U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

70–751 PDF 2011

S. HRG. 112–126 

CYBER CRIME: UPDATING THE COMPUTER FRAUD 

AND ABUSE ACT TO PROTECT CYBER SPACE 

AND COMBAT EMERGING THREATS 

HEARING 

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

SEPTEMBER 7, 2011 

Serial No. J–112–38 

Printed for the use of the Committee on the Judiciary 

( 

(II) 

COMMITTEE ON THE JUDICIARY 

PATRICK J. LEAHY, Vermont, Chairman 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

CHUCK SCHUMER, New York 

DICK DURBIN, Illinois 

SHELDON WHITEHOUSE, Rhode Island 

AMY KLOBUCHAR, Minnesota 

AL FRANKEN, Minnesota 

CHRISTOPHER A. COONS, Delaware 

RICHARD BLUMENTHAL, Connecticut 

CHUCK GRASSLEY, Iowa 

ORRIN G. HATCH, Utah 

JON KYL, Arizona 

JEFF SESSIONS, Alabama 

LINDSEY GRAHAM, South Carolina 

JOHN CORNYN, Texas 

MICHAEL S. LEE, Utah 

TOM COBURN, Oklahoma 

BRUCE A. COHEN, Chief Counsel and Staff Director 

KOLAN DAVIS, Republican Chief Counsel and Staff Director 

(III) 

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page 

Grassley, Hon. Chuck, a U.S. Senator from the State of Iowa ............................ 2 

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont .................... 1 

prepared statement .......................................................................................... 38 

WITNESSES 

Baker, James A., Associate Deputy Attorney General, U.S. Department of 

Justice, Washington, DC ..................................................................................... 5 

Martinez, Pablo A., Deputy Special Agent in Charge, Criminal Investigative 

Division, U.S. Secret Service, Washington, DC ................................................. 7 

SUBMISSIONS FOR THE RECORD 

American Civil Liberties Union, Laura W. Murphy, Director, Washington 

Legislative Office; Kelly William Cobb, Executive Director, Americans for 

Tax Reform’s Digital Liberty; Leslie Harris, President and CEO, Center 

for Democracy & Technology; Fred L. Smith, President, Competitive Enterprise Institute; Marcia Hofman, Senior Staff Attorney, Electronic Frontier 

Foundation; Charles H. Kennedy, partner, Wilkinson, Barker, Knauer, LLP; 

Wayne T. Brough, Chief Economist and Vice President, Research 

FreedomWorks Foundation; Orin S. Kerr, Professor of Law, George Washington University; Paul Rosenzweig, Visiting Fellow, The Heritage Foundation; Berin Szoka, President, TechFreedom, August 3, 2011, joint letter ....... 27 

Baker, James A., Associate Deputy Attorney General, U.S. Department of 

Justice, Washington, DC ..................................................................................... 29 

Martinez, Pablo A., Deputy Special Agent in Charge, Criminal Investigative 

Division, U.S. Secret Service, Washington, DC ................................................. 40 

Nojeim, Gregory T., Director, Project on Freedom, Security & Technology, 

on Behalf of Center for Democracy & Technology, Washington, DC, statement ...................................................................................................................... 48 

Stewart, Julie, President, Families Against Mandatory Minimums (FAMM), 

Washington, DC, statement ................................................................................ 63 

Wall Street Journal, September 7, 2011, article ................................................... 72 

(1) 

CYBER CRIME: UPDATING THE COMPUTER 

FRAUD AND ABUSE ACT TO PROTECT 

CYBER SPACE AND COMBAT EMERGING 

THREATS 

WEDNESDAY, SEPTEMBER 7, 2011 

U.S. SENATE, 

COMMITTEE ON THE JUDICIARY, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:09 a.m., in room 

SD–226, Dirksen Senate Office Building, Hon. Patrick J. Leahy, 

Chairman of the Committee, presiding. 

Present: Senators Leahy, Whitehouse, Klobuchar, Franken, 

Coons, Blumenthal, and Grassley. 

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. 

SENATOR FROM THE STATE OF VERMONT 

Chairman LEAHY. Good morning. Today the Committee is holding an important hearing on cyber crime. Protecting American consumers and businesses from cyber crime and other threats in cyber 

space has been a priority of this Committee for many years—I 

might say a bipartisan priority—and we continue that tradition 

today. Before we start, I want to thank Senator Grassley who has 

worked closely with me on this hearing in a bipartisan way. I think 

cyber crime impacts all of us, regardless of political party or ideology, so I look forward to our continued partnership, Chuck, in 

this Congress and as we continue. 

Developing a comprehensive strategy for cyber security is one of 

the most pressing challenges facing our Nation today. I think of the 

days not many years ago when you worried about somebody going 

into a bank and robbing a bank and maybe getting $20,000—they 

were usually caught—or looting a warehouse. Now it is a lot different. A study released today by Symantec Corporation estimates 

the cost of cyber crime globally is $114 billion a year. In just the 

last few months, we have witnessed major data breaches at Sony, 

Epsilon, RSA, the International Monetary Fund, and Lockheed 

Martin—just to name a few. It is not the masked person with the 

gun walking into a bank. It is somebody maybe sitting thousands 

of miles, even another country away and committing the crime. 

Our Government computer networks have not been spared. We 

saw the hacking incidents involving the United State Senate, and 

also the Central Intelligence Agency websites. We cannot ignore 

these threats. We cannot ignore the impact on our privacy and security. That is why the Committee will carefully examine the 

2 

Obama administration’s proposals for new legal tools to help law 

enforcement investigate and prosecute cyber crime today. 

I do want to thank and commend the dedicated men and women 

at the Departments of Justice and Homeland Security, and elsewhere across our Government, who are on the frontlines of the battle against cyber crime. Every day they are successfully investigating and disrupting the growing threats to our cyber security. 

In July, the FBI announced that it had arrested more than a 

dozen individuals associated with a group of computer hackers 

called, obviously, ‘‘Anonymous’’ after the group launched a series of 

cyber attacks on Government and private networks, according to 

the charges made. The Secret Service recently announced a successful cyber crime investigation that led to the Federal indictment 

of an individual alleged to have hacked into the computer system 

at the Massachusetts Institute of Technology, MIT, resulting in the 

theft of more than 4 million scientific and academic articles. These 

are just two examples of the many accomplishments of our law enforcement community in this area. 

But with every new victory, we are challenged by even greater 

threats and even more cunning cyber thieves. A recent report by 

the computer security firm Symantec found that on any given day, 

an average of 6,797 websites harbor malware, or other unwanted 

programs. That is an increase of slightly over 25 percent since June 

2011. I am pleased that representatives from the Department of 

Justice and the Secret Service are here to share their views on this, 

and later this week the Committee will consider these proposals 

and other privacy measures in my comprehensive data privacy and 

security legislation. I hope that the Committee will promptly report 

this legislation on a bipartisan basis, as it has done three times before. 

We are talking about the security of our Nation and our people 

in cyber space, so we have to work together. Again, this is not a 

Democratic or Republican issue. This is something that should 

unite us all. It is a national issue that we have to address, so I am 

hoping that all Members of Congress will join in that. 

Again, I thank the distinguished Senator from Iowa for his help, 

and I yield to him. 

STATEMENT OF HON. CHUCK GRASSLEY, A U.S. SENATOR 

FROM THE STATE OF IOWA 

Senator GRASSLEY. Before I go to my statement, there are a couple things I would say. 

I think the fact that Majority Leader Harry Reid had a meeting 

several months ago on various committees that were involved in 

this—and you and I were involved in that—plus the fact that in 

our party Senator McConnell has had hearings, I think that highlights the bipartisanship as well as the national security reasons 

for these pieces of legislation. 

Also, the second thing I would say is that I think you have correctly stated that you and I are very, very close on this legislation, 

and I can say from the standpoint of this Committee’s work, very 

close with the administration’s legislation. I may have some ideas 

that vary a little bit, and I will refer to a couple of those in my 

remarks. 

3 

I thank you very much for today’s hearing. Given the growth of 

the Internet and our society’s increased dependence on computer 

systems, this is a very important topic. Cyber criminals are no 

longer confined by the borders of their community, their State, or 

even their country. Cyber space has allowed criminals to steal 

money, steal personal identities, and commit espionage without 

even leaving their home. Cyber criminals are now using the Internet to conspire with other cyber criminals. They collaborate to install malicious software, commit network intrusions, and affect account takeovers. 

Cyber criminals also target the point-of-sale computers at restaurants and retailers in order to steal millions of credit card numbers, as they did at companies such as TJX, BJ’s Wholesale Club, 

Office Max, Boston Market, Sports Authority, and I suppose many 

others. 

