U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

29–461 PDF 2006

CREDIT CARD DATA PROCESSING:

HOW SECURE IS IT?

HEARING

BEFORE THE

SUBCOMMITTEE ON 

OVERSIGHT AND INVESTIGATIONS

OF THE

COMMITTEE ON FINANCIAL SERVICES

U.S. HOUSE OF REPRESENTATIVES

ONE HUNDRED NINTH CONGRESS

FIRST SESSION

JULY 21, 2005

Printed for the use of the Committee on Financial Services

Serial No. 109–48

(

(II)

HOUSE COMMITTEE ON FINANCIAL SERVICES 

MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa 

RICHARD H. BAKER, Louisiana 

DEBORAH PRYCE, Ohio 

SPENCER BACHUS, Alabama 

MICHAEL N. CASTLE, Delaware 

EDWARD R. ROYCE, California 

FRANK D. LUCAS, Oklahoma 

ROBERT W. NEY, Ohio 

SUE W. KELLY, New York, Vice Chair 

RON PAUL, Texas 

PAUL E. GILLMOR, Ohio 

JIM RYUN, Kansas 

STEVEN C. LATOURETTE, Ohio 

DONALD A. MANZULLO, Illinois 

WALTER B. JONES, JR., North Carolina 

JUDY BIGGERT, Illinois 

CHRISTOPHER SHAYS, Connecticut 

VITO FOSSELLA, New York 

GARY G. MILLER, California 

PATRICK J. TIBERI, Ohio 

MARK R. KENNEDY, Minnesota 

TOM FEENEY, Florida 

JEB HENSARLING, Texas 

SCOTT GARRETT, New Jersey 

GINNY BROWN-WAITE, Florida 

J. GRESHAM BARRETT, South Carolina 

KATHERINE HARRIS, Florida 

RICK RENZI, Arizona 

JIM GERLACH, Pennsylvania 

STEVAN PEARCE, New Mexico 

RANDY NEUGEBAUER, Texas 

TOM PRICE, Georgia 

MICHAEL G. FITZPATRICK, Pennsylvania 

GEOFF DAVIS, Kentucky 

PATRICK T. MCHENRY, North Carolina 

CAMPBELL, JOHN, California 

BARNEY FRANK, Massachusetts 

PAUL E. KANJORSKI, Pennsylvania 

MAXINE WATERS, California 

CAROLYN B. MALONEY, New York 

LUIS V. GUTIERREZ, Illinois 

NYDIA M. VELA ́ ZQUEZ, New York 

MELVIN L. WATT, North Carolina 

GARY L. ACKERMAN, New York 

DARLENE HOOLEY, Oregon 

JULIA CARSON, Indiana 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

BARBARA LEE, California 

DENNIS MOORE, Kansas 

MICHAEL E. CAPUANO, Massachusetts 

HAROLD E. FORD, JR., Tennessee 

RUBE ́ N HINOJOSA, Texas 

JOSEPH CROWLEY, New York 

WM. LACY CLAY, Missouri 

STEVE ISRAEL, New York 

CAROLYN MCCARTHY, New York 

JOE BACA, California 

JIM MATHESON, Utah 

STEPHEN F. LYNCH, Massachusetts 

BRAD MILLER, North Carolina 

DAVID SCOTT, Georgia 

ARTUR DAVIS, Alabama 

AL GREEN, Texas 

EMANUEL CLEAVER, Missouri 

MELISSA L. BEAN, Illinois 

DEBBIE WASSERMAN SCHULTZ, Florida 

GWEN MOORE, Wisconsin, 

BERNARD SANDERS, Vermont

Robert U. Foster, III, Staff Director 

(III)

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

SUE W. KELLY, New York, Chair

RON PAUL, Texas, Vice Chairman 

EDWARD R. ROYCE, California 

STEVEN C. LATOURETTE, Ohio 

MARK R. KENNEDY, Minnesota 

SCOTT GARRETT, New Jersey 

J. GRESHAM BARRETT, South Carolina 

TOM PRICE, Georgia 

MICHAEL G. FITZPATRICK, Pennsylvania 

GEOFF DAVIS, Kentucky 

PATRICK T. MCHENRY, North Carolina 

MICHAEL G. OXLEY, Ohio 

LUIS V. GUTIERREZ, Illinois 

DENNIS MOORE, Kansas 

CAROLYN B. MALONEY, New York 

STEPHEN F. LYNCH, Massachusetts 

ARTUR DAVIS, Alabama 

EMANUEL CLEAVER, Missouri 

DAVID SCOTT, Georgia 

DEBBIE WASSERMAN SCHULTZ, Florida 

GWEN MOORE, Wisconsin 

BARNEY FRANK, Massachusetts 

(V)

C O N T E N T S 

Page 

Hearing held on: 

July 21, 2005 ..................................................................................................... 1

Appendix: 

July 21, 2005 ..................................................................................................... 51

WITNESSES 

THURSDAY, JULY 21, 2005

Duncan, Mallory, General Counsel, National Retail Federation ......................... 23

Gorgol, Zyg, Senior Vice President, Fraud Risk Management, American Express ...................................................................................................................... 17

Hendricks, Evan, Editor and Publisher, Privacy Times ....................................... 26

Minetti, Carlos, Executive Vice President, Cardmember Services, Discover 

Card ....................................................................................................................... 19

Peirez, Joshua L., Senior Vice President & Associate General Counsel, Law 

Department, Mastercard International .............................................................. 14

Perry, John M., President and Chief Executive Officer, CardSystems Solutions, Inc. .............................................................................................................. 25

Ruwe, Steve, Executive Vice President, Operations & Risk Management, Visa 

U.S.A. Inc. ............................................................................................................. 16

Watson, David B., Chairman, Merrick Bank ........................................................ 21

APPENDIX 

Prepared statements: 

Castle, Hon. Michael N. ................................................................................... 52

LaTourette, Hon. Steven C. ............................................................................. 53

Duncan, Mallory ............................................................................................... 54

Gorgol, Zyg ........................................................................................................ 66

Hendricks, Evan ............................................................................................... 78

Minetti, Carlos .................................................................................................. 85

Peirez, Joshua L. .............................................................................................. 98

Perry, John M. .................................................................................................. 105

Ruwe, Steve ....................................................................................................... 119

Watson, David B. .............................................................................................. 127

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

LaTourette, Hon. Steven C.: 

ARMA International statement ....................................................................... 136

Cardholder Transaction Process chart ............................................................ 142

(1)

CREDIT CARD DATA PROCESSING: 

HOW SECURE IS IT? 

Thursday, July 21, 2005

U.S. HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON FINANCIAL SERVICES, Washington, D.C. 

The subcommittee met, pursuant to notice, at 10:13 a.m., in room 

2128, Rayburn House Office Building, Hon. Sue Kelly [chairwoman 

of the subcommittee] presiding. 

Present: Representatives Kelly, Pryce, Bachus, Castle, Kennedy, 

Garrett, Renzi, Price, McHenry, Gutierrez, Maloney, Hooley, Moore 

of Kansas, Matheson, Scott, Davis of Alabama, and Cleaver. 

Chairwoman KELLY. I call this hearing on the Subcommittee on 

Oversight and Investigations to order. 

Over the last few months, disturbing information has come to 

light about breaches in data security across the financial services 

industry. Millions of consumers have found out that their personal 

information may have been compromised. Millions more are now 

worried about personal data protection with the attention given 

these breaches. 

This is an issue that personally affects all of us. In cities and 

towns across my congressional district in New York and all across 

our country, we rely on credit cards day in and day out. We expect 

nothing less than a safe and secure system of processing them. 

These breaches harm the network of financial transactions that 

gives the United States the most productive economy in the world. 

These breaches cause consumers to lose confidence in the payment 

systems that drive sales growth. They impose new risks and costs 

on merchants and threaten some with the loss of customers and 

their livelihood. We need to do everything possible to ensure that 

our personal information remains privileged and protected when 

we make any financial transaction. 

Today’s hearing will deal specifically with the recent data breach 

at CardSystems where more than 40 million credit card accounts 

of 4 major credit card brands may have been exposed. At least 

200,000 accounts were definitely stolen, and evidence exists that a 

routine may have been in place to allow the culling of credit card 

information on a regular basis. 

In response to these breaches, Visa and American Express are 

terminating their relationship with CardSystems, while the company itself is putting in new measures to ensure data security. 

Yesterday, in testimony to the Financial Services Committee, 

Federal Reserve Chairman Greenspan noted that increased regulaVerDate 0ct 09 2002 12:47 Sep 20, 2006 Jkt 029461 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 F:\DOCS\29461.TXT HFIN PsN: TERRIE
2

tions may have the consequence of killing the electronic innovation 

and productivity that have kept our economy and our markets 

growing. He also noted that in a free market economy all companies that hold personal data have a huge financial incentive to 

keep it as secure as possible. Unfortunately, in this case and others, those incentives either failed or were overcome by the financial 

incentives of fees. 

What we need to learn today from the witnesses in this case is, 

what happened, what was supposed to happen, and what can be 

done to prevent this from happening again. 

I welcome the witnesses, and I yield now to the gentleman from 

Illinois. 

Mr. GUTIERREZ. Good morning. I want to thank Chairwoman 

Kelly for calling this hearing entitled, ‘‘Credit Card Data Processing: How Secure Is It?’’ I think the answer to many people reading the news lately is, not secure enough. 

Data security is very important to many of us here on this committee, and I am pleased that we will be joined later on by some 

of our colleagues who will ask to participate. 

This issue is also personally important to me. I am proud to have 

served as a conferee on the FACT Act, which dealt with similar 

issues. 

In March, I coauthored a bill with Congresswoman Melissa Bean 

on this issue, and I am proud to be an original cosponsor of the recent bill introduced by Representatives Bean and Artur Davis. 

There are many other worthy bills on this topic, and I suspect we 

are going to be working together to craft a solution before the end 

of the year. 

We need to understand what happened here and where the gaps 

in the law are so they can be fixed. We also need to determine the 

proper way to notify and protect consumers and inform the credit 

rating agencies when consumer data compromise can lead to identity theft. We need to make sure that consumer notification takes 

place in language the consumer can understand. 

I look forward to hearing from the witnesses so that we can learn 

from the problems they experience and minimize similar occurrences. At the proper time, I will inquire about the audit processes 

or credit processes and how CardSystems could have been certified 

while maintaining an adequate software and retaining customer 

data in violation of its Visa contract. 

Additional checks and balances may be necessary in the system 

of certification. The largest banks, I am told, have supervision in 

the form of professional examiners from their regulator onsite 

every day of the year. It might make sense to employ a similar 

process when we are talking about security of large amounts of 

data in an entity that is not a bank but is performing functions of 

a bank. It would also be helpful to determine the actual scope of 

the compromised data and the degree of fraudulent activity that 

may be related to this incident. 

I am pleased to welcome all of the witnesses, and I especially 

want to welcome Evan Hendricks whose quarter century of expertise proved invaluable during consideration of the FACT Act issues, 

and I am certain he will be helpful today. I understand that he has 

3

a plane to catch early this afternoon, but we are especially grateful 

that he could make the time to be with us today. 

Thank you so much, Mr. Hendricks, for being here. 

We have been joined by Mr. Matheson, and I ask unanimous consent that he be permitted to make an opening statement. 

Chairwoman KELLY. So moved. 

We have been joined by a number of members who are not on 

this particular subcommittee but that are on the Financial Services 

Committee as a whole. We are honored by their presence. We have 

Mr. Kennedy, Mr. Castle, and Mr. Bachus with us this morning, 

and I ask unanimous consent that they too may be able to make 

an opening statement. So moved. 

So without objection, all members’ opening statements will be 

made part of the record. 

I turn now to Mr. Garrett. 

Mr. GARRETT. Thank you, Madam Chairwoman, for holding today’s hearing on data security and credit card systems in light of 

recent headlines. I think it is both timely and necessary that we 

have these hearings, not only so that we can learn more about the 

apparent data breach at CardSystems affecting the four major 

credit card companies, but also we can learn how this committee 

may be able to respond in an appropriate manner. 

The data breaches that were recently disclosed by financial institutions have generally, in the past, involved lost data tapes or similar mishaps which do not necessarily suggest criminal intent. However, in this circumstance it appears that someone was able to compromise their database system to obtain information for malicious 

purposes. 

So while the other types of data breaches are obviously cause for 

concern, it is especially troubling when we learn that sensitive information has fallen into the hands of apparent criminals. Therefore, I am particularly interested in learning about how consumers 

are protected against credit card fraud or other problems resulting 

from this breach. 

I think we also need to examine how the breach at CardSystems 

could have been avoided. Is there a shortfall in the law? Do we 

need new laws? Or do companies simply need to be more responsible in complying with existing laws and any of their contractual 

obligations? 

My hunch is that CardSystems’ apparent lack of an adequate 

data security regime may simply be that they were running crosswise with existing laws or contractual obligations. So we simply 

need to learn now how the existing lay of the land has been applied 

in this situation before we move on and consider making more 

laws. 

I think we also may want to use this as an opportunity to at 

least explore and understand a little bit what potential impact the 

decisions that may affect CardSystems’ future may also have indirectly on any of their vendors or other players in the system. 

I would also like to say for the record that I appreciate 

MasterCard’s efforts to bring the situation at CardSystems to light, 

as they were under really no direct obligation to do so, but I think 

that they did so in thinking what was most responsible for getting 

the information out in the interest of their cardholders. And for 

4

that reason, I believe that they should be commended for their actions. 

Thank you again, Madam Chairwoman, for holding this hearing, 

and I yield back the balance of my time. 

Chairwoman KELLY. Thank you. 

Ms. Maloney? 

Mrs. MALONEY. Thank you very much, Madam Chairwoman, for 

having this hearing today that continues to address the really very 

pressing issue of data security and identity theft through this series of hearings. 

This hearing focuses on a particularly terrible example of a 

breach of data security: The exposure of 40 million credit and debit 

card accounts at a data processing company handling Visa, 

MasterCard and American Express. Based on an FBI investigation 

it appears that the data processor, CardSystems, blatantly violated 

the contractual data security restrictions imposed by each of the 

credit card companies. 

But this would not have come to light had it not been for a huge 

breach and resultant fraudulent transactions. I expect that each of 

the credit card companies here today will explain to us that they 

spend a great deal of time, money and resources preventing credit 

card fraud and protecting consumers from the effects of credit card 

fraud through zero liability policies and card reissuance. 

This is all very laudable but the issue before the committee today 

is not just credit card fraud: the issue before us is the much more 

complex issue of identity theft, because it does not simply involve 

a fraudulent charge on a card, it is typically the opening of a new 

account in the name of the victim. Identity theft is harder to find, 

harder to assess, and harder to combat, but it is the main issue we 

need to address. 

For example, we may have a good idea now of all the credit card 

fraud that is likely to result from the CardSystems breach, but that 

does not mean that we know the extent of the identity theft risk. 

Similarly, the credit card companies often identify credit card 

fraud right away, but in this case they appear to have been absolutely clueless for months while personal data was removed from 

the database. 

At present, the main protections against identity theft are contractual agreements between credit card companies and the banks 

and data processors that handle the information. The CardSystems 

incident is a spectacular failure of this private sector protection 

and suggests that more regulation, more enforcement and more 

penalties are necessary in this area. 

For example, until yesterday, it appeared that the credit card 

companies would continue to do business with CardSystems even 

though CardSystems had not complied with the data security requirements. 

Moreover, there is a huge regulatory gap under Gramm-LeachBliley. The respective financial regulators are responsible for making sure that financial institutions who contract out data processing functions ensure their contractor’s compliance. And the FTC 

rules require data processors to preserve the confidentiality of personal financial data. But in this case, the regulators appear to have 

played ‘‘toss the hot potato’’ with this whole incident. 

5

So far, all the consequences of data security breaches could be 

viewed by a data processor as the cost of doing business. 

Yesterday, perhaps bowing to the pressure of this important 

hearing, Visa and American Express terminated their business 

with CardSystems, but MasterCard still has its data processing 

handled by them. This situation is not acceptable, and we need to 

provide the legal structure to fix it. 

I am a proud cosponsor and original sponsor of this legislation 

that has been introduced by my colleague, Representative Bean 

from Illinois, and it is a good first step in this area. I look forward, 

as always, to hearing the witnesses’ views and some of the alternatives and ideas that they may have, and I hope that we can benefit as we move forward with this bill, and I thank all of you for 

being here. It is extremely important. 

