U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

77–434 PDF 2002

S. Hrg. 107–258

CRITICAL INFRASTRUCTURE PROTECTION: WHO’S

IN CHARGE?

HEARING

BEFORE THE

COMMITTEE ON

GOVERNMENTAL AFFAIRS

UNITED STATES SENATE

ONE HUNDRED SEVENTH CONGRESS

FIRST SESSION

OCTOBER 4, 2001

Printed for the use of the Committee on Governmental Affairs

(

(II)

COMMITTEE ON GOVERNMENTAL AFFAIRS

JOSEPH I. LIEBERMAN, Connecticut, Chairman

CARL LEVIN, Michigan

DANIEL K. AKAKA, Hawaii

RICHARD J. DURBIN, Illinois

ROBERT G. TORRICELLI, New Jersey

MAX CLELAND, Georgia

THOMAS R. CARPER, Delaware

JEAN CARNAHAN, Missouri

MARK DAYTON, Minnesota

FRED THOMPSON, Tennessee

TED STEVENS, Alaska

SUSAN M. COLLINS, Maine

GEORGE V. VOINOVICH, Ohio

PETE V. DOMENICI, New Mexico

THAD COCHRAN, Mississippi

ROBERT F. BENNETT, Utah

JIM BUNNING, Kentucky

JOYCE A. RECHTSCHAFFEN, Staff Director and Counsel

KIERSTEN TODT COON, Professional Staff Member

HANNAH S. SISTARE, Minority Staff Director and Counsel

ELLEN B. BROWN, Minority Senior Counsel

ROBERT J. SHEA, Minority Counsel

MORGAN P. MUCHNICK, Minority Professional Staff Member

DARLA D. CASSELL, Chief Clerk

(III)

C O N T E N T S

Opening statements: Page

Senator Cleland ................................................................................................ 1

Senator Thompson ............................................................................................ 2

Senator Carnahan ............................................................................................ 4

Senator Collins ................................................................................................. 5

Senator Bennett ................................................................................................ 6

Senator Voinovich ............................................................................................. 7

Senator Domenici ............................................................................................. 21

Prepared statement:

Senator Bunning ............................................................................................... 41

WITNESSES

THURSDAY, OCTOBER 4, 2001

John S. Tritak, Director, Critical Infrastructure Assurance Office, Bureau

of Export Administration, U.S. Department of Commerce ............................... 9

Ronald L. Dick, Director, National Infrastructure Protection Center, Federal

Bureau of Investigation ....................................................................................... 11

Sallie McDonald, Assistant Commissioner, Office of Information Assurance

and Critical Infrastructure Protection, U.S. General Services Administration ........................................................................................................................ 13

Jamie S. Gorelick, Vice Chair, Fannie Mae .......................................................... 23

Joseph P. Nacchio, Chairman and Chief Executive Officer, Qwest Communications International, Inc. ................................................................................ 25

Frank J. Cilluffo, Co-chairman, Cyber Threats Task Force, Homeland Defense

Project, Center for Strategic and International Studies ................................... 27

Kenneth C. Watson, President, Partnership for Critical Infrastructure Security (PCIS) ............................................................................................................. 30

ALPHABETICAL LIST OF WITNESSES

Cilluffo, Frank J.:

Testimony .......................................................................................................... 27

Prepared statement .......................................................................................... 83

Dick, Ronald L.:

Testimony .......................................................................................................... 11

Prepared statement .......................................................................................... 52

Gorelick, Jamie S.:

Testimony .......................................................................................................... 23

Prepared statement .......................................................................................... 70

McDonald, Sallie:

Testimony .......................................................................................................... 13

Prepared statement .......................................................................................... 61

Nacchio, Joseph P.:

Testimony .......................................................................................................... 25

Prepared statement .......................................................................................... 76

Tritak, John S.:

Testimony .......................................................................................................... 9

Prepared statement .......................................................................................... 42

Watson, Kenneth C.:

Testimony .......................................................................................................... 30

Prepared statement with attachments ........................................................... 98

(1)

CRITICAL INFRASTRUCTURE PROTECTION:

WHO’S IN CHARGE?

THURSDAY, OCTOBER 4, 2001

U.S. SENATE, COMMITTEE ON GOVERNMENTAL AFFAIRS, Washington, DC.

The Committee met, pursuant to notice, at 9:35 a.m., in room

SD–342, Dirksen Senate Office Building, Hon. Max Cleland, presiding.

Members present: Senators Cleland, Carnahan, Thompson, Collins, Bennett, Voinovich, and Dominici.

OPENING STATEMENT OF SENATOR CLELAND

Senator CLELAND [presiding]. At the request of Senator Lieberman, who must be out of town today to attend a funeral, I am

chairing today’s hearing on critical infrastructure protection. I appreciate this opportunity to examine who in the public and private

sector is responsible for ensuring the protection of our Nation’s infrastructure. This is the second hearing held by Senator Lieberman

and the Committee in our continuing series on the security of our

Nation’s critical infrastructure and the vulnerability of the country’s financial, transportation, and communications networks, also

our utilities, our public health system, law enforcement, and emergency systems, and others. As you can tell infrastructure covers

just about everything of value in our country.

Prior to the September 11 terrorist attacks the Governmental Affairs Committee has been actually diligent in its examination of the

responsibilities of Federal agency heads for developing and implementing security programs. In fact, the computer security law, enacted during the 106th Congress, requires Federal agencies to upgrade their practices and procedures in order to protect government

information systems from cyber attack. However, since the attacks

on Washington and New York City, we have learned that there is

still much to be done to protect the Nation’s critical infrastructure.

The terrorist attacks provide evidence that physical assaults can

cause severe disruptions in the service and delivery of goods and

products, triggering ripple effects throughout the Nation’s economy,

and more importantly damaging the faith of the people in the viability of the day-to-day functioning of the country. Nothing affects

Americans more than the disruption of the Nation’s transportation,

communications, banking, finance, and utilities systems. The country’s critical infrastructures are growing increasingly complex, relying on computers and computer networks to operate efficiently and

reliably.

2

The growing complexity and the interconnectedness resulting

from networking means that a disruption in one win may lead to

disruptions in others. Therefore, President Clinton established the

President’s Commission on Critical Infrastructure Protection in

July 1996. In 1997, this organization released its report and recommended that greater cooperation and communication between

the private sector and the public sector is needed in order to decrease the vulnerability of the Nation’s infrastructures, which led

to their President’s release of Presidential Decision Directive 63.

In May 1998, President Clinton released this directive, which

sets up groups within the Federal Government to develop and implement plans that would protect government-operated infrastructures and calls for a dialogue between government and the private

sector to develop a national infrastructure assurance plan that

would protect the Nation’s critical infrastructures by the year 2003.

This Presidential decision memorandum identified 12 areas critical

to the functioning of the country: Information and communications;

banking and finance; water supply; transportation; emergency law

enforcement; emergency fire service; emergency medicine; electric

power; oil and gas supply and distribution; law enforcement and internal security; intelligence; foreign affairs; and national defense,

just about everything you can think of.

The directive required each Federal agency to secure its own critical infrastructure and to identify a chief officer to assume that responsibility. The directive also established several new offices to

oversee and coordinate critical infrastructure protection. One was

a national coordinator designated to ensure that a national plan

was developed. The coordinator would be supported by a critical infrastructure assurance office, to be located in the Export Administration of the Department of Commerce.

The directive also created a joint FBI and private sector office,

the National Infrastructure Protection Center, which serves as a

focal point for Federal threat assessment, vulnerability analysis,

early-warning capability, law-enforcement investigations and response coordination. NIPC is also the private sector point of contact

for information sharing. Finally, the directive recommended that

we have the capacity and the capability to detect and respond to

cyber attacks while they are in progress. The Federal Computer Incident Response Center gives agencies the tools to detect and respond to such attacks, and it coordinates response and detection information.

We are fortunate today to have several witnesses who will

present their views on the status of the Nation’s critical infrastructures, and offer their recommendations on protecting public and

private systems from outside attacks.

Senator Thompson, would you like to make any opening remarks.

OPENING STATEMENT OF SENATOR THOMPSON

Senator THOMPSON. Thank you, Mr. Chairman, just very briefly.

I think this is certainly a timely hearing. I think we all appreciate

now the vulnerability that we have had for a long time, and one

that we have discussed in this Committee and others on very many

occasions, certainly including cyber security and the problems we

have with computer security, and so forth. Of course, that was the

3

background for Senator Lieberman and I introducing the Government Information Security Act.

I think that we are now looking at all these threats through different glasses. Today we are probably going to emphasize, perhaps,

one particular issue a little more than others, and that is the cyber

threat. Now we are all familiar, all of a sudden, with the threats

of biological elements, chemical, certainly nuclear, certainly conventional combinations of all the above, and in addition to that is

the cyber threat, which many people think would precede any

major conflict that we had with a major power.

Of course, we now know that in this modern age of technology,

you do not need to have a major nation-state or a national power

in order to create grave problems for us. So now that we have our

attention focused after all this time, we are thinking about rearranging the boxes again and creating new laws and new offices,

and trying to fit all the stuff that is out there together. Of course,

Governor Ridge’s appointment, I think, is a good step. But within

his bailiwick, as I understand it, will be an Office of Cyber Security.

You have Presidential Decision Directive 63, which addressed the

same general problem of cyber security. The GAO has indicated

that has not done very well, in terms of what it was designed to

do and the offices that it set up. Now we have a new proposed executive order that is not with us yet that will address all of this. We

have got the question of what is OMB’s role going to be in all of

this, since they have responsibility for computer security, and then

we have got to ask ourselves how does all this relate to the private

sector, as Senator Bennett spent a lot of time on and has legislation on, because we know that most of our critical infrastructure

is basically in private hands.

So we have got real big organizational issues on the table to deal

with. To me, I think it gets down to a pretty simple proposition,

it is going to require leadership, authority at the top, and leadership, and accountability. Maybe we can learn from our past experience with other government agencies and other crises and things

of that nature, and not make the same mistakes as we go about

trying to rearrange these boxes and decide who reports to who and

who has what authority.

Maybe we will take the lessons we learned from our other management problems. In particular, the government basically cannot

manage large projects very well. We are told time and time and

time again by GAO, by the inspectors general, all the reports that

we have seen in terms of our problems with regard to financial

management. For example, billions and billions of dollars in waste,

fraud, and abuse.

We are told that we cannot manage large information systems.

We have spent billions and billions of dollars, money down the

drain basically, in trying to get computers to talk to one another.

This is a government-wide problem and we think that we are going

to come in here and efficiently set this particular thing up and it

is going to work well, when nothing else—well, that is an overstatement, of course—but so many things are producing billions of

dollars of waste, fraud, and abuse every year. The same agencies

come before us every year on the high-risk list, subject to waste,

4

fraud, and abuse, for a decade, but we are going to pull this out

and set the boxes right, and then go on about our business the way

we did before; we have solved that problem. Well, it isn’t going to

happen that way unless we have what we have been lacking for

years and years and years, and that is leadership from the top on

these issues, with the right person having the right authority, and

accountability when it does not work.

We are very good at setting up plans and goals, and terrible at

implementing them. So I do not want to start out this optimistic

exercise on a sour note, but I think it is important to understand

that we have got a bigger job than probably what we realize in trying to cut through this morass that we always find ourselves in

when we try to solve a problem. And it is especially important here

because of the nature of the problem. So, hopefully, today we can

get some ideas as to who ought to do what, where the responsibility

lies.

I defy anybody to tell us today where the responsibility lies for

any of this, but maybe we can talk about where it should lie and

where we should go, the direction we should go in, and I think for

that reason it will be a useful exercise.

Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Thompson. We will allow

everyone to make an opening statement, if they wish.

Senator Carnahan, would you like to make an opening statement?

OPENING STATEMENT OF SENATOR CARNAHAN

Senator CARNAHAN. Thank you, Mr. Chairman. Terrorists did not

want to bring down just our buildings. They wanted to bring down

our economy. They wanted to bring down our military and our financial and political infrastructure as well. Our losses are incalculable and far-reaching. Still we must face a stark reality: It could

have been worse. Now this Congress, alongside the President, must

take the lead to ensure we are prepared for the future. I applaud

the Chairman for addressing these issues with this series of hearings. When we talk about critical infrastructure, we are talking

about American families and their ability to have a quality life.

This means freedom to travel; it means freedom to make a living;

and it means freedom to conduct business without fear of terrorism. It means having the peace of mind that your government

is doing all that it can to protect you and your children. Grim experience has taught us that terrorist attacks know no boundaries.

The ripple effect is extensive. The emotional trauma is long-lasting,

and the economic impact is real and widespread. We are all affected, and all of us must be part of the Nation’s defense against

further attacks.

As the witnesses will discuss today, there are difficulties in creating a unified system to protect our national infrastructure, because control of the different components rests with different entities. On the most basic level, there is a division between what the

government owns and operates versus what the private sector owns

and operates, but the issue is really much more complex. We live

in a global, computerized, and interconnected world. Technological

changes have led to great opportunities for human progress, but

5

they have also created vulnerabilities that did not exist even 5

years ago.

