U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

71–238 PDF 2012

CYBER SECURITY: 

PROTECTING AMERICA’S NEW FRONTIER 

HEARING 

BEFORE THE

SUBCOMMITTEE ON CRIME, TERRORISM, 

AND HOMELAND SECURITY 

OF THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

NOVEMBER 15, 2011 

Serial No. 112–80 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 

(II) 

COMMITTEE ON THE JUDICIARY 

LAMAR SMITH, Texas, Chairman 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

ELTON GALLEGLY, California 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

STEVE CHABOT, Ohio 

DARRELL E. ISSA, California 

MIKE PENCE, Indiana 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TIM GRIFFIN, Arkansas 

TOM MARINO, Pennsylvania 

TREY GOWDY, South Carolina 

DENNIS ROSS, Florida 

SANDY ADAMS, Florida 

BEN QUAYLE, Arizona 

MARK AMODEI, Nevada 

JOHN CONYERS, JR., Michigan 

HOWARD L. BERMAN, California 

JERROLD NADLER, New York 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

MELVIN L. WATT, North Carolina 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO R. PIERLUISI, Puerto Rico 

MIKE QUIGLEY, Illinois 

JUDY CHU, California 

TED DEUTCH, Florida 

LINDA T. SA ́ NCHEZ, California 

[Vacant] 

SEAN MCLAUGHLIN, Majority Chief of Staff and General Counsel 

PERRY APELBAUM, Minority Staff Director and Chief Counsel 

SUBCOMMITTEE ON CRIME, TERRORISM, AND HOMELAND SECURITY

F. JAMES SENSENBRENNER, JR., Wisconsin, Chairman 

LOUIE GOHMERT, Texas, Vice-Chairman 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

J. RANDY FORBES, Virginia 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TIM GRIFFIN, Arkansas 

TOM MARINO, Pennsylvania 

TREY GOWDY, South Carolina 

SANDY ADAMS, Florida 

MARK AMODEI, Nevada 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO R. PIERLUISI, Puerto Rico 

JUDY CHU, California 

TED DEUTCH, Florida 

SHEILA JACKSON LEE, Texas 

MIKE QUIGLEY, Illinois 

[Vacant] 

CAROLINE LYNCH, Chief Counsel 

BOBBY VASSAR, Minority Counsel 

(III) 

C O N T E N T S 

NOVEMBER 15, 2011 

Page 

OPENING STATEMENTS 

The Honorable Louis Gohmert, a Representative in Congress from the State 

of Texas, and Vice-Chairman, Subcommittee on Crime, Terrorism, and 

Homeland Security ............................................................................................... 1 

The Honorable Robert C. ‘‘Bobby’’ Scott, a Representative in Congress from 

the State of Virginia, and Ranking Member, Subcommittee on Crime, Terrorism, and Homeland Security .......................................................................... 3 

WITNESSES 

Richard W. Downing, Deputy Chief, Computer Crime and Intellectual Property Section, Criminal Division, United States Department of Justice 

Oral Testimony ..................................................................................................... 5 

Prepared Statement ............................................................................................. 8 

The Honorable Michael Chertoff, Co-Founder and Managing Principal, The 

Chertoff Group 

Oral Testimony ..................................................................................................... 16 

Prepared Statement ............................................................................................. 19 

James A. Baker, Lecturer on Law, Harvard University 

Oral Testimony ..................................................................................................... 31 

Prepared Statement ............................................................................................. 33 

Orin S. Kerr, Professor of Law, George Washington University 

Oral Testimony ..................................................................................................... 38 

Prepared Statement ............................................................................................. 40 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Response to Post-Hearing Questions from Richard W. Downing, Deputy Chief, 

Computer Crime and Intellectual Property Section, Criminal Division, 

United States Department of Justice ................................................................. 76 

Response to Post-Hearing Questions from the Honorable Michael Chertoff, 

Co-Founder and Managing Principal, The Chertoff Group .............................. 82 

Response to Post-Hearing Questions from Orin S. Kerr, Professor of Law, 

George Washington University ........................................................................... 83 

(1) 

CYBER SECURITY: 

PROTECTING AMERICA’S NEW FRONTIER 

TUESDAY, NOVEMBER 15, 2011 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON CRIME, TERRORISM, AND HOMELAND SECURITY, COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Subcommittee met, pursuant to call, at 10:03 a.m., in room 

2141, Rayburn House Office Building, the Honorable Louie 

Gohmert (Vice-Chairman of the Subcommittee) presiding. 

Present: Representatives Gohmert, Scott, Deutch, Forbes, 

Marino, Gowdy, Lungren, Jackson Lee, and Goodlatte. 

Staff present: (Majority) Caroline Lynch, Subcommittee Chief 

Counsel; Arthur Radford Baker, Counsel; Sam Ramer, Counsel; 

Lindsay Hamilton, Clerk; Vishal Amin, Counsel; (Minority) Joe 

Graupensberger, Counsel; Veronica Eligan, Professional Staff Member. 

Mr. GOHMERT. The Subcommittee will come to order. 

Welcome to today’s hearing on cyber security. I would especially 

like to welcome my witnesses and thank you for joining us today. 

I am joined today by the distinguished Ranking Member of the 

Subcommittee, Bobby Scott, and by the most recent Chairman 

Emeritus, Mr. Conyers, who as I understand will be coming shortly. 

I want to welcome everybody to the hearing on ‘‘Cyber Security: 

Protecting America’s New Frontier.’’ The Internet revolutionized 

our society in many ways. While its benefits abound and extend 

from our largest corporations to remote rural regions throughout 

the Nation, individuals in the United States and abroad have unfortunately been able to exploit the Internet for criminal means. 

Cyber crime often is faceless and has proven to defy traditional 

investigative prosecutorial tools. As a result, the frequency of cyber 

crime is growing rapidly and now includes many international 

criminal syndicates and is threatening our economy, our safety and 

our prosperity. 

Even more worrisome are the national security implications of 

cyber intrusion. We in Congress are concerned that we are witnessing the opening salvos of a new kind of conflict waged in cyberspace. 

As we learned in the Wikileaks case, one individual with access 

to classified data can threaten America’s national operational security, and as we saw from China’s cyber attack on Google and other 

2 

companies, America’s edge in innovation and technical superiority 

can be compromised by competing countries who make theft of intellectual property a national strategy. 

As recently reported in the Fiscal Times, China’s brazen use of 

cyber espionage stands out because the focus is often corporate and 

part of a broader government strategy to help the develop or help 

develop the country’s economy. 

Quote, I’ve been told that if you use an iPhone or a BlackBerry 

everything on it—contacts, calendar, emails—can be downloaded in 

a second. All it takes is someone sitting near you on a subway 

waiting for you to turn it on and they have got it, said Kenneth 

Lieberthal, a former senior White House official for Asia who is at 

the Brookings Institution. 

One security expert reported that he buys a new iPad for each 

visit to China and then never uses it again. 

The problem remains that the United States government does 

not own the networks through which all data flows, as totalitarian 

regimes like China do. Your government and industry must team 

up at times to secure the networks and create digital shields to 

protect our country and our business. 

The Administration has recently released a cyber security initiative proposal which aims to make changes to the cyber security 

structure and laws of the United States. We will look at the proposal today and we have a distinguished panel of experts here to 

help guide the Committee on what changes should be made to protect citizens from cyber criminals. 

One thing is clear. We have learned that computer crime is just 

as important as ordinary crime and should be treated just as 

harshly by our criminal justice system. The risks to our national 

infrastructure and our national wealth are profound and we must 

protect them. 

Besides our national security, we have something in this country 

as precious as wealth—our civil liberties. When it comes to cyber 

crime, Americans are fully engaged on the issue of protecting our 

civil liberties and privacy. They are correct to be so concerned, and 

we on this side of the aisle share their concern. 

Sometimes it seems like a dilemma. By using Facebook and other 

websites, Americans are putting more of their private lives on the 

Internet than ever before. Yet, more Americans are concerned 

about privacy than ever before. 

But it is understandable the more Americans rely on the Internet 

for their work, their entertainment, their relationships, the more 

productive and connected they become. But they also become vulnerable in new ways. 

It is truly a new frontier for our country and this Committee is 

determined that this new frontier will not be a Wild West. Our 

challenge is to create a legal structure flexible enough to protect 

our interests while allowing the freedom of thought and expression 

that made this country great. I am convinced we can thread this 

needle. 

I look forward to hearing more about this issue and thank all of 

our witnesses for participating in this hearing. It is now my pleasure to recognize for his opening statement the Ranking Member of 

the Subcommittee, Congressman Bobby Scott of Virginia. 

3 

Mr. SCOTT. Thank you, Mr. Chairman. 

I am pleased that we are conducting a hearing today on the important issue of cyber security. It is a critical issue. It is critical 

that we work together in Congress with the Administration and 

with the business community and with private advocates to find 

ways to enhance the security of our government information systems, our business computer networks and the personal use of the 

Internet. 

Last spring, the Administration sent to Congress a comprehensive cyber security legislative proposal. I was, frankly, disappointed 

that they called for mandatory minimum sentences for certain 

crimes of damaging critical infrastructure computers because mandatory minimums have been found to waste the taxpayers’ money, 

do nothing about crime and require sentences that often violate 

common sense. 

Resolving the significant issues relating to cyber security including protecting network access and operating aspects of our critical 

infrastructure is a very challenging problem. 

We must not shrink from the challenge but sentencing individuals who have been convicted of serious crimes is also a serious 

challenge as it requires individualized determination of what the 

person actually did, the harm they caused and the circumstances 

of the crime. 

And that’s why Congress actually did something right in this 

area when it created the U.S. Sentencing Commission whose job it 

is to establish sentencing guidelines to be used by judges in imposing appropriate sentences. Calling for mandatory minimum sentences shrinks from the challenge of doing this right. While the 

crime involved may involve—may indeed be serious, imposing mandatory minimum sentences on everyone will not make us more secure. 

The code section of the offense violated does not often—often 

does not accurately reflect the seriousness of the crime. This practice ultimately leads to injustice, cynicism and distress in our 

criminal justice system and the imposition of sentences that make 

no sense at all. 

Another issue that we need to talk about is the provision requiring notification of the government of certain breaches of sensitive 

personal information stored in the computer networks of businesses. The bill requires that an entity as of yet unnamed in the 

Department of Homeland Security shall be notified and that entity 

should also notify the FBI and Secret Service. 

Both of these agencies have specialized expertise that may be 

called upon depending, for example, whether the crime is one that 

threatens national security or the integrity of our financial systems. 

We need to hear more from the Administration and these agencies on how this would—how this coordination would take place. 

In addition, it is important that we examine whether the laws 

have maintained an appropriate focus on behavior we all believe 

rises to the level of criminal—Federal criminal liability. The Computer Fraud and Abuse Act was originally enacted to deal with intrusions into computers, what we now call hacking. 

4 

Since that time, we have expanded the scope of the law on several occasions which has led to a disturbing expansive use in recent 

years which have generated concerns on both sides of the aisle. 

For example, now it is possible for someone to be prosecuted for 

violating the user agreement in a social networking site. One of our 

witnesses is the distinguished law professor who has written extensively about these concerns. 

I hope this hearing will give us a chance to discuss these issues 

and the best approach for refocusing our efforts in this area. 

Finally, I note concern about proposals to expand the ability of 

private companies to share information with government and ultimately with law enforcement for the purpose of protecting against 

cyber security threats. If we allow vastly overbroad sharing of information, we actually may undermine the very privacy rights 

which should be at the forefront of our concern. 

So I thank all of our witnesses for being with you and thank you, 

Mr. Chairman, for calling the hearing. 

Mr. GOHMERT. And thank you, Mr. Scott. 

