U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

72–810 2012

CYBER SECURITY: PROTECTING YOUR SMALL 

BUSINESS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON HEALTHCARE AND 

TECHNOLOGY 

OF THE

COMMITTEE ON SMALL BUSINESS 

UNITED STATES 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

HEARING HELD 

DECEMBER 1, 2011 

Small Business Committee Document Number 112–047 

Available via the GPO Website: http://www.fdsys.gov 


pmangrum on DSK3VPTVN1PROD with HEARINGcongress.#13
(II) 

HOUSE COMMITTEE ON SMALL BUSINESS 

SAM GRAVES, Missouri, Chairman 

ROSCOE BARTLETT, Maryland 

STEVE CHABOT, Ohio 

STEVE KING, Iowa 

MIKE COFFMAN, Colorado 

MICK MULVANEY, South Carolina 

SCOTT TIPTON, Colorado 

JEFF LANDRY, Louisiana 

JAIME HERRERA BEUTLER, Washington 

ALLEN WEST, Florida 

RENEE ELLMERS, North Carolina 

JOE WALSH, Illinois 

LOU BARLETTA, Pennsylvania 

RICHARD HANNA, New York 

NYDIA VELA ́ ZQUEZ, New York, Ranking Member 

KURT SCHRADER, Oregon 

MARK CRITZ, Pennsylvania 

JASON ALTMIRE, Pennsylvania 

YVETTE CLARKE, New York 

JUDY CHU, California 

DAVID CICILLINE, Rhode Island 

CEDRIC RICHMOND, Louisiana 

JANICE HAHN, California 

GARY PETERS, Michigan 

BILL OWENS, New York 

BILL KEATING, Massachusetts 

LORI SALLEY, Staff Director 

PAUL SASS, Deputy Staff Director 

BARRY PINELES, General Counsel 

MICHAEL DAY, Minority Staff Director 


pmangrum on DSK3VPTVN1PROD with HEARING
(III) 

C O N T E N T S 

Page 

OPENING STATEMENTS 

Ellmers, Hon. Renee ................................................................................................ 1 

Richmond, Hon. Cedric ............................................................................................ 7 

WITNESSES 

The Hon. William M. ‘‘Mac’’ Thornberry, U.S. House of Representatives (TX– 

13), Washington, DC ............................................................................................ 4 

Mr. David Beam, Senior Vice President, North Carolina Electric Membership 

Corporation, Raleigh, NC .................................................................................... 11 

Mr. Glenn Strebe, Chief Executive Officer, Air Academy Federal Credit Union 

Colorado Springs, CO ........................................................................................... 13 

Dr. Phyllis A. Schneck, Chief Technology Officer Public Sector, McAfee, Inc. 

Reston, VA ............................................................................................................ 15 

Mr. Michael Kaiser, Executive Director, National Cyber Security Alliance, 

Washington, DC ................................................................................................... 17 

APPENDIX 

Prepared Statements: 

The Hon. William M. ‘‘Mac’’ Thornberry, U.S. House of Representatives 

(TX–13), Washington, DC ............................................................................. 27 

Mr. David Beam, Senior Vice President, North Carolina Electric Membership Corporation, Raleigh, NC ..................................................................... 30 

Mr. Glenn Strebe, Chief Executive Officer, Air Academy Federal Credit 

Union, Colorado Springs, CO ....................................................................... 45 

Dr. Phyllis A. Schneck, Chief Technology Officer Public Sector, McAfee, 

Inc. Reston, VA ............................................................................................. 69 

Mr. Michael Kaiser, Executive Director, National Cyber Security Alliance, 

Washington, DC ............................................................................................ 79 

Questions for the Record: 

None 

Answers for the Record: 

None 

Additional Materials for the Record: 

CompTIA Statement for the Record ................................................................ 93 

Recommendations of the House Republican Cybersecurity Task Force ...... 100 


pmangrum on DSK3VPTVN1PROD with HEARING

pmangrum on DSK3VPTVN1PROD with HEARING
(1) 

CYBER SECURITY: PROTECTING YOUR SMALL 

BUSINESS 

THURSDAY, DECEMBER 1, 2011 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON HEALTHCARE AND TECHNOLOGY, COMMITTEE ON SMALL BUSINESS, Washington, DC. 

The Subcommittee met, pursuant to call, at 1:01 p.m., in Room 

2360, Rayburn House Office Building, Hon. Renee Ellmers [chairwoman of the Subcommittee] presiding. 

Present: Representatives Ellmers, Tipton, and Richmond. 

Also Present: Representative Schilling. 

Chairwoman ELLMERS. Good afternoon, everyone. I am going to 

go ahead and call this meeting to order. I would like to thank everyone for being here joining us today on this very important issue 

on cyber security. I would like to say a special thank you to Representative Mac Thornberry and our panel of witnesses that will be 

coming up in the second panel. We appreciate everyone’s participation. 

Our Nation’s digital infrastructure has become an essential part 

of our everyday lives. It is difficult to imagine a world without the 

Internet. It touches nearly every sector of the United States economy, and it is critical to our national security. According to the 

Federal Communications Commission, over 97 percent of small 

businesses utilize the Internet to increase their productivity and 

overall success. 

On Tuesday, The Wall Street Journal reported that the online sales for Cyber Monday rose to a record $1.25 billion. This is an 

increase of 22 percent from last year and marked the heaviest single day for online commerce ever. Despite this good economic news, 

the growth of the Internet technology and e-commerce has also attracted a growing number of cyber criminals looking to steal sensitive information, including intellectual property and personal financial information. These attacks can be catastrophic, as you can 

imagine, leaving many businesses unable to recover. Especially our 

small businesses. 

Although we often hear about cyber attacks on large businesses 

and institutions, a recent report shows the majority of these attacks are on small firms. Small businesses generally have fewer resources available to monitor and combat cyber threats, making 

them easy targets for expert criminals. Moreover, the sophistication and scope of these attacks continue to grow at a rapid pace. 

A recent report from the Office of the National Counterintelligence Executive stated that tens of billions of dollars in trade seVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
2 

crets, intellectual property, and technology are being stolen each 

year by foreign nations like China and Russia. As the leader in 

producing intellectual property, the United States and small businesses will continue to be a primary target for cyber criminals 

seeking an economic advantage. 

Adding to the uncertainty is the difficulty in which one protects 

themselves online. Protecting our digital infrastructure is complex, 

and no one agency or private business can do it alone. It takes a 

true public-private partnership to identify, combat, and share information regarding these sophisticated cyber attacks. 

Both the administration and Congress have recognized the need 

to update certain laws and resources to better combat cyber 

threats. The broad range of issues being considered includes establishing a national standard of reporting a cyber breach, strengthening the criminal statutes, and requiring some private industries 

to develop cyber security plans. 

We have heard small businesses’ concerns about the possibility 

of duplicative regulations, always regulations, as many industries 

already have procedures in place to protect third-party information. 

For example, a company in my district called Diversified Information Technologies, which digitally processes health care and insurance information, already provides full compliance based on the 

Health Insurance Portability and Accountability Act, or HIPAA. In 

considering legislation, we should look to harmonize these regulations to avoid any duplicative rules on small businesses. 

There is no question cyber security is a real and major threat to 

our Nation’s economy, security, and everyday way of life. Moving 

forward, I am confident that we can identify the most efficient role 

of the public and private sectors to protect small businesses and 

our Nation against cyber attacks. 

Again, I want to thank all of our witnesses who are participating 

today. I look forward to hearing the testimony on how we can better assist small businesses against cyber attacks. I now yield to the 

Ranking Member Richmond for his opening statement. 

Mr. RICHMOND. Thank you to the chairwoman and thank you to 

everyone for coming to participate, especially to Congressman 

Thornberry, who heads the Cyber Security Task Force, and the recommendations that you all have made. So as a person was chair 

of Judiciary in the State legislature for 4 years, cyber security was 

under our umbrella, I can tell you that our States are not as aware 

as they should be of the risk that is posed, so it is a great thing 

that we are taking the lead on it and that your task force is doing 

what it is doing. So thank you for that. 

Internet and telecommunication technologies have not only 

changed how we communicate, but also how business is conducted. 

America’s 23 million small businesses are some of the savviest 

users of technology by using the Internet to access new markets to 

grow and to diversify. In fact, small businesses are the driving 

forces behind further technological innovation, as they produce 

about 13 times more patents per employee. However, along with 

being connected comes being exposed to new threats. Cyber threats 

can come in many forms, but they are all devastating to both business owners and to their customers. A single attack can wipe out 

a small business, which is why cyber crime poses severe problems 


pmangrum on DSK3VPTVN1PROD with HEARING
3 

for small businesses that are not prepared to mitigate this kind of 

risk. 

According to studies, 40 percent of all threats are focused on 

firms with less than 500 employees and reveal that a total of nearly $86 billion annually is lost with companies incurring an average 

of $188,000 in losses. Sadly, some small companies fail to recognize 

the benefit of cyber security as an investment until it is too late. 

