information chooses to 

change the rules of the game. 

User might say, for example, ‘‘I don’t want this information to be 

widely available or searchable through an Internet search engine. 

I only want these photos to be available to my friends or family 

members,’’ and then the company says, ‘‘Well, we have a transition 

now in the privacy settings, and we are going to change those defaults a bit. And if you want to change them back, you are always 

free to do so.’’ 

The point that I am trying to make is that these changes in the 

privacy settings create risks for users that they really cannot control. This is the reason that we went to the Federal Trade Commission and urged the FTC to enforce the agreement that users had 

with Facebook and other Internet firms to respect their privacy settings. 

41 

Now, I am bringing attention to this FTC complaint because I 

think it has some specific implications for what this Committee 

might be able to do to address user concerns about online privacy 

in the social network space. 

Because the FTC has not acted on this complaint, it means that 

the companies are able to continue to make these changes, and 

that there is no recourse for users. And what I am proposing, 

therefore, is that the Federal law that regulates the disclosure of 

information by companies such as Facebook, the Electronic Communications Privacy Act, be amended so that these disclosures to 

third parties could not occur without clear and affirmative consent. 

In other words, if a person has chosen not to disclose personal 

information to an application developer that is a business partner, 

a Facebook or an Internet Web site that is also a business partner 

of Facebook, that preference should be respected. And if it is not 

respected, then I think it is creating a significant risk to the privacy of users online. 

Looking ahead, this is going to continue to be an important concern for Internet users until we have comprehensive legislation 

protecting people online. 

Thank you very much for the opportunity to testify. I would be 

pleased to answer your questions. 

[The prepared statement of Mr. Rotenberg follows:] 

42 

PREPARED STATEMENT OF MARC ROTENBERG


MR-1.eps
43 


MR-2.eps
44 


MR-3.eps
45 


MR-4.eps
46 


MR-5.eps
47 


MR-6.eps
48 


MR-7.eps
49 


MR-8.eps
50 


MR-9.eps
51 


MR-10.eps
52 


MR-11.eps
53 


MR-12.eps
54 

Mr. SCOTT. Thank you. 

We have been joined by the gentleman from Illinois, Mr. Quigley, 

so thank you for being with us. 

Mr. Pasqua? 

TESTIMONY OF JOE PASQUA, VICE PRESIDENT FOR 

RESEARCH, SYMANTEC, INC., WASHINGTON, DC 

Mr. PASQUA. Mr. Chairman, Ranking Member Gohmert and 

Members of the Subcommittee, thank you for the opportunity to appear here today and discuss this important topic. As a global information security leader, Symantec welcomes the opportunity to provide the Committee with our insights on how to keep social network users safe online. 

While social networking has provided many new benefits, it has 

also opened new doorways for cyber-crime. It has expanded online 

opportunities for the underground economy, which has discovered 

that social networking pays. 

The infiltration of communities and the spreading of spam or 

malware have become a part of everyday life within social networks, and that trend is increasing. The potential abuses cybercriminals have conceived are highly varied and range from targeted 

spying, spam and phishing mail distribution to exploitation of security holes within particular social networking platforms. 

Attacks against both social networking sites themselves, as well 

as individual users of those sites, have now become standard practice for criminals. Part of the reason for this is that these sites 

combine two factors that make for an ideal target for online criminal activity: a massive number of users and a high level of trust 

among the users. 

Social networks also provide a rich repository of information 

cyber-criminals can use to refined their phishing attacks. Many 

Internet users today are too blase about the information they post 

on the web. Social network users should always be cautious about 

the information they post online and how it can be used. 

In a rush to embrace the advantages of sharing information on 

the Internet, many young people in particular have created online 

data sets, or ‘‘tattoos,’’ that, much like the real thing, are difficult 

to remove. Posting personal information online can also leave them 

vulnerable to identity theft. Details such as postal codes, 

birthdates, mother’s maiden names, can all be used by cyber-criminals to crack passwords, hijack accounts, send out spam, and distribute malware. 

In addition to the direct insertion of malware or the distribution 

of mass mailings, cyber-criminals use social networks to lure users 

to primed Web sites where they can steal personal data so that 

they can sell it for profit. There has been a marked increase in 

crimeware, or software used to conduct cyber-crime, on social networks and elsewhere. 

In 2009, Symantec created over 2.5 million new virus signatures 

and discovered more than 210 million distinct malware variants. 

That is a 56 and 75 percent increase, respectively, over the same 

period in 2008. 