We now will proceed and it is my pleasure to introduce today’s 

witnesses. Richard Downing is the Chief Deputy or Deputy Chief 

for computer crime at the Computer Crime and Intellectual Property Section of the United States Department of Justice in Washington, D.C. 

Mr. Downing supervises the section’s computer crime work including the prosecution of computer hacking, identity theft and 

other online crimes. Mr. Downing also supervises a wide range of 

legislative and policy issues relating to computer crime. 

These issues include the modernization of the Federal Computer 

Hacking Statute policy and legislation aimed at improving cyber 

security, the development of the electronic evidence-gathering laws 

and efforts to enhance international cooperation in cyber crime investigations. 

Mr. Downing received his Bachelor of Arts in political science 

from Yale University in 1989 and his Juris Doctor from Stanford 

Law School in 1992. 

I will go ahead and introduce all of the witnesses and so we will 

just take one after the other without your having to be interrupted 

by me. 

The Honorable Michael Chertoff is co-founder and managing 

principal at the Chertoff Group in Washington, D.C. In addition to 

his role at Chertoff Group, Mr. Chertoff is also senior of counsel at 

Covington & Burling LLP and a member of the firm’s white-collar 

defense and investigations practice group. 

Prior to his work at Chertoff Group, Mr. Chertoff served as Secretary of the United States Department of Homeland Security from 

2005 to 2009. Before heading up the Department of Homeland Security, Mr. Chertoff served as a Federal judge on the U.S. Court 

of Appeals for the Third Circuit. 

Before serving as a judge, he was a Federal prosecutor for over 

a decade. Mr. Chertoff received his undergraduate degree from 

Harvard College in 1975 and his Juris Doctor from Harvard Law 

in 1978. 

Mr. James Baker is currently a lecturer on law at Harvard Law 

School. He most recently served as an Associate Deputy Attorney 

5 

General with the United States Department of Justice from 2007 

until last month, ending a 17-year career at the Department. 

In 2007, Mr. Baker was a Fellow at the Institute of Politics at 

the John F. Kennedy School of Government at Harvard University 

and was a lecturer on law at Harvard Law School. From 2001 to 

2007, Mr. Baker served as counsel for intelligence policy at the 

Justice Department where he was the head of the Office of Intelligence Policy Review. 

Mr. Baker is a former Federal prosecutor. He received his Bachelor of Arts in government from the University of Notre Dame in 

1983 and his Master of Arts in political science and Juris Doctor 

from the University of Michigan in 1988. He received—okay. 

And Professor Orin Kerr—Professor Kerr is a professor of law at 

George Washington University where he teaches criminal law, 

criminal procedure and computer crime law. 

Before joining the faculty in 2001, Professor Kerr was an honors 

program trial attorney in the Computer Crime and Intellectual 

Property Section of the criminal division at the United States Department of Justice as well as a Special Assistant U.S. Attorney for 

the Eastern District of Virginia. 

He is a former law clerk for Justice Anthony M. Kennedy of the 

U.S. Supreme Court and Judge Leonard Garth of the U.S. Court 

of Appeals for the Third Circuit. In the summer of 2009 and 2010, 

he served as special counsel for the Supreme Court nominations to 

Senator John Cornyn on the Senator Judiciary Committee. 

He has been a visiting professor at the University of Chicago 

Law School and the University of Pennsylvania Law School. Professor Kerr received his Bachelor of Science degree in engineering 

from Princeton University and his Masters of Science from Stanford University while earning his Juris Doctor from Harvard Law 

School. 

All of the witnesses’ written statements will be entered into the 

record in its entirety and I ask that each witness summarize his 

testimony in 5 minutes or less. 

And at this time then, Mr. Downing, thank you for your patience. 

Please proceed with your opening statement. 

TESTIMONY OF RICHARD W. DOWNING, DEPUTY CHIEF, COMPUTER CRIME AND INTELLECTUAL PROPERTY SECTION, 

CRIMINAL DIVISION, UNITED STATES DEPARTMENT OF JUSTICE 

Mr. DOWNING. Good morning, Chairman Gohmert, Ranking 

Member Scott and Members of the Committee. 

Thank you for the opportunity to testify on behalf of the Department of Justice regarding the Administration’s cyber legislation 

proposals. 

This Committee knows well that the United States confronts serious and complex cyber security threats. The critical infrastructure of our Nation is vulnerable to cyber intrusions that could damage vital national resources and put lives at risk, and intruders 

have also stolen vast databases of financial information and valuable intellectual property. 

At the Department of Justice, we see cyber crime on the rise 

with criminal syndicates operating with increasing sophistication to 

6 

steal from innocent Americans. That is why President Obama has 

made cyber security a high priority. The Justice Department has 

done its part. 

For example, we have brought a series of important prosecutions, 

including cases against offenders from overseas, in an effort to 

build real deterrence. 

Despite this good work, the problem is far from solved. It is clear 

that new legislation can help to improve cyber security substantially. 

To that end, the Administration’s legislative proposal contains a 

number of ideas and I would like to take a moment to highlight 

the parts of that package aimed at improving the tools we use to 

punish and deter computer crimes. 

First, the Administration’s proposal includes reasonable and focused changes to ensure that computer crimes are punished to the 

same extent as other traditional criminal activity. 

For example, because cyber crime has become a big business for 

organized crime groups, the Administration proposal would make 

it clear that the Racketeering Influenced and Corrupt Organizations Act, or RICO, applies to computer crimes. 

Prosecutors have used this statute in the past to charge the leaders of organized crime families for their roles in their criminal enterprises, even where they did not themselves commit a predicate 

crime such as theft or extortion. 

In a similar way, RICO could be used to dismantle criminal enterprises focused on online theft and extortion and not just the people with their fingers on the keyboard. 

Also, the proposal would increase certain penalties in the Computer Fraud and Abuse Act, which is the statute used to prosecute 

hacking offenses so as to harmonize them with analogous traditional laws. 

For example, the crime of wire fraud carries a maximum penalty 

of 20 years in prison, but violations of the Computer Fraud and 

Abuse Act that involve very similar conduct carry a maximum penalty of only 5 years. Such disparities make no sense. 

The Computer Fraud and Abuse Act also currently has limitations that have prevented it from being fully used by prosecutors 

against criminals who traffic in computer passwords, and these 

shortcomings should be corrected. 

We propose that the scope of the offense for trafficking in passwords should cover not only passwords, but other methods of confirming a user’s identity such as biometric data, single-use pass 

codes, or smart cards used to access an account. This new language 

should cover log-in credentials used to access any protected computer, not just government systems or computers at financial institutions. 

Finally, some have argued that the definition of ‘‘exceeds authorized access’’ in the Computer Fraud and Abuse Act should be restricted so as to disallow prosecutions based solely upon a violation 

of an employee use agreement or a website’s terms of service. 

While we appreciate this view, we are concerned that restricting 

the statute in this way could make it difficult or impossible to deter 

and punish serious threats from malicious insiders. 

7 

The reality of the modern workplace is that employees in both 

the private and public sectors require access to databases containing large amounts of highly personal and sensitive data. 

We need look no further than bank customer service representatives, government employees processing tax returns, and intelligence analysts handling sensitive material. Because they need access in order to do their jobs, it is impossible to restrict their access 

through passwords or other security mechanisms. 

In most cases, employers communicate clear and reasonable restrictions on the purposes for which that data may be accessed. 

Employers should be able to set such access restrictions with the 

confidence that the law will protect them when their employees exceed these restrictions. Improperly accessing personal or commercial information is a serious matter that requires serious criminal 

consequences. 

We must not impair these prosecutions based on unsubstantiated 

fears that the Department will expend its limited resources on trivial cases such as prosecuting people who lie about their age on an 

Internet dating site. 

Mr. Chairman and Members of the Committee, this is an important topic. The country is at risk and there is a lot of work to be 

done to stop computer crimes from victimizing and threatening 

Americans throughout the country. 

I look forward to answering your questions here today. Thank 

you. 

[The prepared statement of Mr. Downing follows:] 

8 


RWD-1.eps
9 


RWD-2.eps
10 


RWD-3.eps
11 


RWD-4.eps
12 


RWD-5.eps
13 


RWD-6.eps
14 


RWD-7.eps
15 


RWD-8.eps
16 

Mr. GOHMERT. Thank you very much. 

At this time, Mr. Chertoff, we will hear from you. 

TESTIMONY OF THE HONORABLE MICHAEL CHERTOFF, COFOUNDER AND MANAGING PRINCIPAL, THE CHERTOFF 

GROUP 

Mr. CHERTOFF. Thank you, Mr. Chairman. Thank you, Ranking 

Member Scott and Members of the Committee. I am delighted to 

testify here today. 


RWD-9.eps
17 

It is actually my first return to Congress as a witness since I left 

office 3 years ago and I used to testify in this room about border 

security. 

Mr. GOHMERT. Yes, you did, and I knew you couldn’t stay away. 

Mr. CHERTOFF. Right. It is hard to stay away. 

This is a very important look at an important topic. It is a topic 

that includes, obviously, concerns about criminal behavior but is 

much broader than that. I would argue that the issue of cyber security is now at the very top of the list of security threats faced by 

the United States. 

We have seen multiple dimensions of the threat. Some of them 

involve massive acts of criminality. I remember when I was Secretary we prosecuted the theft of literally tens of millions of credit 

card numbers which were used to steal money from credit card 

companies and from individual customers. 

But beyond that, we have seen the use of cyber attacks as a way 

of stealing very valuable intellectual property including national 

security secrets and these are reported almost on a daily or weekly 

basis. 

Beyond that, there is the obvious concern about our industrial 

control systems which could in some circumstances be attacked in 

a way that might actually cause serious damage to property and 

serious loss of life. 

We have seen examples back in 2007 and 2008 that are declassified of attacks against Estonia or Georgia, which are really part 

of what you could very well argue is a new way of war making. 

So this has got to be dealt with in a number of different dimensions. Certainly, the criminal law is part of it but I would argue 

there are some other elements as well. 

Broadly speaking, I would say there are three concerns we have 

in terms of vulnerability. One is the network itself and how to protect the network, and that is in many respects a technical problem. 

But the supply chain is also a problem. We are living in a global 

environment in which hardware and software is fabricated around 

the world and our degree of confidence about whether there are 

malicious bits of code or other malicious tools embedded in our 

hardware or software is not what it needs to be. 

And perhaps most significantly is the insider threat. While many 

people think the biggest problem with cyber security is somebody 

hacking across a network, experience shows that in many cases it 

is the insider who wittingly or unwittingly introduces malware into 

the system in a way that causes an enormous amount of damage. 

To this end, I would commend an article written a couple years 

ago in Foreign Affairs by then-Deputy Secretary Bill Lynn who described a major intrusion into our defense networks as having been 

caused by somebody picking up a thumb drive and putting it into 

a laptop as an act of negligence. 

So we have got to deal with all of these problems and one of my 

observations over the years I have worked on this issue is a tendency to believe there is a magic bullet. There is no magic bullet. 

So I would argue that there are several things that we need to 

do. I think the current Administration proposal is a good start but 

it is a start. It is not an end. 

18 

First, I think we need to have tougher penalties and I in the 

main approve and applaud the proposals put forward by the Administration in that respect. Second, we need to make information 

sharing much easier. 

Time and again, when the private sector suffers an intrusion, the 

ability to get technical assistance about the nature of what that intrusion is is hampered by uncertainties in the law about whether 

the U.S. government and the private sector can share information. 

This has got to be made much easier and much more streamlined 

and I think, again, the proposal here is a good start. 

Third issue is how do we build standards of cyber security in our 

critical infrastructure. If we have a failure of critical infrastructure 

in, let’s say, the electric grid, there will be enormous collateral consequences. 

