```

[Senate Hearing 114-412]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 114-412

 PROTECTING AMERICA FROM CYBER ATTACKS: THE IMPORTANCE OF INFORMATION 
                                SHARING

=======================================================================

                                HEARING

                               before the

                              COMMITTEE ON
               HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                          UNITED STATES SENATE

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                               __________

                            JANUARY 28, 2015

                               __________

        Available via the World Wide Web: http://www.fdsys.gov/

                       Printed for the use of the
        Committee on Homeland Security and Governmental Affairs
        
        
        
        
      [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]    
        
        
        
        
        
   
                         U.S. GOVERNMENT PUBLISHING OFFICE 

94-272 PDF                     WASHINGTON : 2016 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001
                               
        
      
        
        
        
        
        
        
        
        
        
        
        
        

        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                    RON JOHNSON, Wisconsin Chairman
JOHN McCAIN, Arizona                 THOMAS R. CARPER, Delaware
ROB PORTMAN, Ohio                    CLAIRE McCASKILL, Missouri
RAND PAUL, Kentucky                  JON TESTER, Montana
JAMES LANKFORD, Oklahoma             TAMMY BALDWIN, Wisconsin
MICHAEL B. ENZI, Wyoming             HEIDI HEITKAMP, North Dakota
KELLY AYOTTE, New Hampshire          CORY A. BOOKER, New Jersey
JONI ERNST, Iowa                     GARY C. PETERS, Michigan
BEN SASSE, Nebraska

                    Keith B. Ashdown, Staff Director
              William H.W. McKenna, Investigative Counsel
            Sean C. Casey, Senior Professional Staff Member
              Gabrielle A. Batkin. Minority Staff Director
           John P. Kilvington, Minority Deputy Staff Director
     Stephen R. Vina, Minority Chief Counsel for Homeland Security
           Matthew R. Grote, Senior Professional Staff Member
                     Laura W. Kilbride, Chief Clerk
                   Lauren M. Corcoran, Hearing Clerk
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                   
                            C O N T E N T S

                                 ------                                
Opening statements:
                                                                   Page
    Senator Johnson..............................................     1
    Senator Carper...............................................     3
    Senator Lankford.............................................    14
    Senator Booker...............................................    16
    Senator Ernst................................................    18
    Senator Baldwin..............................................    19
    Senator McCain...............................................    20
    Senator Ayotte...............................................    22
Prepared statements:
    Senator Johnson..............................................    33
    Senator Carper...............................................    34

                               WITNESSES
                      Wednesday, January 28, 2015

Marc D. Gordon, Executive Vice President and Chief Information 
  Officer, American Express......................................     2
Scott Charney, Corporate Vice President, Trustworthy Computing, 
  Microsoft Corporation..........................................     4
Peter J. Beshar, Executive Vice President and General Counsel, 
  Marsh and McLennan Companies...................................     6
Richard Bejtlich, Chief Security Strategist, FireEye.............     7
Gregory T. Nojeim, Senior Counsel and Director of the Freedom, 
  Security and Technology Project, Center for Democracy and 
  Technology.....................................................     9

                     Alphabetical List of Witnesses

Bejtlich, Richard:
    Testimony....................................................     7
    Prepared statement...........................................    61
Beshar, Peter J.:
    Testimony....................................................     6
    Prepared statement...........................................    54
Charney, Scott:
    Testimony....................................................     4
    Prepared statement...........................................    44
Gordon, Marc D.:
    Testimony....................................................     2
    Prepared statement...........................................    37
Nojeim, Gregory T.:
    Testimony....................................................     9
    Prepared statement...........................................    65

                                APPENDIX

Additional statements for the Record:
    Chamber of Commerce..........................................    77
    ICBA.........................................................    80
    NACFU........................................................    82
    TIA..........................................................    85
 
                     PROTECTING AMERICA FROM CYBER
             ATTACKS: THE IMPORTANCE OF INFORMATION SHARING

                              ----------                              

                      WEDNESDAY, JANUARY 28, 2015

                                     U.S. Senate,  
                           Committee on Homeland Security  
                                  and Governmental Affairs,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 1:34 p.m., in 
room SD-342, Dirksen Senate Office Building, Hon. Ron Johnson, 
Chairman of the Committee, presiding.
    Present: Senators Johnson, McCain, Lankford, Ayotte, Ernst, 
Sasse, Carper, Baldwin, Booker and Peters.

             OPENING STATEMENT OF CHAIRMAN JOHNSON

    Chairman Johnson. This hearing will come to order. Senator 
Carper is on his way, but we have just been told we can get 
going here.
    I want to keep my opening remarks very brief because we do 
have votes and I want to make sure we get to the testimony. But 
I want to thank the witnesses for their very well thought out, 
well-prepared testimony, certainly the written testimony. I am 
looking forward to your oral testimony. I want to thank you for 
your flexibility. We have obviously moved the hearing up.
    We have in this Committee agreed upon a mission, and the 
mission is pretty simple: to enhance the economic and national 
security of America. If we focus on that goal, a goal that we 
all share--whether you are Republican or Democrat, we really 
share that. And particularly when it comes to this 
cybersecurity hearing about sharing information to protect our 
cyber assets, it is also a goal we share. So if we concentrate 
on that, recognizing there are different viewpoints on this, I 
think we have a far better chance of actually succeeding. So 
when Senator Carper gets here, we will give him a chance to 
have an opening statement.
    The tradition of this Committee is to swear in witnesses, 
so I would ask the witnesses to stand and raise their right 
hands. Do you swear that the testimony you will give before 
this Committee will be the truth, the whole truth, and nothing 
but the truth, so help you, God?
    Mr. Gordon. I do.
    Mr. Charney. I do.
    Mr. Beshar. I do.
    Mr. Bejtlich. I do.
    Mr. Nojeim. I do.
    Chairman Johnson. Thank you.
    What I would like to do is get right into testimony then, 
and I will start with Marc Gordon. He is the Executive Vice 
President and Chief Information Officer (CIO) of American 
Express. He previously served as CIO of Bank of America and 
Best Buy. Mr. Gordon, your testimony, please.

 TESTIMONY OF MARC D. GORDON,\1\ EXECUTIVE VICE PRESIDENT AND 
          CHIEF INFORMATION OFFICER, AMERICAN EXPRESS

    Mr. Gordon. Thank you, Chairman Johnson and Members of the 
Committee. As you heard, my name is Marc Gordon. I am the 
Executive Vice President and CIO at American Express. I oversee 
the global technology organization for our company, as well as 
information security, and I really appreciate the opportunity 
to testify before this Committee on information sharing. It is 
a topic that I am very passionate about.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Gordon appears in the Appendix on 
page 37.
---------------------------------------------------------------------------
    Based on my experiences as CIO across both the retail 
sector and the financial services sector in Fortune 100 
companies, I would strongly urge the Committee to move forward 
swiftly with information-sharing legislation. I believe that 
effective information sharing may actually be the single 
highest-impact, lowest-cost, fastest-to-implement capability we 
have at hand as a sector and as a Nation to raise the level of 
capability against the many and varied threats that we face. 
The way I like to think about it is an attack against a single 
company can be the entire sector's and Nation's defense, 
quickly shared.
    I realize you are familiar with the threat landscape, and 
we have included many examples in my written testimony on the 
nature and the scale of the threats we face. I will not go 
through those now. What I would emphasize here is that while 
cyber crime is growing meaningfully for us and across 
industries, we are increasingly concerned about what appears to 
be the convergence of players, capabilities, and intentions--
namely, nation-state players or those with nation-State 
capabilities with a particular attention around destructive 
intent across industries.
    In response to these threats, the financial services 
industry has invested literally billions of dollars to protect 
our networks. But there are steps that we can take together 
within and across industries and with the government to make 
the total ecosystem more secure.
    And while there is some sharing of information today, I 
would characterize it as highly variable within industries, and 
especially highly variable across industries. And meaningful 
legislation I believe would expand both the quality and volume 
of cyber information sharing and raise the security level 
overall for all of us.
    But legal barriers and the threat of lawsuits are obstacles 
to information sharing today, and that is where legislation 
that provides targeted protections from liability and 
disclosure is sorely needed.
    There are a few notable items that I would also emphasize 
today in terms of attributes of information sharing that we 
believe are particularly important for effective information 
sharing and to have the desired results.
    First is an emphasis on real-time sharing.
    Second is liability and disclosure protection, not just for 
sharing but also for acting within one's own network on the 
information that is shared.
    Third, that the protections that are afforded in terms of 
liability and disclosure and so forth are extended not just to 
government-sanctioned entities but to private entities, 
businesses sharing among themselves. We feel that is actually 
very important.
    And, finally, that the sharing needs to be bi-directional, 
that is to say, we believe the government should be directed to 
share in the right way classified indicators only known and 
knowable from the government. We think that is a big value add 
to this proposition for the private sector as we protect our 
customers' information.
    Finally, we are committed to protecting the privacy of our 
customers' information and believe that concerns around privacy 
protection should be discussed but can be effectively addressed 
in the legislation.
    Again, I just want to thank you for asking me to be here 
today. I look forward to working with this Committee and other 
Members of the Senate and House, and I look forward to helping 
in any way that we can.
    That concludes my prepared remarks, and I would be happy to 
answer questions.
    Chairman Johnson. Well, thank you, Mr. Gordon.
    Our Ranking Member has arrived, so, Senator Carper, do you 
have some opening comments?

              OPENING STATEMENT OF SENATOR CARPER

    Senator Carper. As we say in Delaware, bienvenido. 
[Laughter.]
    Bienvenido. We are happy you are here, looking forward to 
this hearing. This is a timely, important topic. Let us see 
what we can learn from all of you.
    Thank you.
    Chairman Johnson. Thank you for that.
    Our next witness is Scott Charney. He is the Corporate Vice 
President of Microsoft's Trustworthy Computing Group where he 
focuses on the security and privacy of Microsoft's products. 
Scott has also worked for PricewaterhouseCoopers and as Chief 
of the Justice Department's Computer Crime and Intellectual 
Property Section.
    Mr. Charney, you have the floor.