55 

And to put this in perspective, Symantec created more malware 

signatures in the past 15 months than in the previous 18 years 

combined. So it is a massive, massive increase. 

Attackers are now going directly after the end user and attempting to trick them into downloading malware or divulging sensitive 

information under the auspice that they are doing something perfectly innocent. Social engineering’s popularity is at least in part 

spurred by the fact that the operating system that a user is using 

or a browser is largely irrelevant. It is the actual user that is being 

targeted, not necessarily vulnerabilities in the machine. 

To their credit, social network sites squash most threats quickly, 

but it is not just targeted attacks you should be worried about. It 

is adapted attacks. Adapted attacks occur when bad guys take existing threats and use social networks to increase the effectiveness 

of the attack through social engineering. There is nothing like 

being surrounded by friends to get you to lower your guard, and 

that is what they make you think they are doing. 

Given the potential for monetary gain from compromised corporate intellectual property, cyber-criminals have also turned their 

attention toward enterprises. Attackers are leveraging the abundance of personal information openly available on social networking sites to synthesize socially engineered attacks on key individuals within targeted companies. This can take into account position within the company, colleagues, hobbies, places they have 

been, pictures, etcetera. 

I am just going to skip ahead a little bit and wrap up because 

I see I am running low on time. But I will mention that, according 

to a recent Symantec enterprise security survey, most organizations do not have social networking policy in place despite giving 

employees unfettered access to these popular Web sites. Our survey 

also found that 84 percent of CIOs and CISOs consider social networking sites to be a serious threat to their security. 

In closing, I have provided in my written testimony to the Committee a number of useful precautions that all users of social networks should consider in their use of this new medium, and we all 

call this to the Committee’s attention. 

Mr. Chairman and Members of the Committee, Symantec appreciates the opportunity to provide our input on combating cybercrime on social networks and protecting online privacy so the Internet can reach its full potential. We look forward to continuing to 

work with the Committee as it considers future legislation in this 

area. 

Thank you. 

[The prepared statement of Mr. Pasqua follows:] 

56 

PREPARED STATEMENT OF JOSEPH PASQUA


JP-1.eps
57 


JP-2.eps
58 


JP-3.eps
59 


JP-4.eps
60 


JP-5.eps
61 


JP-6.eps
62 


JP-7.eps
63 


JP-8.eps
64 


JP-9.eps
65 

Mr. SCOTT. Thank you. And I want to thank all of our witnesses 

for their testimony. And we will now have questions, and I will recognize myself first. 

Are there laws in other countries that do not apply here in terms 

of protecting people’s privacy? Mr. Rotenberg? 

Mr. ROTENBERG. Maybe I should take this. 

Mr. Chairman, part of our work at EPIC is looking at different 

approaches to privacy protection. And I think it is fairly well 

known that the Europeans have I guess we could say a more comprehensive approach to privacy protection in that companies that 


JP-10.eps
66 

collect data on users have presumptive obligations to protect the 

privacy of that information. 

Here in the United States, we tend to do it on a sectoral basis. 

We would legislate for a particular industry, for example, like medical records, electronic health records. 

I think what is important about this approach is that it means 

that when companies like Facebook gather information on users in 

other countries, they have to be more careful about disclosure to 

other parties because they do run some risk of stepping over the 

line on those more comprehensive privacy laws. 

Mr. SCOTT. I think, Mr. Rotenberg, you mentioned changing security settings. 

Mr. ROTENBERG. Yes, the privacy settings. 

Mr. SCOTT. And what allegation were you making there? 

Mr. ROTENBERG. Well, essentially that, for a person in the 

United States who wants to protect their privacy on Facebook, they 

have to go to a series of screens provided by Facebook and make 

some choices. Do they want their photographs, for example, to be 

available to everyone, or to their friends, or friends of friends, or 

just a small group? And you make a lot of these decisions about 

a lot of different information that you put online. 

Our objection is that, when the user makes those decisions, and 

then Facebook comes along later on and says, ‘‘Well, we want to 

change our approach to privacy, and maybe you had your photographs available only for family members but we are going to 

change that setting to everyone,’’ that is where the problem arises. 

And that is actually the basis of most of the concerns we think 

today that Facebook users have about privacy. It is the changes in 

those settings. 

Mr. SCOTT. Mr. Sullivan, did you want to respond to that? 

Mr. SULLIVAN. Thank you, Chairman. 

Our position on privacy hasn’t changed. It is our belief that people who use Facebook own their information, and they have the 

right to share their information in the way that they want to share 

it. And it is our responsibility to respect their wishes. 