I must say that one of the biggest credit card theft rings is in 

the district that I represent in New York, in Queens, and it is just 

a terrible problem once it happens, and so our efforts to prevent 

it are very important. Thank you. 

Chairwoman KELLY. Thank you, Ms. Maloney. 

Mr. Kennedy? 

Mr. Price? 

Mr. PRICE. Thank you, Madam Chairwoman. I appreciate the opportunity to participate in this hearing, and I want to thank all of 

the witnesses for being here. 

I want to especially welcome Mr. John Perry of CardSystems, 

who has a portion of his business in my district. I am sorry I am 

late but I want to echo the comments of others who have talked 

about the importance of having security within the credit card system. I am somewhat astounded by some of the comments that I 

just heard, however, in view of the fact that CardSystems, itself, 

discovered the breach, notified the companies of the breach, and is 

working aggressively and actively to correct the challenges that 

they and the industry have. 

Greater regulation and greater penalties I am not certain—which 

is oftentimes the knee-jerk reaction to a challenge that we have in 

any area—I am not certain that is indeed the answer at all. 

So I look forward to the testimony before us today. I look forward 

to increasing my knowledge of this area, and I also hope that individuals will lower the rhetoric, calm down, and work toward solutions in this area as opposed to bomb-throwing. And I yield back. 

Chairwoman KELLY. Mr. Moore? 

Mr. MOORE OF KANSAS. Thank you, Madam Chairwoman. I 

would like to thank you for holding today’s hearing and thank the 

witnesses for appearing today to share their information with us. 

The focus of this morning’s hearing is data security within the 

credit card payment system, specifically the recently publicized 

data breach at CardSystems Solutions that could have affected approximately 40 million credit and debit card accounts. 

I look forward to Mr. Perry’s testimony this morning. I appreciate your being here, sir, to discuss what steps CardSystems is 

taking to secure deficiencies in the system. 

The CardSystems breach, among many others of businesses as 

diverse as data brokers, retailers, and banks, begs the question of 

what Congress should be doing to protect consumers from identity 

6

theft. As we have all seen over the last few months, States across 

our country have been enacting or considering data security notification laws to deal with the problem of data breaches. 

The proliferation of State activity in the area of data security 

and notification, though, is now creating a confusing patchwork of 

conflicting laws that is adding to the cost of doing business nationwide. I think it is time for Congress to act to protect consumers 

from data breaches and create a uniform national standard that 

seeks to create a level of certainty for consumers and national businesses. 

Representatives Deborah Pryce, Mike Castle, and I have been 

working on data security legislation that would, for the first time 

under Federal law, require companies to notify consumers when 

their sensitive personal information has been accessed in a way 

that could lead to identity theft. There should be a few guiding 

principles behind any data security bill that Congress considers. 

Number one, companies should be required to safeguard their 

data. Number two, breached businesses should be required to notify consumers, law enforcement, regulators, and relevant third 

parties when sensitive personal information is compromised. Number three, breached entities need to ensure that consumers are protected after their data is compromised through credit file monitoring and other such actions. And, number four, Federal preemption, we believe, is necessary to create a meaningful uniform national standard. 

Our legislation embodies each of these guiding principles, and we 

will be introducing our bill today. Additionally, I know you will not 

believe this but sometimes when Congress sees a problem they 

overreact, and I hope that—what are you laughing about? 

[Laughter.] 

I hope that is not the case here, because we do need to address 

and correct this problem but at the same time not overreact. We 

have one of the best credit systems in the whole world right here 

in this country, and it is a benefit to consumers that they can get 

a quick answer to a credit check. What we do not need, though, is 

to go too far and hurt the industry which has set up this wonderful 

credit system. 

As Congress considers data security legislation, we need to again 

correct this problem without overreacting. As this process moves 

forward, I look forward to continuing to work with Members on 

both sides of the aisle to pass the best bill we possibly can. This 

should not be about Republicans and Democrats, it should not be 

partisan at all. We need to address this in a bipartisan fashion, 

and I am confident we can do that here. I am very proud of our 

committee, because we have worked well together in other areas in 

the past, and I believe we can do that here. 

Thank you again, Chairwoman Kelly. I look forward to hearing 

from our witnesses. 

Chairwoman KELLY. Thank you very much. 

Mr. McHenry? 

Mr. MCHENRY. Thank you, Madam Chairwoman. Thank you so 

much for having this hearing today, and I appreciate your leadership on this issue. 

7

I will make this brief because I know we have a lot of testimony 

to hear. The last time I saw this many witnesses lined up at a 

table before a hearing we had baseball players in. So, Mr. Sosa, 

Mr. McGwire, thank you all for being here today. 

But in all seriousness, data security should be a top concern of 

all financial institutions and all financial service industry related 

folks. And what I would like to examine is what is being done now. 

I would also like to examine whether or not there are market forces 

that would influence how you protect data. 

I do not think that the government should step in when the market can actually dictate, and I think there are repercussions for 

companies that do not protect data. I think there are repercussions 

financially on their bottom line for companies that do not do what 

is appropriate and right and do not secure data appropriately. Customers will leave, merchants will refuse to deal with you, and the 

market will deal with it. 

Now, does the government need to intervene if the marketplace 

is going to deal with companies on these issues? That is what we 

need to understand as a committee, and we need to see where we 

need to go. If there is a marketplace that is going to determine 

data security, government intervention may hurt in this regard and 

actually may have an adverse effect on data security rather than 

the true spirit of what we would attempt to do as a government. 

So I welcome the testimony today. I look forward to hearing from 

all of you and look forward to hearing what has happened and actually what is occurring currently and what you view as the best 

way to secure data going forward. Thanks so much. 

Chairwoman KELLY. Thank you. 

Mr. Davis? 

Mr. DAVIS OF ALABAMA. Thank you, Madam Chairwoman, for 

calling this hearing, and I am going to try to follow Mr. McHenry’s 

lead and be somewhat brief, given the fact there are so many of 

you and a lot of us who are here to question you. Let me just make 

a few general observations. 

The first one, one of the happy things, I suppose, about this kind 

of climate is that the industry, frankly, has as much of an incentive 

to have this institution act in a responsible way as the consumer 

does. I think all of you who are here as industrial representatives 

and corporate representatives understand that your ability to provide a service to your consumers, your ability to attract consumers 

is in peril if they do not have confidence in how their information 

is being handled. That is the bottom line. 

So you have the same incentive, and I think that is why Mr. 

Moore and some of us can confidently say that this should not be 

a left-right kind of issue, it should not be a business-consumer kind 

of issue because you are in the same place in terms of wanting to 

promote consumer confidence. 

The second observation that I will make—this is something that 

I see routinely on this committee—is that the world of financial 

service transactions now, the world of financial service in general 

is so numbingly complex that a lot of people that you serve every 

day and that we serve every day frankly just want to throw up 

their hands and say, ‘‘We do not understand this.’’ 

8

And they feel so detached from their own ability to go out and 

make purchases and all of a sudden you have this information 

about security breaches and I am willing to bet that probably 

makes them feel even more detached. And then, worst-case scenario, they will learn weeks later that there may have been a 

breach that they did not even know about. 

I think we have to speak to that consumer anxiety. I think we 

have to speak to people who feel that somewhere out there things 

may be happening that are adverse to their interests that could involve a fraud or a theft and they did not even know for several 

weeks. We have to speak to that anxiety. 

The final point that I will make, Ms. Bean, Mr. Frank, and I are 

the lead sponsors on a bill that I think all of you are aware of. It 

is referred to by some in the press as the Democratic bill. I hope 

that this is the beginning of a conversation that can draw the best 

instincts from my side of the aisle and the best instincts of our 

partners on the other side of the aisle 

And this committee has done it before. We did it very recently 

in the context of GSE’s, an enormously complex issue. Most people 

did not think, given the acrimony of last year’s hearings, that we 

would get to a middle ground on GSE’s. We got there. I wish the 

U.S. Senate would respect the fact that we got there, but we got 

there. 

We got there on the question, because of my colleague from Alabama, Mr. Bachus’ leadership, on the extension of the Fair Credit 

Reporting Act several years ago. Nobody expected us to build a consensus that helps protect the best credit system in the world. 

So I drew inspiration from those things. 

Again, I thank the chairwoman for having this hearing and look 

forward to working with all of you. 

Chairwoman KELLY. Thank you. 

We turn now to Mr. Bachus. 

And I would like to say that for the ex officio members, because 

we have a lot of people here, many opening statements, I am going 

to ask the people who are ex officio, and we welcome them here, 

but I am going to ask them to keep their statements to 3 minutes 

each. 

Mr. Bachus? 

Mr. BACHUS. I appreciate that, Chairwoman. 

As with any legislation that comes before the subcommittee on 

which I am chairman, it obviously is something of great concern to 

me, and I commend you for having this hearing and for your leadership over the past several years, not only on this issue but identity theft and credit card fraud. 

Credit card fraud, identity theft, and data security breaches are 

really three different things, and we sometimes have a tendency to 

mix and match them. But as we go about this hearing, we should 

bear that in mind. 

And I appreciate the remarks of the gentleman from Alabama. 

The gentleman from Alabama has introduced a bill along with the 

ranking member, Ms. Bean, and Chairman Pryce and Chairman 

Castle and Mr. Moore have introduced this morning a bipartisan 

piece of legislation. And, further, we have had two other members, 

Mr. LaTourette and Ms. Hooley, who have introduced a third bill. 

9

Mr. Garrett questioned whether existing law is sufficient or do 

we need new laws? Can we just enforce those laws on the books? 

A great deal of this is going to be, yes, we just need to enforce what 

is there. 

Law enforcement has a role in this. This was a criminal violation; somebody hacked in. This was a criminal act not by the victim 

but by a criminal. But I will answer the question, yes, we do need 

to address this, and I think that the Members’ bills, as we go 

through this, we just need to do, as Mr. Price said, we need to show 

caution, and I associate myself with his remarks and Mr. Garrett’s 

remarks. 

With that, I do want to say two other things, if I could. One, 

CardSystems Solutions was a victim of a criminal act by a hacker, 

and they did report this to MasterCard. They voluntarily reported 

it, and they should be commended for that. That is my understanding. 

And, furthermore, I would like to note that we learned of the situation at CardSystems Solution through a public announcement by 

MasterCard International. This announcement was not required by 

the law; rather, MasterCard played the role of a good citizen, good 

corporate citizen in notifying the public of the situation, even 

though MasterCard itself was not the subject of the breach. And I 

commend MasterCard for their efforts. 

So in the aftermath of this hacking incident, I think the system 

worked well, and these companies responded in an appropriate 

way. But I do believe that really the solution to this is that we first 

in this Congress pass a law, and I know Chairman Castle and 

Chairman Pryce and others are working on it with Mr. Moore and 

others and Mr. Davis, on establishing a national uniform standard 

protecting all Americans. 

And with that, I yield back any time I have. 

Chairwoman KELLY. Thank you, Mr. Bachus. 

Mr. Cleaver has indicated he has no opening statement, so we 

will turn to Mr. Scott. 

Mr. SCOTT. Thank you very much, Chairwoman Kelly, and I 

want to thank you and Ranking Member Gutierrez for holding this 

very important hearing on credit card fraud and identity theft. 

I certainly also want to take this opportunity to welcome Mr. 

John Perry, who is president and CEO of CardSystems from Atlanta, Georgia, my hometown. 

Of course we all know that recent news continues to affirm the 

viewpoint by many consumers that their personal credit is constantly at risk for fraud or abuse. It is a major, major problem facing this country. Tens of millions of consumers have been exposed 

to credit fraud or theft, and these data attacks and frauds have hit 

major credit card issuers and banks, many of whom already have 

high standards for data protection. 

And in my hometown of Atlanta, some of the major events and 

incidents have occurred at ChoicePoint and at CardSystems. But it 

is important to note that ChoicePoint is recovering from its security 

breaches, and CardSystems has responded to this and they are 

working their way through the fallout, and I certainly commend 

you in the steps that you are taking and wish you speedy success. 

10

It is also important to note that the incidence of theft has gained 

national attention. From my own constituents, for example, we 

have had many discussions with privacy issues. Many of them are 

asking what they can do to protect themselves and what Congress 

can do to punish the credit thieves. 

Credit theft and identity fraud can be devastating to a family. 

Their credit can be ruined, it can take countless hours and resources to repair their good name, and I believe that Congress 

should provide additional protections that are substantive and not 

merely reactionary. 

I look forward to learning more in this hearing and hearing this 

distinguished panel. Thank you. 

Chairwoman KELLY. Thank you, Mr. Scott. 

Chairman Castle? 

Mr. CASTLE. Thank you, Chairwoman Kelly. Thank you for allowing me to speak in my 3 minutes, so I will jump right to it, and 

I will jump out of what I was going to say formally and just talk 

a little bit about our legislation that has been referenced by several 

people that Chairwoman Pryce and Dennis Moore and I introduced 

today. 

I believe very strongly that we do need a national solution, and 

we need it fairly rapidly. There is a lot happening in the States. 

Maybe there are certain State-relevant things that need to exist, 

but I think we need to speak to this sooner rather than later. I am 

delighted we are doing it on a bipartisan basis. Actually, we have 

bi-legislative basis right now. We have two bills out there, maybe 

others before we are done, but we are moving forward. 

I would like to have compliance. I am not particularly interested 

in enforcement, but obviously you need the enforcement behind it 

to get the compliance. But our hope is that once we share information and we have a clear standard, which is something else I want 

in our legislation, I want everybody to be able to clearly understand what it is that we are doing. 

I agree with Chairman Bachus, there is a lot out there now, 

there are a lot of enforcement mechanisms which are out there 

now, but we need to make sure that everybody understands what 

they are dealing with in this particular area. 

We need to expand this to entities not under financial regulation 

now, Gramm-Leach-Bliley and those who regulate under GrammLeach-Bliley, because a lot of the breaches that have happened 

have happened from entities away from that, and that is also significant. 

And I think there is an issue of consumer angst here. I was one 

who received a notice. I did not have much idea of what to do. 

Eventually, I figured it out. And my concern is who is going to really open that envelope, who is really going to know when you will 

be mailing it out, the whole business of not over-involving the consumer but making sure the consumer is absolutely protected when 

the consumer has to be. 

Those are at least some of our goals in drafting this. I hope that 

some day we have this legislation before us and we do it unanimously, quite frankly. I have no interest in having something that 

is divided in this committee with respect to where we are going. 

11

So we appreciate you being here today. We appreciate your contributions to this information. It is simple to say what I have just 

said, but it is a little hard to write it, as we have learned. So we 

know it is complicated, and we are going to need a lot of help to 

do it, but I think we have a very strong determination, and it is 

one of those issues that should move forward and it is one of those 

issues that really should not get hung up on politics but should be 

able to be resolved fairly rapidly. 

And with that, I yield back, Madam Chairwoman. 

Chairwoman KELLY. Thank you. 

Ms. Wasserman Schultz? 

Ms. WASSERMAN SCHULTZ. Thank you, Chairwoman Kelly and 

Ranking Member Gutierrez, for convening today’s important hearing. 

I particularly want to welcome Zyg Gorgol from American Express, which is one of the largest employers in my district, in South 

Florida. 

What I am hoping to hear from our guests’ testimony today will 

focus on lessons learned from recent events and how to best move 

forward to ensure that America’s consumers are protected. We have 

a steady drumbeat of high profile data security breaches in the last 

6 months, and that has given many Americans, I would say most 

Americans, cause for concern. 

My constituents are no different. Since I was first elected and 

came to Congress in January of this year, my office has received 

dozens of calls, letters and e-mails on this matter. In fact, it is 

probably the thing that has gotten the most attention and volume 

in my office. 

One woman in Hollywood, Florida, wrote to me and said, ‘‘I am 

outraged that private companies can hold information about me 

without any national standards for whether or how they protect 

that information.’’ 

From another one of my constituents in Fort Lauderdale, she 

said, ‘‘It is time for Congress to give Americans meaningful identity 

theft protection, insist on strong security standards for information 

brokers with real penalties if they fail to keep my personal information secure.’’ 

The apparent ubiquity of these cases has clearly caused a great 

deal of alarm and also caused some confusion. What I would like 

to hear from the credit card company representatives today is for 

you to help clarify the difference between identity theft and credit 

card fraud, because there is clearly a difference. Both are very serious matters, but the credit card companies have developed effective 

consumer fraud protections to combat fraud and I think it is important to make that distinction. 