Unfortunately, the value of the damage often exceeds the value 

of the asset, which means that there is no market incentive for the 

asset owner to invest in protecting the asset. We have got to 

change that. Again, I think the Administration has begun with a 

good start in talking about having standards for cyber security. 

I am concerned about two things. One, how do we enforce the 

standards. I am not sure naming and shaming is sufficient. And 

second, we are talking about a very complicated and detailed rulemaking process which may take a considerable amount of time to 

complete, and the problem is time is not on our side. 

Finally, I conclude by observing that there is a larger national 

security dimension here involving the problem of cyber warfare, the 

actual use of cyber tools as an adjunct to military operations, and 

here we need to be clear about what our policy is in responding to 

those acts of war and we need to have a declared policy of deterrence, how we are going to prevent these from happening. 

This is work that is beginning but it has got a ways to go. I 

would be happy to answer questions. 

[The prepared statement of Mr. Chertoff follows:] 

19 


MC-1.eps
20 


MC-2.eps
21 


MC-3.eps
22 


MC-4.eps
23 


MC-5.eps
24 


MC-6.eps
25 


MC-7.eps
26 


MC-8.eps
27 


MC-9.eps
28 


MC-10.eps
29 


MC-11.eps
30 

Mr. GOHMERT. Thank you very much. 

Mr. Baker? 


MC-12.eps
31 

TESTIMONY OF JAMES A. BAKER, LECTURER ON LAW, 

HARVARD UNIVERSITY 

Mr. BAKER. Mr. Chairman, good morning. Ranking Member Scott 

and Members of the Committee, it is an honor to appear before you 

today to discuss the cyber security challenges that the country is 

facing. 

I would like to focus my remarks on a very few key points today. 

First, as you know and as we have already discussed here this 

morning, the United States faces a significant cyber threat today. 

The threat comes from many sources, nation states, non-state actors such as organized crime groups, terrorist organizations and 

lone individuals. 

As folks have said this morning, the money in our banks, our intellectual property and our critical infrastructure are threatened. 

There is a very real risk that at a time of crisis some parts of our 

critical infrastructure such as electrical, water, financial, transportation and telecommunications systems will not function as designed or at all. 

Presently, the United States is not fully prepared to deal with 

the cyber threat that we face. In other words, our defensive capabilities are insufficient to address the malicious activities that are 

directed against the United States. This includes Federal, state 

and local governments, civilian and military authorities and the 

private sector. 

At the present time, we cannot stop the theft of funds, intellectual property or personally identifiable information and we cannot 

ensure the malicious actors will not be able to degrade or destroy 

elements of our critical infrastructure at a time and in a manner 

of their own choosing. 

Although many people in the government and the private sector 

are working overtime to find more effective ways to address these 

vulnerabilities, right now we cannot guarantee our cyber security. 

All we can do is mitigate the risks. 

There are many reasons why we are not fully prepared to address the cyber threat today and these include technological, organizational, policy and legal issues. My written statement addresses 

these matters so in the interest of time I won’t discuss them all 

now. 

I will note, however, that one of the problems we must confront 

is that the Federal Government is not where it needs to be organizationally to address the cyber threat. There has been much 

progress in this sphere and the Administration’s proposal contains 

some important provisions in this regard. 

But the government is not where it needs to be in terms of clearly delineating agency roles and providing for robust but appropriate information sharing. 

Next, I would like to address some of the Administration’s proposals to amend the Computer Fraud and Abuse Act, or CFAA, and 

related provisions. Standing alone, as some have mentioned, these 

proposals will not address fully all of our—excuse me, all of our 

cyber security requirements. 

They are important, however, and likely will assist law enforcement agencies and prosecutors in better ensuring that cyber crime 

is deterred effectively and punished appropriately. I know that 

32 

some Members have concerns about aspects of this proposal but I 

urge Congress to work with the Administration to find a set of mutually acceptable provisions to modify the CFAA and related laws 

as quickly as you can. 

What Congress should not do, however, in my view, is to take 

steps that would weaken rather than strengthen the Computer 

Fraud and Abuse Act. I am concerned that some proposals to modify the terms of the existing act, in particular, those directed at 

modifying the scope of the term ‘‘exceeds authorized access’’, would 

have the unintentional effect of undermining the CFAA in certain 

respects. 

I understand the concerns that some have raised about the scope 

of the act, that it may be ambiguous and that government overreaching could result in individuals being prosecuted for what essentially are innocent or harmless violations of the terms of service 

of particular websites or services. 

I do not believe, however, that the case has been made that Federal prosecutors have regularly misused the CFAA, and to the extent that Congress is concerned that such abuses might occur, it 

strikes me that it might make more sense to use your oversight 

powers to ensure that enforcement of the CFAA is properly focused 

on the worst offenders. 

But do we really want to make it harder for the government to 

prosecute individuals who abuse their authorized access to immense databases at financial institutions, social networking sites 

and email providers to steal money or sensitive personal information? 

In closing, I recommend that the Subcommittee work quickly to 

enact some version of the Administration’s proposal. Cyber security 

is not a problem that is amenable to simple solutions but we need 

to start moving in the right direction as quickly as possible. Our 

adversaries are not waiting for us to act. 

Thank you, Mr. Chairman. 

[The prepared statement of Mr. Baker follows:] 

33 


Baker-1.eps
34 


Baker-2.eps
35 


Baker-3.eps
36 


Baker-4.eps
37 


Baker-5.eps
38 

Mr. GOHMERT. Thank you, Mr. Baker. 

Professor Kerr? 

TESTIMONY OF ORIN S. KERR, PROFESSOR OF LAW, 

GEORGE WASHINGTON UNIVERSITY 

Mr. KERR. Thank you, Judge Gohmert, Ranking Member Scott 

for the invitation to appear here this morning. I am going to begin 

by doing something that is probably unusual for a witness before 

you. I am going to admit that I am a criminal, at least according 

to the United States Department of Justice’s interpretation of the 

Computer Fraud and Abuse Act. 

Mr. GOHMERT. Sir, you have the right to remain silent. [Laughter.] 

Anything you say may—could be used against you. 

Mr. KERR. I will waive that right. 

Mr. GOHMERT. You have the right to consult an attorney if you 

wish. 

Mr. KERR. In fact, I would like to speak about this. Why am 

I—— 

Mr. GOHMERT. If you can’t afford an attorney one will be appointed for you. [Laughter.] 

Mr. KERR. Why am I a criminal? Well, I have a Facebook account. Facebook requires its terms of service—in its terms of service that you cannot provide any false information on Facebook. 

However, I do so. I say in my profile that I live in Washington, 

D.C. In fact, that is a blatant lie. I live in Arlington, Virginia. 

Therefore, I am in blatant violation of the terms of service, and according to the Justice Department I violate Federal criminal law 

every time I log in. 

Those of you may have children or grandchildren who are under 

the age of 18 who use Google to conduct searches. According to the 

Justice Department, they are also all criminals. Why? 

Well, because Google’s terms of service say you have to be of 

legal age to enter into a contract in order to use Google. The legal 

age to enter into a contract in most states is 18. 

Therefore, anybody under the age of 18 who uses Google is, according to the United States Department of Justice, a criminal. 

Tens of millions of Americans have Internet dating profiles. 

Those Internet dating profiles typically say the terms of service of 

the Internet dating services say that individuals must give all 

truthful information and cannot give misleading information. 

According to one study, more than 80 percent of Internet dating 

profiles give misleading information. Somebody might say they are 

an inch taller than they are, maybe five pounds less. Maybe they 

might say they go to the gym every week when they don’t. According to the United States Department of Justice, that makes them 

criminals. 

In fact, probably most people in this room, most of the witnesses, 

Members, counsel, members of the audience, most if not all are 

criminals under the United States Department of Justice’s interpretation of the Computer Fraud and Abuse Act. 

What is the government’s position here in how to amend the 

statute? My understanding is that the Justice Department wants 

39 

to further broaden the statute so that it encompasses more cases 

and is more punitive than before. 

I think the answer is to narrow the scope of this act to ensure 

that routine computer usage is not criminalized rather than to further broaden and enhance the penalties of the statute. 

The reason why this is a problem—the reason how we got into 

this situation—is that Section 1030 of the Computer Fraud and 

Abuse Act treats computers differently than it treats the physical 

world. If you think about you are an employee at a job, your boss 

says don’t go into the personnel files without a good work-related 

reason, you might—someone might look into those personnel files 

and might be disciplined for that. The boss might fire them or 

might not give them a raise but it wouldn’t be a crime just to look 

into the folder. 

On the Internet or in the case of computers, it is a different rule. 

The law says you cannot exceed authorized access, which the Justice Department sees as saying that any term of use or term of 

service by an employer or an Internet service provider is binding 

as a matter of law. 

If an employer says you can’t use the workplace computers for 

personal reasons and you do so, you are a criminal, again, a different rule in the case of using computers than there is in the case 

of offline real-world conduct. 

I think we need to amend the statute to eliminate those overly 

broad readings of the Computer Fraud and Abuse Act and that it 

is actually quite simple to do so. 

I have put in my written testimony two different ways of amending the statute which would narrow it and yet also preserve the 

Justice Department’s authority to prosecute the kinds of cases that 

they mention when they explain why they want existing law to be 

as it is. 

In particular, the Justice Department, when it talks about prosecuting cases under the ‘‘exceeds authorized access’’ prong, always 

talks about cases in which the data that is obtained is very valuable or very private information. 

However, the statute does not contain any such limitation. The 

statute applies to any act of exceeding authorized access to obtain 

any information at all. One simple way of fixing the statute would 

be to limit the Computer Fraud and Abuse Act so that the ‘‘exceeding authorized access’’ prong only applies to efforts to obtain personal information or valuable information. That would preserve the 

Justice Department’s ability to prosecute the kinds of cases it 

wants to prosecute and yet also preserve civil liberties of every 

other American who might, for good reasons, violate Internet terms 

of service of websites which it looks like most Americans who use 

the Internet and a computer probably do. 

Thank you. I look forward to your questions. 

[The prepared statement of Mr. Kerr follows:] 

40 


Kerr-1.eps
41 


Kerr-2.eps
42 


Kerr-3.eps
43 


Kerr-4.eps
44 


Kerr-5.eps
45 


Kerr-6.eps
46 


Kerr-7.eps
47 


Kerr-8.eps
48 


Kerr-9.eps
49 


Kerr-10.eps
50 

Mr. GOHMERT. Thank you. 

At this time, we will go to questions and I will reserve mine to 

allow other Members to go ahead. 

So let’s see, Mr. Forbes of Virginia? 

Mr. FORBES. Thank you, Mr. Chairman. 

Gentlemen, thank you all for your expertise and willingness to 

come here, and I understand Professor Kerr’s desire to want to be 

able to lie on his Facebook account and that is okay. My concern 

is this. 

I realize that we can have death by a thousand cuts with all 

these small cyber attacks but my big concern from sitting on the 

Armed Services Committee is the major gaping wounds that can 

happen to us if we were to have cyber warfare. 

And the question I would ask for all of you gentlemen who would 

like to respond is are our laws in any way hampering the Department of Defense from developing the technologies that we need to 

defend and protect against that major kind of attack if it was coming, which I believe one day we will see it in some portion or the 

other. 

And secondly, are our laws in any way hampering DOD from developing the kind of strategies we would need to be able to use that 

same kind of attack if, you know, heaven help us, we would have 

to do it? And then can you give me a little insight on how we even 

know when such a war would be launched against us? 

How do we know who is doing it and how do we possibly say 

okay, now this is the time when we can launch a counter action 

against that? And I will defer to any of you who would like to go 

first. But I really respect and appreciate your insight on it. 