On the subject of U.S. versus international laws, we attempt to 

treat all of our users by one very high standard. We don’t differentiate between U.S. users and other users in terms of presenting different standards to them or treat their information with different 

levels of care. 

Our approach has been to try and improve over time. Facebook 

is a relatively new technology. As a company and a product, we are 

6 years old. And we are growing and learning every day. 

And the number one way that we learn is through feedback from 

our users, and we are constantly innovating and trying to learn 

from our users, and every innovation that we do is driven by user 

feedback. 

And in addition to innovating, the other thing we try and pride 

ourselves on is responding quickly. So when we get feedback that 

something isn’t working right, we try and fix it very quickly. 

With regard to our privacy settings, we have spent a considerable 

time and effort in the last year trying to make them better and trying to make them easier to understand. I feel very good about 

67 

where our privacy settings are today, and would love the opportunity to walk anyone through how those settings work today. 

We have a one-page that has all of your privacy settings on it 

right now. We try and break it into three simple buckets—your directory information, how you share information, and how you share 

information with applications. 

With regard to how you share information, it is literally a oneclick process, where you can go on the site right now and say, ‘‘I 

am not sure what my settings were for each different thing that 

I posted, but right now I would like to make everything I have ever 

put on the site friends-only.’’ One click, you can do that. 

In addition, we know that people want flexibility, so we have 

tried to build contextual messaging into our product so that, at the 

time you make decisions about sharing, you can customize the setting for that particular piece of information. So if I want to share 

information about being in front of this Committee today, I might 

want to share that only at work, or maybe I want to share it with 

all of my friends. I have the ability, one status update at a time, 

to change the setting to direct it to different audiences. 

Mr. SCOTT. I mean—I think, because sometimes people make 

those choices, and Facebook comes behind and changes the settings. Is that accurate? 

Mr. SULLIVAN. No, that is not accurate. 

Mr. SCOTT. Mr. Marc, do you want to make your statement? 

Mr. ROTENBERG. I am kind of astounded by Mr. Sullivan’s answer to your question. I mean, we have documented this in 50 

pages to the Federal Trade commission, and it is discussed by hundreds of thousands of Facebook users across the Facebook platform. 

So maybe Mr. Sullivan would like to rethink how he answered your 

question. 

In fact, I think he should also rethink what he said earlier in response to your question about the ability of users to selectively disclose what information to make available online. Facebook has an 

increasingly broad category of what it considers to be publicly 

available information. That is the information that the user really 

has no control over, even the users who would like the highest level 

of privacy settings. 

And it is clear to just about everyone what direction that category is heading, which is to say that Facebook will simply continue to make more user information available. So I think maybe 

Mr. Sullivan would like to rethink that answer also. 

Mr. SCOTT. Do you want to respond, Mr. Sullivan? 

Mr. SULLIVAN. I am not interested in changing my answer. I 

stand by it. 

Mr. SCOTT. Gentleman from Texas. 

Mr. GOHMERT. Thank you, Mr. Chairman. 

And appreciate all the witnesses being here and for the testimony. 

I am curious, Mr. Sullivan, what information would you recommend not sharing on Facebook specifically? 

Mr. SULLIVAN. Personally and as a company, we want people to 

make those decisions for themselves. 

Mr. GOHMERT. Well, but I am asking you personally rather than 

Facebook. 

68 

Mr. SULLIVAN. Well, personally, I choose to share quite a bit of 

information through Facebook, and I put different levels of visibility on different types of information. 

My contact information I make available to my friends on 

Facebook, so my friends can go on Facebook and see my e-mail address, my phone numbers, my Instant Messaging identifiers and 

things like that. The pages that I am a fan of, I am happy to share 

that with other people because I like to interact with people who 

are fans of the same sports teams that I am fans of, etcetera. My— 

information—I am sorry. 

Mr. GOHMERT. Let me ask you, since our time is so limited, what 

problems has China indicated that they have with Facebook that 

would prevent them from allowing Facebook to be accessible, that 

is? 

Mr. SULLIVAN. To be honest, I don’t think we have—— 

Mr. GOHMERT. Well, I would prefer you be honest. Thank you. 

Mr. SULLIVAN. I don’t think we have received a clear answer on 

that. My understanding is that it relates to our refusal to moderate 

speech. 

Mr. GOHMERT. To moderate speech? So if somebody said something unkind about China, they would want that moderated. Is 

that correct? 

Mr. SULLIVAN. It is a very sensitive issue that we spend a good 

deal of time trying to make sure that we as a company respect free 

speech rights of our users. 