Part of our challenge here is that many of the industry’s guidelines and best practices that have been developed to protect consumer information have not been adopted by third party vendors 

and retailers; in other words, those in the payment stream. And I 

have always believed in personal responsibility, and this standard 

certainly applies to vendor and third party processors. Any company touching consumer data must be responsible and accountable 

for the way in which that data is managed. 

12

Two of the largest security breaches announced this spring involved merchants that had maintained unnecessary credit card 

magnetic strip information, including card verification and replacement codes in violation of industry security rules. It has become 

quite clear to me that we need effective and consistent national 

standards for both how consumer data is managed and when consumers are notified about potential breaches. 

We also have to make sure that we do not set fire alarms off for 

no reason. If there has been data that has been compromised but 

it is not necessarily a danger to the consumer, telling them absolutely everything that they think they need to know is not necessarily wise. Existing regulations are simply not sufficient, 

though, and I encourage my colleagues on both sides of the aisle, 

as Chairman Castle has, to build upon the industry’s existing best 

practices and ensure that our consumers are protected. 

Thank you. I yield back the balance of my time. 

Chairwoman KELLY. Thank you. 

Chairwoman Pryce? 

Ms. PRYCE. Thank you, Madam Chairwoman. I appreciate the invitation to be here today. 

The effects of data breach can be staggering to the American 

public. It is a problem that has to be addressed sooner or later. I 

just want to thank you for your interest in it, for you holding this 

hearing and commend Mr. Castle and Mr. Moore and Ms. Hooley 

and Mr. LaTourette for working together on a bipartisan basis to 

address this, and I look forward to moving legislation, as Mike 

said, sooner rather than later, because it is a problem of national 

significance, and I think the consumer confidence issues will begin 

to affect the economy if we do not do something soon. 

So thank you so much for holding the hearing, Madam Chairwoman. 

Chairwoman KELLY. Thank you very much. 

Ms. Hooley? 

Ms. HOOLEY. Thank you again for holding this hearing and for 

allowing me the opportunity to speak. 

The topic of identity theft is one I have been working on for over 

8 years, and the wave of data security breaches over the last few 

months has been one of the most troubling developments I have 

witnessed in that time. 

Identity theft represents a fundamental threat to our e-commerce, to our overall economy and to our homeland security. No 

longer are we facing just ‘‘hobby hackers’’ looking to create a nuisance. Increasingly, these attacks are driven by skilled criminals. 

ID theft is huge business in this country. 

Today, with Congressman LaTourette, we have introduced legislation that requires universal and timely notification to consumers 

when their personal, sensitive financial information is put at risk, 

as well as one free year of credit monitoring service when a breach 

places consumers at risk of identity theft. 

I look forward to working with all of my colleagues on this committee and Ms. Pryce and Mr. Castle and Mr. Moore to pass the 

best possible legislation. 

I am particularly concerned about the breach that occurred with 

CardSystems this May. The behavior of CardSystems was in direct 

13

violation of agreements with MasterCard, Visa, and American Express. CardSystems placed 40 million consumers’ financial accounts 

at risk. Now, while I recognize only 200,000 accounts were actually 

compromised—that is still a lot—in this case, I am not certain that 

consumer notification is enough. 

Valuable financial information that was not rightfully owned or 

stored by CardSystems is what is at question here. I would like to 

applaud Visa and American Express for no longer doing business 

with CardSystems until they are sure that the problem has been 

resolved. And I am looking forward to seeing what CardSystems 

has done in the last few months. 

Again, I thank you, and I look forward to this hearing and testimony from the panel. Thank you. 

Chairwoman KELLY. Thank you. 

Mr. Renzi? 

Mr. RENZI. I thank the chairwoman for allowing me to be on the 

dais today and to participate. 

I am a member of the Intelligence Committee and every morning 

have a chance to look and see the threat against the United States. 

There is no cybersystem security system available in the commercial marketplace that cannot be hacked. There are few systems 

that the government has that have not been hacked to date, but 

they necessarily are not in the commercial world. I say that to you 

in order to make the point that there is no perfect system. 

I had a chance earlier this morning to meet with both the representatives from CardSystems and Visa. I am thankful that you 

both have expressed a good faith to meet privately and expeditiously within the next few days to see if you can work through the 

real facts, not those that just appeared in the paper that were just 

quoted, but work through some of the real facts and see if you can 

come up with solutions. I think that needs to happen. 

We have over 100 Arizonans who work for CardSystems, whose 

jobs will be immediately lost, but a death knell will be put to 

CardSystems. Now, that has a chilling effect on those in the industry who have come forward and worked with investigators to show 

the truth and say, ‘‘Hey, look, this is what happened,’’ rather than 

hide it. 

So while some may applaud Visa and MasterCard for their actions, think about unintended consequences that may also occur. 

So let me come back and say thank you to Visa and to 

CardSystems for giving me their word that they will meet in an expeditious manner, in a good faith manner to work through the facts 

that hopefully may work and lead to compromise. Either way, I am 

hopeful that there could be a solution that will be found that will 

protect both American consumers as well as those people who are 

an integral part of the credit card system here in America. 

I thank the gentlelady for yielding me the time. 

Chairwoman KELLY. Thank you. 

Mr. Matheson? 

Mr. MATHESON. Thank you, Madam Chairwoman. 

And thank you, Ranking Member Gutierrez. 

I am pleased the Oversight Subcommittee has scheduled this 

hearing regarding data security, and I am also pleased to be here 

14

this morning to welcome David Watson, who is chairman of 

Merrick Bank, based in my home State of Utah. 

I appreciate Mr. Watson taking the time and effort to travel to 

Washington to participate in this hearing regarding data security. 

I know that Merrick Bank and its employees have a good reputation with their clients and customers, and I appreciate their commitment to working with us on the credit card data issue. 

The issue of data security is incredibly important to all of our 

constituents. Many people are concerned about the potential for 

credit card fraud and identity theft. I look forward to hearing the 

testimony of Merrick and all the other witnesses on the panel so 

we can learn more from their experiences and understand whether 

there are more reasonable steps, and I want to emphasize reasonable steps, that we can take to increase data security so that we 

can prevent theft of data and identity. 

And with that, I will yield back my time to Madam Chairwoman. 

Chairwoman KELLY. Thank you very much. 

I am turning now to the panel. 

We have a very distinguished panel with us: Mr. Joshua Peirez, 

who is the senior vice president and associate general counsel of 

the Legal Department of MasterCard; Mr. Steve Ruwe, executive 

vice president, Operations and Risk Management, Visa; Mr. Zyg 

Gorgol, senior vice president, Fraud Risk Management, American 

Express; Mr. Carlos Minetti, executive vice president, Cardmember 

Services, Discover Card; Mr. David B. Watson, chairman of the 

Merrick Bank; Mr. Mallory Duncan, general counsel of the National Retail Federation; Mr. John M. Perry, president and chief 

executive officer, CardSystems Solutions, Incorporated—and I have 

to say, sir, I am delighted to have you here, and I admire your 

courage for being here—and Mr. Evan Hendricks, editor and publisher of Privacy Times. 

Mr. Peirez, we begin with you. 

STATEMENT OF JOSHUA PEIREZ, SENIOR VICE PRESIDENT 

AND ASSOCIATE GENERAL COUNSEL, LAW DEPARTMENT, 

MASTERCARD INTERNATIONAL 

Mr. PEIREZ. Good morning, Chairwoman Kelly, Ranking Member 

Gutierrez and members of the subcommittee. My name is Joshua 

Peirez, and I am a senior vice president and associate general 

counsel at MasterCard International, located in Purchase, New 

York. 

It is my pleasure to discuss the important topic of fighting fraud 

and safeguarding financial information, and I commend the subcommittee for holding this important hearing. 

MasterCard takes its obligation to safeguard financial information and protect consumers extremely seriously. This issue is a top 

priority at MasterCard where we have a team of experts devoted 

to working with law enforcement and maintaining the integrity 

and security of our payment systems. Our great success in protecting consumers and preventing fraud is due in part to the constant efforts we undertake to keep our networks secure. This is 

why our overall fraud rates are at an historic low, well below onetenth of 1 percent of our volume. 

15

MasterCard’s information security program is comprehensive and 

we continually update it to ensure that it provides strong protection. MasterCard requires each of our customers and merchants 

and any third party acting on their behalf to safeguard cardholder 

information. In addition, MasterCard has a variety of consumer 

protection and antifraud tools. 

Importantly, MasterCard has voluntarily implemented a zero liability rule. Under this rule, consumers will generally not be liable 

for any unauthorized use of their cards. In addition, MasterCard is 

focused on preventing unauthorized use in the first place through 

enhanced security features on the card, the MasterCard address 

verification service and our proprietary fraud reporting system 

which helps identify and prevent fraud from occurring in the first 

place. 

We also offer services to our issuers and assist them in 

proactively identifying and stopping fraud. 

I would now like to discuss the CardSystems situation. Several 

months ago, MasterCard and a few of our issuers noticed a small 

pattern of fraud. Working with our issuers, we traced the pattern 

of fraud to the acquirer, Merrick Bank, and then on to 

CardSystems, a third party processor the bank had hired. Once notified of the situation, CardSystems identified a script in its system 

designed to export cardholder data. 

CardSystems then engaged a data security firm to conduct forensic analysis of its networks. The forensic investigation found that, 

first, CardSystems was storing transaction information on its system in violation of our rules. This was remedied in short order. 

Second, the investigation confirmed the presence of a malicious 

computer script on CardSystems systems, along with other serious 

security vulnerabilities. And, third, there was evidence that some 

cardholder data had been compromised. 

Based on the findings, we believe approximately 68,000 different 

MasterCard accounts and well over 100,000 accounts of other 

brands were exported from the CardSystems database. The matter 

is under investigation by the FBI. 

Upon learning this information, we demanded that we be provided with the account numbers impacted as soon as possible, and 

we received the file on June 16th. We notified the banks that had 

issued the impacted accounts beginning the very next day and are 

continuing to monitor the potentially affected accounts with those 

banks. 

Given the circumstances of this case, MasterCard made the decision that a public disclosure of the event was warranted. Thus, on 

June 17th, we issued a press release to notify the public of the situation at CardSystems. 

I would like to stress that we provided broad public disclosure 

because it was the right thing to do, even though we had no legal 

obligation to do so. We continue to closely monitor CardSystems’ efforts to cure their deficiencies and have given them only until the 

end of August to do so. 

Let me now turn to a brief discussion of possible legislative 

measures to help address the issue. MasterCard strongly supports 

the legislative efforts to enact uniform national standards and believes it is critical that any legislative solution: one, strengthen 

16

criminal penalties to be in line with the severity of these crimes; 

two, provide notification to consumers in appropriate circumstances; and, three, establish strong data protection requirements for entities not already covered by the Gramm-Leach-Bliley 

Act. 

MasterCard looks forward to working with you as you tackle 

these important issues, and I would be pleased to answer any questions you may have. 

[The prepared statement of Mr. Peirez can be found on page 98 

of the appendix.] 

Chairwoman KELLY. Thank you very much. 

Mr. Ruwe? 

STATEMENT OF STEVE RUWE, EXECUTIVE VICE PRESIDENT, 

OPERATIONS AND RISK MANAGEMENT, VISA U.S.A. INC. 

Mr. RUWE. Chairwoman Kelly and members of the subcommittee, 

my name is Steve Ruwe. I am the executive vice president of Operations and Risk Management for Visa U.S.A., Incorporated. Visa 

appreciates the opportunity to appear at today’s hearing on the 

issue of information security. 

The Visa Payment System, of which Visa U.S.A. is a part, is a 

leading consumer payment system and plays a pivotal role in advancing new payment products and technologies, including initiatives for protecting cardholder information and preventing fraud. 

Cardholder security is never an afterthought at Visa. For Visa, 

it is about trust. Our goal is to protect consumers, merchants and 

our members from fraud by preventing fraud from occurring in the 

first place. 

This commitment to protecting consumers from fraud includes 

Visa’s zero liability policy, which protects Visa cardholders from 

any liability for fraudulent purposes. 

Because the financial institutions that are Visa members do not 

charge their cardholder customers for fraudulent transactions, 

those members absorb most of the cost from fraudulent transactions. 

Visa has implemented a comprehensive and aggressive security 

program known as the Cardholder Information Security Program, 

CISP, which applies to all entities that store, process, transmit, or 

hold Visa cardholder data. Visa also provides sophisticated neural 

networks that flag unusual spending patterns for fraud that enable 

our members to block authorization transactions where fraud is 

suspected. 

Only yesterday, Visa announced a new nationwide data security 

education campaign that will involve both the payments industry 

and merchants in the fight to protect cardholder information. Visa 

believes that all parties who participate in the payment system 

share responsibility to protect cardholder data. 

When cardholder information is compromised, Visa notifies the 

issuing financial institution and puts the affected card numbers on 

a special monitoring status. Visa also uses an array of other security measures that are described in my written statement to prevent particular fraudulent transactions. As a result of these strong 

security measures, fraud within the Visa system is at an all-time 

low of 5 cents for every $100 worth of transactions. 

17

Visa was recently informed by payment processor, CardSystems 

Solutions, Incorporated, CSSI, about an unauthorized intrusion 

into CSSI’s computer system. Visa immediately worked with the 

processor, law enforcement, and affected member institutions to 

prevent card-related fraud and respected law enforcement protocol 

to keep the information about the investigation confidential. 

Visa notified all of the potentially affected card issuing institutions and provided them with the necessary information so that 

they could monitor the accounts and, if necessary, advise customers 

to check their statements or cancel or reissue cards to their customers. The card-issuing institutions that are members of the Visa 

system have the direct responsibility and relationship with their 

customers, and because of Visa’s zero liability policy for cardholders, bear most of the financial loss if fraud occurs. Visa institutions can best determine the appropriate action for each customer 

that might have been affected. 

We have determined that about 22 million Visa card numbers 

from the CSSI database were put at risk. In many of these cases, 

CSSI, by its own admission, knowingly and improperly retained 

magnetic stripe information, which was a clear violation of the 

cardholder information security program. 

Because of CSSI’s failure to follow Visa’s security requirements, 

Visa is terminating CSSI’s ability to act as a processor for Visa 

members. Protecting our cardholders was, and remains, Visa’s primary goal in responding to this incident. 

Significantly, the information retained by CSSI did not include 

the cardholders’ date of birth, address, Social Security number, or 

driver’s license number. Visa believes that the information involved 

in this incident cannot be used to commit identity theft—identity 

fraud against an individual in which a criminal opens a new account in the individual’s name. 

Thank you for the opportunity to present this testimony today. 

I would be happy to answer any questions. 

[The prepared statement of Mr. Ruwe can be found on page 119 

of the appendix.] 

Chairwoman KELLY. Thank you very much. 

I wanted to step into a bit of housekeeping. The two boxes at the 

end of the table indicate green, yellow, and red lights. The green 

light means you have 5 minutes, the yellow means you have one 

minute to sum up, the red light means that it is time to end your 

testimony. 

I just simply wanted all of you, in case you have not testified before Congress before, to understand how that system works and if 

you wondered what those lights were doing. 

Mr. Gorgol? 

STATEMENT OF ZYG GORGOL, SENIOR VICE PRESIDENT, 

FRAUD RISK MANAGEMENT, AMERICAN EXPRESS 

Mr. GORGOL. Chairwoman Kelly, Ranking Member Gutierrez, 

members of the subcommittee, my name is Zyg Gorgol, and I am 

a senior vice president of Fraud Risk Management at American Express. 

My responsibility is to protect our customers by preventing fraud 

or identifying and minimizing it as quickly as possible. I appreciate 

18

the opportunity to testify today about the recent data security 

breach at CardSystems Solutions and its impact on American Express cardmembers. 

We view this breach with great concern and have taken steps to 

protect any cardmembers who may have been affected by it. 

I would like to highlight a few key points today, so the complete 

body of my comments have been submitted to the committee. 

First, I would like to discuss the Payment Card Industry Data 

Security Standards. They provide an industry-wide approach to 

safeguarding charge and credit card customer data. These PCI 

standards were developed by a cross-industry working group that 

included American Express and the other major card networks. 

American Express fully endorses these standards as an appropriate industry baseline for data security in the payments industry. 

Let me now specifically discuss CardSystems. As background, 

CardSystems Solutions processes less than 1 percent of American 

Express card transactions. Upon learning of the breach at 

CardSystems, we began an investigation to determine any impacts 

on American Express cardmembers. We also put additional security 

and fraud prevention measures in place for all American Express 

card accounts that were on their database. We are continuing to 

closely monitor these accounts for any suspicious activity on an ongoing basis. 