   TESTIMONY OF SCOTT CHARNEY,\1\ CORPORATE VICE PRESIDENT, 
          TRUSTWORTHY COMPUTING, MICROSOFT CORPORATION

    Mr. Charney. Chairman Johnson, Ranking Member Carper, and 
Members of the Committee, thank you for the opportunity to 
appear today at this important hearing. My name is Scott 
Charney, and I am the Corporate Vice President for Trustworthy 
Computing at Microsoft. It is good to see the Committee's first 
hearing of the 114th Congress focuses on cybersecurity. I 
commend this Committee and the Members of the Senate for 
addressing one of America's most complex challenges.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Charney appears in the Appendix 
on page 44.
---------------------------------------------------------------------------
    Let me start by describing the cyber threat. The threat 
comes in two forms:
    First, there are opportunistic criminals who, like burglars 
testing doorknobs, do not care who falls prey as long as 
someone does.
    Second, there are actors described as advance persistent 
threats because they are intent on compromising a particular 
victim.
    These two different types of threats require somewhat 
different responses. Basic computer hygiene--such as running 
the latest version of software, applying updates, and using 
antivirus products--can thwart many opportunistic threats. 
Addressing advanced persistent threats, however, requires much 
more. Computer security professionals must prevent, detect, and 
respond to sophisticated attacks.
    Knowing about threats, vulnerabilities, and incidents can 
help computer security professionals and others take the right 
action. So how does such information sharing occur in practice. 
Simply put, a party collects information, identifies a computer 
security issue, and then shares it with those who can act on 
it. The recipient uses that information to prevent, detect, or 
respond to the event, normally collecting more data and sharing 
it in return. Often parties are added to the process as the 
evidence dictates. Throughout this process, all parties will 
maintain the data responsibly, protecting its confidentiality 
as appropriate.
    Does this work? Absolutely. For example, Microsoft has 
partnered with other companies and law enforcement agencies to 
take down two botnets which had infected millions of computers 
around the world and were each responsible for over $500 
million in financial fraud.
    So if information sharing is so important and so helpful, 
why is such sharing limited? The short answer is that those 
with critical information are often unable or unwilling to 
share it. They may be unable to share it due to law, 
regulation, or contract, all of which create binding 
obligations of secrecy and expose a company to legal risk if 
information is shared.
    There are also other risks. For example, a company that 
discloses its vulnerabilities may suffer reputational risk, and 
such a disclosure may even make security matters worse if 
hackers leverage that information for further attacks against 
that company or anyone else.
    In light of these issues, how can information sharing be 
encouraged? While my written testimony detailed six core tenets 
that must guide any information-sharing proposal, let me 
describe the most important tenets here.
    First, privacy is a fundamental value and must be protected 
when sharing information. While users around the world may have 
different views about privacy, they want assurances that the 
information they entrust to others is used properly and 
protected. It is also important that governments adhere to 
legal processes for law enforcement and national security 
requests and do not use computer security information-sharing 
mechanisms to advance law enforcement and national security 
objectives.
    Second, government and industry policies on information 
sharing should take into account international implications. 
Many U.S. businesses are multinational companies. If not 
properly constructed, rules in the United States can discourage 
foreign markets from using U.S. technology products and 
services, as well as lead to reciprocal requirements that could 
undermine U.S. security.
    Third, while information sharing has benefits, it also 
poses business risks that must be mitigated. As noted, sharing 
information can expose an organization to legal, regulatory, 
contractual, and reputational risks. Any information-sharing 
regime must attempt to reduce these risks by providing 
appropriate liability protections.
    Finally, information sharing need not follow a single 
structure or model, and governments should not be the interface 
for all sharing. Information sharing already occurs through 
both formal and informal processes, within industry and between 
industry and government, and sometimes across national borders. 
There is no single model because situations and desired 
outcomes differ. Flexibility is critical.
    With current practices and those tenets in mind, how should 
we think about information-sharing legislation? In a nutshell, 
Congress should ensure that existing information-sharing 
arrangements are left undisturbed, ensure the protection of 
civil liberties, and reduce disincentives to sharing. This can 
be done in the following three ways:
    First, the legislation should be scoped to cover 
information that reasonably enables defenders to address cyber 
threats.
    Second, the legislation should be designed to protect 
privacy and civil liberties by requiring data be anonymized, 
restricting secondary uses, protecting against inappropriate 
disclosure, and requiring the government to seek a court order 
when attempting to pierce the veil of anonymity.
    Third, the legislation should grant appropriate liability 
protection for sharing information while recognizing that 
companies must fulfill their contractual obligations to their 
customers.
    Thank you for the opportunity to testify, and I look 
forward to working with the Committee on this effort.
    Chairman Johnson. Thank you, Mr. Charney.
    Our next witness is Peter Beshar. He is the Executive Vice 
President and General Counsel of Marsh & McLennan Companies. 
Before joining Marsh, Mr. Beshar was a partner in Gibson, Dunn 
& Crutcher. Mr. Beshar.

 TESTIMONY OF PETER J. BESHAR,\1\ EXECUTIVE VICE PRESIDENT AND 
          GENERAL COUNSEL, MARSH & MCLENNAN COMPANIES

    Mr. Beshar. Thank you, Chairman Johnson, Ranking Member 
Carper, and Members of the Committee.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Beshar appears in the Appendix on 
page 54.
---------------------------------------------------------------------------
    The evolution in the sophistication and intensity of cyber 
attacks in 2014 was astonishing. And as bad as it was in 2014, 
it got worse in the last month. In December, the German 
Government reported that hackers had caused massive damage to 
an iron plant by disabling the electronic shut-off systems that 
turned off the furnaces. And this escalation of cyber attacks 
reflects a troubling threat posed to our critical 
infrastructure.
    I would like to focus my remarks this afternoon on cyber 
insurance. Some of you may be saying, ``What relevance does 
cyber insurance have to this issue?'' And we would say it has a 
lot, that cyber insurance has the potential to create powerful 
incentives that drive behavioral change in the marketplace and 
that fundamentally that is what this Committee, what the 
Congress, and all of us are trying to accomplish.
    The simple act of applying for cyber insurance forces 
companies to conduct meaningful gap assessments of their own 
capabilities because insurers will want to know: Do you have an 
incident response plan? Do you have good protocols for patching 
software? Are you regularly monitoring your vendor network? And 
this process in and of itself is an important risk mitigation 
tool.
    Once a cyber policy is purchased, the incentive then shifts 
to the insurer to try to assist the policy holders to the 
greatest extent possible to avoid or mitigate attacks. And so 
you are seeing many insurers now offering an array of services 
like monitoring and behavioral analytics and rapid response 
that help policy holders, and the market is really responding. 
So in 2014, the number of our clients that purchased stand-
alone cyber coverage increased by 32 percent over the prior 
year. And we tracked specifically which sectors of the economy 
the cyber take-up rates were the highest, and so they are 
sectors like health care, education, and hospitality and 
gaming. Each of these industries handles a substantial volume 
of sensitive data. We also saw meaningful increases in the 
power and utility sector.
    We also tracked pricing trends on the premiums for cyber 
insurance, and if you read the headlines alone, you would 
assume that premiums went up meaningfully. And, in fact, year-
over-year pricing was really quite stable. Some industries were 
up, some industries were down. What we did witness in the 
fourth quarter of 2014 was in the retailing sector in 
particular, premium prices went up for obvious reasons. And 
underwriters really began differentiating between those 
retailers that were implementing the most sophisticated 
defenses on point-of-sale systems--end-to-end encryption, for 
example--and those retailers that were not doing so. And, thus, 
you are seeing insurance market forces really begin to drive 
incentives and create meaningful reasons to make the type of 
investments in cyber defense that we would want. And this 
phenomenon, Chairman, has occurred many times in many 
industries--workers' compensation, for example. Insurers were 
part of the bold work to really identify safety protocols that 
would improve the security of workers in the workplace. And 
over the last two decades, you have seen the number of 
fatalities in the workplace drop by over 35 percent. And this 
is the type of dynamic that we would like to see unleashed in 
the cyber insurance arena where carriers begin to give 
companies specific credit for implementing two-factor 
authentication or other meaningful protections like detonation 
software. In sum, cyber insurance is one element of many in a 
holistic risk mitigation strategy.
    A second key element, as this Committee has recognized, is 
information sharing between industry and government. To 
accelerate the identification and detection of emerging 
threats, there needs to be greater trust and greater real-time 
threat information sharing, and it should be, as other 
witnesses have commented, more reciprocal.
    Accordingly, we support the sharing of cyber threat 
indicators, like malware threat signatures and known malicious 
Internet Protocol (IP) addresses, provided that reasonable 
liability protections and privacy considerations are addressed. 
We believe that the dual considerations of national security 
and privacy can be fairly and appropriately balanced.
    Thank you, Mr. Chairman.
    Chairman Johnson. Thank you, Mr. Beshar.
    Our next witness is Richard Bejtlich. He is the Chief 
Security Strategist at FireEye. He is also a non-resident 
senior fellow at Brookings and previously directed General 
Electric's Computer Incident Response Team. Mr. Bejtlich.

 TESTIMONY OF RICHARD BEJTLICH,\1\ CHIEF SECURITY STRATEGIST, 
                            FIREEYE

    Mr. Bejtlich. Thank you, Chairman Johnson, Ranking Member 
Carper, Members of the Committee. I appreciate the opportunity 
to testify today. I am Richard Bejtlich, Chief Security 
Strategist at FireEye. Our Mandiant consulting service, known 
for its 2013 report on Chinese PLA Unit 61398, helps companies 
identify and recover from intrusions.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Bejtlich appears in the Appendix 
on page 61.
---------------------------------------------------------------------------
    So who is the threat?
    We have discovered and countered nation-state actors from 
China, Russia, Iran, North Korea, and other countries. The 
Chinese and Russians tend to hack for commercial and 
geopolitical gain. The Iranians and North Koreans extend these 
activities to include disruption via denial of service and 
sabotage using destructive malware. We have helped companies 
counter organized crime syndicates in Eastern Europe and 
elsewhere. Our recent report on a group we call ``FIN4'' 
described intrusions to facilitate insider trading. We have 
also encountered hacker teams for hire and others who develop 
and sell malicious software, or malware.