Mr. GOHMERT. I will take that as a yes. Thank you. 

Mr. Pasqua, I appreciate your being here. And I hadn’t bought 

a Symantec or Norton product in probably 10 or 15 years. 

But there is a perception that, once information is put into a social networking site, that it is there forever, and there is just really 

not anything that can be done. Since you have been in the security 

business with the software, is there anything that can be done to 

actually pull stuff out once it is in there? 

Mr. PASQUA. The fact of the matter is, there really are a lot of 

different sites out there, and they have different capabilities. Obviously, Facebook is a major important one, but there are certain 

types of information on certain sites that you can remove. There 

are other types of information in other sites where you really have 

very little control over pulling back information once you have created that content. 

So if you, for example, have a comment on a blog that is controlled by someone else, you can’t necessarily control whether you 

can delete that comment, or change it or amend what you have 

said. It is really up to the owner of that Web site. 

Mr. GOHMERT. Okay. Let me ask our Federal entities representatives. 

Mr. Snow, how easy is it to pass information about questionable 

Internet activity to other Federal entities, whether the NSA, CIA, 

Secret Service? How easy is it within the FBI to do that? 

Mr. SNOW. Sir, from the FBI’s position, it is very easy for us to 

pass—— 

Mr. GOHMERT. Well, I understand that is your position, but from 

a factual standpoint, how easy is it? 

69 

Mr. SNOW. Yes, sir. We right now—and the Chairman originally 

discussed it somewhat—we have the National Cyber Investigative 

Joint Task Force that has been designated by the White House 

and—— 

Mr. GOHMERT. No, no, I understand all that, but, you know, I 

have enough friends that are Federal agents in all different sectors, 

and I keep hearing about difficulty, even since we had the big umbrella of Homeland Security, in communicating. In fact, some say 

that it is even created more problems in getting information from 

one to the other, because now it goes up before it comes down and 

goes lateral. 

So that is what I am asking, really from a practical standpoint, 

how easy is it? If you see a problem, can you just send that out 

to friends at Secret Service, or what do you have to go through to 

get that done? 

Mr. SNOW. Absolutely, sir. Anything that I have, I can pass, almost in real-time, depending on which systems are linked or not 

linked. So at—— 

Mr. GOHMERT. Do you need approval from anyone to do that? 

Mr. SNOW. Sir, I am the approving entity and individual in the 

cyber division, so anything cyber-related would go through me. But 

I also take a very strong approach, a proactive approach, on pushing those approval processes down to my workers and my operators 

out at the National Cyber Investigative Joint Task Force. 

Mr. GOHMERT. Great. 

Mr. Merritt, how easy is the flow, from your experience? 

Mr. MERRITT. Very easy, sir. I mentioned the cyber-intelligence 

section within our criminal investigative division. 

Mr. GOHMERT. Right. 

Mr. MERRITT. These are extremely talented, both agents and contractors with superior computer and linguistic capabilities who 

monitor, real-time, these codding portals we have talked about, the 

codding Web sites. 

And when, in fact, an anomaly appears or a malware, for example, based on our electronic crimes task forces, we distribute that 

information real-time to our members. In turn, they channel it 

down their flow chains. To include, we have a representative on 

each FBI joint task force, along with our national Joint Terrorism 

Task Force, and we do have a member at their NCIJTF. 

So the big benefit of this, sir, would be the private sector who 

are not seeing this. Some corporations are better suited, with their 

analysts, to identifying anomalies and intrusions more so than others, especially the medium to small size companies. But we do have 

that ability, and we do do that. 

Mr. GOHMERT. Thank you. 

Mr. MERRITT. Thank you. 

Mr. GOHMERT. Mr. Pasqua, I didn’t mean to be cryptic, but it is 

been back when I was a judge in the 1990’s, I personally bought 

some Norton securityware. I had examined the boxes, all of the 

properties. Norton seemed to have good qualities, but they had a 

$20 rebate if you sent the original receipt. And I did, kept all the 

copies of everything I sent, said wait 6 weeks. 

I waited about 10 weeks, called, and the lady said, ‘‘If you don’t 

have proof that we received it, then you have got nothing.’’ And I 

70 

said, ‘‘Well, I didn’t send it certified because that would have eaten 

up the $20.’’ And I said, ‘‘But I have got copies of everything.’’ She 

said, ‘‘Too bad. We don’t take copies. It said that in the rebate. We 

got the original.’’ 

So I have cost Symantec, because people know I am somewhat literate in the area, lots more than $20, and it is too late to send 

me my $20 now that I am in Congress. But anyway, that is the 

reason I haven’t bought anything from Symantec in years, but I appreciate the time, and I yield back. 