Based upon our current analysis, we have determined the following: 1.6 million American Express card accounts were stored on 

the database; information relating to approximately 12,000 American Express card accounts appears to have been acquired by unauthorized persons. Although the information relating to these 12,000 

accounts included the card account number and expiration data, it 

did not include any personally identifiable information, such as 

name, address or Social Security number. 

While we have been closely monitoring these accounts, we have 

not detected any increased incidences of fraud on these 12,000 accounts, nor have we detected any increased incidence of fraud 

across the total number of accounts that were on the CardSystems 

database. We are continuing to monitor all of these accounts for 

any suspicious activity every day, and we continue to investigate 

where the criminals accessed any other American Express card accounts. 

It is important to know that American Express employs sophisticated monitoring systems and controls to detect and prevent fraudulent activity. Historically, this has been an area of emphasis for 

American Express. Over the last several years, we have invested 

tens of millions of dollars to enhance our fraud prevention capability to better protect cardmembers. 

If fraudulent charges are placed on an American Express card 

account, we stand behind our cardmembers. American Express 

cardmembers are not held liable for fraudulent charges. 

Finally, we believe there are some tangible steps that can be 

taken to better protect consumers. Most importantly, we recommend that Congress extend Gramm-Leach-Bliley-like safeguard 

standards to those companies involved in processing card payments 

that are not currently subject to those safeguards today. 

19

Sensitive customer information should be consistently protected 

as it passes throughout the payment card transaction cycle. 

In conclusion, I want to assure the subcommittee that American 

Express is strongly committed to protecting the security of our 

cardmembers’ personal information. It is clear that recent events 

have raised the public’s concern regarding security of their personal information. We share this concern and are constantly working to protect the security of our cardmembers’ information so that 

when a customer makes a transaction they have a confidence that 

it will occur in a safe and secure manner. 

We appreciate the opportunity to share our views on this issue 

and look forward to working with you and members of the Financial Services Committee. 

This concludes my testimony. I would be happy to answer any 

questions you may have. 

[The prepared statement of Mr. Gorgol can be found on page 66 

of the appendix.] 

Chairwoman KELLY. Thank you very much. 

Mr. Minetti? 

STATEMENT OF CARLOS MINETTI, EXECUTIVE VICE 

PRESIDENT, CARDMEMBER SERVICES, DISCOVER CARD 

Mr. MINETTI. Madam Chairwoman and members of the subcommittee, thank you for inviting Discover Financial Services to 

share our views on the issue of data security breaches affecting 

credit card information. 

My name is Carlos Minetti, and I am responsible for operations 

and risk management at Discover. This includes oversight of Discover’s information security and antifraud efforts. Discover works 

very hard every day to prevent customer information from falling 

in the hands of individuals who would hope to use it for criminal 

purposes, like account fraud or identity theft. 

Discover Bank, the issuer of Discover cards, is a financial institution subject to Gramm-Leach-Bliley information security standards 

and the interagency guidance on security breach response programs. The FDIC examines Discover Bank for compliance with 

those standards, and our data security program is designed to perform with them. 

At Discover, we have a number of different fraud and identity 

theft prevention programs, which are described in my written 

statement. In fact, in 2005, ‘‘Identity Fraud Safety Scorecard for 

Credit Card Issuers,’’ conducted by Javelin Strategy and Research, 

ranked Discover as number one in overall card safety features. 

Today, I will focus on our response initiatives. Because we operate both a large merchant network and issue the Discover Card, we 

are often able to learn about computer hacking and other signs of 

data compromises when they first occur. In fact, Discover was the 

first network to uncover evidence of data compromises in many of 

the recently publicized security breaches involving large merchants 

and payment processors. 

Upon learning of a data security breach that may affect Discover 

Cardmembers, such as the CardSystems Solutions incident, we immediately commence an investigation. We first ascertain the type 

20

of information involved to determine whether the data could be 

used to commit identity theft or otherwise harm the consumers. 

We also identify the specific accounts that were affected, monitor 

those accounts, and take further action if necessary, such as contacting our customer or closing the accounts. 

Where the breach occurs at merchants or processors, we must 

rely on information from those companies. We work with them and 

with their party of forensic investigators to validate the breach and 

its impact on Discover Cardmembers. We also work with other card 

networks when their account data is affected. It is critically important for all these parties to cooperate fully in the investigative 

process. 

Discover carefully weighs all relevant facts and impacts on our 

customers to determine the proper course of action. If we determine 

that a breach is likely to harm our customers, we notify them in 

accordance with the Interagency Guidelines and the requirements 

of State laws. We also take further action as may be necessary to 

prevent harm, such as further monitoring or closing the accounts. 

We coordinate our efforts with the FDIC and with law enforcement 

personnel who may be investigating the incident. 

As the subcommittee is aware, not every data breach resulted in 

any theft of consumer exposure to substantial costs and time-consuming efforts to remedy misuse of personal information. As a result, it is often not necessary to immediately notify consumers, 

close accounts, provide credit report monitoring, or put fraud alerts 

in consumers files. 

Discover Cardmembers are not responsible for unauthorized 

charges, and our 24–7 customer service allows to quickly remove 

the fraudulent charges from their account. Industry resistance to 

across-the-board up-front notification, card reissuance, and other 

requirements is not based on the cost involved. 

Given the fact that potential fraud-related losses are incurred by 

credit card issuers and not by the consumers and can quickly 

eclipse the cost of notification and/or card reissuance, the customer 

notification/reissuance is generally not the driving factor for decisions about how best to react in a given situation. 

Our investigation of the CardSystems Solutions security breach 

is ongoing. This breach is very troubling and should never have occurred. Based on what we know today, it does not appear that Discover Cardmembers were exposed to a risk of identity theft, because the Discover data was limited to purchase transaction information. 

While the CardSystems breach did involve a loss of Discover data 

that could be used to commit account fraud, Discover Cardmembers 

will not experience financial loss as a result of this incident. 

As the committee considers the need for legislation, addressing 

information security and identity theft, we hope you will consider 

our recommendations. First, a single national standard for responding to security breaches affecting personal information is appropriate. Second, the Interagency Guidelines coupled with onsite 

compliance examinations establishes an effective and proper regime for information held by the national institutions. It also provides regulators with the flexibility they need to adjust breach response standards. 

21

Finally, when a data breach affecting credit card information occurs, notification is best handled by the card issuer, not the entity 

whose security was breached. An entity whose security was compromised must cooperate fully in investigating the incident and 

preventing further fraud, but it should not be charged with contacting credit card customers who may have been affected. A single 

notice is the best way to protect credit card users, and card users 

are in the best position to determine whether and when that notice 

is appropriate. 

We appreciate the opportunity to discuss information security 

issues, and we would be pleased to provide further information that 

would be useful to the subcommittee. 

[The prepared statement of Mr. Minetti can be found on page 85 

of the appendix.] 

Chairwoman KELLY. Thank you. 

Mr. Watson? 

STATEMENT OF DAVID WATSON, CHAIRMAN, MERRICK BANK 

Mr. WATSON. Madam Chairwoman, ranking member, and members of the subcommittee, thank you for inviting me to testify 

today. My name is David Watson. 

As a cardholder myself and as chairman of a card-issuing bank, 

I commend this committee for its diligence and its interest in formulating good public policy on credit and security—a topic of importance to virtually every American. 

Merrick Bank is a Utah financial institution, subject to regulation and annual examination by the FDIC and the Utah Department of Financial Institutions. We issue credit cards to 

accountholders, and we make payments of processed credit card 

transactions to merchants. 

Credit card and account holder security is a fundamental principle of our business; it has to be. 

First, a little bit about the credit card payment process and then 

Merrick’s relationship with CardSystems. 

To most consumers, the credit card system seems marvelously 

simple and dependable but behind the scenes multiple players and 

a sophisticated series of steps are triggered in each of the millions 

of daily credit card transactions. Each step must be performed with 

precision, for the integrity and security of the process is only strong 

when the performance of each party is strong. 

The merchant initiates the transaction, the processor authorizes 

the transaction and sends the notice for payment to the cardholder’s bank and then ensures that the merchant is paid. The paying bank is then reimbursed by the card issuer’s bank through the 

Visa and MasterCard settlement networks. All of this is conducted 

according to rules imposed by the individual card associations. 

Like many other banks, Merrick Bank makes payment to merchants who use CardSystems for processing. Before September 

2003, we did not have any significant business contacts with 

CardSystems, although they were a known entity in the card processing field. 

Following 2003 discussions concerning the transfer of certain 

Provident Bank merchant contracts to Merrick, we advised 

CardSystems that we could not consider participating in any procVerDate 0ct 09 2002 12:47 Sep 20, 2006 Jkt 029461 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 F:\DOCS\29461.TXT HFIN PsN: TERRIE
22

essing unless and until CardSystems became compliant with the 

Customer Identification Security Program, which you have heard is 

the CISP Program, and the Visa Data Security Accreditation Program. 

CardSystems then engaged Cable & Wireless, an auditor from 

the Visa group auditor list, to conduct the CISP assessment. Cable 

& Wireless was selected by CardSystems, paid by CardSystems, 

and the audit report that resulted was sent to Visa. In June 2004, 

Visa informed CardSystems that it was just approved, and 

CardSystems so notified Merrick Bank. 

We then successfully took over most of Provident Bank’s merchant payment contracts effective September 30, 2004. From that 

point to May 2005, Merrick’s payments for the transactions presented by CardSystems proceeded routinely. 

After initial inquiries from MasterCard regarding potential fraud 

activity, on May 22, 2005, CardSystems identified a security breach 

in its operation and on May 23rd, contacted the FBI. On May 25th, 

CardSystems contacted Merrick and advised us of a possible intrusion and export of cardholder data at CardSystems. 

Merrick reviewed this information and notified Visa and 

MasterCard of the potential security breach. On May 27, 2005, 

with the approval of MasterCard and Visa, Merrick engaged 

Ubizen, a well known forensic IT audit firm to thoroughly investigate the breach at CardSystems, and Ubizen began an onsite examination of CardSystems at its Tucson facility on May 31, 2005. 

We also sent our chief security officer and our senior network engineer to the CardSystems site to investigate the issue and see that 

immediate action was taken to prevent any further breach. 

The Ubizen audit identified two issues at CardSystems. First, 

CardSystems had retained certain transaction data on their system 

in violation of association procedures. Ubizen reports this data retention practice had been followed by CardSystems since 1998, 

even though it was inconsistent with CISP standards. 

This was not identified by the Cable & Wireless report in the 

2004 Visa certification process. 

Second, Ubizen identified certain issues with CardSystems servers and software, which were compromised by the intruding party. 

Again, unfortunately, the Cable & Wireless report did not make 

any mention of these vulnerabilities. 

Merrick Bank, Ubizen, CardSystems, Visa, and MasterCard have 

all been aggressively working together to see that the issues permitting the breach are corrected and that CardSystems’ data environment is fully secured. Visa and MasterCard have identified the 

cardholders whom they believe may have been compromised and 

have sent notice to the issuing banks of the potentially affected 

cardholders. This was accomplished by June 17th. 

Merrick is taking additional steps. We are preparing a contingency plan to assure our merchants are serviced without disruption 

in a secure environment. In addition, in consultation with security 

and data experts, Merrick is developing its own set of requirements 

to assure card processor compliance with all applicable card association standards. 

I want to conclude by reiterating our absolute commitment to 

data security. We are very closely monitoring for unusual activity 

23

the accounts of any affected cardholders. While we deeply regret 

any impact that this breach has had on consumers, we understand 

this presents all of us with an opportunity to help our industry improve our systems and processes and thereby better protect consumers’ interests. 

I want to again commend this committee for its hard work and 

good work to formulate sound public policy that will assist us in 

achieving this goal. Thank you. 

[The prepared statement of Mr. Watson can be found on page 

127 of the appendix.] 

Chairwoman KELLY. Thank you. 

Mr. Duncan? 

STATEMENT OF MALLORY DUNCAN, GENERAL COUNSEL, 

NATIONAL RETAIL FEDERATION 

Mr. DUNCAN. Thank you, Madam Chairwoman. I am Mallory 

Duncan, senior vice president and general counsel for the National 

Retail Federation. The NRF is the world’s largest retail association 

with membership that comprises all retail formats and channels of 

commerce. We appreciate the opportunity to testify here today. 

There has been a substantial increase in the reported incidence 

of identity theft. Federal Trade Commission data indicates that 

identity theft complaints increased 8-fold to nearly 250,000 between 2000 and 2004. Recently, an FTC survey estimated 10 million people experienced identity theft within the past year. Even 

larger numbers have been published elsewhere. 

The reported numbers are rising, but we do not know how much 

of that is a real increase as opposed to increased awareness of 

those reporting; versus mischaracterization of the problem. 

As striking as these figures are, it is important to recognize that 

the fraud that they reflect comprises a variety of activities, not all 

of which are true identity theft. 

I suggest we look at this issue broadly. We have to ask, how do 

businesses know who we are? Relatively few of us reside in communities with bankers and shopkeepers who have known us since 

birth. Instead, proof of our identity has shifted from being something others vouch for to something that is inferred: from identifiers such as driver’s license and Social Security numbers, and 

quick recall of personally related facts, such as date of birth, mother’s maiden name, and office telephone numbers. 

True identity theft occurs when someone appropriates identifying 

data for the purpose of secretly committing fraud. The thief may 

attempt to open credit and checking accounts, purchase a car, even 

buy a condominium using the victim’s excellent credit history. So 

long as the thief makes payments, it might be years before anyone 

discovers the fraud. On the other hand, the thieves may decide to 

stiff the creditors, potentially ruining the victim’s credit report. In 

that case, it could takes months or years for victims to recover 

their good name. Worse, if not apprehended, there is the possibility 

the thieves will strike again. 

In contrast, much of what is commonly referred to as identity 

theft is in fact credit card fraud. While it can be a problem for 

those affected, credit card fraud is much closer to a serious nuisance than it is the horror of identity theft. Equally important, 

24

Congress long ago approved many of the tools needed for its correction. Under the Fair Credit Billing Act, the consumer may challenge charges and be held harmless for the loss. Either the retailer 

or the card issuer bears the cost of the loss. 

With this distinction in mind, it is clear that the incidence of 

identity theft is, fortunately, considerably different than some of 

the numbers that have been cited. Even if one accepts the 10 million estimate by the FTC, it turns out that two-thirds of that is not 

truly identity theft. 

Now, I go into this distinction because the remedies for these two 

frauds are quite different. Credit card fraud is usually is an on-off 

event. Once discovered, credit card fraud is relatively simple to 

stop by closing the account and reopening a new account number—

a pain, but it can be stopped. 

On the other hand, when identity theft occurs, it is not a simple 

matter to change an individual’s Social Security number, date of 

birth, or mother’s maiden name. If society has limited resources 

that it can devote to fighting crime, then we ought to tilt toward 

using those resources to help consumers faced with the more serious consequences. 

Indeed, this committee recently established many new protections for identity theft victims with the FACT Act. Now, although 

identity theft grabbed the headlines, retailers have devoted considerable attention to reducing the incidence of credit card fraud as 

well. 

Several retailers issue their own cards. They want to protect the 

integrity of their cards and essentially treat all cards with the 

same level of security. Currently, merchants are coming online 

with the Visa and MasterCard new security program. Initially developed for your Internet transactions, the card associations are extending these to all channels of commerce. 

The FTC recently entered into a proposed settlement with BJ’s 

Wholesale Club as a result of system attacks in 2003. Retailers are 

paying particularly close attention to the requirements of that settlement. And when there are losses, they are typically borne by the 

retailers, yet another incentive for us to want to reduce the incidence of both types of fraud. 

In closing, identity theft is a fairly focused but especially pernicious form of fraud. Proof of identity has become a more elusive 

quality at the very moment that our society is investing greater 

amounts of trust in its veracity. 

Viewed from a distance, our credit system is marvelous. Families 

receive a meal in exchange for a swipe of plastic. Individuals secure 

home financing from bankers they have never met. These benefits 

flow not from credit cards but from the trust our society invests in 

the identities of persons seeking credit. If we are to preserve these 

benefits, society must crack down on those who would abuse that 

trust by appropriating the core elements of identity. 

With the passage of the FACT Act, Congress has begun to provide tools to those who have been victimized. It should now provide 

incentives to ferret out and prosecute those who make use of those 

tools necessary. 

Thank you for the opportunity to appear today. I will take your 

questions. 

