U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

89–407 PDF 2003

FIGHTING FRAUD: IMPROVING

INFORMATION SECURITY

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON 

FINANCIAL INSTITUTIONS AND CONSUMER CREDIT

AND THE

SUBCOMMITTEE ON 

OVERSIGHT AND INVESTIGATIONS 

OF THE

COMMITTEE ON FINANCIAL SERVICES

U.S. HOUSE OF REPRESENTATIVES

ONE HUNDRED EIGHTH CONGRESS

FIRST SESSION

APRIL 3, 2003

Printed for the use of the Committee on Financial Services

Serial No. 108–19

(

(II)

HOUSE COMMITTEE ON FINANCIAL SERVICES 

MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa 

DOUG BEREUTER, Nebraska 

RICHARD H. BAKER, Louisiana 

SPENCER BACHUS, Alabama 

MICHAEL N. CASTLE, Delaware 

PETER T. KING, New York 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

ROBERT W. NEY, Ohio 

SUE W. KELLY, New York, Vice Chairman 

RON PAUL, Texas 

PAUL E. GILLMOR, Ohio 

JIM RYUN, Kansas 

STEVEN C. LATOURETTE, Ohio 

DONALD A. MANZULLO, Illinois 

WALTER B. JONES, JR., North Carolina 

DOUG OSE, California 

JUDY BIGGERT, Illinois 

MARK GREEN, Wisconsin 

PATRICK J. TOOMEY, Pennsylvania 

CHRISTOPHER SHAYS, Connecticut 

JOHN B. SHADEGG, Arizona 

VITO FOSELLA, New York 

GARY G. MILLER, California 

MELISSA A. HART, Pennsylvania 

SHELLEY MOORE CAPITO, West Virginia 

PATRICK J. TIBERI, Ohio 

MARK R. KENNEDY, Minnesota 

TOM FEENEY, Florida 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

TIM MURPHY, Pennsylvania 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

KATHERINE HARRIS, Florida 

RICK RENZI, Arizona 

BARNEY FRANK, Massachusetts 

PAUL E. KANJORSKI, Pennsylvania 

MAXINE WATERS, California 

CAROLYN B. MALONEY, New York 

LUIS V. GUTIERREZ, Illinois 

NYDIA M. VELA ́ ZQUEZ, New York 

MELVIN L. WATT, North Carolina 

GARY L. ACKERMAN, New York 

DARLENE HOOLEY, Oregon 

JULIA CARSON, Indiana 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

BARBARA LEE, California 

JAY INSLEE, Washington 

DENNIS MOORE, Kansas 

CHARLES A. GONZALEZ, Texas 

MICHAEL E. CAPUANO, Massachusetts 

HAROLD E. FORD, JR., Tennessee 

RUBE ́ N HINOJOSA, Texas 

KEN LUCAS, Kentucky 

JOSEPH CROWLEY, New York 

WM. LACY CLAY, Missouri 

STEVE ISRAEL, New York 

MIKE ROSS, Arkansas 

CAROLYN MCCARTHY, New York 

JOE BACA, California 

JIM MATHESON, Utah 

STEPHEN F. LYNCH, Massachusetts 

BRAD MILLER, North Carolina 

RAHM EMANUEL, Illinois 

DAVID SCOTT, Georgia 

ARTUR DAVIS, Alabama 

BERNARD SANDERS, Vermont

Robert U. Foster, III, Staff Director 

(III)

SUBCOMMITTEE ON FINANCIAL INSTITUTIONS AND CONSUMER CREDIT

SPENCER BACHUS, Alabama, Chairman

STEVEN C. LATOURETTE, Ohio, 

Vice Chairman 

DOUG BEREUTER, Nebraska 

RICHARD H. BAKER, Louisiana 

MICHAEL N. CASTLE, Delaware 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

SUE W. KELLY, New York 

PAUL E. GILLMOR, Ohio 

JIM RYUN, Kansas 

WALTER B. JONES, Jr., North Carolina 

JUDY BIGGERT, Illinois 

PATRICK J. TOOMEY, Pennsylvania 

VITO FOSSELLA, New York 

MELISSA A. HART, Pennsylvania 

SHELLEY MOORE CAPITO, West Virginia 

PATRICK J. TIBERI, Ohio 

MARK R. KENNEDY, Minnesota 

TOM FEENEY, Florida 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

TIM MURPHY, Pennsylvania 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

RICK RENZI, Arizona 

BERNARD SANDERS, Vermont 

CAROLYN B. MALONEY, New York 

MELVIN L. WATT, North Carolina 

GARY L. ACKERMAN, New York 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

LUIS V. GUTIERREZ, Illinois 

DENNIS MOORE, Kansas 

CHARLES A. GONZALEZ, Texas 

PAUL E. KANJORSKI, Pennsylvania 

MAXINE WATERS, California 

NYDIA M. VELA ́ ZQUEZ, New York 

DARLENE HOOLEY, Oregon 

JULIA CARSON, Indiana 

HAROLD E. FORD, JR., Tennessee 

RUBE ́ N HINOJOSA, Texas 

KEN LUCAS, Kentucky 

JOSEPH CROWLEY, New York 

STEVE ISRAEL, New York 

MIKE ROSS, Arkansas 

CAROLYN MCCARTHY, New York 

ARTUR DAVIS, Alabama 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

SUE W. KELLY, New York, Chair

RON PAUL, Texas, Vice Chairman 

STEVEN C. LATOURETTE, Ohio 

MARK GREEN, Wisconsin 

JOHN B. SHADEGG, Arizona 

VITO FOSSELLA, New York 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

TIM MURPHY, Pennsylvania 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

LUIS V. GUTIERREZ, Illinois 

JAY INSLEE, Washington 

DENNIS MOORE, Kansas 

JOSEPH CROWLEY, New York 

CAROLYN B. MALONEY, New York 

CHARLES A. GONZALEZ, Texas 

RUBEN HINOJOSA, Texas 

JIM MATHESON, Utah 

STEPHEN F. LYNCH, Massachusetts 

(V)

C O N T E N T S 

Page 

Hearing held on: 

April 3, 2003 ..................................................................................................... 1

Appendix: 

April 3, 2003 ..................................................................................................... 53

WITNESSES 

THURSDAY, APRIL 3, 2003

Beales, J. Howard III, Director, Bureau of Consumer Protection, Federal 

Trade Commission ............................................................................................... 11

Brady, John J., Vice President, Merchant Fraud Control, MasterCard International ................................................................................................................. 33

Caddigan, Tim, Special Agent in Charge, Financial Crimes Division, United 

States Secret Service, accompanied by Robert Weaver, Deputy Special 

Agent in Charge, New York Field Office ............................................................ 8

Farnan, James E., Deputy Assistant Director, Cyber Division, FBI ................... 10

Hendricks, Evan, Editor and Publisher, ‘‘Privacy Times’’ .................................... 34

McIntyre, David J. Jr., President and CEO, TriWest Healthcare Alliance ........ 25

Mitnick, Kevin D., President and Co-founder, Defensive Thinking .................... 27

Pratt, Stuart, President, Consumer Data Industry Association .......................... 31

APPENDIX 

Prepared statements: 

Bachus, Hon. Spencer ...................................................................................... 54

Kelly, Hon. Sue W. ........................................................................................... 56

Oxley, Hon. Michael G. .................................................................................... 58

Gillmor, Hon. Paul E. ....................................................................................... 60

Hinojosa, Hon. Rube ́n ....................................................................................... 61

Paul, Hon. Ron .................................................................................................. 63

Shadegg, Hon. John B. ..................................................................................... 65

Beales, Howard ................................................................................................. 67

Brady, John J. ................................................................................................... 86

Caddigan, Timothy ........................................................................................... 92

Farnan, James E. ............................................................................................. 98

Hendricks, Evan ............................................................................................... 105

McIntyre, David J. Jr. ...................................................................................... 114

Mitnick, Kevin .................................................................................................. 124

Pratt, Stuart K. (with attachments) ............................................................... 130

Weaver, Bob ...................................................................................................... 141

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

Assistant Secretary of Defense, William Winkenwerder, Jr., prepared statement ...................................................................................................................... 145

Farnan, James E.: 

Written response to questions from Hon. Sue W. Kelly ................................ 150

Hendricks, Evan: 

Written response to questions from Hon. Sue W. Kelly ................................ 151

Page

VI

McIntyre, David J. Jr.: 

Written response to questions from Hon. Sue W. Kelly ................................ 153

Mitnick, Kevin: 

Written response to questions from Hon. Sue W. Kelly ................................ 156

(1)

FIGHTING FRAUD: IMPROVING 

INFORMATION SECURITY 

Thursday, April 3, 2003

U.S. HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON FINANCIAL INSTITUTIONS

AND CONSUMER CREDIT, JOINT WITH THE SUBCOMMITTEE ON

OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON FINANCIAL SERVICES, Washington, D.C. 

The subcommittee met, pursuant to call, at 10:07 a.m., in Room 

2128, Rayburn House Office Building, Hon. Sue W. Kelly [chairwoman of the Subcommittee on Oversight and Investigations] presiding. 

Present: Representatives Bachus, Kelly, Shadegg, Fossella, 

Capito, Tiberi, Feeney, Hensarling, Murphy, Barrett, Renzi, 

Maloney, Gutierrez, Hooley, Carson, Sherman, Inslee, Moore, Ford, 

Lucas of Kentucky, McCarthy, and Matheson. 

Chairwoman KELLY. The Committee on Oversight is pleased to 

be able to have this hearing today. 

Personal information has to be safeguarded throughout our national credit system. Just as consumers shred their unwanted mail 

and take care with their receipts, financial institutions have to develop and upgrade their information security procedures to protect 

consumers. Financial records such as credit card numbers are combined with other pieces of personal information, and they are the 

first targets of identity thieves. Years of work are often necessary 

for both consumer and business victims to correct damaged credit 

histories and restore access to credit. 

Today two subcommittees will hear from the witnesses on three 

specific case studies to review current industry practices and to ensure that proper security procedures and protocols are in place or 

are being implemented. 

Teledata Communications is a company in my home State of 

New York that enables businesses to access credit bureau information so they can grant credit to consumers. An employee inside the 

company allegedly stole and sold passwords and codes for accessing 

credit reports for thousands of people. According to law enforcement, his actions resulted in millions of dollars of financial theft. 

TriWest Healthcare, an important health care provider for our 

active duty military personnel, honored veterans and their dependents, suffered the physical theft of its computer hardware. The 

equipment stored personal information about many of our heroes 

now involved in the war to liberate Iraq, including the Chairman 

2

of the Joint Chiefs of Staff, General Richard Myers. Fortunately, 

quick action by the company and the credit bureaus appears thus 

far to have prevented misuse of the information. 

Another company, Data Processing International, in Nebraska 

saw its database of millions of credit card numbers hacked from 

the outside. It again appears that rapid action this time by the 

company and the credit card companies have prevented improper 

use of the numbers to date. 

Through the examination of these cases the subcommittee will 

review how credit issuers, third party vendors that process transaction, credit bureaus and law enforcement agencies coordinate efforts to limit harm to consumers when data security is breached. 

Among our witnesses are officials of the law enforcement and regulatory agencies involved with these and other such cases, representatives of the companies involved, one of the most notorious 

computer hackers in the world, who is now a consultant, I am 

happy to report, and an expert in privacy. 

I want to thank my distinguished colleague, Representative 

Spencer Bachus, the chairman of the Subcommittee on Financial 

Institutions and Consumer Credit, for joining us in holding this important hearing of our subcommittees. I also want to congratulate 

him for his leadership in the bipartisan passage of H.R. 522, the 

Federal Deposit Insurance Reform Act of 2003, by the full House 

yesterday. 

With that, I turn to Mr. Gutierrez. 

[The prepared statement of Hon. Sue W. Kelly can be found on 

page 56 in the appendix.] 

Mr. GUTIERREZ. Good morning, Chairs Kelly and Bachus, and 

members of the committee. Today more than ever identity theft 

takes myriad forms. Modern thieves are using massive digitized 

databases to access and steal consumers’ personal information. As 

too many people are learning the hard way, identity thieves steal 

Social Security, bank account, and credit card numbers and use 

them to commit fraud, very often destroying the credit rating and 

financial future of their victims. Every year thousands of these victims are left financially ruined, often with severe credit problems 

and even false criminal records that they must spend years working to erase. Even in minor cases victims spend endless hours. 

So we are gathered here today to discuss ways to help consumers 

by increasing the security of data that contains our personal information and to understand some of the possible loopholes that have 

enabled these cases to occur in the first place, to hear about data 

security efforts undertaken by the companies that hold our private 

information, and look for ways to help consumers have quick and 

better access to their personal records when identity theft incidents 

occur. One of the most fundamental problems is consumers are 

often left out of the loop after their information has been stolen 

and this is unacceptable. 

In one of the cases that will be discussed today a former employee of Teledata is being charged with the biggest identity theft 

fraud in U.S. history. One of the most outrageous aspects of this 

specific case is that in March of 2000 the alleged perpetrator quit 

his job, but that didn’t even slow down his scheme. He only worked 

there for 10 months but the scam continued for 3 years. The comVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
3

pany security codes he allegedly stolen still worked and were accessible right up to the moment of his arrest. In the meantime 30,000 

people had their identities stolen and financial losses reached more 

than $2.7 million. 

How could personal data be so easily accessible? What kinds of 

safeguards do companies have in place to deter these practices? I 

hope that this hearing will serve as an opportunity to answer these 

questions and others. I thank you for holding the hearing, and I 

look forward to the testimony, and I ask unanimous consent that 

my complete opening statement be submitted for the records. 

Chairwoman KELLY. Thank you very much, Mr. Gutierrez. Mr. 

Bachus. 

Mr. BACHUS. Thank you, Chairman Kelly, for telling me my mike 

wasn’t on, that is very important, and also for convening this joint 

hearing of our two subcommittees to review issues relating to the 

security of personal information. This is an issue of critical importance to the financial service industry and I believe this hearing is 

a timely one, and it is actually one of a series of hearings that 

Chairwoman Kelly has been holding over the past year or two on 

this issue. 

This hearing, which is titled ‘‘Fighting Fraud: Improving Information Security,’’ is one of many hearings that will be held by the 

Subcommittee on Financial Institutions and Consumer Credit regarding the security of personal information. I expect that at some 

point our efforts will culminate in comprehensive legislation addressing the broad issue of how secure consumers feel with respect 

to their personal information. 

Today’s hearing will focus on three cases where sensitive personal information was compromised through hacking or physical 

theft of computer databases. Each case that we will hear about 

today is illustrative of a different type of security breach: An outside computer hacker, employee misconduct, and a garden variety 

burglary. Using these cases, we will review how credit issuers, 

third party vendors that process transactions, credit bureaus, and 

law enforcement coordinate efforts to limit harm to consumers 

when data security is breached. 

Fighting fraud and protecting the security of personal information is a topic that unites financial institutions and consumers. 

Each group is harmed by the fraudulent use of personal information. Financial institutions are the victims of fraud because the financial institution is usually liable for any losses suffered as a result of that fraud. Consumers obviously suffer unnecessary inconvenience and insecurity as a result of fraud and they can be exposed to additional crimes such as identify theft. Furthermore, at 

least a portion of financial institutions’ fraud losses can be expected 

to be passed on to consumers in the form of higher prices. There 

can be no doubt that when fraud is committed everyone loses. 

For obvious reasons financial institutions take precautions to 

prevent fraud, including precautions to protect the security of personal information. In addition to the self-interest financial institutions have in minimizing their fraud losses, Congress has required 

financial institutions to maintain appropriate standards relating to 

information security, including standards to protect against unauthorized access to a financial institution’s customer records as part 

4

of the Gramm-Leach-Bliley Act. The requirements as adopted by 

the Federal banking agencies also require financial institutions to 

oversee their relationship with third party service providers, including having the service providers agree by contract to implement a comparable information security program. It is my understanding that the Federal banking agencies have been examining 

financial institutions with respect to their compliance with these 

requirements. 

However, I remain interested in learning more about the role 

service providers play with respect to information practices and the 

ability to maintain appropriate information security programs. It is 

my understanding that the Bank Service Company Act gives the 

bank regulators broad authority to examine third party providers. 

Two of the cases today illustrate that greater oversight of these entities may be necessary. 

As part of Gramm-Leach-Bliley, Congress also enacted stiff prohibitions against a practice known as pretext calling, which is a 

fraudulent means of obtaining an individual’s personal information. 

Pretext callers contact a financial institution’s employees and attempt to obtain customer information usually while posing as a 

customer whose information they are trying to collect. This is a serious issue and one that both Subcommittees—actually the Oversight Committee has held several hearings previously. I am interested in learning more about efforts to enforce this prohibition and 

the Federal Trade Commission’s advice on the amount of resources 

devoted to fighting this fraudulent practice. 

We will also hear this morning from Federal law enforcement 

agencies about their approach to countering those who would compromise the security of personal information. It has always been 

my experience that law enforcement and the financial services industry works well together with respect to pursuing those who attempt to commit crimes against consumers and financial institutions. I look forward to hearing about law enforcement’s perspective on this important topic, especially with respect to representatives from the FBI, Secret Service and FTC. 

In short, financial institutions, Congress, the banking agencies, 

and law enforcement have been working to address information security and fraud prevention issues. Regardless of the great pains 

taken by all these parties to protect the security of personal information, the chance remains that a breach may occur. Therefore, 

Congress must remain vigilant to ensure that existing regulations 

are implemented appropriately and examine whether new safeguards are necessary. Furthermore, it is just as important for financial institutions to have mitigation plans in place in the event 

that their information security program is hacked or otherwise 

compromised. 