Mr. CHERTOFF. Well, thank you—thank you for the question. It 

is a broad set of questions. 

Mr. FORBES. I know it is. 

Mr. CHERTOFF. I will address maybe the last question, which is 

what is often referred to as the issue of attribution, and it is a complicated issue because the reality is many of the attacks we suffer, 

if you—if you follow the attack back the point at which you’re proximate to, the target may be in the United States but it may be a 

computer that has been taken over and is being operated remotely 

from China or someplace else in the world. 

And the difficulty is proving that connection is often very difficult. It is compounded by the fact that some of the ways we might 

prove it make reference to sophisticated and secret sources and 

methods that we are not going to want to reveal. 

So there is a huge challenge unlike what we faced in the Cold 

War when, if a missile was launched, we could demonstrate where 

the missile comes from. I think the answer there is a—the laws are 

really not the issue here. 

The issue here is for us to develop a doctrine and to be very clear 

about, first of all, what we believe our response ought to be to an 

attack—distinguishing between a theft of property, which is espionage which we have traditionally not viewed as an act of war, and 

an attack on a system that might destroy the system itself like the 

electric power grid. 

And once we have determined what we want our response to be, 

we have got to do two things. We have got to, first of all, make sure 

51 

the law permits us to respond, and second, I believe we need to 

have a declared policy of deterrence. 

We need to, for example, tell the world that if there is an attack 

upon our electric grid that results in a loss of life we reserve the 

right to respond by, A, eliminating the servers that launched the 

attack, we may reserve the right to do so physically as well as in 

cyberspace and we need to explain what our red lines are. If we 

don’t do that, then we run the risk of a miscalculation where somebody launches on us without a clear understanding of our response, 

and experience shows that that is how people get into wars, when 

there is an unclarity of doctrine. 

Mr. BAKER. I would agree with that completely. I think that the 

key problems are making the tough policy choices first, and once 

you have the policy, both the policy in terms of what do we want 

to do as a country to respond to these kinds of attacks. And when 

I am talking about an attack here in this setting I am talking 

about something that when it is directed at us would constitute a 

use of force against the United States if it was done by kinetic 

means. So that is—so when I talk about an attack that is what I 

mean, not an exploitation or espionage or something along those 

lines. 

But I think we need to get the policy right in terms of what we 

want our military to do. We need to get the technology right in 

terms of what it is that we think we are going to be doing, what 

are the collateral effects of that kind of activity. 

For example, if you launch something will you be able to restrict 

it narrowly or will it spread more broadly? How confident are we 

going to be in that? I think those are the tough questions. 

Once the policy makers figure out what they want to do, then the 

lawyers can help figure out how to do this legally either under the 

existing regimes with the, you know, the laws of war, the laws of 

armed conflict, the very statute they have to deal with, or that we 

need to make some kinds of changes and so on. 

Just one other quick question to address the last part of what 

you said, knowing whether we are actually under attack may be 

difficult in some circumstances because a smart adversary might 

just degrade our systems in a way that make them difficult for us 

to use and make us—make it hard for us to respond to a threat 

somewhere in the physical world but that we can’t quite figure out 

whether it is actually being destroyed or not or whether there is 

an attack that is underfoot. 

Mr. FORBES. Mr. Downing, my time is up but I would love at 

some point in time to hear your response to that maybe for the 

record or maybe if you could give it to me in person. 

Mr. GOHMERT. Without objection, we will go ahead and extend 

the time to allow an answer to that question. 

Mr. FORBES. Thank you, Mr. Chairman. 

Mr. DOWNING. So I guess what I would add to these other comments that have gone before is that I am not aware of any particular laws that are holding the military back at this time, although to be clear I work in the Computer Crime Section of the Department of Justice so perhaps that question is best asked to members of our Department of Defense. 

52 

But what I would emphasize here is that unlike other sorts of 

defenses of the Nation, the victims of these attacks are going to be 

in the hands of our private infrastructures for the most part and 

thus it is not possible for the Defense Department to defend in the 

traditional way. 

And so that is very much why we see the comprehensive cyber 

security package as being very important because it provides the 

incentives we need to help industry to defend itself, since the Defense Department is not going to be able to put up, you know, ships 

on the sea and planes in the air to defend that. 

Mr. GOHMERT. Okay. Thank you, Mr. Forbes. 

At this time, Mr. Scott was going to defer and we will hear from 

Mr. Deutch. 

Mr. DEUTCH. Thank you, Mr. Chairman. 

Mr. Downing, the Administration’s proposal for information sharing states, if I understand it correctly, that notwithstanding any 

other provision of law, businesses can share their customers’ private information with Department of Homeland Security. 

I presume that means Internet and email information. What else 

are you trying to get at? What else is there that will be shared and 

could this information potentially include medical records and all 

sorts of other personal information that would violate the privacy 

laws? 

Mr. DOWNING. So the idea of that is shared for the purpose of 

securing cyber security. So I think the primary areas would be 

things like threat and vulnerability information. 

A Internet service provider discovers a new exploit that is allowing people to access computers without authority. It is able to report it to the government and also to spread that information to 

help defend other networks as well. 

It is true, though, that sometimes there will be a narrow set of 

private information that would have to be disclosed. For example, 

in certain kinds of phishing attacks there is an email that is sent 

to a particular person in an effort to get them to give up their password. 

So there may be some cases where there is a need for that sharing of private information. What the bill does, though, is contain 

a number of ways that would protect the privacy of that information, so it would have sharing restrictions once it reaches the government. 

The attorney general would have a set of rules that would require that it be treated in a protected way. It also requires that the 

person giving the information to take out all other sorts of private 

information as well. 

Mr. DEUTCH. Just going back to what you just said, though, 

when you referred to phishing expeditions that we should be concerned then about the possibility, understanding that there are— 

there are requirements that would be imposed and guidelines that 

this could include all kinds of information about individuals. The 

sorts of things that these criminals are looking for are all of the 

sorts of things that may be turned over to the government including bank account numbers, credit card numbers, passwords for all 

of those accounts. 

53 

Might all of that be included in the information that is going to 

be turned over? 

Mr. DOWNING. I think it is important to make sure that there are 

appropriate privacy restrictions because there will be some, I think, 

fairly limited situations where that sort of information may need 

to be turned over. 

So I think attention to the need to protect that information appropriately is proper, and we feel we have done a pretty good job 

of putting into the bill protections for that. But, of course, if there 

are other needs here, we are happy to work with Congress to 

sharpen them as well. 

Mr. DEUTCH. All right. I appreciate that. 

Mr. Baker, I have a question for you. You said—you said we can’t 

stop theft, and we can’t ensure that elements of our infrastructure 

won’t be destroyed. You refer to the technological problems and policy issues. 

Can you speak to the extent to which lawmakers, policy makers 

can partner with the technology community to approach some of 

these issues? Does that—is that happening? Should that be happening? 

Mr. BAKER. Partner—I am sorry. 

Mr. DEUTCH. Please. 

Mr. BAKER. No. I was just going to say partnering directly on 

those kinds of issues. I mean, I think the main thing is to be informed and so calling hearings and bringing folks up to explain exactly what the problems are and what is going on—I mean, as Secretary Chertoff explained, the supply chain problem and the insider 

problem. The zero-day threat is a significant one. 

But I think one of the main things to do in terms of lawmakers 

is to figure out the boxes in terms of what parts of the United 

States government are going to have the lead or—yeah, I guess the 

lead in addressing these problems and some of the proposals in the 

Administration’s recommendation try to address that. 

They try to give an enhanced role for DHS to do this. Not because DHS is perfect. I think they would not say that they are perfect. But we need to make a decision and move forward. 

We need to get going on this legislation and start down this road 

and then fix the problems as we go. As Secretary Chertoff said, this 

is just the beginning. We have got a long way to go. 

Mr. DEUTCH. And Mr. Baker, you and Secretary Chertoff both 

spend a lot of time thinking about what these—what these concerns might be. As you—as you play these out, all of the various 

risks, in terms of critical infrastructure and the risks that we face 

because of the technology, what is it that worries you most? What 

do you think—where do you think we are most vulnerable? 

Mr. BAKER. Well, I think any of these—any of these systems are 

vulnerable, any of them, and the electrical one is one of the primary ones. I think if that was shut down or degraded in a significant part of the United States that is a significant problem. 

And it is not only a problem of somebody intentionally doing 

that. I mean, there might be reasons that a nation state is not 

going to do that in an otherwise—in a situation that is otherwise 

a time of peace. They may do it in a time of crisis. 

54 

But you might have a terrorist group that gets its hands on some 

kind of a tool that would enable them to do this or somebody is experimenting with something and it leaks out and it gets out into 

the wilderness, if you will, out into the wild and then it just starts 

shutting down systems and we don’t know what is going on—I 

mean, that kind of a virus, if you will, in terms of something leaking out. 

So I think any one of these systems is vulnerable. The financial 

system is vulnerable. I mean, any of them. Take your pick. 

Mr. DEUTCH. Thank you. Thank you, Mr. Chairman. 

Mr. GOHMERT. Okay. Thank you, Mr. Deutch. 

At this time, we will hear from Mr. Gowdy from South Carolina. 

Mr. GOWDY. Thank you, Mr. Chairman. 

I want to thank all the witnesses for lending us your expertise. 

Mr. Downing, I think I understood you correctly. One of the Administration’s proposals is to raise the statutory maximum. 

Mr. DOWNING. That is correct, in certain ways. Different parts of 

the statute, yes. 

Mr. GOWDY. I know that sounds good. I get the politics behind 

raising the statutory maximum. How many of these cases ever approach the statutory maximum? If you want to do something about 

it, do something about the guidelines, not the statutory maximums. 

Mr. DOWNING. Well, we certainly agree that a lot of the sentencing is driven by the guidelines and there actually was an effort 

to try to improve the guidelines, by raising the penalties. That occurred the year before last. 

But, unfortunately, the Sentencing Commission largely did not 

do much to raise them. I would say though—— 

Mr. GOWDY. Would you be gracious enough to send to me your 

recommendations for the Sentencing Commission? They were kind 

enough to come visit with us a few weeks ago too and I was 

shocked at how infrequently even judges who were on the Sentencing Commission bother to follow the sentencing guidelines. So 

if you would send me those recommendations. 

Also, if you know how many motions for upward departure Department of Justice may have filed in cyber security cases that 

would be helpful to me as well. The—— 

Mr. DOWNING. I would be happy to take that back. 

Mr. GOWDY. The ratio of motions for downward departure versus 

motions for upward departure is 17 to 1 for downward. So some 

evidence of the Administration’s seriousness about cyber security to 

me would be requests for upward departures in the cases where 

there has been a prosecution. 

RICO, practically, for the line AUSAs in the districts how is 

RICO going to help them? 

Mr. DOWNING. RICO is particularly useful in those situations 

where you want to try to take down an entire enterprise and, in 

particular, where you have leadership of the enterprise that may 

not be actually committing the offenses or may not be in conspiracy 

with others who are. So the usual tools of the direct crime and the 

conspiracy are not available. 

We have seen this in terms of cyber security in the area where 

you have an organized group that will have different pieces of the 

organization doing different parts of the job. 

55 

Some of them are actually hacking. Some of them are using it 

to commit fraud. Some of them are doing other tasks. And so we 

think that it is a useful tool to be able to take down the entire organization including the senior leadership, and so that is one important way that it would help. 

Mr. GOWDY. What leads you to think the Department of Homeland Security is the best agency to handle this? 

Mr. DOWNING. Well, to handle this, I am not quite sure which 

piece of it you mean. You mean why should they get clarified authorities to be a leader in the area of cyber security? 

Mr. GOWDY. Right, as opposed to the Bureau. 