25

[The prepared statement of Mr. Duncan can be found on page 54 

of the appendix. ] 

Chairwoman KELLY. Thank you. 

Mr. Perry? 

STATEMENT OF JOHN M. PERRY, PRESIDENT AND CHIEF 

EXECUTIVE OFFICER, CARDSYSTEMS SOLUTIONS, INC. 

Mr. PERRY. Good morning, Madam Chairwoman and members of 

the subcommittee. Thank you for inviting CardSystems to appear 

before you today. We appreciate the opportunity to address the 

issue of data security and more specifically the recent security attacks perpetrated against us. 

First and foremost, we truly regret this occurrence of data theft. 

We have readily acknowledged our error and continue to work nontop to ensure that we do not become a target of another breach. 

I had planned to provide you with some prepared remarks today 

discussing policy implications of the security incident hat occurred 

at our company, and I had an opportunity to discuss that important issue with some of your staff yesterday. But today, a small 

company with 115 employees, in Atlanta and Tucson, is facing imminent extinction. That concerns me greatly, not just because of 

how it will impact our company but because how it will impact 

110,000 merchants who rely on CardSystems to process their transactions. 

If CardSystems is forced to close its doors, many of these merchants will be unable to process credit card transactions for days 

or even weeks. Signing up with a new processor is not merely as 

simple as changing from one phone company to another. It can 

cause significant disruptions to a business’ operation. Moreover, I 

am concerned about the signal that our experience sends to other 

payment card processors and businesses, one of which undoubtedly 

faces a similar security incident in the future. 

We came forward in May to report this incident to law enforcement officials and our sponsor bank. As a result of coming forward 

with this important information, CardSystems is being driven out 

of business. Our experience should send a troubling message to policy makers. Other companies will have less incentive to come forward in the future when similar breaches will undoubtedly occur, 

knowing the potentially catastrophic effect that they could have on 

their businesses as well. 

We are still learning from the ongoing investigation but we do 

know this: That the attack on our system was very sophisticated. 

Based on the forensic investigation, we know of only one confirmed 

instance of which data was exported and that is the May 22nd incident that has brought us here today. I am relieved to report that 

this breach, to our knowledge, has not resulted in identity theft. By 

design, information is fragmented among different players in the 

payment card industry. This means processors like CardSystems do 

not have access to complete information, such as Social Security 

numbers, which could greatly facilitate identity theft. 

Additionally, this breach has not, to our knowledge, resulted in 

credit card fraud. Make no mistake, exposure of information about 

one card is too many. We will not be satisfied until we are conVerDate 0ct 09 2002 12:47 Sep 20, 2006 Jkt 029461 PO 00000 Frm 00031 Fmt 6633 Sfmt 6633 F:\DOCS\29461.TXT HFIN PsN: TERRIE
26

fident that everything that can be done has been done to prevent 

this from ever happening again. 

Turning to the issue of security compliance, all businesses that 

handle cardholder data are directed by the payment card networks 

to follow rigorous security standards. CardSystems was audited 

and certified in the late fall of 2003 by a qualified Visa security assessor. More recently, Via and MasterCard have developed the payment card industry, or PCI, data security standard, which has been 

adopted by all the card networks. We have hired an independent 

security auditor who has reviewed our systems and has affirmed 

that we will be PCI compliant by the end of the month. 

We are also pleased to hear today that Visa has agreed this 

morning to meet and discuss and, I am confident, to resolve our differences. As MasterCard has just noted, I am sure that we will 

complete the necessary work to satisfy all requirements for continuing our work as processors by August 31st. 

We appreciate the opportunity to participate in this hearing, and 

we welcome the chance to address any questions from the subcommittee. Thank you. 

[The prepared statement of Mr. Perry can be found on page 105 

of the appendix.] 

Chairwoman KELLY. Thank you. 

Mr. Hendricks? 

STATEMENT OF EVAN HENDRICKS, EDITOR AND PUBLISHER, 

PRIVACY TIMES 

Mr. HENDRICKS. Thank you, Chairwoman Kelly, Ranking Member Gutierrez. 

This is my first time back since the 2003 FACT debates. That 

year inspired me to write my book, ‘‘Credit Scores and Credit Reports,’’ which spends a lot of time trying to explain to consumers 

what to do in situations like this. It also has a chapter dedicated 

to Congress’ and this committee’s work, which was an exciting and 

productive year, I think, for all of us. 

I think it is also worth pointing out that this committee, your 

subcommittee, was the first one to hold a hearing on a data breach 

involving a credit card processor, I think it was April 2003. So you 

continue to be out in front of this issue, and look at the response 

you get by shining the spotlight. I think it is very commendable. 

I think there are several lessons from this event. One is that 

some companies will not have adequate security unless they are 

forced to. They will continue to treat security as an afterthought. 

I think you used to say that privacy is good for consumers and good 

for business. I think we have elevated to the point now where privacy and security is not only good, it is essential, and that you see 

by blowing it on privacy and security, that there are serious economic repercussions. 

Here a company is faced with an enforcement action that could 

close them down or seriously reduce them in size. It would have 

been good to have considered not to keep personal information that 

you were not supposed to keep in the first place and if you were, 

to encrypt it so it would be rendered useless with robust 

encryption. I hope other companies will learn the lesson that in ignoring privacy and security, you do so at your own risk. 

27

I think the other thing that we have to remember is the consumer. These incidents impose real costs and hardships on consumers. I have already heard from a few who did not receive any 

notice of this event, went into the retailer and found out that their 

account had been flagged and were unable to make purchases. 

Some were accompanied by friends or by business associates. 

Other people, consumers, have called to try and find out, ‘‘Has 

my information been compromised?’’ Some credit card companies 

were fairly responsive. Others did not have a clue what to tell people, and so this again contributes to the anxiety. If we are going 

to have a system where notice is not going to be required for every 

little event, then it is incumbent upon organizations to have a 

mechanism in place to inform people who are trying to find out 

what is going on. 

The other lesson from this is some companies will not notify consumers unless they have to. Some companies will make the judgment that there is no real harm to people. And the problem with 

that is that if you get a credit card number in this sophisticated 

hack, the sophisticated hackers and identity thieves can use a credit card number as leverage to get a Social Security number through 

pretext and other means. We need to stop treating the lowest priority as the consumer because the consumer is the basis for this 

entire credit card system. 

If we look at the breaches that we have had this year, 

ChoicePoint, Bank of America, CitiFinancial, 3.9 million Social Security numbers about to go out the door and what do they do, they 

call UPS. They are not encrypted, and the information is lost by 

UPS. And now with CardSystems and potentially 40 million, the 

number of Americans that are potentially exposed to these security 

breaches equals the number of Americans that originally signed up 

for the ‘‘Do Not Call’’ list. So it is sort of an eerie mirror of the privacy issue. 

The other thing that shows the inadequacy is what is not known. 

I mean, there are more things that we do not know about what 

happened with this data, how it went out, who it went to, and, 

again, there is no transparency, there is no reporting to the public. 

The lack of encryption is very troubling. We want to encourage 

encryption, but we also want to keep in mind that encryption by 

itself is never going to solve the problem. It is a multifaceted problem and encryption has to be robust and meet certain standards. 

Just because you call it encrypted does not mean that it is adequately protected in this day and age. 

The biggest threat here, I think, is the one to our society, is the 

lack of confidence that is going to entail from all of these events. 

If you look at each event and then total them up, as a consumer 

you do not think there is anyone out there looking for your data 

and that lack of confidence could have enormous implications, just 

as it is having for the Cingular company. If there is falling confidence in our credit card system, the numbers on that could be 

really scary. 

And think what Congress did to build confidence in the credit 

card system. Congress, you like to beat up on yourselves, all the 

members like to joke about yourselves, but give yourselves credit. 

You passed the Fair Credit Billing Act a couple decades ago to 

28

make sure consumers were protected, to put confidence in the system so that people were not going to lose their finances if something went wrong with their credit card. That is the kind of protection we need in terms of people’s data. That is how this has migrated. 

Chairwoman KELLY. Mr. Hendricks, will you please sum up? 

Mr. HENDRICKS. Yes. In closing, I would say this is a very multifaceted problem. I urge the committee to be as comprehensive as 

possible in addressing it and to look at the key moment, the reason 

thieves steal identities is because the credit report continues to be 

disclosed when the thief applies for credit in your name. 

Thank you, and I am sorry to have gone over. 

[The prepared statement of Mr. Hendricks can be found on page 

78 of the appendix.] 

Chairwoman KELLY. Thank you very much. 

I would like to ask a question about a company that is not represented here. I would like to ask Visa, Cable & Wireless security 

was part of your approved auditor list and CardSystems picked 

Cable & Wireless from that list. 

I would like to know how Visa certified Cable & Wireless, and 

I would like to know since Cable & Wireless has been bought by 

an international company, now it is called the SAVVIS Company 

apparently, I would like to know if that SAVVIS Company has 

been tasked to do a better job than Cable & Wireless. 

What can you tell me, Mr. Ruwe? 

Mr. RUWE. Yes. Cable & Wireless is one of a number of vendors 

that are approved by Visa and/or MasterCard to perform assessments in this environment. As you said, the processor in this case 

selects from a list of those assessors and contracts with them to 

conduct the assessment and provide the assessment results to Visa 

or MasterCard or whoever it is going to. 

In the case of Cable & Wireless, they are now, as you mentioned, 

SAVVIS. Visa has asked SAVVIS to explain how there could be 

such a discrepancy in the report of compliance between what was 

reported to Visa in reality. We have temporarily suspended 

SAVVIS from being able to do any more security assessments, and 

we have asked them to revalidate the last ‘‘X’’ number of assessments they have conducted. 

So the investigation as to what happened in terms of the discrepancy that was very large of what was the case at CSSI versus what 

was in the report provided to Visa on behalf of CSSI is still under 

investigation. 

Chairwoman KELLY. Mr. Ruwe, and I would ask you too, Mr. 

Peirez, how do you set up the goals that you expect the auditing 

companies to meet? What standards are you applying before you 

put them on your list? 

Mr. Peirez? 

Mr. PEIREZ. Thank you, Madam Chairwoman. 

Well, obviously at this point in time, a lot of this information is 

new to us as well, in terms of what happened in this particular instance, as we were not privy to this report. 

That being said, we obviously are looking at the measures in 

order to have auditors who are effective, who know what they are 

doing, and who can give accurate reports. We look for auditors who 

29

follow standard auditing practices and look for them to issue reports that are within those guidelines. There are many standards 

out there for best practices of auditors, and that is what we look 

at. 

Chairwoman KELLY. So you use whatever the standards are that 

are in the industry but do not have separated standards of your 

own. 

Mr. Ruwe? 

Mr. RUWE. There are in the case of assessors that Visa uses, and 

I believe this is true now of MasterCard, perhaps it was not at that 

time, there is a set of documentation that the assessor is given as 

a minimum that could be provided to the committee if they would 

like to see it, a minimum of standards that define and delineate 

and categorize the things that they have to check within that environment. That is as a minimum. 

Beyond that, as a processor, assessor in this space, these companies have proven themselves to be viable and capable of doing this 

work, otherwise they would not be on the list. 

So there is an actual process that is defined that they have to 

go through as a minimum for the PCI Program, and then beyond 

that they have their own additional assessments that they conduct. 

Chairwoman KELLY. Mr. Gorgol, Mr. Minetti, I would like to 

have you please chime in on this. Tell me what your standards are. 

Mr. GORGOL. At American Express— 

Chairwoman KELLY. Mr. Gorgol, I am sorry— 

Mr. GORGOL. Sorry. 

Chairwoman KELLY. Thank you. 

Mr. GORGOL. At American Express, we have the data standards 

in our contract with companies like CardSystems, the processors, 

and there are consequences to not meeting those standards. And 

you can see recently that those consequences do have teeth. But we 

also rely on the industry, and we would expect processors to draw 

from the industry and bring in professional help to make sure that 

they are meeting that contractual obligation. 

Chairwoman KELLY. Mr. Minetti? 

Mr. MINETTI. Our requirements are also outlined in our contracts. In addition to that, when we select the vendors we conduct 

an RFP, a request for proposal. I am not familiar with the criteria 

in the RFP, but it was a competitive process and we selected the 

top vendors of that list. 

Chairwoman KELLY. Perhaps, Mr. Minetti, you could— 

Mr. MINETTI. I can provide it. 

Chairwoman KELLY. —advise the committee in writing. It is 

something of concern because if you all rely on auditors, then it is 

important that reliance is a correct one. 

Mr. MINETTI. And I will be happy to provide you with a written 

statement that outlines the criteria. 

Chairwoman KELLY. Fine. Thank you very much. My time is up. 

Mr. Gutierrez? 

Mr. GUTIERREZ. Thank you. 

Well, first, I want to commend Mr. Ruwe and Visa for being a 

leader in the industry and initiating heightened security which became the PCI standard for the industry, and I commend the other 

companies for working to make this an industry standard. I think 

30

it is a step in the right direction in terms of securing data of the 

public, which Mr. Hendricks so clearly elaborated we should be 

most focused on here at this hearing. 

And I think, Madam Chairwoman, I think your questions about 

the audits are excellent, and we should examine who performs 

these audits and what standards are used and what the best practices are for these audits that are used by Visa and MasterCard 

and all of the other credit issuing companies, because if you have 

a bad audit, they all have bad information and our checks and balances, I think, are all out of whack. 

So I think it is a great place. I am happy that you went in that 

direction, and I am going to be asking Visa to put in writing, if 

they would for me, just what happens at the audit, what flaws they 

saw in the audit and what actions they took with the auditor after 

they saw the vulnerabilities of the audit. 

I would like to say also that it seems to me that we have a very, 

very serious problem here, because trying to set aside the issues of 

the processor and the credit card issuing companies, I mean, as I 

read these prepared statements and I look back and they say that 

there were—and I would like to ask Mr. Perry about this—your 

testimony has indicated that the data relating 239 accounts was 

transferred out of your system. 

And this looks as though this number—239,000, thank you very 

much—this look as though this number can be tracked to only one 

day of transfer activity since the hacker software was on your system since September of 2004 through May of this year and was designed to download data every 4 days. That is in your testimony 

that he actually entered your system—he or she, they actually entered your system in September. 

So it just seems extremely unlikely that a hacker, a sophisticated 

hacker would enter your system in, say, September, October, November, December, January, February, March, April and finally in 

May decide to download this information. And Merrick Bank did an 

audit, a forensic audit and their auditor suspects and found information that your system was probably already vulnerable as early 

as April of 2004. 

Do you have any other information, I mean, is it your testimony 

that the only information that you have is of the 239,000 names 

downloaded that one day, that was the only security breach at 

CardSystems? 

Mr. PERRY. Mr. Gutierrez, regarding that question, the only export of data that has actually been confirmed where it is possible 

to actually describe the number of accounts that were exported 

from the system was the security incident that occurred on May 

the 22nd, Sunday afternoon, I believe, when I heard about it. 

Mr. GUTIERREZ. Well, it just seems rather unlikely and given the 

forensic information that Merrick Bank put together in saying that 

your system was probably already hacked into and that you were 

vulnerable much earlier than that, that a hacker would just wait 

that long to download information on one particular day, which 

only tells us that we need to be more secure, because even in your 

testimony and other people’s testimony, you were vulnerable for 

months if not for over a year before you found out that somebody 

actually downloaded some information. 

31

And, secondly, the information that you held, why did you hold 

information that clearly was established in the contract, at least 

with MasterCard, in the information I have received, with 

MasterCard and Visa that you were not supposed to have in your 

system? 

Mr. PERRY. Mr. Gutierrez, the data that was actually exported 

on that day that we notified the FBI and Merrick about was from 

a database that was used primarily for research purposes. 

Mr. GUTIERREZ. I guess my question is, why did you have the 

data in your system if your contract with MasterCard and Visa, I 

do not know about the other two companies, but at least with those 

two companies they said, ‘‘This is part of our contract. We do not 

want you to have this information.’’ 

Mr. PERRY. Mr. Gutierrez, we have stated that we were in error 

by keeping that data. That data was specifically designed to provide customer service to the merchants that might have had a 

transaction that did not properly execute, it did not properly process, and the individuals in that case that managed that database 

believed it enhanced customer service to provide the merchants 

with the information they would need to conduct their business. 

Chairwoman KELLY. Thank you. 

We turn to Mr. Garrett. 

Mr. GARRETT. Thank you. 