    How active is this threat?
    In March 2014, the Washington Post reported that in 2013, 
Federal agents, often the Federal Bureau of Investigations 
(FBI), notified more than 3,000 U.S. companies that their 
computer systems had been hacked. This count represents clearly 
identified breach victims, and many were likely compromised 
more than once.
    In my 17 years of doing this work, this is the single best 
statistic I have ever seen as far as just how bad the problem 
is.
    Serious intruders target more than the government, defense, 
and financial sectors. No sector is immune.
    But how do victims learn of a breach? In 70 percent of 
cases--and this has held up through our own consulting and also 
through other companies that we work with--someone else, 
usually the FBI, tells a victim about a serious compromise. 
Only 30 percent of the time do victims identify intrusions on 
their own. The median amount of time from when an intruder 
initially compromises a victim to when the victim learns about 
the breach--and, remember, most of the time they are being told 
by someone else. That time, according to our research for 2014, 
is 205 days. This number is better than last year's count, 
which was 229 days and the year before, in 2012, which was 243 
days. So we are making progress, but intruders still spend 
about 7 months inside a victim network before anyone notices.
    So what is the answer?
    Well, as Mr. Chairman mentioned, so-called network hygiene 
only gets you so far. We need more strategy here, and in my 
opinion, the best strategy is to prevent as many intrusions as 
possible, clearly; but we need to quickly detect attackers who 
evade regular defenses, respond appropriately, before the 
adversary accomplishes his mission. Strategically significant 
intrusions do not occur at the speed of light. It takes 
intruders time, from hours to weeks, to move from their initial 
foothold to the information that they seek.
    So defenders win when they stop intruders from achieving 
their objectives. I recommend two metrics that we could track 
to see whether this is the case, to include the Federal 
Government.
    The first metric is tracking simply the number of 
intrusions or the types of intrusions that occur in a given 
year. There are many companies I visit, and I ask that simple 
question. They cannot answer that question.
    The second metric is to measure the amount of time that 
elapses from when the intruder gets into your network and you 
notice. We want that number to be as small as possible.
    Well, how does threat intelligence play into this?
    ``Threat intelligence'' refers to the tactics, tools, and 
procedures used by intruders to abuse software and networks. It 
does not depend upon sensitive information about U.S. persons. 
And I will note that the President's proposal is compatible 
with this definition of ``threat intelligence.''
    Will that help?
    Threat intelligence will help defenders more quickly 
resist, identify, and respond to intrusions, but only if the 
organization is postured to succeed. Unless you have a sound 
strategy, the right technology, people, and processes, no 
amount of threat intelligence will help you.
    There are usually three cases for sharing threat 
intelligence: from the government to the private sector; within 
the private sector, and from the private sector to the 
government. And all three face challenges.
    In the government-to-private scenario, I recommend or I 
encourage the government to grant clearances to private 
security teams who are not working on government contracts. The 
government should also augment their narrative style reports--
in other words, text and sentences--with appendices that are in 
machine-readable format so we could facilitate that real-time 
sharing that was mentioned by my colleagues.
    In the private-to-private case, I would second the idea of 
having more information-sharing organizations in the private 
sector.
    And now we get to the toughest case, and this is the 
private-to-government case, and it is contentious, for two 
reasons.
    First, companies are reluctant to publicize they have 
breaches besides what is necessary to comply with laws. So the 
private sector fears penalties if they disclose. So I would 
recommend that they not be held liable simply for notifying the 
government that they have been compromised.
    Second, some privacy advocates fear that liability 
protection will let companies submit customer data to the 
government. If you properly format threat intelligence, this 
will not be a problem. In my written testimony, I have an 
example of a pilot program in the government involving the 
Department of Energy that we think is doing a decent job 
working with this sort of information, but I will leave that to 
your questions.
    Again, I thank you for the opportunity to testify.
    Chairman Johnson. Thank you, Mr. Bejtlich.
    Our next witness is Gregory Nojeim. He is the Senior 
Counsel and Director of the Freedom, Security & Technology 
Project at the Center for Democracy & Technology. Greg 
previously served as Associate Director and Chief Legislative 
Counsel in the ACLU's Washington legislative office.
    Mr. Nojeim.

TESTIMONY OF GREGORY T. NOJEIM,\1\ SENIOR COUNSEL AND DIRECTOR 
   OF THE FREEDOM, SECURITY & TECHNOLOGY PROJECT, CENTER FOR 
                     DEMOCRACY & TECHNOLOGY

    Mr. Nojeim. Thank you, Senator Johnson, Senator Carper, 
Members of the Committee. I am pleased to testify on behalf of 
the Center for Democracy and Technology (CDT). We are 
nonpartisan, nonprofit technology policy organization dedicated 
to protecting civil liberties and human rights on the Internet. 
We applaud the Committee for holding the first hearing of the 
114th Congress on cybersecurity. It is an important issue. It 
should be a particularly important issue for this Committee. It 
can play a key role in addressing the information-sharing 
problem.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Nojeim appears in the Appendix on 
page 65.
---------------------------------------------------------------------------
    I am going to explain today the role that information 
sharing can play in countering the threat of cyber attacks. I 
will identify different approaches to encouraging information 
sharing as well as the essential civil liberties attributes of 
a successful information-sharing policy.
    Other panelists have already described very well the direct 
harms of cyber attacks. I will just add one: Major cyber 
attacks on Target, JPMorgan Chase, Home Depot, and Sony 
Pictures command the headlines so much that, in addition to 
direct harms, these large-scale attacks also threaten to chill 
use of online services and of the Internet itself.
    There is no silver bullet that will wipe away the danger of 
cyber attacks. As my colleagues have noted, many cyber attacks 
could be stopped by basic digital hygiene, and Congress should 
be encouraging that. And a good way for doing that also is the 
Cybersecurity Insurance Program.
    On the other hand, other attacks, the advanced persistent 
attacks, they will often require the sharing of information 
about potential threats and how to defend against them.
    Cybersecurity information sharing also poses risks to civil 
liberties. After all, it does involve the sharing of some 
communications content and of some personally identifiable 
attributes of communications. As Mr. Bejtlich mentioned, the 
flow of this information to the government triggers concerns 
that cybersecurity information sharing could evolve into a 
surveillance program, and the concern is particularly acute 
when the permission to share trumps all laws.
    We favor a more focused approach: Create specific 
exceptions to the laws that inhibit information sharing. Start 
with the Wiretap Act and with the Electronic Communications 
Privacy Act. They permit communications service providers to 
share communications information to protect their own networks. 
But they do not permit them to share information to protect 
others. That can be fixed with straightforward amendments that 
we would be happy to work with you on. As other laws that 
inhibit necessary information sharing are identified, 
cybersecurity exceptions could be created to them as well.
    The broader, riskier approach of trumping all laws that 
might otherwise stand in the way of information sharing 
requires exacting civil liberties protections to prevent abuse. 
All of the major cybersecurity proposals take what we think is 
the riskier approach of trumping all laws. The White House bill 
does it; the Cyber Intelligence Sharing and Protection Act 
(CISPA) did it; and so did Cybersecurity Information Sharing 
Act (CISA), the Senate Intelligence Committee's bill from last 
year.
    What are those civil liberties protections that need to be 
incorporated?
    First, narrowly define the information that can be shared 
and include only that which is necessary to describe a threat.
    Second, prioritize company-to-company sharing because the 
private sector owns most of the critical infrastructure that 
must be protected against cyber attack and because private-to-
private information sharing does not create some of the fears 
about the flow of information to the government.
    Third, apply privacy protections prior to any level of 
information sharing, whether by a private entity or a 
governmental entity.
    Fourth, ensure continued civilian control of the 
government's cybersecurity program for the civilian sector.
    Fifth, require that information shared for cybersecurity 
reasons be used for cybersecurity, with limited exceptions for 
law enforcement use to counter imminent threats of bodily harm, 
and to prosecute cyber crime.
    Sixth, be careful about authorizing countermeasures. 
Countermeasures that could amount to hacking back against an 
individual or entity suspected of hacking into one's own system 
should not be authorized. They create more problems. They open 
a Pandora's Box.
    And, seventh, create strong privacy procedures governing 
the sharing of information by governmental entities.
    With respect to these seven factors, I think the White 
House bill does a better job on all of them except for 
prioritizing the company-to-company sharing. We have specific 
concerns with the White House bill. It could be a lot better. 
But it was a significant improvement over the Senate's last 
look at information sharing, which was CISA.
    I close by observing that today is Data Privacy Day. It is 
a day observed around the world for promoting data privacy. Let 
us work together to ensure that cybersecurity information 
respects data privacy, even when it is shared, and helps 
preserve the Internet as a great engine of communication, 
innovation, and prosperity. Thank you.
    Chairman Johnson. Well, thank you, Mr. Nojeim. Again, thank 
you to all the witnesses for your thoughtful testimony.
    To give more Members a chance to ask questions, we are 
going to limit the time for questions to 5 minutes each. Also, 
to remind veteran Members and let the new Members know what the 
tradition of this Committee is in terms of order of 
questioning--it is the people here in attendance when the gavel 
drops. It will be in order of seniority, rotating between 
sides. And then after the gavel falls, just in order of 
appearance.
    So, with that, I am not going to ask questions so that more 
Members have a chance to ask questions. I will turn it over to 
our Ranking Member, Senator Carper.
    Senator Carper. I want to thank the Chairman for yielding 
his time to his Ranking Member.
    We do a lot of oversight work here. We do a lot of asking 
of studies by the Government Accountability Office (GAO) and 
others. Sometimes we just send letters, and I noted a change of 
behavior, and sometimes we legislate. Last year, when we were 
in the 113th Congress, we legislated in three or four different 
Bills with respect to cybersecurity. We sought really to 
bolster the capabilities of the Department of Homeland Security 
(DHS) on that front.
    We passed three or four modest bills, but I think together 
they are very meaningful. One was to make the Cyber Ops Center 
of DHS real and meaningful, codified it. I think that is a very 
good thing. We also have enabled them to strengthen their 
workforce. And a third area that we have worked in is to better 
enable them to protect the dot.gov domain. And so those three 
things taken together I think are helpful.