On the other hand, those firms that understand the importance 

of such an investment often lack the resources to implement an effective security system. The Federal Communications Commission, 

the Department of Homeland Security, and the National Institute 

of Standards and Technology, have all embarked on efforts to offer 

Federal programs designed to educate the public on computer security. It is worrisome that despite the rise in cyberterrorism over the 

past few years and the growing impact it has on small businesses, 

comprehensive cyber security policy remains illusive. With 1.2 million people employed at small companies in the New Orleans metropolitan area, it is important to ensure that they are protected 

against cyber crimes by keeping our Nation’s cyber security, our 

cyber infrastructure incorruptible. That is why I am cosponsoring 

the Homeland Security Cyber and Physical Infrastructure Act as a 

way to strengthen our infrastructure through research, development, and establishment of innovative cyber security technology. 

Like every day Internet users, small firms are exposed to cyber attacks and vulnerable to their malicious effects. 

Today’s hearing will give us an opportunity to review whether 

the increases in Federal investment in both financial and personnel 

resources will have an impact on a small firm’s ability to mitigate 

their cyber risk. The testimony we hear today will help us better 

understand what role the government can play in educating the 

American public and the business community about the security 

risks and challenges they face. Your recommendations on the best 

ways to protect the Nation’s small businesses from this growing 

threat will be useful as we move forward on addressing this issue. 

In advance of the testimony, I want to thank all the witnesses for 

both their participation and insight into this important topic. 

Thank you, and I yield back. 

Chairwoman ELLMERS. Thank you to the ranking member. I will 

say that if committee members have an opening statement prepared, I ask that they be submitted for the record. I don’t have to 

explain the timing lights to our first panel of witnesses. It is my 

pleasure now to introduce, again, Congressman Mac Thornberry, 

who is our first witness, and he is the Congressman of the 13th 

District in Texas. He currently serves as the vice chairman of the 

Armed Services Committee, where he also leads the Subcommittee 

on Emerging Threats. He continues to serve the House Permanent 

Select Committee on Intelligence as well. 

Earlier this year, Congressman Thornberry was tapped by the 

Speaker of the House and Majority Leader to spearhead a Cyber 

Security Task Force to guide House legislation action on this growing economic and national threat. On October 5th, the task force 

released their recommendations, which have been well received 

from Republicans and Democrats, the White House, private busiVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00007 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
4 

nesses and other organizations. Thank you for being here. We look 

forward to your testimony, Congressman. 

STATEMENT OF THE HON. MAC THORNBERRY, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. THORNBERRY. Thank you, Madam Chairwoman and ranking 

member, Mr. Schilling. I appreciate the chance to be here. I have 

submitted a written testimony, and if it is all right, what I would 

like to do is just kind of summarize it into four points. 

One is, I appreciate you having this hearing. One of the major 

findings of our task force is that there is a tremendous gap in what 

is really happening and most people’s awareness of what is happening. That is true in the population, it is true among Members 

of Congress, and our view is that first we have a responsibility to 

educate ourselves and then try to help our communities understand 

what a serious issue this is. I have recommended that the Speaker 

and Minority Leader have a classified briefing for all Members because I think all Members really need to get a better understanding of what we are facing. 

Also, just as a test case a few weeks ago, I took a cyber expert 

with me to my district, and in one town we had a special meeting 

of the Chamber of Commerce, in another town, it was a joint meeting of the Chamber of Commerce and the biggest service club just 

to talk about this issue. He could answer the technical questions, 

but just to try to raise awareness from small businesses in my 

area, and I hope maybe that is something that other Members may 

want to consider in the future. 

The second point I would make, and both of you have made it 

in your opening statements, small businesses are affected by this. 

No one should believe that because I am a small business in Amarillo, Texas, that I don’t have to worry about it. It is simply not the 

case. What we also have come to learn is that not only are small 

businesses in the cross-hairs of those seeking to perpetrate crime 

and steal intellectual property, a lot of times small businesses are 

subcontractors that are used to get to larger contractors. A lot of 

times increasingly, in fact, lawyers and accountants are targets in 

order to get their clients’ records. So there is some careful planning 

going on here, but small businesses are particularly in the crosshairs, and every time they steal intellectual property from a small 

business, they are stealing jobs from the United States. So it is obviously a national security issue, but as both of you have rightly 

pointed out, it is also an economic issue that is very important. 

Third, I would say that this is a big, complicated issue that Congress cannot solve in a single bill, and we shouldn’t try. I think you 

all have mentioned that it touches most aspects of our lives, most 

aspects of business life these days. Eighty-five, roughly, percent of 

the infrastructure we are talking about protecting is owned by the 

private sector. So government is not going to come in and solve all 

of this, but we can take steps to help protect the country, and obviously, that is what we need to do. 

Fourth and lastly, the task force you have both mentioned have 

made recommendations as far as a general framework on what 

Congress could do during this session of Congress, and that was 

the Speaker’s instruction to us, don’t try to solve all the problems 


pmangrum on DSK3VPTVN1PROD with HEARING
5 

in the world, but look at what we can do that will make a significant difference that could get passed during this session of Congress, and our recommendations have drawn on a lot of previous 

work that Members of both sides of the aisle have done, but I have 

been pleased at the bipartisan support, not only in the House, but 

from Senators, the White House has spoken positively of it, so I 

think there is a real opportunity to act here. 

There is lots of differences we have between the parties, between 

the different Houses of Congress on a variety of issues, but this is 

one where I think we can work together, and I think it is essential 

that we work together to try to begin to take those steps in the 

right direction. So, again, I appreciate your interest in it, and I will 

be happy to answer any questions that I can answer. 

Chairwoman ELLMERS. Well, I definitely echo those comments 

about the importance of us all working together in a bipartisan 

manner on this issue, I think we all see the very important aspects 

of it. 

I just have a couple questions, and then I will yield to Mr. Richmond, the ranking member. My first question for you, Congressman, is the recent report from the National Counterintelligence Executive Agency revealed that China and Russia are behind a majority of cyber attacks, and that is obviously deeply, deeply disturbing. 

In your opinion, how does the small business, the small business 

that is out there right now dealing with all of the issues with the 

economy, how can these small businesses deal with these attacks 

right now, and what and how should the United States respond to 

this as a Nation? 

Mr. THORNBERRY. I would say two things, and they are really the 

central recommendations of our task force. Number one is what is 

called good hygiene. It is the basic things that we all know we 

should do but too often don’t do, keeping our firewalls up to date, 

our virus protection up to date, not having our passwords underneath our mouse pads in our offices, which a defense contractor 

told me he just went and checked in one of his offices and found 

that was the case in a large number of his employees, and the task 

force received information from a variety of witnesses saying 

roughly three-fourths of the malicious stuff out there on the Internet could be stopped if we all did the basic stuff we know we are 

supposed to do. You know the reason they call it good hygiene because it is kind of like washing your hands and coughing in your 

sleeve and getting enough sleep and drinking enough water, the 

basic things that keep us healthy, it can keep the Internet healthy, 

too. So small businesses, you know, it doesn’t take a lot of money, 

but you need to do the stuff you know you should do. 

Secondly, though, when you talk about Russia and China, if Russia and China is targeting somebody, good hygiene won’t be 

enough, and so our second central recommendation is to update 

some laws to allow information sharing that where we can use especially Internet service providers to help defend us against these 

more sophisticated threats. And so I think you have got to do two 

prongs: Basic hygiene, but also update our laws so that we can 

bring all the resources of government and the private sector to bear 

against these more sophisticated threats. 


pmangrum on DSK3VPTVN1PROD with HEARING
6 

Chairwoman Ellmers. Thank you. My next question for you, 

there again, comes from our small business owners, and they are 

basically saying that, you know, one of the big issues, and we hear 

this repeatedly, is the threat of regulations and dual regulations, 

especially those industries defined as critical infrastructure. This is 

a two-part question here. First, has this issue been adequately addressed, and in your opinion, do you believe that small businesses 

should be subjected to the same regulations or Federal standards 

as larger businesses regarding cyber security compliance? 

Mr. THORNBERRY. It certainly has not been adequately addressed, and I think this gets to where there is a difference of opinion between the White House proposal that came out in May and 

the task force recommendation. The White House recommended basically that critical infrastructure businesses develop a cyber security plan which would be sent to the Department of Homeland Security for evaluation and kind of a thumbs up or thumbs down. 

Our view was that we ought to rely on existing regulators, so for 

the electric industry, FERC, and NERC and the existing regulators, the Nuclear Power Regulatory Commission for nuclear 

power plants, et cetera. In other words, these structures are in 

place, they help understand the fuller spectrum of what these businesses are dealing with, and they need to put a greater emphasis 

on cyber security. 

Now, we are going to have to work through how to do that, but 

I think I am concerned, as you mentioned, about layering additional regulations, particularly on small businesses that have a difficult time affording what they have got now. 

Chairwoman ELLMERS. Thank you. Thank you for outlining that. 

There again, you know, having to report to more than one agency, 

each of these different duplicative just adds to the cost of doing 

business as well, so—— 

My last question, in actually talking about Federal agencies, of 

course, Federal agencies play a key role in protecting against cyber 

attacks. Considering our committee, Small Business Committee 

and its jurisdiction, what do you think the appropriate role is for 

the Small Business Administration? 

Mr. THORNBERRY. My sense is the most valuable thing is the 

awareness and help small businesses have the tools to know how 

to defend themselves, and if you can do that where you don’t have 

to go hiring an outside consultant or so forth, if you can just help 

direct small business to the kinds of things they need to do with 

that good hygiene we were talking about, I think that would be a 

tremendous help to small business, but again, when you help all 

those small businesses, you are also helping the whole Internet because you reduce the clutter that is out there, and that helps the 

more sophisticated entities target those more sophisticated threats. 