I appreciate Mr. Watson’s opening comments about the simplicity 

of the system and how the average consumer just deals with it in 

an easy manner. From a government point of view, I can go to a 

local government agency, whatever it is, try to transact some sort 

of action with the government, it may take me some hours or days 

or even weeks to get some sort of response from the government, 

but I can go across the country or across the world and just open 

my wallet and bring out my credit card and given it them and literally within seconds or a minute or 2 they know who I am and 

I can get into a hotel or, as you say, have dinner or something like 

that. 

So it is an amazing ability that we have developed or that you 

all have developed, and I guess the track record has been fairly 

good in the scheme of things, and unfortunately we come to this 

point in time when it occurs as it does here, but I think I want to 

commend that it has been able to move the economy as it has in 

the system that we have had so far. 

The concern we have is whether we need to be taking additional 

actions right now or, as I see from one of the charts that we have 

here, literally the litany of regulations that applies to the various 

players, whether it is the issuing banks, the merchants, the ISO’s, 

the card services, and it goes from the Federal banking laws, the 

FACT Act, the FTC safeguard rules, the bank regulators acts and 

so on. So we have a lot on the books already, and I know some of 

you who are before us are involved in the regulatory side of the 

game. 

Let me turn first to Mr. Perry then on that regard. Someone else 

had made mention, I believe, earlier with regard to Gramm-LeachBliley and how that applies here or it does not apply here. Your 

understanding as to whether that applies to you or not? 

32

Mr. PERRY. Mr. Garrett, we are currently conformed to the regulations and rules of the card associations who set before us, including Visa and MasterCard, who set before us the rules on how we 

process timeframes, etc. 

Mr. GARRETT. Okay. If anyone else would like to address the 

question with regard to Gramm-Leach-Bliley, whether that should 

be applying to them now or in the future. 

Yes? 

Mr. HENDRICKS. My understanding is that Gramm-Leach-Bliley 

does not apply to the processors, and one of the reasons was that 

they do not keep the information. So when they keep the information, it really becomes problematic. 

Mr. GARRETT. Okay. Does anybody else have a comment on that? 

Mr. GORGOL. We would agree to have Gramm-Leach-Bliley apply 

to the processors as well. 

Mr. GARRETT. That it should. 

Mr. GORGOL. It should. 

Mr. GARRETT. Okay. 

And, Mr. Hendricks, as long as you are answering the question, 

in the situation that we have right now and the descriptions that 

you have here and I guess in your book as well, is there recourse 

for the consumer in some other avenue other than through the regulatory scheme from civil action or anything else on those matters 

to recourse? 

Mr. HENDRICKS. That is why I like Visa taking action here. The 

only enforcement action after all these breaches has been Visa in 

this case. There have been several class action lawsuits filed after 

various breaches, and those are going to drag on forever, and the 

companies, the defendants are going to say, ‘‘The law does not 

apply to us,’’ and they are going to point out more holes in the law. 

So there is no simple solution for consumers. It is just an enormous burden on them to constantly be monitoring their credit reports and their credit card statements because the smart thieves 

are going to wait for the 30-, 60-, 90-day period or even over a year 

before they use the information, particularly if they get Social Security numbers. 

Mr. GARRETT. The other people that can be harmed to a degree, 

not as much as the consumer can be, but that is the issuing companies and the small, I guess they are called the acquiring banks, the 

small merchant banks are involved here, because they have to pay 

for the reissuance of the card. 

Can some of you discuss that as far as how they are reimbursed? 

I understand that sometimes it is in the contract, and sometimes 

I understand that it is difficult for the smaller players, the credit 

unions as well, that have to get in under the line here to deal with 

those contracts. Can some of you address that issue, how that is 

reimbursed and is made or is not made? 

Mr. PEIREZ. Thank you, Congressman. I would be happy to address that in so far as the MasterCard system is involved. 

First of all, we provide protection against issuers, large and 

small, both for the cost of monitoring their accounts as well as for 

the cost of reissuing accounts if that becomes necessary as a result 

of a data compromise scenario. 

33

There is no distinction between how those rules would apply to 

a small or large institution. Indeed, our experience is that smaller 

institutions tend to take us up on that more often. So that is how 

it works with MasterCard. 

Mr. GARRETT. Okay. 

Mr. RUWE. In the Visa world, if there is fraud perpetrated on an 

issuer, whether it is large or small, there is no distinction as well. 

They have a system of being able to apply for compensation for 

that through Visa. It is based on actual fraud occurring subsequent 

to the event. 

Mr. GARRETT. My time is up, but thank you. 

Chairwoman KELLY. The gentleman’s time is up. Please answer 

the question and then we have to go to another member. 

Mr. GARRETT. I do not know if any of the other gentleman from 

the other— 

Mr. GORGOL. It does not really apply to American Express. We 

are the only issuer and the only acquirer. 

Mr. GARRETT. Sure. 

Chairwoman KELLY. Thank you very much. 

Mr. Davis? 

Mr. DAVIS OF ALABAMA. Thank you, Madam Chairwoman. 

Let me follow Mr. Garrett’s lead and kind of ask you in the time 

that I have to react to some of the legislative issues that Congress 

will wrestle with in the next few months based on distinctions from 

these various bills. 

Let me ask you, obviously one of the differences in the bills 

around the table is the question of preemption, the question of 

whether or not State law will be set aside in favor of a Federal 

standard. Let me ask you, do any of you believe that general State 

tort laws or general State breach of contract laws that are not specific to data security should be preempted? Is there anybody on this 

panel who believes that a State breach of contract law that is already in place or a State tort law should be preempted by this bill? 

Does anyone have an affirmative answer to support that? 

Mr. RUWE. Yes, Congressman. I think Visa would support a national level approach. 

Mr. DAVIS OF ALABAMA. So you support a national approach 

which would take a State breach of contract law that is in place 

right now and say it cannot be applied even if it is not specific to 

data security. 

Mr. RUWE. That is correct. 

Mr. DAVIS OF ALABAMA. What about Mr. Peirez, would you support that kind of standard? Just give me a quick yes or no because 

of the time. 

Mr. PEIREZ. Congressman, I will have to follow up with you and 

look at specifically what you have in mind in terms of the laws in 

question. 

Mr. DAVIS OF ALABAMA. Well, I mean, the specific question was, 

preexisting State tort law, preexisting State breach of contract law, 

it is not specific to data security, you have no position. 

Mr. Gorgol, do you have a position? 

Mr. GORGOL. I am a little bit out of my league. I would have to 

get— 

Mr. DAVIS OF ALABAMA. Okay. 

34

Mr. Minetti? 

Mr. MINETTI. Same here. 

Mr. DAVIS OF ALABAMA. You are out of your league or you do not 

have a position? 

Mr. MINETTI. Both. 

Mr. DAVIS OF ALABAMA. All right. 

Mr. Watson? 

Mr. WATSON. As I understand what you are saying, it is not just 

a preemption of regulations but a preemption of remedies, and I 

guess one needs to go hand in hand with the other. 

Mr. DAVIS OF ALABAMA. So your position would be if they go 

hand in hand with the other, they should be preempted or not. 

Mr. WATSON. Yes. 

Mr. DAVIS OF ALABAMA. All right. 

Mr. Duncan? 

Mr. DUNCAN. I am not absolutely clear on the question. 

Mr. DAVIS OF ALABAMA. The question is, preexisting State breach 

of contract law, not a data security law, but a general breach of 

contract law that a litigant tries to enforce in State court today, 

should it be preempted by Congress? 

Mr. DUNCAN. Again, from a retailer perspective, I am not sure 

what the cause of action would be. 

Mr. DAVIS OF ALABAMA. It would be— 

Mr. DUNCAN. But if Congress is attempting to develop a national 

standard, then retailers would like to see preemption to the extent 

that data protection is covered. 

Mr. DAVIS OF ALABAMA. Mr. Hendricks, I am not quite sure I 

have heard an answer to my question yet. Would you like to briefly 

weigh in on it? 

Mr. HENDRICKS. Yes. It would be a really bad idea because contracts are between two parties, and I do not think we want the 

Federal law jumping in between that kind of relationship. 

Mr. DAVIS OF ALABAMA. And let me turn to another scenario. 

One of the issues or the differences is a question of when you disclose a breach, and the bill that Ms. Bean and I have would, if I 

can use the shorthand, probably create something of a presumption 

in favor of disclosure. Some of the other bills would frankly probably create a presumption in favor of nondisclosure. 

What if you had this scenario, and I will not, for the sake of 

time, ask you all to react to it, but what if you had this scenario: 

What if a company believed that its database was compromised but 

in no specific instance could it identify a specific breach for a particular consumer? Do any of you believe that a company in that instance should not be required to disclose under Federal law if we 

pass a standard? Anybody want to weigh in on that? 

Mr. DUNCAN. I guess I will start by saying I am not sure: if you 

think there may have been a breach, but you cannot show particular evidence of— 

Mr. DAVIS OF ALABAMA. No, no. Let’s say that you know there 

has been a compromise of your system but you cannot identify the 

instance of a specific consumer that there has been a breach. 

Should Congress mandate a company that believes its system has 

been compromised to go ahead and notify the public or should the 

35

company be able to say, ‘‘We know we have been compromised but 

we cannot tell them the specific instance.’’ 

Mr. DUNCAN. I think you run the risk in that situation, if you 

have notification, that unfortunately we run into with some of the 

Gramm-Leach-Bliley notices. People receive privacy notices by the 

boatload, and at some point they stop reading them. 

Mr. DAVIS OF ALABAMA. And, Mr. Hendricks, I am going to ask 

one last quick question and you can respond to the one you want 

to on this one. 

I am interested from hearing from Mr. Hendricks on how other 

professions handle this. I used to be a lawyer, well, still am a lawyer, just do not have to practice now. In my profession, confidentiality is at the bedrock of what we do. Doctors, confidentiality is 

at the bedrock of what they do; same for hospitals. 

What is the standard, Mr. Hendricks, as someone who is an expert on privacy, for a lawyer who believes that his or her files have 

been compromised? What are the ethical obligations of that lawyer 

for notifying the client, and what are the ethical obligations of a 

doctor or the medical world for notifying the patient if their security or their identity or their information, rather the confidentiality 

has been compromised? 

Mr. HENDRICKS. They basically would have to notify very specifically each client and then take whatever remedial actions were 

necessary depending on what kind of information was breaches. So 

it would be some heavy lifting, yes. 

Mr. DAVIS OF ALABAMA. So that is the current ethical standard. 

Chairwoman KELLY. The gentleman’s time is up. Thank you very 

much. 

Mr. McHenry? 

Mr. MCHENRY. Thank you, Madam Chairwoman. As votes are 

approaching, I will try to not use up my full amount of time. 

I want to start by saying thank you, first of all, to Visa and to 

MasterCard and to the others for actually disclosing that this occurred. That was not a motivation mandated by law but it was the 

right thing to do for your customers, and I certainly appreciate you 

all stepping forward and disclosing to your cardholders and to the 

public at large that this occurred. I know it was not easy but it was 

certainly the right thing to do. 

And that goes directly to my question for you all, and I will leave 

this for the panel. Is there a marketplace motivation, is there a 

market force for data security? We are talking about possibly passing legislation to force you guys to do certain things. My question 

is, is there a market force for data protection and data security? 

Now, one at a time. Okay. Slow down here. 

Chairwoman KELLY. And please remember that we have been 

called for a vote, and we need to have answers rapidly. 

Mr. PEIREZ. Yes. There is a marketplace for data security. 

Mr. MCHENRY. Great answer. 

Next? 

Mr. WATSON. Congressman, I can tell you there is no stronger 

marketplace call for data security than the potential undermining 

of the consumers’ confidence in this system. If the consumer does 

not believe in this system, then we do not have a system and we 

36

do not have a business. What could be a stronger market force than 

that? 

Mr. GORGOL. I would agree. Trust is the bedrock of our business. 

Mr. RUWE. We agree. 

Mr. PERRY. We agree as well. 

Mr. MINETTI. We concur as well. 

Mr. MCHENRY. The problem is it is kind of a negative market 

force that would hit in after the fact, which is why I think we need 

to get in front of the issue. Inside companies where they have officers who push for security, they still run up against, ‘‘Well, why do 

we really have to do this?’’ So that is where the public policy has 

a good role to play. 

Mr. Duncan, do you want to chime in? 

Mr. DUNCAN. To some extent, it depends on the kind of breach. 

I spoke with a retailer yesterday who, because they were seeing a 

fair amount of identity theft, had taken great efforts to reduce that 

number. Marketplace forces work because they eat those losses. 

Mr. MCHENRY. Well, that sounds very encouraging. If there is a 

marketplace for this to occur, then perhaps legislation is not the 

right route for us to take. If the marketplace is going to deal with 

this, let’s watch it, let’s monitor it, and let’s make sure that you 

all are doing your part to adhere to Gramm-Leach-Bliley, to adhere 

to the standards we currently have on the books. Let’s make sure 

that is the right thing to do. And I certainly appreciate in particular Visa and MasterCard stepping up to the plate, disclosing 

fully and doing what was right in a timely manner. That makes a 

big difference, and it makes a big difference for this committee. 

Chairwoman KELLY. Thank you, Mr. McHenry. 

We have been called to a vote at the Capitol. I am going to ask 

the committee to recess for approximately 15 minutes. We will go, 

we will vote, it is 2 votes, and we will be back here and reconvene 

in approximately 15 minutes. 

[Recess] 

Chairwoman KELLY. Let us continue. Thank you for your forbearance. 

We turn now to Mr. Price. 

Mr. PRICE. Thank you, Madam Chairwoman, and I appreciate 

you having a recess and allowing us to come back. 

You are welcome to take as long as you want answering my 

questions. 

I want to thank you all again for coming, and I want to commend 

you for the work that you do. I am constantly in awe of the literally 

billions of transactions that occur without any errors or without 

any violation at all. And so I want to commend you for the work 

that you do. 

And I understand, as I think Mr. Garrett said, it may have been 

Mr. Renzi, that there are bad guys out there and they are trying 

as hard as they can to break your systems, and I think it is important for us to appreciate that we are all on the same team, we are 

all interested in making certain that the consumer has the confidence in the system and that it works as easily, frankly, as it 

does now. 

Mr. Ruwe, I heard Congressman Renzi say that he had spoken 

with Visa and with CardSystems and that you all had agreed to 

37

get together and work. I heard Mr. Perry say that, but I did not 

hear you say that. Are you committed to working with 

CardSystems and trying to work out a solution that is hopefully 

more equitable to all involved? 

Mr. RUWE. I spoke with Congressman Renzi before the meeting 

and said I would talk to CSSI. That is what I said. I would meet 

with them. 

Mr. PRICE. And help me understand a little bit about—

MasterCard is comfortable apparently right now with allowing 

CardSystems to continue with the work that they are doing and 

understanding and I heard a commitment from CardSystems that 

they would have PCI standards in effect by the end of the month, 

I believe. How is it that you all reached a different conclusion 

about your relationship with CardSystems? 

Mr. RUWE. I think the crux of our problem is the discrepancies 

in the audit that we were provided on behalf of CSSI and reality, 

and there is a huge gap between that, and we feel that CSSI bears 

responsibility for the accuracy of an audit conducted on their premises. 

Mr. PRICE. But CSSI is not the auditor, are they? 

Mr. RUWE. They are not the auditor, but they are responsible for 

what is in the audit report. 

Mr. PRICE. Mr. Perry, were you aware—Mr. Gutierrez talked to 

you about the error being in error and holding that information. 

Were you aware that you were in error? Was CardSystems aware 

that they were in error? 

Mr. PERRY. Mr. Price, until the incident that took place in May, 

I was not aware. When I joined the company in April of 2004, I did 

look at the CISP report prepared by Cable & Wireless. It was an 

unqualified report, it was a very clean report, and to be quite—I 

took that report and reviewed it with management, and we were 

gratified to get the unqualified certification from Visa. 

Mr. PRICE. So you thought you were in complete compliance. 

Mr. PERRY. Yes, sir. 

Mr. PRICE. And to Visa, isn’t the culpability here potentially with 

the auditor and not with CardSystems? 

Mr. RUWE. In our system, the culpability is with the party who 

is being audited. Now, if there is a problem with the audit— 

Mr. PRICE. But they believe, however, that they are in compliance because the auditor has told them they are in compliance. 

Mr. RUWE. Then I think that if you look at the audit finding 

versus what turned out to be reality in the environment, the gap 

is quite large, and we do not understand how there could be a gap 

of that size between what was true in the environment and what 

was in the audited report. I do not know what went on between 

the auditor and CSSI, but it is a joint responsibility in our view. 