Moreover, there are online criminal forums that traffic in stolen 

credit card numbers, such as the notorious CarderPlanet forum 

that traffic in stolen credit card numbers. Cyber criminals also continue to engage in phishing attacks, denial-of-service attacks, and 

web application attacks. 

Cyber criminals are smart, and they learn from their mistakes. 

They learn from evaluating other cyber attacks, and they learn 

from successful prosecution of their peers. Cyber criminals design 

relentless new computer viruses and malware as they attempt to 

stay one step ahead of the anti—virus programs. 

All of these attacks are serious and dangerous to our Nation. 

However, I fear that the threats we have not heard about or even 

thought about are likely to be even more dangerous and devastating. So we must take these cyber attacks seriously and ensure 

that our critical system infrastructure is well protected from cyber 

criminals. 

Accordingly, the Federal Government must take every single 

breach of a computer system or potential vulnerability seriously. 

For example, I have asked the Department of Defense Inspector 

General to properly investigate serious allegations that Department of Defense employees purchased child pornography online 

and were never adequately investigated by the Defense Criminal 

Investigative Service. These allegations include DOD employees 

possibly purchasing child pornography from their own work computers. I remain deeply concerned that DOD employees who purchased child pornography continue to work in key positions and retain high-level security clearances, putting the Federal Government and our military computer systems at risk for intrusion. I 

want to know what the Defense Department is doing to stop this 

sort of behavior, whether these individuals will be brought to justice, and whether Government systems could be compromised because of criminal behavior. 

Aside from this example, I generally support the efforts that the 

administration is undertaking to work toward a bipartisan solution 

on cyber security. However, I have some concerns with part of the 

administration’s proposal. I also have reservations about how these 

sweeping policies will be implemented and how much they add to 

an already large Government bureaucracy. 

4 

On top of these concerns, I also question the wisdom of the administration in some of the personnel appointments that they have 

made to critical positions. Example: The administration recently 

hired an individual at U.S. Cyber Command, an agency charged 

with securing our military capability network. I am concerned that 

the Obama administration seemingly failed to conduct an adequate 

background investigation of the individual’s qualifications. If they 

had, I am confident they would have easily seen that she played 

a role in the Clinton administration’s alleged loss of subpoenaed email during the investigation of the 1996 Presidential campaign or 

that she allegedly paid a diploma mill thousands of dollars for a 

bachelor’s, master’s, and doctorate degree in computer science. Ensuring that our Nation’s most sensitive networks are safe from 

international cyber espionage should not be assigned to someone 

who obtained their degrees from a diploma mill. 

These types of personnel decisions weaken our ability to protect 

our Nation from cyber attack, essentially putting us at risk. Further, they raise questions about whether the administration is 

truly serious about protecting our Nation’s critical infrastructure 

and military computer systems. 

External threats continue to target our infrastructure, whether 

that is the financial services industry or retail. According to a recent data breach study conducted by the U.S. Secret Service and 

Verizon, 92 percent of the breaches were from ‘‘external agents.’’ I 

appreciate that the Secret Service continues to aggressively combat 

worldwide financial and computer cyber crimes. In 2010, the Secret 

Service arrested more than 1,200 suspects for cyber crime violations involving over $500 million in actual fraud and prevented another $7 billion in potential loss. I plan to ask the Secret Service 

and the Department of Justice witnesses how we can improve our 

protection of cyber space. I am eager to understand how they are 

proactively engaging in emerging threats of cyber criminals, and I 

also want to know more about why they feel they need new criminal laws, new bureaucracies, and thousands of pages of regulations 

that could hamper virtually all businesses, large and small, across 

the country. 

Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you very much. 

Our first witness is James Baker. He is an Associate Deputy Attorney General at the U.S. Department of Justice. I know he was 

planning to be here once before for this hearing, and we had to cancel, and everybody’s schedule changed. I told him earlier this morning that I am glad he is here, and the same with you, Mr. Martinez. He has worked extensively on all aspects of national security 

policy and investigations. As an official at the U.S. Department of 

Justice for nearly two decades, he has provided the United States 

intelligence community with legal and policy advice for many 

years. In 2006, he received the George H.W. Bush Award for Excellence in Counterterrorism. I would note that that is the CIA’s highest award for counterterrorism achievement. He also taught at 

Harvard Law School and served as a resident fellow at Harvard 

University’s Institute of Politics. 

Mr. Baker, as always, it is good to have you here. Please go 

ahead, sir. 

5 

STATEMENT OF JAMES A. BAKER, ASSOCIATE DEPUTY ATTORNEY GENERAL, U.S. DEPARTMENT OF JUSTICE, WASHINGTON, DC 

Mr. BAKER. Thank you, Senator. Chairman Leahy, Ranking 

Member Grassley, and members of the Committee, thank you for 

the opportunity to testify today on behalf of the Department of Justice regarding the administration’s cyber legislation proposal. 

This Committee knows well that the United States confronts serious and complex cyber security threats. The critical infrastructure of our Nation is vulnerable to cyber intrusions that could damage vital national resources and potentially put lives at risk. Intruders have also stolen confidential information and intellectual 

property. At the Department of Justice we see cyber crime on the 

rise with criminal syndicates operating with increasing sophistication to steal from innocent Americans. Even more alarming, these 

intrusions might be creating future access points through which 

criminal actors and others can compromise critical systems during 

times of crisis or for other nefarious purposes. 

That is why the administration has developed what we believe 

is a pragmatic and focused legislative proposal for Congress to consider as it moves forward on cyber security legislation. We think 

that the proposal will make important contributions toward improving cyber security in a number of respects. Today I would like 

to take a moment to highlight the parts of the administration’s proposal aimed at improving the tools that we have to fight computer 

crimes. 

The administration’s proposal includes a handful of changes to 

criminal laws aimed at better ensuring that computer crimes and 

cyber intrusions can be investigated and punished to the same extent as other similar criminal activity. Of particular note, the administration’s proposal would clearly make it unlawful to damage 

or shut down a computer system that manages or controls a critical 

infrastructure, such as electricity distribution or the water supply. 

This narrow, focused approach is intended to provide deterrence 

to this class of very serious, potentially life—threatening crimes. 

Moreover, because cyber crime has become big business for organized crime groups, the administration proposal would make it 

clear that the Racketeering Influenced and Corrupt Organizations 

Act, or RICO, applies to computer crimes. Also, the proposal would 

harmonize the sentences and penalties in the Computer Fraud and 

Abuse Act, or CFAA, with other similar laws. 

For example, acts of wire fraud in the United States carry a 

maximum penalty of 20 years in prison, but violations of the CFAA 

involving very similar conduct carry a maximum of only 5 years. 

Such disparities make no sense. 

In addition, the administration proposal would expand the scope 

of the CFAA’s offense for trafficking in passwords to cover not only 

passwords but other methods of confirming a user’s identity, such 

as biometric data, single-use passcodes, or smart cards used to access an account. Such language should also cover log-in credentials 

used to access any protected computer, not just Government systems or computers at financial institutions. The means to access 

computers at hospitals, nuclear power plants, and air traffic control 

towers are no less worthy of protection. This proposal will help 

6 

equip law enforcement to fight a key area of cyber crime: The theft 

of passwords and means of access for the purpose of committing additional crimes. 

The administration also proposes several amendments to the 

CFAA related to forfeiture, including adding a civil forfeiture provision. The lack of a civil forfeiture authority in the CFAA currently 

forces Federal prosecutors to use criminal forfeiture authorities in 

instances where civil forfeiture would be more appropriate or efficient. Our proposed civil forfeiture provision is consistent with 

similar provisions in Federal law that have existed for many decades. 

Finally, some have argued that the definition of ‘‘exceeds authorized access’’ in the CFAA should be restricted to disallow prosecutions based upon a violation of contractual agreements with an employer or a service provider. We appreciate this view, but we are 

concerned that restricting the statute in this way would make it 

difficult or impossible to deter and address serious insider threats 

through prosecution. My written statement goes into this issue in 

more depth. 

I would note that we have been working with Chairman Leahy, 

Ranking Member Grassley, and their staffs on a common solution 

to address this issue. 

Mr. Chairman and members of the Committee, this is an important topic, as you all know. The country is at risk, and there is 

much work to be done to better protect critical infrastructure and 

improve our ability to stop computer crime. I look forward to answering your questions today, and I would ask that my full written 

statement be made part of the record of the hearing. 

Thank you, Mr. Chairman. 

[The prepared statement of Mr. Baker appears as a submission 

for the record.] 

Chairman LEAHY. Thank you, and your full statement will be 

part of the record. I appreciate the statement. 