Securing our critical infrastructure from cyber attacks, which

could be launched from anywhere, is a tremendous challenge for

both government and industry. I look forward to hearing from the

witnesses today and learning from their expertise. I want to hear

their suggestions on what more needs to be done. The question

being raised today, who is in charge of protecting our national infrastructure, needs to be answered as soon as possible. We cannot

afford to wait for another attack.

Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Carnahan. Senator Collins.

OPENING STATEMENT OF SENATOR COLLINS

Senator COLLINS. Thank you very much, Mr. Chairman, for convening this important hearing. It would be hard to imagine a more

current topic for a hearing than the one that we have before us

today on the question of who is in charge of protecting the critical

infrastructure of our Nation. Until the terrorist attacks of September 11, in fact, most Americans probably never fully realized

the importance of this issue. Tragically, however our eyes are all

too open now.

As I have talked with my constituents throughout Maine during

the past 21⁄2 weeks, the question of our vulnerability to attack—to

various kinds of attacks—and who is in charge and who is coordinating it all has come up repeatedly. This morning, I did early

morning radio, back in Maine, and one of the questions was who

is coordinating if we have a biological or chemical attack? Another

constituent asked me what about our ports? What about if we have

a big tanker that is full of liquefied gas coming in? What about the

computer systems that are so critical to our commerce and to our

government?

The answer to the question of who is in charge seems to be, ‘‘Nobody is quite sure.’’ Less than 2 weeks ago, this Committee heard

compelling testimony from the distinguished chairmen of two commissions appointed to study this Nation’s security, former Senators

Gary Hart and Warren Rudman, and Governor James Gilmore of

Virginia eloquently expressed their unanimous, but unfortunate,

conclusion that, as a Nation, we are simply not properly prepared

to defend our critical resources.

If we were poorly prepared for the challenges we thought we

faced before the terrible events of September 11, we must surely

realize that we are woefully unready now. It seems clear that the

protection of our critical infrastructure still consists largely of a

smorgasbord of independently-run and poorly-coordinated programs

across the breadth of the Federal system. President Bush took an

important step when he took office in focusing the National Security Council upon terrorism issues and appointing Vice President

Cheney to head a task force to develop better ways to respond to

catastrophic disasters.

As the Hart-Rudman Commission and the Gilmore Commission

made clear, however, and as recent events have so tragically underlined, it is necessary to do even more. We, in America, have long

6

been blessed by being spared most of the traumas of terrorist attacks that became far too familiar to Europeans in the 1970’s, and

have been a tragic part of Israeli life for decades. It should be clear,

however, that we can no longer afford to attempt to protect our

critical infrastructures without clear lines of authority and accountability, and without being able to answer readily and precisely the

question of who is in charge.

The difficult, but crucial question now, of course, is who should

be in charge and of what? In other words, we must ask who should

be in charge at what level, with what specific responsibilities and

resources, and with what means of ensuring accountability? And

that is why I believe this series of hearings is such an important

contribution to the national dialogue of protecting our infrastructure and of winning the battle against terrorism. I am very eager

to hear the testimony of our witnesses today, and I want to thank

the Chairman and the Ranking Member for their leadership on this

issue. Thank you, Mr. Chairman.

Senator CLELAND. Thank you very much, Senator Collins. Senator Bennett.

OPENING STATEMENT OF SENATOR BENNETT

Senator BENNETT. Thank you, Mr. Chairman. I appreciate the

hearing and I appreciate the opportunity for us to examine these

issues, and the point I want to make with respect to the challenge

that we face is that it is seamless. The networks do not begin and

end at any particularly defined place. But the efficiency that comes

out of the information revolution that we live in has brought with

it an increased vulnerability, and the two are two sides of the same

coin.

If you go back in American history to George Washington’s time,

there was little or no connection, let us say, between Charleston

and Boston, between Virginia and Massachusetts, or New York,

whatever. It was a 7-day journey to travel from one major metropolitan area, if you could call it that, to another. Today, we go

around the world with information, money, deals, negotiations, etc.,

literately with the speed of light. There are no boundaries in today’s economy. The borderless economy is a reality, and those who

want to take down the Americans who are the best at playing this

particular game have vulnerabilities virtually everywhere in the

system.

The seamlessness is part of our efficiency. It is also part of our

vulnerability, and I got introduced to this whole thing when we got

into the Y2K issue and discovered that seamlessness, for me, for

the first time. I am interested that the emergency people in New

York, who handled all the difficulties after the World Trade Center

was hit, have said to Senator Dodd, who has repeated it to me, we

could not have handled this emergency if we had not done the remediation required with respect to Y2K.

Prior to the Y2K remediation, they were in the stovepipe mentality, a computer here, a computer there, a system someplace else.

Y2K caused them to look at it in horizontal terms, and they praised

Senator Dodd for his work, I think appropriately, on Y2K awareness and remediation, because it addressed this problem. We are

now, in the terrorist world, simply looking at a situation where this

7

same vulnerability that we identified with Y2K, if the computer

should fail by accident, now what do we do if the computers fail

on purpose, not our purpose, but somebody else’s purpose who

wants to break into this infrastructure and cripple us?

So we need to do what we did with respect to Y2K, address the

stovepipes, look at this in a strategic manner and say how is the

entire system to be protected? As Senator Thompson has said, the

majority of the ownership of the entire system is in private hands,

not government hands, which is why I have introduced a bill to increase the flow of information between the government and the private sector, back and forth, so that each one can understand in this

seamless situation what is going on in their particular part of the

world.

So I think homeland security and critical infrastructure protection can come down to two words: Interagency coordination. Now,

if that sounds too bureaucratic, think of interagency as including

private agencies, but coordination of information, coordination of

protection activities, coordination of understanding so that we do

not go around with the attitude, ‘‘Well, there is no hole in my end

of the boat, so I do not need to worry about sinking.’’ With this

boat, a hole anywhere hurts us all, and this is an issue that is

going to be with us for a long, long time. We are just beginning to

understand it. That is why this hearing and others like it are very

worthwhile, because it adds to this continually-building layer of understanding, awareness, and, we hope, solutions to this problem.

We cannot go back. We cannot say, ‘‘Let us leave the computer

age and go back to paper and dial telephones.’’ We are in the Internet age. We are in the electronic age, whether we want to be or

not, and we simply have to learn to live with that new vulnerability. Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Bennett. Senator Voinovich.

OPENING STATEMENT OF SENATOR VOINOVICH

Senator VOINOVICH. Thank you, Mr. Chairman. I thank Chairman Lieberman for calling this hearing this morning, and although

he is not able to be with us, we are in good hands with our Chairman pro tem. Today’s hearing focuses on the protection of our Nation’s infrastructure, an aspect of our society that most Americans

tend to take for granted. America’s water and sewer systems, computer, roads and bridges, and banking networks, they are all things

that most Americans use on a daily basis, but rarely give more

than a passing thought.

The events of September 11, however, have changed our way of

thinking forever. Americans are now actually aware of how vulnerable our infrastructure systems and physical surroundings can be.

That is why it is so critical that we work to protect that infrastructure. This hearing will give us an opportunity to examine how we

allocate the responsibility of getting the job done. I would like to

just say at this time, Mr. Chairman, that we are having all of these

hearings about the various threats we face, but we are not discussing the human capital crisis confronting the Federal Government, which is also a threat. Our witnesses will be talking to us

today about all kinds of things that need to be done, but the real

8

issue is, do you have the people in your respective agencies with

the qualifications that you need to get the job done?

From my observation of studying this human capital crisis for

the last 2 years, we are in very bad shape today. Many people are

unaware of the fact that by 2005, about 80 percent of our Senior

Executive Service can retire. Van Harp, a senior FBI agent here in

Washington who used to live and work in Cleveland told me that,

‘‘I’m running my shop with people that are ready to go out the

door.’’ And so as we talk about all of these things that need to be

undertaken, Mr. Chairman, we had better be aware of the fact that

our No. 1 threat is the crisis that we have in our human capital.

As a former Mayor and Governor, I am very much aware of the

water, sewers, and other infrastructure that we have in this country. I have to say that even without terrorists, our sewer and water

systems in this country are vulnerable because of aging. With the

new mandates coming out of Washington today, in my State, for

example, sewer rates, and water rates are going up 100 percent. If

we are going to do some of the things that we are talking about

to protect them, it is going to be costly. And it seems to me, Mr.

Chairman, that one of the things that is missing here in Washington today is that we are not prioritizing the expenditure of dollars.

Some of the things that I think are high on people’s agenda in

terms of spending are much less important than some of the infrastructure needs that we confront here in our Nation.

So I will be very interested to hear from you in terms of the

cyber problem. I would say this: I remember how worried we were

about Y2K. Do you remember? And we were wringing our hands

and we were worried, could we get the job done and is everything

going to fall apart? Senator Bennett, who is very familiar with this

area, was very much involved in that, but we got the job done,

didn’t we? But we did not get it done without making it a major

priority in terms of personnel and the expenditure of money, and

that is what it is going to take if we are going to protect our infrastructure from this new threat of terrorism.

Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Voinovich. Wonderful

comments by all the Members of the Committee here. Thank you

very much for your participation. I will say as a member of the

Armed Services Committee, 1 week before the attacks, as we were

marking up the defense authorization bill, I personally asked Senator Pat Roberts, who had been the Chairman of the Emerging

Threat Subcommittee, and Senator Mary Landrieu, who is now the

Chairman of the Emerging Threat Subcommittee, what they

thought was the most probable attack on the United States, where

we were most vulnerable. Both agreed that No. 1—a terrorist attack below the radar screen, stealth in nature, either biological or

chemical, primarily biological and then cyber attack.

So on the Armed Services Committee, we have been gathering

data and information for at least a couple of years now that certainly point to a cyber attack as one of the top two or three attacks

that could come via terrorist means on this country.

We would like to welcome all of you. Today’s first panel consists

of public sector witnesses who represent three of the primary ofVerDate 11-MAY-2000 13:54 Jul 09, 2002 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 77434.TXT SAFFAIRS PsN: SAFFAIRS
9

1The prepared statement of Mr. Tritak appears in the Appendix on page 42.

fices created by the Presidential directive. The Committee will hear

from John Tritak, Director of the Critical Infrastructure Assurance

Office in the Bureau of Export Administration at the U.S. Department of Commerce; Ronald Dick, Director of the National Infrastructure Protection Center; and Sallie McDonald, Director of the

Federal Computer Incident Response Center.

Thank you all for joining us here. Before you begin, just some

rules of the road here. Just let me mention to you that your full

statement will be entered into the hearing record. You can have an

opportunity to make a short statement and you will be subject to

a time limit, according to Committee rules. Once the light turns

from green to yellow, you will have about a minute to wrap up before the red light appears. If you do not stop then, we will make

you an air marshal out at National. Thank you for coming.

Tell us a little bit about youselves, and what you do, and some

of your thoughts on the subject. But, before I turn you loose, let

me just say I have been here in the Senate almost a full term now

and on this Committee for well over 5 years. I had no idea you all

existed. So please tell us who you are and where you came from

and what you do.

Mr. Tritak, do you want to start off?

TESTIMONY OF JOHN S. TRITAK,1 DIRECTOR, CRITICAL INFRASTRUCTURE ASSURANCE OFFICE, BUREAU OF EXPORT ADMINISTRATION, U.S. DEPARTMENT OF COMMERCE

Mr. TRITAK. Thank you, Senator, Chairman, and Members of the

Committee. I welcome this opportunity, truly, to be here before

you. We generally feel obligated to say that we applaud your leadership on various issues. It is almost a canonical thing you need

to say, but, in this case it is absolutely true. I want to add to the

remark that was made earlier that this hearing, in fact, was supposed to happen before the attack—it was scheduled before the attack, and underscores the fact that this Committee recognizes there

is a real need to address the challenges to our critical infrastructures.

As was indicated in the opening remarks by a number of Senators, we basically have been guided by PDD 63 for about 3 years,

and that Directive was created based on recommendations of an

interagency group as well as a Presidential commission. Jamie

Gorelick, who will be appearing in the next panel, was actually

leading that interagency process. So this goes back to the mid1990’s, in terms of the concerns. It created, as you indicated, three

organizations, a number of organizations; myself at CIAO, Ron

Dick over at the FBI, and Sallie McDonald over at FedCIRC. Needless to say, after 3 years, we were ripe for review, a thorough review in terms of the policies that were established under PDD 63,

and frankly, to take a look at the organizational setup of the Federal Government to determine where fixes and improvements could

be made.

After 3 years of experience and being in the trenches, if we could

not come up with improvements, we really are not doing our job.

And President Bush said as much in May of this year, in which he

10

directed that the critical infrastructure policy be thoroughly reviewed with a view towards figuring out ways to improve the organization of the Federal Government to better deal with and address

the concerns of this issue, which are extremely complex, as you

have all indicated.