Mr. PRICE. But you are willing to work with CardSystems and 

see what that discrepancy was and see if you cannot work out a 

relationship. 

Mr. RUWE. We said we would take a meeting on that. We have 

asked for explanation on this gap previously and not received satisfactory answers. 

Mr. PRICE. Okay. 

38

Mr. Hendricks, I would like you to comment, please, on the sense 

that I believe is possible and that is a chilling effect in the industry 

if in fact the individual who stands up and says, ‘‘Look, I am in 

error here, and I am working as hard as I can to comply or correct 

the situation,’’ what about that chilling effect? 

Mr. HENDRICKS. Well, yes, we always want people to have full reporting, so we take the remedial measures and make sure it does 

not happen again. I do like to focus on the fact that there was a 

decision made by somebody to keep personally identifiable information that was not allowed by contract. And we have to find out why 

that happened, why that decision was made, because that is what 

created the problem, what is exposed here today. 

And I think Visa deserves a lot of credit, because if they know 

that there is a huge gap there and security is not being protected, 

they have to take enforcement action; otherwise, they become 

complicit in it and other processors will think, ‘‘Well, they do not 

take this seriously either.’’ 

Mr. PRICE. And I appreciate that. And nobody wants there to be 

these violations or breaches, understanding that no loss occurred as 

a result of this, is my understanding. 

Mr. HENDRICKS. I mean, in terms of loss, I do not think we really 

know how much the bad guys got and what they did with it. The 

whole point that they are in the system for over a year and we only 

have a record of the stuff going out the back door one month, I look 

forward to the results of the investigation. 

Mr. PRICE. Thanks. 

My time is up, Madam Chairwoman, but I look forward to being 

able to submit other questions. 

Chairwoman KELLY. And, certainly, you may. 

I would like to ask about the PCI standard. The PCI standard, 

according to page 6 of CardSystems’ testimony, is based on Visa’s 

CISP, and it was adopted by Visa, MasterCard, Discover, American 

Express, Diner’s, and JCB in December of 2004. 

In theory, the PCI standard did not work here, if you look at it. 

So are you still using the same standard or has the standard been 

changed? 

And let’s start with you, Mr. Peirez. 

Mr. PEIREZ. Thank you, Madam Chairwoman. 

I think I would say that the standard is relatively new in terms 

of being an industry standard and only having been implemented 

at the end of last year, the compliance date for everyone was June 

30th of this year. 

We, at MasterCard, have gone out with letters to the over 300 

third party processors of whom we are aware, making them crystal 

clear on those standards as well as requiring them to provide us 

with a certification within 60 days that they are not storing the 

type of sensitive data that led to this particular breach event. So 

we think the standards are still sound. We think they were not followed here. 

Mr. RUWE. I would like to, if I can, take an opportunity to clarify 

one thing. The PCI standard became effective in December of 2004, 

which was the result of the four large card companies getting together and agreeing on a set of rules. However, prior to that, the 

Visa standards were fully in play and people were fully responsible 

39

to be compliant with them. So in the timeframe that we are discussing here, prior to 2004, the CISP standards would have been 

in place and Visa players would have been responsible for being 

compliant with them. 

As far as whether or not they work, I think that the CISP standards do work if they are followed. And in this case, up to this point, 

it appears to us they were not followed. 

Chairwoman KELLY. Anyone else like to respond to that? 

Mr. Gorgol? 

Mr. GORGOL. I agree. I believe the standard is sound. I believe 

it is an enforcement issue here. 

Chairwoman KELLY. Mr. Minetti? 

Mr. MINETTI. I also believe the standard is sound. Again, it is 

just not following the standard that created the problem. 

Chairwoman KELLY. Okay. 

Mr. DUNCAN. Madam, may I— 

Chairwoman KELLY. Yes, by all means. 

Mr. DUNCAN. One of the things from the retail perspective, the 

standards are an excellent idea in terms of trying to work out a 

coordinated approach, but they are extremely complicated, and that 

may be part of the issue. Some retailers have mentioned difficulties 

with the complications as well. 

Chairwoman KELLY. Thank you. Thank you for that observation. 

That goes to a question I would like to ask of Mr. Gorgol. 

In your testimony, on page 2, your explanation of the PCI standard, I would like you to define those standards in light of what Mr. 

Duncan just said, in terms of their impact on small business customers. Do you impose the same security standards on small businesses for the privilege of using your card that you impose on large 

businesses? 

Mr. GORGOL. Yes, to answer your question directly. I think the 

standards to protect the data need to be the same for everyone 

throughout the transaction chain. I think it is incumbent upon us 

as an industry to make it easy as possible for the small mom and 

pop stores to be able to meet those standards. 

Chairwoman KELLY. Mr. Duncan, you said you think they are a 

bit complicated. I am concerned because, as I read Mr. Gorgol’s testimony outlining some of the expectation levels here, how a mom 

and pop store, just a small business retail store on a corner, can 

maintain the six elements of what Mr. Gorgol’s testimony—you 

probably have the testimony in front of you, I can go through them 

if you do not remember what they are—but I am concerned about 

its impact and the cost on small businesses. 

Mr. DUNCAN. Ideally, there should be risk-reward basis in the 

standard, and I think there has been some effort to achieve that; 

that is, that at the original CISP standards there were more requirements for larger merchants than there were for smaller merchants. And this makes a certain amount of sense because if there 

is a breach, it is likely there is going to be more data captured from 

a large merchant than a small merchant. 

That said, I have heard a number of merchants complain about 

complications in understanding the enforcement standards, but 

they are making their best effort to do so. 

40

Chairwoman KELLY. Well, I think we need to make sure that the 

cards must be secure, that the standards of the industry may not 

need to be all the same for every industry. It may be a little more 

difficult for someone in the situation I described, the business person in the situation I described, to, for instance, to keep a written 

notebook. 

Looking at the standard, they were to build and maintain a secure network. Obviously, that is possible. Protect cardholder data. 

That is possible. Maintain a vulnerability management program. I 

am not sure what that means. And I do not know how complicated 

that is. Does that mean you have to have a notebook, you have to 

have somebody outside coming in to audit? How expensive is this 

protection? 

You have to implement strong access and control measures. That 

is totally possible for somebody in a small retail business. Regularly monitor and test networks. That is possible. Maintain an information security policy. What does that say? 

Those are some problems I see for small businesses, Mr. Duncan. 

I would like you to answer them. 

Mr. DUNCAN. Well, for a number of small businesses, it can be 

a challenge. You think of a modest retailer that might have 6 or 

10 stores in their chain. Chances are they are buying their equipment, the point-of-sale equipment already in a single package, and 

they really have to rely upon the software and hardware provider 

to have it right. They probably do not have the facility to do an indepth study. 

So there have to be some allowances for this, and, as I said, it 

is a challenge. 

Chairwoman KELLY. It is a challenge, but I think it is important 

that we consider this, that the major credit card companies consider this. Having been a retail merchant, a small merchant, and 

accepting Visa, MasterCard, American Express in my business, I 

know that I would have been surprised if somebody walked in the 

door and said, ‘‘How are you protecting this information from someone from the credit card companies? Do you take it on faith, do you 

go and inspect?’’ What are the standards that you are asking small 

businesses to do to protect the information at that level? 

It is a concern, it is a cost to small businesses, and it is something I think that we need to think about in terms of protection, 

both for the customer and the retail merchant as well as the credit 

card issuer. 

That being said, I want to go to the concern that I think many 

small businesses—again, customers of Merrick Bank through the 

credit card systems will lose their access to credit cards. That could 

drive them out of business. Was the impact on small business customers considered when the decisions were made from Visa and 

MasterCard and so on? 

What are you doing, Visa, in particular, to help the small businesses stay in their card network? 

Mr. RUWE. When Visa selected October 31st as the termination 

date, as has been stated, we took into consideration how much time 

it would take for an acquirer to move from one processor to another, and that was felt to be a reasonable amount of time. 

41

I believe the statements that have been made regarding the 

small merchants’ inability to move or inability to retain new services or the situation where they would be out of touch or unable 

to operate or transmit or conduct Visa transactions have been overstated. We believe that they will be able to find new processor accommodations within that timeframe, and that is something we 

will work with our banks on, our acquirer banks. 

I have not heard this complaint from my acquirer banks. I have 

only heard it from CSSI. So if my banks tell me we need more 

time, then we will take that into consideration. We are not going 

to leave merchants hanging, but the statements that have been 

made so far regarding merchants and being cut off and being left 

in the cold have been overstated, in our view. 

Chairwoman KELLY. But have you done any outreach on that 

score to allay the fears of the merchants? 

Mr. RUWE. That would be done through the acquiring banks who 

have the direct relationships with the merchants. That is not done 

by Visa. 

Chairwoman KELLY. All right. I understand that. I mean, I appreciate your response. 

When a merchant says to me, ‘‘I am not going to accept American 

Express, I will accept Visa,’’ that is your brand. What has happened here with CardSystems affects your brand. And I understand your wanting to protect your brand, but I also want to make 

sure that we set standards in such a way that the industry can respond in a way that it is possible for them to. A law is no good unless it can be followed. 

So it is extremely important that outreach be made, I believe, 

from your brand to the small businesses to help them understand 

not to panic, because from what I understand you are letting the 

banks take care of that, but, sir, are you sure that the banks are 

actually in touch with their small businesses and helping them understand and get through and find access to what they need? 

Mr. RUWE. Madam Chairwoman, we have every intention of 

working with the acquiring banks and to support them any way we 

can in this space. My response was more of a factual one than anything else. We do not have direct contact with merchants any more 

than we have direct contact with cardholders, but we certainly will 

support our acquirers in this transition. Whatever we need to do 

to support them or make sure that the merchants are comfortable 

and feel knowledgeable about what is going on, we will support 

them in that regard, yes. 

Chairwoman KELLY. I would be interested in Am Ex and Discover’s response to that, as well as MasterCard. 

Mr. GORGOL. Well, American Express will be offering our merchants a different choice for processing. They will have a number 

of different options. We will work with them directly over the next 

couple of months, including the option to come directly to American 

Express and avoid using a processor all together. 

Mr. MINETTI. From our perspective, we have not finalized a decision. We wanted to be thoughtful and have all the information before we reach a conclusion. We have been working with CSSI all 

along, and we have a meeting scheduled to talk to them next week. 

Chairwoman KELLY. Thank you, Mr. Minetti. 

42

Mr. Peirez? 

Mr. PEIREZ. Madam Chairwoman, similar to Discover, we have 

not shut off CSSI at this point. We expect them to be in full compliance by the end of the August, as they have told us they can be. 

If it becomes necessary for something to happen that would put 

their ability to process MasterCard transactions at risk, we would 

certainly make sure that the small merchants would not be impacted in any way. We would do the outreach necessary to get to 

that point, but we are not there at this time. 

Chairwoman KELLY. Thank you. 

Yes, Mr. Perry? 

Mr. PERRY. Madam Chairwoman, may I just add that I have 

been in this industry for a long time with quite a few different payment processors, and we have 110,000 small businesses around the 

United States that are typically not 6-location merchants but onelocation merchants, one-location restaurants, and some of those 

restaurants take up to 80 percent of their sales, or credit card 

sales, if not 100 percent. 

It is my belief that it will not be possible to move a portfolio or 

part of a portfolio of 110,000 mom and pop merchants over the 

course of 3 months in an orderly fashion. Changing your credit card 

processing is not similar to changing your cell phone service, and 

some of us that have done that also understand how difficult that 

can be. 

There are a variety of different issues involved, including underwriting, technology, changing bank accounts, scheduling, as we all 

know is very difficult with a small business because at the end of 

the day they are very focused on moving product out the door, not 

necessarily the payment type that they take. And this will be a 

huge inconvenience to the small business, and we are very, very 

concerned how we continue to take care of these small businesses. 

Chairwoman KELLY. Thank you. 

Mr. Cleaver, thank you for returning. 

Mr. CLEAVER. Thank you, Madam Chairwoman. I have 6,000 

questions. I will reduce it to five. 

One of the personal issues I have shared, and maybe Mr. Hendricks can respond, about 4 weeks ago the host of one of the ‘‘hate’’ 

radio shows in my hometown went on the air and said that he had 

my Social Security number, and he said on the air, ‘‘And I plan to 

use it to find out everything about him.’’ I called the FBI. They 

said, ‘‘Well, we do not get involved in this.’’ I called the Federal 

Communications Commission and they said, ‘‘Well, we do not get 

involved in this.’’ I ended up calling four or five different Federal 

agencies, and finally I called the U.S. Marshals Office and they 

began to monitor the radio show. 

It seems to me that there ought to be something wrong with 

somebody essentially promoting identity theft. And it was done on 

radio, the record is there, the tape is there, the whole 9 yards, but 

there is apparently no law against that. I did not think it was a 

good idea that people could promote the commission of a crime, but 

apparently you can do it with impunity on the public airwaves. 

Is there anything or any way that you think that kind of thing 

can be corrected? 

43

Mr. HENDRICKS. Well, first of all, I am really sorry to hear that. 

That is absolutely horrible, and I cannot imagine someone can do 

that without being ashamed of themselves, but obviously— 

Mr. CLEAVER. No, he is not ashamed. 

Mr. HENDRICKS. Yes. Obviously, he did. We in the privacy and 

consumer community would like to see a rollback of the Social Security number. It is required for many things in our society, but 

we need to start getting them out of courthouses, we need to stop 

using them as insurance company identification numbers if they 

are doing insurance. And there is legislation pending to have better 

protections for Social Security numbers so that he could not get it 

in the first place. That is the first thing. 

Obviously, using a Social Security number to harass someone, 

yes, maybe that is not covered by statute now but that is something that we should consider looking at. 

And in terms of the other problem, where does the consumer go 

for help, and I have to point out that in every other Western country except the United States there is a national office in charge of 

privacy issues, where people can go to get answers to these sort of 

questions, and sometimes you can get an investigation. It is called 

a privacy commissioner or data protection commissioner, and I 

think as big as this issue is getting, I think we should start revisiting that issue, because I think we need one here for situations 

like this. 

Mr. CLEAVER. Thank you. 

My other question—this will be the last, Madam Chairwoman—

I was the mayor in Kansas City and in an attempt to confuse the 

crooks, we encrypted our system, communications system, so that 

people who had the radio ban sitting around would not know what 

we were doing and when we were going to do it. Is encryption an 

option for us that could possibly either reduce or prevent identity 

theft, particularly with credit cards? 

Mr. DUNCAN. Congressman Gutierrez—excuse me, Cleaver— 

Mr. CLEAVER. He is shorter. 

[Laughter.] 

Mr. DUNCAN. What am I doing? Encryption can be a partial solution, but there are tradeoffs with encryption. There is highly detailed information on credit cards, but obviously we do not want to 

have stores retain informatin that one could use to make a clone 

card. But there is fairly basic information, the original numbers, 

the name, the expiration date, that if you encrypt it, you may save 

some problems, but you also may create more problems on the 

other side. Let me give you an example. 

Many consumers go into a retail store where they have bought 

something and they would like to return it but they do not have 

their receipt. If the checkout clerk who is taking the item back has 

to decrypt data in order to accomplish a return, it makes it much 

more difficult or maybe impossible in many situations. So there has 

to be a balancing as to how we achieve that. 

As to your first question, may I say that one of the points we 

wanted to focus on in our testimony is the need for more enforcement. Currently, if retailers find evidence of identity theft and take 

that to the State attorneys general offices, oftentimes they will not 

enforce unless they have $100,000 worth of damage. So we would 

44

like to see a situation where Congress would encourage State officials to take a more active role in going after those who are committing crimes. 

Mr. CLEAVER. Thank you. 

Chairwoman KELLY. Thank you, Mr. Cleaver. 

Mr. Price, you said you had another question. Feel free to ask. 

Mr. PRICE. I may? 

Chairwoman KELLY. Yes. 

Mr. PRICE. Thank you, Madam Chairwoman. I appreciate it. 

I think this is an incredibly important topic, and I think we can 

overreach in so many ways, but, again, I think it is imperative that 

we make certain that folks have confidence in the system. 

Mr. Gorgol, if you would not mind, please, commenting on the potential culpability of the auditor vis-a-vis CSSI review and ultimate 

problems that they had. 

Mr. GORGOL. We relied via our contract on CardSystems meeting 

their contractual obligations to meet the data standard. And they 

were the ones we worked with. We did not work directly with the 

auditor, so I cannot comment on it. 