In conclusion, let me say I am pleased that we will hear from 

several witnesses today who will describe how various parties took 

action to address recent breaches and prevent subsequent fraud. 

Before we proceed I believe it is important to mention to the entire 

panel that although this hearing is a public forum, we should avoid 

discussing specific details which may give criminals ideas or even 

a road map for doing further harm. 

5

Let me close by thanking Chairman Oxley for recognizing the importance of improving the security of personal information and 

scheduling this hearing. We must continue to work to improve security and protect sensitive data to ensure the consumers continue 

to have confidence in our nationwide credit system as well as our 

financial services system in general. I look forward to working with 

the chairman, Mrs. Kelly, and other colleagues as we continue to 

examine this complicated issue. 

[The prepared statement of Hon. Spencer Bachus can be found 

on page 54 in the appendix.] 

Chairwoman KELLY. Thank you. Mrs. McCarthy, do you have an 

opening statement? 

Mrs. MCCARTHY. Thank you. I will wait for the testimony. 

Chairwoman KELLY. Mr. Moore. 

Mr. MOORE. Thank you, Madam chair and Congressman Bachus. 

I appreciate both of you convening this hearing. I appreciate the 

witnesses being present. I want to reiterate, I won’t say it all, what 

Congressman Bachus and Congresswoman Kelly said before, and 

that is this is a very important area. As a district attorney for 12 

years I worked closely with people in fraud cases and a lot of the 

things—this was back in the 1970s and 1980s, so a lot of the things 

we are talking about here today weren’t relevant then, weren’t 

even around then. As the Internet has expanded and accessibility 

of the Internet is used not only by individuals but by financial institutions and other organizations and private and important individual data is contained in databases, I think it is very, very important that we protect that information. I think individuals who 

have private important information stored in those databases have 

a right to expect that companies and institutions will take adequate measures to protect that information. Obviously, theft of that 

information, identity theft and theft of financial information about 

an individual can cause great harm to a person and to their family, 

and it ends up costing all the consumers I think a lot of extra 

money. 

So I am interested to hear what the witnesses have to say and 

very much appreciate you being here. 

Thank you. 

Chairwoman KELLY. Thank you very much. 

Mr. Shadegg. 

Mr. SHADEGG. Thank you, Chairwoman Kelly. I want to begin by 

thanking you and Chairman Bachus for holding this important 

hearing on information security. I also want to begin by thanking 

one of my constituents, David McIntyre, president and CEO of 

TriWest Healthcare Alliance, for agreeing to be here and testify 

today. 

My personal interest in identity theft and information security 

began about 5 years ago when two of my constituents, Bob and Joanne Hartle of Phoenix, Arizona were victims of identity theft. My 

constituents, following their victimization, were instrumental in securing the passage of the first State law in the Nation criminalizing identity theft. Mr. and Mrs. Hartle suffered the devastation 

of identity theft when a convicted felon took Mr. Hartle’s identity 

and made purchases totaling over $100,000. In addition, this individual purchased handguns using Mr. Hartle’s clean record to get 

6

around the Brady law. Finally and shockingly in this day of terrorism, this individual also used Mr. Hartle’s clean record and military record to obtain security clearance to secure areas of Phoenix 

Sky Harbor International Airport. As a result of this victimization 

at a time when there were no State laws and no Federal laws penalizing identity theft, Mr. and Mrs. Hartle were forced to spend 

more than 4 years of their life and more than $15,000 of their own 

money seeking to restore their credit. 

Their case led me to introduce legislation to criminalize identity 

theft at the Federal level. The Identity Theft and Assumption Deterrence Act of 1998 was signed into law by President Clinton on 

October 30th, 1998. It gives for the first time Federal law enforcement agencies, including those who are represented before us here 

today, the authority to investigate and prosecute identity theft. 

But following the passage of that law, I found there was more 

that needed to be done. We began to notice that the Federal agencies with this new authority were unfamiliar with it and did not 

have a habit of coordinating with local law enforcement on these 

issues. So we began a series of meetings that lasted over a year in 

Phoenix, Arizona between Federal law enforcement agencies, including the FBI and others here today and State and local law enforcement agencies, to try to resolve the tough issues of who should 

act and what they should do in the interplay between Federal and 

State laws and in the interplay of these crimes where someone is 

victimized in one place but lives many States away, thousands of 

miles away. 

Mr. and Mrs. Hartle also turned their unfortunate circumstance 

into something very positive. They established a nonprofit organization to assist other victims of identity theft. Their Web site, 

www.idfraud.net, is available to provide guidance to any identity 

theft victims across the Nation, and they have devoted themselves 

to this task. 

Identity theft ranges from individual instances like the Hartles 

involving small or large amounts to large organized professional 

crime rings. In fact TriWest Healthcare Alliance may well have 

been the victim of a professional identity theft operation. Like the 

Hartles, Mr. McIntyre, my constituent, and his company took an 

unfortunate circumstance, a burglary of their computer in which 

data was stolen, and turned into a positive model for other companies to follow. 

Following the break-in of their Phoenix office and the theft of 

computer hard drives containing their clients’ sensitive personally 

identifiable information, Mr. McIntyre and TriWest Healthcare Alliance embarked upon an aggressive effort to notify all 562,000 affected customers of the theft. The stolen data included personally 

identifiable information such as Social Security numbers, birth 

dates and addresses for military personnel, one quarter of whom 

were on active duty at the time, retirees and family members, all 

whom are served by TriWest under a contract with the Department 

of Defense. 

TriWest immediately reported the theft to the police, notified the 

Department of Defense officials and launched a 30-hour data run 

to determine what files were stolen. In addition, the company established a dedicated e-mail address and set up toll free telephone 

7

lines with a three-tier response network so that customers would 

not experience long delays in trying to find out information about 

the theft and about how it might affect them. TriWest mailed letters notifying victims of theft and provided guidance on steps they 

could take to protect their credit. TriWest also posted a $100,000 

reward for leading to the conviction of those responsible for the 

theft. 

In all, TriWest undertook great efforts to notify victims of the 

theft at great financial expense to the company. But due to their 

extraordinary efforts to date no information from the stolen computer files has yet led to a single instance of identity theft. 

The nature of identity theft has changed and the threat is more 

likely than ever to come from breaches of data security, which is 

why I think this hearing is most appropriate. According to an identity fraud manager at the Federal Trade Commission, there is a 

shift by identity thieves from going after single individuals to going 

after mass information. Law enforcement experts now estimate 

that half of all cases come from thefts of business data banks as 

more and more information is stored in databases which are vulnerable to attack from hackers. 

The Identity Theft and Assumption Deterrence Act of 1998 was 

an important first step in the road to crack down on identity theft 

crimes. However, more legislation is needed to protect people from 

these thieves and from easily obtaining Social Security and credit 

card numbers, to provide better coordination between victims and 

credit reporting bureaus, to establish procedures for businesses to 

follow in the event of a data security breach like we will discuss 

today, and provide stiffer penalties for those who steal and use 

other persons’ ID. 

I look forward to the testimony of the witnesses and help to identify areas in which a legislative response may be needed. I yield 

back. 

[The prepared statement of Hon. John B. Shadegg can be found 

on page 65 in the appendix.] 

Chairwoman KELLY. Ms. Hooley. 

Ms. HOOLEY. Thank you, Madam Chairwoman and Mr. Chairman. I appreciate the Chairs and ranking members of both subcommittees in putting together today’s hearing and look forward to 

hearing more about our Nation’s data protection. This is an important hearing and hopefully it will be the first of many hearings on 

the issue of identity theft. It is the fastest growing crime in the 

United States. I know through these and other hearings we will 

not only learn about the challenges in fighting identity theft, but 

also hear unique and effective suggestions on how we in Congress 

can better protect our consumers and financial institutions from 

this crime. 

I know I can speak for everyone on the Financial Services Subcommittee when I say we are hear to listen with open minds and 

to put whatever work is necessary into solving this problem. This 

truly is a bipartisan issue, and in that regard I would like to thank 

Mr. LaTourette from Ohio for working so closely with me on legislation on identity theft that is nearly ready for induction. I would 

also like to thank Mr. Frank and all the members of the DemoVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00013 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
8

cratic Task Force on Identity Theft for pledging to work together 

on this issue. 

In order to protect both consumers and industry, we all certainly 

have our work cut out for us. But if the cooperation and dedication 

of people like Mr. LaTourette and Mr. Frank and the members of 

both subcommittees are any indication, we on the Financial Services Committee are up to the challenge. 

Thank you again, and I look forward to today’s proceedings and 

look forward to hearing from the panelists. Thank you. 

Chairwoman KELLY. Mr. Hensarling. Mrs. Maloney just left. Mr. 

Matheson. Mr. Barrett. Mr. Ford left. Mr. Lucas. Mr. Tiberi. Mr. 

Feeney. 

I will introduce our first panel: Mr. Tim Caddigan, the Special 

Agent in Charge of the Financial Crimes Division of the United 

States Secret Service, accompanied by Robert Weaver, Deputy Special Agent in Charge of the New York Field Office; James Farnan, 

Deputy Assistant Director of the Cyber Division in the FBI; and 

Mr. J. Howard Beales, III, Director of the Bureau of Consumer Protection in the Federal Trade Commission. 

We look forward to having you here today, and we look forward 

to your testimony. We will begin with you, Mr. Caddigan. 

STATEMENT OF TIM CADDIGAN, SPECIAL AGENT IN CHARGE, 

FINANCIAL CRIMES DIVISION, UNITED STATES SECRET 

SERVICE, ACCOMPANIED BY ROBERT WEAVER, DEPUTY SPECIAL AGENT IN CHARGE, NEW YORK FIELD OFFICE 

Mr. CADDIGAN. Thank you. Chairman Bachus, Chairwoman 

Kelly, Congressman Sanders, Congressman Gutierrez and members 

of both subcommittees, thank you for inviting me to be part of this 

distinguished panel and the opportunity to address the committee 

regarding the Secret Service efforts to protect our Nation’s financial and critical infrastructures. Let me also take the opportunity 

to thank Chairman Oxley, Congressman Frank and all the members of the full committee for their long-standing support of the Secret Service and the interest this committee has conveyed in our 

mission, our programs and our employees. 

With me today is Mr. Bob Weaver, Deputy Special Agent in 

Charge of the Secret Service’s New York Field Office and head of 

the New York Electronic Crimes Task Force. I am also pleased to 

be here with my colleagues and partners in fighting identity crimes 

and related computer crimes from the Federal Trade Commission 

and the FBI. 

In my full statement for the record I provided an overview of the 

Secret Service’s investigative mission and our historic responsibility for safeguarding our currency and financial infrastructure. 

The Secret Service has statutory jurisdiction to investigate a wide 

range of technology based crime, including credit and debit card 

fraud, identity theft, false identification fraud, counterfeit currency 

and checks, financial institution fraud and telecommunications 

fraud. These investigations are pursued through our 134 domestic 

offices with additional support from our 20 foreign offices. 

There is no shortage of information, testimony or anecdotal evidence, regarding the nature and variety of cyber based threats to 

our banking and financial sectors and the need to create effective 

9

solutions. There is, however, a scarcity of information regarding 

successful models to combat such crime in today’s high tech environment. One such successful model is the New York Electronic 

Crime Task Force and the valuable formula this task force has developed and applied to the prevention and detection of computer 

based crimes. 

Our New York task force has brought together 50 different Federal, State and local law enforcement agencies as well as prosecutors, academic leaders and over 100 different private sector corporations. The task force investigates substantial electronic criminal activity involving e-commerce frauds, identity crimes, telecommunications fraud, and a variety of computer intrusion crimes 

which affect a number of infrastructures. 

Since 1995, the New York task force has charged over 1,000 individuals with electronic crimes and the loss to Social Security exceeding $1 billion. It has trained over 60,000 law enforcement personnel, prosecutors and private industry representatives in the 

criminal abuses of technology and how to prevent them. The task 

force has identified tools and methodologies that can be employed 

by our partners to eliminate potential threats to their information 

systems. 

We consider the New York task force to be the 21st century law 

enforcement model that modernizes criminal justice and incorporates partnership and information sharing within its core competencies. Accordingly, Congress authorized the Secret Service in 

the U.S.A. PATRIOT Act of 2001 to expand our task force initiative 

to cities and regions across the country. We have since established 

electronic crimes task forces in Los Angeles, San Francisco, Chicago, Boston, Charlotte, Miami, Las Vegas and Washington, D.C.. 

Our task force model stresses prevention through partnership. 

We focus on the mitigation of damage and the quick repair of any 

damage or destruction to get the system operational as soon as possible after an intrusion occurs. 

Let me mention one critical point about our partnerships with 

other law enforcement agencies, academia and private sector. Partnerships cannot be legislated, regulated nor stipulated. Partnerships are voluntarily built between people and organizations that 

raise the value in joint collaboration towards a common end. They 

are fragile entities which need to be established and maintained by 

all participants and built on a foundation of trust. I cannot overstate the significance of these trusted partnerships to the success 

of our task force model. 

Let me share with you some insights regarding a recent ongoing 

case which our Omaha office is investigating in conjunction with 

our Chicago, New York, and San Francisco task forces. The case 

which came to our attention early February through our contacts 

in the credit card industry involves an unlawful intrusion into the 

computer system of a third party credit card processor, the companies responsible for processing credit card transactions of companies such as Visa, Master Card, American Express and Discovery. 

We believe that multiple machines combined to attack this processor’s computer system and unlawfully seized millions of credit 

card numbers along with expiration dates from the company’s filings. Our investigation with the FBI determined that these mulVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
10

tiple servers were located both within and outside the United 

States. The Secret Service is completing electronic forensic examinations and is working with foreign authorities in gathering further evidence concerning this attack. 

I want to conclude my statement by again thanking the members 

of both subcommittees and the full committee for their strong support of the Secret Service and our investigative mission. 

[The prepared statement of Tim Caddigan can be found on page 

92 in the appendix.] 

Chairwoman KELLY. Thank you very much, Mr. Caddigan. Mr. 

Farnan. 

STATEMENT OF JAMES FARNAN, DEPUTY ASSISTANT 

DIRECTOR, CYBER DIVISION, FBI 

Mr. FARNAN. Good morning. I would like to thank the Chairs of 

both subcommittees as well as the other members for their opportunity to testify today. Holding this hearing demonstrates your 

commitment to improving the security of our Nation’s information 

systems and this committee’s leadership on this issue. 

My testimony today will address the activities of the FBI’s Cyber 

Division as they relate to a broad spectrum of cyber criminal acts. 

Last week a headline in the Atlanta Journal Constitution announced Hackers Strike Georgia Tech Computer, Gain Credit Card 

Data. The article goes on to discuss the information on 57,000 people that was available to the hackers, including about 38,000 credit 

card numbers. The university had moved the database from one 

system to another but it failed to put up a fire wall to protect the 

data. 

Incidents like this happen every week, even to organizations at 

technology’s leading edge like Georgia Tech. American consumers 

and businesses are increasingly relying on the Internet. E-commerce is growing in all sectors of the U.S. economy. Although most 

e-commerce transactions are business to business, e-commerce retail sales in the United States reached $46 billion last year, up 

from $36 billion in 2001. 

When Internet users, be they businesses or consumers, are impacted by Internet crime, the viability of e-commerce is compromised. When a cyber crime is committed, the FBI is in a unique 

position to respond because it is the only Federal agency that has 

the statutory authority, expertise and ability to combine the 

counterterrorism, counterintelligence and criminal resources needed to effectively neutralize, mitigate and destruct illegal computer 

supported operations. 

The FBI’s reorganization of the last 2 years included the goal of 

making our cyber investigative resources more effective. In 2002 

the reorganization resulted in the creation of the Cyber Division 

where we have taken a two-tracked approach to the problem. One 

avenue is identified as traditional criminal activity that has migrated to the Internet, such as Internet fraud, online identity theft, 

Internet child pornography, theft of trade secrets and other similar 

crimes. 

The other nontraditional approach consists of Internet facilitated 

activity that did not exist prior to the establishment of computers, 

networks and the World Wide Web. This encompasses cyber terVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00016 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
11

rorism, terrorist threats, foreign intelligence operations, and criminal activity precipitated by illegal computer intrusions into U.S. 

computer networks, including the disruption of computer supported 

operations and the theft of sensitive data by way of the Internet. 

The FBI assesses the cyber threat to be rapidly expanding as the 

number of actors with the ability to utilize computers for illegal 

harmful and positively devastating purposes is on the rise. A typical case will come to the FBI through the Internet Fraud Complaint Center, which later this year will be renamed as the Internet Crime Complaint Center to more accurately reflect its mission. 

In its fourth year of operation the Center has proven to be a very 

successful clearinghouse, receiving over 75,000 complaints last year 

on crimes ranging from identity theft and computer intrusions to 

child pornography. 

If the Center, for example, received an intrusion report from a 

company in, say, Birmingham, Alabama, we would first attempt to 

locate where the intrusion took place. That same company may 

have its servers in Minneapolis while the intruder is routing 

through California and Europe. If the servers in Minneapolis were 

hacked, the Minneapolis Cyber Crime Task Force would be assigned to lead the case. The leads in California could end up in 

Eastern Europe, Nigeria or even back in Birmingham if an insider 

were involved. One of the FBI’s response teams would be called 

upon to preserve evidence and that evidence would be forwarded to 

one of our new regional computer forensic laboratories now located 

in Chicago, Dallas, and San Diego. Simultaneously other FBI computer experts would determine the extent and duration of the intrusion and whether the attacker came from inside or outside the 

company. Depending on the sophistication of the intruder, the case 

may be solved in a few days or it may take years. 