He also announced that he wanted, under the directorship of my

office, the Critical Infrastructure Assurance Office, to begin to prepare a national plan or strategy to be developed with industry, to

develop a consensus in this country, through a document that

would be used to inform and make aware and educate on what the

problems of critical infrastructure are and what the respective roles

and responsibilities of government and industry are in addressing

the problem. We all speak about this as a critical infrastructure

protection program. If I had it my way, I would strike the word

‘‘protection’’ and say it is critical infrastructure ‘‘assurance’’—for

the simple reason that what we are really worried about here is

the assured delivery of vital services over our Nation’s critical infrastructures. Those services are provided by both physical- and

cyber-based assets.

Increasingly, those infrastructures are being restructured and

are increasingly dependent upon information systems and networks—not just to support their business, but to operate their assets. They are also becoming more interdependent, so that disruptions in one sector can actually affect other sectors, as well. What

we learned about September 11, if nothing else, is now there are

at least some groups whose purpose and goal is to undermine our

way of life. They will exploit vulnerabilities wherever they can find

them. We had some horrific examples of that back on September

11. I suspect they are not going to stop there.

If they can find and exploit the vulnerabilities of cyberspace, they

are going to do so. So it is incumbent upon our government to deal

with that problem and work closely with private industry in order

to do it. As indicated before, President Bush had inaugurated a

thorough review of government structure and government policy,

and frankly, we were very close to completing that. In fact, at the

time that the original hearing was going to take place we were

close to finishing that review. Then the horrific events of September 11 intervened—and what we are working on now, and I expect that the review will be completed fairly soon, is recognition

that this is not just about infrastructure protection, it is about

homeland security, of which the infrastructures themselves are but

a component part.

So what we are trying to do now is identify how and in what

ways we can improve, both organizationally and in policy, to address the new issues when, in fact—and I will be quite candid,

since one of the roles of my office is to raise awareness, to draw

the various sectors together and identify common problems across

those sectors to involve other sectors of the economy, like the risk

management community, the insurers, the auditing community,

the people who influence the corporate leaders—is that we had to

emphasize the business case as a way of moving forward. The national security case, in many cases, but not all, but many cases, is

simply not self-executing in the market.

11

1The prepared statement of Mr. Dick appears in the Appendix on page 52.

It seemed too remote to affect day-to-day business decisions and

investments in security. That is not to say people did not take it

seriously, but they had to be able to justify those kinds of expenditures against their bottom line—and shareholders and investors

who have a whole lot of other things on their minds. Well, September 11 has just frankly changed all of that. I do not think anyone doubts anymore what the needs and importance of investing in

infrastructure security, and particularly taking into account now

what needs to be done that was not done before September 11

when we got our wake-up call.

So I would say that one of our jobs at the CIAO is to work toward developing a national strategy, working with Ron Dick, who

is the operational side of PDD 63—with my organization learning

more about the policy-support side—is to address those issues. And

what I expect to happen in the fairly near term is for the President

to be able to provide a much more comprehensive statement about

how homeland security will be prosecuted and how the critical infrastructure dimension of that fits into this overall effort.

Thank you for the opportunity to appear here today, Senator,

and I look forward to your comments.

Senator CLELAND. Thank you, Mr. Tritak.

Mr. Dick, tell us a little bit about youself, and what you do.

TESTIMONY OF RONALD L. DICK,1 DIRECTOR, NATIONAL INFRASTRUCTURE PROTECTION CENTER, FEDERAL BUREAU

OF INVESTIGATION

Mr. DICK. Good morning, Senator Cleland and other Members of

the Committee. Thank you for this opportunity to discuss our government’s important and continuing challenges with respect to critical infrastructure protection. In my written statement I address

our role in protecting the Nation’s critical infrastructures and how

we coordinate with other organizations, both public and private.

Last week, while appearing before a subcommittee of House Government Reform, I heard compelling testimony from Mark Seton,

who is the vice president with the New York Mercantile Exchange

and an eyewitness to the attacks on the World Trade Center.

Although the computer systems and records of the exchange survived the attack, their communications, transportation, and power

systems were devastated. Working through contacts in their emergency plans, the exchange opened 3 days after the attack, helping

to stabilize energy markets both here and abroad. In this case, diesel generators provided the power, boats provided the transportation, law-enforcement officials and first-responders provided the

secure environment. The telephone company provided new lines.

His experience proves three things: How our Nation’s various infrastructures are interdependent and vulnerable; how an entity that

organizes for an emergency and plans for redundancy can operationally survive a major attack; and how the private sector, working with Federal, State and local agencies, can succeed in mitigating the damage in a time of crisis.

The mission of the NIPC is to deter and prevent malicious acts

by detecting, warning of, responding to, and investigating threats

12

to our critical infrastructures. It is the only organization in the

Federal Government with such a comprehensive national infrastructure protection mission. The NIPC gathers together under one

roof representatives from, among others, the law enforcement, intelligence and defense communities, which collectively provide a

unique analytical deterrent and response perspective to threat and

incident information obtained from investigations, intelligence collection, foreign liaison, and private sector cooperation.

This perspective ensures that no single community addresses

threats to critical infrastructures in a vacuum; rather all information is examined from a multidisciplinary perspective for potential

impact as a security, defense, counterintelligence, terrorist, or lawenforcement manner, and an appropriate response that reflects

these issues is coordinated by decisionmakers. While developing

our infrastructure protection capabilities, the NIPC has held firm

to two basic tenets that grew from the extensive study of the President’s Commission on Critical Infrastructure Protection.

First, the government can only respond effectively to threats by

focusing on protecting assets against attack while simultaneously

identifying and responding to those who nonetheless would attempt

or succeed in launching those attacks; and second, the government

can only help protect the Nation’s most critical infrastructures by

building and promoting a coalition of trust; one, amongst all government agencies; two, between the government and the private

sector; three, amongst the different business interests within the

private sector itself; and, four, in concert with the greater international community.

Therefore, the NIPC has focused on developing its capacity to

warn, prevent, respond to, investigate, and build partnerships all

at the same time. As our techniques continue to mature and our

trusted partnerships gel, we will continue to experience ever-better

results. Presidential Decision Directive 63 commanded the National

Infrastructure Protection Center to ‘‘provide a national focal point

for gathering information on threats to the infrastructures.’’ Additionally, pursuant to this 1998 Directive, the NIPC provides ‘‘the

principle means of facilitating and coordinating the Federal Government’s response to an incident, mitigating attacks, investigating

threats, and monitoring reconstitution efforts.’’ In the 3 years since

that mandate, the NIPC has established an unprecedented level of

cooperation among various Federal and local agencies in the private sector.

This cooperation was achieved because we have seen the success

of joint multi-agency operations when all members of the intelligence, defense, law enforcement, and other critical infrastructure

agencies, as well as our private sector counterparts, combine their

widely-varied skills and specialties toward a single goal. The eight

infrastructures set forth in PDD 63 have recognized that although

they are independent, they are also interdependent and that they

must work together in order to reduce or eliminate their own

vulnerabilities, and the impact one infrastructure may have on another.

The center has full-time representation from the defense agencies, numerous other Federal agencies, and the Critical Infrastructure Assurance Office. We work closely with the Federal Computer

13

1The prepared statement of Ms. McDonald appears in the Appendix on page 61.

Incident Response Center, as well as the Joint Task Force for Computer Network Operations at Department of Defense, and other entities which respond to critical infrastructure events. Beyond this

and moreover, we recognize the need for a military public-private

sector partnership similar to that in the days of World War II.

We in the National Infrastructure Protection Center continue to

partner with and support lead agencies, such as the FBI and the

Department of Defense. We continue to provide timely and credible

warning information to law enforcement, counterintelligence, and

counterterrorism, and support to all of our partners in order to

fully perform this vital mission. The center is proud to work with

your Committee and the Executive Branch to ensure that freedom

continues to ring across this Nation.

Thank you very much.

Senator CLELAND. Thank you very much, Mr. Dick. Ms. McDonald.

TESTIMONY OF SALLIE McDONALD,1 ASSISTANT COMMISSIONER, OFFICE OF INFORMATION ASSURANCE AND CRITICAL INFRASTRUCTURE PROTECTION, U.S. GENERAL SERVICES ADMINISTRATION

Ms. MCDONALD. Thank you and good morning, Mr. Chairman

and Members of the Committee. On behalf of the Federal Technology Service of the General Services Administration, let me

thank you for this opportunity to appear before you to discuss our

role in critical infrastructure protection. FedCIRC is a component

of GSA’s Federal Technology Service and it is the central coordination facility for dealing with computer security-related incidents

within the civilian agencies of the U.S. Government. Our role is to

assist those agencies with the containment of security incidents

and to aid them with the recovery process. This directly supports

a critical infrastructure protection mission because the Federal

Government’s agencies depend upon their computer systems, not

only to conduct government operations, but also to provide final

connectivity to the owners and operators of the Nation’s critical infrastructures.

Incidents involving new vulnerabilities or previously unseen

exploits require in-depth analysis. Effective incident analysis is a

collaborative effort. Data is collected from multiple sources, then

verified, correlated and analyzed to determine the potential for proliferation and damage. This collaborative effort has resulted in the

development of an incident response community that includes

FedCIRC, the NIPC, the National Security Agency, the Department of Defense, the intelligence community, industry, academia,

and individual incident response components within Federal agencies.

Though the respective missions of these organizations vary in

scope and responsibility, this virtual network enables the Federal

Government to capitalize on each organization’s strategic positioning within the national infrastructure, and on each organization’s unique access to a variety of information sources. Each entity

has a different but mutually supportive mission and focus, which

14

enables the critical infrastructure protection community to simultaneously obtain information from and provide assistance to the private sector, Federal agencies, the intelligence community, the lawenforcement community, the Department of Defense, and to academia.

The unified response to recent threats to the cyber infrastructure, including the Code Red worm and the Nimbda worm, clearly

demonstrate how these collaborative relationships work and how

each participant’s contributions help to assess and mitigate potential damage. In both instances, industry alerted the incident response community to the new exploit. During a previous event, a

collaborative communication network had been established among

numerous government agencies including FedCIRC, the NIPC and

the Critical Infrastructure Assurance Office, in addition to academia, industry, software vendors, antivirus engineers and security

professionals.

This network enabled participants to share details as they performed analyses and developed remediation processes and consensus for protection strategies. In the case of Code Red, through

the collaboration of the above-named groups, the collective team

concluded that this worm had the potential to pose a threat to the

Internet’s ability to function. An unprecedented public awareness

campaign ensued concurrent with efforts to ensure that all vulnerable servers were protected. Statistical information provided by

software vendors indicated an unprecedented rush by users to obtain security patches and software updates addressing the vulnerabilities. As a result, the impact of Code Red and its variants

was significantly mitigated and serious impact to Internet performance was avoided.

Mr. Chairman, the information presented today highlights the

critical and effective relationship that exists between FedCIRC and

other members of the critical infrastructure community. Though

each contributes individually to critical infrastructure protection,

our strength in protecting information systems government-wide

lies in our collaborative and coordinated efforts. I trust that you

will derive from my remarks an understanding of the cyber threat

and response issues, and also an appreciation for the joint commitment to infrastructure protection of FedCIRC and the other members of the critical infrastructure community.

We appreciate your leadership and that of the Committee for

helping us achieve our goals and allowing us to share information

that we feel is crucial to the protection of our Nation’s technology

resources. Thank you.

Senator CLELAND. Thank you very much, Ms. McDonald. We will

open it up in a minute for a round of questions. Each Senator will

have 8 minutes in order to delve into some of these questions that

plague our country. One of the things that occurs to me on this

particular point of vulnerability to cyber warfare is a question that

I ask myself about the intelligence community, but what comes to

mind is that line by a humorist in Georgia, now deceased, Lewis

Grizzard, who once said that life is like a dog sled team. If you

ain’t the lead dog, the scenery never changes. I am looking for the

lead dog. Who is the lead dog among you here? Is there one? And

is that a problem?

15

In other words, it is interesting, Mr. Dick, you are director of the

National Infrastructure Protection Center, FBI. Mr. Tritak, you are

the director of the Critical Infrastructure Assurance Office, U.S.

Department of Commerce. Ms. McDonald, you are over in the Federal Computer Incident Response Center, GSA.

Do we have a lead dog in the Federal Government that runs the

war against cyber terrorism, Mr. Tritak?

Mr. TRITAK. Senator, under PDD 63, the lead person for coordinating government policy on critical infrastructure protection and

assurance issues is the National Coordinator for Security, Infrastructure Protection, and Counterterrorism at the National Security Council, and that is Richard Clarke. What they did is create

two basically parallel offices; one for operational threat assessment

and warning and the like. It is an interagency office that happens

to be housed at the FBI. That is Ron Dick’s.