Chairwoman ELLMERS. Thank you so much for answering my 

questions. I am going to yield now to Mr. Richmond for his questions. 

Mr. RICHMOND. Thank you, and I will try to start where you are 

leaving off when we talk about education and awareness as a costeffective way to reduce our cyber breaches. The task force suggested the basic technology tools, industry best practices, and education could eliminate about 85 percent of the cyber threat. I think 


pmangrum on DSK3VPTVN1PROD with HEARING
7 

you just hit on most of it, but what else besides the good hygiene 

and the other recommendations can we do to further push for a reduction and further accomplish a reduction in cyber attacks? 

Mr. THORNBERRY. Well, one of the key areas, we believe, is that 

we need to provide some voluntary incentives so that as a CEO is 

trying to figure out where his money goes, that more of his attention and perhaps more of his money goes to defending that business against cyber attack. 

Now, again, there are some differences. There are some people 

who have made proposals on a more directive regulatory approach. 

Our view was you can’t have one size that fits all, but a variety 

of incentives, whether it is the Tax Code, whether it is SEC regulations, which actually they came out with one a couple weeks ago 

that requires greater attention be paid to cyber. 

I think that sort of thing, we have got to elevate this issue in 

the consciousness not only of Members of Congress, the American 

people, but of businesses, and some incentives, financial incentives, 

I think—we think help accomplish that, even though we did not try 

to put out a laundry list of what they all are, and suggestions that 

you all may have, particularly for incentives that would be effective 

for small business, I think, would be very welcome as we move 

through this process. 

Mr. RICHMOND. Another thing, one of the recommendations was 

in the Federal procurement process, to require security technology 

processes and performance management in the government IT 

process. Since we are sitting on Small Business, one concern that 

immediately pops up is the cost associated with it and how would 

it put small businesses at a disadvantage compared to other businesses in the procurement process for government contracts. 

Mr. THORNBERRY. It is a good point. I think our view was, the 

government is a big customer, we ought to be a good big customer 

in what we buy, in other words buy things that are more secure, 

but also I think what one finds out is a lot of innovation in this 

area is being done by small business, innovation in enhanced security. So I think, if we can put a higher priority on security that 

small business, particularly small business innovators will benefit 

from that. They should, and I hope so. 

Mr. RICHMOND. I am glad you brought up the role that small 

businesses play in the technology aspect of it. The Federal Government is spending an enormous amount of money, and we are 

spending more every year, on cyber security. What niche, or what 

way do you see small businesses being able to participate on the 

technology side of helping us get ready, combat or fight off cyber 

attacks? 

Mr. THORNBERRY. I think we were just touching on it. A lot of 

the innovation that goes on is in small business start-up businesses, and the Federal Government in its procurement has to be 

nimble enough to take advantage of those advances, and that is obviously a challenge. And a second area that we touched on is, the 

Federal Government spends a lot of money on research in cyber. 

We ought to make sure the money we spend on research in cyber 

is not taking the place of money that private industry is spending 

on cyber. In other words, displacing some small business that is 

putting their resources out there, we ought to be complementary, 


pmangrum on DSK3VPTVN1PROD with HEARING
8 

more basic research that everybody can benefit from rather than 

researching things that, you know, that put a small business potentially out of business. 

Mr. RICHMOND. And just a few more. When you talked about information sharing earlier, of course it raises questions of privacy 

concerns. One question that would quickly pop up in my mind is 

in an information sharing arrangement, for the person whose information is then leaked or who has his life or business turned upside 

down because of it, how do we address liability in that question 

and who ultimately would bear the responsibility? 

Mr. THORNBERRY. It is, in many ways, kind of a central question 

to making this work, you are exactly right. What we recommended 

in the task force was creating a separate entity apart from government where information could be shared so that—and I will just 

take the car industry. For example, Ford and GM could bring their 

information to this place to share. They may want to sanitize that 

information so you don’t have particular individuals’ names and so 

forth, but they could bring the information that we are getting attacked from here, we are getting attacked from there, threat information could come together. 

At the same place you would have government classified information brought in so that you can have this whole fuller picture, at 

least, of the nature of the threat with appropriate classified safeguards so that we do not lose important national security information, and then ideally, that information could be acted upon by 

Internet service providers, so you accumulate this threat information, and AT&T and Verizon can use that information to protect big 

businesses and small businesses eventually, hopefully. 

I mean, that is kind of the concept that we talked about, but you 

are absolutely right that privacy has got to be built in every step 

of the way and that if we don’t, the American people are not going 

to go for it, and we will not be able to advance cyber security. 

Mr. RICHMOND. And the last question is hopefully a short answer, but nowadays with iPads, iPhones, Androids, so between the 

smartphone and the tablet, they are becoming business instruments for many people, especially small businesses. What is your 

assessment of what cell phone companies and those companies are 

doing in terms of making sure that there are adequate safeguards 

in place for threats on those smart devices? 

Mr. THORNBERRY. As they multiply, the potential entry points for 

attacks of some sort multiply as well, and I don’t think there has 

been nearly enough attention by the software companies, the hardware companies or us as individuals into safeguarding these little 

devices that we all carry around with us. 

But I will say, from the Armed Services Committee standpoint, 

we are going to start issuing some of these devices to soldiers in 

the field, and so we have got to figure out from a government 

standpoint how we make sure they are secure, and hopefully that 

can start a trend towards greater security for all of these devices. 

Mr. RICHMOND. And I am glad you mentioned that, and this will 

be the last question. 

Chairwoman ELLMERS. That is fine. 

Mr. RICHMOND. What you just said scares me because I think of 

my smartphone and the fact that it has great capabilities where 


pmangrum on DSK3VPTVN1PROD with HEARING
9 

parents can use the GPS feature on their children’s smartphone to 

see where they are, the first question in my mind becomes whether 

the technology is there, whether the companies have the ability to 

make sure that we are not giving away the coordinates and where 

our soldiers are, but, you know, so do you think that—and I know 

that our military and our leaders would address those things, but 

those types of concerns, we just have to make sure that those cell 

phone providers and those are very wary of those, especially as 

more and more—and we talked about troops, but especially as 

more and more children have cell phones, we have to worry about 

the cyber attacks. We also have to worry about our hardened criminals using technology to find our children and so forth. 

So that is one thing we have to keep pushing on our industries 

and our companies, to make sure that they understand to some extent there is a moral responsibility with making sure that the 

phones are as safe as possible in that respect. So thank you for 

what you do, Mac, and thank you to the Chairwoman for allowing 

me a little extra time. Thank you. 

Chairwoman ELLMERS. Well, thank you. Those were excellent 

questions, excellent questions, and excellent responses. This is 

quite an opportunity today. 

At this time, I would like to recognize Mr. Schilling from Illinois, 

if he has any questions. 

Mr. SCHILLING. Yes, thank you, Chairwoman. I think I agree 

with Mac here, with Congressman Thornberry I should call him, is 

this is something that really needs to be addressed, and, you know, 

as I go into some of the hearings that we have been in, some of 

the briefings, you know, I don’t really feel a sense of urgency out 

here in Washington, D.C. when it comes to the cyber attacks that 

we are already dealing with, and then the future ones that are 

coming, and being a small business owner myself, you know, of 

course, one of the things that I always fear is when I hear the government is going to get into and then they are going to throw 

something else upon my small business that is already struggling, 

things like that, so I think that is something we definitely need to 

work on. 

One of the things I was curious is, where is, like, leadership, for 

example, on maybe having briefings with the Democrats and Republicans here to where we can get the message? And I really appreciate, just the idea that you had of going out to the Chambers 

and speaking to the small businesses because this is a real threat, 

and I think down the road, this is going to be something that we 

are going to have to really pay a lot of attention to. So several different—— 

Mr. THORNBERRY. I think there is a good chance it will happen. 

As I mentioned, I recommended to the Speaker, I know Jim Langevin talked to Mrs. Pelosi’s office about jointly doing this. Obviously, I think you are right, generally there is not the sense of urgency. For people like the Speaker, the President, and the Majority 

Leader in the Senate who have had every day or every week get 

classified briefings, they are pretty fired up about this, and see the 

urgency of doing something. So I am hopeful we can do that, and 

I think it would help all Members to get a little fuller picture of 

what we face every day. 


pmangrum on DSK3VPTVN1PROD with HEARING
10 

Mr. SCHILLING. Very good. I do like the message you have, also 

when we do do something, is it something that is going to complement somebody that is already working on something, not trying 

to take something that maybe a small business is working on. So 

that is all I had. Thank you. 

Chairwoman ELLMERS. Great. Thank you. At this time I would 

like to recognize Mr. Tipton from Colorado. 

Mr. TIPTON. Thank you, Chairwoman, and Congressman, thanks 

for your leadership on this obviously very important issue. I 

haven’t had an opportunity to obviously be able to go through your 

entire task force report, but in there, it states that 85 percent of 

the issues, cyber issues can be cleaned up with hygiene, and I was 

wondering, is there a way to be able to really accomplish this without driving up some of the costs that small businesses are really 

going to be bearing? Any estimates on that? 