Mr. QUIGLEY [Presiding]. The gentleman yields back. 

The gentlewoman from California is recognized. 

Ms. LOFGREN. Thank you very much. And first, let me offer my 

regrets for not being here at the beginning of the hearing, because 

I would have liked to have given a word of welcome to two of the 

witnesses who represent companies located in Silicon Valley, which 

I represent in the House. And that is both the Facebook witness 

and, of course, Symantec, both companies that employ many of my 

constituents. So, welcome here. 

As I think about the risks involved in use of technology, I think 

of them in at least two categories. One, there is really nothing the 

government can do about. 

I mean, if you decide to post your home address on Facebook and 

not limit who sees it, and then say, ‘‘Oh, by the way, I am on vacation for a month,’’ it is like saying, ‘‘Please come burglarize me.’’ 

So that is really an education issue that the government, and I 

really think the companies, are not responsible for. It is a matter 

of Americans understanding what they are doing. 

There is a second issue, which is really a technology issue, which 

is allowing people the opportunity to have their rights respected. 

And I wanted to address, really, two questions, probably three 

questions, to Mr. Sullivan. 

It has been mentioned here by EPIC, certainly a very well regarded organization that I have supported for years, that the settings are too tough and maybe not fully implemented. And I have 

actually complained, most recently a few months ago, not that you 

couldn’t do it, but that it was too complicated. 

And I suggested to the Facebook people I met with that you need 

not the Geek Squad but the Granny Squad. I mean, design it for, 

you know, a grandma in the Midwest so she can understand it and 

make it do what she wants with very simple clicks. 

Do you think you have accomplished that yet? I realize this is 

really still a startup. I mean, even though you are at half a billion, 

you know, it is 6 years, and you are still growing. 

Mr. SULLIVAN. Thank you very much for that question. And I 

think that it is something that we spend time thinking about every 

day, because I think your goals and our goals are aligned on this 

issue. We want people to understand and be able to use the controls because they will feel good about our service. And I think that 

the controls that we have in place now are the best we have ever 

had. 

And as I mentioned earlier, the controls that we launched as a 

result of the feedback that we received from people like you, we 

think that we have dramatically simplified so that you—you know, 

as you know, before, you had to go to five or six different screens 

71 

to cover all the different types of sharing that you could do, and 

now you can manage all of that on a single page. 

Ms. LOFGREN. And maybe that you are not at liberty, and this 

may not be a fair question, but if EPIC had some further suggestions for you to consider to simplify this, would you welcome those 

suggestions? 

Mr. SULLIVAN. We certainly would. In fact, I would like to mention that both before the large rollout that we did last fall of trying 

to engage users on new privacy settings, and during the spring we 

did reach out to a large number of organizations outside the company that asked for feedback, and we received feedback from a 

number of highly regarded organizations across the nonprofit and 

public and private sector. 

Ms. LOFGREN. Let me ask you two other questions, and this is 

one really having to do with people who decide that Facebook is too 

much trouble and they wanted to delete their account. 

I mean, if you post somewhere else, I realize that is on somebody 

else’s Facebook and you can’t necessarily get rid of that. But if you 

close your own account, is every whisper of information that you 

have lodged with Facebook erased with that? 

Mr. SULLIVAN. Yes. 

Ms. LOFGREN. And finally, I would like to make a suggestion, unless this has already been implemented. There are times when 

things go wrong. 

For example, somebody has failed to take appropriate steps to 

safeguard their Facebook account, and it gets hijacked. There is nobody to call. I mean, you can send an e-mail, but it takes a long 

time to be sorted out. Are there plans in place to have kind of a 

rapid response when things of that nature occur? 

Mr. SULLIVAN. Yes. It is another area where we are continuing 

to innovate. What we have done is we have placed ‘‘Report’’ buttons 

across our site, and you should be able to find them on basically 

every single page. And we have put those buttons in places where 

we think that you are most likely to run into a problem and would 

want to report something. And the ‘‘Report’’ button opens up a dialogue. 

And like you said, I think in the old days of the Internet, companies would have a single e-mail address, and all of the issues would 

come into one big bucket, and then you have to have someone sort 

it. The way we do it now is, during the report process, we have 

some very easy drop-downs where a user can specify what the specific issue is. And that directs it into a prioritization queue. 

And so, for example, the most serious issues we try and get to 

within, you know, hours, most frequent—— 

Ms. LOFGREN. What would a serious issue be, for example? 