The other was a policy, planning and support group with an emphasis on dealing with some of the cross-cutting issues of private

industry. So if you ask under the PDD 63 rubric, the person that

has front-line responsibility in oversight is Richard Clarke over at

the National Security Council. As I tried to indicate before, all this

is under review, and what is being considered now is how to not

only accomplish what Senator Thompson had indicated, which was

to establish the lines of authority, accountability, but, frankly, also

what are our policy priorities. If you have the best organizational

chart in the world, things won’t get done unless the matter is a priority with the backing of the highest guy in the land—the President of the United States.

I think there is no question under the current circumstances—

and I do not think it was a question before the circumstances of

September 11—that critical infrastructure protection is going to be

a priority for this President. But, as things are, the policy review

process is ongoing, but being wrapped up and, unfortunately, many

of the people who are involved in finalizing the policy review are

also very busy actually dealing with the terrorist problem we are

confronting at the moment. So if you ask me today: To what extent

is PDD 63 still in play? I would say that it is for the interim, but

I would also tell you that is going to change very soon.

Senator CLELAND. Mr. Dick, any comments?

Mr. DICK. No, I completely agree with John’s comments as to

who is in charge—that is according to the guidelines under which

we exist today and which are under review. I would like to make

one quick comment in agreement with Senator Bennett. No matter

who is in charge, the key to success that we have found is the

building of interagency cooperation to include the private sector.

We in the center, as I said, have been in existence for about 3

years. We have had a number of initiatives. One is called InfraGuard, a grassroots effort with security professionals in both cyber

and the physical world, to share information.

We currently have about 2,000 members throughout the country.

We have chapters in every one of our 56 field offices at the FBI

and even a few more cities across the Nation. We are working very

closely with the information sharing and analysis centers that are

formed within the private sector for banking and finance and electrical power and water, and we are working very closely, obviously,

16

with our partners in the Federal Government to share information,

and succeeding in getting cooperation in that. But the key to that

interagency cooperation is the building of one word, as I said in my

statement, trust.

Trust takes time, but trust is evolving. I think the things we

have seen that Sallie alluded to, with the Leaves virus, Nimbda,

where you saw a combining of law enforcement, intelligence community, private sector individuals coming together, really experts

in this field, determining what is the issue, what is the resolution

to it and providing to the public a means by which to mitigate and

solve the problem, was truly successful. And I think that across all

infrastructure protection, as well as homeland security, that is the

issue—is what Mr. Bennett alluded to, is the cooperation between

all of the agencies.

Senator CLELAND. Can I just underscore that? It does seem, and

I hate to inflict another comment on you, but I was thinking about

Casey Stengal’s great line when he was coach of the Yankees. He

said that it is easy to find the players, but it is tough to get them

to play together. It does seem to me that the challenge here is the

coordination of the existing assets, I mean, step one, and we are

all human beings. We all have our offices. We all have our departments. We all have our allegiances. Trusting someone outside that

department, outside the framework is the challenge. In other

words, building a team may be tougher than just putting some

names on an organizational chart.

Mr. DICK. And you are absolutely right and let me, if I may, give

you another, what I think, is a very good example. My experience

in being involved with the center for over 3 years and being the

director for the last 6 months, is that the people I have dealt with

in the other agencies, people I have dealt with in the private sector,

are all trying to do the right thing. There are no agendas here

going on in my opinion. These are people that are legitimately trying to do the right thing and figure that out.

One of the things, I think, is a success from our standpoint is the

relationship the center has built up with the Joint Task Force for

Computer Network Operations under General Bryant in the Department of Defense. General Bryant and I are in complete agreement about one thing, that I cannot do my job without JTFCNO

and the Department of Defense as an integral partner. And General Bryant agrees with that same statement. So we have built,

what I think and I think General Bryant does too, a very good

working relationship that is built upon trust and sharing information, and that information not being used in a wrongful manner.

But that takes time.

Senator CLELAND. Mr. Dick, I would like to observe, too, that we

are all trying to do the right thing here, too. If some person on the

National Security Council is the lead dog or the top coordinator or

the ultimate person to which this information is followed up, that

person is not confirmed by the Congress and it is tough for the

Congress to be part of the team. In other words, I do not think we

have the authority to call up Mr. Clarke and ask him how the war

against cyber terrorism is going? I mean, he is on the National Security Council. So that is just a challenge for us here as we try to

plug ourselves into our oversight responsibilities.

17

Ms. MCDONALD. Well, I certainly agree with both John and Ron’s

statements. We have come together as a team, because I think this

community, probably more than others, has recognized the

vulnerabilities in the cyber area, and recognized, as Dick Clarke

frequently says, that there will be an electronic Pearl Harbor. None

of us were expecting the events of September 11, and we in the

cyber community are hoping not to see anything of that magnitude

in this area. But if we do not all come together, if we do not devote

resources, if we do not correct the human capital situation that

Senator Voinovich addressed, we have a tough job ahead of us and

many challenges.

Senator CLELAND. Amen. Well said. Senator Carnahan, any

questions?

Senator CARNAHAN. Certainly, all of us would agree that we are

going to have to be looking into the types of attacks that we are

likely to face, and whether or not we are prepared for them in the

public or private sector. The attacks in New York and Washington

were targeted attacks. Is our infrastructure equipped to withstand

a larger geographical attack on a larger geographical area? I would

address that question to Mr. Dick, and also, could you explain how

NIPC is preparing for such a scenario, and what steps you are taking to help the private sector prepare for something of that nature?

Mr. DICK. Thank you. Obviously, whether we are prepared for a

particular attack depends on how big. Obviously, you can make a

threat scenario so large that you eventually lead to—well, everything is shut down, but in taking what would normally be perceived by the intelligence community and us as reasonable threats

that are out there, that are potential, that could occur—I think the

private sector and the U.S. Government entities, as well as State

and locals, are preparing themselves. Are they adequately prepared? No. Like the events of September 11, no one could have predicted, I think, with any great certainty that those things could

have occurred.

What has happened, though, in the last few years is a raising of

the awareness, if you will, of the need for the contingency plans

that I talked about in my statement by Mr. Seton, and with the

Mercantile Exchange in New York. Because of those efforts, this

particular company took a lot of time and effort to build these contingency plans. Has North American Electrical Liability Council

and all the electrical power companies done the kind of contingency

planning and consideration of redundancy issues that they should

have? Probably not, but I think with heightened awareness and coordinated planning, as Mr. Bennett was talking about, in cooperation with each other, we can achieve a very robust ability to respond and survive almost any kind of attack.

Senator CARNAHAN. Do you feel like you need additional resources or tools to be able to make NIPC more effective in this regard?

Mr. DICK. Well, absolutely. We are moving forward right now.

We have submitted a supplemental proposal and we are working

it through the Department of Justice and OMB as we speak, to address many of those issues to reach what we are calling full capacity to address these issues as they occur, and it will be through a

phased-in approach. But we have made that request already. What

18

I think is another issue here, and it is not just a matter of funding

to the NIPC or funding to the FBI—it is a matter of being able to

get the experts in this area, whether it be in the cyber, whether

it be in WMD issues, in the private sector, at the table with the

government to share what those vulnerabilities are and how those

fixes are occurring. So it is not just a personnel issue for governmental entities. It is much broader than that.

Senator CARNAHAN. One final question, Mr. Tritak. Certainly a

key component of our country’s ability to recover from a terrorist

attack is the government’s ability to continue functioning. I was

wondering if you could discuss what steps are being taken to ensure that the Federal agencies have the capability to continue functioning in the event of an attack, and with whom does this responsibility fall?

Mr. TRITAK. Well, Senator, actually, there is one piece of this I

can answer and there is another bit of it that, I think, probably

would be better discussed in another environment about the continuity of government and how we ensure you have a fully functioning government under all circumstances. But one thing we are

doing under my mandate, under PDD 63, is to assist agencies in

identifying the key critical services they provide, identifying the

systems that support those service deliveries as a way of mapping

potential dependencies and vulnerabilities that they have to address and safeguard.

So for example, and I use this in my written testimony, I think

everyone would agree, for example, that a timely warning of a hurricane would be a vital service the government needs to provide.

Ensuring that service is deliverable—it is not sufficient simply to

make sure that the Tropical Prediction Center in Miami, Florida

works. The fact of the matter is, a number of inputs from other

government agencies and private sector entities feed into that system. Some of those, if disrupted for even brief periods of time, could

actually impair the delivery of vital information that warned of

hurricanes with the result in loss of life if it is not brought up

quickly.

So one of the things we are all doing in accelerating, and this is,

in fact, something that is fully supportive of the efforts that were

passed under the Lieberman-Thompson bill of last year, is to accelerate that mapping process within each of the civilian agencies,

where we focus on the civilian agencies, because, frankly, the Defense Department, they do this as a matter of course. So in that

respect, what we are looking at is ensuring critical government

services. In some of those cases they rely on private sector infrastructure service providers to help. We have given these agencies

a way of identifying what they have to prioritize and pay attention

to to ensure that those services, whether they are Social Security

checks, hurricane warnings, or mobilization of U.S. forces to project

power overseas can be done.

Senator CARNAHAN. Thank you.

Ms. MCDONALD. Senator Carnahan, if I could add, the General

Services Administration is also charged with continuity of government operations. As you probably know, we not only have the Federal Technology Service, which provides long-distance telecommunications service and information technology service, but we also

19

have the Federal Supply Service that has been instrumental in providing supplies both to New York and the Pentagon, and we have

the Public Building Service where we provide office space, etc. So

we do have contingency plans to reconstitute government as far as

buildings, technology, and supplies are concerned.

Senator CARNAHAN. Thank you.

Senator CLELAND. Thank you very much. Senator Bennett.

Senator BENNETT. Thank you, Mr. Chairman. Mr. Dick, can you

tell us how many people are actually doing analysis in your information sharing unit?

Mr. DICK. I think there are 10 or 12 that are FBI employees. I

would have to confirm those numbers. From an interagency standpoint, we probably have another four or five. Now, that is just

doing analysis. Within the center, we have a total of approximately

90 FBI and 20 interagency folks.

Senator BENNETT. I understand that in November 2000 the FBI

director wrote to Sandy Berger complaining that the other Federal

agencies did not recognize NIPC’s mission, and he said NIPC would

not be able to provide analysis and warning, if the NSC did not,

in fact, assist NIPC in obtaining personnel. Are you aware of that

letter or of that concern and do you share that concern?

Mr. DICK. I am aware of the letter and I share that concern. As

I spoke a moment ago, to one of the key factors of the success of

being able to provide strategic analysis, is the interagency nature

of being able to get many people from different disciplines to look

at the same data, and to determine if the vulnerability in the banking and finance sector is applicable to the electrical power sector.

And that is one of the findings that was referenced by Mr. Thompson in the GAO report. In fact, my reading of the GAO report was

that it said we did investigations pretty well and we did outreach

pretty well, because of InfraGuard and some other things, key

asset initiatives. It said we did training pretty well. So we did a

number of things pretty well.

But what it said we did not do very well was strategic analysis.

They said we did not do strategic analysis very well, meaning predictive analysis, because we did not have the resources, both from

an FBI standpoint, but more importantly, from an interagency

standpoint. And it has been my public position that GAO was right.

You know, their conclusion was absolutely correct, but——

Senator BENNETT. It always bothers you when that happens.

Mr. DICK. Yes, it does, but I try to get over it. We have been

working very diligently with other partners, and there has been

some response from many of the agencies in providing us resources.

Senator BENNETT. That was going to be my next question. Have

things gotten any better since November 2000?

Mr. DICK. They have gotten better. The CIA has provided a senior officer to head the analysis and warning section, and it made

a commitment for multiple years for that person to be engaged

there. He is an excellent person. Behind me here, the Department

of Defense has sent over a two-star Rear Admiral from the Navy

to be my deputy director for the center, Admiral Plehal. He is

working very diligently with the other Department of Defense

agencies to fill those gaps that we have talked about before. The

20

National Security Agency has sent over a senior analyst to head up

the analysis and information sharing unit.

So there have been a number of issues that we have made

progress on. Are there still gaps? Yes, sir, there still are gaps, but

I am seeing greater cooperation, and I think since the events of

September 11, there has been an even heightened awareness of the

need for participation and sharing of information within the center.

Senator BENNETT. Well, let me ask all of you, you have referred

to this collaborative analysis, who has the ultimate responsibility?

Mr. DICK. For production of products?

Senator BENNETT. Yes.

Mr. DICK. Generally, the center is the one that assists in the production of that and coordinates the production of that, along with

others, particularly in the private sector, and then pushes those

products out. One of the things that you have to keep in mind, a

lot of the solutions are not necessarily government solutions.

Senator BENNETT. Oh, I understand that. I am just talking about

the analysis here, and you are saying it is focused in the NIPC and

the FBI.

Mr. DICK. But it is a collaborative effort, where like—as Sallie

was talking about on the Code Red worm, we bring the unique

skills that each of us possessed together to look at a particular

problem or issue, and then come up with mitigation or a solution.

So it is not us in the center alone. It is a partnership with the others, a big partner, private sector, the antivirus community, and the

other software vendors.