Next we will hear from Mr. Martinez. He serves as Deputy Special Agent in Charge of Cyber Operations for the Criminal Investigative Division of the United States Secret Service. In nearly two 

decades at the Secret Service, he oversaw the agency’s first major 

cyber operation, Operation Firewall, in which over 30 online criminals from across the globe were apprehended. Incidentally, very impressive. He is currently responsible for the oversight of all cyber 

training and criminal intelligence operations conducted by the 

Criminal Investigative Division. Prior to that assignment, he supervised the New York Electronic Crimes Task Force, oversaw multiple transnational cyber fraud cases, again, pointing out that none 

of these things happen just in the locality where you are. He is a 

1990 graduate of the Virginia Military Institute, where he received 

a Bachelor of Arts in economics, then a commission in the U.S. 

Army Reserves. 

Please go ahead. 

7 

STATEMENT OF PABLO A. MARTINEZ, DEPUTY SPECIAL 

AGENT IN CHARGE, CRIMINAL INVESTIGATIVE DIVISION, 

U.S. SECRET SERVICE, WASHINGTON, DC 

Mr. MARTINEZ. Good morning, Chairman Leahy, Ranking Member Grassley, and distinguished members of the Committee. Thank 

you for the opportunity to participate in this morning’s hearing. 

One of the significant challenges in producing an analysis of the 

cyber criminal underground lies in the diversity of the online criminal community. For example, criminals may choose to cluster 

around a particular set of Internet relay chat channels, Internetbased chat rooms, or web-based forums. In some instances, a group 

of online criminals may come from a particular geographic area 

and may know each other in real life. In other instances, a group 

may be dispersed across the globe and know one another only 

through their online interaction. 

Many venues are populated by those whose capabilities are unsophisticated; however, other more exclusive groups are comprised of 

members who have a decade or more of experience and extensive 

contacts in diverse criminal worlds. This diversity is reflected in 

the group’s interests and aims. One group may see the researching 

of vulnerabilities and development of new exploits as a technical 

challenge fundamentally related to the basics of computer security. 

Another group may have little or no interest in underlying technological issues but will happily use exploits developed by others in 

order to intrude into third-party computer systems and harvest 

data of commercial value. Still other online criminal communities 

show even less interest in coding and exploits but use the Internet 

as an operating base, taking advantage of the anonymity and instantaneous communication the Internet affords them. 

Two of the hallmarks that distinguish effective online criminal 

groups are organizational structure and access to a well-developed 

criminal infrastructure. One striking manifestation of these trends 

in online criminality is found in the web-based online forums that 

first began to emerge approximately a decade ago. In the early 

days, these online forums were established by hacking groups or by 

groups of carders, criminals who traffic in or exploit stolen financial data. Many of these forums have a strong representation of 

members from Eastern Europe. Although membership often spans 

the globe and includes members from multiple continents, by utilizing the built-in capabilities of the forum software, the people behind the organization are able to set up a system of foreign administrators and moderators who form the core of the organization and 

who maintain order at the site. 

Some of these online forums developed into marketplaces for 

criminal goods and services. By 2004, forums such as 

DumpsMarket, CarderPortal, Shadowcrew, and CarderPlanet were 

already well-developed criminal marketplaces overseen by an experienced group of administrators who were often established criminals. In reality, these sites serve as a business platform for a fusion 

of criminal communities, each of which provides its own contribution to the development of the organization’s capabilities by making 

a greater variety of reliable criminal services available to all members. 

8 

Some of the major classes of participants in these forums include 

the following broad categories: Carders, hackers, spammers, 

malware developers, and specialized hardware developers, to name 

just a few. 

As evident from the array of criminal service providers I have 

just listed, the development of diverse online criminal organizations has greatly enhanced the criminal infrastructure available to 

pursue large-scale criminal activity. The far-reaching availability of 

a reliable criminal infrastructure in combination with other developments on the Internet presents a global challenge to law enforcement, which has found itself forced to adapt in order to apprehend 

and prosecute online criminals. 

The administration is aware that in order to fully protect American citizens from cyber threats, certain sections of our current 

cyber security laws must be updated. This past spring, the administration released its proposal to address the cyber security needs 

of our country. The legislative package proposed by the administration addresses key improvements for law enforcement. Secret Service investigations have shown that complex and sophisticated electronic crimes are perpetrated by online criminals who organize in 

networks, often with defined roles in order to manage and perpetuate ongoing criminal enterprises dedicated to stealing commercial 

data and selling it for profit. The administration’s proposal will better equip law enforcement agencies with additional tools to combat 

transnational cyber crime by enhancing penalties against criminals 

that attack critical infrastructure and by adding computer fraud as 

a predicate offense under the Racketeering Influenced Corrupt Organizations Act. 

Chairman Leahy, Ranking Member Grassley, and distinguished 

members of the Committee, the Secret Service is committed to our 

mission of safeguarding the Nation’s financial infrastructure and 

will continue to aggressively investigate cyber and computer-related crimes to protect American consumers and institutions from 

harm. This concludes my prepared statement. Thank you again for 

this opportunity to testify on behalf of the Secret Service. 

[The prepared statement of Mr. Martinez appears as a submission for the record.] 

Chairman LEAHY. Well, thank you. And I assume you have no 

doubt in your mind these attacks are going to continue, no matter 

how many you have been able to stop in the past. Is that correct? 

Mr. MARTINEZ. Yes. 

Chairman LEAHY. Mr. Baker, like most Americans, I am concerned about the growing threat of cyber crime. If you have a business, you worry about that. If you are just an average citizen, you 

worry about somebody stealing your identity. I understand the FBI 

National White Collar Crime Center’s Internet Crime Complaint 

Center received more than 300,000 complaints about cyber crime 

last year. That is an astounding number. 

You discussed in your testimony the need to keep the Computer 

Fraud and Abuse Act up to date. How would the administration’s 

proposals to update the Computer Fraud and Abuse Act ensure 

that the statute keeps us with the changes in technology? 

Mr. BAKER. Well, in particular, on the question of keeping up 

with changes in technology, I would focus on the provision regardVerDate Nov 24 2008 14:48 Oct 27, 2011 Jkt 070751 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70751.TXT SJUD1 PsN: CMORC
9 

ing trafficking in passwords and other identifying information. 

Right now we think the language is broad enough to enable us to 

do what we need to do, but we think that expanding it to include 

other means of access to computers will clarify in the future, as 

hopefully security systems advance and other new technologies are 

developed to protect access, that this would be an easy way to 

make sure that we can actually get at defendants who we are able 

to bring to court and not have them escape on some technicality 

because a court thinks that the definition is not precise enough 

with respect to this new type of technology. So that is one example, 

Senator. 

Chairman LEAHY. Well, I can imagine decades ago any predecessor of mine being in here talking about ‘how do we get these 

bank robbers; how do we get these train robbers’. That is pretty 

simple. I have to assume that no matter how good a defense any 

one of the major companies have somebody is constantly trying to 

figure out a way to get around it. Is that not true? 

Mr. BAKER. Yes, they are under constant assault. Yes, that is 

why I think you have the large number that you cited. 

Chairman LEAHY. Now, one criticism of the Computer Fraud and 

Abuse Act is that the statute has been—this leads from your answer, it is interpreted so broadly that it could treat relatively innocuous behavior, violating terms of a service agreement, for example, as a Federal criminal offense. 

What kind of assurances do we have if we pass this statute that 

either this administration or a future administration might abuse 

the authorities under the law? 

Mr. BAKER. Well, certainly one thing is that we are accountable 

to this Committee and to the Congress in terms of how we enforce 

the Act, and we have to come up here and explain what it is that 

we have been doing. I think that if you look at our whole record 

with respect to how we have enforced the Act over time, I think 

we have done it in a responsible way. 

I think we would be happy to work with the Committee under 

your leadership to try to find a way to address those concerns. 

There are perhaps a variety of different things, increased reporting 

requirements, for example, that might be effective, but we are certainly willing to work with you to make sure that this Committee 

believes that you have the right information to enable you to assess 

how it is that we are enforcing the Act. 

Chairman LEAHY. You know what I am saying. In the normal 

criminal code, you could have some kid who takes a car joyriding 

and leaves it. You can charge him with some minor offense, or you 

can charge him with grand larceny. And most prosecutors would 

not charge him with grand larceny—we want you to concentrate on 

the real cyber crimes and not the minor things. 

Mr. BAKER. Of course, we agree with that. We have limited resources. As you expressed, the threat is large, and we have resources but they are limited in terms of the number of people we 

are trying to—— 

Chairman LEAHY. Let us talk about that. How many investigators and prosecutors are there at the Department of Justice investigating and prosecuting cyber crime? 

10 

Mr. BAKER. In terms of prosecutors dedicated to cyber intrusions, 

if you will, there are approximately 230. Now, if you expand that 

to include other types of fraud, child exploitation-type crimes, it is 

going to be a larger number than that. I do not have that exact figure. 

Chairman LEAHY. What about investigators? 