Mr. SULLIVAN. So, an identity theft or cyber-bullying, or a threat 

to life or a potential suicide discussion, or something like that. 

Ms. LOFGREN. Okay. Well, that is more serious than hijacking a 

Facebook page. Where would that fall in your priority list? How 

long would it take to respond to that, do you think? 

Mr. SULLIVAN. I think probably within 24 hours, but—— 

Ms. LOFGREN. If I told you it was 3 weeks, would you be willing 

to look into it? 

Mr. SULLIVAN. I certainly would like to look into it. 

72 

Ms. LOFGREN. I would appreciate that. 

I realize my time is just about over, but before I did, I just want 

to, since the Chairman didn’t get his rebate, I would like to say I 

just bought a Symantec product that I have installed on my home 

computer, and it is protecting me from viruses and malware, and 

I appreciate it very much, and love your products. 

And I yield back. 

Mr. PASQUA. Thank you. 

And Member Gohmert, I am sorry we lost you as a customer. I 

hope we can win you back. But most importantly, I hope you are 

using some sort of protection on your machine. 

Mr. QUIGLEY. The gentlewoman’s time has expired. 

Mr. Goodlatte from Virginia is recognized. 

Mr. GOODLATTE. Thank you, Mr. Chairman. 

Folks, welcome. I missed most of your testimony because I had 

to go deal with another Committee and some legislation I had 

there. I apologize for that. 

But I did want to ask Mr. Snow, with the many Federal agencies 

involved in some aspect of identity theft or related cyber-crimes, is 

there ever confusion on the part of the private industry sector as 

to what agency they should call for assistance or to report a 

breach? Do you have some kind of a clearinghouse, or—— 

Mr. SNOW. Yes, sir. Our most powerful clearinghouse is the agent 

and investigators that are in the field. So all the different agencies, 

federal, state and local, and our international partners are out 

pushing the outreach programs. 

We have three very strong outreach programs—the Internet 

Crime Complaint Center, which is a public-private partnership; our 

InfraGard program, and then our computer education and development unit, which go out, along with our domain entities, as to 

other Federal agencies and state and local partners to let people 

know, if you have crime or you have crime reporting, to come and 

talk to us. 

The clearinghouse actually takes place back in the investigative 

agencies along with where the different jurisdictional lines reside. 

So for instance, if you had a problem, an Internet breach, you could 

Google it. You would come up with probably about five or six places 

to go report. 

If you were directed to the FBI Web site, FBI.gov, you would be 

directed back to the Internet Crime Complaint Center. It would 

talk to you about what that crime complaint center does, what it 

can provide you, and how to report. It would have a very accessible 

link there. 

The Internet Crime Complaint Center, if you started there, 

would have the same issue and reporting mechanism. And then, we 

have an educational partnership that is called wwwlookstoogoodtobetrue, and you would be able to go there, also. 

An important part of the education, and I know we have talked 

about the education, is that all three of these sites, individuals that 

are suspecting that they may be subjects, or potential subjects, 

which everybody is, of Internet fraud or computer hacking, can sign 

up for informational alerts that will come to whatever piece that 

you have. 

Mr. GOODLATTE. Thank you. 

73 

Mr. Sullivan, let me follow up on the question from Ms. Lofgren 

regarding the privacy issues there. Can you explain Facebook’s privacy transition tool? How does this process ensure that users are 

considering privacy issues in evaluating their own security settings? 

Mr. SULLIVAN. Certainly. So, last December, we took on I think 

what was probably an unprecedented event in the history of the 

Internet, and that is that we tried to engage every single one of our 

users and make them think about privacy. 

And so, what we did was we put that wizard, which was a page 

that talked about privacy and laid out your settings and what we 

were recommending as settings, in front of every single user, and 

we simply wouldn’t let you use the service again until you walked 

through these pages and said, ‘‘I want to do it this way.’’ 

And so, that was quite a massive undertaking, and it got quite 

a bit of attention, and we were pleased in both regards because we 

saw that users engaged with this wizard, that they made decisions, 

that they talked about privacy, they thought about privacy, they 

thought about what they put on the site before. And they have continued to use the privacy settings after that day even more than 

they ever did. 

Mr. GOODLATTE. What is instant personalization? I know that 

Facebook has become a platform upon which you have invited other 

vendors to build various tools that they can utilize as members of 

Facebook. What assurances do you have that partner sites in this 

program have sufficient protection to safeguard Facebook users? 

Mr. SULLIVAN. Sir, from the security standpoint, we focus on a 

number of different things. This is a beta program that—only used 

on a very limited number of carefully selected partner sites at the 

moment. 