Senator BENNETT. Yes, and that is what my legislation is trying

to address, to increase that partnership with the private sector, but

if the Chairman can quote baseball, if I were advising Tom Clancy

on his next novel, who would be the official who would go running

to the Oval Office and say, ‘‘Mr. President, an attack is coming,’’

and our analysis shows this from the private sector creates a pattern that we discover that holds with the Defense Department, and

the CIA tells us and so on. Our analysis shows that there is going

to be a major incident coming, on the Tom Clancy mode, would that

be Dick Clarke who would go forward with that? Would that be the

director of the FBI? Would the director of the FBI tell the Attorney

General? Who? Who ultimately is the one in whose mind that the

alarm bell should go off that, ‘‘Hey, this pattern of analysis shows

we have a major, major vulnerability here, and it looks like somebody is getting ready to exploit it?’’

Mr. DICK. Yes, I think it would be a collaborative effort. Obviously, we are in direct contact with Mr. Clarke and the National

Security Council almost on a daily basis because of the events of

today. So when you are saying who is going to run and brief the

President, those briefings that occur every day with the Attorney

General, the director of the FBI, and representatives from the National Security Council. In the kind of event that you are talking

about, there are sensors out within the private sector, but also

within CIA, NSA, DOD, the FBI, and all of that intelligence is

churned together to make those briefings. So I do not know that

there is a person that would be running up to the President.

21

Senator BENNETT. Do you have any expectation, and I realize

this is speculation, but let’s speculate—do you have any expectation that Governor Ridge will become that person?

Mr. DICK. I have not seen the final—or I have seen a draft of the

executive order, but I do not know how that is all going to flesh

out.

Senator BENNETT. Either of the other two? Do you have any—

Mr. TRITAK. I will venture a speculation, which hopefully I will

not pay for. [Laughter.]

Senator BENNETT. We will protect you.

Mr. TRITAK. I think it is fair to say that just based on administration statements recently, there is going to be someone who will

be responsible for this—recognizing there are channels of constant

communication on intelligence matters with the FBI and everybody

else—there will be somebody who will, in addition, have a responsibility for reporting those sorts of things to the Cabinet and therefore the President. It is a question of who and under what circumstances, and I think that is what is actually being worked out.

I think what is informing your question is the recognized need

to ensure is that there is someone with sufficient authority, accountability, and has the ear of the President who is going to be

able to communicate these concerns in a timely manner, and I

think that there is every effort from what I can tell, just in the various reviews that have been going on at an accelerated pace, that

the answer will be yes, there will be someone responsible. What we

cannot tell you now is who, for sure.

Senator BENNETT. If I may, Mr. Chairman, I am asking these

questions of the administration. If someone were to turn the tables

and say who in the Senate would be the one to alert Leader

Daschle, we would not have an answer to that on this side of the

dais. Thank you very much for your testimony and for your service

in this area.

Senator CLELAND. Thank you very much, Senator Bennett. Senator Domenici.

OPENING STATEMENT OF SENATOR DOMENICI

Senator DOMENICI. Thank you, Mr. Chairman. I apologize for

being late and I am sorry I did not get to hear whatever you had

to say before I arrived.

I just want to make two observations, Mr. Chairman. It would

be good to have before us how many meetings we have had of this

type, talking about better coordination among the important aspects of the government and the people, so that they know what

is happening and what might beset them and their families. Most

of those hearings would be drab and dull, and maybe if the Committee had not reported so many bills during the year, it might report one on the subject of coordination, so that we would not just

add to another tall list of coordination requirements.

I will not say people in the government will not follow them, but

I would suggest there would not be a great deal of urgency about

getting them operative, solving problems within the legislation that

requires meeting for this and meeting with this leader or that person. I would hope that has ended, and I would hope that you, Mr.

Chairman, and the Chairman of the Committee, would consider the

22

subject matter of this hearing something serious enough that within a very reasonable time, it should be achieved.

We should have legislation that does something with reference to

this area of infrastructure, organizationally speaking, so as to preserve it and make sure we know what we are doing and others can

rely upon what we know. I happen to have a bill that is before us,

S. 1407, the Critical Infrastructure Protection Act. It follows in tandem with what we understand the President’s proposals are going

to be, by way of executive order. I am hopeful that soon, whatever

other bills are going to be introduced and considered, that our

Chairman will proceed with dispatch to mark up this kind of bill,

unless to be effective, we need to do a lot of other bills.

I have not passed judgment on that yet myself, but obviously a

very big vacuum existed in terms of communicating to someone

about a problem that was going to fall upon our people on that now

infamous day, September 11. I compliment you and this Committee, because I think this is not normally very exciting work. But

we ought to do something with the smartest people we have and

the equipment we are capable of buying and putting in place if we

think the problem is serious enough. We surely can do much better

than we have done, and we can have in place within a year something much better than we have by way of infrastructure safety, cooperation, and information exchange.

Thank you for what you all do. I am going to wear my other hat,

which I am a little bit better known for, the budgeting part, and

I am going to go talk about the stimulus. I have already chatted

with you, so I kind of know what you think. Maybe we can get

something done on that quickly, too, let’s hope.

Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Domenici. Thank you for

stimulating and underlining the need for increased coordination

and cooperation on this vital issue of security, in terms of our cyber

world, both public and private, and just to point out and underscore the Senators concern if we cannot get together public entities,

private entities, Legislative and Executive Branches—if we cannot

get together now, under these circumstances, when will we ever get

together? So that is our charge.

We would like to thank the panelists for your time and attention.

Thank you very much. We would now like to call the second panel.

We thank you all very much for coming today, and we would like

to welcome Frank Cilluffo. He is the senior policy analyst and deputy director for the Global Organized Crime Project, from the wellknown and well-respected Center for Strategic and International

Studies, which I understand the board of trustees is chaired by my

friend, Senator Sam Nunn, from Georgia. You are a senior policy

analyst and recently chaired two homeland defense committee

hearings on counterterrorism and cyber threats and information security at CSIS. We welcome you today.

Jamie Gorelick, the Vice Chair of Fannie Mae, who, as you know,

is a private shareholder-owned company that works to make sure

mortgage money is available for people in communities all across

America. We welcome you today.

Joseph Nacchio, Chairman and CEO, Qwest Communications,

and Vice Chairman of the National Security Telecommunications

23

1The prepared statement of Ms. Gorelick appears in the Appendix on page 70.

Advisory Committee. We would like to learn more about that.

Qwest Communications offers local and long distance telephone,

wireless, and Internet web hosting services over a state-of-the-art

network to homes, businesses and government agencies in the

United States and around the world.

Kenneth Watson, President, Partnership for Critical Infrastructure Protection Security, who is very much involved in dealing with

these threats and vulnerabilities, countermeasures and best practices within and between industries. We are delighted to welcome

all of you here.

May I just throw out a couple of questions here that you can respond to, please? The President has put forward the notion of an

Office of Homeland Defense. It is interesting that it has cabinetlevel status, and it needs it, and the office will report directly to

the President, and I think that is very much needed. However, interestingly enough, the Rudman-Hart Commission that looked for

2 years at the question of American defense focused more and

more, because of the testimony they received, on a terrorist attack

and concluded that—a year ago, in their report—that it was not a

question of whether a terrorist attack would come on this country,

but when, and therefore recommended a full-blown agency of homeland defense, in effect with a budget of its own and, in effect, infantry, troops, people at its command, Border Patrol and so forth, the

Coast Guard and the like, that could be put into operation in terms

of homeland defense.

We just want to let you know that is something that is on my

mind as you now have an opportunity to give an opening statement, and we will start off with Ms. Gorelick.

TESTIMONY OF JAMIE S. GORELICK,1 VICE CHAIR, FANNIE

MAE

Ms. GORELICK. Thank you very much, Senator Cleland, and I

very much appreciate the opportunity to be here. I testified on this

subject, I think, the first time before this Committee in July 1996,

and I said at the time that I hope we would not have to see the

electronic equivalent of Pearl Harbor before we did something substantial. We have not had an electronic Pearl Harbor, but we have

had a Pearl Harbor, and it, I think, puts what we are doing as a

country in a different perspective.

As Senator Thompson said just a little while ago, we are seeing

things through different glasses. I have a long interest in this

issue. I came to the Department of Justice from the Department of

Defense. At the Department of Justice, where I served as deputy,

I was in a position—not unique, but there are not very many people who see both domestic and foreign intelligence on a daily

basis—that caused me to be very concerned about our national infrastructure and the lack of responsibility for protecting it, particularly in the area of cyber security (but also our entire national infrastructure).

We started a Working Group which resulted in a Presidential

Commission, which resulted in PDD 63. I have been long interested

in these issues. I currently serve on the Director of Central IntelVerDate 11-MAY-2000 13:54 Jul 09, 2002 Jkt 000000 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 77434.TXT SAFFAIRS PsN: SAFFAIRS
24

ligence National Security Advisory Panel and on President Bush’s

National Intelligence Review Panel. So I have kept an interest in

these things. I am here as Vice Chairman of Fannie Mae, to comment on the readiness of the financial services sector of our economy, but also with this background.

So let me make a couple of comments and see if I can come back

to the question that you posed, Senator Cleland. We have realized

as a country, for now 5 or 6 years, that we need to have a hardened-against-attack private and public infrastructure. We need to

have the comprehensive ability to detect intrusions. We need to

have comprehensive planning, warning, and operational response

capabilities.

The two original actions that emerged from the Presidential

Commission did, as we just heard from the last panel, create two

efforts, a law-enforcement effort and an effort to get industry to

where it needed to be. There has been progress, but frankly it has

not been enough. The events of September 11 serve, if nothing else,

as a wake-up call. From the point of view of industry, the original

concept was that industry should be encouraged, if you will, to

work together to form such things as the Partnership for Critical

Infrastructure Security, and various information sharing analytic

centers, to work together.

That made sense, because industry asked the Commission not to

put in place government command-and-control of industry infrastructure. And there was, as you have heard from the previous

panel, a decided lack of trust between industry and government. So

the first step was to build trust and each industry was to be encouraged to work together. Various of these information sharing

and analysis centers have, in fact, been stood up. I would say to

you—and I have submitted my testimony in greater length on this

subject—that there is an uneven range of results, uneven participation, uneven robustness of capacity. And in some industries, the effort is still nascent.

These ISACS, by and large, have no funding, no permanent staffing, no real operational capability. So when you point out, Senator,

as you have quite appropriately, that 90-plus percent of the information infrastructure on which this country’s security rests belong

in the private sector, that private sector’s organizations to deal

with this issue are not, I think, where they need to be. I think now,

perhaps with the greater sense of urgency, there will be a greater

willingness on the part of industry to step up to the plate and also

to accept help from the government.

I think we need a more realistic approach, one in which the government does more to bring industry together for the sharing of information. We need a new legal rubric, and I commend Senator

Bennett for addressing the Freedom of Information Act issue and

the antitrust issue, both of which will bring greater coordination to

and greater flow of information from the private sector to the government. And we need greater clarity on chain of command, if you

will, within the governmental structure.

I would say one word about law enforcement. The NIPC is to be

commended for the work that it has done. To the question that all

of you have asked, the FBI is in charge, under PDD 63; it is very

clearly the lead agency. But if you look at the resources that the

25

1The prepared statement of Mr. Nacchio appears in the Appendix on page 76.

FBI in general has had to fight terrorism, compared to the resources that a CINC would have to protect the national interest,

say, in the Pacific, it is absolutely dwarfed. There is no relationship

between the job and the resources.

The worry that I have about a coordinator in the White House

is that we will not get to the point of real homeland security and

defense, the way the Defense Department would step up to it if it

had that job. I do not know what the thinking is in that regard,

since I am not in the government. But I would say to you, having

served in both places, there is no one in the government with the

operational capacities and the wherewithal of our Defense Department. And unless you get to that level of scale and capacity to protect our national infrastructure, we will, I am afraid, remain at

risk.

There is no one currently doing the kind of planning we need

done, and there is no capacity, for example, that I am aware of for

a military response to a cyber attack on the private sector.

Thank you.

Senator CLELAND. Fascinating testimony, Ms. Gorelick. Thank

you very much. Powerful. Mr. Nacchio.

TESTIMONY OF JOSEPH P. NACCHIO,1 CHAIRMAN AND CHIEF

EXECUTIVE OFFICER, QWEST COMMUNICATIONS INTERNATIONAL, INC.

Mr. NACCHIO. Thank you, Mr. Chairman and Members of the

Committee for inviting us. It is an honor to be here this morning.

Let me begin by first introducing who we are. We are not as wellknown as most other big companies. We are a 5-year-old Fortune

100 company. We have 66,000 employees and revenues of about

$20 billion. We provide local, long distance, Internet, broadband,

and wireless services across the United States and Western Europe, and we own the incumbent local telephone company in 14

Western States. We also provide services to agencies of the U.S.

Government, notably the Departments of Defense, Energy, and

Treasury.