Mr. BAKER. In terms of that, the difficulty is that the exact number of investigators that the FBI has in particular dedicated to this, 

because of the national security aspect of it, is classified. We would 

be happy to share that information with you in a different setting. 

Chairman LEAHY. Perhaps in a different setting, if you could let 

both Senator Grassley and myself know. 

Mr. BAKER. Absolutely. 

Chairman LEAHY. Thank you. And do you have sufficient resources? 

Mr. BAKER. I think we can always use more resources. We, the 

administration, put forward a proposal for fiscal year 2011 that included a request for some, I think, 160, approximately, additional 

personnel and some $45 million to go along with it. And the key 

is, I think, we want to make sure that we have the right resources. 

This is not something you just throw bodies at and solve it. You 

need to have trained people. You need to develop them over a period of time. So what we need to do is have sort of a long-term goal 

and objective in terms of bringing people in, training them, and 

then having them be able to work on these issues. 

Chairman LEAHY. Well, the same question to you, Mr. Martinez. 

How many people do you have dedicated to this? And do you have 

adequate resources? 

Mr. MARTINEZ. Chairman Leahy, we have put over 1,400 of our 

special agents through some type of computer training. We take 

cyber crime as a serious offense. We have been doing this for a 

while, so much so that part of the training that we now provide all 

of our special agents when they become agents is a specific 2- to 

3-week block of cyber training. So it has now become part of our 

basic training for every special agent that goes through the academy. 

In addition to that, with the assistance of the Committee, we 

now have 31 Electronic Crime Task Forces throughout the country, 

29 of them domestically and 2 overseas. And what we have done 

with that, in addition to the special agents that we have that have 

cyber training, we have also partnered with our State and local law 

enforcement officers throughout these task forces and provided 

them with this training. We do that training through the National 

Computer Forensic Institute down in Hoover, Alabama, where we 

only train State and local law enforcement on computer forensics, 

network intrusion, and in basic skills of computers. 

Those individuals, when they leave the NCFI, are then either 

members of our Electronic Crime Task Forces throughout the country or are providing assistance and support to State and local municipalities throughout the country. We are proud to say that we 

have had State and local law enforcement from all 50 States of the 

Union and 2 of its territories. And in addition to having the State 

and locals train there, we also train State judges and State prosecutors because we feel as important as it is to train our investigaVerDate Nov 24 2008 14:48 Oct 27, 2011 Jkt 070751 PO 00000 Frm 00014 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70751.TXT SJUD1 PsN: CMORC
11 

tors, it is that important to also train prosecutors and judges so 

that these cases get prosecuted and so that judges know how to 

prosecute these cases. 

The other thing we have taken with the Electronic Crime Task 

Force model is that we have partnered with academic institutions, 

because a good amount of the research and development that goes 

on in this country is done by universities. So for the last 12 years, 

we have been at Carnegie Mellon University and have been a member of the Software Engineering Institute where we work with Carnegie Mellon NCI, which is a federally funded research and development center, to develop software and hardware that helps our investigators. 

In addition to that facility, we have also partnered with the University of Tulsa where we have a cell phone/PDA forensic facility 

to also boost the capabilities of our agents and our State and local 

partners. 

Chairman LEAHY. Thank you very much. I know my little State 

of Vermont has had people down there, so I appreciate that. 

Senator Grassley. 

Senator GRASSLEY. I want to zero in on cyber attacks on our infrastructure, like power grids, traffic control. These things, where 

they can be interfered with, control most of our important day-today operations. As such, our criminal laws should reflect the need 

to protect critical infrastructure by sending a signal to would-be 

criminals that these attacks, including even attempted attacks, will 

not be tolerated. That means not only criminalizing the conduct but 

including tough sentences that Federal judges cannot play games 

with. So, Mr. Baker, I would like to ask you questions along this 

line. 

The administration’s cyber security proposal includes a new 

crime for aggravated damage to a critical infrastructure computer. 

This proposal includes a 3-year mandatory minimum prison sentence for those who knowingly cause or attempt to cause damage 

to a critical infrastructure computer. Why did the administration 

include this mandatory minimum for this crime but not other 

crimes? 

Mr. BAKER. Because we understand the concerns that some 

Members of Congress have with respect to the use of mandatory 

minimums, we believe that it was appropriate in this circumstance, 

given, as you just recited, that it is involving damage to critical infrastructure systems that result in the substantial impairment of 

the system, so we thought that under those circumstances, given 

the gravity of the offense, that a mandatory minimum of 3 years 

was appropriate in this circumstance, and we thought it was a judicious use of the mandatory minimum concept, which is why we attached it to this particular offense. 

Senator GRASSLEY. We are scheduled to mark up a Senate bill 

that does not currently include a crime for aggravated damages to 

a critical infrastructure computer. It is my understanding that may 

be added at markup. However, I understand it may not include a 

mandatory minimum. Would the Department support including a 

mandatory minimum, as the President’s proposal does, as part of 

the Committee process? 

12 

Mr. BAKER. The administration’s proposal is to include a mandatory minimum. Obviously, we want to work with Congress in this 

area. We understand the concerns, and so we are happy to work 

with the Committee. But we do think that this prohibition, this 

new criminal offense, is something that we do need to address and 

try to include. 

Senator GRASSLEY. Okay. This would be for Mr. Martinez. As I 

stated in my opening remarks, I believe that we must take cyber 

attacks seriously and ensure that our critical systems’ infrastructure is well protected from cyber criminals. However, I am concerned that we provide too broad of a definition for things like 

‘‘sensitive personal identifiable information,’’ that we may desensitize that information and create complacency within the public. 

Individuals that constantly receive data breach notifications from 

their banks will begin to maybe ignore them. A broad definition of 

‘‘sensitive personal identifiable information’’ could also overburden 

businesses by requiring them to make unnecessary notification for 

what amounts to public information that is easily obtainable 

through Internet searches. 

So how does the Secret Service define ‘‘sensitive personally identifiable information’’ ? 

Mr. MARTINEZ. Senator Grassley, we identify it the same way 

that it is laid out in the administration’s bill and also as it appears 

on the 1028(d)(7). I think what we also need to take into account 

is when we look at what constitutes a data breach, it includes the 

information you are referring to, but it also includes Section (b) 

which states, ‘‘which present a significant risk of harm or fraud to 

any individual.’’ So that is taken into account along with the definition of ‘‘personally sensitive identifiable information’’ in order to 

make notification. 

The other way I think we address it also is through triggers. I 

think there are triggers in the bill that define when notification 

needs to be made and when it does not. 

In reference to the broad definition of ‘‘personally sensitive identifiable information,’’ I will tell you that there are individuals in 

the online criminal community that can take that general information and put it together with additional information that they have 

already compromised to give you a better idea as to the information 

involving your victim target. So, for example, I could take the first 

initial and last name of an individual, his home address, and provide it to one of these online criminal data brokers and say, ‘‘Can 

you run a credit report on an individual at this address with this 

first initial and last name’’ ? So that combined information can then 

really cause harm to the victim. 

Senator GRASSLEY. Well, if banks send their customers breach 

notification that involves nothing more than their name address, or 

their mother’s maiden name, do you agree that this broad definition of ‘‘sensitive personally identifiable information’’ could potentially desensitize the public perception and maybe create a ‘‘boy 

who cried wolf’’ situation? 

Mr. MARTINEZ. There is a possibility that something like that 

could happen, and that is why, again, I go back to the administration’s proposal that talks about significant risk of harm or fraud. 

I think the organization, the company, needs to take that into acVerDate Nov 24 2008 14:48 Oct 27, 2011 Jkt 070751 PO 00000 Frm 00016 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70751.TXT SJUD1 PsN: CMORC
13 

count, you know, before we start desensitizing these intrusions by 

sending too many of these notices. 

Senator GRASSLEY. Well, if you would support narrowing the definition of that term to cover information that leads to a significant 

risk of identity theft, how would you narrow the definition? 

Mr. MARTINEZ. I believe in the definition or in that area, as it 

is submitted as part of the administration’s proposal, it talks about 

combining the PSII information with the second part of it, which 

is, ‘‘which presents a significant risk of harm or fraud to that individual.’’ I would add that section to the bill as it is laid out in the 

administration’s proposal. 

Senator GRASSLEY. And, last, if Congress were to give rulemaking authority to modify the definition in the future, what agency or combination of agencies would you suggest be given that authority? 

Mr. MARTINEZ. I believe the FTC and I think also in consultation 

with the Department of Justice, because the Department of Justice 

is responsible for prosecuting these cases, so I definitely think that 

the FTC has the expertise in this area, and I think consultation 

with the Department of Justice would also be good. 

Senator GRASSLEY. Thank you, Mr. Chairman. 