And we have done a couple of different things. We have done 

some external auditing of their security measures. I manage an information security team that has investigative experts who understand the different types of vulnerabilities the Web sites have. We 

have made suggestions. We have had dialogue with their internal 

experts. 

And then, we also on the security side, we make suggestions for 

requirements to put into the written contracts about the standards 

that we expect those sites to live up to. So as I mentioned earlier, 

we are PCI level one compliant, and there are other security standards and acronyms that I won’t share today, but are the types of 

things that we would look for. 

Mr. GOODLATTE. One last thing. You indicated in your testimony 

that you will use legal means to go after people that are behind 

specific scams. Can you elaborate on this? Is it civil actions that 

you will pursue, or do you assist law enforcement authorities in 

pursuit of criminal charges, or both? What are you talking about 

there? 

Mr. SULLIVAN. So our goal is always to prevent something bad 

from happening. But if it does happen our second goal is to be incredibly aggressive. 

And so, I mentioned in my written testimony in a bit earlier a 

couple of the CAN-SPAM cases that we have brought. And so, in 

these two cases that have received a decent amount of attention in 

74 

the mainstream press, they have actually received even more attention in the forums where the bad guys meet. 

And we spend a lot of time on my team in those forums. Like 

the folks at Symantec do, we spend a lot of time trying to understand what the bad guys are interested in, what they are focused 

on, which companies they are targeting, what their newest techniques are. 

And it has been fascinating for us to take back and share with 

the company the impact of these spam cases. You know, we certainly aren’t going to collect $700 million from Mr. Guerbuez or, 

you know, $800 million from Sanford Wallace, but we are going to 

be pursuing them for the rest of their life, and that is a heavy judgment hanging over their heads. 

And you see people talking in these forums, saying, ‘‘Don’t go 

after Facebook. That is a bad idea.’’ So we do see a deterrent effect 

in that type of civil action. 

Likewise, on the criminal side, we have brought a number of 

cases to both the FBI and the Secret Service over the last couple 

of years where we have identified individuals or groups that are attempting to target our users, whether through distribution of 

malware or through spam or other types of problems like that. 

Mr. GOODLATTE. Thank you. 

My time has expired. Thank you, Mr. Chairman. 

Mr. QUIGLEY. Thank you. 

Mr. Deutch is recognized. 

Mr. DEUTCH. Thank you, Mr. Chairman. 

Gentlemen, I think we need to do a better job of raising awareness among Internet users, particularly children. While most social 

networking activities are harmless, the fact is there are people who 

are out there who are going to tell a lie and hurt you. 

And whether it is someone seeking easy money or a child predator, when it comes to social networking, these criminals know the 

game, and they are going to play it. I am deeply concerned about 

the risks that the predators pose to children, and I believe we need 

to do more to minimize the risks to children online. 

Education is a critical component of crime prevention. As a parent, I am no stranger to the need to talk to children early and often 

about online predators. Parents must play a critical role to make 

them understand the risks that are out there. 

Now, I applaud the efforts of the FBI, Secret Service and other 

law enforcement agencies to protect children, but I think everyone 

would agree, if even one child is victimized, we as a government 

need to do more. And while we can’t promise our children that we 

are never going to let them down, we can at least commit to not 

deserting them and focus on what additional tools might be helpful. 

To that end, as a Member of the Foreign Affairs Committee, I am 

particularly interested in the international component of this problem. Criminals thrive in areas where the government is too blind 

to see. And while this is true of traditional criminal activities, it 

is particularly true of Internet-based crimes. 

So how do we go after criminals who know the rules and purposely set up shop in lawless areas or countries that are willing to 

turn a blind eye to these activities? I guess, Mr. Merritt and Mr. 

Snow, I would turn to you for this. 

75 

Mr. MERRITT. Sir, I think somebody referenced it earlier, some 

of the challenges when these crimes originate overseas and they 

target either U.S. citizens or corporations, and then the financial 

infrastructure. In addition to some countries that don’t have legislation that makes this necessarily a crime in their country, there 

are other challenges, as well. 

I mean, I think law enforcement here in the United States has 

been able to dispel the myth of anonymity that the computer and 

the Internet provide to the criminals because we have been successful in many investigations identifying these people. 

But you get into lack of legislation, countries that don’t have an 

extradition treaty with the states, the official channels that we normally go through for MLATs and letters rogatory are very cumbersome and time-consuming. 