Mr. DOWNING. Well, we think the Bureau is an important piece 

of the puzzle but they have a very different role then that we 

would proscribe for the Department of Homeland Security. The Bureau does a terrific job on investigating cases and they are a critical piece of creating deterrence. 

However, DHS has an important role too. DHS, as the proposal 

would suggest, would strengthen or clarify the rules that would 

allow it to be better at outreach with private industry, making 

clear its role in helping to protect the civilian infrastructure and 

the government infrastructure. 

So it is really a different role that we see for DHS, and that is 

why we are seeking to have its authorities clearly laid out in legislation. 

Mr. GOWDY. Can you tell me the difference between computer 

trespassing/theft and treason? 

Mr. DOWNING. I am sorry. And treason? 

Mr. GOWDY. Treason. When does it become treason? 

Mr. DOWNING. Well—— 

Mr. GOWDY. Because the penalty for treason is already pretty 

high, I think. 

Mr. DOWNING. I believe it is, yes. Treason, I would have to probably get back to you on that. I am not sure I know the elements 

of the offense of treason. But my understanding would be that it 

would require that it be done in terms of wartime or where it 

would be a direct—— 

Mr. GOWDY. So it has to be during a time of war to be treasonous? 

Mr. DOWNING. I am sorry. I don’t want to guess. 

Mr. GOWDY. What about one of our law professors? 

Mr. KERR. My understanding is that treason is defined by the 

Constitution and requires somebody who is loyal to the United 

States who does an act intentionally against the interests of the 

United States as an act, intentional act of disloyalty to the United 

States. 

So I don’t see how that is implicated in an act of computer trespass, which can be conducted for many different reasons. It might 

be. You could have an act of computer trespass that is part of an 

act. 

Mr. GOWDY. So if a soldier were to download information and 

give it to an enemy, would that be treasonous or not? 

Mr. KERR. I don’t know. 

Mr. GOWDY. What do you think? 

56 

Mr. KERR. Well, prosecutions for treason, my recollection is that 

the Constitution has requirements as to the witnesses that have to 

be available for acts of treason. So it is actually a very rarely prosecuted crime. I don’t know if there have been prosecutions for treason in my lifetime. 

But it certainly would be a criminal act with severe penalties. 

Whether it is an act of treason or not, I don’t know. 

Mr. GOWDY. I yield back, Mr. Chairman, or yield to the gentleman—no, I am out of time. 

Mr. GOHMERT. I thank the gentleman. 

The Chair now recognizes the distinguished gentleman from Virginia, Congressman Scott. 

Mr. SCOTT. Thank you, Mr. Chairman. 

Mr. Chairman, one of the issues we have been working on is ID 

theft and the statutory maximum is not usually the problem. The 

problem is that these cases don’t even get investigated much less 

prosecuted. 

And so let me ask in that line, Mr. Downing, is unauthorized 

possession of credit card numbers, passwords, ID information—is 

unauthorized possession only a crime? 

Mr. DOWNING. Under criminal law, it generally has to be with an 

intent to commit a fraud. So mere possession may not be but in almost all cases we can show that there is a intent to commit a 

fraud. 

Mr. SCOTT. Well, you have—but just—if you just looked in my 

computer and found all kinds of credit card information you would 

have to either show that I intended to do something with it or that 

I obtained it illegally. 

Mr. DOWNING. That is right. 

Mr. SCOTT. That mere possession is not a crime. 

Mr. DOWNING. I believe that is the case. 

Mr. SCOTT. Now, child pornography, if you found something on 

somebody’s computer you wouldn’t care how they got it, would you? 

Mr. DOWNING. We would definitely care how they got it. It would 

also be a crime for mere possession. 

Mr. SCOTT. Well, I mean, in terms—in terms of a crime being 

committed you could prosecute without being concerned about how 

they got it. 

Mr. DOWNING. That is true. Mere possession of child pornography 

is a crime. 

Mr. SCOTT. Is—do you know if in the Federal Government 

whether or not there is any requirement that banks try to limit ID 

theft by doing things like sending a real-time email every time a 

charge is made? 

I mean, there is no technological problem with the bank if somebody uses a credit card instantaneously text messaging that to the 

user. Is there anything—does anybody have any authority in the 

Federal Government to require banks to do stuff like that? 

Mr. DOWNING. As a technological matter, I assume that it is possible to do that. As far as the regulations—— 

Mr. SCOTT. But it is technologically possible to do it. Is there 

anybody in Federal Government that can order the banks to do 

that? 

57 

Mr. DOWNING. I don’t know the answer to that question, I am 

afraid. 

Mr. SCOTT. Under RICO, we—Mr. Downing, you want to use 

RICO for computer crimes. Why is not the underlying crime that 

you are investigating enough to access RICO rather than the fact 

that they used a computer? 

I mean, if they—if they are doing some operation that is some 

big organized crime effort that ought to be enough to get RICO. 

Why do you have to show that they are using a computer? Why is 

that important? 

Mr. DOWNING. There are, certainly, some cases where there is 

another predicate offense that could be used to prove the RICO. 

But there are some situations where it might not be. I am going 

to give you an example. 

If an organized crime group were to use a denial of service attack 

against a gambling website, let’s say, to prevent the site from operating right before a critical event, it would be an extortion under 

Section 1030(a)(7). It is not clear that that sort of extortion falls 

into traditional extortion statutes since there is no physical property at risk and no risk of harm to human life. 

So it is true that there are some areas that could be done 

through a RICO prosecution, but we feel that this would close some 

gaps and allow us to make sure that it covers it in all situations. 

Mr. SCOTT. You have in your testimony the statement that the 

Administration has proposed a mandatory minimum sentence of 3 

years imprisonment as one appropriate way to achieve the needed 

deterrence. 

Do you have any research that shows that mandatory minimums 

rather than longer maximum sentences subject to guidelines serves 

as a deterrence? 

Mr. DOWNING. I am not an expert on the research on mandatory 

minimums, but I can say that this particular one is very narrowly 

focused. 

Mr. SCOTT. Can you point to any—can you point to any research—you can’t point to any research that shows that it serves 

as a deterrence. 

Mr. DOWNING. I would be happy to research that issue and get 

back to you. 

Mr. SCOTT. Are you aware of research that shows that mandatory minimums do not reduce crime and serve only to waste the 

taxpayers’ money? Are you familiar with that research? 

Mr. DOWNING. I am not aware of that research either. That is not 

my field of expertise. 

Mr. SCOTT. Mr. Chairman, my time is just about up. But before 

I yield back, I would just like to ask for the record for the witnesses, I guess Mr. Downing and anybody else, on these reports, 

exactly what—how these reports work, who can ask for it, do you 

need a subpoena and then what happens to it because in earlier 

versions of Homeland Security, information sharing was very important. 

So if Homeland Security got something the FBI and Department 

of Defense and everybody else could look at it, how this information 

is shared and what exactly—what information there can be, and 

58 

also we talked a little bit about the international aspects of the 

Internet and trying to prove who did it is a problem. 

But another problem is if you find out who did it does the Department of Justice have jurisdictional problems—if things are 

going on in France that affect things in the United States how we 

deal with the jurisdictional problems, if anybody would want to respond to those for the record. 

Thank you, Mr. Chairman. 

Mr. FORBES [presiding]. Thank you, Congressman Scott. And do 

each of you have a comfortable understanding of what Congressman Scott needs to supply? Good. 

If you have any questions I am sure he will be glad to clarify 

that for you and if you would respond to the record for him on that 

we would appreciate it. 

Chair recognizes the former Attorney General of California, Mr. 

Lungren. 

Mr. LUNGREN. Thank you very much, Mr. Chairman. 

Secretary Chertoff, in the Cyber Security Task Force we had on 

the Republican side early this year information that we got both 

public and private was that the best estimate was that perhaps 85 

percent of intrusions in the cyber world could be taken care of if 

we just had good cyber hygiene and that because of that, because 

we don’t have that, the 85 percent clutter that is out there makes 

it more difficult for to identify the 15 percent of the more serious 

nature. 

When we are asked to perhaps pass new laws with respect to 

criminal sanctions and so forth, I guess one of the questions our 

constituents would ask is are we as a government as well as the 

private sector doing what we need to do to identify and encourage 

good cyber hygiene, and if not, why not? 

Mr. CHERTOFF. Well, Congressman, I think you are dead right 

about this. I think that, and I can’t tell you if 85 percent is exactly 

the right number, but I think you could take a lot of hay off the 

haystack with good cyber hygiene. What do I mean by that? 

I mean appropriate use of passwords and changing of passwords, 

appropriate implementation of access controls, appropriate rules 

about who and what can download off a network and who and what 

can insert various kind of media into a network. 

And you are quite right. A lot of this is in private hands and that 

is why when I look at the Administration’s proposal, in many ways, 

to me, the more significant element has to do with the requirements as it relates to critical infrastructure and requiring that a 

nationally significant critical infrastructure have plans and programs in place to make sure they have cyber security and much of 

that involves internal processes and internal programs. 

Now, there are a lot of different ways to skin the cat and I am 

not prescribing one particular way to do it. But a big challenge is 

to architect your internal security system so that it is not so cumbersome that people just avoid it altogether but that it is robust 

enough so that it is not obvious or easy for people to penetrate it. 

You know, take a very simple thing like the ability to take a 

thumb drive and put it into a network and download, as was reported to be the case with Bradley Manning. If you are dealing 

59 

with sensitive systems you ought to have restrictions on who has 

the capability to do that. 

So, to me, rolling out a set of processes and having the private 

sector have to meet certain standards would take a lot of hay off 

that haystack. 

Mr. LUNGREN. I guess it would be my observation that as we are 

looking at these proposals, and I certainly support us moving forward in the area of cyber security, enhanced awareness of it within 

our various laws, I would hope that we would have at least as 

much effort in the public and private sector on raising the awareness of the need for computer hygiene. 

I mean, we need a equivalent of a Smokey the Bear campaign 

to somehow help us. That is not to say we ought not to do these 

things now. 

One thing I would like to address to Professor Kerr and Mr. 

Chertoff and Mr. Downing is this. There has been a Memorandum 

of Understanding entered into by the—by DHS and by the Defense 

Department in terms of proper exchange of information, et cetera. 

I happen to think that is a good start. 

However, if we do not from the beginning ensure that civil liberties are protected here and that we are not in any way acting in 

a position that does not recognize the traditional and constitutional 

priority of civilian control of the military, we are buying a real 

problem. 

I guess my question—I will start with you, Professor Kerr, if you 

have some knowledge of that Memorandum of Understanding. Are 

you satisfied that that—it has reached an appropriate position of 

balance such that as we designate DHS as the primary repository 

of this information and the coordinator of information and—or 

overview of cyber security throughout the Federal Government that 

the concern—the legitimate concerns of civil libertarians or anybody, any American concerned about that, have been met? 

Mr. KERR. I share, certainly, all of your concerns with the need 

to protect privacy and civil liberties in this situation and also to 

balance that with the appropriate exchange of information within 

the government, which can be tremendously important. 

As an outsider, I really can’t tell how things are working. So I 

would love to know the answer just as you would like to know the 

answer but, unfortunately, I don’t have it. 

Mr. LUNGREN. Mr. Chertoff or Mr. Downing? 

Mr. CHERTOFF. I think I can probably offer some insight into this 

because I think this in the main reflects an agreement that we had 

in the prior Administration between DHS and the Department of 

Defense concerning the proper allocation of responsibility. 

With respect to government networks and the commercial domain, I think it was understood that the authorities should be DHS 

authorities to maintain the principle of civilian control. 