Mr. THORNBERRY. Well, I think you can do it with incentives and 

encouragement. Maybe you don’t get all 85 percent. Maybe you get 

80 percent. But I think increasingly, small businesses, like all businesses, are going to have to understand that if their customer 

records are stolen and misused, they may have some responsibility 

for that, and so I think we are better off in structuring things 

where it is self-interest to put a higher priority rather than government mandating how it should be done. Among other things, the 

threats move so quickly, there is no way the government can regulate in this area. It just evolves so fast. But as in some other areas, 

physical safety, for example, everybody has to have insurance, 

sometimes you have an insurance agent come and inspect your 

physical plant to determine your rates and so forth. That is the 

sort of incentive, I hope, that we can get going. 

Mr. TIPTON. Great. And I apologize for being late, and if you 

have already answered this, but I was also curious where you had 

noted that a number of our small businesses are developing new 

technologies that are being hacked and the next day they know it 

is out on to the street, are there any estimates in terms of how 

much that is costing the U.S. economy? 

Mr. THORNBERRY. I don’t know of any good estimates. You have 

a wide range of numbers about the value of the information being 

stolen every day, every year from our economy, but we did hear 

specific instances of small businesses who discovered that they 

were hacked and information, where there was a formula, a blueprint, something was taken from their computers, and a few 

months later that exact product shows up on our shores with 

‘‘Made in China’’ stamped on the back. Now the problem is they 

knew they were hacked. How many are out there that don’t know 

that the information was ever stolen from them. So that is part of 

the reason we believe we have got to make this a bigger deal for 

everybody. 

Mr. TIPTON. Exactly. Again, thank you for your leadership. 

Madam Chairman, yield back. 

Chairwoman ELLMERS. Thank you. Again, I would like to thank 

Congressman Thornberry for his leadership and insight on this 

issue. We will continue to work closely with his office and the task 

force on developing legislation that assists small businesses in combating cyber security. Thank you so much. It was a pleasure. 


pmangrum on DSK3VPTVN1PROD with HEARING
11 

I would like to call the second panel now to the table. 

Wonderful, let’s go ahead and get started. I would like to take 

the opportunity right now to just explain to you the timing lights. 

You will each have 5 minutes to deliver your testimony. The light 

will start out as green. When you have 1 minute remaining, the 

light will turn yellow. Finally, it will turn red at the end of your 

5 minutes, and I ask that you try to keep to that limit, if possible, 

although, you know, I am usually pretty flexible with that within 

reason. Within reason. 

Thank you all for being here. Again, this is a great opportunity. 

It was certainly wonderful to hear from Congressman Thornberry. 

He has done so much work on this, and now from the business aspect, you know, we get to hear your side of it. So, again, thank you 

so much for being here today. 

I am going to take the opportunity now to introduce our first witness, Mr. David Beam. Before I do, though, I do want to say that 

at some point we may be called for votes, and what we will do at 

that time is we will interrupt, we will kind of decide what time 

frame we are looking at, and then we will come back and pick up 

again later, okay? 

So our first witness is Mr. David Beam. He is the senior vice 

president of Corporate Strategies for the North Carolina Electric 

Membership Corporation in Raleigh, North Carolina. David has 

over 30 years of experience in the electric utility industry. In his 

current role, he oversees their energy risk management and regulatory compliance, including cyber security. David earned his Bachelor of Science in mechanical engineering from the University of 

Kentucky and his MBA from the University of North Carolina 

Chapel Hill. He is testifying on behalf of the National Rural Electric Cooperative Association. 

STATEMENTS OF DAVID BEAM, SENIOR VICE PRESIDENT, 

NORTH CAROLINA ELECTRIC MEMBERSHIP CORPORATION, 

ON BEHALF OF THE NATIONAL RURAL ELECTRIC COOPERATIVE ASSOCIATION; GLENN STREBE, CHIEF EXECUTIVE OFFICER, AIR ACADEMY FEDERAL CREDIT UNION, ON BEHALF 

OF THE NATIONAL ASSOCIATION OF FEDERAL CREDIT 

UNIONS; PHYLLIS SCHNECK, CHIEF TECHNOLOGY OFFICER 

PUBLIC SECTOR, MCAFEE, INC, ON BEHALF OF THE SOFTWARE & INFORMATION INDUSTRY ASSOCIATION; AND MICHAEL KAISER, EXECUTIVE DIRECTOR, NATIONAL CYBER 

SECURITY ALLIANCE 

Chairwoman ELLMERS. Welcome, you have 5 minutes to present 

your testimony. 

STATEMENT OF DAVID BEAM 

Mr. BEAM. Chairman Ellmers, and Ranking Member Richmond, 

thank you for inviting me to testify on cyber security impacts on 

small businesses. My name is David Beam, and I am senior vice 

president of Corporate Strategy for North Carolina Electric Membership Corporation, or NCEMC. NCEMC is a generation and 

transmission cooperative providing wholesale power and other related services to 25 of the 26 electric cooperatives incorporated in 

North Carolina. NCEMC is responsible for reliability in cyber secuVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00015 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
12 

rity compliance, for its own critical assets as well as those belonging to its members. These assets include generation and transmission facilities and the associated protection equipment and procedures. All of our distribution cooperatives that own NCEMC are 

small businesses. I would like to acknowledge the National Rural 

Electric Cooperative Association. NRECA is our national trade association representing over 900 cooperatives nationwide, providing 

electricity to 42 million consumers in 47 States. 

Today I will cover the following: The bulk power system and how 

it is separate from the distribution system, the origin and purposes 

of the North American Electric Reliability Corporation, or NERC, 

how we comply with NERC reliability and cyber security standards, and our views on the potential impacts of new legislation. I 

would also like to commend the work of Speaker Boehner’s Cyber 

Security Task Force and the leadership of Representative Mac 

Thornberry. 

Generally speaking, NERC’s standards apply to the bulk power 

system which includes generation and transmission assets operated 

at voltages of 100 KV or higher. Distribution facilities receive 

power from the bulk power system and transmit it to retail consumers. Because outages at the distribution level generally do not 

pose a threat to the bulk power system, NERC standards don’t 

typically apply to distribution lines and substations. Contrary to 

popular belief, hackers cannot easily access the telecommunications 

systems that overlay parts of the bulk power system. Utilities have 

comprehensive cyber security systems to protect against malicious 

attacks. 

Congress created a mandatory enforceable reliability standards 

regime for the bulk power system in the Energy Policy Act of 2005. 

NERC is an industry-funded, self-regulatory organization. Its purpose is to regulate reliability and cyber security standards. It also 

audits compliance and has enforcement authority over those standards. NERC and the Federal Energy Regulatory Commission or 

FERC can fine utilities that violate these standards and have done 

so. Additionally, FERC can direct NERC to develop new or revised 

reliability standards. 

Congress created a stakeholder-driven process, recognizing that 

utility owners and operators best know how to provide reliable electric service and how our complex systems are designed and operated. We want to preserve this process. 

NCEMC follows exacting procedures to ensure NERC compliance. Our goals are awareness and commitment to compliance by 

all employees, prompt detection, cessation, and reporting of violations, and effective remediation measures should violations occur. 

NCEMC has devoted significant financial and human resources to 

ensuring reliability in cyber security. We employ a full-time compliance coordinator whose sole responsibility is managing compliance 

with reliability and cyber security standards. In addition, NCEMC 

employs a compliance team of subject matter experts who are responsible for compliance with their assigned cyber security and reliability standards. NCEMC also uses outside contractors to audit 

and provide recommendations for improving our compliance program. Additionally, at least one employee for each distribution coVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00016 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
13 

operative is responsible for compliance with reliability and cyber 

security standards. 

We employ strong defensive measures to protect our network and 

business systems. We have strict security guidelines for securing 

the network and systems, including policies that govern the access 

and use of its network and systems. NCEMC and NRECA believe 

NERC processes work very well. The process could be strengthened 

by narrowly targeted legislation that lets the Federal Government 

react quickly to severe, imminent cyber threats and increases timely actionable information flowing to utilities. Any new legislation 

should cover only assets and systems which are realistic targets of 

cyber threat and which could truly impact the bulk power system. 

Casting too wide a net could bring entities, like distribution co-ops 

and other small businesses, under potentially very burdensome 

regulatory requirements with little or no benefit to grid security. 

Thank you for the opportunity to testify today. I look forward to 

answering your questions. 

Chairwoman ELLMERS. Thank you, Mr. Beam. 

Chairwoman ELLMERS. I now yield to Congressman Tipton for 

the introduction of our next witness. 

Mr. TIPTON. Thank you, Chairwoman. It is my pleasure today to 

be able to introduce Mr. Glenn Strebe. He is the chief executive officer of the Air Academy Federal Credit Union in Colorado Springs. 

He oversees full operations of nine credit unions, including oversight of their compliance and security issues. Glenn received his 

Bachelor of Science from the U.S. Air Force Academy, my son-inlaw is also a graduate of the Academy, and an MBA from the Colorado State University. He is testifying on behalf of the National Association of Federal Credit Unions, and Glenn, welcome, and we 

look forward to your testimony. 

STATEMENT OF GLENN STREBE 

Mr. STREBE. Thank you. Good afternoon. Chairwoman Ellmers, 

Ranking Member Richmond, and members of the subcommittee, 

my name is Glenn Strebe, and I am testifying today on behalf of 

the National Association of Federal Credit Unions, or NAFCU. 