Cases are routinely complex and often involve international connections. Cyber crime continues to grow at an alarming rate and 

security vulnerabilities contribute to the problem. We will soon 

begin staffing a public-private alliance unit within the FBI which 

will work with administrators and security professionals to reduce 

opportunities for criminals by employing best practices and 

patching vulnerabilities before they can be exploited. Through that 

unit’s efforts combined with the efforts of those in this committee 

problems like the hacking experience by Georgia Tech will happen 

much less frequently. The FBI will continue to pursue cyber criminals as we try to stay one step ahead of them in the cyber crime 

technology race. 

I thank you for your invitation to speak today. I on behalf of the 

FBI look forward to working with you on this very important topic. 

[The prepared statement of James E. Farnan can be found on 

page 98 in the appendix.] 

Chairwoman KELLY. Mr. Beales. 

STATEMENT OF J. HOWARD BEALES, III, DIRECTOR, BUREAU 

OF CONSUMER PROTECTION, FEDERAL TRADE COMMISSION 

Mr. BEALES. Thank you, Chairman Kelly and members of the 

committee. I am Howard Beales, Director of the Federal Trade 

Commission’s Bureau of Consumer Protection. I am pleased to 

present the views of the Commission this morning. 

12

The Federal Trade Commission works to prevent and protect information security on a number of fronts. We take law enforcement 

actions, we provide victim assistance when security breaches result 

in identity theft. We educate both consumers and business and we 

hold public workshops to examine emerging issues. 

In our traditional role as a law enforcement agency the FTC has 

brought civil actions to enforce privacy promises, including cases 

where companies failed to take adequate security precautions with 

consumers’ personal information. When an information breach is 

reported, the FTC staff activates our protocol for triaging the 

breach. We evaluate the incident on a number of levels, including 

the extent of the breach and the type of information that was exposed. We also analyze any jurisdictional issues. We do not have 

jurisdiction over banks and common carriers, for example. In addition, we determine whether there is an ongoing criminal investigation, given that the breach may involve an underlying theft of information. We coordinate any FTC investigation with criminal authorities because we don’t want to get in the way of an ongoing 

criminal investigation. 

When the Commission determines that law enforcement action is 

appropriate we have two valuable tools to work with. First, section 

5 of the FTC Act, which prohibits unfair deceptive acts or practices 

such as misleading promises about information security; second, 

starting in May of this year, the Commission will enforce the 

Gramm-Leach-Bliley Act safeguards rule for the financial institutions within our jurisdiction. 

Last August the Commission announced a settlement with 

Microsoft regarding misleading claims about the information collected from consumers through its passport services. The Commission’s complaint alleged that Microsoft misrepresented the privacy 

afforded by these services, including the extent to which Microsoft 

kept the information secure. 

Microsoft is an important case because it involved alleged 

misstatements about the security provided for millions of consumers’ sensitive information. In addition, it held Microsoft to its 

security promises even in the absence of a known breach of the system. Thus, the Commission found even the potential for injury actionable when sensitive information and security promises were involved and when the potential for injury was significant. 

The Microsoft case was followed by the Commission’s case 

against Eli Lilly. The Lilly case involved alleged misrepresentation 

regarding the security provided for important information. Like 

Microsoft, Lilly made claims that it had security measures in place 

to protect the information collected from consumers on its Web site. 

As in Microsoft, the Commission charged Lilly with failing to have 

reasonable measures in place to protect the information. The order 

in the Lilly case prohibits the misrepresentations and as in Microsoft it requires Lilly to implement a comprehensive information security program. 

It is important to note that the Commission is not simply saying 

gotcha for security breaches. Although a breach may indicate a 

problem with a company’s security, breaches can happen even 

when a company takes all reasonable precautions. In such instances the breach does not violate the laws that the FTC enforces. 

13

Instead, the Commission recognizes that security is an ongoing 

process using reasonable and appropriate measures in light of the 

circumstances. That is the approach the mission took in these cases 

and in its Gramm-Leach-Bliley Act safeguards rule, and it is the 

approach we will continue to take. 

As I mentioned earlier, in May the Commission’s Gramm-LeachBliley Act safeguards rule takes effect. The rule requires financial 

institutions under our jurisdiction to develop and implement appropriate physical and procedural safeguards to protect customer information. The rule takes a flexible approach, requiring greater security measures for the most sensitive consumer information. It requires companies to assess the risks they face, take reasonable and 

appropriate steps to reduce those risks. Companies must also monitor their security performance and adjust their programs as the 

risks they face change over time. 

The FTC also plays a role in improving information security and 

in reducing risks to personal information by fostering dialogue and 

educating the public on security issues. For example, the Commission held a workshop last May to examine the security of consumer 

information, both as maintained by consumers on their own computers and by businesses on their systems. In May and June of this 

year the Commission will host workshops that focus on the role of 

technology again for both consumers and businesses. 

The cases of TriWest and Teledata communications Inc., in which 

massive numbers of individuals’ personal information was taken 

are good examples of where the Commission carried out its traditional education and assistance role. The staff provided advice to 

those companies on how to notify the affected individuals and what 

steps those consumers should take to protect themselves. 

From these experiences and others the FTC has developed a response kit for businesses which have suffered information security 

breaches. The kit tells businesses what steps to take to respond to 

a breach and includes a form letter for notifying the individuals 

whose information has been taken. These kinds of information security breaches place substantial costs on individuals and businesses. The Commission is committed to reducing these breaches 

as much as possible through its civil law enforcement authority 

and its education and assistance programs. 

Thank you for holding this hearing, and I look forward to your 

questions. 

Chairwoman KELLY. Thank you, Mr. Beales. I also want to note 

that we invited Dr. William Winkenwerder, the Assistant Secretary 

of Defense for Health Affairs at the Defense Department to discuss 

the DOD’s role in mitigating the impacts of a theft at TriWest. Unfortunately, he had already accepted an invitation to testify about 

this before the Senate Finance Committee right now and his deputy is on travel. 

Dr. Winkenwerder submitted a statement for the record and with 

the members’ unanimous consent I want to enter it into the record 

at this time. 

[The prepared statement of William Winkenwerder can be found 

on page 145 in the appendix.] 

Chairwoman KELLY. We thank all of you and I would like to 

begin with you, Mr. Caddigan, asking you a couple of questions. We 

14

commend the entire Secret Service and especially the agents in the 

New York Field Office for your truly dedicated and outstanding 

service to this country. We in New York are understandably very 

proud of the tenacity of the New York Field Office as it recovered 

from the destruction of its offices at 7 World Trade Center. 

I would like to ask if your task force and the stronger emphasis 

on information security since 9/11 has led to law enforcement successes? 

Mr. CADDIGAN. Madam Chairwoman, I think it is safe to say yes, 

the proactive approach that the task force model in New York 

takes with regard to partnering with businesses, it gets on the 

front end of an issue. We help establish self-assessment 

vulnerabilities in a particular entity. We can help mitigate those on 

the front end. We can help develop a response plan for that business should they be victimized. So do those actions prevent activity 

or help mitigate that in the long run? Yes, ma’am, I would say that 

it does. 

Chairwoman KELLY. That is very good to hear. 

Mr. Farnan, your testimony discusses two cases in which the 

hacker was arrested overseas. How often are hacking cases originated from an overseas point? Do you want to answer that? 

Mr. FARNAN. Much more frequently than we might care to think 

about. What we have learned and the model we come from in law 

enforcement is to typically think along State jurisdiction lines and 

the FBI, of course we think when violations may cross State jurisdictional lines. With the advent of the Internet and the World Wide 

Web, we have to completely reevaluate those jurisdictional lines. 

We now have to think of the entire planet as a ground or platform 

from which perpetrators can act, and so we do see a lot of activity 

from persons based in overseas countries or outside the United 

States. 

Chairwoman KELLY. Mr. Caddigan, do you want to address that? 

Mr. CADDIGAN. I think crime has become global in nature, especially with the onset of the Internet and computer. What can take 

place in a criminal activity in California can almost instantaneously have the victim be victimized in Asia, for example. So we 

do look at things as a borderless society with regard to fighting 

crime. We do partner not only domestically with business and law 

enforcement, but I think it is also as critical to partner in the foreign arena with foreign businesses, foreign law enforcement and 

governments. 

Chairwoman KELLY. Mr. Farnan, is the FBI concerned that large 

scale hacks or the denial of service attacks might be an instrument 

of international terrorism? 

Mr. FARNAN. We are definitely concerned about that. In the 

Cyber Division what we have done is aligned our priorities along 

with those of the FBI. So counterterrorism is our number one priority and our number one focus followed by counterintelligence 

matters and then criminal matters in terms of our third priority. 

So we are definitely concerned about that. And we have seen, for 

example, terrorists who are interested in communicating by way of 

the Internet, like in many cases we all are. So we pay special attention to that arena. 

15

There are two other sort of elements that help us focus on that. 

One is that in the international arena especially. We have our legal 

attache program that is located in about 46 countries, I believe it 

is, and we are going to start in the Cyber Division an Internet, or 

we have started an international investigative support unit to work 

with our legal attaches to make sure that we are addressing that 

very issue. 

Chairwoman KELLY. Good. Thank you, Mr. Farnan. 

Mr. Beales, can you give me more details? You mentioned that 

you have taken some specific measures with the FTC to—what 

measures, specifically, did you take with respect to the three cases 

to help the victims? 

Mr. BEALES. Well, what we did was to discuss with the companies the kind of a letter they might send and make discussions 

about the letter. We have a booklet that is consumer information 

about identity theft that is called Identity Theft: When Bad Things 

Happen to Your Good Name. And we make that booklet available 

and encourage companies to provide that booklet to consumers in 

need of information about what they should do next. 

Chairwoman KELLY. Thank you. I am about out of time. 

Mr. Farnan and Mr. Caddigan, I want to be sure, we want to be 

sure, we need to be sure that there is no unnecessary overlap or 

redundancy between the two of your agencies. I wonder if you 

would be willing to clarify your authority over cyber intrusions. 

Mr. FARNAN. Again we have our—well, the fact that Mr. 

Caddigan and I are sitting next to each other and Dennis Holly, 

who is sitting next to me is an agent actually assigned to FBI 

Headquarters, resources permitting, I want to assign an FBI agent 

to Secret Service Headquarters, I think we are working in an extremely cooperative and complementary fashion. There is enough 

crime, as I think you can sort of define from the testimony today, 

to go around. There is plenty of work to do. And with that, I think 

that our efforts complement each other. We have specific mechanisms in place to make sure that happens, including the sharing 

of personnel back and forth. 

When it comes to intrusions, the one unique thing that we may 

bring is the fact that if it is a State-sponsored or foreign government who is trying to break into or hack into a system in the U.S., 

it is one kind of unique area that the FBI may bring to that. What 

we have done successfully is work on a case-by-case basis at the 

field level all the way through the headquarters level to make sure 

we are not duplicating and complementing efforts. 

Chairwoman KELLY. Mr. Caddigan, are you satisfied with that 

answer? 

Mr. CADDIGAN. I would concur completely. We recognize that any 

single entity can’t handle this problem alone. By working together, 

combining our resources, combining our approach methodologies, 

we do provide a better product to the public we serve. 

Chairwoman KELLY. So you feel that there is not a problem with 

overlap there? 

Mr. CADDIGAN. I think, as Mr. Farnan mentioned, we detailed an 

Assistant Section Chief to the Cyber Division in headquarters, so 

conflict is not an issue. We do coordinate at the local level with our 

task forces. The Bureau has representation and membership in 

16

each of our electronic crimes initiatives throughout the country 

and, conversely, in smaller environments where we are not present 

we have membership in their initiatives. 

So I would suggest to the panel that the cooperation does exist 

at the highest level and although there maybe some appearance of 

overlap it does mesh well together. 

Chairwoman KELLY. Thank you. I am out of time. Mr. Gutierrez. 

Mr. GUTIERREZ. Thank you very much. First of all, I want to 

thank Mr. Weaver and Mr. Caddigan and Mr. Farnan and all of 

those that work with you at the FBI and Secret Service for the 

work that you do. 

I would like to ask Mr. Beales, I guess my concern is what are 

the responsibilities of financial institutions that suffer from intrusions to their client base in terms of information from them? Is 

there a 48-hour, 72-hour window, a week, 30 days? Is there something that says you must do this by the FBI’s call, the Secret Service knows, they are investigating how long does it take and is there 

anything that says they have to do it in a specific amount of time? 

Mr. BEALES. There is no specific requirement either to give notice 

or to give notice within a certain period of time. Notice is clearly 

appropriate in many circumstances and is clearly the best practice 

and was what we have generally seen in most cases that involve 

breaches. There are some cases though where notice may not be as 

useful. And I think in the case of the credit card hack that got the 

information about credit cards, providing that information to the financial institution so they could block fraudulent activity on those 

cards is a more effective way to address the problem and considerably reduces the need for notice to consumers. 

Mr. GUTIERREZ. So I guess then what you are saying is we have 

to rely on the credit card companies and the service that is provided to protect the consumer but we are not—we don’t necessarily 

inform the consumer so that he can help protect himself and you 

think there might be just best practices where the consumer is left 

totally out of the picture and unaware? It seems to me the credit 

and the reputation belongs to the consumer and that credit and 

reputation is I trust—I entrust it to the financial institution, to my 

credit card company, my mortgage company and that they have a 

responsibility to me to alert me. I mean, if my bank didn’t call me 

because somebody ripped off my money from my checking or bank 

account immediately, I think I would get pretty angry about it. I 

guess my question is don’t you think there should be some best 

practices established so that consumers can help themselves? 

A booklet is nice and I am very happy that you issue that booklet, but at what point do we trust the consumer to engage and to 

cooperate with the Secret Service, with the FBI, with the District 

Attorney’s office or whatever it is that is prosecuting the case. 

What do you think? 

Mr. BEALES. I completely agree with you that consumers need to 

find out in most of these cases. And we have—in the particular 

cases that are at issue here we have strongly encouraged the companies to provide information to consumers and try to make it easier for them to do that. I think there is no question that is the best 

practice in most cases. 

17

Mr. GUTIERREZ. So the best practice is trust the companies to figure out when they should inform the consumer that their credit 

has been somehow hurt or compromised and that somebody has access to their information; we should just trust the companies to do 

this? 

Mr. BEALES. We don’t have regulatory authority. 

Mr. GUTIERREZ. Who does? 

Mr. BEALES. I am not sure that there is any agency that has authority to. 

Mr. GUTIERREZ. So there is no authority that you understand 

that anyone has? 

Mr. BEALES. There is authority and there are regulations both by 

us and the bank regulatory agencies that govern the front end, that 

require financial institutions to have in place measures to prevent 

breaches of information security and to take appropriate steps in 

order to keep that from happening in the first place. 

Mr. GUTIERREZ. I understand that. And I guess then that maybe 

we should look at how it is ultimately the House of Representatives 

or legislatively we deal with the issue given that it is your testimony that there is no best practice other than let the companies 

figure out how it is they should deal with the consumers, but there 

is no 72 hours, 48 hours. So we probably may need some best practices established to protect the consumer because in the end that 

is who we have to protect and that is who is most hurt in this situation. 

Again, I want to thank the members of the Secret Service and 

the FBI for their work because I know they have a lot of work, especially after September 11th. I want to thank them for all the 

hard work that they do. I want to thank folks at the Federal Trade 

Commission, too. You do a great job there, too. 

I wanted to see if we could figure out what we might need to do, 

this committee and other committees. Thank you all so much for 

your testimony this morning. 

Chairwoman KELLY. Thank you, Mr. Gutierrez. 

Mr. Bachus. 

Mr. BACHUS. Thank you. Mr. Beales, will the FTC be taking a 

closer look at banks’ third party providers with respect to the service providers information security programs? 

Mr. BEALES. It is something that we are very interested in, in 

looking at security cases and information security cases in general. 

It is an area where the bank regulators also under their safeguards 

rules also have authority and it is a place where we would want 

to coordinate with the bank regulatory agency as to who was in the 

best position to address any particular case. 

Mr. BACHUS. Are you already doing that? Are you already looking at these? 

Mr. BEALES. We talk to the bank regulatory agencies on a very 

regular basis about a host of issues, including this. 

Mr. BACHUS. How about the bank’s third party providers? Are 

you all in contact with them or are you reviewing their information 

security programs? 

Mr. BEALES. Well, we have—under the FTC rules we can’t talk 

about particular investigations. They are not public. 

18

Mr. BACHUS. I don’t want specifics, but is it a part of your general procedure? Do you—— 

Mr. BEALES. Well, in our general procedures we are sort of looking for cases everywhere. They may come from reports in the media 

and they may come from complaints. They may come from referrals 

from other law enforcement agencies, and if they are in our jurisdiction and third party service providers, we would be very interested in pursuing. 

Mr. BACHUS. Banks’ third party service providers are within your 

jurisdiction, aren’t they, as far as their information security? 

Mr. BEALES. Yes, I believe they are. They are also subject to the 

bank’s—— 

Mr. BACHUS. I understand that. But I am just talking about for 

a minute—without being specific, have you taken a closer look at 

any of their information security programs? 