On the other hand, there are unique capabilities in the Department of Defense both in terms of access to information and tools 

and techniques which are important to have available to deploy to 

protect the United States, and as long as that is undertaken under 

the authorities of DHS I think you manage to balance between 

using all of the elements of national power but having a civilianVerDate Aug 31 2005 13:46 Mar 29, 2012 Jkt 000000 PO 00000 Frm 00063 Fmt 6633 Sfmt 6601 H:\WORK\CRIME\111511\71238.000 HJUD1 PsN: DOUGA
60 

controlled and civil-liberty respecting way of actually 

operationalizing. 

You know, I would leave you with this thought. I don’t think security and privacy here are in conflict. I think they actually are 

mutually reinforcing. 

You cannot have privacy on the computer if you don’t have the 

security to be able to control who gets into your computer, and I 

think that it is important not to lose sight of the fact that it would 

not be a triumph of civil liberties to keep the U.S. government from 

protecting computers so the Chinese government could get on our 

computers. [Laughter.] 

Mr. DOWNING. If I may, I would add, certainly, the Administration is very concerned about the sharing of information and that 

there are appropriate civil liberties and privacy protections in 

place. 

One example of that is what I referred to earlier in the legislative proposal where sharing is going to occur under a set of rules 

that allows the private sector to share with the government. We 

have really been very careful to think through how that sharing is 

going to happen once it occurs inside the government, and there 

would be appropriate limitations to make sure that there isn’t 

going to be any abuse. 

Mr. GOHMERT [presiding]. Thank you, Mr. Lungren. 

At this time we will hear questions from Ms. Jackson Lee of 

Texas. 

Ms. JACKSON LEE. Let me thank the Chairman and the Ranking 

Member for this hearing. It is interesting to see our former Secretary of Homeland Security, thanking him for his service and as 

well the numbers of individuals. 

Mr. Baker, I was looking for my friend from Texas but you have 

a good name and certainly I know that testimony has been productive. Mr. Secretary Chertoff would know that I was in Homeland 

Security and going back to Homeland Security, still serve on Homeland Security and cyber security has been a enormous issue. 

I am going to go right to you, Mr. Secretary, and I think we do 

have a dilemma between the First Amendment rights, as we have 

always had a tension, the whole question of the—when we had the 

discussion on the PATRIOT Act was during your tenure and some 

of the ramifications of that. 

But I am going to go directly to an entity, that preceding 9/11 

there were challenges and that is China, and cyber security is not 

any longer a fly that we swat at. It is annoying. They have just 

gotten my formula for the—or the formula for how to do a Gucci 

purse or they have just found out how to make Colgate toothpaste 

or at least label it and say it is Colgate toothpaste. 

How dangerous is it to have a friend that is engaging in the intrusion of one’s cyber system and does that friend’s accessibility 

then open it up to individual—to entities that would wish to do us 

harm? 

Mr. CHERTOFF. Well, I think, you know, the National Counterintelligence Executive recently publicized the extent to which our 

networks and our systems are being penetrated by foreign powers, 

and I would—I would have to say I think it is now a general consensus that in terms of both our economic well being and potenVerDate Aug 31 2005 13:46 Mar 29, 2012 Jkt 000000 PO 00000 Frm 00064 Fmt 6633 Sfmt 6601 H:\WORK\CRIME\111511\71238.000 HJUD1 PsN: DOUGA
61 

tially our national security and military posture the ability of foreign governments to penetrate into our networks is probably at the 

very top of the list of threats that we face. 

You know, I have heard people debate whether the theft of intellectual property has national significance. If you consider the 

amount of money and time we spend developing our technological 

advances, to have somebody come in and steal it and short circuit 

it is nothing less than giving away our economic competitiveness. 

Beyond that, again, just relying on open source public documents 

like the U.S.-China Security Commission, we know that in China, 

for example, there is a military doctrine that looks to cyber warfare 

as one of the domains of warfare. 

So, again, we have to be concerned about the possibilities, as Mr. 

Baker said, either in a tense situation or even in a peacetime situation a foreign adversary taking advantage of their ability to distract us by degrading or disrupting our networks. 

So, you know, there are multiple dimensions to this. There are 

some diplomatic issues that need to be pursued. But most important, I think, we need to have the internal capability to manage 

our risk in a way that does not leave us hostage to foreign actors. 

Ms. JACKSON LEE. I thank you. And Mr. Baker, I don’t know if 

this—thank you very much, Secretary—whether this would fit you 

but on the Homeland Security side we are completely frightened of 

this process or prospect of cyber security as it relates to, and I 

know that the government witness is from Intellectual Property 

but the extent that cyber security can intrude on water distribution, electrical grids and how much government oversight, intrusion and emergency action should be engaged in as it relates to 

cyber security or the protection of our cyberspace. 

There are a lot of bells going off but how much government activity should we have? How precious is this cyberspace that it could 

literally shut us down as a Nation? 

Mr. BAKER. The cyberspace is precious. It is absolutely precious. 

We have to be worried about it being degraded and destroyed, disruptive and having a shut down, having significant parts of our 

economy shut down. 

As others have said, I think we are in, you know, based on everything that I have seen, sort of a pre-9/11 mode right now where we 

see we have got some significant problems. We see we have got significant vulnerability. We have got adversaries out there that are 

serious about doing us harm and we need to get going and we need 

to get organized. 

Ms. JACKSON LEE. What would you want us to do and—— 

Mr. BAKER. So we need—we need to figure out one thing, just for 

example, and was talked about here. One thing we need to figure 

out is as a society how much government involvement, meaning 

how much government monitoring of private communications, do 

we want and are we willing to tolerate. 

And if we are going to have government monitoring of private 

communications in order to obtain information to protect us from 

cyber security threats, how are we going to monitor that, how do 

we monitor the monitoring. In other words, what privacy protections do we have in place, what oversight. 

62 

We have to pay for that oversight. Everybody talks about oversight. Oversight is expensive so we need to make a commitment 

that we are going to pay to have the right people in place to do 

that kind of oversight. 

So I think it is inevitable that you are going to have government 

monitoring of private communications to some degree. The question 

is how much and then who watches to make sure that we are all 

comfortable with what is going on. 

So I think it is—I think you are going to have—you have to 

have—I think no entity standing alone, private sector or government, anybody else, military, civilian, has all the tools necessary to 

address this threat. 

We need to bring all of our resources together in a way that we 

are all comfortable with and then move forward. 

Ms. JACKSON LEE. Mr. Chairman, would you allow Mr. Kerr to 

answer that question? 

Mr. GOHMERT. Yes, without objection. Mr. Kerr, you may answer. 

Ms. JACKSON LEE. And you might put your influence on the question. Thank you. 

Mr. KERR. Yeah. 

Ms. JACKSON LEE. And I thank Mr. Baker. Thank you, Professor. 

Mr. KERR. Thank you. I think striking the right balance is quite 

difficult then and Mr. Baker’s answer raises, I think, what is the 

missing half of the puzzle that we are looking at in this hearing, 

which is the procedural rights, the rights of government investigation. 

The problem in cyber security from the standpoint of criminal 

law is not that the punishments aren’t high enough. The punishments are not only as high as they are in non-cyber crime laws. 

In many ways, they are higher. 

The difficulty is it is very difficult to catch people. So what tends 

to happen is the government wants more investigatory power. That 

becomes quite controversial. So instead, the government gets 

broader and broader substantive criminal laws and greater and 

greater punishments for crimes. 

We should not use substantive criminal law and the Computer 

Fraud and Abuse Act as a substitute for the difficulty of catching 

the bad guys. We should focus on making sure the government has 

the power necessary to catch people that are engaging in wrongdoing online. 

Ms. JACKSON LEE. I thank the Chairman. 

Mr. Chairman, if I could just say to you or say for the record I 

know that we are in the Crime Subcommittee and the Committee 

dealing with terrorism but I truly believe I think Secretary 

Chertoff and I think Professor Baker might answer Mr. Kerr’s 

point. 

I think we need to ramp up and get coordination between military, civilian and government resources. We need to get in front of 

this. If we are pre-9/11 on cyber security we have got some work 

to do, and I hope this Committee can be part of the solution, Mr. 

Chairman. 

I thank you very much for yielding. 

63 

Mr. GOHMERT. Thank you, Ms. Jackson Lee, and you do make a 

very good point. We do need to get ahead of it and I appreciate you 

all addressing that. Hopefully, we will get into that a little further. 

At this time, I have the Honorable Mr. Goodlatte from Virginia 

with questions. 

Mr. GOODLATTE. Thank you, Mr. Chairman. 

Welcome, all of you. I want to direct this first question to Mr. 

Downing and Mr. Baker. 

The Administration proposal includes a so-called ‘‘name and 

shame’’ provision to coerce industry to beef up cyber security. We 

certainly understand what that objective is but I wonder if that 

doesn’t paint a target on the backs of vulnerable systems for cyber 

criminals to exploit or to encourage others to keep their problems 

as hidden as possible so that they won’t be discovered to have been 

put in that situation. 

I wonder if you might comment on that, starting with you, Mr. 

Downing? 

Mr. DOWNING. Certainly. The—it is important to understand that 

this publicizing the vulnerability of a particular company is done 

at an extremely high level. It wouldn’t reveal any particular 

threats that would be successful against a network. It would simply provide some information to the public and to the government 

about how well the company is doing overall. 

I think it is also important to think about what sort of incentives 

we think are appropriate to encourage the kind of better cyber security behavior that we would like to see. One option that the Administration has not proposed is to create a huge regulatory framework that would require lots of fines and auditors and all that sort 

of thing. 

Instead, it is a light-touch regulatory idea that would require but 

there still has to be some incentive made to cause companies to 

change their behavior. And so in this way, we think that by publicizing those that need to improve, that will provide a significant 

but not overreaching type of incentive to get them to change. 

Mr. GOODLATTE. Mr. Baker? 

Mr. BAKER. Yes, just real quick. 

I think you are right to be concerned about that. I think the Administration understood that and tried to come up with a solution 

where there was a sufficient amount of enhanced incentives for 

people to—companies to improve their cyber security posture without making them a target, as you suggest. 

I think you are right, we need to make sure we get the legislation right on that point. I would say, however, I mean, I think to 

a certain degree even today companies face risks in this area by 

not exposing to some extent what their vulnerabilities are because 

they have obligations to their shareholders and reporting requirements to the SEC to make known a set of risks that may be material in some fashion. The SEC recently put out some guidance on 

this. 

I think that is very significant. I mean, I think there is an incentive already and I just think it is unrecognized. 

Mr. GOODLATTE. Thank you. 

64 

Mr. Chertoff, how can Congress encourage the kind of innovative 

solutions we need from the private sector for cyber security and at 

the same time avoid a one-size-fits-all regulatory scheme? 

Mr. CHERTOFF. Well, first, let me say that, as I said in my opening statement regarding the legislation, I think it is a good start 

but I think there are some pieces that need to be strengthened. 

The good start piece is the concept of having the government lay 

out general standards and requirements but allowing the private 

sector to meet those standards using a variety of different methods. 

That is actually pretty similar to what we did in the chemical security area back when I was at DHS. 

So the good news is I think that gives you flexibility and allows 

people to tailor an approach, including one which the private sector 

can help to develop. 

I think on the—on the disappointing side, I would actually like 

to see some tougher responses to the issue of those elements of critical infrastructure that don’t meet those standards or requirements 

because I think if you have a serious vulnerability in our electric 

grid or our water or any other important element of national security we are not going to have a lot of time to coax those entities 

into coming into compliance. 

We need to have the ability at some point to compel them to 

come into compliance. So that is an area where I would, frankly, 

like to see a little bit of strengthening. 

Mr. GOODLATTE. Thank you. 

And back to you, Mr. Baker, how would including the CFAA 

within RICO help protect Americans from cyber criminals? 