Thank you for holding this important hearing. I appreciate the opportunity to share my views on cyber security and data security at 

our Nation’s credit unions. NAFCU supports efforts to enact comprehensive data and cyber security measures to protect consumer 

data. Credit unions and other financial institutions already protect 

data consistent with the provisions of the 1999 Gramm-Leach-Bliley Act. Unfortunately, there is no comprehensive regulatory structure similar to what was put in place for financial institutions 

under Gramm-Leach-Bliley for other entities that may handle sensitive personal and financial information. Consistent with GrammLeach-Bliley, the National Credit Union Administration established 

administrative, technical, and physical safeguards for credit unions 

to ensure the security, confidentiality, integrity, and proper disposal of consumer information and other records. Every credit 

union must develop and maintain an information security program 

to protect data. Additionally, the rules require third-party service 

providers that have access to credit union data take appropriate 

steps to protect the security and confidentiality of this information. 


pmangrum on DSK3VPTVN1PROD with HEARING
14 

Gramm-Leach-Bliley and its implementing regulations have successfully limited data breaches among financial institutions. I have 

outlined the specifics of the Act in my written testimony. 

At Air Academy Federal Credit Union, we are relentless in our 

efforts to protect sensitive data. The increased reliance on Internetbased services has created new challenges and expenses over the 

past decade. With over a quarter of our members living out of 

State, a large number of our transactions are performed online. In 

order to address this growing trend, Air Academy has implemented 

and continues to execute security measures on many different levels, the details and costs of which are outlined in my written testimony. At Air Academy, we take cyber security seriously. We use 

an ethical hacker that tests our security measures, looking for hidden vulnerabilities. Our laptops and thumb drives are encrypted in 

case they fall into the wrong hands. We change penetration testing 

vendors as well as our service providers every 2 or 3 years to avoid 

complacency and to keep a fresh set of eyes on our security system. 

While all of these steps are costly, they are best practices. Despite 

Air Academy’s efforts, the inadequate security systems of other entities still leaves our members’ data vulnerable to hackers and 

thieves. 

Everyone has heard about large national data breaches that impact millions of payment cards, but many breaches are small and 

on the local level. For example, in 2009, a local liquor store failed 

to protect card data because they claimed no liability. We suffered 

over $60,000 in losses. Data breaches are a serious problem for consumers and businesses. 

Financial institutions such as credit unions bear a significant 

burden as they incur steep losses in order to reestablish member 

confidence after a data breach occurs. NAFCU has developed a list 

of items we would like to see addressed in any data security bill. 

They are outlined in detail in my testimony and include: Payment 

of breach costs by breached entities; national standards for safekeeping of information; disclosing of data security policy at point 

of sale; requiring disclosure of the breached entity; enforcement of 

prohibitions on data retention; and timely notification of account 

servicer when a breach occurs. 

In conclusion, NAFCU supports new measures to protect consumers’ financial data. Creating a comprehensive regulatory 

scheme for those entities that currently have none is critical. A safe 

harbor for financial institutions already in compliance with 

Gramm-Leach-Bliley should be included in any data security bill. 

Further, if more regulations are needed to address new concerns, 

it should be the functional regulators that are charged with promulgating new rules. Finally, any other party that holds sensitive 

information should be held liable when responsible for a data 

breach. 

Thank you again for the invitation to testify before you today. I 

would welcome any questions you may have. 

Chairwoman ELLMERS. Thank you, Mr. Strebe. 

Chairwoman ELLMERS. I now yield to Ranking Member Richmond for the introduction of our next witness. 

Mr. RICHMOND. Thank you, Madam Chairwoman. It is my pleasure and honor to introduce to everyone Dr. Phyllis Schneck, who 


pmangrum on DSK3VPTVN1PROD with HEARING
15 

is the chief technology officer for the public sector at McAfee, a 

leading provider of cyber security software. Ms. Schneck received 

her Ph.D. in computer science from Georgia Institute of Technology 

where she pioneered the field of information security and securitybased high performance computing. In addition to her role at 

McAfee, she currently serves as the chairman of the board of directors of the National Cyber Forensics and Training Alliance. Ms. 

Schneck was named one of the top 25 women leaders in information security, and she also holds three patents in high performance 

and adaptive information security. Welcome, Ms. Schneck. I am 

sorry, Dr. Schneck. 

STATEMENT OF PHYLLIS A. SCHNECK 

Ms. SCHNECK. Thank you. Good afternoon, Chairwoman Ellmers, 

Ranking Member Richmond, and members of the subcommittee. I 

am Phyllis Schneck, vice president and chief technology officer for 

the global public sector for McAfee, testifying today on behalf of the 

Software & Information Industry Association. SIIA is the primary 

trade association of the software and digital information industry, 

with more than 500 members that develop software and electronic 

content for consumers, business, education, and the Internet. 

McAfee, Inc., protects businesses, consumers, and the public sector 

from cyber attacks, viruses, and a wide range of cyber security 

threats. We are the world’s largest dedicated cyber security technology company and a proven force in combating the world’s toughest security challenges. McAfee is a wholly owned subsidiary of the 

Intel Corporation. 

We appreciate the subcommittee’s interest in cyber security as it 

affects small business, which plays such a large part in our Nation’s economy. While small business falls prey to the same security risks as large business, most small firms cannot afford a dedicated security staff nor do they have a million dollar budget to purchase enterprise security solutions. Nevertheless, small companies 

must meet the same security and compliance requirements as Fortune 500 firms, just to remain in business. 

The importance of small business to the national economy cannot 

be overstated. According to the Small Business Administration, 

small firms represent 99.7 percent of all employer firms. They have 

generated 65 percent of new jobs over the past 17 years, and as 

Ranking Member Richmond mentioned earlier, they produce in 

order of magnitude more patents per employee than even the large 

patenting firms. 

Today’s cyber threats are more sophisticated and targeted than 

ever. They are growing at an unprecedented rate. McAfee Labs 

finds, for example, that both malicious URLs and malware, they 

have grown almost sixfold in the past 2 years, and in 2010 we saw 

more malware than in all of the years previously. 

One of the most insidious cyber attacks is a low level incursion, 

it sinks below the radar, quietly exploring and stealing the contents of the network. Security professionals call this an advanced 

persistent threat on an APT, and McAfee has uncovered several 

over the past year, the most recent, shady RAT, has been stealing 

valuable intellectual property from more than 70 organizations 

across 14 countries, including small firms in addition to governVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00019 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
16 

ment contractors, nonprofits, and government agencies. And this is 

not an isolated incident. A 2010 survey found that 60 percent of organizations report a chronic and recurring loss of sensitive information. 

More than a million small businesses and retailers were victims 

of some type of information theft in 2010, with 56 percent of small 

and midsized businesses experiencing this type of banking related 

fraud in 2010 and 75 percent of it coming from online sources. 

Among small businesses falling prey to bank fraud, 61 percent 

were victimized more than once. 

We are only as secure as our weakest link. To further help small 

business, we recommend three guiding principles to make the cost 

of security most effective. Practice risk management first. Next, 

minimize the amount of sensitive information retained in the network; and, third, invest in the appropriate level of security. 

Finally, we have some policy recommendations. A heavily regulated approach would not necessarily make organizations more secure. It makes them more compliant. And it would stifle innovation. On the other hand, positive incentives and subsidies have a 

high probability of success in two ways: First, a higher chance of 

better actual outcome; and secondly, a higher probability of good 

legislative success. There are a variety of proposed approaches 

found on incentives, including the recommendations that we heard 

earlier from Representative Thornberry of the House Republican 

Cyber Security Task Force and some promising approaches on the 

Democratic side. 

We support the following approaches: 

Litigation and legal reform. Imposing limitations on liability for 

damages as well as for noneconomic loss would remove a serious 

obstacle to information security investment, such as the risk of 

being held responsible for losses notwithstanding a company’s good 

faith investment in good cyber security. 

Public-private partnership on information sharing. Departments 

of Defense and Homeland Security manage many public-private 

partnerships, McAfee plays a key role in several. These partnerships ensure that senior corporate and government officials share 

vital information and best practices, and they are especially important for small businesses. 

Competition, scholarships, research and development help identify and recruit talented individuals that foster innovation in advanced basic and applied solutions and bring those individuals to 

the cyber security workforce. 

Tax incentives. Accelerated depreciation or refundable tax credits 

should be considered to encourage critical infrastructure industries 

to make additional investments in cyber security technologies, solutions, and human capital. The same approach could be effectively 

applied to small business. 

Insurance reforms. Because of the lack of actuarial data, government should consider implementing reinsurance programs to help 

underwrite the development of cyber security insurance programs, 

which could be phased out as insurance markets gain the cyber security coverage. 

In conclusion, let me emphasize that collaboration and cooperation between the public and private sector are key to addressing 


pmangrum on DSK3VPTVN1PROD with HEARING
17 

cyber security in a holistic way. Thank you for your interest, and 

I will be pleased to answer any questions. 

Chairwoman ELLMERS. Thank you, Dr. Schneck. 

Chairwoman ELLMERS. I have the opportunity now to introduce 

our last witness for today, Mr. Michael Kaiser. He is the executive 

director of the National Cyber Security Alliance, NCSA, in Washington, D.C. The NCSA is a nonprofit organization focused on educating and promoting awareness of safe cyber security practices to 

individuals, education institutions, and small businesses. They recently conducted a study analyzing small business cyber security 

practices. Welcome, Mr. Kaiser. You have 5 minutes for your testimony. 