I am also testifying today, as you noted earlier, in addition to my

capacity as Chairman and CEO of Qwest, as the Vice Chairman of

the National Security Telecommunication Advisory Committee

(NSTAC), and I bring to that organization all of my experience in

the industry, about 30 years, and a deep concern on this issue, an

issue we have been addressing for the better part of the last 3

years. In cyberspace, we have been at war for 3 years. It is now

just catching up to the general consciousness of the country.

We are constantly hit with viruses and almost ironically, the success that the telecommunications industry has had over the last 30

years in defending against physical attacks and nuclear war, has

now made us vulnerable in cyberspace. Although we have moved

much of the physical layer out of danger, although there is still

some danger, we now have cyber defense as one of our biggest

issues.

I would tell you though, that instead of focusing just on vulnerability, we should also look at resiliency. And, as the President reVerDate 11-MAY-2000 13:54 Jul 09, 2002 Jkt 000000 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 77434.TXT SAFFAIRS PsN: SAFFAIRS
26

assured the Nation 2 weeks ago that the state of the Union is

strong, I would tell you this morning and assure you that the telecommunications infrastructure of this country is strong.

Our infrastructure and telecommunications is the best in the

world. Our engineers, technicians and workers maintain it second

to none, and we saw that proof on September 11, because despite

the horrific damage at the World Trade Center and at the Pentagon, most of the Nation’s telecommunications and Internet infrastructure worked flawlessly at a time of increased demand.

The problems were isolated to the end links in the network. We

had wireless overlays in play. It was far better than most people,

I think, would have imagined. At ground zero in New York, telecommunications companies put aside their everyday marketplace

rivalries, including ourselves. For example, we diverted a multimillion dollar shipment of equipment that was supposed to come to

us in the West directly to Verizon, so that we could restore those

central offices down on West Street. We worked with FEMA to provide communications between the two critical locations in lower

Manhattan the day after the attack, and we provided Internet connections and services to all who had lost them.

Similar efforts were made by other telecom companies. We have

a collaborative industry, and in this case, it was praised by FCC

Chairman Michael Powell, who quoted it as a heroic act, ensuring

the world’s premier communications network has continued to be

available in times of tragedy. So we should look at both the

vulnerabilities and the resiliency of our infrastructure, and understand how resiliency came to pass: It has been through collaborative efforts that have occurred over the last 20 or 30 years.

The telecom industry understands that our networks are quite

literally the conduits that connect the world and the essential sectors of the economy, and keeping both our internal and external

networks safe is something that the companies in our industry do

every day and will continue to do. Let me give you two examples

that make this real from our own experience.

First, to defend our internal Qwest physical network from physical and cyber attack we have implemented a comprehensive information network security program which includes classification of

the network assets, the implementation of a complete set of security policies and procedures, extensive employee training and a

plan for disaster recovery and reacting to disasters.

The NSTAC leadership has broadly circulated the Qwest program, encouraging the other members of NSTAC to implement a

similar program.

Second, to protect our external networks, just last month we

dedicated 1,000 technical experts to assist our customers affected

by the global Code Red computer virus, which penetrated our firewalls and took down our customer networks. Such a quick and

comprehensive response is what is necessary across all networks.

But doing it in our own networks is not enough. Doing it inside the

telecommunications infrastructure is not enough. Other industries

need to take similar steps because we are all interconnected in

cyberspace.

It is no longer important to just protect your physical layer. You

have to protect the software layer. We are all connected. Each comVerDate 11-MAY-2000 13:54 Jul 09, 2002 Jkt 000000 PO 00000 Frm 00030 Fmt 6633 Sfmt 6633 77434.TXT SAFFAIRS PsN: SAFFAIRS
27

1The prepared statement of Mr. Cilluffo appears in the Appendix on page 83.

pany must therefore protect its own network, assets and people,

and all companies must coordinate those actions. I have some very

specific proposals that I think address this.

First, NSTAC and the National Security Council should immediately initiate a project to develop benchmarks and requirements

for information security best practices for the telecommunications

industry and its users, because again we are interconnected. Either

NSTAC or another public organization, such as the National Infrastructure Simulation and Analysis Center, proposed by Senator

Domenici, should be given the responsibility to extend these clearinghouse and coordination functions to other industries and other

agencies, as well.

Second, I think Congress should remove the perceived barriers to

information sharing. Your legislation, Senator Bennett, with Senator Kyl, is critical to allow us to share information safe and secure, so that the information we are sharing with the government

does not fall into the hands of the perpetrators to begin with, under

the Freedom of Information Act, and we can collaborate without

the threat of antitrust, based upon the national security needs.

Third, and this is very important to us who are fighting this

every day, we need legislation increasing the penalties for cyber attacks. This is not a humorous subject for hackers. It has to be a

serious subject. It costs money. It costs time. It puts people in vulnerable circumstances when they lose their communications infrastructure. We need to give law enforcement greater latitude to investigate and to prosecute these attacks.

Let me conclude by saying that the telecommunication infrastructure is strong. There is more work to be done, but it can and

must be made stronger, and I know that we at Qwest and my colleagues in the communication industry will do whatever is necessary to help this Committee, the Congress and the administration to ensure the continued strength of America’s telecommunications infrastructure.

Senator CLELAND. Thank you very much, sir, for that very strong

testimony. Mr. Cilluffo.

TESTIMONY OF FRANK J. CILLUFFO,1 CO-CHAIRMAN, CYBER

THREATS TASK FORCE, HOMELAND DEFENSE PROJECT,

CENTER FOR STRATEGIC AND INTERNATIONAL STUDIES

Mr. CILLUFFO. Mr. Chairman, Senator Bennett, it is a privilege

to appear before you today to discuss this important matter. In the

wake of the terrorist attacks on the World Trade Center and the

Pentagon, the United States is confronted with harsh realities.

Our homeland is vulnerable to physical attack and gone is the

sense that two oceans that have historically protected our country

can continue to protect Americans. The terrorists attack highly

visible symbols, not only of military strength, but also of our economic prowess. Though exceedingly well-planned, coordinated and

executed, the comparatively low-tech means employed by the terrorists raises the possibility of a cyber strike or perhaps a more inclusive, more sophisticated assault combining both physical and

virtual means on one or several critical infrastructures.

28

As we will never be able to protect everything, everywhere, all

the time, from every adversary and every modality of attack, now

is clearly the time for clearheaded prioritization of policies and resources. Unless we examine this issue in its totality, we may simply be displacing risk from one infrastructure to another. We need

to approach the issue holistically and examine the dangers posed

to our critical infrastructures from both physical attack, a wellplaced bomb, and cyber attack, and perhaps most important where

the two converge.

Infrastructures have long provided popular terrorist targets.

Telecommunications, electric power systems, oil and gas, finance

and banking, transportation, water supply systems, and emergency

services have been frequent targets to terrorist attacks, and I listed

a bunch in my prepared remarks. The destruction or incapacitation

could have a debilitating effect on U.S. national or economic security, clearly the reason for this hearing and others.

One should state that bits and bytes or bugs and gas, for that

matter, will never replace bullets and bombs as the terrorist weapon of choice. Al Qaeda, in particular, chooses vulnerable targets

and varies its modus operandi accordingly. They become more lethal and more innovative with every attack. While bin Laden may

have his finger on the trigger, his grandchildren may have their

fingers on the computer mouse. Moreover, cyber attacks need not

originate directly from Al Qaeda, but from those with sympathetic

views, and given the anonymity of cyberspace, it is very difficult to

discern who is really behind the clickety-clack of the keyboard.

For too long, our cyber security efforts have focused on the beep

and squeak issues, and it focused on the individual virus or hacker

du jour in the news, often to the neglect of the bigger picture. It

is now time to identify gaps and shortfalls in our current policies,

programs and procedures, begin to take significant steps forward

and pave the way for the future by laying down the outlines of a

solid course of action that will remedy these existing shortcomings.

Along these lines, there have already been a series of actions

taken, some prior to September 11, some post. In particular, I do

applaud the creation of the new cabinet-level Office of Homeland

Security, directed by Governor Ridge. It is my understanding that

a comprehensive review will be completed by next week, which will

set out the office’s roles, missions, and responsibilities. We will

then have a better sense of the explicit roles and responsibilities

pertaining to homeland security and how they directly impact critical infrastructure protection, and as was mentioned earlier, there

was already an executive order in the works, about to be signed,

on cyber security. So this is clearly something the President has

been engaged in, in advancing our cyber defenses, for quite some

time.

To get to the point you have brought up earlier, Mr. Chairman,

this attack was a transforming event. Many have claimed that the

Office of Homeland Security may not have the authority to succeed.

Well, I disagree. One cannot look to history alone to identify what

organizational model will be most effective. Because this is the

highest priority facing our Nation today, organizational charts, titles, and line items, boxes, historic emblems of bureaucratic power,

fade to the background. Governor Ridge will have the ammunition

29

required to carry out his responsibilities because he and his mission have the full confidence of the President of the United States.

But even an undertaking of this importance takes time to move

from concepts to capabilities. Once the immediacy of the problem

has settled into routine, perhaps several months from now, we

should consider codifying and institutionalizing its mission with

congressional legislation and additional statutory authority if needed, but I think we have to crawl before we run. As both the Executive Branch and the Congress consider how best to proceed in this

area, we should not be afraid to wipe the slate clean and review

the matter with fresh eyes.

We need to be willing to press fundamental assumptions of national security. Critical infrastructure protection and information

assurance are cross-cutting issues, but our government is still organized along vertical lines in their respective stovepipes. When we

do this review, we should do it with a critical eye, not only one that

appreciates how far we have to go, but also where we have come,

and there have been some centers of excellence, both in government and the private sector, that we should leverage and build

upon.

Ultimately, it is essential that any strategy encompasses prevention, preparedness and incident response, vis-a-vis the public and

private sectors and the interface between them. What we need is

a strategy that would generate synergies and result in the whole

amounting to more than simply the sum of its parts, which is currently the case.

Information technology’s impact on society has been profound

and touches everyone, whether we examine our economy, our quality of life, or our national security. Unfortunately, our ability to

network has far outpaced our ability to protect networks. Though

the myth persisted that the United States had not been invaded

since 1812, invasion through cyberspace has been a near-daily occurrence, a marked counterpoint to September 11 attacks.

Fortunately, however, we have yet to see the coupling of capabilities and intent, aside from foreign intelligence collection, where the

really bad guys exploit the really good stuff and become

technosavvy. We have not seen that marriage, but in my eyes that

is a matter of time. Let me jump very briefly—I have laid out a

number of recommendations that I thought we should be looking

to in terms of building this partnership. As to who is responsible,

it is a shared responsibility.

The government must, however, lead by example. Only by leading by example and getting its own house in order can they expect

the private sector to commit the resources in both time and effort

to get the job done, and we need to clarify accountability. We need

to clarify roles and missions. Right now, there really is no one held

accountable, and clearly that is going to be something that will be

examined with all the new executive orders.

Let me skip through the rest and close with a couple of initiatives that can be taken to incentivize the private sector. First, from

the government perspective, by improving the resilience of our economic infrastructure we improve the government’s readiness, because so many of these critical functions are owned and operated

by the private sector. But, second, we also improve our economic

30

1The prepared statement of Mr. Watson appears in the Appendix on page 98.

security, which cannot be seen as black or white. These are now

blurred.

We need to encourage standards to incentivize the private sector.

We need to improve information sharing, and I wholeheartedly applaud Senator Bennett’s initiative in this area, because FOIA has

been a significant obstacle to sharing information between the public and private sector. We can also look at liability relief. Government could provide extraordinary liability relief to the private sector in the case of cyber warfare, similar to the indemnification

authority set up in the case of destruction of commercial assets

during conventional warfare. So these are some of the areas we can

look to.

Mr. Chairman, I know I am over my time. I have rarely had an

unspoken thought. Forgive me, but not to digress, but I would like

to close by saying thank you. We have all done some soul-searching

in the last couple of weeks. I, for one, have never been so proud

to be an American, proud of our President, proud of our Congress,

and proud of the millions of Americans that make this country

great. I believe we have all emerged from this with a stronger

sense of purpose and appreciation of our Republic and its institutions.

This is precisely what our forefathers had in mind. We were put

to the test. We will prevail. They will fail. And critical infrastructure protection is clearly an important element to improving our

Nation’s security.

Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Mr. Cilluffo. Wonderful, strong

statement. We are proud of you, too, and all of you.

Mr. Watson.

TESTIMONY OF KENNETH C. WATSON,1 PRESIDENT, PARTNERSHIP FOR CRITICAL INFRASTRUCTURE SECURITY (PCIS)

Mr. WATSON. Good morning, Mr. Chairman and Senator Bennett,

I am honored to be here today on behalf of the more than 70 companies and organizations from all the critical infrastructure sectors

that comprise the Partnership for Critical Infrastructure Security,

or the PCIS. The question: ‘‘Critical infrastructure protection: Who

is in charge?’’ is timely, but may not have a quick and easy answer,

as we have heard many times today.