Mr. BEALES. We do not have any—we haven’t done anything that 

was specifically targeted to bank third party. 

Mr. BACHUS. I understand that. I am not talking about target. 

I am just saying are there instances when you have reviewed their 

information security programs? 

Mr. BEALES. If we review information, it would be in the context 

of a particular investigation of a particular company. 

Mr. BACHUS. I understand that. I am not talking about particulars, but have you done that? I know you have the right to do it, 

and you might do it, but have you done it? 

I am not going to ask specifics about companies, but I want to 

know if that is part of your jurisdiction? 

Mr. BEALES. It is part of our jurisdiction. 

Mr. BACHUS. My question is, are you all taking advantage of it? 

Are you all doing that? Are you reviewing or have you reviewed 

any? 

Mr. BEALES. We have reviewed cases as they have come to our 

attention. 

Mr. BACHUS. Banks, third-party providers? 

Mr. BEALES. Yes, sir. 

Mr. BACHUS. Okay. You know, on the DPI case, this information 

was looked at, but it wasn’t actually taken, is my understanding. 

Mr. BEALES. I am not—I don’t know that for sure. 

Mr. BACHUS. Okay. All right. 

Are you aware of any identity theft cases that resulted from the 

DPI hack? 

Mr. BEALES. I am not. 

Mr. BACHUS. How many personnel are dedicated to investigating 

pretext calls at your agency? 

Mr. BEALES. There probably isn’t anyone that is completely dedicated. We are a small agency and people multi-task, but there 

are—there are four or five staff members who have been involved 

in pre-texting investigations. 

Mr. BACHUS. Let me ask the Secret Service, either one of you 

gentlemen, Mr. Weaver or Caddigan, in your experience how responsive have credit card issuers and processors been in notifying 

the Secret Service of data penetrations or other hacking events. 

Mr. CADDIGAN. I think, as a general statement, it is safe to say 

that they have been very responsive. We have ongoing and longVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00024 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
19

standing relationships with the credit card companies individually, 

the banks that they represent, and on occasion the third-party 

processors as it becomes important for us to deal with them. 

Mr. BACHUS. You have been in a position to know whether they 

are cooperative, and they are? 

Mr. CADDIGAN. Yes, sir. They are very cooperative. 

Mr. BACHUS. To Mr. Farnan, do you work closely with the private sector in monitoring data penetrations? 

Mr. FARNAN. Well, one thing to keep in mind here is that what 

has happened at the FBI is the former National Infrastructure Protection Center has now migrated to the Department of Homeland 

Security. 

So what is happening is on the vulnerability side of the house, 

the Department of Homeland Security is really assuming that responsibility. And to focus our limited resources the best we can, we 

are focusing more on the threat side of the house. By that I mean, 

who is it out there that is causing the problem. 

So to answer your question, we are not directly monitoring. 

Mr. BACHUS. You are focusing on the perpetrators? 

Mr. FARNAN. Yes, sir. 

Mr. BACHUS. In our second panel, we are going to talk about 

TriWest, what happened there. Now, you know, this hearing has 

sort of focused on penetrations of data systems, hacking, that nature. But in that case, someone either on the inside, it is an ongoing investigation, or on the outside just walked in and walked away 

with hard drives containing information on half a million people. 

Which obviously, if you had a preference for what you would do, 

is, you know, go in and try to grab stuff. If you could just walk in 

and take the hard drives out or the disk out, you know, that would 

be the preferred method I would think for thieves. 

I read the testimony of TriWest’s CEO, and it was 2 days before 

they discovered this theft. From a law enforcement agency perspective, what do you advise corporations that have these large databases of how to protect them from a security standpoint? Not someone hacking, but someone walking in or somebody walking out, 

whether they walked in or not. 

Mr. FARNAN. One of the things that we tend to see is sometimes 

we do tend to think of these cases as extremely complex, because 

once when we get into the world of electrons and what is happening in cyberspace, things can get complicated pretty quickly. 

But in doing that, sometimes we forget the fundamentals, sometimes we forget to lock the door. 

So there are times when you have to look at, where does any 

company or university or institution keep its servers, where do 

they keep their mainframes, what kind of security, in terms of 

locked doors, places in the building that kind of equipment is kept. 

Is it kept on site in the same place as the corporate headquarters 

or is it secured in an alternate location. 

So sometimes even though we get into lots of victims involved in 

these crimes, and the crimes can be really worldwide in nature, 

sometimes we forget the very fundamentals. And that is really, 

probably, the place to start with security matters. 

20

Mr. BACHUS. I totally agree with you. I would think fundamentally you worry about sophisticated—through the network, but you 

obviously shouldn’t—you should just protect the front door. 

How about the Secret Service? Any comments you would make? 

Mr. CADDIGAN. I would concur. 

I think in a proactive approach to information assurance or information security, a company, an organization, an entity needs to be 

concerned dually, both physical and cyber. 

And when you look at vulnerability assessment, an organization 

can be guided to conduct their own self-assessment, I think you 

do—those things rise right to the top. I don’t know the particulars 

on this case, but as you describe them you would ask the simple 

questions on the front end, is there a lock on the door, is there protection on the hard drive, what schedule do you use in order to 

verify that information has not be compromised. 

And again, not having any knowledge of this case, protecting 

your cyber elements again is just as critical as your physical elements. So it is easy to critique on the back side, but the proactive 

approach I think might have determined that vulnerability on the 

front side. 

Mr. BACHUS. Thank you. 

Chairwoman KELLY. Mr. Caddigan, I want to follow up. 

Just one quick question to Mr. Bachus’s question, and that is, 

about the way that the computers contain the information. If people are lifting the hard drives, then it seems to me that containing 

information that separates numbers from names and Social Security numbers from addresses, things like that can be done. Are you 

overseeing things like that? Are you looking at things like that, or 

recommending things like that to companies? 

Mr. CADDIGAN. Yes, ma’am. Recommending would be the proper 

word. We do have issues with regard to—these companies are private sector. We can’t mandate, we can’t legislate, but we certainly 

can recommend security mindedness. Those would be exactly the 

type of things that we would ask you to consider in how you collect 

and keep your data. 

Chairwoman KELLY. Thank you. Ms. Hooley. 

Ms. HOOLEY. Thank you. I am going to direct most of my questions to Mr. Beales, but if any of you would like to jump in, please 

feel free to do so. 

I know you are to provide victims assistance and consumer education. 

Can you highlight, beyond your testimony specifically, specific 

steps the FTC has taken in regard to consumer education and victims assistance? Let me explain what I am looking for. 

I know in regard to victims assistance you have a centralized 

database to aid law enforcement. Are there any programs in place 

specifically to help victims of ID theft clean up their credit, which 

as many of you know can be a long and expensive process? And do 

you have any suggestions for new ways to help in this regard? That 

is the first part of my question. 

The second part is, you have to finalize rules which require financial institutions under FTC’s jurisdiction to develop and implement appropriate physical, technical and procedural safeguards to 

protect consumer information. 

21

Can you tell me which financial institutions might be subject to 

this rule? Would the 400 companies which are sponsored by financial institutions to process credit card payments, such as DPI, be 

subject to the rule? 

Then the third part of my question is, I know your—you have 

been traveling around the country to educate local law enforcement. I would like to know how well that has gone. 

Can you tell us a little bit about the seminars, how many cities 

have you traveled to, how often are they held, and what might be 

coming next. And is there anything we can do to help you with 

that? 

I know I have used your brochures extensively for the education 

piece. Thanks. 

Mr. BEALES. When consumers call our hotline for identity theft 

to report a problem, the phones are answered by trained counselors 

who will try to talk them through what they need to do next. 

Our role is to provide advice to consumers about the steps that 

they need to take. We do that to the best of our ability, but it is 

really up to consumers to do that. 

There are private programs that will help consumers individually 

on a one-on-one basis, go through the process of cleaning up their 

credit. It is not something that we do or would have the resources 

to do for the complaints we get. We get—last year we had approximately 161,000 victims who contacted our clearinghouse for information and assistance. 

Ms. HOOLEY. Let me ask you, are there any other things? I 

mean, I know what the directions are that you give victims, and 

it can take 3 or 4 years. I mean, I think the average time is an 

enormous amount of time to clear up their credit. 

Do you have suggestions or ideas, any of you, about how we can 

make that happen in a much quicker, less costly, less time consuming, less frustrating way? 

Mr. BEALES. We are constantly looking for better ways to do it, 

to make it simpler. We have—I mean that led us last year to put 

out a uniform affidavit. So consumers could report the fraud on one 

form and then submit copies to different financial institutions, as 

one way to try to simplify the process. 

We are working—we have been working with the credit reporting 

agencies to initiate a pilot program that would let consumers just 

make one call to contact all three credit recording agencies and establish a fraud alert. We expect that program to go into place later 

this month. 

We are continually looking as well for things that Congress 

might do to make this simpler. At this point we don’t have any specific suggestions. But, it is something that we are very much alert 

to, and looking for ways that we or you or anyone else could make 

this process less of a hassle for the people who are victims. 

As to our Safeguards Rule, there are a wide variety of firms that 

you wouldn’t think of as financial institutions that are or may be 

financial institutions under the Gramm-Leach-Bliley Act rules that 

are subject to our jurisdiction and that would be subject to the 

Safeguards Rule. 

Accounting firms that do tax preparation and the like, for example, may well be subject to the rules. Auto companies that provide 

22

credit or dealers that provide credit or financial institutions are 

subject to the rules. 

The third parties that provide services, to banks or anyone else, 

that involve handling sensitive information would likely be financial institutions and subject to our rules. 

It is a hodgepodge of who it is, there is no easy way to describe 

the universe. But, our jurisdiction is basically any financial institution, except banks or financial institutions that are specifically regulated by some other regulator. 

As to the law enforcement training, I believe we did five—— 

Ms. HOOLEY. Let me finish up that. The companies that are 

sponsored by financial institutions, like DPI, are they under your 

jurisdiction? 

Mr. BEALES. I believe they are, yes. 

Ms. HOOLEY. Okay. 

Mr. BEALES. As to the law enforcement training, I believe we did 

five cities last year. We did training programs in five cities last 

year. We thought it was successful and useful. 

We did those training programs in conjunction with the Justice 

Department and with the Secret Service and the Postal Inspection 

Service. We tried to bring in local officials, as well, in each one. 

This year we have five more planned in different cities around 

the country, and we are continuing to pursue that activity. 

Ms. HOOLEY. How can we help you in increasing those numbers 

for law enforcement, because I think that is a really important 

piece, the law enforcement piece of identity theft. 

Mr. BEALES. Well, the—the piece that, I mean, the training piece 

I mean is simply limited by resources. It is—it is—it takes staff, 

time and effort. And we have tried very hard to work with the 

other law enforcement agencies involved to extend our resources 

and leverage them as much as possible. 

Ms. HOOLEY. Thank you. 

By the way, thank you for the booklets. We do send out a 

gazillion of them. 

Mr. BEALES. I am glad to hear that. 

Chairwoman KELLY. Mr. Shadegg. 

Mr. SHADEGG. I am going to pass. 

Chairwoman KELLY. Mr. Renzi. 

Mr. RENZI. Thank you, Madam Chairwoman. 

Just two real quick questions, so then we can go vote. 

I am really interested in the who behind all of this. You know, 

we have heard that there are hackers involved and terrorists involved, organized crime involved, and even insiders. And I know 

the FBI and the Secret Service has done a wonderful job in foiling 

some attempts. What can you share with me as far as the who behind this. 

I’ve got a little follow-up question. Thank you. 

Mr. FARNAN. First, our experience and our investigative activity 

to date suggests one thing that really kind of stands out. And that 

is, that the highest, the person that we are most concerned about 

is, in fact, the insider as opposed to an outsider. That person poses 

the most significant threat. 

Secondly, what we focused on and what we are concerned about 

are organized groups that may be attempting to obtain, penetrate 

23

machines and obtain large amounts of data. And we are very concerned, also, about the threats that are posed from foreign countries, frankly. 

But, one important point, I think, to emphasize is the fact that 

it is the insiders. It is the people who have access to the machines 

and to the data that really pose a significant threat, which raises 

the question, who watches the watchers? 

Mr. RENZI. Well said. 

Congressman Shadegg and I share a real concern living in Arizona with the border. We are reminded weekly of the threat, particularly as it relates to terrorism. We recently just had an Iraqi 

arrested down in the Tucson area. That goes to my follow-up question, which is the market, the black market. 

We have probably a sophisticated black market as it relates to 

credit cards, as it relates to Arizona, drivers’ licenses, passports. 

Los Angeles has a whole market that is even bigger than ours, because of the immigrants that move through our area looking for 

identification and also the terrorists, I think, that are also looking 

for that new identity. 

Could you talk real quickly then about the driving force of once 

the insiders or whoever have stolen this information, who they are 

selling it to, where is the purchasing, the fencers, I guess, is what 

I am talking about? 

Mr. CADDIGAN. The insider threat is—the correlation of the insider is permeated through many of the cases that we have. 

The hacking community, the groups out there that do hacking for 

a pastime, we think they fall maybe into three categories. 

One is those doing it for the challenge. They want to show that 

they can tap into your vulnerability and exploit you. 

The second is political, which means they get into websites. They 

deface them. They put a statement, a logo, again, sometimes just 

for encouragement. 

The other is for profit. So they are the ones that I think we are 

all concerned about in law enforcement, those that are getting in 

there and stealing information. We find, in many cases, they make 

that information available in chat rooms on the webpage. 

They indiscriminately make it available to anyone willing to pay 

for it. Thus, it is hard to track where the sources are going to, because they are everything and anything. 

Mr. RENZI. Your answer leads me to believe that there is not an 

absolute purchaser. There is not an absolute market that you have 

been able to identify, indiscriminate purchasers? 

Mr. CADDIGAN. There is not an absolute market. I think that is 

safe to say. 

With regard to terrorism and the like, we do find—with illegal 

immigrants, terrorists, those that are truly trying to hide their 

identify, aren’t using it to gain credit or to have purchasing power, 

they are using it to be able to live and exist with a different name 

that doesn’t draw attention to them. 

Mr. RENZI. You are able to set up an electronic fencing operation, 

a pseudo fencing operation, where you look on the Internet and 

purchase that information and then go after that individual, just 

like you would—— 

Mr. CADDIGAN. That does occur. 

24

We have always had sting operations with regard to, as your concern expressed, the immigrants. We have had some terrorism links 

to those that are just trying to have different breeder documents, 

and what they can get out of the breeder documents, meaning passports, driver’s license and the like. It is just strictly to have a 

change of a named identity that they can use at will. So it does 

run the gamut in that regard. 

Mr. RENZI. Let me just thank you all of you for your testimony 

today, and especially at this time in our Nation’s history for the 

work you are doing. 

I know we are talking about incidents that have already occurred 

today. I can’t imagine the amount of incidents that you have foiled. 

So thank you for that. 

Chairwoman KELLY. Thank you very much. 

We have just been called for two votes on the floor. So I will 

eventually deal with that, but I want to note that some of the 

Members may have additional questions for this panel, that they 

may wish to submit those questions in writing. 

So, without objection, the written hearing record will remain 

open for 30 days for members to submit written questions and to 

place responses in the record. 

This panel is excused with our great thanks. We appreciate the 

fact that you gave us so much of your time, and we look forward 

to being in continual contact with you, because this is quite a 

thorny issue. Thank you very much. 

In light of the vote, I am going to recess this committee for 20 

minutes, and we will reconvene in 20 minutes for our second panel. 

Thank you very much, gentlemen. 

[Recess.] 

Chairwoman KELLY. As the second panel takes their seats at the 

witness table, and with the agreement of Members, I want to recognize the gentleman from Arizona, Mr. Shadegg, for the purpose of 

introducing our first witness before I proceed with the rest of the 

introductions. 

Mr. SHADEGG. Thank you, Madam Chairwoman. 

As I mentioned in my opening statement, I have the privilege of 

having a constituent on this panel. 

Mr. David McIntyre is here to testify about the burglary of his 

company’s office located in my Congressional district, the burglary 

that occurred on the morning of December 14th, 2002, and about 

the response by his company to that burglary. 

Mr. McIntyre is president and CEO of TriWest Healthcare Alliance, which is a private corporation that administers the Department of Defense’s TRICARE Program in a 16-State region in the 

central United States. TriWest is the largest Department of Defense contractor in Arizona. 

Mr. McIntyre has more than 18 years of experience in healthcare 

and healthcare policy and in the healthcare business. He was previously Vice President of Blue Cross Blue Shield of Arizona, which 

is where I met him. 

For our purposes, Madam Chairman, he has 9 years of experience serving on the staff of Senator John McCain. So he is somewhat familiar with the hearing process. 

25

As I mentioned in my opening statement, in the wake of the burglary of TriWest’s offices in Phoenix, Mr. McIntyre’s company aggressively responded. 

Mr. McIntyre personally oversaw and took part in the plan to notify customers about the stolen information and personally telephoned a number of those whose credit card information was stolen. 

Mr. McIntyre has turned that negative experience, the burglary 

of his company’s offices, into a positive model for other companies 

across the country who are victims of information theft. 

I appreciate him being here to testify, and I look forward, as I 

am sure the rest of the panel does to his testimony. 

Chairwoman KELLY. Thank you, Mr. Shadegg. 

Our remaining witnesses on the second panel are Mr. Kevin D. 