STATEMENT OF MICHAEL KAISER 

Mr. KAISER. Thank you, Chairwoman Ellmers and Ranking 

Member Richmond, and members of the subcommittee. Thank you 

for the opportunity to testify today on this very important current 

state of cyber security in small business. My name is Michael Kaiser, and I am the executive director of the National Cyber Security 

Alliance. NCSA is a nonprofit organization, a public-private partnership working with industry leaders, government, and nonprofits 

on education awareness issues in cyber security. NCSA’s board of 

directors is comprised of representatives from 18 companies, ADP, 

AT&T, Bank of America, Cisco, EMC, ESET, Facebook, General 

Dynamics Advanced Information Systems, Google, Intel, Lockheed 

Martin, McAfee, Microsoft, PayPal, SAIC, Symantec, Verizon and 

Visa. 

NCSA leads cyber security education and awareness in this country. We lead critical efforts, such as the STOP. THINK. CONNECT. 

campaign, which we developed with the Anti-phishing Working 

Group and industry and government and which the Department of 

Homeland Security leads in the Federal Government. We have developed National Cyber Security Awareness Month, we are working 

on Data Privacy Day, and we operate StaySafeOnline.org, our Web 

site. NTSA recently signed an MOU with the Department of Education and NIST to lead the National Cyber Security Education 

Council, a public-private partnership to address formal cyber security education from basic education all the way through to degrees 

and workforce training programs. We have a long track record in 

conducting surveys about the practices of individual small businesses and the state of cyber security in U.S. schools. 

In October, we released the results of a study conducted in conjunction with Symantec about the cyber security practices of small 

businesses. We found that businesses still don’t have good practices 

and policies in place, allow risky behavior, and in general, fail to 

take a strategic approach to cyber security, leading unfortunately 

to a false sense of security. We found actually that businesses are 

becoming more reliant on the Internet. Two-thirds say that their 

business is dependent on the Internet for day-to-day operations and 

also two-thirds say they have become more dependent on the Internet in the last 12 months. A majority, 57 percent, say that the loss 

of the Internet access for 48 straight hours during a regular business week would be disruptive to their business. 


pmangrum on DSK3VPTVN1PROD with HEARING
18 

We learned that businesses actually have critical information on 

hand. Sixty-nine percent report handling customer data, half deal 

in financial records and reports, one-quarter have their own intellectual property, which we have been discussing a lot today, and 

actually one-fifth have the intellectual property of other people in 

their business, which I think is something we have to be concerned 

about as well. 

We discovered that small businesses aren’t creating an environment that promotes cyber security. Seventy-seven percent do not 

have formal Internet security policies for employees, and nearly 

half of those don’t even have informal cyber security policies for 

their employees. Sixty-three percent don’t have policies that relate 

to the use of social networks in the workplace, and two-thirds allow 

the use of USB devices in the workplace. These are general risk 

factors that we are aware of. 

Unfortunately, these data show that the entire small business 

ecosystem is at risk, and we look at it that way a lot. We need to 

reach every small business with information that will help them 

protect their digital assets. Cyber criminals, as has been mentioned 

here, are well aware of these vulnerabilities, and small businesses 

have become a primary target for them. 40 percent of all targeted 

attacks are directed to businesses with less than 500 employees, 

and roughly 60 percent close within 6 months of a cyber attack. It 

is tough enough for small businesses to make and thrive, we 

shouldn’t also be losing them to cyber criminals. There is no single 

government agency, nonprofit group that can take on—company, 

government agency or nonprofit group that can take on this vast 

issue alone or reach every small business. Working together with 

a broad array of stakeholders, leveraging resources, sharing the responsibility is our best hope for success. 

Based on this thought of a collaborative approach, here are some 

ideas that we have about what we could do. Create a harmonized 

message in a campaign, like STOP. THINK. CONNECT. that can 

be deployed by key stakeholders. That would go a long way to clarifying for business owners what they need to do, and it would come 

from trusted sources. 

Align forces within the Federal Government to support small 

businesses. Many Federal agencies have an interest in helping 

small businesses grow and protect their digital assets. At minimum, the Small Business Administration, the Department of Commerce, the FTC, the FCC, the Department of Homeland Security 

should participate, but others such as the Department of Defense 

and the IRS that work and touch small businesses should be involved as well. 

Engage local communities in the effort. Small business owners 

are likely to listen to their local peers. A few forward-thinking communities, such as Washtenaw County, Michigan, San Diego, California, San Antonio, Texas, and Colorado Springs have started efforts to make their communities more cyber secure, and they have 

all prioritized small business as a key target in their communities 

to make that happen. 

Support education reform that leads to a more cyber capable 

workforce. We need a workforce in the 21st century that underVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00022 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
19 

stands how to use technology safely, securely, ethically, and productively when they graduate high school or college. 

And encourage your colleagues, I think as Representative Thornberry has done, to make information available to small businesses 

in your district. Go out, talk with them, have a town hall on cyber 

security, and get the conversation going. 

Thank you for your time and attention to this issue, and I look 

forward to your questions. 

Chairwoman ELLMERS. Thank you, Mr. Kaiser. We are going to 

go ahead and get started with some questions, and just so you 

know, we will be called for votes about 2:15, so what I am going 

to do is I am going to yield now to Mr. Tipton from Colorado for 

his questions. 

Mr. TIPTON. Thank you, Madam Chair. Glenn, I would like to 

thank you for joining us. Once again, it is good to have a Coloradoan here and to be able to see you. I was disturbed a little bit, 

the stories that you had in your written testimony about the costs 

to your businesses in terms of the data breach from the other company, I believe it was a liquor company; is that right? 

Mr. STREBE. Yes, it was. 

Mr. TIPTON. The mistake ended up costing you thousands of dollars for nothing you had no control over, and you also mentioned 

that you were only able to recover 35 percent of your incurred expenses. What additional steps would you recommend that Congress 

and this committee take to curb this phenomenon and without imposing burdensome regulations on small businesses? 

Mr. STREBE. As I mentioned in my verbal comments as well as 

in the written testimony, one of the things that does not occur out 

in the business world is the fact that there is no liability, there is 

no accountability. In the case of that liquor store, the police were 

involved in that case, and they themselves were confronting the liquor store, asking them, you know, What are you doing? They said, 

Well, we don’t have any liability, so we are really not going to 

worry about it, and as a result of that it cost us over $60,000. What 

would I do? I would look for the opportunity to hold accountable, 

as I have written in testimony, hold accountable those businesses 

that have such a cavalier attitude. 

Mr. TIPTON. I appreciate that. And Dr. Schneck, I believe in your 

comments you said that we have got to be very cautious that we 

just aren’t in a manner of compliance as opposed to having the security. Would you like to expand on that a little bit because I think 

as small business people we often see, we spend a lot of time making sure we are complying as opposed to getting the job done. 

Ms. SCHNECK. Thank you. The problem with regulation is that 

it draws a box, it draws a box where they have to take the money 

and invest, and it does two things: Number one, it stifles innovation because if companies are only having to fill that box and invest 

in those X places, it doesn’t leave a lot of room for advancing creativity, saying well, how else can we solve this problem that might 

be better because the regulation is this is what we have to buy, it 

is in this box. 

The second thing it does that can really hurt small businesses, 

it shows the adversary, the cyber adversary, everything that is outside of the box, and small business is already a target, as has been 


pmangrum on DSK3VPTVN1PROD with HEARING
20 

mentioned, not only a target to bounce into a larger enterprise, but 

small businesses, in many cases, are developing the intellectual 

property that could make the next jet engine and working on national security and holding private information, all kinds of ways. 

So they are holding the same intellectual property and harboring 

the same risk as a big company that can afford a dedicated team 

and the best security, but they can’t afford, they don’t have the 

extra money to do that to secure their piece, and at the same time 

what regulation would do is show the outline of the box and show 

the bad guy exactly where he can go straight into those small businesses that can’t afford to protect it, so what we really need to do 

is incentivize, and as was mentioned by Representative Thornberry 

and some other colleagues, some good incentives for businesses to 

be able to target that investment upfront, make cyber security part 

of the corporate risk and go ahead, as I mentioned, and minimize 

the amount of information that is stored on their network. Compliance and regulation are not going to protect us. 

Mr. TIPTON. So be very cautious about trying to have a one-sizefits-all regulatory policy? 

Ms. SCHNECK. Exactly. Or anything that doesn’t allow innovation. 

Mr. TIPTON. Thank you so much. I yield back, Madam Chair. 

Chairwoman ELLMERS. Thank you. I am going to go ahead and 

ask my questions now. This question I would like to ask the entire 

panel for your opinion. There is a variety of Federal agencies and 

organizations involved in combating cyber security, as you know. 

Do you think small businesses know where to go to get the best 

information and assistance and, if not, what recommendations do 

you have to help us get that information out? Starting with Mr. 

Kaiser. 

Mr. KAISER. Yeah, you know, we take approach to all this, a 

similar approach across all education and awareness in cyber security on this issue, which is that we should not try to spend a lot 

of time trying to get, in this case, small businesses to trust other 

entities for new information. We should be going to the entities 

that they already trust and getting them to disseminate a very 

similar comprehensive harmonized message, so whether it is in 

their vertical of their industry or to a government agency that they 

already trust or back to a software provider on an ISP, if we can 

coordinate and harmonize that messaging, then they will just go to 

who they trust, and no matter where they go they will get the right 

message. I think that is really the work that we have to do at this 

level to support them at the lower levels. 

Ms. SCHNECK. I would definitely agree and echo those remarks. 