We would all like to be able to turn to a single government or

industry executive or agency with the authority and responsibility

to assure the continued delivery of vital services to our citizens in

the face of these new and emerging threats. The truth is that the

infrastructure architecture requires a distributed leadership, cooperation, and partnership to accomplish that goal, exactly what

Senator Bennett said earlier.

I would like to describe for you the environment of the critical

infrastructures, explain what we were doing before the horrendous

attacks 3 weeks ago, and what has changed since then. I will also

make a few recommendations.

Over the last 10 to 20 years, the network of networks has truly

changed the way we live and work. There is no turning the clock

31

back. This has brought about unprecedented levels of productivity

and profitability; however, each industry is now more dependent on

every other than before, and all have come to depend on computer

networks for core operations, not just as a business enhancing tool.

The Federal Government cannot function without services provided by the private sector infrastructure owners and operators.

Most of these are multinational corporations with an interlaced

network of suppliers, partners and customers, many of whom are

outside the United States. The Internet itself relies on key name

servers and routers located around the world with no central ownership or authority. Therefore, the health of the global economy is

directly related to America’s national and economic security.

Just as the Internet is open, borderless, international and unregulated, responsibility for protecting critical infrastructures is

distributed among companies and government organizations. Form

follows function. This applies not only to architecture, but also to

how we organize to protect our critical infrastructures. Even with

the best of intentions and the most modern tools, the Defense Department could not defend against a cyber attack on the information systems of a power plant in Omaha. That power plant must

have the technologies and teams to defend itself and to prevent

cascading effects beyond its own perimeter, and it must be connected to a distributed indications and warning system in order to

be able to respond quickly and proactively.

Also, since every unsecured computer connected to the Internet

could be used as a zombie in a distributed denial-of-service attack,

these tools, teams and warnings must become part of every business’ standard networking procedures. Activities that an enterprise

can take: Conducting vulnerability and risk assessments; deploying

security technologies; investing in research and development;

resourcing and enabling incident response teams must now be distributed and coordinated.

Many in industry and government have been focusing on how to

accomplish this coordination for at least the last 5 years. The President’s National Security Telecommunications Advisory Committee,

or NSTAC, has been providing advice on national security and

emergency preparedness issues in the telecommunications sector

since 1982. The NSTAC is still extremely relevant, even more

today, conducting studies and holding network security information

exchanges on current issues.

The President’s Commission—as has been mentioned several

times—on Critical Infrastructure Protection, reported in October

1997, recognizing the need for close public-private coordination,

that applies to all the infrastructure sectors. Industry responded to

the government’s invitation to a dialogue by launching the Partnership for Critical Infrastructure Security at the World Trade Center

in December 1999. Since its formation, the PCIS has become a

model for cross-sector coordination and public-private cooperation.

Last year, the PCIS identified barriers to information sharing

with government, and now Senator Bennett’s bill and others in

Congress are working through legislation based on our findings.

During the response to the Code Red worm, government and industry turned to the PCIS to represent industry alongside the NIPC

and security experts as we made the public service announcement

32

that ultimately blunted the impact of that infestation. Inthe coming year, the administration will publish a public-private national

plan for critical infrastructure protection, with industry sections coordinated by the PCIS.

This is not just an American problem. Several countries are establishing similar partnerships. The PCIS is forming close relationships with them and we are collaborating several areas. We are

currently working with critical infrastructure protection organizations in Canada and the United Kingdom, and we are following

similar activity in Switzerland. The United States and Australia

conducted a bilateral meeting in August, 2 months ago, where we

agreed to cooperate on security standards and in other areas.

One of the keys to success is the timely sharing of information

about threats, vulnerabilities, countermeasures and best practices

within and between industries and between the public and private

sectors. Information Sharing Analysis Centers, or ISACs, are proving their value as both computer defense centers and awareness vehicles. There are currently five ISACs in operation: Financial services; telecommunications; information technology; electrical power;

and oil and natural gas.

These ISACs have shared information on threats to members and

helped their sectors prevent damage and disruption from threats

like the Code Red and Nimda software worms. The telecom ISAC

is able to share vital information from the government to industry

that has been proved both valuable and timely. Four additional

ISACs are in various stages of development: Railroads; aviation;

water; and information service providers, or ISPs. One of this

year’s top goals for the PCIS is to establish a cross-sector and public-private information sharing architecture.

With the same goal, the existing ISACs, under the leadership of

the National Communications System, met last week to work out

a cross-sector operational information exchange capability. This

meeting greatly accelerated the progress we have made in this area

and the procedures they develop will form the foundation for the

overall cross-sector architecture.

What has changed since September 11? The terrorist attacks on

the World Trade Center and the Pentagon did not change the architecture of the new economy or our interdependency, or the interlinked nature of the economy’s national security in the nations of

the world. What those attacks did was create a sense of urgency

and an increase in security awareness. Just as the administration

carefully and deliberately seeks out those that conducted and supported these barbaric acts and learns about this new battlefield environment, I urge everyone involved to take the time to understand

the infrastructure environment and not to move too quickly to try

to solve the infrastructure protection problem.

So what can we do to protect our critical infrastructures? We

need to raise the security bar worldwide, by streamlining communication and coordination, accelerating research and development,

practicing good network security, and by not abandoning our values. I have four recommendations: First, support the administration initiatives to streamline coordination within the Federal

Government. We will continue to work closely with the Critical Infrastructure Assurance Office, the National Infrastructure ProtecVerDate 11-MAY-2000 13:54 Jul 09, 2002 Jkt 000000 PO 00000 Frm 00036 Fmt 6633 Sfmt 6633 77434.TXT SAFFAIRS PsN: SAFFAIRS
33

tion Center, and the national coordinator, as the government organizes itself to manage homeland security, counterterrorism, and

critical infrastructure protection.

Second, support initiatives that will secure the next generation’s

network of networks, as well as patches and fixes we are applying

today, by providing resources to government agencies with increased responsibilities in this area and providing funding for research. To assist in this effort, the PCIS is developing a research

and development roadmap that will include a gap analysis of current industry, academic and government programs, and recommendations for focusing resources to meet sector and cross-sector

needs.

Third, encourage government organizations, businesses and individuals to practice sound information security, starting by adequately funding network security programs in all Federal departments and agencies; updating passwords, disallowing unauthorized

accounts and unneeded services and installing firewalls and intrusion detection are no longer just common sense, but a matter of

cyber civil defense.

And, last, carefully consider the impact of any new legislation on

the freedoms Americans cherish: Individual privacy; freedom of expression; and freedom of entrepreneurship. We all understand that

without security there is no privacy, but we must always strive for

balance. My colleagues of the PCIS and I welcome any invitation

to discuss our activities with you at any time. We believe a dialogue where we can hear your insight and you can hear our concerns will be healthy and fruitful.

We are all in this together: Industry, academia, the administration, the Congress, the American people, and we need all points of

view to ensure that our critical infrastructures continue to meet

the needs of every citizen by ensuring the continued delivery of

vital services and enabling the economy that underpins our security and our way of life.

Thank you very much, and I am happy to answer any questions.

Senator CLELAND. Thank you very much, Mr. Watson. You are

right. We are all in this together.

Mr. Cilluffo, I was fascinated by a comment. If you would go back

in your testimony, if you could find that section where you said

something about the terrorist will not do something—and ultimately will not give up bombs and bullets. Can you say that section again? Since you seemed to say that maybe bombs and bullets,

in bin Laden’s case, was maybe generational, and his offspring may

have their finger on a mouse or something. Talk about that section

again.

Mr. CILLUFFO. If we look at the threat, we need to look at a full

spectrum of threats. If we are focusing on Al Qaeda specifically,

this is an organization that understands the lethality, has demonstrated the capability, and bombs and bullets are the effective

weapon of choice, and he will continue to accelerate the capability.

If you look at it, even Al Qaeda, if you go back to Kobar Towers,

you saw car bombs, then you had truck bombs at the African embassies. The U.S.S. Cole, you had boats as bombs. Now, unfortunately, you have planes as bombs. So it is more innovative every

time, more lethal every time, he is not, and his followers in Al

34

Qaeda and this loosely affiliated network of radicals, because what

they really do is they pool resources. There is no monolithic organization. He is the chief financial officer of this loosely affiliated organization that brings groups together.

He is not going to be turning to cyber means. They use it, cyber,

for tradecraft, to communicate. Whether they use stegonography,

as some media have said, I do not know, to hide code messages inside, or whether they use simple code words, where ‘‘Go walk the

dog,’’ could mean something very different, and seemingly innocuous could mean something very different if they have communications beforehand, and he has demonstrated the ability to mix very

high-tech and very rudimentary low-tech means of tradecraft, to include communications.

And so I think that it is important to say that when we look at

the terrorist threat today, we need to look at it holistically. We

need to recognize that Al Qaeda is not all terrorism. You are going

to see some that are turning to cyber means. There is only one official terrorist use of offense information warfare, and that was the

Tamil Tigers of LTTE, who disabled embassy communications in

Ottawa, Seoul, and Washington. But that is going to change.

What we see mostly are nations—and they are in the stealing secret business. They are not going to crash systems. They would be

compromising such a valuable method and technique to steal

America’s secrets. So we just need to look at it holistically.

Senator CLELAND. Thank you.

Mr. Nacchio, thank you for your testimony. When I saw the Pentagon smoking and I looked at the Capitol and realized that the

Capitol might be the next target, it was a strange feeling. So I tried

to get on a cell phone. Of course, by now the whole system was

clogged, and my immediate thought, though, was that we are also

under a cyber attack. In other words, they have jammed our communications. As an old Army signal officer, I guess that was the

first thing that came to my mind. Actually, I later realized the

whole system was overloaded.

Also, you mentioned the reliability of the system. Again, in my

training, the first week I was on active duty I had an old colonel

tell me that, ‘‘Cleland, the secret to reliability is redundancy.’’ Have

you learned anything about this, in effect, instant overload, when

the country is attacked or some spectacular thing happens, have

you learned anything in your world that you are going to do differently? Are you going to program in more redundancy for a peak

usage for a few hours, so that average citizens can communicate by

the millions, which is what they wanted to do, and I just wondered

if you had a comment on that?

Mr. NACCHIO. Well, yes, it is a very pertinent point, and it really

relates to a question you asked an earlier panel that said how do

you protect against a massive attack? The communication networks

are best designed, of course, for a massive attack. There are many

of them, multiple paths, physical redundancy, multiple fiber paths

that you can travel. What happened in New York and the Pentagon, specifically New York, is when the towers were on fire, West

Street central office of Verizon went out, so all of southern Manhattan, at the end point, was taken out. The rest of the nationwide

infrastructure worked well, but you could not get in and out of

35

southern New York, and similarly the wireless networks and points

did not work if you were going in and out of New York or in and

out of northern Virginia.

But the rest of the Nation, communicating about it, worked well.

So you still have physical points of vulnerability. What we learned

here is that what we used to protect for a nuclear attack, the same

thing could happen with an airplane attack or if we had a massive

fiber cut or if a bridge across the Mississippi River went down.

These infrastructures need to be protected. So we are not invulnerable to physical attacks, and that is what was demonstrated, but

it is very isolated.

The bigger danger is what my colleague here on the left has said;

it is only a question of time, only a question of time that what nation-states can do to attack the fiber infrastructure, terrorists will

learn how to do, and you will see a massive shutdown, and that

is what I know national security has worried about in the past and

what we have tried to assist on, a massive cyber attack that disables nationwide communications, not just a pair of points, say in

New York or Washington.

Senator CLELAND. Then do we in the Federal Government and

many in the private sector need to think about redundancy, some

kind of redundant capability?

Mr. NACCHIO. Right.

Senator CLELAND. Certain leaders were moved to, in effect, a redundant headquarters outside of Washington. In the case of, shall

we say, a national emergency in our telecommunications world, in

our cyber world, do we need to be able to have some kind of builtin redundancy?

Mr. NACCHIO. Absolutely, and I think for most of the infrastructure in this country, you have redundancy. There are still critical

points and there is a limit at the last mile, so to speak, at some

point you are not going to have redundancy, and that is what we

have to be careful of.

Senator CLELAND. Thank you.

Mr. Watson, do you have any feeling about your own view about

whether an Office of Homeland Defense is going to be adequate, or

do you feel a cabinet-level agency with budget and with troops in

the field and so forth, massing their assets, is something we ought

to seriously think about? Have you come to a conclusion on that?

Mr. WATSON. There are many agencies and organizations in the

Federal Government that are currently contributing to the critical

infrastructure protection effort. There certainly needs to be some

streamlining. I am in no position to tell the government how to organize itself, but simply the fact that the pending executive order

seems to indicate that there will be someone to coordinate critical

infrastructure protection, we believe, is a very positive step, and we

look at that as a parallel effort to what we have at the PCIS, coordinating all the infrastructure sectors.

Senator CLELAND. Mr. Cilluffo, I see your head nodding. Do you

want to come in on that?