Mitnick, President and Co-founder of Defensive Thinking and a 

computer hacking expert. Stuart Pratt, President of the Consumer 

Data Industry Association. Mr. John Brady, Vice President for 

Merchant Fraud Control of MasterCard International, and Evan 

Hendricks, Editor and Publisher of Privacy Times. We welcome you 

all. We thank each of you for testifying here today. 

Without objection, your written statements will be made a part 

of the record. You will each be recognized for 5 minutes, and if you 

don’t know the color codes on the lights in front of you, the green 

light is all go, and as soon as you see the yellow light it means it 

is time to sum up because the red light will come on. We all know 

what that means. 

With that we will start with you, with Mr. McIntyre. 

STATEMENT OF DAVID J. MCINTYRE, JR., PRESIDENT AND 

CEO, TRIWEST HEALTHCARE ALLIANCE 

Mr. MCINTYRE. Chairwomen Kelly and distinguished members of 

the Financial Services Committee, thank you for the invitation to 

appear before you today to discuss the important topic of identity 

theft. 

Congressman Shadegg, thank you for your overly generous and 

very kind remarks, and I appreciate your long interest, dedication 

and effective leadership on this critical consumer issue. It, in fact, 

is an issue that affects every consumer in America, probably a very 

unique one at that. 

As Congressman Shadegg said, my name is Dave McIntyre. I am 

the president and CEO of TriWest Health Care Alliance. We are 

a private corporation that delivers health care services to the Department of Defense and its beneficiaries in 16 states. We serve 1.1 

million people. 

This was a very painful holiday period for me this last year, because like a number of organizations in this country, I have had 

the opportunity to learn firsthand about the information theft. 

What is most appalling to me, however, is that in many cases, 

it takes the individual who suffers the identity theft longer to clean 

up their credit report than is the jail term that is served by the 

criminal who actually perpetrated the act. As a consumer, as a 

business leader whose company suffered the theft of the personal 

information of its customers, I am grateful to you for your focus on 

this critical issue. 

26

On Saturday morning, December 14th, one of our offices was burglarized. Computer equipment and data files containing confidential and personal information of more than 570,000 members of the 

military, their dependents and retirees was stolen. 

The information on the stolen hard drives included names, addresses and Social Security numbers, which we are required by the 

Federal Government to collect, along with other personal information. Fortunately, it only contained 23 credit card numbers. 

I was told by experts shortly after the theft that the most effective thing I could do was to get out in front of this issue and notify 

consumers as quickly as possible. So that is what we set out to do. 

We notified authorities on learning of the theft. 

Secondly, we contacted our DOD partners to jointly create and 

implement a comprehensive three-pronged action plan to protect 

our beneficiaries. We went to the media. Because many of these 

people were away from home during the holidays visiting their 

families. We wanted to make sure that we lost no time. 

The military worked through their chain of command and notified every installation worldwide, so that we would reach the leadership and all of the folks serving in the military. 

We sent the first of what will now be three letters to the individuals who were affected, to notify them of what had occurred, and 

give them advice based in part on the counsel of the FTC on what 

they could do to protect themselves. 

This has been a joint effort, working with Dr. Winkenwerder, the 

Assistant Secretary of Defense for Health Affairs, the Surgeon General of each service and all of the command structure in the military. It has been a fabulous partnership, albeit at a time when they 

didn’t have time to spend on this issue. 

Third we posted a $100,000 reward to aid law enforcement in 

their efforts to try to detect who had done this. As you can imagine 

we were devastated by this event. However, we focused all of our 

energy on trying to do what we would want to have done were we 

the consumer who was sitting on the other side. 

Given the burden on the individual of placing a fraud flag with 

three different credit bureaus, we worked with the credit bureaus 

to develop a plan that has allowed us to request on the behalf of 

our customers, not forcing them to do it, the actual request of a 

fraud flag. 

To date, more than 63,000 of the people on that list have chosen 

that option, and we have done that work on their behalf. 

Through this experience, I have learned a lot. I never planned to 

become an expert or even close to someone who knew a lot about 

the issue of information theft. I am pleased to be joined by a number of other people who obviously know a lot about this topic as 

well. 

I have come to believe that the work that was done by Congressman Shadegg needs to be built on in a couple of ways. 

First, I think that every leader of any organization, whether it 

is public or private, has an absolute obligation to their customers, 

that when that information is compromised, they have an obligation to inform their customer of the fact that has happened. It is 

painful. It is awkward. It is embarrassing. It is expensive. But you 

27

know what, it is not our information, and unless you arm the consumer with that information, they cannot protect themselves. 

Second, as a consumer, I have observed the inconsistencies in the 

last 4 months with how my credit card information is handled. Half 

of the receipts from restaurants have the full credit card number 

and authorization date or expiration date posted on it. That is all 

you need and a name to go to the Internet and buy something. 

In addition, I still belong to the Senate Credit Union. I went to 

the credit union to find out what comes on your statement. Social 

Security numbers are printed on those documents if you go and ask 

for the balance on your account today. Same is true in the House 

Credit Union. 

So we need to work to look at when is it necessary to have the 

full Social Security number printed on the document, when is it 

necessary to have the full credit card number printed. 

I also think that penalties in this area for those who perpetrate 

such crimes need to be looked at and significantly enhanced. 

Fourth, I believe that credit bureaus should allow organizations 

to act on behalf of their customers, and that they should establish 

consistent timelines for the updating of fraud flags. 

Thanks for the invitation to be before you today. I hope that this 

is the year that you are able to take the incidents that we have 

all faced and use them as leverage to further protect consumers in 

this country. I look forward to answering any questions you may 

have. 

Thank you, ma’am. 

Chairwoman KELLY. Thank you. 

[The prepared statement of David J. McIntyre can be found on 

page 114 in the appendix.] 

Chairwoman KELLY. Mr. Mitnick. 

STATEMENT OF KEVIN D. MITNICK, PRESIDENT AND COFOUNDER, DEFENSIVE THINKING 

Mr. MITNICK. Good morning, Chairwoman Kelly, Chairman 

Bachus and distinguished members of the committee. 

My name is Kevin Mitnick. I appear before you today to discuss 

your efforts to review current industry practices concerning security procedures for the prevention of electronic theft of credit card 

information and identity theft. 

I am primarily self-taught. My hobby as an adolescent consisted 

of studying methods, tactics and strategies for circumventing computer security, and for learning more about how computer systems 

and telecommunications systems work. 

I have 15 years experience circumventing information security 

measures, and I can report that I have successfully compromised 

all systems that I targeted for unauthorized access except one. 

I also have 2 years experience as a private investigator with responsibilities that included locating people and assets using social 

engineering techniques. Social engineering is the same thing as 

pre-texting that Mr. Bachus spoke to earlier. 

I have gained unauthorized access to computer systems at some 

of the largest corporations on the planet and have successfully penetrated some of the most resilient computer systems ever developed. I use both technical and nontechnical means to obtain source 

28

code to various operating systems and telecommunication devices 

to study their vulnerabilities and their inner workings. 

Currently, I am the Co-founder of Defensive Thinking, a Los Angeles based information security firm. I recently co-authored with 

William Simon a book titled the ‘‘Art of Deception,’’ published by 

John Wiley and Sons, which has become an international best seller. The book details nontechnical methods and tactics, in essence 

pre-texting, that computer intruders use to compromise valuable 

information assets, including credit card information. 

Social engineering is a method where the intruder deceives his 

target into complying with the request based on false pretenses 

and psychological manipulation. 

It is important to understand, and all companies and their employees need to realize, that the most insidious vulnerability to information security are the well-meaning, hard-working folks that 

use, operate and maintain information systems. 

The prevention and detection of social engineering attacks should 

not be ignored or underestimated. In fact, the majority of scams involving identity theft and credit card fraud include social engineering on some level. 

In an attempt to deter carding, many retailers are now requiring 

an on-line customer to provide the three-digit CVC number that 

card issuers have begun to use. 

But the thieves also obtain the CVC number. With it, he is able 

to use the information to commit fraud against unsuspecting cardholders and merchants. I understand that the subcommittee will be 

examining three recent cases involving large-scale thefts of nonpublic, personal identifying information and credit card details. 

A major part of the problem is that the criminals only need to 

obtain information that is stored or processed in thousands of computers systems around the world. In February of 2003, DPI, a credit card processing services company, reported that an unknown intruder had compromised their network and gained access to a database that held over 8 million credit card accounts. 

DPI did not release any details describing how the breach occurred, citing cooperation with Federal law enforcement officials. 

The DPI case was widely reported in the press because of the astounding number of credit cards potentially compromised. 

But when examined closer, you will realize that these types of attacks happen all the time. In my opinion, the committee should not 

overlook that many similar attacks on networks containing financial information are not detected by the owner or operators. It is 

important to realize that many of these security incidents remain 

undetected because of poor security and auditing practices. 

DPI has publicly claimed that the intrusion occurred from the 

outside of the organization. Although, I do not like to hypothesize 

on facts and circumstances of an any attack without details, I 

would recommend that DPI consider the possibility that the 

attacker had assistance from the inside of the company. 

Every day the security community announces new vulnerabilities 

and operating systems in application software that have been identified. Vulnerabilities in software can be exploited to gain remote 

access to the target computer. Many system programs contain programming errors that enable the intruder to trick the software into 

29

behaving in a way other than which is intended in order to gain 

unauthorized access rights, even when the application is part of the 

operating system of the computer. 

Once a new vulnerability is recognized, the software developer 

releases a patch, a modification to the software that might be installed by individual companies, a process that may be overlooked 

for days, weeks, months, even years. Meanwhile companies using 

that software remain vulnerable or are forced to disable or block 

access to the vulnerable service until the patch becomes available. 

Even then in many cases this is not enough. There are a number 

of sophisticated hackers who are able to discover previously unrecognized security vulnerabilities and then use them to compromise 

global computer systems and networks. 

I agree that it is essential to implement security strategies to 

prevent, detect and respond to security threats and attacks, but it 

is too easy to look in the wrong direction for an answer. In my 

view, attempting to solve the complex problem by micromanaging 

every on-line site that accepts credit card transactions would turn 

out to be wasteful, inefficient and not a very successful exercise. 

Instead, I recommend that the committee look into a different direction. I recommend that you explore mitigation strategies which 

focus on improving the authentication of the credit card user. In 

any on-line credit card transaction, identity and authorization is 

based on the information a consumer provides to the merchant. 

This is no better than a static password. 

There is an old saying among hackers. You never know if someone else has your password. The reality is that a password or its 

equivalent is too easy to steal. A first step towards a solution would 

be to strip away the identity value of all personal information. 

If knowledge of a credit card number, expiration date and the 

corresponding customer name and address is without value, stealing this information would be a useless to an imposter. 

Unfortunately, authentication technology has not yet matured to 

the point of being able to provide an easy solution to the issue. If 

not being done already, I would recommend that the finance industry explore additional authentication methods that may include 

digital certificates, identification of the user’s location based on IP 

address or telephone number, or verification of a PIN through a 

separate communications channel. 

For example, consider this scenario. You have just placed an 

Internet order for a new cell phone with a price tag of several hundred dollars, and placed an on-line order with your credit card information, but you were not required to give a PIN number. Instead, you next dial your credit card company, and when prompted 

you enter your card number. An automated system then reads off 

the details of the transaction. You are satisfied that the details are 

correct. The system tells you: To authorize this transaction, enter 

your PIN number. 

What would be the advantage of this approach? The thousands 

upon thousands of individual retailers would not have access to 

consumer PIN numbers. The fact that so many retailers store the 

credit card numbers of on-line customers gives rise to the kind of 

credit card theft that this hearing is addressing. 

30

If they also store the customer PINs, then there is no gain in security. The PIN becomes almost worthless as a security element. 

But under the approach I have suggested, only the bank would 

have access to the PIN number information. Under this arrangement, the theft of the card numbers would be of limited value. 

In another area, I would also recommend consumer-awareness 

training programs that educate people about the various scams 

being used to steal their credit card details and personal information, a practice that can prove highly valuable to effectively minimize identity theft and credit card fraud. 

I believe that all on-line retailers who accept credit cards should 

be encouraged or required to do the following: 

One, perform a regular, thorough risk assessment on their information assets, especially systems that process or store consumer financial and personal information. 

Two, implement policies, procedures, standards and guidelines as 

dictated by the results of the risk assessment. 

Three, create an audit and oversight program that measures 

compliance. The frequency of the audits ought to be determined 

consistent with the mission. The more valuable the data, the more 

frequent the audit process. 

Develop a process to ensure meaningful and effective patch management for all computer systems. Employ authentication methods 

that do not use nonpublic personal identification information, such 

as a mother’s maiden name, birth date, birth place, driver’s license 

number, address, phone number or Social Security number. 

Next, effective audit procedures implemented from the top down 

must be part of an appropriate system of rewards and consequences in order to motivate system administrators, personnel 

managers, and employees to maintain effective information security, consistent with the goals of this committee. 

Next, establish a security-awareness training program designed 

to educate their employees on the threats to information security 

and to change employee behavior to foster a secure environment. 

These would follow the security recommendations described in detail in my book, ‘‘The Art of Deception.’’ 

In terms of legislation, I recommend that the subcommittee consider the following: 

One, legislation that prohibits merchants or credit card processors from electronically storing PINs or other types of verification 

credentials such as the CVC, unless it is essential to business 

needs. 

Two, the requiring of periodic security assessment and or penetration testing to evaluate the security posture of any business that 

stores or processes credit card transactions, to be performed by an 

independent information security consulting firm. 

Three, require encryption of stored financial or personal information. If this was done by TriWest or by DPI, then the information 

would not be accessible to the hackers. 

Finally, I want to offer what I have deemed the most important 

factor in security, the human factor. This is essential, underlying 

all security issues, whether it is from deceptive credit card thieves 

or terrorist operatives to blend into our communities. 

31

I believe it is essential to consider regulations that mandate security awareness training as part of an overall security program as 

required by HIPAA and the GLBA. 

Thank you. 

Chairwoman KELLY. Thank you very much, Mr. Mitnick. 

[The prepared statement of Kevin D. Mitnick can be found on 

page 124 in the appendix.] 

Chairwoman KELLY. Mr. Pratt. 

STATEMENT OF STUART PRATT, PRESIDENT CONSUMER DATA 

INDUSTRY ASSOCIATION 

Mr. PRATT. Chairwoman Kelly, Chairman Bachus, members of 

the committee, thank you for this opportunity to appear before you 

today. 

For the record, I am Stuart Pratt, president of the Consumer 

Data Industry Association, and we commend you for holding this 

hearing on the implications of breaches in information security in 

a number of different cases. In each of these cases, you have asked 

us to comment on the security breaches from the perspective of our 

members who operate as nationwide consumer reporting agencies. 

I will start with TCI Communications. Our members have no direct relationship with TCI Communications, and we learned—our 

members report to us that they learned about access codes being 

compromised in particular through customer contacts with us. 

We work collaboratively with our customers. We worked collaboratively then with law enforcement to assist affected consumers. 

Let me just outline some of those steps. 

Consumers received notices from consumer reporting agencies as 

well as in partnership with our customers to make sure that they 

were aware of the breach that had occurred with regard to our information. Consumer’s files were in some cases frozen temporarily 

while we could get those notices to them. 

Notification letters also then allowed consumers to take advantage of free file disclosures, free access to monitoring services that 

our members provide, as well as opting those consumers out of prescreened offers of credit, and also adding fraud alerts to their files. 

Beyond the priority of assisting consumers, we also took 

proactive steps to ensure that the scope of the fraud was contained. 

We analyzed the patterns that we identified through the crime, and 

we then adjusted our pattern recognition tools and initiated reviews all of all third-party access codes where we had similar third 

parties having access to those. We began rotating access codes 

more aggressively. Our customers are more accepting of the rotation of those access codes today. 

So we actually have a task force continuing to analyze yet additional steps we can take to further remove access codes from employees who might otherwise take advantage of the access that 

they have. 

We had no real involvement with DPI Merchant Services to the 

extent that we have been able to ask our members that question. 

I will move on to TriWest. With TriWest, TriWest is not a customer, it was not our information involved in this case. TriWest, 

as they reported themselves, took very quick action. On behalf of 

TriWest, many consumers then contacted consumer reporting agenVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00037 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
32

cies. We provided them voluntarily with free file disclosures. We 

also took them off a pre-screened offers of credit again, added security alerts to their files. 

These are just some of the various initiatives that we have for 

assisting potential victims or real victims of identity theft. A summary is included with our full comments here for the record. 

TriWest then proactively contacted our members and coordinated 

an additional plan of work that would allow their customers to 

have an easier time of adding additional information to their files. 

We learned a number of things through this experience. One, 

criminal behavior by employees, we will never be rid of that completely. But, of course, thanks to Mr. Shadegg, we have the Identity Theft Assumption and Deterrence Act of 1998. 

Those employees who had access to those systems, in fact, violated that very law that you created in the first place. They also 

violated the Counterfeit Access Device and Consumer Fraud and 

Abuse Act of 1984. They violated the Fair Credit Reporting Act, 

amended in 1996, which also prohibited access and escalated criminal penalties as well as civil fines for perpetrating this type of 

crime. So we do have a number of different laws on the books 

today. 

That being said, obviously everything that we can do to vet employees who have access to sensitive information is a critical element going forward. We must begin to learn to measure the relative risks of various breaches. One of our concerns from our members is that if we were to encourage the entire Nation with every 

security breach to contact consumer reporting agencies, this would 

not be hundreds of thousands, but literally millions of contacts per 

year. 