    We tried to pass information-sharing legislation, as you 
know, in the House and the Senate. We got it out of Committee 
in the Senate but not through the full Senate.
    We have shared jurisdiction on that issue, and some would 
say we actually have maybe more jurisdictional claim on 
information sharing than other committees. But we are going to 
be working fairly hard in this vineyard very soon.
    We have three places to look--maybe more than three. Your 
job is going to find more places to look in terms of developing 
good policy, but, one, the Administration's proposal; two, the 
Senate Committee's bill, the Intel Committee bill from last 
year; and then the work that the House has done.
    I am going to ask each of you, if you would, using those 
three as maybe a touchstone for us in cobbling together smart 
legislative policy on cyber, especially on information sharing, 
what would be one or two major points that you would have us 
take into mind to consider as we do our work. Mr. Gordon.
    Mr. Gordon. Thank you very much, Senator. I agree there was 
great progress last year. I would love to see that bill with 
information sharing.
    If I look across the bills--CISA, CISPA, and the 
President's proposal--the areas that I would highlight as--
first, there are many in common, so I am not going to cover 
those, but the differences or the areas that I would highlight, 
one, I think there is greater or lesser emphasis on real-time 
sharing, and I would propose that that is very significant in 
terms of the speed at which attacks cascade across--within 
industries and across industries. I believe that real time is 
very important.
    Second--and a number of people have mentioned it here--I 
think it is important that the construct not just protect in 
terms of liability entities sanctioned by the government, but 
also that it encourages and facilitates company-to-company 
sharing, that is to say that the liability protections would 
extend to companies sharing among themselves, not just with 
another entity.
    The third and fourth I would highlight very quickly. One is 
protecting sharing. Liability in terms of sharing is important. 
But I also believe protecting acting within one's own network 
is also important. So it is not enough simply to share, but one 
has to be able to actually act on what is shared, and I would 
emphasize that.
    And then the final one, which a number of folks I think 
have mentioned as well, that for us is very important is the 
bi-directional nature of sharing. I believe that as I reflect 
on it, both the CISA and CISPA bills did have a great deal of 
focus on basically requiring the government to get more active 
in sharing, particularly in classified indicators, shared in 
the right way; whereas, I believe the President's proposal is 
silent on that. And I believe that bi-directional sharing I 
feel is very important, and for us there are the threats that 
we experience that we can share across the private sector. 
Typically those occur while we are under attack, so what we are 
sharing is essentially information about an attack that is 
unfolding. What the government has access to that simply is not 
known to us are the attacks that could take place and the 
nature of those attacks. I think that would be a tremendous 
value-add. So I would include the bi-directional sharing in 
terms of emphasis.
    Senator Carper. OK. Thanks. Mr. Charney.
    Mr. Charney. I agree with the points made. I think certain 
bills did not go far enough on the civil liberties side. I 
worry a little with the Administration proposal that we not 
impact current industry-to-industry sharing that is really 
working well. Marc's points were spot on. The only other thing 
I would add is the international flavor of this. As a company 
that has customers all over the world and who is constantly 
combating international threats, it is very important to 
recognize that whatever the Congress does, others may emulate.
    And so, for example, the U.S. Government could say, ``Tell 
us about every vulnerability you know about,'' and you could 
say, ``Well, that would be really interesting to know.'' And 
then every other government in the world will ask for the same 
thing, and suddenly things can become very difficult. And so 
thinking about the international implications of what is done 
here is super important.
    Senator Carper. All right. Thanks. My time has expired.
    Chairman Johnson. No; go ahead.
    Senator Carper. Mr. Beshar, and maybe I would ask you to 
just short it up just a little bit, if you will, please.
    Mr. Beshar. Very briefly, Senator Carper, two points.
    First, there is a hierarchy of data that would be of 
interest to the government that sits in these companies' hands. 
And if you try to focus on the cyber threat indicators and 
begin this journey there as opposed to trying to go deeper on 
the data that is part of this exchange, I think that will be a 
very fruitful step.
    Second, the idea that in the President's bill there are 
obligations that all of our companies have to try to strip out 
the personally identifiable data, I think that is a very 
constructive step forward, as Greg has identified.
    Senator Carper. All right. Thanks.
    Mr. Bejtlich. Senator Carper, briefly, I would encourage 
whatever resources are necessary to help the FBI with its 
notification mission. Speaking as the spokesperson for the 
intel community, that third-party notification is just very 
valuable.
    And, second, I would encourage whatever is required to get 
more prosecutions. I do not think it is necessary to lengthen 
prison times and that sort of thing. I think we just need to 
make better use of the laws that are there and to get more of 
these bad guys.
    Senator Carper. Good. Thank.
    Last, but not least?
    Mr. Nojeim. So I think I am going to focus just on three 
issues:
    Stripping out irrelevant personally identifiable 
information (PII) before you share a cyber threat indicator. 
The White House bill does a pretty good job of that. CISA did 
not require that.
    Second, on use restrictions, making sure that if a company 
shares information for cybersecurity reasons, it is used for 
cybersecurity. There are some national security uses that are 
cybersecurity uses. Those should be allowed. There are some law 
enforcement uses that are cybersecurity uses. If you want to 
prosecute a cyber crime, that serves a cybersecurity purpose. 
That should be allowed.
    Countering an imminent threat to a person, that should be 
allowed, but not much more. And I think the White House bill 
did a much better job on that score than did CISA.
    And, finally, on hacking back, making sure that if 
countermeasures are going to be authorized, they can only 
operate on your own network. You do not want a countermeasure 
that could, when stolen from your network and placed on 
somebody else's computer, including a victim's computer, 
encrypt or damage data on that computer.
    Senator Carper. Thank you all very much. That was very 
helpful. Thanks.
    Chairman Johnson. Thank you. And now we will stay more on 
time. Senator Lankford.

             OPENING STATEMENT OF SENATOR LANKFORD

    Senator Lankford. Thank you all for being here and being a 
part of this. Let me ask some cost questions and the gain from 
this. We are talking about between a hundred--estimates of $100 
billion to $450 billion in costs a year somewhere right now on 
the cyber attacks. Give me a rough ballpark on the breakdown of 
that between damages that are paid out that are preventable if 
we have this enhanced information sharing and those that are 
not preventable because of a zero-day attack and we are stuck, 
we are at the beginning of it.
    So what I am trying to affirm is we get this in motion, we 
get better information sharing. What difference does it make 
economically? And anyone can attack that.
    Mr. Gordon. That is a great question. I am not sure I can 
answer it directly in terms of a percentage. But what comes to 
mind for me is what percentage of those losses are repeat 
attacks, meaning they happen more than once. And I would say in 
the right construct of information sharing, bi-directional real 
time, a very high percentage of repeats--that is back to my 
comment earlier, which is one company's attack can become the 
Nation's defense if we do it the right way. It will not prevent 
that first attack, but it can prevent all the ones that follow 
potentially.
    So I cannot answer specifically the dollar amounts. I do 
not know how to break that down.
    Senator Lankford. So the guess here is to try to figure out 
how many attacks that are out there are repeat attacks.
    Mr. Gordon. That might be a way to look at it.
    Senator Lankford. So any ballpark on that you would see 
from just what you have seen or anyone has seen on cyber 
attacks out there that are known threats, or were they just not 
known to you or to those companies?
    Mr. Bejtlich. Senator, at Mandiant, just even our own 
customer base, when we do a response, depending on who the 
actor is, if it is the Chinese or the Russians, they are going 
to be back. In some cases, their recidivism rate is as high as 
a third. So that is just against one company is hit, and then 
they are hit again by the same group after we leave.
    Senator Lankford. OK. Let me ask a question. What is next 
on this? Information sharing, I think there is fairly common 
agreement we need to have some level of information sharing. It 
is how to protect personally identifiable information and such. 
What is the next level on this? Where does this go?
    Mr. Charney. I can take that. I think to deal with advanced 
persistent threats, you need a very robust security program 
that has three elements: you need high-level protections in 
place; you need great detective capabilities, because the bad 
guys will keep attacking; and you need very fast response 
processes. And what we have found, of course, in many of the 
hacks that occur today, even if they are called ``advanced 
persistent threats,'' they are not all that advanced. People 
attack unpatched systems. People are running old operating 
systems and old software. And we need to get all boats to rise.
    The challenge has been, of course, that for 20 to 30 years 
people have built networks with tough, hard perimeters, but the 
middles are really soft. And in these advanced persistent 
threats, the bad guy comes in and gets a foothold in the 
network and then moves across the network.
    So the information technology (IT) industry and users of IT 
are all focused on a few core things that are starting to 
happen.
    First, you need multi-factor authentication. You need to 
get rid of user names and passwords because they are just too 
easy to guess or calculate and break in.
    Second, we need what we call ``domain isolation.'' If 
someone attacks and gets in somewhere, they should not be able 
to move everywhere.
    And, third, we have to do a much better job, as people say, 
of detecting things so we can respond quickly. So hopefully 
with more information sharing you put the detections in place, 
and then you can act much more quickly and prevent a lot of the 
damage.
    Senator Lankford. OK. Let me ask a followup question to 
that. With a lot of the issues based on the fact that companies 
are not doing basic patches, they are not doing some of the 
things that are commonplace, then we have this extra layer that 
we are adding to this with personally identifiable information 
that they have got to be able to secure that, sequester that 
away, and so that does not get out as well. If they are not 
doing patches, how diligent are they going to be to make sure 
they are also protecting the information once it gets shared 
that people truly have their privacy protected as well?
    Mr. Charney. Well, so it is absolutely clear that if you do 
not have a good protection program, you are going to lose 
valuable data----
    Senator Lankford. Right.
    Mr. Charney [continuing]. Whether it is economic data or 
personally----
    Senator Lankford. But that is happening right now.
    Mr. Charney. That is happening right now, and you need to--
there are two things to think about. One is raising the 
protections, which is what information sharing is supposed to 
help do, so that you can prevent that. But the second thing is 
that the security model is changing across the industry in two 
respects. One is in some cases you actually do not need that 
personally identifiable information to engage in a transaction.