I would add that the cyber adversary is fast, shares information 

very well, already has trust, is often very well funded. So they can 

act without any legal boundaries, IP boundaries, and that is why 

they are winning. The very best thing that we can do as the good 

guys is match that and then go one step better. Since small business makes up 99.7 percent, I calculate that as part of the fabric, 

they are a large part of the cyber information and situational 

awareness that we will see, breaches, how they happen, what they 

are seeing. First and foremost, we would ask them to know who to 

call, whether it is a partnership of law enforcement or others that 


pmangrum on DSK3VPTVN1PROD with HEARING
21 

you trust, know who that is ahead of time so that you can all get 

together when you see something, and even build those relationships to determine steady state so you can understand an anomaly 

even when things are good. 

The second thing is work with those public-private partnerships, 

they are so important because not only do small businesses get access to people and resources that do have million dollar budgets to 

do things and see more things globally, but you also put information from that 99.7 percent of the fabric back into the pot that protects the entire fabric. 

We, again, only are as good as our weakest link. Our small businesses are so strong in the innovation, we can’t let them be weak 

in the security just because of money, and we have to incentivize 

that spend and incentivize putting some of their resources into 

those partnerships. 

Mr. STREBE. I believe that the most basic level, working with 

some of your business customers or business owners to educate 

them on where they can find that information is very, very crucial. 

I can’t really speak for everybody else out there. I can speak on behalf of our credit union. We have about a thousand business accounts, and we quite often, and we have a very professional IT 

staff, as the Doctor suggested, that if we have a member of ours 

or a small business of ours that asks us how do I do this or how 

do I do that, while we are not in the profession of trying to give 

them IT security advice, we recognize the fact that without them 

we have no meaning, and as a small credit union or not a small 

credit union, we are a medium-sized or a large credit union, as a 

credit union, we truly believe in trying to help our membership to 

the greatest extent possible, so I completely agree with the Doctor 

that if we can provide some framework information, some construct 

of where they can get the information, how they can get the information and from whom, that will be very, very valuable for us 

going forward. 

As a credit union, we will always help our membership, as I believe—while I can’t speak for every credit union, I am pretty confident that I can speak for a lot of them that they would say any 

member of ours that wants a little bit of help in trying to understand some of the threats out there, we would definitely, definitely 

help them because we just feel that as a member-based organization, we need to do that. 

Mr. BEAM. I would say the electric industry is a little different 

than some of the other small business groups in that we are currently regulated by the Federal Energy Regulatory Commission for 

reliability in cyber security, and so we have a clear place to go for 

clarification on cyber security issues. One thing I would like to emphasize as we consider new cyber security legislation is making 

sure you have that clear line of demarcation of one agency regulating one group and not having overlap. I think that will just 

cause confusion and really muddy the waters. But I would like to 

echo what some of the other panelists have said about the importance of the public-private partnership and the information sharing. I think that is really the key to improving our cyber security 

rather than through regulations. 


pmangrum on DSK3VPTVN1PROD with HEARING
22 

Chairwoman ELLMERS. Excellent. Thank you so much. I am now 

going to recognize Ranking Member Richmond for his questions. 

Mr. RICHMOND. And I think I will just start with Dr. Schneck on 

this. The question becomes, and we heard the Congressman talk 

about just general computer hygiene. If that accounts for about 

four out of five of the security breaches that we have, then do you 

think that it is worthwhile for us—or whether it has merit or it is 

too cost prohibitive for us—to require almost like we do with some 

public service announcements to remind people of these very simple things that they can do to keep their information secure. If we 

can cut out 80 to 85 percent just by doing that, should we require, 

or do you have some ways that would incentivize people to provide 

that information when you go to Yahoo! or whatever you do online, 

to provide some of that simple hygiene information and to reinforce 

how important that is? 

Ms. SCHNECK. I absolutely agree that that basic hygiene will 

take care of a large percent of the issues. The analogy I would use 

is many years ago, Howard Schmidt used the analogy to seatbelts 

in cars and the process that it took to get people to use seatbelts. 

The other analogy that has been used is the forest fires. A lot of 

this goes back to education awareness that our colleagues at the 

NCSA do a great job of and others and certainly the credit unions 

that we have heard, but I want to also point out that that 20 percent is evil, that 20 percent that we can’t catch with the hygiene 

that Representative Thornberry also mentioned. That is the part 

where very quiet attackers that don’t want you to know that they 

are there, they are not looking for your bank information, they are 

looking to find exactly the people that sit on top of core intellectual 

property, whether it is recipes, oil field diagrams or diagrams for 

other parts, military, they will sit there until they find it, and they 

will send it home, and that is moving jobs, money, and markets 

across countries and companies, and that is the piece that we want 

to also incentivize companies and small companies, especially because they don’t have extra money to invest in protecting that and 

to consider it part of the corporate risk, so I think it is twofold. 

One is it certainly is an awareness campaign, and NCSA has the 

Cyber Security Awareness Month with the government and does a 

lot of different things. I think we are a lot more—I sit on the 

ISPAB as well, and we were briefed on some of these efforts, and 

I think as a community we are a lot more aware now than we were 

before of cyber as an issue. I think this hearing is one example of 

that. But the other side is these very quiet attacks. We do need to 

incentivize our small businesses to protect what they have. What 

they have is key to our national security, and that can’t be overstated. 

Mr. RICHMOND. Well, and part of my thinking was that if we can 

eliminate 60 to 80 percent strictly by information and being very 

creative, it would allow us and free up more money, more time, 

more energy to focus on those people who are going to try to do it 

no matter what all the time and are very sophisticated and evil 

with it. Anyone can answer this question, but how has cloud computing, I guess no pun intended, clouded our ability to protect ourselves? And I guess I just started to look at some of my new data 

in the office, and they talk about cloud computing, it just scares me 


pmangrum on DSK3VPTVN1PROD with HEARING
23 

to just have information floating out there. So how safe is it, and 

how has it complicated your jobs and our ability to keep the country safe? 

Ms. SCHNECK. I guess I will start. So the important thing is to 

protect data in motion, data at rest, and data in use. What cloud 

does is it outsources data processing, so it says that you are, to 

your point, you are sending your information somewhere else to be 

processed, and then it comes back so that you can view it, and the 

danger that people immediately sense is while it is not on my network and in transit and while the third party is holding it, is it 

protected? And these are the questions that have to get answered. 

The very, very beneficial side of cloud computing is that it is very 

efficient. You can package your computing processing power, you 

can have somebody else pay the bills for chilling the computing and 

doing the efficiencies, you can do high performance calculation, and 

the data comes back and it is a fraction of a price if you had a CPU 

on every machine, and that scales beautifully. So for small business, you can outsource a lot of your computing needs, and it ends 

up saving them a lot of money. 

The other side is they have to make sure when those data are 

in transit they are working with a third-party provider that is taking care of encrypting or protecting the identity or the data when 

it is in storage, when it is being processed, and certainly on its way 

back. A big advantage is that if you are using a good provider, 

whatever service it is, the high-end providers do have the million 

dollar budgets to secure things right, whereas the small businesses 

may not. So there are a lot of efficiencies and a lot of security built 

into cloud, even though it requires that we send our data offsite. 

Mr. RICHMOND. And this question would be for Mr. Kaiser. How 

important is it for us to deal with breach notification laws as opposed to the many different laws in the various States, and does 

it make sense and would it help the small business or businesses 

period for us to come up with a national standard for breach notification as opposed to having different laws in I think 48 States now 

that have them and small businesses that do business across State 

line having to, I would assume, to comply with all of them. 

Mr. KAISER. Yeah, I think that at the end of the day, I think 

wherever we can have clarity for both businesses and consumers, 

that is a good thing, right, so people know what to expect when 

something happens and know what will happen if something happens, and how that gets accomplished I think could be done probably in a number of different ways, but I do think that clarity, you 

know, where, you know, because the data really lives everywhere 

because not only of cloud, but just the way the Internet works, you 

know, as a consumer, I am doing business with people all over the 

country when I am using the Internet, and small businesses are 

doing business all over the country. I think where we can have 

clarity about what will happen when a breach occurs and from both 

sides, both as a person whose information was lost and also as the 

person or business that lost the information, I think that is just 

helpful in general on a lot of these cyber issues, not only that, but 

also on education awareness, clarity about the message, those 

things help. It is kind of a confusing world out there, and there is 


pmangrum on DSK3VPTVN1PROD with HEARING
24 

a lot of different messages, so anything that helps that I think is 

good. 

Mr. RICHMOND. And my last question would be for Mr. Strebe, 

and that question would simply be, you mentioned the analogy— 

the example of the liquor store that was very careless which exposed the credit union, I would assume, to I think you said $60,000 

worth of repayments. Do you think legislation—is needed to clear 

up responsible parties or to figure out and help find who is responsible for data breaches and who shall reimburse the consumer at 

the end of the day or the person who sustains the loss? 

Mr. STREBE. I think with legislation you can create a framework 

that any small business can follow. When you look at things, we 

have talked about hygiene today. If they are not following simple 

hygiene and they are not doing a basic standard of care, I think 

responsibility can be held or liability can be pushed back on to a 

small business. If they take care of that or if they create or through 

legislation create a framework and create, you know, here is the 

exact things that you are going to do, and they follow that and they 

are not negligent, I think you could essentially hold them harmless 

for, you know, again, a due standard of care. 