Chairman LEAHY. Well, thank you. And, incidentally, Mr. Baker, 

I think the House of Representatives would find it very difficult to 

accept the mandatory minimum, and certainly I do not intend to 

include it in the bill that I will put forward. Just in passing, I want 

strong penalties, but the mandatory minimum is something that I 

worry can be abused. 

Senator Coons. 

Senator COONS. Thank you, Mr. Chairman. 

I want to start by thanking the Chairman and the Ranking Minority for convening this hearing. I think we have heard from the 

Chairman, from the President, and from many leaders in the private sector and public sector that this is one of the most grave 

threats facing our Nation, that the number and complexity of cyber 

crimes continues to grow year after year and the cost and the impact on victims large and small continues to grow. So I am glad 

we are continuing to press on this. I hope that the Senate will, indeed, take the opportunity to move in a bipartisan and responsible 

way to reconsider the CFAA, to amend it in ways that deal with 

overbreadth or last of clarity but to, frankly, also strengthen the 

tools available to law enforcement. 

I want to focus on just a few simple points, if I could. One is 

about training and the skill set that is available, both in the Department of Justice and in the Secret Service. Mr. Martinez, Special Agent Martinez, I was struck in your written report about the 

scope of training available, the 1,400 agents having gone through 

ECSAP training, the 31 ECTFs you referred to, the institute in 

Alabama that I know Delaware law enforcement has benefited 

from as well as many other States, I think all States. But I am concerned about the depth of training and the breadth of it. 

There was an Inspector General report from the Department of 

Justice just in April of this year that suggested that the National 

Cyber Investigative Joint Task Force, actually a third of the agents 

engaged lacked the necessary expertise in networking and counterVerDate Nov 24 2008 14:48 Oct 27, 2011 Jkt 070751 PO 00000 Frm 00017 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70751.TXT SJUD1 PsN: CMORC
14 

intelligence to be able to effectively participate in intrusion cases, 

and that many of the field offices also lacked the forensic and analytical capability. I am clear that training is expense, that we have 

lots of other things on our needs list for the country, but this is not 

a want that strikes me as a critical need. I would be interested in 

comments from both of you, if I might, about what more we can 

and should be doing to strengthen the training, the depth and 

breadth of training by law enforcement. 

And then as a follow-on to that, if I might, Special Agent Martinez, you have, I think, a reserve commission. In Delaware we 

have a National Guard unit that takes advantage of a lot of the 

private sector strength and skills in our financial services community to also bring them into training and make them available as 

a resource. I wondered if both of you might comment on the possibilities or the risks of engaging the National Guard and the Reserve as a way to get some of the most skilled private sector folks 

also engaged in some of the national security-relevant pieces of ongoing forensic and network defense and investigations. If you 

might, please, first. 

Mr. MARTINEZ. Thank you, Senator. Yes, it is an expensive undertaking to get these folks trained, and that is why we have tried 

to force multiply, working with our partners. Cyber crime is not 

something that can be solved by any one organization. We all have 

to work in a collaborative way to do that. And we think we are— 

that is what we have been trying to do with our task forces, and 

not only partnering with State and local law enforcement and other 

Federal partners, but also bringing the private sector in. 

There is a section of the administration’s proposal which actually 

talks about having folks from the private sector come in to assist 

Government and so forth. So there is probably some mechanism 

that is already been used in other parts of the Government that 

can be used to help here. 

One of the other issues that we see from cyber crime is that we 

have a lot of involvement from Eurasian cyber criminal organizations or some of the most robust organizations. In speaking about 

the National Guard, there is potentially something we should probably look into that is similar to some of the activities that other 

Department of Justice organizations, law enforcement organizations have done in the past with the assistance of some National 

Guard entities in other parts of the country, and specifically in the 

area of linguistic capabilities. You know, that is one of our biggest 

challenges, is the fact that a lot of these criminals are Eastern European and speak Russian or a Russian dialect. There is probably 

a way to get that same model that we set up in narcotics enforcement for language translations and have that sort of supplement 

what we do in cyber crime because these individuals primarily 

communicate through some type of online method, whether it is instant message, e-mail, or peer-to-peer, and so there probably would 

be a good venue to get that type of linguistic capability up to speed 

and utilize it in furtherance of cyber crime investigations. 

Senator COONS. Thank you. I would be happy to work with you, 

if I can, in furthering that. And if you might, Associate Deputy Attorney General Baker, please. 

15 

Mr. BAKER. Sure, just a couple quick comments to amplify on 

that. 

I think with respect to the use of the National Guard, I agree. 

We need to use all of our available resources. The key there is to 

make sure we understand what hat they are wearing when they 

are engaged in that role and to make sure that what they are doing 

is consistent with the law and executive branch policy, and then to 

make sure that we have appropriate privacy protections in place 

and appropriate oversight to make sure when any element of DOD, 

assuming they are acting in that capacity and in that way, is engaged in these kinds of activities. But I agree with your general 

point that we need to make sure that we have the resources—that 

we use all the resources that are available, especially if these people are coming with particular skill sets that they have developed 

in the private sector. That is absolutely critical. 

Just real quickly on the IG report with respect to the FBI, I 

would just note that the FBI, it was my understanding, accepted 

all the recommendations from the IG, so they understand it. They 

place a huge amount of importance on this, and they get it as well. 

Senator COONS. Great. Thank you. As we try to move responsibly 

to strengthen law enforcement’s toolkit, I also want to make sure 

that we are striking the right balance, as you mentioned, between 

privacy and continuing to be certain that there are robust divisions 

between DOD authority and domestic law enforcement, and that 

we are respecting the rights of Americans and protecting individual 

liberties. 

Thank you for your answers. 

Senator WHITEHOUSE [presiding]. I will be chairing the remainder of the hearing, so that means I will be here until the end. So 

to expedite my colleagues, let me defer my questioning until the 

end, and so unless a Republican colleague arrives, we will have 

Senator Klobuchar, then Senator Franken, then Senator 

Blumenthal. Senator Klobuchar. 

Senator KLOBUCHAR. Thank you very much, Mr. Chair, and 

thank you to both of you for working on this very difficult and important area. I am glad that we are holding this hearing, obviously, 

but also that we are moving ahead on legislation, because I have 

heard time and time again, whether it is confidential briefings with 

our Defense Secretary and others about the concern of the cyber attack issue—and I certainly have seen in a much smaller way in my 

previous job a prosecutor for 8 years just the growing, escalating 

number of cases that we had involving just individuals being 

hacked or data stolen. And I have introduced a number of bills in 

this area, and I wanted to talk through some of those and how they 

could work with the larger bill that we are working on. 

Senator Hatch and I introduced a bill aimed at child pornography that would require Internet service providers to retain information on the IP addresses they assign to customers for a minimum amount of time. This is information that the providers already have and already retain, but some providers, we have 

learned, keep it for longer periods than others, and the bill would 

simply set a minimum retention period. The providers would not 

be required to retain any content of a person’s online activity. It 

simply mean that if law enforcement sees illegal activity online, 

16 

then they can tell that it is emanating from a certain computer or 

device. They would then be able to go to the Internet service provider and get information on who owned that computer or device, 

and, of course, they would need a subpoena to do that. 

It seems to me that this could be an important reform not just 

for child pornography cases but also for many of the types of crimes 

that we have been talking about today. I do not know if either of 

you would like to comment on that. Mr. Baker. 

Mr. BAKER. Yes, thank you, Senator. Just briefly, we agree completely that this is a significant issue and it potentially impacts a 

whole range of cases, including child exploitation, gangs, other 

types of—you know, terrorism potentially, national security crime. 

So we think it is a significant problem. 

We do not, unfortunately, have a cleared administration position 

on how long and what types of data to retain and so on, but I agree 

with your characterization of the basic idea with respect to the proposals that we have seen. It is certainly something we would like 

to work with you on because it is a very, very important issue. 

Senator KLOBUCHAR. Agent Martinez. 

Mr. MARTINEZ. Yes, Senator. Digital crime scenes tend to evaporate more quickly than traditional crime scenes, so preserving data 

is an important part of any type of cyber investigation. So we concur with Mr. Baker’s comments that, you know, some type of retention would be good to cyber investigations. 

Senator KLOBUCHAR. Then another area is cloud computing, and 

I think we are seeing more and more of that, for good reasons: 

bringing down the cost of data storage, computing for businesses, 

consumers, and government alike. However, we need to also ensure 

that our laws are keeping up with the new technology. Cloud computing represents a unique challenge. The way the data is stored 

and accessed in the cloud makes it sometimes hard to prove the 

damages that are currently required by the Computer Fraud and 

Abuse Act. And so we are looking at how we can make sure that 

those damages can be proved when you are dealing with the cloud, 

and I do not know if you want to comment at all about that and 

what is happening with hacking. 