One of our member companies estimates that it was, in servicing 

TriWest customers, which was the right thing to do, it was the 

right time to do it, we have no question about doing it, it cost one 

of our member companies $1.5 million in order to accomplish that 

goal. 

We obviously need to work with the Congress and work with this 

issue to make sure that we are not on our own handling the totality of that kind of cost. It would change and radically alter how we 

do business today. 

All of that being said, coordinating assistance for consumers is 

important, and that is what our initiatives do for victims of identity 

theft. We look forward to working with you and this committee in 

this process, doing everything possible for those consumers. 

Thank you. 

Chairwoman KELLY. I thank you, Mr. Pratt. 

[The prepared statement of Stuart Pratt can be found on page 

130 in the appendix.] 

Chairwoman KELLY. It gives me great pleasure to now call on 

Mr. John Brady, who is a constituent of mine. And I am very 

pleased to have him be here to testify from MasterCard today. 

Mr. Brady. 

33

STATEMENT OF JOHN J. BRADY, VICE PRESIDENT, MERCHANT 

FRAUD CONTROL, MASTERCARD INTERNATIONAL 

Mr. BRADY. Good afternoon, Chairwoman Kelly, Mr. Bachus, Mr. 

Sanders, Mr. Gutierrez, and members of the subcommittee. 

My name is John Brady. I am the Vice President for merchant 

fraud control for MasterCard International in Purchase, New York. 

It is my pleasure to appear before you this afternoon to discuss 

the important topic of fighting fraud and safeguarding financial information. MasterCard takes its obligations to safeguard financial 

information and protect consumers extremely seriously. This issue 

is top priority for MasterCard. 

We have a team of experts devoted to working with law enforcement and maintaining the integrity and security of our payment 

systems. Our success in protecting consumers and preventing fraud 

is due in part to the constant efforts we undertake to keep our network secure. 

The MasterCard Information Security Program is comprehensive, 

and we continually update it to ensure that it provides strong protections. Our member financial institutions also have information 

security protections in place, including those required under the 

applicable banking law. 

Also, MasterCard’s bylaws and rules require each member and 

any third party acting on behalf of a member to safeguard the 

transaction and account information. Our bylaws and rules also require any merchant that accepts a MasterCard branded payment 

device to prevent unauthorized access to the information. 

In addition, MasterCard has a variety of consumer protections 

and antifraud tools. For example, MasterCard has voluntarily implemented a zero-liability policy with respect to unauthorized use 

of U.S. issued MasterCard consumer cards. Under this rule, a cardholder victimized by unauthorized use generally will not be liable 

for any loss at all. 

In addition, MasterCard has developed programs to protect 

against unauthorized use of the MasterCard payment cards. These 

include enhanced security features on the card, the MasterCard address verification system, and our proprietary fraud reporting system which helps identify fraud at merchant locations and allows us 

to better focus our global merchant auditing programs. 

We also offer a program to our issuers called Risk Finder, which 

assists issuers in proactively identifying fraud. These and other 

MasterCard tools have proven extremely effective in protecting 

cardholders and the security of our systems. 

I would now like to discuss a recent example of how we addressed a problem when it occurred. There was a recent incident 

involving a data processor called DPI, Data Processing International, who was acting as a service provider to a MasterCard 

member bank in Ohio, which, in turn, was providing bank card 

processing services for merchants. 

Earlier this year DPI detected that someone had obtained unauthorized access to its system. Although it is not clear at this point 

how much data the hacker successfully exported from DPI’s system, we do know the hacker potentially had access to approximately 10 million Visa, Discover, American Express and 

MasterCard payment card account numbers. 

34

Once DPI detected the problem, they took action, and quickly notified the Secret Service and FBI as well as affected payment card 

companies. MasterCard immediately took decisive action to protect 

its systems, its members, and most importantly MasterCard cardholders from fraudulent activity related to this breach. 

MasterCard interviewed the appropriate people at DPI in order 

to determine the nature and scope of the breach. MasterCard gathered the payment card account numbers and forwarded them to the 

appropriate issuers via our MasterCard alert system. 

MasterCard hired a third-party forensic firm to act on 

MasterCard’s behalf during the investigation. MasterCard remains 

in ongoing contact with issuers of the card numbers that were involved. I am pleased to say that it does not appear that these numbers have been involved with unusual activity as a result of the 

DPI breach. 

As a final point, I would like to note that law enforcement agencies have done a commendable job in investigating this breach. 

MasterCard works closely with these organizations and greatly appreciates their efforts to resolve this issue. 

MasterCard continually strives to provide its members and 

MasterCard cardholders with strong protections. And we will continue to develop new strategies and tools to prevent those who seek 

to do harm from succeeding. 

I would like to thank the subcommittee for inviting me to discuss 

these issues, and I would be pleased to answer any questions you 

may have. 

Chairwoman KELLY. Thank you, Mr. Brady. 

[The prepared statement of John J. Brady can be found on page 

86 in the appendix.] 

Chairwoman KELLY. Mr. Hendricks. 

STATEMENT OF EVAN HENDRICKS, EDITOR AND PUBLISHER, 

‘‘PRIVACY TIMES’’ 

Mr. HENDRICKS. Thank you, Madam Chairwoman and Mr. Chairman. 

A lot of times in the privacy community, we like to talk about 

Supreme Court Justice Louis Brandeis, who wrote eloquently about 

the importance of privacy in a civilized society. But, he is also the 

one who wrote that sunshine is the best disinfectant, and one of 

the themes throughout my brief talk today is the importance of 

sunshine, that to improve privacy you need sunshine and transparency. Just by having this hearing today, you are bringing sunshine to a very important issue, and providing a vital public service. I really commend you for that. And again, thanks for the opportunity. 

A few fundamental observations. The problem that we are discussing today, of hacker access to sensitive data, data leakages and 

identity theft in general, is going to get worse before it gets better. 

There are several reasons. One, is that we have now in our society many databases filled with the personal data, and they, to me, 

are the electronic equivalent of swimming pools without fences 

around them. They are attractive nuisances. 

35

The reason they are attractive is because our personal data is 

worth a tremendous amount of money to many organizations, and 

the criminals have figured this out. 

The other thing is that identity theft losses are still a fraction 

of the overall revenue generated by the credit industry. So to this 

point, the Tower Group has just released a report saying that they 

don’t expect any major changes in the practices of financial institutions because it can still be written off as a cost of doing business. 

I don’t know if that is going to be very helpful to the people who 

would be the victims of identity theft, though. In addressing these 

problems, as I mentioned the lack of transparency is a major issue 

that comes from all of those cases. Thousands upon thousands of 

entities, large and small, have instant electronic access to very sensitive data on over 200 million Americans. 

Consumers generally don’t enjoy that same kind of instant electronic access to their own data. We must move toward a society in 

which they do, and I will explain why and how. 

Also, there is a lack of sunshine when things go wrong, and that 

is the issue of, are people going to be notified when their security 

is compromised. Currently there is not a requirement of that. 

I will talk about the culture of security that is really needed, and 

we must develop and advance. Also another problem that comes 

from all of these cases is the over reliance on the Social Security 

number. 

Now, in the Teledata Communications case, which I think is one 

of the more important cases we are discussing this morning, you 

see access as a vital part of the problem and the solution. If those 

30,000 victims would have had instant electronic access or alert 

providing them that there had been activity on their credit report, 

and one of your constituents from New York or Alabama or Arizona 

saw there was an inquiry on their credit report from Texas Energy 

Supply, which is one of the institutions used for fraudulent access, 

then they would have known something was wrong. 

In fact, the credit bureaus have already started offering this 

service, and they have discovered it is a very good revenue stream. 

The problem is, they are charging as high as $79 per credit bureau 

to get a credit monitoring service. If you multiply that by all three 

credit bureaus, that can run over $200. 

It is a good business, if you can collect people’s data and sell it 

back to them at that price. But we should remember that the Fair 

Credit Reporting Act gives you a right of access to your credit report, and caps how much they can charge for it. Yet, there is no 

cap for these sort of monitoring services I see moving toward a system where we are plugged into our personal data as being an important part of the solution. 

So we should encourage that and see the economies of scale and 

can make it a win-win for everyone. This is also a model for the 

financial world. There are going to be databases of sensitive financial information kept by financial institutions that could fall outside the Fair Credit Reporting Act. I think that access is going to 

be a very important issue to address those problems as well. 

Also, I was concerned in this case with the lack of security in the 

TCI case. Because most of the credit card companies, and Mr. 

Brady can probably speak a lot about this, have software that monVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00041 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
36

itors our purchases and activities, so they can spot suspicious patterns of activities. 

To my experience, I have not seen evidence that the credit bureaus are using this, even though this was a case where there was 

suspicious activity over and over again. 

In the TriWest case, I think one of the most important lessons 

emerging is the fact that the Social Security number should not be 

used as an identifier, and really this is a societal problem and a 

Defense Department problem, that they require that the Social Security number as an identifier, and just proposed a new rule to 

make it the health identifier for soldiers. 

I really fear that we will have soldiers returning from the Gulf 

War to find that they are victims of identify theft, because of over 

reliance on the Social Security number. We can explore more of 

this later in questions if you like. 

In the DPI merchant services cases, I think what was most troubling was the secrecy that surrounded the problem. At first they 

only revealed that there was a hit of credit cards. They wouldn’t 

disclose who—that DPI merchant services was the credit card processor. Then they disclosed that. 

DPI told the Detroit News that consumers who were concerned 

about this should contact their issuing banks. Yet than they declined to name which of the issuing banks were hit. There was no 

systematic way. Then Visa levied substantial fines in the matter, 

but wouldn’t say who they levied the fines on or for what amount 

or for what purpose. 

So basically, this sort of secret society was saying, ‘‘we will make 

sure that your personal information is corrected, but don’t you 

worry your pretty little head about it.’’ 

I think the model for addressing this is California, which has 

passed a new statute, which takes effect July 1, which basically requires notification of individuals when their information is compromised in these sort of breaches. 

What I like about the law is the flexibility it includes, and I mentioned this in my testimony. The notice can be in writing, electronically, in accordance with the Federal E-signature law. 

Mr. HENDRICKS. If the cost of notice were to exceed $250,000 or 

were over 500,000 people, you could do it through a combination 

of different ways and they list some of the ways you could do it. 

Whenever you have a privacy problem, reasonableness is the standard for the solution. Any solutions have to be reasonable given the 

context. It is really case-by-case. 

The final thing is that when we have the issues of identity theft, 

as some of your witnesses have said, the main problem is the problem of cleaning up the polluted credit history. It is time-consuming, 

energy-consuming and very emotional and distressful. So the idea 

of having us plug into our credit reports and having a more instant 

means of communicating with our own data is an important part 

of the solution. 

Thanks. 

[The prepared statement of Evan Hendricks can be found on 

page 105 in the appendix.] 

Chairwoman KELLY. Thank you, Mr. Hendricks. I am going to 

ask you, Mr. Hendricks, a couple of things. Having had my credit 

37

card number stolen, my 95-year-old mother-in-law had her credit 

cards stolen last week, and she has called me and said I still have 

my credit card but the bank just called me and said that my credit 

card number has been stolen and they are going to give me a new 

credit card. She didn’t really understand it. My point is 

MasterCard called me when my number was stolen. The issuing 

card company called my mother-in-law, the bank called my motherin-law. Since this is already being done, I wonder if you have ever 

estimated the cost of what it would be for banks, people, anybody 

to have to notify their customers, since there are millions of us. 

And after you answer that question I am going to go to Mr. 

McIntyre and talk to him about his cost. So what do you think that 

cost is going to be? 

Mr. HENDRICKS. I don’t know. I have not calculated the cost. I 

would love to raise the money to do a really authoritative study on 

that, because I think it is important. But that is why I agree that 

there are cases where you have—your solution has to be reasonable 

to the problem. And if you don’t see evidence of crime happening 

then you can find more general ways to try and issue notice. What 

I don’t think is acceptable is that if you have a system where you 

know there has been a hit of 10 million numbers, if you simply 

can’t even find out which banks—if you are trying to find out if my 

bank has been hit, you can’t find that out, that is a lack of notice 

I think that is unacceptable. 

Chairwoman KELLY. Given the free market one would hope that 

the banks themselves would do some notification and do that pretty quickly. But you sat there and testified that you felt that the 

DOD should no longer use Social Security numbers as identifiers. 

I am wondering—what clicked immediately in my mind is how 

much is that going to cost? 

Mr. HENDRICKS. DOD, I am told by a fairly authoritative source, 

has a system—because a lot of soldiers do not have Social Security 

numbers or their dependents in the health care arena might not 

have Social Security numbers. So they already have a mechanism 

for generating another random number that can serve that identification purpose. We see this in a lot of other places. You go out 

there in the Department of Motor Vehicles in the District of Colombia and because of problems they had with Social Security numbers 

being compromised now for the last few years they will give you 

a randomly generated number for a driver’s license number. If you 

want your Social Security number to be a driver’s license number 

you have to request it. 

So I don’t think there is a tremendous amount—in this case the 

benefits far outweigh the cost, considering how we are seeing these 

leakages and the rise in identity theft. 

Chairwoman KELLY. Well, as a Congressperson we have to be responsible for the way we spend the money. So we need to get some 

kind of cost estimate. 

Mr. McIntyre, I now would like to ask you a question about how 

much it cost your firm to do the notification that you did. You certainly acted responsively. I think you were a model in the industry 

to show how rapidly and how proficiently people could access the 

fact that their information had been stolen. You did a number of 

things that had to have a bottom line cost. What did it cost? 

38

Mr. MCINTYRE. We had a lot of people cooperating and helping 

us in that process and we are grateful to all of them, including our 

colleagues in the Department of Defense. We have spent about a 

million dollars to date. That is this real hard cost. That is not the 

cost of having people work around the clock in our company, which 

we did from the 23rd of December all the way through the 3rd of 

January. And their impacts to the individuals who were involved 

in the Defense Department as well. So our real actual financial 

out-of-pocket cost is now about a million. We are not done with this 

issue. We cannot take our eyes off this issue nor in my opinion 

should we take our eyes off this issue until either the perpetrator 

is caught or we and the Defense Department are collectively convinced and that is no more risk to the consumer from this information being potentially in someone’s hands. 

Chairwoman KELLY. Mr. Mitnick, what is the single most important step that financial services companies can take to protect 

large consumer databases? Is there any one thing that you would 

point out? 

Mr. MITNICK. I wouldn’t say there is one thing. It is really a mixture of people, security processes and technology, and developing 

an information security program, because the attacker or the bad 

guys are going to look for the weakest link in the security chain. 

If they can exploit physical security weaknesses like with TriWest 

or potentially technical weaknesses like DPI, the bad guys are 

going to get the information. And again, I look at the information 

that is out there like the Social Security number. Anybody with a 

credit card and access to the Internet can access a variety of online 

information broker Web sites and obtain anybody’s Social Security 

number. It is out there for sale. So it is really a difficult issue when 

this information is readily available and this information could be 

used to apply for extensions of credit. 

Chairwoman KELLY. Thank you. 

Mr. Brady, I want to know what action you can take against a 

member bank that violates your safeguards. Have you ever taken 

action against—well, let me put it this way: Have you taken action 

against the member bank with regard to the DPI case? 

Mr. BRADY. I would be happy to talk to you about the DPI case. 

I think the DPI case is an illustration of how the system works, 

how the rules work in this case, such as the immediate notification 

to us and our ability to protect the consumers by getting the card 

numbers out there. And I can tell you this: the DPI case with my 

input is being reviewed by senior management. What I can further 

tell you is we have some seriously big sticks that we can apply in 

this case. I think you will see something probably in the next couple of weeks in the public domain with exactly what our position 

is in the DPI case, what specifics. So I have input into it, but I 

don’t want to go into great detail about it today other than to just 

let you know that it is being looked at, it has reached the most senior part of MasterCard and that we have definitive rules that can 

be applied in this case and will be applied. 

Chairwoman KELLY. Thank you. My time is up. Mr. Bachus. 

Mr. BACHUS. Mr. McIntyre, you mentioned the truncating problem with merchants, people picking up the Social Security number 

and using that. And just on reading the paper, at least my impresVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00044 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
39

sion is that a lot of identity theft and people using people’s credit 

cards is someone at the merchants getting that information off the 

receipt. And Mr. Mitnick mentioned the fact if you truncate the 

credit card, you mentioned that too. And first of all, and I am 

sure—Mr. Brady, could you comment on this—it is my understanding that credit card companies are going to start requiring 

their merchants to do that in the very near future anyway. So I 

think that problem will be—— 

Mr. BRADY. If I could. That is absolutely true. That has been a 

practice with ATM receipts and receipts when you go to a gas station, truncation for years. But both card associations are moving to 

that. That will be happening within the next 2 years, so you are 

absolutely correct. That has already been addressed. 

Mr. BACHUS. Can you give us a target date on when that might 

happen? 

Mr. BRADY. I can’t give you the exact target date, but I believe 

it is 2005. But I will confirm that and get back to you on that. 

Mr. BACHUS. See if it could be speeded along. Mr. McIntyre, you 

are talking about truncating and in the situation of a merchant, 

but let’s go back to your situation. Did you truncate the Social Security numbers? 

Mr. MCINTYRE. No, sir. Currently we are required to use the Social Security number in its full breadth when we communicate certain information. That is a topic that is under discussion, and I will 

be making some recommendations to the Department of Defense 

for the health care system in that area. The important thing to understand, though, is we didn’t e-mail the numbers out. They didn’t 

get released on a paper. Someone stole the hard drives. And in 

doing it in the configuration that they were in at that time it was 

a database that allowed them to have access to the full Social Security number. 