    So, for example, in the credit card arena, there are 
companies who are looking at--and PayPal does this already--not 
giving the credit card to every merchant in the world, but just 
passing an authentication code to authorize the payment. And if 
you do things like that, then it is much harder--even if you 
steal the information, you are not getting anything that is 
replayable and reusable, and you will see that coming in many 
new ways because we are going to start attaching identities to 
particular devices. People have tablets. They have phones. They 
have portable PCs. And if we can tie your credential to that 
device, then if someone else tries to use that credential from 
another device, it will not work.
    So there is a lot of preventative things we can do from 
protecting networks to thinking about information differently 
and how we protect it.
    Senator Lankford. Thank you, Mr. Chairman.
    Chairman Johnson. The remaining order will be Senator 
Booker, Senator Baldwin, Senator McCain and then Senator 
Ayotte. Senator Booker.

              OPENING STATEMENT OF SENATOR BOOKER

    Senator Booker. I want to thank the Chairman. This is a 
fantastic and very important hearing that we are having. I 
appreciate your leadership, and I want to thank my Ranking 
Member as well.
    Gentlemen, it is the balance, again, between privacy and 
security, and I think that there is a huge tension in this 
area. The degree and nature of the attacks are startling and 
stunning. And I just have really quick questions that should be 
very brief. But the first is: What role does the government 
have, being that so many mistakes are being made in what is 
called the hygiene area? It is remarkable to me how many 
mistakes we make, and I sat with my staff and realized even for 
my own passwords I was not using dual authentication methods 
and the like. But so many businesses out there just are not 
doing the basic common sense that would prevent a lot of this 
from going on.
    And so I am wondering, in just the idea of the role of 
government, what could we be doing to either incentivize or 
mandate levels of hygiene? Or is that, in some of your opinion, 
not the role of government at all?
    Mr. Nojeim. I am going to start with that. I do not think 
it is a good idea to mandate levels of hygiene. I think that 
the mandates will rapidly grow outdated, and they will become 
the floor instead of the ceiling. Companies are going to 
innovate. They are going to come up with new ways to protect 
data, and I think that you want to encourage them to do that. 
Give them tax credits, give them other assistance, but I do not 
think you should try to mandate exactly what they do.
    Mr. Bejtlich. I would concur with that, Senator. The 
insurance example is a great one. If someone keeps breaking 
into my house, it is going to be tougher for me to get a 
premium because they can tell I do not lock my doors and that 
sort of thing.
    The government should restrict itself to the things that it 
will not let the private sector do, which is hack other people, 
or prosecute or do those sorts of things. So I think the role 
of the government should be to do those things that are unique 
to the government, to do the threat mitigation by either 
deterrence or by prosecution or that sort of thing, and the 
private sector can work on the things that we are good at.
    Senator Booker. Yes?
    Mr. Charney. I would add one more point. The government can 
lead by example. The government is a large enterprise, and it 
has customers, too, but their customers are called 
``citizens.'' And citizens file taxes online and file for 
benefits online and want information from the government. So 
the government could do a better job, I think, of adopting the 
latest technologies, managing their systems really well, and 
leading by example.
    Senator Booker. OK. Let me just shift for a second.
    And, by the way, 14 months in the U.S. Senate, we are not 
leading by example with a lot of the practices I see. But I 
just want to then to the perverse business incentives and the 
idea that you provide some kind of full liability or when it 
comes to information sharing with the government, are we 
creating an environment where we are going to promote 
oversharing with government some of the privacy information? 
And I am really worried about that. In many ways, it is just 
giving the government access to another level of domestic 
surveillance by creating perverse business incentives for 
oversharing. Is that a concern?
    Mr. Gordon. The way we look at sharing, if we actually look 
at both what we share and what is shared with us and what we 
would like to amplify over time in terms of sharing, what we 
are essentially talking about are things called ``cryptographic 
hashes'' or pieces of software code. There is nothing 
associated with customers in any shape or form in terms of 
essentially what is effective for sharing. And so I think even 
the way the prior legislation speaks to pulling out PII, our 
view is--and I went back and looked at what we have shared and 
what we like to share more of--it is indicators of attack, 
indicators of compromise, and the like that we do not see that 
there is any real issue at the end of the day as long as we 
focus on sharing that type of information.
    Mr. Beshar. Senator Booker, we would concur with that, that 
even in the last year, the extent of the threat has intensive; 
that if there are going to be attacks on critical 
infrastructure and it is less graffiti and financial crime and 
more threatening of power grids and the like, then that balance 
has to at least be calibrated. And as the other witnesses have 
said, I think by stripping out the personally identifiable 
data, you legitimately address the privacy concerns that are 
there, at least with respect to cyber threat indicators.
    Mr. Gordon. I would like to add one more thing and think 
about it this way: If somebody broke into our data center and 
started attacking our computers with an axe, we would report 
the fact that they have done that. If they broke into our data 
centers and started siphoning off customer information, we 
would report the same thing. The analog for me here is I am 
reporting the axe that got used and the fact that siphoning is 
occurring. I am not even reporting because I do not know in 
most cases who it is.
    So that is the nature of what we are talking about sharing 
essentially, is the fact that an axe was taken to our data 
center.
    Mr. Nojeim. Senator, there are three steps here.
    First, you narrowly define the information that can be 
shared. It has to be necessary to describe the threat.
    Second, you require companies to look for and strip out any 
personally identifiable information that is not relevant to the 
threat.
    And, third, you make it so the liability protections only 
operate when the companies play by those rules. That would do 
the trick.
    Mr. Charney. Can I add one point to that? There are times 
when we do need to do attribution and find source. So if you 
only share anonymous data, you can protect and detect, but you 
cannot deter. And that is why in our testimony, one of the 
things we point out is when you need to get identifying 
information so you can do attribution and take action, we have 
legal processes, court orders, and other things that are 
designed to protect civil liberties and strike the right 
balance.
    Senator Booker. Thank you.
    Thank you, Chairman.
    Chairman Johnson. Senator Ernst has returned, so we will go 
to you next, and then Senator Baldwin.

               OPENING STATEMENT OF SENATOR ERNST

    Senator Ernst. Thank you, Mr. Chairman. Gentlemen, thank 
you for being here today. We greatly appreciate your expertise 
in this area.
    Iowa just in recent years has really become a tech hub. We 
have Google located there, Facebook. We have Microsoft coming 
soon to West Des Moines. We also have many financial 
institutions, insurance companies, both large and small. We 
have a lot of small business.
    So when we are talking about this, we largely think about 
those larger entities, but what can we do through a voluntary 
process to assist and encourage small businesses to voluntarily 
share information and do it in a way that is not cost 
prohibitive or time prohibitive for those smaller groups? I 
would love to hear your thoughts on that. Thank you.
    Mr. Bejtlich. Senator Ernst, this may sound 
counterintuitive because a lot of people have worries about the 
cloud. But to tell you the truth, the cloud may be--assuming 
you use a worthy cloud provider who has their act together, the 
cloud is of great benefit. I advise many small startups, and 
they do not build out networks the way we did 10 or even 15 
years ago. They do everything on the cloud.
    So if the cloud providers--Google, Microsoft, Amazon, and 
these others--have a robust security program and they protect--
or the users protect how they access those services using two-
factor and other methods, that is actually a pretty good 
scenario. It takes the IT duty away from that mom-and-pop shop 
and puts it in the hands of some professionals.
    Mr. Beshar. Senator Ernst, I am proud to report that we 
have 1,500 employees in Urbandale, and it is a terrific 
workforce and a great asset for our company.
    Senator Ernst. Yes. Thank you.
    Mr. Beshar. It is similar to Senator Lankford's question, 
that it is difficult to visit burdens on small and mid-sized 
enterprises that are perhaps customary and commonplace for the 
larger companies.
    At the same time, one of the real takeaways from 2014 is 
that the security of the larger organizations is really 
dependent upon smaller enterprises, that many of the companies 
that have been in the news have been attacked not through the 
front door but through the side door of the back door of the 
vendor network. So things like the Administration's 
cybersecurity framework, the National Institute for Standards 
and Technology (NIST) framework, I think is a helpful, 
relatively straightforward tool to try to assist small and 
medium enterprises to go through some of the steps that we are 
talking about.
    Senator Ernst. Any other thoughts?
    [No response.]
    Thank you, Mr. Chairman.
    Chairman Johnson. Senator Baldwin.

              OPENING STATEMENT OF SENATOR BALDWIN

    Senator Baldwin. Thank you, Mr. Chairman and Ranking 
Member, for holding this hearing. I really appreciate it.
    I have a couple questions I want to get out there, but I 
wanted to actually start, having heard the response to Senator 
Booker's first question about the appropriate government role, 
and I just want to make sure I understand your responses as 
really coming from the business enterprises that you have the 
expertise in, because, as I have looked at it, I have seen 
perhaps areas where we should have a more robust government 
role when we deal with things like--I know, Mr. Beshar, you 
mentioned the electrical grid, critical transportation 
infrastructure, some of our infrastructure. Is that fair that 
you are really answering for your industries and not--or is 
this advice throughout no matter what type of attack we are 
looking at? I just want to clarify that for the record. Do you 
want to just go down the--Mr. Gordon?
    Mr. Gordon. The role of the government question, in the 
context of hygiene, which I think was a substantial part of it, 
I would concur. I feel that, first of all, the definition of 
``hygiene'' is very dynamic. I mean, it literally changes day 
to day. I do not think the government should have much of a 
role in that. And I would say the market has very quickly taken 
care of that in terms of boards paying attention to hygiene. I 
think that is an increasingly smaller problem.
    The other dimension, which I think is outside the purview 
of this discussion, but I do think the question of the role of 
the government in preventative action and in deterrence, I 
think that is still unclear probably to some greater or lesser 
degree, not the role of the private sector.
    Mr. Charney. In my written testimony, I talked about the 
four roles of government relative to IT, because in addition to 
being a large enterprise with customers, they also do have a 
traditional public safety and national security responsibility. 