Mr. MARTINEZ. Again, I go back to the crime scene. A cloud crime 

scene is much more difficult to solve than to try to get evidence 

from a traditional crime scene. So it is going to be a challenge to 

make sure that when we respond to an organization that is storing 

information in the cloud, that that organization knows exactly 

where that information is at and, you know, make sure that law 

enforcement can access that information in a quick manner. 

I go back to, you know, the fact that digital evidence evaporates 

a lot quicker, so it is going to be incumbent on organizations that 

establish some type of cloud computing environment that they 

know the layout or the topography of their information. And the 

other challenge that we also face is, you know, if the information 

is stored in the cloud and that cloud is out of the jurisdiction of the 

United States, what challenges might that pose to us? 

Senator KLOBUCHAR. And that is why we are trying to put in 

here some structure for other countries to work together on these 

things, because that is going to be key as we move forward. 

17 

Shifting to another topic, do you think the jail terms and the 

fines in the current law are severe enough to have a substantial 

effect in deterring or reducing cyber attacks? And how about in the 

proposal before us? 

Mr. MARTINEZ. I think the administration’s proposal does a very 

good job of addressing that. And, in fact, I used some examples 

where we have charged cyber criminals with other offenses as identified by Mr. Baker, where these individuals were charged with either wire fraud or credit card fraud or bank fraud that received significant jail terms, in excess of 10, 15, 20 years. That is definitely 

a deterrent to criminals that conduct this type of activity. 

If you look at our Verizon data breach investigative report, we 

see a larger number of intrusions occurring right now, but we do 

not see as many of the large-scale intrusions that we have seen in 

the past. We think part of the reason for that is the deterrent factor that these stiff sentences have had on these criminal organizations. So to get a statute like 1030, the Computer Fraud and Abuse 

Act, up to par with some of these other ones we believe will make 

a deterrent against criminals that are undertaking these types of 

intrusions. 

Senator KLOBUCHAR. Okay. Then just one last question, Mr. 

Chair, if I could. Economic espionage is clearly a drain on the 

American investment in our country, our talent, whether it is blueprints to the way a manufacturing facility is set up or a design of 

a dress. Does, do you believe, the Computer Fraud and Abuse Act 

adequately combat the problem of economic espionage? And do you 

think the administration proposals helps with this? Are there more 

things that we should be doing as we look even away from the 

cyber attacks on Government and look into what has been going on 

in the private sector? 

Mr. MARTINEZ. I think Mr. Baker could better answer that than 

I. 

Senator KLOBUCHAR. Mr. Baker. 

Mr. BAKER. Absolutely. I mean, the focus of the Computer Fraud 

and Abuse Act is sort of on the means that are used to perpetrate 

the crime that I think you are talking about. We would fully support efforts to try to make sure that we can address the type of 

crime that you are concerned about because we are very concerned 

about it as well. I think that our proposals in the administration’s 

legislation would be effective in addressing the type of crime. But 

if there were particular things that we should focus on, we would 

be happy to work with you on that because it is a huge problem, 

and the theft of our intellectual property is a very, very significant 

problem for the country. 

Senator KLOBUCHAR. Have you seen instances of retaliatory 

hacking where groups actually go after people that are working on 

this, these issues? 

Mr. BAKER. Groups go after a lot of different people working on 

a whole range of issues, and, you know, I guess I would defer to 

Special Agent Martinez on the cases because—well. 

Mr. MARTINEZ. Yes, I think no one is immune from these types 

of intrusions and attacks. I think we have seen a lot of these types 

of attacks have been reported in the media, and there is a lot that 

18 

happen. So I do not think anybody is immune from this type of 

cyber attack. 

Senator KLOBUCHAR. Thank you very much. 

Senator WHITEHOUSE. Senator Franken. 

Senator FRANKEN. Thank you, Mr. Chairman. 

Mr. Baker, I want to ask you a question to follow up on a question from Chairman Leahy. In recent cases the Department of Justice has actually argued that the violation of a website’s term of 

service or an employer’s computer use policy can constitute a Federal crime under the Computer Fraud and Abuse Act. In other 

words, under this interpretation of the statute, people could conceivably be guilty of a Federal crime for checking their gmail or the 

weather if their employer’s computer policy prohibits them from 

using their computers for personal reasons. Two Federal judges 

have found this reading of the statute to be unconstitutional because people do not read those policies, and when they do, they can 

be, as you know, long and complex and full of fine print. 

Don’t you think it would be worthwhile to somehow address the 

concerns of those Federal judges in updating this statute? 

Mr. BAKER. Thank you for that question. As I said earlier, Senator, we would be happy to work with folks to address these kinds 

of concerns. I think that the challenge is to address those concerns 

and at the same time not create a significant loophole that would 

allow somebody, for example, who worked at the Social Security 

Administration, the IRS, the U.S. passport office, or a bank to take 

information in violation of their employer’s policies and misuse it 

for some purpose, either to spy on somebody that they know or to 

take information and pass it others to actually steal money. So I 

think this insider case where somebody violates the rules of their 

employer using a computer is a very challenging thing to address 

and at the same time address the types of concerns that you suggest. 

The difficulty is that, you know, we have to think about how and 

whether we should have a regime that is parallel to the actual 

physical world. So if an employer says, ‘‘Well, you can use the petty 

cash for certain purposes but not for other purposes,’’ and somebody takes the cash and spends it on something that they are not 

supposed to, we would prosecute them, potentially, depending upon 

the amount, for fraud. And so the question is or the issue is employers all the time set rules about what can be done with their 

resources. Do we want to make a difference—or how do we want 

to differentiate the cyber world from the physical world? So I think 

these are real challenges, but we understand what you are saying, 

and obviously we have read those opinions, and we have heard loud 

and clear what the judges were saying, and in the Drew case, in 

particular, we decided not to appeal in that case. 

Senator FRANKEN. Okay. Thank you. 

Again, Mr. Baker, I know that this is not technically the subject 

of the hearing, but since you are here, I want to ask you about the 

administration’s data breach proposal. The administration’s proposal would require certain companies holding ‘‘sensitive personally 

identifiable information’’ to notify their customers if that information is breached. I was surprised to see that the administration’s 

definition of ‘‘sensitive personally identifiable information’’ did not 

19 

include an individual’s geolocation. Today many companies literally 

have minute-to-minute records of everywhere a smartphone user 

has been over a period of months. In my mind, that information 

can be just as sensitive, if not more sensitive, than one’s home address, which is covered under the definition. 

Would you consider amending your proposal to include 

geolocation in the definition of ‘‘sensitive personally identifiable information’’ ? 

Mr. BAKER. I think certainly, Senator, we would be open to looking at that issue. I would have to look at it again. There may be 

parts of this that would cover that type of information, depending 

on how it was stored in an account or something already. But in 

terms of focusing on it directly, I think we would be open to that. 

I would just note that, because we looked at the geolocation question in a variety of different contexts, defining geolocation information is tricky, and so we would have to make sure that we got that 

right in order to include the kinds of things that you are concerned 

about but not sweep in a bunch of other stuff. But I would be 

happy to work with you on that, or the Department would be 

happy to work with you on that. 

Senator FRANKEN. Good. Thank you. 

I also noticed that this proposal gives companies up to 60 days 

to notify their customers of a breach of their sensitive personally 

identifiable information. That period seems long to me. A criminal 

can do a lot of damage with someone’s Social Security number in 

2 months. Why can’t we have a quicker deadline or shorter deadline for notification? 

Mr. BAKER. I think on that as well, Senator, we would be happy 

to work with you on that, because the one thing to think about, 

though, is there is invariably some lag time, because there will be 

a breach and it might take a short period of time for the company 

to become aware of it. And then I think you want some period of 

time where the company is required to go to law enforcement and 

law enforcement can make some assessment about whether we 

want them to report. We may have an undercover operation ongoing, let us say, to try to target these people. They have been doing 

a variety of different breaches, and so we have an operation. We 

do not want them to know that we are on to them. So we may in 

a particular circumstance ask the company to hold off on the notification because it might harm—— 

Senator FRANKEN. Okay. 

Mr. BAKER. So we want some period of lag time. The trick is to 

find out what that is, and so I think we would be happy to work 

with you on that. I do not think there is any magic with respect 

to the 60-day number. 

Senator FRANKEN. Okay. It looks like we have got a lot of little 

things to work on. 

Mr. BAKER. Sure. 

Senator FRANKEN. Okay. Thank you, Mr. Baker. 

Mr. BAKER. Okay. 

Senator FRANKEN. Thank you, Mr. Chairman. 

Senator WHITEHOUSE. Senator Blumenthal. 

Senator BLUMENTHAL. Thank you, Mr. Chairman, and thank you 

both for being here today. I want to second the concerns just raised 

20 

by Senator Franken about the 60-day period, which I think is way 

too long in the majority of instances. I recognize there may be some 

law enforcement activity that requires some lag time, but it seems 

to me that an exception can be carved out for that kind of specific— 

and I do mean explicit and specific—law enforcement activity that 

justifies a delay rather than having a blanket 60-day period, which 

seems excessively long. 