Mr. BACHUS. Aren’t there programs where even when they go 

into your data base it can be programmed to where they can’t pull 

that out? 

Mr. MCINTYRE. There is some amazing technology available in 

the marketplace that I have actually put in place in our organization over the last several months. The fact of the matter is, though, 

if you go to today’s standard it is not good enough 6 months from 

now. And the challenge in this area is there is so much growth in 

technology and it is changing so rapidly. Those little Blackberries 

that we all carry, those weren’t available a year ago. It is changing 

so rapidly that we have got—this is something that you constantly 

have to stay on top of. 

Mr. BACHUS. Let me ask you this. The cost has been mentioned. 

You spent a million dollars but actually the credit bureaus—Mr. 

Pratt, I think he represents those companies—didn’t they spend 

about a million and a half a piece? Did you testify to that on 

TriWest’s case? 

Mr. PRATT. One of our member companies did run the numbers 

and spent about a million five. 

Mr. BACHUS. Who pays for that if we were to design something 

and requiring someone to? 

Mr. MCINTYRE. I pay for my own cost, which I assume is what 

that organization is going to do. One of the reasons why they were 

40

willing to move to a process by which we could assist them in filing 

the fraud flag is to reduce that expense. So we took on that burden, 

which we willingly do. I don’t have any problem with the million 

dollars I spent. I want to state that very clearly. 

Mr. BACHUS. What I am saying, Mr. McIntyre, information was 

stole from TriWest but it resulted in a million and a half to one 

of the credit bureaus. 

Mr. MCINTYRE. Actually the way it works, sir, when the information is compromised the most effective things the experts tell you 

that you can do if you have lost the type of information that was 

stolen from our organization is to get out in front of the issue as 

a consumer and file—— 

Mr. BACHUS. I am not arguing with the fact it was done. I am 

just pointing out—— 

Mr. MCINTYRE. The only place you can go is to those credit bureaus. 

Mr. BACHUS. It was great that they did it. I am just saying other 

people, as a result of that theft at TriWest, there were other companies that incurred expenses of—actually greater expenses than 

TriWest or comparable expenses. 

Mr. MCINTYRE. No question about that. That is why hopefully 

when they catch the person we can figure out how to be more creative than just use the maximum 5 years, $250,000 penalty. 

Mr. BACHUS. Mr. Hendricks mentioned this. You know, as far as 

notice in all cases, when you say notice in all cases what if it interferes with a law enforcement investigation? What if the information that you get is not usable? I mean, I guess I am saying when 

you say notice in all cases, would you like to qualify that? 

Mr. MCINTYRE. One has to be very careful about under what situations you are deciding to provide notice. Where you end up in a 

case where the experts would tell you there is sufficient information to misuse it and obtain credit, that certainly is an area where 

you need to do notice. That is what happened in our case and what 

has happened in a series of cases. 

Mr. BACHUS. I understand that. So actually notice in all cases 

really is notice in all cases where it would be reasonable to assume? 

Mr. MCINTYRE. Absolutely. 

Mr. BACHUS. Not actually in a case where the information wasn’t 

usable or there wouldn’t be any reason to notify? 

Mr. MCINTYRE. And I think that California’s standard is one that 

is worthy of looking at. They do talk about reasonable notice, reasonable timeliness under reasonable circumstances. 

Mr. BACHUS. That is what—and rush to notify in all cases. I 

think, you know, there are times when it is not reasonable. 

Mr. MCINTYRE. Agreed. 

Mr. HENDRICKS. May I comment on that? First, you have a reasonableness standard. I think my point is that the default should 

be that there should be notice. The general rule should be the notice and you have to justify when and why there will not be a notice. What is also important here as we talk about costs is look at 

the costs we have identified already just from the lax security procedures, what the credit bureaus had to spend to give people this 

rush of access to their credit reports, to the notice that TriWest had 

41

to do to notify a million people. Please don’t forget the cost to the 

individuals that then have to spend time and emotional energy 

working on that. These are very costly matters if we don’t get them 

right. 

Mr. BACHUS. If you all would like to respond. Do you have any 

comment on that? 

Mr. PRATT. Well, in terms of the broader discussion, we agree 

that, first of all, not every security breach ends up in large scale, 

for example, identity theft. Doesn’t mean that some don’t. An example is in California 200,000 state employees’ records were ostensibly or allegedly stolen. Our member companies cooperated with 

that breach as well. So there are 200,000, there is 562,000 and the 

risk potentially of 10 million over here. So you can see where the 

concern rests. 

We have tracked the 200,000 out of California and have not had 

a single incidence of identity theft related to that. Now does that 

mean we should do nothing? Of course not. But there is a lot of 

qualification that has to be gone through and deliberative process 

that we have to work our way through to make sure we are doing 

the right decision at the right time. In all of this obviously our 

members believe that if we have had our information breached it 

is a responsibility we have to take seriously, not just under fair 

credit but it is the right steps at the right time for the consumer, 

and, no differently than any other industry represented here at the 

table, we are going to take the right steps for the consumer. 

Mr. BACHUS. I think you are in the better position in most cases 

than people who don’t have all the facts. 

Mr. Brady, would you like to respond? 

Mr. BRADY. I guess I would like to respond specifically to DPI 

and how it relates to this, because I think what you have to understand in the DPI case is that there has not been fraud on those 

accounts. And we notified the issuing banks promptly of the issue 

and the issuing banks in turn may notify their cardholders; in 

some cases they notified their cardholders. But the message I want 

to send here is one of let’s not create panic here. You will read the 

headlines that something bad happened but the by-line on page 6 

is that something good happened. And yes, something bad happened at DPI. But the message is that a lot of good things happen. 

There are a lot of people behind the scenes protecting the integrity 

of the process. 

Mr. BACHUS. I think by talking about them to a certain extent 

allows people to—you know, Mr. McIntyre was telling me that happened to him, actually happened. There was a bank that had something very similar. Had he had notice of that, he probably could 

have avoided this entire incident. So I believe by highlighting this 

and taking steps that we are already preventing a lot of that and 

some of the proposals on the table. 

Mr. MITNICK. I have to ask a question of why would these companies not encrypt the credit card and financial information that is 

in their databases. Because if the bad guys are able to break into 

these systems the information is unintelligible. So maybe that is a 

standard that should be considered in the industry. 

42

Mr. BACHUS. Certainly if that happens notifying people would actually—I think that would be a downside. That would be something 

you wouldn’t want to do. 

Chairwoman KELLY. Mr. Mitnick, what would that cost? 

Mr. MITNICK. What would the notification cost or the encryption? 

Well, there are different cost factors. If you encrypt stored information it is relatively inexpensive. If you are encrypting data in real 

time it is expensive. The actual dollars and cents I don’t have at 

my fingertips at the moment. 

Mr. PRATT. I can attest to that. We operate as an association information exchange at financial institutions. When we have to hire 

three different terms to management in description process and 

testing on a monthly basis for penetration, it is staff, it is outside 

resources, it is internalized resources, it is software programs. I 

think Mr. McIntyre said it just right in every 6 months you have 

to change everything because you have to ramp up to a whole new 

standard because the criminals are moving almost with you and 

keeping pace in a lot of cases. 

Mr. MITNICK. Not necessarily with the encryption as long as you 

are using an algorithm that has been widely accepted and you are 

changing keys on a frequent basis. So that is my comment for now. 

I had something, but it slipped my mind, that I was going to say. 

Chairwoman KELLY. Mr. Shadegg. 

Mr. SHADEGG. Thank you. Let me begin, Mr. McIntyre, with you. 

Your testimony doesn’t go into great detail about the break-in. I 

think it might be helpful if we heard a little bit more about how 

it was accomplished, how you discovered it. 

Mr. MCINTYRE. Yes, sir. I will be as detailed as I can be given 

the fact that it is still under Federal investigation with the FBI, 

the Defense Criminal Investigative Service, and a number of other 

entities, and hopefully they will crack it soon. But we suffered a 

theft following another theft, and what happened on this particular 

Saturday at a building where we have no signage on the doors on 

the building that we are there is that someone broke into the property management office for that site and stole the master electronic 

key in order to enter our suite. Totally undetected. Many of the offices around here have those proxy cards. It allows you to know 

who is going in and who is going out, what time they go in, what 

time they go out, and their identity. And so it was a fairly sophisticated job. Was it an insider job? We don’t know. The authorities 

don’t know. They visited with 150 different people. They 

polygraphed a lot of folks. They have caught other people who have 

been engaged in other similar crimes, but not ours in the process 

of this investigation. And we have a very serious problem in Arizona as it relates to this issue, as you well know. 

Mr. SHADEGG. It has already been brought out in your initial testimony and questioning that you were required to maintain Social 

Security number information for these customers. 

Mr. MCINTYRE. Correct. 

Mr. SHADEGG. It seems to me and, as you know, I have put a lot 

of time into the health care industry, are we disadvantaged, are we 

doing ourselves a disservice to require a single number like that 

and to have—and to, for example, require you to use it? I take it 

you use the Social Security number because of a DOD reg and 

43

DOD is using Social Security numbers by choice, presumably not 

by statute? 

Mr. MCINTYRE. Forty years ago they used to use an ID number 

and they switched to Social Security numbers. I am not an expert 

in why they switched and what the complications were that led to 

that. Probably somewhat trying to remember what all your different numbers are because I can’t remember my pin number if I 

have been up all night. So there are different issues that would 

lead one to do that. My Blue Cross/Blue Shield card that I carry 

in my wallet has my Social Security number on it. So this is something that we all—I think you all need to take a look at. Where 

is that really necessary and what are the complications if you are 

going to move away from that? We are required to use them in our 

current contract. 

Mr. SHADEGG. To that point I would like to ask any member of 

the panel that wants to make a comment. Do you think numbers 

should be further restricted, the use of Social Security numbers, 

and should the DOD be using a different number than their Social 

Security? When I was on active duty in the military they used four 

digits of my Social Security number and it seems to me it is too 

broadly used. Anybody have a comment? 

Mr. HENDRICKS. I would like to comment on that because I think, 

yes, pending a study of the costs, the actual real costs, they won’t 

be hard to calculate, I think we should basically place a moratorium on further use of Social Security numbers. It is already required by banks and employers and we have passed laws and we 

have this. But it is such an instrument of choice by identity thieves 

and it increases the value of information and the incentive for 

stealing it. So I think that we should look toward having—especially in the health care field it is very problematic that the Social 

Security number is used. 

The last thing you should remember is you didn’t have time to 

fit the most recent case onto your agenda. That is the University 

of Texas, who got hit by an outside hacker. He was hitting their 

system with random Social Security numbers and once he found 

one it would suck it out of the system and was able to get thousands and thousands of Social Security numbers through this program. The University of Texas official said this was a mistake. We 

should not have used the Social Security number. We are changing. 

So I think we should do this more systematically instead of lost 

and found, by trial and error. 

Mr. SHADEGG. You said pending a study of cost. It looks to me 

there are costs everywhere here. We will have cost to notify everybody. Mr. McIntyre recommended that there should be an obligation to notify everybody. I think that ought to be universally true. 

But that is expensive. Mr. Mitnick commented about encryption 

and then we discovered you can encrypt stored data but not current data. It is the current data that is at least viable. So it seems 

to me we are going to face costs to secure these systems no matter 

what. Go ahead. 

Mr. PRATT. I thought I would set this into context a little bit. We 

do have a difficult time in our society today with 40 million consumers moving every year, 3 million last names change due to 

marriage and divorce, about 6 million or 7 million second homes in 

44

this country with a lot of folks who move in between those two 

homes. There is a lot of flux in the ways we think about identifying 

ourselves. When you and I think about ourselves and we look at 

our own mail coming in the door, we go I know who I am and I 

know what my information is. For a database like a consumer credit reporting database which must have reasonable procedures to assure maximum possible accuracy of the information in the file, that 

is what the Fair Credit Reporting Act tells us, it would be very 

hard for to us build an accurate database if we did not have the 

Social Security number at least for those internal accuracy purposes. 

I think one of the issues that we haven’t framed the question 

quite this way is access by the general public to Social Security 

numbers different than the use of the Social Security number in 

certain matching processes internalized, which allows us to build 

more accurate databases. 

Mr. SHADEGG. Mr. Mitnick. 

Mr. MITNICK. It is fine to use a Social Security number, but not 

to authenticate the person’s identity. I think that is where the mistake is being made. I know it is a very expensive proposition, but 

the problem is people’s Social Security numbers are readily available. There is—for example, the U.S. courts have PACER, public 

access court electronic records, and anybody that has had a bankruptcy, anyone could subscribe to the service and look at the party’s Social Security numbers. They are there for anybody’s viewing. 

Social Security numbers are easily obtainable and to use them as 

a means of identification I think is a mistake. 

Mr. SHADEGG. Speaking of the government’s complicity in this, 

Mr. McIntyre, isn’t one of the cases that you have in this summary 

the result of the United States Senate publishing Social Security 

numbers? 

Mr. MCINTYRE. Yes, sir. I learned from a number of our Nation’s 

distinguished general officers that they received training when 

they become a general officer on identity theft, and they receive 

that because there was a practice up until the late 1990s when on 

their confirmation in the Congressional Record their Social Security number and name was printed. Someone went out, published 

that on the Internet, it was taken, they ordered credit and abused 

the credit of those general officers. The striking thing to me was 

that criminal got only 2 years and 9 months for that crime. And 

it takes longer for those people to clean up their credit records than 

it did for the penalty that the criminal got. 

Mr. MITNICK. One other case, I believe it was a New York busboy 

had obtained the personal identifying information of celebrities 

that were like the top 100 and started obtaining their identity credentials and applying for credit. That was a huge case out of New 

York that you might not be aware of. 

Mr. PRATT. If I could add one point, I have heard Mr. McIntyre 

say several times it takes longer for people to clear up their credit 

history than it does for the perpetrator to remain in jail. I appreciate his enthusiasm for quoting some of the consumer groups in 

terms of that statistic. We are processing consumers every day successfully through consumer dispute processes. We recently looked 

at 5,000 credit reports where security alerts have been added to see 

45

if additional activity occurred in those files. In one-half of 1 percent 

of the cases was there ever even a subsequent dispute relative to 

that set of 5,000 cases where we had added security alerts to the 

files. 

I have to resist the characterization of our entire industry of 

being slipshod and unable to keep information out of the file and 

unable to be responsive. What is happening, and this is why in our 

initiatives that you will see in our testimony, it is a longitudinal 

crime. It isn’t like burglary. It is over a period of time. So in some 

cases we are able to correct the initial information in the file but 

there is still crime occurring or there is still more bad information 

on its way to the credit bureau file. 

So understandably from the consumer’s perspective, that is all 

the same thing to me. But from our perspective we are wrestling 

with trying to keep the right information in the file for safety and 

soundness purposes, which is of course important to this committee, and at the same time to keep the fraudulent information 

out of the file, which is something that we believe is a top priority 

job, one for us just as it would be for anybody else. 

Mr. SHADEGG. In defense of Mr. McIntyre and those consumer 

groups, I can tell you that my constituents who brought the first 

legislation to me they spent far longer than 2 years and 9 months 

trying to clean their record up, indeed probably four or five times 

that length of time. 

I guess the problem I have is the reality that both summaries are 

wrong and really the real problem is how long it takes to apprehend them, because in most cases they are not apprehended at all. 

Before the earlier act passed the response of law enforcement—

and I know this is not your responsibility—the response of law enforcement was to say this isn’t a crime. They may have stolen your 

identity but until they use the credit and you can show me the 

credit then I have a credit card fraud case. And, by the way, I am 

only interested in that credit fraud case if you live here and the 

credit card was used here. If the credit card was used in Pennsylvania and you live in Phoenix, Arizona, I don’t care. So we have 

a serious problem we have to address here. 

I want to conclude by asking Mr. McIntyre if you would describe 

how the fraud alert security mechanism works and what changes 

or improvements would you suggest making to it? 

Mr. MCINTYRE. I am very grateful to the credit bureau industry 

for what they have done. I am sorry that my remarks were misinterpreted, because I actually think that the Federal laws need to 

be enhanced and the penalties. I think the bureaus have done a 

good job of helping protect consumers wherein they have been notified and they are aware they can get that protection. 

What I was advised to do was to contact the consumers, let them 

know this had happened. Because the most effective thing you can 

do when this occurs and you have information in the public domain 

that could potentially be used to create credit and misuse it is to 

put a fraud flag on your file. What that does is it notifies those that 

may be interested in granting you credit or may be contacted to 

grant you credit that they need to verify you are who you say you 

are so your identity isn’t misused and you end up with a subsequent problem. That is why we took that action. We were advised 

46

by the bureaus and the FTC that was the best thing to do in this 

case. 

What I have discovered, together with the bureaus, is that we do 

need a process by which corporations that are willing to do this on 

behalf of their customers can do it. It helps the bureaus reduce cost 

and it helps the customer reduce the hassle, because it was on average taking 3 hours for people to go through this process just because of the sheer weight of the volume that had been put onto the 

back of the credit bureaus. 

The second thing I discovered is that in order to keep people protected I now have to notify people every 90 days that they have to 

go out and update their fraud flag because each of the credit bureaus is on a different cycle. One of the credit bureaus requires an 

update every 90 days. One of the credits bureaus requires an update every 6 months. One of the credit bureaus requires an update 

everybody 12 months. I think it would be helpful for them and for 

us and for the customers to have that in alignment. 