Mr. BAKER. It is a further tool that prosecutors can use to go 

after these very aggressive robust organized crime groups, mainly 

located overseas, and I take Professor Kerr’s point. It is difficult. 

You have to have two things. You have to have the legal tools 

in place so that you can investigate and prosecute these crimes if 

and when you get your hands on somebody. 

But then we need to work with our international partners as the 

FBI does regularly to actually go out and get them and bring them 

to justice either in the United States or in a separate jurisdiction. 

But I think RICO is another tool that strikes me as appropriate 

here because that is what is going on. Organized crime groups are 

using the Internet to steal a vast amount of funds. 

Mr. GOODLATTE. Thank you very much. 

Thank you, Mr. Chairman. 

Mr. GOHMERT. Thank you, Mr. Goodlatte. And having been a 

judge for a decade and at times sat on the bench and thought does 

this lawyer not know that he’s wasting his time asking those silly 

questions, it is a real honor to listen to such insightful questions 

that I think we have heard on both sides of the aisle here, and it 

points to the understanding people here have of the risks and problems inherent in what we are talking about. 

One of the things that—I don’t know, it may be the only thing 

that the Heritage Foundation, the ACLU, Mr. Scott and I have 

agreed on and that is that we have over criminalized so many 

things, 5,000 or so crimes. 

We don’t even know how many because they are not required to 

come through the Judiciary Committee in order to slap a prison 

65 

sentence on, and there are so many things that have been made 

a crime. And people say oh, well gee, the Justice Department would 

never pursue anything like that. 

But it turns out it is not just up to the Justice Department. You 

know, we had a hearing previously where a guy just didn’t stick 

the little sticker on his package that had an airplane with a line 

through it and he went to prison. You know, a guy received an orchid from a South American company without properly filling out 

their material. He went to prison for 18 months. 

So some things do get prosecuted. The poor guy that sent the 

package without the sticker with the airplane with the line through 

it was run off the road with what sounds like what amounted to 

an EPA SWAT team, ran him off the road, threw him to the 

ground, handcuffed him and hauled him in. 

So we are rather sensitive to over criminalizing and if I understand correctly we are talking about the potential for the Federal 

Government to run somebody off the road like they did the gentleman from Washington State and put him in handcuffs because 

he checked that he had scrolled down and read and agreed to the 

end user agreement and he didn’t actually do that, and then as a 

result now he has committed a Federal crime. 

Is that a possibility, Mr. Kerr? 

Mr. KERR. It is certainly my understanding of the Justice Department’s interpretation of the law but I don’t know if the Justice 

Department here would agree. 

Mr. GOHMERT. Well, and then a good question was asked, Mr. 

Baker. How much government monitoring of private communications are we going to allow, and that has been a concern of a lot 

of us on both sides of the aisle. 

Have any of you read the President’s American Jobs Act? Not my 

American Jobs Act. It was two pages. But the President’s that was 

155 pages. 

Were you aware that he set up a—the Public Safety Broadband 

Corporation in that that will help take care of our use of 

broadband? I mean, had you all heard that? 

Well, it won’t do anything to create jobs but it will give more government control of our broadband, and you couple that with a potential push for more control of the Internet here it causes me 

some concerns. 

But on the same—at the same time, I know the question was 

asked who would have ever dreamed that planes would be flown 

into a building and some of us said well, that was Tom Clancy back 

several years ago had a hijacker fly one into the Capitol. Well, 

Clancy, if you—he has also written about this Net problem and Net 

security. 

So I mean, it is clearly an issue that we have got to deal with. 

Let me ask what—Mr. Chertoff, I will start with you. You said the 

value of damage for our intrusion may exceed the value of the 

asset. How do you think it would be damaged, if you could be more 

specific? 

Mr. CHERTOFF. I mean, here is the challenge you have, I think, 

in the case of some of the critical infrastructure. You might own 

a power plant and it might be worth a certain amount of money, 

66 

and no rational person is going to invest more in securing the 

power plant than it is worth. 

Mr. GOHMERT. Right. 

Mr. CHERTOFF. I mean, that is common sense. The problem is, 

and we have seen this both in terms of cyber and in the physical 

world, that power plant may be critical in terms of the whole surrounding community, even a state, involving public health, involving public safety, involving public communication. 

If that power plant goes down, there could be an enormous loss 

of life and economic damage that exceeds the value of the asset. 

So the challenge is how do you make the people who operate the 

asset and own the asset invest enough to protect against a cyber 

attack, and I think that is where it is appropriate to have the government play a role in laying out a set of general metrics and a 

set of general standards and then allowing the private sector to figure out the precise way in order to meet those standards and 

metrics. 

Mr. GOHMERT. Anybody else care to comment on that aspect? If 

not—— 

Mr. SCOTT. Can I make another comment, a quick comment? 

Mr. GOHMERT. Well, sure. It is your turn. 

Mr. SCOTT. No. I have already asked questions. 

Mr. GOHMERT. Oh, okay. All right. Yes. Then we will go to Mr. 

Scott. 

Mr. SCOTT. Mr. Chairman, Mr. Baker and Professor Kerr have 

talked about the problems in defining ‘‘exceeds unauthorized access.’’ You kind of know it when you see it but, obviously, that term 

can cover a lot more than we want covered and, for the record, they 

can—if they have any suggestions as how we can define ‘‘exceeds 

unauthorized access’’ in a way that covers what we want covered 

without being over expansive that would be helpful. 

Thank you, Mr. Chairman. 

Mr. GOHMERT. Well, thank you, Mr. Scott. Do you have any further questions? I mean, we could mount to a second round if you 

wish. Pardon? 

Mr. SCOTT. If you want a second round. 

Mr. GOHMERT. Okay. Go ahead. I will allow Mr. Scott to complete—you can see the two of us are here and this is such an important issue. If you don’t mind, let’s—go ahead, Mr. Scott, if you 

would. 

Mr. SCOTT. Well, if—do you want to—do you want to—do you 

have any recommendations on ‘‘exceeds unauthorized access?′′ 

Mr. KERR. I do. I think there are two basic strategies that could 

be used to limit ‘‘exceeds authorized access.’’ 

One would be to just amend the current definition. Unfortunately, the current definition of ‘‘exceeds authorized access’’ is entirely circular. It says that you exceed authorized access when you 

do that to which you are not entitled, which doesn’t really answer 

the question. 

It just makes the issue entitlement rather than authorization, 

just substitute a word. So one method of limiting the statute would 

be to clarify that that definition does not apply to mere terms of 

service violations and computer use policies, essentially just defining by exclusion that which the definition does not apply. 

67 

And another approach would be to limit the substantive statute 

rather than limiting ‘‘exceeds authorized access’’ by saying that 

Section 1030, the Computer Fraud and Abuse Act, only applies to 

obtaining personal information or valuable information rather than 

any information. 

So under that approach, violating a terms of service or violating 

a terms of use could in fact lead to criminality but only in the kind 

of cases that the Justice Department focuses on, namely those 

cases where there’s access to a sensitive database by a government 

employee or particularly valuable information that is taken in violation of an employer’s computer use policy. 

Both of those strategies, I think, are two different ways of getting 

to the same conclusion and either is acceptable. 

Mr. BAKER. I think the main thing that I am concerned about is 

making sure that we have the tools necessary to prosecute insiders 

who have access to vast amounts of data whether they are at a government employer or whether they are with a private-sector employer. 

I mean, if you think about how much data employees at 

Facebook or Google have access to, it is amazing, about—access to 

information about Americans and what Americans are doing. And 

so I think that is the kind of thing that I want to make sure that 

we don’t change the statute to somehow inhibit or cripple, in some 

ways, the ability of the government to prosecute those kinds of 

cases. 

So if you were to somehow take—I mean, I have seen some of 

the suggestions with respect to amending the definition of ‘‘exceeds 

authorized access.’’ 

As long as they still allow for prosecution of in the employment 

context I think that would be the key thing and it would avoid 

some of the things that Professor Kerr was talking about in terms 

of what—you know, misrepresentations that people make on 

Facebook or website and so on. 

The other—I think his suggestion with respect to amending the 

specific provision of 1030(a)(2)(C) I think shows—I think there is 

more promise there. It is a more narrowly-focused provision. It 

doesn’t deal with this definition. It applies to the whole statute, 

and I think it does get at the kinds of cases where somebody does 

something, accesses information in order to steal something or do 

something fraudulent or cause some harm. I think that shows 

much more promise, at least in my mind. 

Mr. SCOTT. Mr. Downing, this is limited to—this entire code section is limited to computers—government computers, financial institutions and protected computers. What about my computer? Is 

that—is that a Federal jurisdictional problem? 

Mr. DOWNING. The computer in your office? Yes, it would certainly be covered. A protected computer—— 

Mr. SCOTT. What about my personal computer? 

Mr. DOWNING. Protected computer is actually a fairly broad term. 

So it would include—— 

Mr. SCOTT. What is—what is not included? 

Mr. DOWNING. Not included would be certain stand-alone computers that aren’t connected to the Internet, for example. Relatively 

68 

rare these days. Most computers are covered by the term ‘‘protected 

computer.’’ 

Mr. KERR. If I could add—if I could add a brief comment, actually computers—stand-alone computers are also protected computers. Every computer in the United States is a protected computer because the definition of protected computer includes any 

computer that affects interstate commerce, a term of art which included anything that the Commerce Clause can include, and under 

the court’s—Supreme Court’s—Commerce Clause jurisprudence 

that would include every computer. 

So basically everything with a microchip except for a handheld 

calculator—there’s an old 1980’s era exclusion in there—is included. 

Mr. SCOTT. Thank you. 

Mr. Downing, under civil forfeiture, who gets the proceeds of the 

forfeiture? 

Mr. DOWNING. Generally, the proceeds are kept by the government. In part, they are used to further enforce the laws and part 

of it is put back to the general Treasury. 

Mr. SCOTT. Does the local—one of the problems I have with some 

of these civil forfeitures are is there is an incentive to do law enforcement based on how you can make money and fund your local 

operation, which kind of distorts the criminal justice system. 

When you say the law, does the FBI get to keep the money generally or does the local FBI office get to keep the money and avoid 

cutbacks in employment that may be coming with this budget deal? 

Mr. DOWNING. I am afraid I don’t know all the ins and outs of 

the forfeiture rules. But my understanding is that it doesn’t go to 

the local office at all, no. This is an important tool for getting at 

certain kinds of actors where criminal law is not sufficient. 

Mr. SCOTT. Well, yeah. And I know why we have civil forfeiture. 

My question is whether it is distorting. You have got Eighth 

Amendment problems of proportionality. Two people commit the 

same crime and one loses a house and a car. Another one doesn’t 

lose anything. 

Who gets the money and whether or not you want civil forfeiture 

rather than criminal forfeiture means that you don’t have to prove 

that somebody is guilty. They got to prove their innocence to get 

their money back, and so even if they are innocent they are out of 

attorneys’ fees and a lot. So civil forfeiture, if not done properly, 

can be problematic. 

Thank you, Mr. Chairman. 

Mr. GOHMERT. Okay. Thank you, Mr. Scott, and I just want to 

follow up. Now, of course, we have had a Federal court say you 

can’t prosecute, as has been done before, a cheerleader mom that 

violates an end user agreement. But it brings to question in my 

mind is there anybody that polices the end user agreements, just 

what people are required to agree to before they utilize a service. 

Mr. DOWNING. Well, I am not sure what you mean by polices but, 

certainly, there are a couple of forces that would control what gets 

put into an end user agreement by a big website. 