Mr. CILLUFFO. Oh, no, I pretty much agree. What we will have

to work out are the details, of course. There are a number of potential executive orders out there, a number of great ideas and a number of commissions that have come out with different ideas. What

36

I think you are seeing now is the amalgamation of the best of the

best. There is no right answer. Whatever answer they choose,

though, is in some ways the right answers, because they are the

ones who are going to have to implement and execute.

So what I say here is let’s not rush to judgment. Let’s see where

this goes. Six months from now, maybe we are going to see there

is a need for additional statutory authority or very specific legislative proposals or even access to troops. But I think let’s focus now

on the short-term needs requirements, backfill those threats to be

able to withstand, prevent and preempt an incident, make sure

that we are looking at this from not just the top-down, but the bottom-up; that our emergency responders and the public health community, for a bio event, are ready. So I do not disagree, but I think

now let’s focus on the short-term and then look to long-term capacity building.

Senator CLELAND. Ms. Gorelick, any ideas?

Ms. GORELICK. As I said earlier, I think we do need some streamlining from the point of view of business to know who is doing

what, operationally. I would make a comment about NSTAC in

that regard. The reason that NSTAC is as robust as it is and has

the capacity that it does, compared to the other ISACs that are

more nascent, is that it was actually stood up by the government.

The CEOs of the industry were, in 1982, named to the panel. They

were given clearances. They get briefings. There is an extant staff.

Industry is not told what to do by the government, but there is an

infrastructure provided.

There are many willing partners in the private sector, and we

have a lot of technical expertise. We understand, from our own

business perspective, the need to have business continuity. We understand, from our own business perspective, the need for our partners to have business continuity, but we are in business, we are

unused to collective or collaborative action of the sort that is really

called for here. If you could have the NSTAC model in each of the

other industries, you would have a much more robust capacity on

the part of industry doing the sorts of things that Mr. Watson is

talking about. Other industries would get caught up to where communications is.

The financial services sector did very well, considering what happened to it. It does have a lot of individual redundancy. We have

backup centers and we have done a lot of thinking about hardening

those resources. But if we are going to get where we need to be as

industries responsible for this national infrastructure, I think we

need, as I suggest in my written testimony, more adequate support

on an industry by industry basis. I think we would be all helped

by that. I do not think it is tremendously expensive, and it would

dramatically increase the way that industry and government communicate with each other, and that industry communicates across

itself.

Senator CLELAND. Mr. Nacchio.

Mr. NACCHIO. Mr. Chairman, let me just build on that—a couple

of quick thoughts. Something that we do in the private sector, I

think, applies here. If you want to get something done, define it

clearly, focus and align resources, and keep it simple. Today, when

we have a problem on our networks, we are required under the law

37

to report it within 30 minutes to the FCC, as Verizon did to Chairman Powell when they had the outage. If we, NSTAC members, are

faced with a cyber attack, will report it to NSTAC so it can be

shared. But just to be clear, we take care of ourselves. NSTAC does

not direct what we do. We are together.

I have a fiduciary responsibility to make sure my network does

not go down no matter who is attacking. I have my own guys who

protect it. We hire ex-FBI, ex-anybody we can. We are kind of a

nation-state in defending our physical and our cyber infrastructure.

We are happy to share that as long—under the Freedom of Information Act—as it not get passed out to the bad guys, so to speak.

So what NSTAC is really good at, which I think was touched

here and why I am involved, is that my biggest job as the vicechair is not necessarily working with national security, it is working with all my colleagues in industry as best I can to encourage

them, based upon what we learned, because we are all responsible

for this, not just the government. But if you can keep it focused

and keep it simple, your pertinent question about what do you do

about homeland defense—I could not tell you how to organize the

government—but I would say keep it simple.

There are at least a dozen agencies, if something really bad is

happening, we have to call, and that is all good, including the FBI,

the local police, and the FCC. We generally get on it ourselves to

start with. So, I recommend that you can keep it focused, streamlined, with clear accountability, and, of course, dedicate the resources.

Ms. GORELICK. I would second that.

Senator CLELAND. Thank you. Senator Bennett.

Senator BENNETT. Thank you, Mr. Chairman.

Mr. Nacchio, they taught me in high school that nature abhors

a vacuum. Government abhors simplicity. [Laughter.]

Senator BENNETT. And may I, as a former customer of US West,

and now one who writes a check to you every month, thank you

for the improvement in service that has come since you took over.

We are grateful that you have put the kind of resources you have

into increasing customer service, and it is not unnoticed and not

unappreciated.

Mr. NACCHIO. Thank you.

Senator BENNETT. Mr. Nacchio has told us what they did at September 11. I would be interested, Ms. Gorelick, what Fannie Mae

did with respect to September 11.

Ms. GORELICK. We stayed in business.

Senator BENNETT. What kind of challenges did you face?

Ms. GORELICK. We were open for business. Our challenges were

communication with sources of funding. The capital markets, as

you know, were not really operating. We were able to establish

communication with the Fed. We were able to maintain our communications with our customers.

Basically, what we do, as you know, is fund those who are making mortgage loans around the country, and, by and large, the

other outlets were, at least for the period of September 11 and for

some period after that, not able to function. Fortunately, for us, we

were able to. We have a very robust system. Like Mr. Nacchio, we

38

try to hire the best. Our head of security is out of DISA. We have

spent a lot of time thinking about cyber security.

So we were able to function and I think we were able to perform

a real service to those who needed the capital markets to function.

Eventually, those markets came back, but it took awhile, and I

think if you look at what some of the learnings are, I think a lot

of financial services companies have learned what makes their

backup systems work. If you have your backup system right down

the street from your main system, that may not work. If your

backup system is reliant on the same communications grid, even if

it may be in Brooklyn rather than lower Manhattan, it may not

work.

If you have a backup system that relies on the same people and

the people cannot get there, it may not work. Fannie Mae did not

experience any of those problems, and that is partly good planning

and partly good luck, but I think there are a lot of learnings for

the financial services sector coming out of this event.

Senator BENNETT. Thank you.

Mr. Cilluffo, you made reference to the motivations of Al Qaeda,

and I will share with you and put into this record information that

came from a hearing we held in the Joint Economic Committee on

this issue less than 60 days ago, where I asked one of the witnesses

from the CIA if, in fact, the next terrorist attack would not come

in the form of a cyber attack, because I said, as I said before, if

I were someone who wished this country ill—back to your world,

Ms. Gorelick—I would want to shut down the Fed wire and break

into the computer system that keeps that going. If you could do

that, you would produce long-term devastation.

Ms. GORELICK. If I might suggest, Senator Bennett—I am sorry

to interrupt—but I would actually think it useful to inquire as to

what occurred, because that is a very vulnerable node, and we

saw——

Senator BENNETT. We have done that on the Banking Committee. I sit on the Banking Committee, and I have asked Alan

Greenspan directly about that issue and have had my staff down

at the Fed looking at it for exactly the reason that you are underscoring. The answer I got from the witness was very interesting,

and, in view of what has now happened, prophetic. He said, ‘‘Senator, that is because you think the way you think. To the terrorist,

shutting down the Fed wire does not give him what he wants,

which is television footage that can be broadcast around the world

to inflame people,’’ and one of the analysts after September 11 who

spoke to us said, ‘‘In a sense, this attack by Al Qaeda backfired and

failed, because what they wanted to produce was such a reaction

out of America as to create a war of civilizations that would then

polarize the Muslim world on their side. It backfired in that it

caused such revulsion among good Muslims, who said this is not

what they teach in the Koran, that it has driven moderate Arab

States and Muslim States to our side in this confrontation.’’ So cutting down the Fed wire does not give them any footage at all on

international television, and therefore was not a notion that he

looked at.

But we go to the issue of hostile nation-states, and the ability to

shut down the Fed wire would be something that a dictator in a

39

hostile nation-state could hold this country hostage, a phone call or

a hotline to the President of the United States, saying, ‘‘Mr. President, we want the following things done in the international scene,

and if they are not, within 20 minutes,’’ or they would probably

give him less time than that, ‘‘the Fed wire will be shut down and

the American economy will come to a screeching halt.’’

If we think in strategic terms, isn’t that the kind of long-term

protection that we have got to deal with, in addition to the immediate challenge of terrorists that want to use kinetic weapons—isn’t

this the long-term strategic vulnerability that we have?

Mr. CILLUFFO. Absolutely, Mr. Chairman—Senator Bennett.

Senator BENNETT. I will take that, but the Senate probably

would not concur. [Laughter.]

Mr. CILLUFFO. But let me build on what I thought was such an

important point. The single common denominator of all terrorism

is that it is a psychological weapon intended to erode trust and undermine confidence in a government, its institutions, its elected officials, its policies in a region or, more generally, its values, and on

and on and on and on. This did backfire. It united our country and

it united—we united at home and we built a united front abroad.

In the back of the minds, I think, of the administration, they have

done a wonderful job of keeping this to fighting the really radical

radicals. This is not about Islam. It is about radical Islamic fundamentalism, which Islam abhors, and we need to keep it that

way.

But, to the cyber question, I do not think there is an easy answer. Since the end of the Cold War, threat forecasting has arguably made astrology look respectable, and I do not have a crystal

ball, but I would say that one thing we do want to think about in

terms of conventional terrorist organizations are combined attacks,

where perhaps you detonate your conventional explosive, big, large,

whatever it may be, and you disrupt emergency 911, so the first

responders cannot get to the scene, or something similar—and we

do not want to advertise too many possibilities.

But you are right. In terms of nations, that is where we have

seen capabilities. There is no question that nations are doing surveillance, the cyber equivalence of intelligence preparation of the

battlefield, on our networks. And those same tools to steal secrets

can automatically be turned on to deny service, to attack. So this

is something we need to be looking at, absolutely, and we need to

be looking at it in a many-pronged lens. We need to improve our

own computer network, exploit the ability to steal cyber secrets of

others, as well as good old espionage.

Senator BENNETT. If I could just make one quick comment, Mr.

Chairman, before we wind it up. One of the vulnerabilities that we

have to deal with, with the Defense Department, is the potential

ability of an enemy to break into that communications system and

then send the wrong instructions to the CINCs, and even if they

do not, the mere fact that there is the possibility that they have

will cause the CINC not to act on real instructions until he can be

absolutely sure, through redundancy, that this order did come from

the CINC, and in that process, time is lost, efficiency is lost, and

the combination that Mr. Cilluffo was talking about of a kinetic

weapon attack and then a scrambling of our command and control

40

system or a threatening of our command and control system that

slows down our response is an additional tool of warfare that we

need to deal with as we are thinking about this in strategic longterm——

Mr. WATSON. Senator Bennett, if I may make an additional comment to piggyback on that, I spent 23 years in the Marine Corps,

the last eight of which were devoted to what became information

warfare, and we were very much concerned with the combination

of things like electronic warfare, military deception, psychological

operations, destructive capabilities. But our feeling now in the private sector—and there are many of us that believe that the center

of gravity for this country has moved to the private sector, because

everyone is dependent on the private sector for the services that

the infrastructures provide, we understand that we are on the front

lines of defense, and I think it is impressive that the board of directors of the PCIS is all volunteer, and they all represent presidents

and executives from companies like Bank of America, BellSouth,

Consolidated Edison, Union Pacific, Conaco, Microsoft, and Merrill

Lynch. You name the industry association and they are on the

board. We get it, and we are ready to cooperate and help.

Senator BENNETT. Thank you. Thank you, Mr. Chairman.

Senator CLELAND. Thank you, Senator Bennett, and thank our

panelists today, wonderful testimony.

In conclusion, talking about the unity that has been brought

about here, I have been often asked about the historical impact of

the attack on September 11, and I quote Admiral Yamamoto, who

planned and executed the attack on Pearl Harbor, that afterwards

he felt he had only awakened a sleeping giant, and in so many

ways that is exactly what has happened.

Thank you all very much. The hearing is adjourned.

[Whereupon, at 11:59 a.m., the Committee was adjourned.]

(41)

A P P E N D I X

PREPARED STATEMENT OF SENATOR BUNNING

Thank you, Mr. Chairman.

This is the second hearing on critical infrastructure protection the Committee has

held this year, and I am pleased we are looking at this issue again.

The first hearing the Committee held was on September 12, the day after the terrorist bombing. The importance of our security has never been more evident, as the

reality of terrorism on America’s soil was sadly brought home.

Protecting critical infrastructure is a responsibility of all levels of government and

the private sector.

This will require businesses and government to share information and form alliances in ways they have traditionally not done.

I am hopeful that we can make some good progress in protecting our critical infrastructure from future attacks over the next couple of months.

However, we have a long way to go.

In fact, during the September 12 hearing we discussed that too often in the Federal Government our critical infrastructure is weakened because simple, commonsense steps are not taken.

This includes not changing passwords routinely or closing accounts for former employees or contractors.

This leaves us vulnerable to future attacks. We must do better.

I want to thank our witnesses for being here today, and look forward to hearing

more about what else we need to do to protect our critical infrastructure.

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

Æ