The issue I face now is when I update people in the next 4 weeks 

that unless the crime has been solved, and I will update them 

about that, but their information is potentially still at risk. Guess 

what, some of my customers are now deployed. Their fraud flags 

could drop if I don’t make sure and the credit bureaus together 

with me don’t make sure that stuff stays. So we are talking to the 

credit bureaus now and we are going to talk to the Defense Department and the lawyers to figure out how do we get around that 

problem. 

Mr. PRATT. In fact, every one of those consumers when they contacted the credit bureau can add a 7-year alert to their file. So that 

once you contact the bureau what we are talking about is two different things. The temporary alert is added by the credit bureau 

without a question. In other words, the consumer said I want you 

to believe me at least to a certain extent, I don’t have to go through 

a bureaucracy just to get a fraud flag on the file. The key here is 

once the consumer receives his or her file disclosure and goes over 

the report at that time a 7-year alert can be added to the file and 

our member companies are consistent across the board in adding 

7-year alerts. So I think there is a difference in practice, or at least 

we need to clarify the practice here. 

Mr. MCINTYRE. I would suggest in cases where the crime may actually be solved because there is lots of focus of law enforcement 

on it that the hassle of having a long-term alert may not necessarily be the right action. But I am not an expert in this area. 

Mr. PRATT. Of course after a consumer discovers that he or she 

is safe we will voluntarily remove that alert any time during the 

7-ear period. 

Mr. SHADEGG. I know I have more questions, but my time has 

long since expired. I will yield back. If there is a second round, I 

will take advantage of it. 

Chairwoman KELLY. Mr. Renzi. 

Mr. RENZI. Thank you, Madam Chair. Appreciate your testimony 

and traveling all the way out here, especially from Arizona, and 

sharing with us the sophistication behind the theft operation and 

particularly that struck TriWest. Many of you know, particularly 

my friend from Arizona, I am the father of 12 children, 7 boys and 

47

5 girls. I am particularly concerned about the niche as it relates 

to how we take care of the children’s identity that has been stolen. 

If the identity of the parents had been stolen, name, address, 

phone numbers, everything, then obviously also the child’s address. 

We go back to the days of those spy movies where they would take 

identity theft out of the obituaries. We now move forward into electronic theft, full and complete information provided not just on 

adults but on children. You can imagine a child of 5 or 6, 7 years 

old having their identity stolen from them and then yet no flags go 

up until they are about 18 years old, 16 years old and all of a sudden for the last 10 years their identity has been stolen, their identity has been used. 

So I would ask what kind of remedies, and I know there is some 

talk in this area, what kind of remedies are you looking at, what 

kind of means are we putting together to help protect our children? 

Mr. MCINTYRE. I can’t respond to that part of the question, but 

what I can tell you is we did many responses to that issue. We 

looked at that. We were concerned about that issue. I have three 

young kids, so it is the question of what impact is this going to 

have on them. The fact of the matter is that in our case all of the 

information, the breadth of it, on the people over 18 was not also 

on the database for the people under 18. In some cases it was just 

their name. In other cases there wasn’t any information because 

they were—the primary sponsor was the one who was actually on 

the database. 

What we did was we talked to the FTC, we talked to the credit 

bureaus, we talked to others who were experts in the industry 

what do you do, how do you deal with this issue? What we did was 

set up a database. The database can be reviewed by the primary 

sponsor to determine what information was on the stolen hard 

drives to determine what secondary impact it may have on them 

or their families and then to advise them of the risks if you add 

a fraud flag for kids under 18 who have no credit record, and then 

how you would go about doing that so that they could make an informed decision on their own, and then we have offered to assist 

them in that way. 

Mr. HENDRICKS. I would like to respond to that because I am 

working with some folks on a case right now where a young man 

from Alabama was mixed up with an older person from Arizona actually. Just an old-fashioned mixed file case based on a similarity 

in Social Security numbers. They weren’t the same but because the 

algorithms, if they are just one or two digits different they will 

merge the files. What is troubling in the case is the young man 

from Alabama is basically being assigned unpaid debts from when 

he was like 12, 13 and 14 years old. So you would think the system 

would identify that at his age he wouldn’t have been able to incur 

those debts. But they don’t seem to have a system in place. He has 

had a terrible time getting his files unmixed. His mother has gotten involved. So when he became of age and his rite of passage, 

when he got to apply for credit he was rejected. So there are some 

very old-fashioned problems in this system. 

Mr. MITNICK. In certain States like California, Texas and Kentucky birth records are public record. You can go onto the Internet 

and look up anyone’s birth record which gives criminals the ability 

48

to apply for that person’s birth record because all they need to do 

is send a letter to the Department of Vital Statistics, give them the 

information on the birth certificate, they get a certified copy of the 

birth certificate back, and they become that child. They can get extensions of credit set up and the account at the credit bureau. So 

that is a problem that certain States have, birth records in the 

public domain. 

Mr. RENZI. Thank you. One of the things I know that is being 

kicked around as a remedy is the idea—Mr. McIntyre, I appreciate 

you mentioning it—is that those children who have had their identities stolen from them would have an alert or flag put on their 

credit. So that if anyone was checking their credit, if anyone was 

using their credit, even when that credit was being checked it 

would warn the person checking the credit that, hey, this is a stolen identity. Let’s say a child goes through 10 years of that and 

then all of a sudden it is time for them to use their credit. What 

I worry about on the alert system is how do you then take it off? 

What detail is provided to show that child was innocent. So as we 

look at remedies we also not only impose the remedy to protect the 

child but then the release in order to have the child given back. 

Mr. McIntyre. 

Mr. MCINTYRE. That is exactly why I felt uncomfortable making 

the decision to advise people on what they ought to do and that it 

made more sense to lay out the facts so that every parent who 

might otherwise have someone on that list could look at the information that was there and make an informed decision on their 

own, and each parent needs to do that. 

Mr. HENDRICKS. I agree this fraud alert is kind of a sledgehammer. It is sort of all or nothing. And I think what is common 

if have you a problem, you say we don’t want my information used 

for pre-screened offers, too. So you wipe yourself from all those. Obviously we need a finer tuned system so you can really sort of go 

in with the scalpel and fix problems. But that is what we have 

now. To me that is why it is very important to have instant access 

to your credit report so you can see what is on it and what activity 

has there been on it. That is the best way you can keep it accurate. 

Mr. MITNICK. How about developing a partnership with the Social Security Administration so these companies could determine 

the age of the person requesting the extension of credit, verify that 

the name really did match the Social Security number, because it 

would be kind of strange for a 16-year-old to be applying for a 

MasterCard. 

Mr. RENZI. Well said. Creative idea. I serve on the Veterans’ Affairs Committee. At this point in our Nation’s history we have got 

women with children, men with children in America who are being 

kicked out of their homes because the checks, their military pay 

doesn’t get home in time. And we are looking at legislation that is 

going to protect our veterans and servicemen and women so that 

you can’t move them out of their dwellings, you can’t take away 

their cars if they are late on a payment. I am thinking how this 

might tie in this piece of legislation that we are working on in that 

if a serviceman or woman was to have their identity stolen, and 

since we are barely paying them enough anyway, the cost for them 

to get their identification back is going to be enormous. And that 

49

cost or that loss of revenues could then impact their ability to 

house their family, to provide decent transportation. 

Is there an ability or would you be in agreement, particularly 

Mr. McIntyre given the fact that you helped the TRICARE portion 

and how it affects our servicemen and women, would there be an 

ability to protect our servicemen and women as it relates to identity theft? 

Mr. MCINTYRE. I would be more than willing to look at that with 

you. You have described exactly why I have no qualms nor does my 

board to spent the kind of money and effort that we have had to 

spend. The thing that concerned me greatly about the case that involves us and the theft that was perpetrated against us and the information involved is because we are talking about people who 

serve all of us who do not make a lot of money and a blight on 

their credit report can be the difference between having a car, renting an apartment or buying a house. And so we felt an absolute 

obligation to do what we did. But I would be glad to work with you, 

sir, in that area. 

Chairwoman KELLY. Thank you very much. We have just been 

called for another vote. In the interest of time I am going to call 

on Mr. Moore and I am going to call on Mr. Fossella. I would like 

everybody to keep their questions and answers within the 5-minute 

period, please. 

Mr. MOORE. Thank you, Madam Chairman. I wanted to just ask 

you a couple of questions, Mr. McIntyre. We have talked before and 

I appreciate the actions that your company has taken since the 

theft, the burglary and the theft to try to—and your personal call 

to the people but I wanted to ask, obviously I think it is in 

everybody’s best interest that not only do we punish somebody who 

has committed a crime like this but we try to prevent it in the future and that is the best way to protect people, I think. I was concerned in reading some of the materials, I think in your State, that 

I think it was 2 days after the incident until you even learned that 

there had been a theft. 

What kind of security precautions did you have or security systems did you have in place on the day of the incident? And apparently they failed. 

Mr. MCINTYRE. I have been asked by authorities not to address 

all the details of the security systems and the like because they are 

still attempting to catch who did it, and FBI agents have interviewed over 150 folks and polygraphed a number in this area. 

What I can tell you is that we were the subject of a secondary 

theft. Whoever was responsible for this broke into the property 

management office, the place where we had this secondary office. 

They then stole the electronic master key which allows you to get 

into a locked door undetected, although it would read as though 

you were the property manager, and enter our suite. And that is 

how the theft occurred. Thus we weren’t aware—it happened on a 

Saturday. We didn’t learn about it until first thing Monday morning when our folks when in to turn on the computer and found out 

that the computer system did not work. 

Mr. MOORE. Obviously there are video monitor systems and security systems and other precautions that can be taken to notify 

somebody if there has been an entry even if it appears to be an auVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00055 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
50

thorized entry, because at some point they had to steel the electronic key, isn’t that correct? 

Mr. MCINTYRE. Correct. 

Mr. MOORE. From your materials in your statement it appears 

that you have and I hope that you are taking substantial strides 

in trying to correct the system so something like that doesn’t happen again. If there is an unauthorized entry, you or somebody 

would be notified immediately. 

Mr. MCINTYRE. I will tell you that we have brought in security 

experts, we have partnered with the Department of Defense. They 

are now looking at their entire system worldwide. They found deficiencies in their areas. But you know what is interesting to me 

about this is that in Arizona 6 months prior to the theft in our 

building, five financial institutions were hit with a very similar 

crime. A bank in Tucson was hit 6 months prior after hours. Penetrated all the security systems, got through, stole the hard drives, 

left the bank with that information. And so this is something that 

unfortunately, given the rise of the prevalence of information and 

the like, that we have a real serious problem with in this country. 

That is why I think when it does happen, even if they are able to 

get beyond the safeguards, that is when we have to look at where 

are the responsibilities for notification. 

Mr. MOORE. Absolutely. How long after the incident was it that 

you notified the Department of Defense? 

Mr. MCINTYRE. I notified the Department of Defense immediately 

when I discovered there was a problem. They then ran the database and we contacted the senior management in the Department 

of Defense, not the operations people who we had contacted the 

first day that we discovered it. We contacted them once we had the 

database fully run and knew what the extent of the problem was. 

Mr. MOORE. Thank you. I will conclude by saying when these 

large databases exist and if in fact hard drives are stolen, not just 

data or information from a computer system but hard drives and 

there has to be a physical entry and I hope that you have told me 

and I trust what you have said that your company is looking at 

this very seriously and making sure this doesn’t happen in the future. I think financial institutions, anybody else who has databases 

like this needs to take similar precautions. 

Chairwoman KELLY. Mr. Fossella. 

Mr. FOSSELLA. Thank you. I will just throw out two questions 

and the second is sort of two parts and allow you to answer in light 

of the time here. 

First, Mr. Brady, in light of your efforts at MasterCard I am sure 

you are doing what you think is providing the highest level of security on the network. In your mind—if it has been asked before I 

apologize—in your opinion what would be the best thing that could 

be done to provide incentives perhaps for other companies to do as 

you are doing and in providing the highest level of security? And 

secondly, I will throw this out to all of you. If you can answer me, 

great. 

Earlier the Secret Service testified and argued, it seems, for a 

better working relationship or continued working relationship 

among different agencies and academic institutions to prevent 

what has been alluded to a number of times here. In your experiVerDate 0ct 09 2002 13:08 Nov 05, 2003 Jkt 000000 PO 00000 Frm 00056 Fmt 6633 Sfmt 6633 C:\DOCS\89407.TXT MICAH PsN: MICAHW
51

ences how have those relationships been working and what, if any, 

ways can those be improved? And the second part of that question 

is the cost of prosecution and whether local or State or Federal 

prosecutors are doing what they can given the resources they have. 

I will give you an example. It has been argued that perhaps a 

local district attorney, given the nature of this type of crime, will 

say, hey, I have a limited budget here; in my view, the cost of following through on prosecution to indict with a conviction is going 

to cost me X amount of dollars, which could be, you know, such a 

disproportionate share of my budget that I don’t have those resources to follow through. So are there any ways to, A, if in your 

experience that is true, and, B, if so, are there any ways in which 

those situations could be addressed in order to prosecute those 

crimes as efficiently and as swiftly as possible? 

Mr. BRADY. Yes. I would like briefly to talk on your point of security. MasterCard, without getting into too much data on our security network, has a very robust network. We do outside penetration 

testing on networks to ensure they are secure and they are. One 

of the things that I really want today to bring out here, and I alluded to it before, was there is no need for hysteria because 

MasterCard is vigilant behind the scenes. When there is a compromise and the DPI hack is one of those examples, We notify the 

issuers, we follow the protocol, we not only follow the protocol of 

MasterCard and working with law enforcement, but the entity that 

was breached follows the MasterCard protocol in place, the timely 

notification to us and also the timely notification to law enforcement. We have sufficient penalties in place so that if that didn’t 

happen that they could be fined on a per day basis, a draconian 

amount of money. 

So I think the law enforcement gentleman brought up that these 

companies are coming forward, and part of that is because there 

are effective rules in place to bring them forward when something 

does happen. And the good news again with the DPI hack is we 

are not seeing general fraud. But everybody is being vigilant, looking at the account numbers, and monitoring the account numbers 

on a daily basis. 

And MasterCard has a wide array of fraud controls in place, I 

know we are short on time, but we have controls in place for auditing merchants, controlling fraud, and we have penalties and policies in place for the bad actors that are in the system. 

So your second point was on law enforcement and our relationships, and from where I sit we greatly value those relationships. 

The gentleman from the Secret Service that were here from this 

morning, the electronic crimes task forces that have been put together over the past several years, the effort is tremendous and it 

really fits a need out there. And I would just like to say that one 

thing that was brought up this morning about these hacks and 

what we find out from the hacks is that there is little fraud on the 

hacks. When you see account numbers that are being hacked we 

track it. There is little fraud on it. And you know what it is? A lot 

of them that are out there that are joy riding, that are stealing 

numbers, that are causing harm. And the question is what do we 

and the prosecutors that are out there, do with them not only in 

the Federal level but the State levels. I will wrap up. Sorry. And 

52

I think tougher penalties are important here because even though 

there is not fraud there is a lot of costs when these things happen. 

Chairwoman KELLY. Thank you very much. The Chair notes that 

some members may have additional questions for the panel. They 

may wish to submit those in writing. Without objection, the hearing record will remain open for 30 days for members to submit 

written questions to the witnesses. 

The second panel is excused with the committee’s great appreciation for your time. Thank you. I want to thank all the members 

and staff for their assistance in making the hearing possible. 

This hearing is adjourned. 

[Whereupon, at 1:25 p.m., the joint subcommittee was adjourned.] 

(53)

A P P E N D I X

April 3, 2003

54


89407.001
55


89407.002
56


89407.003
57


89407.004
58


89407.005
59


89407.006
60


89407.007
61


89407.008
62


89407.009
63


89407.010
64


89407.011
65


89407.012
66


89407.013
67


89407.014
68


89407.015
69


89407.016
70


89407.017
71


89407.018
72


89407.019
73


89407.020
74


89407.021
75


89407.022
76


89407.023
77


89407.024
78


89407.025
79


89407.026
80


89407.027
81


89407.028
82


89407.029
83


89407.030
84


89407.031
85


89407.032
86


89407.033
87


89407.034
88


89407.035
89


89407.036
90


89407.037
91


89407.038
92


89407.039
93


89407.040
94


89407.041
95


89407.042
96


89407.043
97


89407.044
98


89407.045
99


89407.046
100


89407.047
101


89407.048
102


89407.049
103


89407.050
104


89407.051
105


89407.052
106


89407.053
107


89407.054
108


89407.055
109


89407.056
110


89407.057
111


89407.058
112


89407.059
113


89407.060
114


89407.061
115


89407.062
116


89407.063
117


89407.064
118


89407.065
119


89407.066
120


89407.067
121


89407.068
122


89407.069
123


89407.070
124


89407.071
125


89407.072
126


89407.073
127


89407.074
128


89407.075
129


89407.076
130


89407.077
131


89407.078
132


89407.079
133


89407.080
134


89407.081
135


89407.082
136


89407.083
137


89407.084
138


89407.085
139


89407.086
140


89407.087
141


89407.088
142


89407.089
143


89407.090
144


89407.091
145


89407.092
146


89407.093
147


89407.094
148


89407.095
149


89407.096
150


89407.097
151


89407.098
152


89407.099
153


89407.100
154


89407.101
155


89407.102
156


89407.103
157


89407.104
158


89407.105