Certainly, these things are made public because, obviously, people are signing them, and when Facebook recently or perhaps it 

was last year changed their user agreement in a way that was realVerDate Aug 31 2005 13:46 Mar 29, 2012 Jkt 000000 PO 00000 Frm 00072 Fmt 6633 Sfmt 6601 H:\WORK\CRIME\111511\71238.000 HJUD1 PsN: DOUGA
69 

ly egregious in the eyes of many of the customers, they protested 

and moved away from that—using that service. So there’s a real 

vote-with-your-feet kind of possibility here. 

The importance of end user agreements is also important in the 

context of the Federal Trade Commission. So companies have to 

live up to their—what they say in their agreements, and if they fail 

to do that then they can be sanctioned for unfair trade practices. 

Mr. GOHMERT. And we know here on the Hill—it hadn’t been disclosed publicly—we have had government, our congressional computers hacked from foreign countries, at least one, and it is a 

threat and it is—can be international terrorism of a sort when you, 

as you all have discussed, realize what could be done by destroying 

our Internet usage. 

But by the same token, you don’t want to create a problem for 

the greatest freedoms any country has ever experienced, as we do 

here. 

I know there are some that say well, gee, the Justice Department 

would never pursue that because that would just be too much. But 

we have heard example after example of when prosecutions have 

occurred that people can’t believe. It just sounds like a Kafka novel 

or something. 

But I would hope that on both sides we are ready to be as tough 

as possible on espionage, whether it is domestic or foreign, so that 

the Homeland Security, our Justice Department intelligence has 

the ability to pursue those that want to hurt us but at the same 

time not pursue somebody just because they made some minor mistake or even negligently made a mistake. 

And one of the things we pushed is, and we haven’t done it yet, 

defining what things are really just clerical administrative mistakes individually where maybe you should have somebody subject 

to a fine and what requires prison sentences, forfeiture, all of those 

kind of things so that we don’t keep—just so that we can show how 

tough we are for the next election criminalize some conduct where 

it is more appropriate to just make it a fine or decide does it justify 

somebody being thrown down in front of their wife and kids and 

handcuffed and hauled in. 

So I think that is the issue and a lot of us on both sides of the 

aisle want to make sure that we don’t do that. 

Before we conclude the hearing, you have given your opening 

statements. You have answered questions and been very gracious 

in doing so. But I would just like any final comments based on the 

questions that have been asked, things that may have been triggered in your mind, things that we ought to consider because this 

is all be part of the congressional record here. 

So if you would, starting with Mr. Downing. 

Mr. DOWNING. Thank you for that opportunity. 

There have been a lot of characterizations of what the Department of Justice position is on the 1030(a)(2) question of ‘‘exceeds 

authorized access.’’ Let me be very clear that DOJ is in no way interested in bringing cases against people who lie about their age 

on a dating site or anything of the sort. We don’t have time or resources to do that. 

And, in fact, no court has in fact ruled that that is an appropriate use of the statute and, quite to the contrary, the one case 

70 

that has addressed it ruled that it is not an appropriate use, and 

the government has not brought any further cases. So we are a little bit concerned whether this is truly a problem. 

Given all that, however, we recognize that this is an issue, and 

we are very much interested in working with the Committee to resolve this question in a way that is proper for all. 

What we do need to be careful about is to make sure that as we 

do that, we don’t harm the ability to bring cases that everyone in 

the room would agree are proper and appropriate ones. 

And so, as we think about what sort of solution might be available here, that we do it in a way that isn’t going to cause other 

harm and actually harm our ability to create deterrence in this 

area, which is so important. 

Mr. GOHMERT. Mr. Chertoff? 

Mr. CHERTOFF. Well, I guess I would just conclude by saying I 

do think it is worth giving serious consideration to Professor Kerr’s 

point about maybe some narrowing of the—of the statute. 

I agree with Mr. Baker that I think we are probably more concerned about insiders and employees who exploit their privileged 

position than we are people getting on Facebook. 

But the other point I would make, which I think is important, 

is there is a little bit of a tendency over—observed over the years 

to deal with the issue of criminalizing by simply piling on additional penalties and jail time rather than recognizing the real challenges and being more efficient and more effective in enforcing the 

law against a broader number of law breakers. And here the problem is a lot of the activity is overseas, and we are not going to find 

the people who do this stuff because they are never coming over to 

the United States. 

And, frankly, in some countries there is not a lot of interest in 

cooperating with us. 

So an area which I think is worth exploring is what we can do 

to leverage, again, all of our economic and other powers to really 

induce countries in the world that have tolerated open and notorious criminal activity on the Internet into coming into compliance 

with what ought to be any reasonable international norm about 

preventing this kind of cyber criminality. 

Mr. GOHMERT. Do you have any last suggestions about how we 

do that, how we deal with foreign individuals? 

Mr. CHERTOFF. Well, you know, I mean, one of the, of course, is 

a topic for a whole separate hearing probably. You know, we have 

entered into conventions with other countries and, certainly, the 

Europeans have been—have been cooperative. 

But there are countries in the world where, although there is lip 

service to wanting to play by the rules, they will tolerate the existence of these servers which are nothing more than marketplaces 

for criminal activity. 

Now, we do have a lot of economic power. We have trade power 

and the ability to use that, to say to some of these countries you 

not only have to sign up to doing the right thing but you have got 

to then walk the walk, I think is worth taking a serious look at. 

Mr. GOHMERT. Yeah. Those sanctions work so well. I mean, basically we brought Iran to their knees. 

Oh, wait. No, that hasn’t worked. Never mind. 

71 

Mr. Baker? 

Mr. BAKER. Yes, Mr. Chairman, just two quick points. 

One, I agree with Mr. Downing. I don’t foresee the Justice Department prosecuting the kinds of cases that folks are concerned 

about. I understand the concern. It is a legitimate—— 

Mr. GOHMERT. But you understand, we just want to get the law 

right so it is not even an option. We give them the power to go 

after the bad guys as completely as necessary without even risking 

some runaway prosecutor. 

Mr. BAKER. I agree, but, you know, my experience is with any 

statute that you write there is this huge amount of ambiguity in 

any of these statutes. 

I mean, if you look at the mail fraud and wire fraud statutes, 

they don’t even define fraud and so the government and courts 

have figured out how to—how to prosecute cases and how to adjudicate those kinds of cases over the years. But I—it is difficult to 

write a statute that is so tightly focused to only get at the problem 

you are trying to get at without having some kind of collateral effect as well. 

I just—I would just be cautious about that and I would say then 

that it is a matter then of oversight for this Subcommittee to make 

sure that you stay on top of the Justice Department, to make sure 

you know what they are doing in terms of these prosecutions and 

bring them up here and have them explain why they did X, Y or 

Z in a particular case. That would be my suggestion on that. 

To go back just to close a loop, I think on a question that Mr. 

Forbes had raised earlier, just briefly, I think in terms of the legal 

problems that we are facing versus other kinds of questions, again, 

I think it is a policy problem more than a legal problem. 

But I think folks should be comfortable, I think, that the President has the authority, in the event of an imminent or actual attack on the United States, he has the authority under the Constitution and laws of the United States to take whatever actions are 

necessary to protect the country today. He has that authority 

today. 

The difficult question is figuring out how he would implement 

that authority, how that would be done and exactly what would the 

military do and under what circumstances or what other elements 

the United States government would do. 

That is what we need to figure out, as opposed to worrying about 

whether we have, you know, enough legal authority and whether 

he is going to be hamstrung in the event of a crisis. 

I think—I think he does have that authority. We need to figure 

out technically, strategically, doctrinally what we want to do to protect us. 

Mr. GOHMERT. Thank you, and—— 

Mr. SCOTT. Mr. Chairman? 

Mr. GOHMERT. Yeah. 

Mr. SCOTT. I would hope if the President concludes that we are 

in a imminent threat that he wouldn’t have to fool around and try 

to figure out how this fits under a computer law where he can 

take—— 

72 

Mr. BAKER. I don’t think he would have to do that. That is what 

I am saying. I think he has the authority to take whatever steps 

he deems appropriate in a crisis of that nature. 

Mr. SCOTT. Without having to worry about whether it technically 

fits under some computer—whether they are using computers as 

they do it or a protected computer or something like that. If he 

makes that—— 

Mr. BAKER. That would not be top on his list. 

Mr. SCOTT. If he makes that conclusion then we would expect action to be taken. 

Mr. BAKER. I think—well, I am suggesting this would be the situation in a cyber event and he could take whatever action are necessary whether it is a cyber action or some kind of physical kinetic 

action. 

Mr. GOHMERT. Okay. Thank you, Mr. Scott. 

And you had said we need to figure that out and so I would ask 

you have recommendations in that regard if you would submit 

them to the Committee that would be extremely helpful. 

It is helpful to point out we need to figure this out and what we 

should do but it is even more helpful when you have a suggestion 

as to the best way to proceed in figuring it out. 

Mr. BAKER. Yes, sir. 

Mr. GOHMERT. But Mr. Kerr, final comment? 

Mr. KERR. Thank you, Judge Gohmert. Just two quick points. 

First, I think the concern of the Justice Department’s overbroad 

reading of the Computer Fraud and Abuse Act is a real one. 

Just a few weeks ago, the Ninth Circuit granted rehearing in a 

case in which the earlier panel of the Ninth Circuit Court of Appeals had held that private-sector employee computer use policies 

do in fact—are in fact—criminally enforceable. The employer had 

a policy that said you can’t use the computer for non-business reasons. 

The Justice Department prosecuted the employee for using the 

computer for a non-business reason. The Ninth Circuit granted rehearing. We don’t know what the court’s interpretation will be but 

this is a very real current question. 

And then, second, on the question of civil RICO and mandatory 

minimums under the Computer Fraud and Abuse Act, I think it is 

really important to be specific as to where are the cases where this 

is necessary. 

In my experience, the actual penalties in Computer Fraud and 

Abuse Act cases tend to be relatively low because the damage tends 

to be low in the kinds of cases where the Justice Department actually catches the bad guy. 

So I don’t think there is a lot of—there aren’t any demonstrated 

cases of which I am aware of where, for example, there is the need 

for a mandatory minimum where under current law there wouldn’t 

be and there is an actual case where the law would have applied. 

So some of the Justice Department’s concerns strike me as very 

abstract, kind of, ‘‘well, if we ever catch someone like this it would 

be nice to be able to give them a higher sentence.’’ I think we 

should be responding to real problems, not abstract hypothetical 

ones. 

Mr. GOHMERT. Okay. Thank you. 

73 

We appreciate the witnesses being here. We know you are not 

here because of the money witnesses get paid since you don’t get 

paid at all but—and Mr. Chertoff, nice to see you again. I was a 

little bit surprised you were willing to come in voluntarily after 

some of the hearings you have had here but—— 

Mr. CHERTOFF. Yeah, I was a little surprised too, actually. 

[Laughter.] 

Mr. GOHMERT. Well, we do appreciate all of you being here on 

such a serious topic that has to do with our national security. 

Thank you all very much. This hearing now is adjourned. 

[Whereupon, at 11:45 a.m., the Subcommittee was adjourned.] 

(75) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD

76 

Response to Post-Hearing Questions from Richard W. Downing, Deputy 

Chief, Computer Crime and Intellectual Property Section, Criminal Division, United States Department of Justice 


71238A-1.eps
77 


71238A-2.eps
78 


71238A-3.eps
79 


71238A-4.eps
80 


71238A-5.eps
81 

f 


71238A-6.eps
82 

Response to Post-Hearing Questions from the Honorable Michael Chertoff, 

Co-Founder and Managing Principal, The Chertoff Group 

f 


71238B.eps
83 

Response to Post-Hearing Questions from Orin S. Kerr, Professor of Law, 

George Washington University 


71238C-1.eps
84 

Æ 


71238C-2.eps