And, I am a big fan of market forces, and they work great for 
innovation, but it is hard to make a market case for the cold 
war. When you have a national security imperative, the 
government often has a major role to play, and part of that is 
that, as a large enterprise, they are attacked a lot. As former 
Chief of the Computer Crime and Intellectual Property Section, 
I can tell you that, in the early days, the two most attacked 
agencies were the Department of Defense (DOD) and the National 
Aeronautics and Space Administration (NASA) because NASA had 
cool stuff. And the government has this information and often 
knows of threats and shares it with industry, which makes us 
more effective in protecting the ecosystem and our customers.
    And then there is also the question of how to deter 
particularly these nation-state attacks. Microsoft has been 
very vocal that we need norms for the Internet. We have norms 
for State behavior in a range of areas, like money laundering 
and weapon of mass destruction. We actually do not have norms 
for cyber activity. And so we see nation-state activity that 
would be very hard for the private sector to fend off. I mean, 
nation states can put spies in your organization. It is well 
known that a Russian spy was arrested at Microsoft. How does a 
private company fend off a well-funded, persistent nation-state 
attack?
    And so the government can help by helping establish those 
norms and in the right places taking steps to help, regulate 
the behavior of others, so to speak.
    Senator Baldwin. OK. I am hoping to get to another 
question, so either real quick, or----
    Mr. Beshar. Please.
    Senator Baldwin. OK. For Mr. Nojeim, you talked--I really 
appreciate your analysis of the three principal proposals and 
your recommendations to strengthen them. Just narrowing in on 
the Obama Administration's cybersecurity proposal, obviously 
critical details have yet to be finalized in that, including 
for privacy guidelines. So I am wondering what are your 
recommendations for, first, defining what constitutes 
personally identifiable information; and, second, for sharing 
cyber threat data that includes such personally identifiable 
data.
    Mr. Nojeim. So we went through an exercise of trying to 
list all the types of personally identifiable data that we are 
talking about. I do not think that Congress should try to go 
down that road. We did not know years ago that IP addresses 
could become personally identifiable with the additional 
information. Maybe some people knew it; maybe some people did 
not. But the fact of the matter is that sometimes the 
aggregation of information can make it personally identifiable 
when people thought it was not before.
    So rather than going down the road of trying to list the 
particular categories of personally identifiable information, I 
think it is better to require that personally identifiable 
information be stripped out and then task DHS with coming up 
with the list through a Notice and Comment process, and that 
list will change over time, and everybody will know it will 
change over time. So I do not think you want to go down the 
road of trying to list that in the statute.
    And then when it comes to removing it when it is not 
necessary to describe a threat, I think that is going to happen 
naturally in the automated process of sharing threat 
information. Companies are going to develop systems that other 
companies will buy that they will use to share this threat 
information. They will have to be able to describe the threat. 
And those same systems that describe the threat can be used to 
filter out the irrelevant information.
    Chairman Johnson. Senator McCain.

               OPENING STATMENT OF SENATOR MCCAIN

    Senator McCain. Thank you, Mr. Chairman. I thank the 
witnesses.
    A week ago or a couple weeks ago, the Armed Forces Network 
was hacked into and not only did radical messages show up on 
the screen, but also names and addresses of individuals. And I 
do not think a lot of Americans know that Armed Forces Network 
is at every base, every ship, every defense installation of any 
size, not only in the United States but in all our bases all 
around the world.
    So it was a pretty clever action on their part and I think 
pretty sophisticated, and not only did it give them a 
propaganda coup, but most people believe that Armed Forces 
Network is run by the Armed Forces. It is not. It is contracted 
out to a commercial organization. And it not only was 
propaganda, but also when names and addresses of people are put 
out, it obviously poses a direct threat to literally their 
lives.
    What happened? What could we have done to prevent it? And 
what do we need to prevent something like that in the future? 
Is that you, Mr. Charney, or Mr. Gordon? Whoever wants to take 
that.
    Mr. Charney. Well, first and foremost, many large 
organizations outsource IT functions, and it is absolutely 
crucial that their outsourcing contracts have requirements for 
security and privacy that meet the needs of the party that is 
hiring the contractor.
    Senator McCain. So the Pentagon should have been smarter.
    Mr. Charney. I have a lot of friends in the Pentagon. I 
think they are great. But certainly their contracts should 
require that the information be protected at the right level, 
and now with things like the NIST framework, the International 
Organization for Standardization (ISO) standards, there are 
more and more ways to audit and measure the security controls 
in an environment.
    And so, for example, for a lot of our cloud-based 
customers, they now ask to see our audit reports, which we 
share, because they want to make sure before they entrust their 
data to us that we are taking the necessary steps to protect 
it. And we have to enforce that through contracts with 
customers.
    Senator McCain. So, again, whoever in the Pentagon let that 
contract did not let the right contract.
    Mr. Charney. Either that or the term was in the contract 
but no one evaluated whether the contractual terms were being 
followed.
    Senator McCain. Mr. Gordon, do you have any comment?
    Mr. Gordon. Not a lot to add other than when you look at 
the most common attack factors, websites is one. One of the 
most prominent is websites, so companies put a lot of energy 
into a set of controls around that. I am not familiar with 
actually what the vulnerabilities were that were breached, but 
I agree with Scott. I think that the right third parties and 
businesses put those controls in place to prevent those kinds 
of breaches.
    Mr. Bejtlich. Senator McCain, I think on paper almost 
anyone looks good, but the proof is when you can test it and 
find out if your defenses are strong. I am sure you are 
familiar with the term ``red-teaming.'' If someone had red-
teamed against that user account or a system or a network and 
found, wow, it is very easy for me to get in here, I am not 
going to cause any damage, I am going to report back to the 
owner, it took me 5 minutes to break into this system, and you 
fix the problem before the bad guy finds out. That is one way 
to avoid it.
    Senator McCain. Anyone else?
    [No response.]
    Well, it was interesting that General Dempsey, our Chairman 
of the Joint Chiefs of Staff, recently said that we have a 
technological advantage in every form of warfare over our 
potential adversaries except for one, and that is the issue 
that we are discussing today. I thank you.

              OPENING STATEMENT OF SENATOR AYOTTE

    Senator Carper [presiding]. Senator Ayotte.
    Senator Ayotte. Thank you, Chairman.
    Senator Carper You are welcome. [Laughter.]
    Senator Ayotte. I wanted to followup on a comment that Mr. 
Bejtlich made about law enforcement capacity here, and you had 
said we do not need more laws, what we need is greater 
prosecutions and an ability of the FBI and other law 
enforcement agencies to prosecute these individuals.
    I was Attorney General of our State, and in the limited 
cases that I was involved in on these issues, the prosecutions 
are very challenging. As you know, often the actor can be from 
another country, and we are not even talking about nation-state 
actors there, just the location.
    What thoughts do you have as to how we can better help our 
law enforcement agencies have the right tools to pursue 
appropriate cases, so that we have some examples that we are 
not just allowing these things to happen?
    Mr. Bejtlich. Thank you for the question, Senator. I think 
there are a couple angles to it. One of them is, as you 
mentioned with overseas actors, international cooperation. If 
you are a hacker and you are in the United Kingdom and you are 
attacking the United States, that is a bad situation for that 
hacker. We are going to work with our partners and are going to 
get them back. If you are in an Eastern European country or 
some other location--so international cooperation is first.
    Second is training. You need to be trained to do this sort 
of work. You need to know how to carry off a successful 
prosecution, what are the defenses that could be there, and how 
to collect the information properly. It is very similar to what 
we saw in the intel world in warfare. Guys used to go in, smash 
the computers, and then they would bring back fragments, and 
you realize you could not use it. You had to teach them how to 
collect evidence and that sort of thing.
    And the third part is you have to make it a career path. We 
saw this with the turnaround in the FBI now where it is now a 
career path to be an intel person; it is a career path to be a 
cyber person. You need to have that sort of recognition and 
success for following those.
    Senator Ayotte. Thank you. I was very interested in the 
discussion we had that Senator Ernst asked about, the 
challenges for smaller and mid-sized businesses. Having been 
briefed, for example, on the Sony hack--that obviously was a 
nation-state actor, but, frankly, SONY is a larger company and 
even some of our larger companies do not have all the 
protections in place that need to be there. And so, there are 
challenges for smaller and mid-sized businesses. You have 
talked about the use of the cloud-based system in terms of 
resource efficiency for smaller companies.
    As we look at more of our companies moving to that, what 
are the security challenges we are going to have to be aware of 
with the cloud-based system that we should be focusing on? 
Because, as you know, getting into the system from the smaller 
connection is probably the easier way to do things.
    Mr. Charney. So Microsoft, of course, offers large-scale 
cloud services, and people often ask me, ``Is the cloud good or 
bad for security?'' The answer is yes.
    It is good for security because, as mentioned earlier, 
because it is core to our business and we have a lot of 
security expertise. We probably are more rigorous about 
security than many companies might be.
    At the same time, it is important to understand that in the 
cloud model you have a multi-tenanted environment. You have a 
lot of customers using the same cloud service, which makes it a 
very rich target.
    Senator Ayotte. Right.
    Mr. Charney. And so we do things to make sure that our 
customers' data is segmented from one another and prevent that 
lateral movement.
    But the other important thing is that, even when you use 
the cloud, security becomes a shared responsibility. What I 
mean by that is a small business might issue its user names and 
passwords to its employees, and if an employee loses that 
password to a bad person, that person can log on as that 
employee. The cloud will not know.
    Senator Ayotte. Right.
    Mr. Charney. It looks like an authorized use.
    So we have been committed for quite some time to providing 
more security technologies that are just secure by default in 
our newer products--and I talked about this a little earlier--
identities that cannot be stolen because they are bound to 
machines. We have to get to a place--I am all for user 
education. It is a wonderful thing. But I think we put too much 
of a burden on end users to manage security when it is actually 
a complex undertaking.
    Senator Ayotte. You have all talked about what you see as a 
problem with the Administration's proposal not allowing sharing 
and liability protection among companies. So in a cloud-based 
system, is that the way the legislation drafted is particularly 
acute? Or does that not matter because you are thinking about 
transmitting the information at a higher level?
    Mr. Charney. So for us, we have to be clear. We have two 
types of information. We have our information about our network 
that we can share as we see fit, even if we take some risk in 
sharing. And Microsoft actually does a lot of sharing today. We 
have programs where we share threat and vulnerability 
information with customers, with governments, and others. We 
share our source code with governments as well. So we can 
accept that risk.