Mr. PRICE. Mr. Duncan, there has been a discrepancy between 

responses on the effect on merchants with the cessation of the relationship between Visa and CardSystems. Would you comment on 

what you believe that consequence would be or the effect on merchants? 

Mr. DUNCAN. We are not privy to all the details involved in this 

dispute. Obviously, as in this whole issue, you do not want to overreact in a credit card fraud situation as opposed to, say, an identity 

theft situation. And this strikes me as one where the risks are perhaps lower than a true identity theft, and so maybe that same 

guidance should apply. 

Mr. PRICE. Mr. Ruwe, I have affinity for Mr. Perry and 

CardSystems, obviously. I also think, again, we are all on the same 

team in this in trying to make certain that violations of information do not occur. Do you believe that Visa’s relationship with 

CardSystems is fatally flawed? 

Mr. RUWE. Well, fatal is a very big word. 

Mr. PRICE. Yes. That is what is going to happen to them. 

Mr. RUWE. It is certainly stressed. I think that Visa spent a 

great deal of time trying to evaluate what position we were going 

to take on this, and I believe we made several attempts to get information that we needed and did not get it. And as we said earlier, we will sit down with CSSI, but I think we are going to have 

to have more information and more forthcomingness, if you will, 

than we have had to date before I would make any commitment 

on anything fatal or otherwise. 

Mr. PRICE. I appreciate that. If I am able to facilitate any of that, 

please let us help. 

Mr. Perry, I would like you to comment, if you would, on the discrepancy that Mr. Ruwe pointed out or stated existed between the 

audit and the reality of the information that you all held. 

Mr. PERRY. Yes, Mr. Price. We did receive some requests from 

Visa for information regarding the discrepancy between the CISP 

audit and what was subsequently found by the forensic analyst. 

Unfortunately, I was able to provide to Mr. Ruwe and Visa all of 

45

the data that I was able to find prior to my arrival at CardSystems 

in April of 2004. We stated to Mr. Ruwe and some of his associates 

at Visa that we were providing all of the information possible. 

We attempted to contact former employees, former auditors from 

Cable & Wireless and other former vendors to be able to fully answer Mr. Ruwe’s questions. Unfortunately, it was very difficult to 

track a lot of these people down who had left the company sometime in 2003, early 2004. And, unfortunately, because we were not 

able to provide all of that information, it was deemed that it was 

not enough information. 

Mr. PRICE. Help me with the audit. Was there an actual question 

on the audit that said, ‘‘Is CardSystems in full compliance with the 

agreement with Visa?’’ Is that the kind of question that is on there? 

Mr. PERRY. There are several questions that you would see in an 

audit that are fairly detailed as to very different aspects of the 

audit having to do with network security and, specifically, the error 

that we have owned up to, which is the storing of this data that 

should have been masked. And that is a specific block or question. 

That specific block had a checkmark by the auditor without qualification or any compensating controls in that area. 

When I specifically reviewed— 

Mr. PRICE. Checkmark saying? 

Mr. PERRY. We were compliant. When I reviewed that, I felt pretty good and relied upon the audit and the auditor that we were in 

compliance in that area. 

Mr. PRICE. May I ask one more general question, Madam Chairwoman? 

I am interested from all the card companies as to whether or not 

there is agreement or consensus in the industry about the definition of a data breach and fraud. Is there consensus among the companies about what that is? 

Mr. PEIREZ. Congressman, I think there is general consensus on 

what would constitute credit card fraud. In terms of your question 

about breach, it is a very complicated question, and I think we are 

in general agreement, but any specific case you would have to look 

at the specifics and see whether we all agree. 

Mr. PRICE. Mr. Ruwe? 

Mr. RUWE. I would concur with that. 

Mr. MINETTI. Yes, I would agree as well. 

Mr. PRICE. Is there a need to define those terms? Are they defined legally as it relates to data breach? 

Mr. PEIREZ. Congressman, I think that, first of all, the terms 

that most often get confused and really do need to be used carefully 

and accurately are the distinction between fraud and identity theft 

or identity fraud. Those are the two things that really need to be 

very, very clearly identified because the consequences of either of 

those events are quite different and can be handled in different 

ways effectively. 

In terms of definition of breach, I think that depends on what 

happens if there is a breach as so defined. So I would be happy to 

work with your office if you are looking at something specific, but 

as to the general question on breach, I really cannot answer. 

Mr. PRICE. Any other general comments about that? 

46

Mr. WATSON. I would say that the language is unclear, and it is 

unclear with respect to impact and timing. For instance, you could 

say the system was breached in April of 2004. Accounts were compromised possibly at some other time and certainly in May of 2005. 

But the definitions are not clear with respect to time or effect, and 

I think in putting forth any legislation they are going to need to 

be very clearly defined. 

Mr. DUNCAN. Congressman, there is one additional element, and 

this goes back to the question that the chairwoman mentioned, and 

that is for smaller retailers in particular, if they are buying off-theshelf equipment, they want to make certain that if they bought 

something from IBM or NCR or something else, that they are not 

deemed to be in breach because of something they innocently purchased. And that is a distinction that has to be maintained. 

Mr. HENDRICKS. The California State law does a pretty good job 

of defining a breach by saying it is personal information or account 

numbers/Social Security numbers that can be used to commit 

fraud. And as to the distinction, there is a distinction between 

identity theft takeover and credit card fraud, but under the Identity Theft Deterrence Act and under FACTA, Congress has defined 

some forms of credit card fraud as identity theft, as it should, because we need to maximize protection for consumers, and you see 

this reflected in FTC regulations. 

So I agree with industry that we need to look very carefully and 

draw these distinctions so we have appropriations responses to 

each one, but I want industry to respond that some forms of credit 

card fraud are also identity theft. 

Chairwoman KELLY. Thank you. 

Mr. PRICE. Thank you, Madam Chairwoman. 

Chairwoman KELLY. Thank you, Mr. Price. 

Mr. Cleaver, you said you had another question or two. 

Mr. CLEAVER. Admittedly, this is personal for me, but I am curious as to whether other Western countries, Mr. Hendricks, have 

strong laws with regard to identity theft. When I say strong laws, 

I mean when there is a data breach it could result in someone 

being just wiped out. 

So do you know of any other country where someone could do 

something and actually regret it? 

Mr. HENDRICKS. Do something in terms of using personal information? 

Mr. CLEAVER. Yes. 

Mr. HENDRICKS. Well, a lot of the European countries and others 

do not have the biggest problem with identity theft as we do because they do not rely on the Social Security number the same way 

that we do. So they do not have specific laws on identity theft. 

Mr. CLEAVER. What do they rely on? 

Mr. HENDRICKS. Well, they have their own usually national identification number or another set of identifiers. We need a countryby-country report. It is a very long question and answer. But they 

had old-fashioned comprehensive laws which are based on what we 

know as fair information principles, and that ends up covering a 

lot of these sorts of events. 

So they are constantly trying to upgrade them and oversee and 

implement them, but it becomes more of a compliance issue beVerDate 0ct 09 2002 12:47 Sep 20, 2006 Jkt 029461 PO 00000 Frm 00052 Fmt 6633 Sfmt 6633 F:\DOCS\29461.TXT HFIN PsN: TERRIE
47

cause they have a general framework which covers most personal 

information, creates rights for individuals, duties on organizations. 

Mr. CLEAVER. I do not know if you collect data that would provide information about how long it would take after a breach before 

the fraudulent act begins. And is there any data that would allow 

us information to know the time between the breach and the time 

of the commission of a fraud? 

Mr. HENDRICKS. There is no real research on that has been made 

public, but it ranges from immediate to long term. The methamphetamine users that hit mailboxes they try and use something 

right away, that is just their nature. The very sophisticated criminal rings will sit on information and use it down the road. 

Mr. CLEAVER. So my radio host is sitting on it. 

Mr. HENDRICKS. Yes, but I think maybe someone should sit on 

him. I think he deserves some more attention. 

Mr. CLEAVER. Thank you. 

Chairwoman KELLY. Thanks, Mr. Cleaver. 

Mr. Gorgol, you raised a very important issue in your testimony 

and we have not talked about it, and that concerns phishers with 

a ‘‘ph.’’ I think you mentioned that you were concerned that 

phishers might take advantage of the breach and other publicized 

incidents to look around to see what they can find from card customers. 

I would like this panel to describe whether or not you have seen 

a reaction like that in this case, and I would also like to know 

whether small businesses are likely to be contacted by fraudsters 

that are claiming to represent interested parties in this case? 

And with the terminations and so on that are imminent, apparently, I am wanting to know what you are doing to reach out to 

small businesses to keep them secure from phishers who are likely 

to call them and say, ‘‘We are checking on this information,’’ and 

so forth. They do not know who is at the other end of the phone. 

I want to know what you are doing to protect these people from a 

fraudulent inquiry and a fraudulent solicitation during the changeover period. 

Mr. GORGOL. Well, first, I mean, phishing is a serious problem 

and I think it is something to consider if we think about legislation 

that requires notification. If we overnotify people, that will provide, 

I think, a vehicle for phishers, sort of weeds that they could hide 

in if we overnotify. It is one of the dangers of overnotification. 

But I think the most powerful tool we have, to answer your question directly of what we can do and how we can help small businesses, is education and just raise their awareness that phishers 

are out there and just be very careful in how they share their information. 

Chairwoman KELLY. How do they know if someone calls and 

says, ‘‘I represent such and such, and I want this information’’? 

Mr. GORGOL. There are basic rules. They are not to share personal identifiable information over the phone unsolicited or you are 

not sure who you are sharing it with. 

Chairwoman KELLY. Well, if they are solicited, they are going to 

share it because they do not know the difference. My concern is 

that there be some sort of an interception there, direction, eduVerDate 0ct 09 2002 12:47 Sep 20, 2006 Jkt 029461 PO 00000 Frm 00053 Fmt 6633 Sfmt 6633 F:\DOCS\29461.TXT HFIN PsN: TERRIE
48

cation, however you do it, so that the small businesses during the 

changeover will not become a victim of phishing. 

Mr. GORGOL. Well, during this specific changeover, they would be 

working directly with American Express employees, so we will be 

able to contact them directly. 

Chairwoman KELLY. Anybody else? 

Mr. Ruwe? 

Mr. RUWE. I think that would add to the education, and part of 

the education is making sure they understand that if they get one 

of these calls, that they should say, ‘‘Thank you very much.’’ And 

they have been trained to say, ‘‘Give me a number where I can call 

you back, please,’’ and then they can verify with their true business 

relationship. That is one of the things that we have tried to reemphasize over and over again in our educational materials. 

But, typically, the phishers do not necessarily target small businesses. They may be affected by this, but they really go for the big 

broadcast over the Internet. That is why it is called phishing. They 

go out and really attack the masses is usually their MO. 

Chairwoman KELLY. In the 1970’s and 1980’s, a number of banks 

spun off the card processing units and now some of the banks are 

bringing them back in-house. There are pros and cons on this, and 

we have not heard from any of you about that. 

Mr. Watson, you may be the first one to answer that question. 

What are the pros and cons? 

Mr. WATSON. I actually have worked for data processors in the 

past prior to my career at Merrick Bank. I think data processing 

for both card holder and merchant business is very, very much a 

scale issue, and in-house processing is really only affordable by the 

very, very largest issuers and the very, very largest merchant 

banks. 

Without the access to high quality, secure third party processors, 

the credit card business, both the issuing side and the merchant 

banking side, would be in the hands of a very, very small number 

of banks because they would be the only ones who could afford it. 

Chairwoman KELLY. Okay. So you think that unless a large bank 

like Bank of America, Citi, Chase made the decision to bring it 

back in-house, no one else is likely to because it is expensive; is 

that correct? 

Mr. WATSON. Yes. 

Chairwoman KELLY. Okay. Thank you. 

My last and final question to you, Mr. Perry, there was a 3-day 

time lag between the time you discovered that there was a problem 

in the system and the notification that went out, you called the 

FBI, but it was not until the next day, it was basically a 3-day time 

lag. You found out on the 22nd and on the 25th Merrick Bank 

found out and the card people found out. What caused that time 

lag? 

Mr. PERRY. Madam Chairwoman, the time lag was we found out 

of a suspicious production issue on Sunday, late afternoon, Sunday, 

May the 22nd. On Monday, May the 23rd, we contacted the Phoenix office of the FBI and on actually Tuesday, May the 24th, we 

had not heard back from the Phoenix FBI and then contacted the 

Atlanta FBI because we were very concerned that this might be a 

situation that law enforcement needed to be aware of immediately. 

49

Once we heard back from the FBI on the 25th that they had assigned a case officer and we had disclosed everything to them, we 

also asked if it was okay under the investigation to contact the 

bank and notify the bank so they could go through their proper notification procedures, and they said, yes. Unfortunately, there were 

2 days of lag where we missed speaking to the FBI from Atlanta 

or Phoenix to receive proper instructions. 

Chairwoman KELLY. So the time lag, if I understand you correctly, was caused by the FBI not getting back to you in a timely 

manner. In the meantime, the 44 million people whose information 

had been perhaps compromised were still out there with their information compromised and nobody knew it. 

Mr. PERRY. At that time, all that we were aware of was the export of the 239,000 discrete cards that we found about later. I do 

not want to say that the FBI did not react, but we did contact the 

Phoenix office on Monday, and when we did not hear back from 

them on Tuesday we contacted the Atlanta office. At that point, 

both offices coordinated and once they got back to us, we also asked 

them if we could move to the next step of notification, which we 

saw as critical, which is contacting our sponsor bank, Merrick 

Bank. 

Chairwoman KELLY. I am just curious because under a contractual agreement with the credit card companies, wouldn’t that have 

been in the contract that you had to notify them immediately if you 

discovered any kind of a breach? 

Mr. PERRY. At that point, on May the 22nd and even on May the 

23rd, we were unclear as to the scope of the potential compromise. 

Chairwoman KELLY. But you knew you would been compromised. 

Mr. PERRY. We believed we had, yes. 

Chairwoman KELLY. But it was just a matter of degree. So if 

there was a contractual agreement for notification to the credit 

card people— 

Mr. PERRY. Because we believed there had been a crime perpetrated against the company and its merchants, we believed it 

was incumbent upon us to contact law enforcement first and make 

sure that they would help us and guide us through this situation. 

This is a situation that we had not previously experienced in the 

past, and we wanted to make sure that in no way would we compromise any future investigation. 

Chairwoman KELLY. Thank you. 

I want to thank this panel for your patience. You have been wonderful for staying with us, and I appreciate very much the fact that 

you have given us so much of your time and your expertise today. 

The Chair notes that some members may have additional questions for this panel, which they may wish to submit in writing. So 

without objection, this hearing record will remain open for 30 days 

for members to submit written questions to the witnesses and place 

their responses in the record. 

This hearing is adjourned. 

[Whereupon, at 1:12 p.m., the subcommittee was adjourned.] 

(51)

A P P E N D I X

July 21, 2005

52


29461.001
53


29461.002
54


29461.003
55


29461.004
56


29461.005
57


29461.006
58


29461.007
59


29461.008
60


29461.009
61


29461.010
62


29461.011
63


29461.012
64


29461.013
65


29461.014
66


29461.015
67


29461.016
68


29461.017
69


29461.018
70


29461.019
71


29461.020
72


29461.021
73


29461.022
74


29461.023
75


29461.024
76


29461.025
77


29461.026
78


29461.027
79


29461.028
80


29461.029
81


29461.030
82


29461.031
83


29461.032
84


29461.033
85


29461.034
86


29461.035
87


29461.036
88


29461.037
89


29461.038
90


29461.039
91


29461.040
92


29461.041
93


29461.042
94


29461.043
95


29461.044
96


29461.045
97


29461.046
98


29461.047
99


29461.048
100


29461.049
101


29461.050
102


29461.051
103


29461.052
104


29461.053
105


29461.054
106


29461.055
107


29461.056
108


29461.057
109


29461.058
110


29461.059
111


29461.060
112


29461.061
113


29461.062
114


29461.063
115


29461.064
116


29461.065
117


29461.066
118


29461.067
119


29461.068
120


29461.069
121


29461.070
122


29461.071
123


29461.072
124


29461.073
125


29461.074
126


29461.075
127


29461.076
128


29461.077
129


29461.078
130


29461.079
131


29461.080
132


29461.081
133


29461.082
134


29461.083
135


29461.084
136


29461.085
137


29461.086
138


29461.087
139


29461.088
140


29461.089
141


29461.090
142


29461.093
143


29461.092
144


29461.091
145


29461.094
146


29461.095
147


29461.096