Anytime somebody just completely thinks that data security and 

cyber security is off the radar screen for them and they think that 

they can push all of the responsibility back to us as a financial institution, I think that creates substantial challenges for us as a financial institution. In addition, I think it is really valuable from 

a reputation risk standpoint to understand that anytime there is 

some sort of compromise and we notify our members that what has 

happened, they automatically think it was us as a financial institution that was penetrated, and when that happens, we have to, we 

spend a lot of money trying to overcome that and trying to tell 

them that, well, it wasn’t us, we can’t disclose that to you, we can’t 

make public who it actually was, and as a result of that, those 

costs are borne by us. 

So as I look forward, I do believe a construct or framework can 

create a basic standard of care that they are going to have to follow 

and things that they need to do, and if they are negligent in that, 

then they can be held responsible. You know, can you try to address every single item? I don’t believe you can because, as was 

mentioned before, every time you try to solve one thing there are 

two more things that come on the horizon, and then you are just 

continuing to chase your tail. I just look at it and say there is some 

basic necessities in commerce today that have evolved over the past 

10 years that a businessman really, really needs to grab hold of 

and make sure they are accomplishing. 

Mr. RICHMOND. Thank you, and I will yield back. 

Chairwoman ELLMERS. I have one more question, and I am going 

to quickly, and it is all for the entire panel. Of course, we are hearing about the statistics of the frequency of the cyber attacks. In 

general, if you could give us an idea in your sector of business what 

that frequency is, how often, and how often do you receive information from the Federal or State government warning you of any particular upcoming threats that might be occurring? Starting with 

Mr. Kaiser. 


pmangrum on DSK3VPTVN1PROD with HEARING
25 

Mr. KAISER. Yeah, we don’t really deal in that kind of information between the industry and government, but I will say, just as 

a regular person who looks at the news every day, those threats, 

those attacks are happening all the time, and so we really need to 

be able to respond to them. 

Ms. SCHNECK. We see 66,000 new variants of malware every day 

in McAfee Labs, and that is only going up. And then if you take 

that and you look at the story across the sectors, those malware 

examples and variants are being used to do things such as steal 

the oil field exploration diagrams across the energy sector, and 

these are things that we have published. 

I think you ask a very important question, how much do we get 

from the government? Not much right now. And that could be because of framework, it could be because of the structure. We are 

active in, I would say, most of the major public-private partnerships, but the idea is that we actually share a lot more out with 

government. When we find things, we give as much to government, 

law enforcement, and all the way to State and local as we can, and 

looking at how we can do that more quickly, take the most actionable egregious information and get it to law enforcement faster is 

a challenge across, I believe, the entire business community, and 

the way this affects small business is that needs to get to them, 

and we are legally tied when it comes to sharing with the private 

sector. It is a little bit easier in some cases with government, but 

we need to get it back to those small businesses, and that is why 

from personal experience, I advocate that small businesses get with 

those partnerships. 

Mr. STREBE. In our case I cannot give you specific numbers. 

What I can tell you is, as a financial institution, we do this 24/7/ 

365 times, however many years are in the future. We always have 

to do this. We are getting, I don’t want to say hit, because that 

sounds like somebody actually penetrates us. We always see—we 

have a fortress or a cyber fortress that is built around our financial 

institution, and we always see people coming from all around the 

world trying to find vulnerabilities in our system and IP addresses 

that are open and they can try to penetrate our system. 24/7/365 

times the future, that is exactly how many times we see it. It is 

always happening. 

Mr. BEAM. As far as notifications from the government, NERC 

has a advisory system where they send out alerts. We have received 40 of those since 2008. Of those, the majority were 

advisories that were just advising us of a potential issue. Only a 

handful were things that required us to take action, but we did 

take action on those, and none of those was an imminent threat. 

They were a potential threat that you needed to take action to prevent. 

On the business side, we have our system divided into two completely separate networks. One controls the electric system, and 

one is the business system. The electric system is completely separate from the Internet. There is no connection. And so we have had 

no outside traffic ever able to get on to that system and cause any 

kind of malicious attack. 

On the other side, in 2011 alone, we got 74 million emails hit the 

firewall. Of those, only 16 million got through, and those in our inVerDate Mar 15 2010 14:47 Mar 02, 2012 Jkt 072810 PO 00000 Frm 00029 Fmt 6633 Sfmt 6602 E:\HR\OC\A810.XXX A810

pmangrum on DSK3VPTVN1PROD with HEARING
26 

ternal review processes only allowed 4 million through to the actual end users as legitimate emails. So as everybody else has said, 

we are constantly getting things that are malicious in one way or 

another, be it spam or whatever, but they are not necessarily attacks from a foreign government of that type. As far as anything 

that was actually directed to the electric system in a malicious 

way, we have never had an attack that we are aware of. 

Chairwoman ELLMERS. Mr. Strebe, have you in your industry, in 

the financial credit union world, does the Federal or State level of 

government, do you get notifications that there are imminent 

threats? 

Mr. STREBE. If I waited until I got the information from them, 

it would be way too late. 

Chairwoman ELLMERS. So you are on top of it ahead of time? 

Mr. STREBE. We quite often end up sharing what is happening 

in our institution with other folks that are out there, yeah. We 

can’t wait. We know before everybody else does because it is real 

time for us. 

Chairwoman ELLMERS. Thank you, thank you. I just wanted to 

make sure I clarified that. 

And again, thank you to all of our participants, you know, panel 

1 and panel 2. This subcommittee will continue to closely follow 

this issue. I want you to be aware of that and know that we are 

going to be working on this very issue. It is clear that there is no 

one-size-fits-all policy for cyber security. I look forward to working 

with my colleagues to make sure small businesses have the resources available to combat cyber attacks while not adding to any 

duplicative regulatory burdens. 

I ask unanimous consent that Members have 5 legislative days 

to submit statements and supporting materials for the record. 

Without objection, so ordered. This hearing is now adjourned. 

[Whereupon, at 2:26 p.m., the subcommittee was adjourned.] 


pmangrum on DSK3VPTVN1PROD with HEARING
27 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 62 here 72810A.001
28 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 63 here 72810A.002
29 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 64 here 72810A.003
30 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 65 here 72810A.004
31 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 66 here 72810A.005
32 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 67 here 72810A.006
33 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 68 here 72810A.007
34 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 69 here 72810A.008
35 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 70 here 72810A.009
36 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 71 here 72810A.010
37 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 72 here 72810A.011
38 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 73 here 72810A.012
39 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 74 here 72810A.013
40 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 75 here 72810A.014
41 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 76 here 72810A.015
42 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 77 here 72810A.016
43 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 78 here 72810A.017
44 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 79 here 72810A.018
45 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 80 here 72810A.019
46 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 81 here 72810A.020
47 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 82 here 72810A.021
48 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 83 here 72810A.022
49 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 84 here 72810A.023
50 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 85 here 72810A.024
51 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 86 here 72810A.025
52 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 87 here 72810A.026
53 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 88 here 72810A.027
54 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 89 here 72810A.028
55 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 90 here 72810A.029
56 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 91 here 72810A.030
57 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 92 here 72810A.031
58 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 93 here 72810A.032
59 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 94 here 72810A.033
60 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 95 here 72810A.034
61 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 96 here 72810A.035
62 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 97 here 72810A.036
63 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 98 here 72810A.037
64 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 99 here 72810A.038
65 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 100 here 72810A.039
66 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 101 here 72810A.040
67 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 102 here 72810A.041
68 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 103 here 72810A.042
69 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 104 here 72810A.043
70 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 105 here 72810A.044
71 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 106 here 72810A.045
72 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 107 here 72810A.046
73 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 108 here 72810A.047
74 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 109 here 72810A.048
75 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 110 here 72810A.049
76 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 111 here 72810A.050
77 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 112 here 72810A.051
78 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 113 here 72810A.052
79 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 114 here 72810A.053
80 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 115 here 72810A.054
81 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 116 here 72810A.055
82 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 117 here 72810A.056
83 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 118 here 72810A.057
84 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 119 here 72810A.058
85 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 120 here 72810A.059
86 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 121 here 72810A.060
87 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 122 here 72810A.061
88 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 123 here 72810A.062
89 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 124 here 72810A.063
90 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 125 here 72810A.064
91 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 126 here 72810A.065
92 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 127 here 72810A.066
93 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 128 here 72810A.067
94 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 129 here 72810A.068
95 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 130 here 72810A.069
96 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 131 here 72810A.070
97 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 132 here 72810A.071
98 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 133 here 72810A.072
99 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 134 here 72810A.073
100 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 135 here 72810A.074
101 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 136 here 72810A.075
102 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 137 here 72810A.076
103 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 138 here 72810A.077
104 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 139 here 72810A.078
105 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 140 here 72810A.079
106 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 141 here 72810A.080
107 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 142 here 72810A.081
108 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 143 here 72810A.082
109 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 144 here 72810A.083
110 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 145 here 72810A.084
111 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 146 here 72810A.085
112 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 147 here 72810A.086
113 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 148 here 72810A.087
114 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 149 here 72810A.088
115 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 150 here 72810A.089
116 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 151 here 72810A.090
117 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 152 here 72810A.091
118 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 153 here 72810A.092
119 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 154 here 72810A.093
120 


pmangrum on DSK3VPTVN1PROD with HEARINGInsert offset folio 155 here 72810A.094