    At the same time we have customer information, and they 
have expectations, usually enforced through contractual terms, 
that they do not want us using their data in any way without 
their permission and consent.
    And so when we look at some of this information sharing, we 
want to make sure that the information we share today, which is 
substantial, is not disrupted by a new regulation or regime 
that says, for example, you can only give data to DHS. Well, 
no, we want to share data with our partners all the time, and 
we do, so do not disrupt that. It does not solve the problem of 
sharing customer information. That we will not do without the 
customer's permission, and we want to make sure that any 
regulatory regime respects that contractual obligation, because 
the biggest problem we have, as a global company, I go overseas 
all the time, and customers in other countries say, ``Will you 
turn over our data to the U.S. Government?'' That is what they 
are worried about. And when the answer is sometimes yes because 
we could get a court order or other things--we are fighting a 
case like this right now involving a U.S. order to turn over 
data from our Irish data center, a customer e-mail. it is not 
our data. It is the customer's data. And if we do not protect 
the privacy of that information, then what happens all over the 
world is people say, ``So I should use a local provider, right? 
Because if I use your cloud service, you are a global company; 
you are headquartered in the United States. You are just going 
to give all our data to the U.S. Government.'' And what will 
happen over time is American information technology products 
and services that have been so successful around the world, 
well, in all those other parts of the world people will say, 
``Whoa, maybe we are better off with local technology, not 
being compelled by the U.S. Government.'' And that in the long 
term for America would be a terrible thing.
    Senator Ayotte. Thank you very much for clarifying this. I 
appreciate it.
    Senator Carper. Senator Ayotte, I think we are going to 
wrap it right there. Would you all just stay in place, and, 
Senator, we are going to take a real quick recess. Senator 
Johnson has run to vote. He will be right back, and when he 
does, he will resume, and I know he has some questions. And I 
might join you back again, too. Thank you very much.
    Senator Booker. Mr. Chairman, is the vote imminent, or do 
we have a chance for one more round?
    Senator Carper. The vote started 11 minutes ago. I think we 
have 3 or 4 minutes left on the clock.
    Senator Booker. Being that I cannot come back, may I ask 
one more?
    Senator Carper. You may go ahead, and when you have 
finished, just recess unless Senator Johnson is back.
    Senator Booker. That is a lot of power you are leaving me 
with, sir. [Laughter.]
    Senator Carper. I have every confidence in you.
    Senator Booker [presiding]. Thank you very much.
    Gentlemen, just real quick. I have seen how perception 
problems with private business affect those businesses' 
abilities to operate overseas. And I have seen comments by 
high-level officials here that then make other countries demand 
that our American companies have servers located in their 
country as well.
    Do you have any concerns about us sharing information, 
companies sharing information with the Federal Government 
agencies, then making foreign countries more concerned about 
those companies operating in their nations?
    Mr. Beshar. I think it is a legitimate consideration, 
Senator Booker, so the draft legislation really speaks about 
exempting company that provide information from U.S. civil and 
criminal liability. If there is data from Europe or other parts 
of the world that is embedded in some of the information, a 
question at least arises of the scope of that liability 
protection.
    Senator Booker. OK. Any other thoughts of the child that it 
could be creating or something we should worry about?
    Mr. Charney. Well, we have had to grapple with this problem 
post the Snowden disclosures where government and customers all 
over the world have expressed concern about relying on U.S. 
technology. And we have been very clear that we do defense, not 
offense. We do not put the back doors in products. We do not 
turn over encryption keys.
    Where you can get stuck at the end of that discussion is if 
the U.S. Government does compel the production of data and does 
it with a non-disclosure order, there is some risk to the 
foreign enterprise that their data will be turned over to the 
United States without notice.
    Senator Booker. Right.
    Mr. Charney. And that does worry them. What we have tried 
to do is explain to them, because I think this is true, 
government access is a business risk. It is really what it is. 
I was with a group of chief security officers in France, and I 
knew some of them were running very old technology and were not 
current on their patching and hygiene. And they started talking 
to me about U.S. Government access if they put their data in 
our cloud. And I said, OK, so you have networks that are wide 
open and hackers can get in and steal all your stuff, but you 
are worried about putting it in my more secure cloud because 
the U.S. Government might get it. Who are you more worried 
about--hackers or the U.S. Government? What business are you 
in? I mean, if you are in the terrorism business, you should be 
worried about the U.S. Government. But it still does create 
friction in the system.
    Mr. Nojeim. After the Snowden disclosures, a number of U.S. 
companies said, ``We are not going to voluntarily turn over 
customer information to the National Security Agency (NSA).'' 
OK? Now along comes cybersecurity legislation, and some of the 
iterations of the legislation say it is all voluntary, 
companies will voluntarily share information; some of the 
information is going to be from their customers. So if a 
company is going to play by those rules, how can it promise 
that it is not going to share information with the NSA if the 
legislation says anything you share with a government agency 
for cybersecurity reasons must immediately be shared with all 
these other agencies, including the NSA?
    That was a problem in the CISA bill, the Senate bill that 
never came to the floor, that I do not think you want to 
repeat.
    Mr. Gordon. I come back to the nature of what we are 
sharing, which is attack and threat information, and the 
sharing of that information only enhances our security for our 
customers in the United States and around the world. That is 
how we think about it.
    Chairman Johnson. [presiding]. Thank you for holding down 
the fort there, Senator Booker.
    I do have a number of questions I would like to put forward 
until the next vote is called, and then we will wrap up the 
hearing. So, again, I just want to thank all of you for coming 
here and taking time and really preparing some very thoughtful 
testimony and, I thought, really good responses to questions.
    Mr. Nojeim, let me test my theory in terms of us all 
sharing the same goal. I think it is just true that if we do 
not get this under control, if we allow cyber attacks to 
continue, the threat in terms of loss of privacy really is even 
greater, correct?
    Mr. Nojeim. I think that if there was a major cyber attack 
like the scale of what triggered the attack on--it is the cyber 
equivalent of the attacks on the Twin Towers, that we would end 
up with a cyber PATRIOT Act.
    Chairman Johnson. So we share the same goal. Here in 
government we can pass a law that can help. It is not going to 
be a panacea. It is not going to solve all the problems. But I 
think if everybody on all sides of this issue, if we work 
together, focus on that goal, let us face it, another--I hate 
to single out instances, but another Target instance. Their 
privacy is just destroyed. So we do share that same goal of 
trying to get to a particular result.
    Mr. Nojeim. We do.
    Chairman Johnson. I want to ask all of you this. When you 
take a look at the White House proposal, what is coming out of 
the Senate Intelligence Committee, that is what we are going to 
be dealing with here in the Senate, either of those two 
proposals or some kind of combination.
    What is going to be the biggest threat in terms of us 
crossing the goal line with a piece of legislation? I will 
start with you, Mr. Nojeim.
    Mr. Nojeim. The biggest threat that you are trying to avoid 
or the biggest problem in the bill?
    Chairman Johnson. I would say the biggest problem in the 
bill as well as the outside interests in terms of attacking 
whatever is presented. In other words, what are the poison 
pills in some of these bills? What do we need to be worried 
about? What do we need to work on?
    Mr. Nojeim. Here is what I think you need to work on:
    First is ensuring that you properly define the information 
that can be shared and that you ensure that any irrelevant 
personally identifiable information is removed prior to the 
share.
    Second, make sure that whatever legislation, whatever rules 
govern the sharing of information within agencies of the 
government, that those procedures are clear and that they are 
strong and that they protect privacy.
    Third, I think you should prioritize company-to-company 
sharing--do more on that score. And I think also that you have 
to be mindful of the role that the intelligence agencies are 
going to play in the information-sharing scheme.
    I think you want to ensure civilian control, and the best 
way to do that is to ensure that the shares, the initial 
information shares, go from the private sector to DHS, and that 
DHS then applies privacy procedures to the data before any of 
it is reshared with any other agency.
    Chairman Johnson. OK. Well, thank you.
    Mr. Charney, I will give everybody a chance to answer that 
question, but we had an interesting conversation in terms of 
the necessity of sharing personal information in terms of what 
information we are talking about sharing. And you said there is 
no need whatsoever in terms of sharing personal information if 
we are just trying to prevent attacks. In other words, if we 
are sharing those threat signatures, no personal information is 
required. But if you want to go solve the crime, if you want to 
go find the bad actors, that is where you might need personal 
information. Is that correct?
    Mr. Charney. Yes, that is correct, and also just to be 
clear, sometimes an attack indicator is an IP address, like 
attacks are coming from this IP address, so we will go look at 
our network to see if that IP address is reaching out to us. 
And in some places, IP addresses alone are considered 
personally identifiable information.
    I think in the United States we more try to focus not on 
the IP address, but does it combine with other information to 
point to a person. And I think the way to solve this problem 
generally about using PII is to make sure that when the 
government wants to get personally identifiable information, it 
uses the transparent, judicial procedures already in place with 
which we are all familiar and balance the competing interests 
between government access to PII and privacy.
    Chairman Johnson. In other words, you go to the court 
system, you get a warrant in order to do that. Mr. Nojeim, does 
that----
    Mr. Gordon. There is----
    Chairman Johnson. I just want to ask Mr. Nojeim, does that 
comport with what you would be willing to do or agree to?
    Mr. Nojeim. You do not need a warrant for the IP addresses. 
It is a lesser process.
    Scott, I am not sure that it is going to work that way. At 
the end of the day, IP addresses are often needed to 
investigate a cyber attack to find out where it is coming from. 
Companies are going to want to do that. The private sector 
information-sharing entities that the White House envisions, I 
think they are going to get IP addresses that are relevant to 
the cyber attacks.
    Mr. Charney. They are going to get the IP address, and you 
can do an IP lookup and open source. But if we turn over 
information about an attack and the government says, OK, we now 
want to see account information and subscriber information, we 
require a judicial process. It may be a subpoena, it may be a 
2703(d) court order, or it may be a search warrant. My point is 
it reached a point where the government wants more, and we 
require a legal process to be followed so that our customers 
know we are protecting their privacy and not just giving away 
the data voluntarily.