I want to focus—and I was very interested and impressed by 

your comments on infrastructure vulnerability and potential assaults on that aspect of our economic and security activity. We hear 

a lot of talk about potential cyber assaults on our information, 

whether it is electric or gas. Should there be a stronger requirement for those facilities or companies themselves to take proactive 

and preventive measures? Right now it seems to me if there are 

any provisions, they are egregiously weak in light of the public responsibility of those private institutions. And so I wonder whether 

you would care to comment on that. 

Mr. BAKER. Yes, Senator, thank you. I think that is addressed in 

other parts of the bill where the role of the Department of Homeland Security with respect to helping to set standards and then 

monitoring compliance with standards, I think that is more directed at the kind of concern, very legitimate and absolutely correct 

concern that you have with respect to that. I am not sure—I would 

have to think about it for a minute, but I am not sure that the specific proposal we are talking about with respect to the CFAA, for 

example, would address that. But I think that the larger concern 

about the critical infrastructure—and, you know, again, the whole 

point of all this is to prevent anything from happening. It is one 

thing to prosecute after the fact, but we want to prevent things 

from happening. We want to deter activity, and we want to make 

sure that entities have in place the appropriate means to protect 

themselves and the incentives to do that. 

I think we would be happy to work with you on any way that 

is reasonable that would further those goals. 

Senator BLUMENTHAL. And I agree, deterrence is one way to prevent criminal activity, but not always an effective way in light of 

the interests and stakes. And you mentioned extortion. A potential 

penalty of 3 years, even if it is a minimum, may not be enough to 

deter someone from this kind of—— 

Mr. BAKER. That is right. 

Senator BLUMENTHAL. Do other parts of your—meaning the Federal Government’s—proposals include penalties, whether civil or 

criminal, for the failure of these infrastructure institutions to take 

preventive measures? 

Mr. BAKER. They do not include criminal prohibitions or penalties for failing to take these types of measures. I think the idea 

was to have a lighter touch with respect to building incentives into 

the system to try to get entities to enhance their cyber security. So 

I do not think that that is part of the proposal. 

Senator BLUMENTHAL. What about civil penalties? 

Mr. BAKER. The same thing. I think the idea is not to incur civil 

penalties, but to provide appropriate information and disclosures 

with respect to the state of affairs with respect to particular entities. 

21 

Senator BLUMENTHAL. Because that really is the thrust of my 

question to you, whether there should be—taking a broader view, 

I recognize it is Homeland Security, not the Department of Justice, 

but if there is no effective remedy for the failure to take such measures, I wonder how effective the standards and advice and counseling will really be, given the economic pressures that these companies may have and given their relative lack of sophistication in 

this area. Financial institutions are much more likely to be deep 

into this subject because of the nature of what they do. Their entire 

business is conducted with computers, and so they are familiar 

with making those computers less—and more so the other infrastructure every day where smart energy use involves this kind of 

work. But I guess my point to you is that I think that we do need 

to consider some kind of stick as well as carrot in this area. 

Mr. BAKER. I agree, Senator, and I think there are existing incentives that some folks have just not focused on, I think. For example, there is a loss of good will with your customers when you 

face a serious breach. That is one thing. You are losing money. You 

are losing your intellectual property. You have obligations to your 

shareholders to inform them about the state of affairs with respect 

to your company. That may be something that the SEC is looking 

at—or should look at, I guess. Others have suggested that. Senator 

Whitehouse, in fact, I think suggested that with perhaps Senator 

Rockefeller. 

And so there are a whole range of different incentives built into 

the system today that I guess you would have to say do not seem 

to be effective because we still have a very significant problem that 

we need to address, as you have suggested. 

Senator BLUMENTHAL. And my time has expired, but again I 

want to thank you, and I would just suggest that if we are that 

concerned about the information vulnerability, maybe those incentives are not working as well as they should. 

Thank you. 

Senator WHITEHOUSE. Mr. Baker, welcome back. 

Mr. BAKER. Thank you, Senator. 

Senator WHITEHOUSE. A quick question. Is it clear that the cloud 

is a computer within the meaning of the statute? 

Mr. BAKER. The current statute? Well, I think that the elements 

of the cloud are. I would have to look at it. I can pull out the definition of a ‘‘protected computer.’’ But I would think that because it 

generally includes any computer connected to the Internet, the 

cloud itself at a particular cloud provider is going to be included 

within the definition of a ‘‘protected computer.’’ 

Senator WHITEHOUSE. When was the statute, 2008? 

Mr. BAKER. Yes, I think that is right. 

Senator WHITEHOUSE. So that is, believe it or not, in cyber time 

a generation or so, and it kind of dates back to when it was presumed that data was actually in a computer. And since that is no 

longer the way this works, I just wonder that you may find that 

you run into definitional problems, particularly if criminal statutes 

are intended to be narrowly construed. Anyway—— 

Mr. BAKER. I agree with that, and as I think I suggested, if we 

expand anything with respect to something called ‘‘the cloud,’’ we 

need to make sure that we define that appropriately. 

22 

Senator WHITEHOUSE. Where do you think your defendants are 

most likely to be under this provision of law? 

Mr. BAKER. We face substantial threats—and I will defer to Special Agent Martinez on this as well, but we face substantial threats 

from domestic actors, domestic malicious actors, as well as international. So, as you know very well, there is a very substantial 

threat that we face from actors based overseas. 

Senator WHITEHOUSE. Yes, and it worries me to go back to 

Chairman Leahy’s question. You said that there are 230 prosecutors who are working in this area. Where do you get the 230 number? Does that include the people assigned to the United States Attorney’s Offices who are the designated cyber prosecutors? 

Mr. BAKER. Yes. That includes those people plus folks at Main 

Justice who are dedicated to this type of activity. Again, it does not 

include necessarily the fraud prosecutors, the child exploitation 

prosecutors, because they are dealing with criminal activity on the 

Net as well. 

Senator WHITEHOUSE. So you and I both know that out in the 

United States Attorney’s Offices the designated cyber prosecutors 

are doing other stuff. 

Mr. BAKER. Absolutely. 

Senator WHITEHOUSE. So the number in terms of FTE, or whatever you would want to call it, is actually considerably less than 

230. Because these cases very often involve overseas activity, you 

have added a RICO predicate here, which I think is great. But 

RICO cases are complicated. I do not know to what extent the Department requires departmental oversight of this. If you do, for instance, a public corruption case and you are a U.S. Attorney, you 

have to check in with the Department all the time on that, and it 

adds a lot of work and effort and burden to the case, probably with 

good reason. How closely does the Department supervise and require engagement with a U.S. Attorney’s Office that is prosecuting 

a cyber case? If you are doing a Hobbs Act case, you are kind of 

on your own. The Department really barely ever checks in if you 

are doing a—where on the spectrum is this in terms of the Department requiring a lot of back-and-forth with the U.S. Attorney’s Office? 

Mr. BAKER. Just a quick comment on the RICO case. If adopted 

by the Congress, the RICO provision would be subject to the same 

type of oversight by the Department, so just to make sure that is 

clear. 

With respect to existing criminal activities with respect to cyber 

crimes, there is a range. Some U.S. Attorney’s Offices have a significant number of trained prosecutors who know how to do this. 

You know, they are in large offices, and so they consult with Main 

Justice as needed. Other districts where they do not encounter this 

type of activity as much or do not prosecute the cases as much, 

they are going to rely more extensively on our computer fraud—— 

Senator WHITEHOUSE. So if a U.S. Attorney’s Office has the internal capability to handle a significant cyber case, they can run 

with it on their own without a lot of supervision by Main Justice? 

Mr. BAKER. That is essentially correct, I think, yes. 

Senator WHITEHOUSE. Well, that lifts at least one burden off of 

this, but still, when you divide the 230 down for the extent to 

23 

which those are people who are actually doing something different, 

and when you look at the complexity of RICO cases of chasing people down internationally, probably having to coordinate with our 

intelligence services to get information about the foreign bad actors, I just continue to worry that we are sorely, sorely understaffed for this. 

How would you evaluate, how does the Department evaluate the 

risk of a cyber attack on the country and the constant regular dayto-day onslaught of cyber attacks in the Nation’s priorities? 

Mr. BAKER. In the Nation’s priorities, I mean, I think that the 

threat of a cyber attack or addressing the threat of a cyber attack 

is very high on the list of priorities for the Nation, not only for the 

Department of Justice but for the entire Defense Department, the 

intelligence community, and all elements of Government. We are 

very, very concerned about that kind of thing. So it is very high on 

the list of priorities. 