So a lot of it develops—and I will let Gordon speak for himself, 

but it develops on the relationship that you have with your foreign 

law enforcement counterparts and what you are able to successfully 

do with them, because we obviously have limited jurisdiction overseas. 

Mr. SNOW. Yes, sir. I will—the comments of Mr. Merritt. The relationship internationally is just completely critical, and in legislation development, which, you know, we don’t speak to but Department of Justice does, is also critical, the MLAT, the letter 

rogatories, the officer-to-officer contact that we have. 

And then the private-public partnerships that develop when you 

talk about child exploitation is critical also. So the National Center 

for Missing and Exploited Children are really doing some fantastic 

things in their public-private partnership, along with the International Center for Missing and Exploited Children. 

Mr. DEUTCH. Thank you. 

Mr. Sullivan, I am looking at the statement of rights and responsibilities on Facebook, which says, very clearly, you will not use 

Facebook if you are under 13. I would suggest to you that there are 

more 60-, 70-and 80-year-old grandparents, widows and widowers, 

with full, rich life histories who are, in fact, 10, 11 and 12 years 

old on Facebook than you could even imagine. 

And I wonder, since Facebook very clearly says it should not be 

used unless you are 13, what should we be doing? Do we pretend 

that the younger kids aren’t doing it? Is there something Facebook 

can be doing to make it safer for those younger kids, which is, I 

think, the approach that makes the most sense to me? And have 

you tried to track the number of pre-teens who are actually using 

Facebook, since the numbers must be astounding? 

Mr. SULLIVAN. Sir, you are right that our policy is very clear, 

that we don’t want people under the age of 13 to use our service. 

And we have taken a multi-tiered approach to trying to make that 

happen. And to the extent that you are aware, or if you become 

aware of someone under the age of 13, or you know their parents, 

I would ask that you put them in touch with me or advise them 

not to use the service until they turn 13. 

It is a topic that has received a lot of attention in recent years, 

how do we address teens and youth online. And the approach we 

have taken is kind of a three-tiered approach. I think that we do 

76 

focus on policy and we focus on education, and then we build tools 

to try and prevent those under 13 from using our site. 

Mr. DEUTCH. I guess just if I may, Mr. Chairman, the last question is there are two approaches. You can devote considerable energy to trying to prevent 11-and 12-year-old kids from using 

Facebook, or you can acknowledge that there are thousands and 

thousands of 11 and 12 and 10, and I don’t even know how young, 

kids who are using Facebook, and ratchet up the privacy levels or 

create a separate area for them. And is that even part of your 

thinking, or is the focus entirely on keeping them off? 

Mr. SULLIVAN. Our focus right now is on keeping them off of 

Facebook and on making Facebook as safe as possible for that 13 

to 18 group that is on the site. And so, I mentioned earlier that 

we don’t have different rules for people in different jurisdictions 

around the world. We do treat people differently who are under the 

age of 18 in terms of what we would even allow them to do on the 

site or the type of information that is even made visible to them. 

Mr. DEUTCH. Last question, Mr. Chairman. Do you deny access 

to anyone—do you scan your members to find those who are clearly 

describing life experiences in one way on their biography, and then 

have pictures of little kids, lots and lots of pictures of 10, 11 year 

olds on their site? 

Mr. SULLIVAN. We do have some back-end tools and algorithms 

that we use. We also rely on a considerably passionate user community who is very happy to report other people to us. And finally, 

we do use technology to, you know, try and identify and make sure 

that those people aren’t on our site. 

Mr. DEUTCH. Okay. I think, finally, there is an obligation also, 

as you work to address all of the concerns, if you know that there 

are thousands of kids out there that, while the goal may be to keep 

them off, we should be trying, and you should be trying, to keep 

them safe, as well. 

Mr. SULLIVAN. That is right. 

Mr. QUIGLEY. Gentleman’s time has expired. 

I would like to thank the witnesses for their testimony today. 

Members may have additional written questions, which we will forward to you and ask that you answer as promptly as you can so 

that they may be made part of the hearing record. The record will 

remain open for 1 week for submission of additional material. 

Without objection, the Subcommittee stands adjourned. 

[Whereupon, at 3:35 p.m., the Subcommittee was adjourned.] 

(77) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD

f 


B.eps
78 


A-2.eps
79 


A-3.eps
80 

f 


A-4.eps
81 

f 


C.eps
82 


D-1.eps
83 


D-2.eps
84 


D-3.eps
85 


D-4.eps
86 


D-5.eps
87 


D-6.eps
88 


D-7.eps
89 


D-8.eps
90 

Æ 


D-9.eps