Senator WHITEHOUSE. And just day to day, there are tens of 

thousands of attacks. We are having a hemorrhage of our intellectual property, mostly over to China, but to other places. There is 

an immense amount of crime and fraud that takes place, and that 

is kind of the baseline. If you put the baseline together with the 

risk of a really significant knock-down cyber attack on the country, 

doesn’t that equate in terms of risk to national security of, for instance, our exposure to drug crime or our exposure to the hazard 

of alcohol, tobacco, firearms, and explosives? 

Mr. BAKER. As you know, there is a huge problem with many elements to it. We have to address all of them basically simultaneously because there is an onslaught of attacks, as you have described, every day. ‘‘Attacks’’ ? Let me back up. There is an onslaught and intrusions and computer activity, malicious activity all 

the time. Whether something is an attack or not, let us put that 

aside for a second. 

Senator WHITEHOUSE. Yes, understood. 

Mr. BAKER. Let me back up 1 second. It is important to make 

sure that we have adequate resources to deal with these crimes 

and these activities. It is also important that we make sure we 

have in place, when we catch someone, the appropriate penalties, 

the appropriate language in various statutes to make sure that 

somebody does not get out on a technicality and things like that. 

So what I think we are focused on today, at least in my comments, 

on the CFAA is to make sure that we have the statutory structure 

to address the crime. What we need to do then is go after the criminals, and we need to have all the kinds of resources that we have 

been talking about today, the Secret Service, the FBI, and that 

other elements of the Government have. 

Senator WHITEHOUSE. I understand that. I am just worried that 

we are going to pass this bill as it ends up being amended, that 

it will go into effect, and we are going to pat ourselves on the back 

for having done something good about protecting America from 

cyber crime and from cyber attack, and, in fact, what we have done 

is overlooked the resource disadvantage that we have put ourselves 

at. 

Mr. BAKER. Well, I agree completely. When you look at how the 

Nation has faced the threat from counterterrorism since 9/11, we 

24 

have not just done one piece. We have done a whole range of things 

since then, and we need to dedicate ourselves to that kind of effort 

for a prolonged period of time in terms of dealing with this cyber 

threat. It is going to evolve over time. The adversaries have significant resources themselves devoted to it, and we face substantial 

risks if they are successful. 

Senator WHITEHOUSE. When DNI Clapper had his confirmation 

hearing in the Intelligence Committee, he listed the threats to 

America’s national security. The No. 1 was cyber. 

I wanted to just follow up quickly on the question that I think 

Senator Franken asked, and I think Chairman Leahy did also, 

about violating the terms of a service agreement and criminalizing 

basically contracts with—violations of contracts with your provider. 

When you were asked that question, you responded with an example of somebody who was stealing large amounts of petty cash. I 

would just suggest to you that there is a difference between stealing petty cash, which I think every American understands that 

stealing cash is a bad thing to do, with violating the terms of fine 

print in contracts. I do not think there has ever been a society 

more bedeviled by fine print in contracts than America is right 

now. The average American has so much fine print in all of the 

computer programs they download, in all of their service agreements, in the cell phone contract. I mean, wherever you look, everything you do with the bank has pages, your credit card agreement is probably 20 pages long of fine print. Americans are absolutely tormented with fine print. And I do think that it would be 

very salutary for the Department of Justice to put out a proper, 

solid prosecution policy that would reassure Americans that it is 

not the Department of Justice’s intention in pursuing these criminal offenses to go after somebody who comes in under the wrong 

name on Facebook or who, you know, one way or another is out of 

compliance with a private contract that they have entered into that 

is probably a contract of adhesion more or less in the sense that 

they did not really negotiate it and it is multiple pages long and 

the average person does not even read it. 

I think you want to be out of that business, and I think the cases 

that raise that question really throw the Department’s prosecution 

in this area, its activities in this area in a pretty bad light. They 

have had a lot of attention today. It is attention that I do not think 

you need, and I think there is a clear difference between going 

after somebody who goes into the petty cash drawer and takes 

money out, which everybody knows is wrong, and somebody who 

sends an unauthorized e-mail or accesses a program that they are 

not supposed to. I just think you need to be a lot more careful 

about that and make sure you are going after who you should be, 

and that I think will calm down a lot of the concern about this, because it really does lend itself to abuse if it becomes a Federal 

crime to violate the fine print of all the innumerable contracts that 

Americans are now subjected to. 

Mr. BAKER. I do not think that we have actually done that. I 

think that our performance with respect to enforcing the CFAA has 

been better than that. And so I would submit that, you know, consistent and pursuant to oversight of this Committee in particular, 

we have not done that. I think the case that people are concerned 

25 

about, the Drew case, did not involve—it was not just some random 

case of somebody who happened to violate some terms of a service 

agreement. It was a case involving individuals essentially goading 

a 13-year-old girl into committing suicide, and I think it is understandable that law enforcement would take a dim view of that and 

try to address that kind of situation to the fullest extent of the law. 

In that particular situation, as I noted, the judge disagreed strongly with our interpretation of the statute. We reviewed his decision, 

and we decided not to appeal. And I do not think it is accurate for 

those who—I mean, we understand why people are concerned about 

the kinds of issues that you have raised with respect to terms of 

a service agreements and all these different contracts and so on. 

We get that. We understand that completely. 

What we are trying to do is find a way to address those concerns 

and at the same time not let people off the hook who are insiders 

in particular companies. 

Let me back up. The key thing is this term ‘‘exceeds authorized 

access’’ in the statute. 

Senator WHITEHOUSE. Yes. 

Mr. BAKER. As you well know. And so the key is: How do you 

avoid the kind of cases that you are very concerned about and yet 

at the same time not let off the hook somebody who works, again, 

at the IRS, the Social Security Administration, you name it, or 

some bank, to go in, take information, and misuse it for some particular purpose. 

So we are happy to work with people to address these kinds of 

concerns. I will definitely take back your suggestion about issuing 

some clear policy statement. Maybe that would be helpful in this 

area. 

Senator WHITEHOUSE. I think you are better off doing it yourself 

than counting on Congress to try to draw that fine line and that 

moving line. So I would recommend that. 

Well, I have gone well beyond my time, which I was able to do 

since nobody else is here, so it was no prejudice to any colleague. 

And I want to express my appreciation, Special Agent Martinez, to 

you for the work that you and the Secret Service are doing in this 

area, and to you, Mr. Baker, for the work the Department of Justice is doing and for your long and very meritorious service to our 

country in these areas of national security. 

As you know, I continue to believe that we are sorely 

underresourced in this area and that if you put the 230 prosecutors, many of whom are part-time—or no-time, depending on the 

nature of the district’s caseload—up against, say, the Drug Enforcement Administration and ATF and major organizations like that 

that are working diligently and properly on threats to our National 

security and to our National well-being that are probably no greater than the threat we have from cyber crime and cyber attack, 

there is a huge disconnect. And I would urge that you and the administration ramp up a more energized proposal about how we can 

go after these folks, particularly bearing in mind how immensely 

complicated each one of these cases is going to be as you have to 

track down people in foreign countries and work through all of the 

complexities of engaging with foreign law enforcement authorities 

and dealing with the RICO statute. These are not easy cases, and 

26 

they take an immense amount of work just to do the forensic preparation of the case. 

So as I said, my message is good job on the statute. Obviously, 

we are not going to agree with everything you have put in, but I 

think we do need to improve it. But the rhinoceros in the living 

room is the resource question, and it is fine to improve the statute, 

but we have really got, I think, to be much more aggressive about 

this in terms of—I know that individually everybody is doing a 

wonderful job. It is not your fault that there are not more of you 

to do this. But I think it is important for Congress to act in this 

area. 

Thank you very much. We will keep the record open for 1 week, 

if anybody cares to add anything to it, and the hearing is adjourned. Thank you. 

[Whereupon, at 11:30 a.m., the Committee was adjourned.] 

[Submissions for the record follow.] 

27 


70751.001
28 


70751.002
29 


70751.003
30 


70751.004
31 


70751.005
32 


70751.006
33 


70751.007
34 


70751.008
35 


70751.009
36 


70751.010
37 


70751.011
38 


70751.012
39 


70751.013
40 


70751.014
41 


70751.015
42 


70751.016
43 


70751.017
44 


70751.018
45 


70751.019
46 


70751.020
47 


70751.021
48 


70751.022
49 


70751.023
50 


70751.024
51 


70751.025
52 


70751.026
53 


70751.027
54 


70751.028
55 


70751.029
56 


70751.030
57 


70751.031
58 


70751.032
59 


70751.033
60 


70751.034
61 


70751.035
62 


70751.036
63 


70751.037
64 


70751.038
65 


70751.039
66 


70751.040
67 


70751.041
68 


70751.042
69 


70751.043
70 


70751.044
71 


70751.045
72 


70751.046
73 

Æ 


70751.047