    Mr. Nojeim. I agree.
    Chairman Johnson. Mr. Gordon.
    Mr. Gordon. I think there is an important subtlety with IP 
addresses because that does tend to be the place that this 
conversation converges, and an IP address in the context in 
which we see it is not a customer's IP address. It is not 
affiliated in any shape or form with a customer. When we see an 
IP address in the context of sharing, it is a place from which 
an attack is unfolding, or it is a place from which stolen data 
has been sent. That is all we know and, frankly, all in our 
context we care to know.
    And so sharing that would enable someone else to in turn 
block an attack from that same location without ever knowing 
who it is on the other end. I think the law enforcement 
attribution, that is where there are other dimensions to this, 
but I do not think it is a yes-no. I think there is a context 
to sharing. We would never share information related to our 
customers. This is information related to an attack.
    Chairman Johnson. Mr. Charney, real quick.
    Mr. Charney. Yes, that is true for you, and it is true for 
us. But if one of us was with a phone company or a cable 
provider that provided the Internet access and the government 
said here is the IP address, who is the customer, for them IP 
address is more than just an attack factor. It might be a 
customer's name and address.
    Mr. Gordon. Sure, but they would require a subpoena for 
that.
    Chairman Johnson. Now you almost start answering another 
question I had. Does the White House proposal contain adequate 
liability protection to induce the private sector to share with 
the government, to induce the private sector to share within 
the private sector? I think a number of you have testified that 
is really one of the primary information-sharing platforms we 
want.
    Mr. Gordon. From what I understand, it does not cover 
company-to-company sharing at all, so it will not incentivize 
that.
    Likewise, it does not cover, as I understand it, the acting 
from the sharing, even within your own network. And I think 
those appear to be two gaps.
    Chairman Johnson. So how important is the company-to-
company? And what level are we at right now? What level do we 
want to be at?
    Mr. Gordon. I think it is very important. I think there is 
a tremendous amount of company-to-company sharing that happens 
today, and this essentially would potentially incent us away 
from that and toward this more structured into the government 
sharing. And there are numerous instances that I have been 
involved in where we have information that pertains only to a 
single company, it is very specific. And so sharing that 
through some hub-and-spoke context I think would be 
inappropriate.
    Mr. Nojeim. To be fair to the White House proposal, it does 
allow for the sharing--you could call this private-to-private, 
right? You can share to a private hub, and then that hub can 
share out back to the private sector. It does not allow the 
company-to-company sharing. It does not incentivize the 
company-to-company sharing that we all think is necessary. But 
it does allow the sharing to the hub.
    The trick with the company-to-company sharing is to create 
a mechanism that ensures that the companies are playing by the 
information-sharing rules. So far, the mechanisms that have 
been discussed have all been rejected by the companies. They 
include things like creating a private right of action if the 
company does not play by the rules, and things like audits. 
They have all been rejected. So the question is: How do you 
ensure that the companies play by the rules? I do not think 
that we have gotten to that point yet, and I think that is why 
the White House went with this hub-and-spoke model.
    Chairman Johnson. Mr. Beshar, I am intrigued by the role 
that insurance can play and quite honestly, being a 
manufacturer, having been ISO certified, I can see a role that 
things like ISO certification can play, just simply private 
sector, here are the standards that can be created, that can be 
revised and updated very rapidly. Can you just kind of speak to 
that?
    Mr. Beshar. Sure. I think that is really the power of 
insurance, Mr. Chairman, that it can drive behavior change 
across large swaths of the people that is not driven by the 
government. It is just because there is a creation of the 
appropriate set of incentives that each one of these actors--
large companies, small, mid-sized companies, even individuals--
they take it upon themselves to say here are the steps that I 
can take to position myself as a better risk or I just think 
are prudent under the circumstances. So I think it has a 
tremendous power.
    I think the Administration's proposal has actually struck 
quite a nice compromise that there are clear liability 
protections from civil and criminal exposure. There is the idea 
that it will not be used, the information, for extraneous 
purposes by regulators, and it will not be subject to FOIA 
requests or similar State laws. But then at the same time, 
there is an obligation on the companies to try to take out and 
strip out the personally identifiable information. So I think 
that is the path to go down.
    Chairman Johnson. Mr. Bejtlich, can you kind of chime in on 
this? I was really struck by your testimony in terms of really 
what percentage of companies do not even know they have been 
hacked. So can you just speak to me in terms of where you think 
the hole is there?
    Mr. Bejtlich. Well, Senator, I think part of the problem is 
that many companies measure the wrong things. The example I 
like to use is you have a football team, and imagine if the way 
you determined how you were doing was to measure how tall all 
your players were, how fast they ran the 40, where they went to 
college, and then you took a look at them on paper and said, 
``Oh, that is how good we are,'' when really you need to find 
out how they play in a game. And that is where these metrics of 
how long has it been since someone broke in and to when you 
discovered it, and what steps can you take--technology 
diagnostic, process diagnostic, what are the steps you can take 
to reduce that count?
    I see this in the Federal Government. With the continuous 
diagnostic monitoring, all the emphasis is on make sure we are 
patched, make sure we are configured properly. That is all 
great, but that is hygiene. That does not tell you what the 
score is going to be when you get on the field and you 
encounter the adversary.
    Chairman Johnson. Let us continue going down the row here 
just in terms of looking at these proposals that are out there. 
What are going to be the impediments to putting something 
together and actually get it passed? I will start with you, 
again, Mr. Bejtlich.
    Mr. Bejtlich. Senator, one of the biggest issues I see is 
the deficit of trust in the security community. The security 
community up to the Snowden revelations, things were getting 
better. I mean, you had General Alexander appear at a hacker 
conference, DEF CON. There was real good will being built 
there. And then the Snowden revelations came out, and now we 
have this real trust deficit.
    I think one of the ways to perhaps address that would be to 
take a look at the Computer Fraud and Abuse Act. Some of the 
changes that have been proposed to that have really scared the 
security community into thinking that just being a researcher 
and trying to do the right thing and find vulnerabilities and 
report them so that they can be fixed could be a prosecutable 
event in and of itself.
    So maybe one of the ways to approach this is to pair 
reforming the CFAA so that it is friendlier to good hackers 
with this information sharing and try to address that trust 
deficit.
    Chairman Johnson. OK. Mr. Beshar.
    Mr. Beshar. I think the focus, Senator, should really be on 
information sharing and the rebuilding of trust between 
industry and government. Personally, I think the intercompany 
issues should be pushed somewhat to the side.
    Chairman Johnson. Mr. Charney.
    Mr. Charney. I agree that industry and government sharing 
is important. The other party I would think about is the 
customers, because the privacy concerns stem from the customers 
who want to entrust their information to third parties, and I 
think the discussion we have had today about how could we 
provide privacy protections for the data that is shared but 
ensure that the data could be used with less risk of liability 
is the right formulation.
    Chairman Johnson. Mr. Gordon.
    Mr. Gordon. I agree. I think that is the one issue that 
looms around this. Otherwise, I think there is, at least for 
the private sector, tremendous support for this. And I think 
the conversation about removing PII in the way that we share 
information is a very reasonable approach that really would 
solve this.
    Chairman Johnson. That is a real critical aspect of this. 
One thing we really have not talked too much about--unless it 
was asked when I was gone--is really breach notification. Can 
you just kind of speak to the necessity for that and what 
problems that creates for any organization that is going to be 
required to do so? We will start with you, Mr. Gordon.
    Mr. Gordon. I think that having a national breach 
notification standard is appropriate and would actually be 
helpful, and especially one that supersedes because, as you 
know, every State has a version of it and it is very 
complicated to navigate. I think it is appropriate and we 
should do it.
    Chairman Johnson. Is that the only level we are at right 
now, is just State? Have there been smaller jurisdictions that 
have offered any?
    Mr. Gordon. I am only aware of State at this point.
    Chairman Johnson. OK, Mr. Charney.
    Mr. Charney. I agree with that. The only other thing I 
would pay attention to is when breach notification has to be 
given. There have been some proposals, for example, that there 
should be a definitive timeline. But very often when you are 
investigating these cases, it takes awhile to figure out 
exactly what has happened and who has been breached, and you do 
not want to give out partial notifications. You want to 
understand the scope of the adversary's activity and whether he 
is still in. And once you start giving notification, you have 
told the adversary that you are on to them.
    So there should be some reasonable time to give breach 
notification, but a time fixed in stone, like 48 hours, is not 
flexible enough.
    Chairman Johnson. What would be a reasonable timeframe? 
And, again, that looks to me like any kind of timeframe is 
somewhat of a conundrum.
    Mr. Charney. It is a little bit of a conundrum, and it 
certainly should not be open ended. But in all sorts of places, 
the law requires reasonableness and a reasonable-man standard, 
so to speak. And the reality is these cases can be very 
complex, and it can take awhile to figure out exactly what 
happened and who should be notified. And what you do not want 
to end up is notifying too soon and actually compromising the 
investigation, and maybe even a law enforcement investigation.
    Chairman Johnson. I am assuming you are not going to give 
me a timeframe.
    Mr. Charney. I am not going to give you----
    Chairman Johnson. And that is actually reasonable. Mr. 
Beshar----
    Mr. Gordon. I would completely support that. I think 
putting any time against it is nonsensical, because every 
instance is different, and I think reasonable is the right 
standard.
    Mr. Beshar. We strongly support a uniform Federal breach 
notification standard, and our hope, Mr. Chairman, would be 
that it preempts the State regimes.
    Chairman Johnson. OK. Mr. Bejtlich.
    Mr. Bejtlich. Mr. Chairman, the one thing--I would concur 
with my colleagues, but the one caution I would add is that 
breach has to be properly defined. There are many low-level 
things that get caught, stopped, and so forth. If you had to 
somehow report on all of those, it would be a disaster.
    Chairman Johnson. Can you kind of typify some sort of 
level? We were talking about data breach. Now you are talking 
about when personal information is lost and people really need 
to understand that so they can either cancel your credit card 
or----
    Mr. Bejtlich. That is right. You would not want to define a 
breach as someone broke into a computer. You would want to 
define it as they stole PII, something that the person who is 
affected would not know otherwise and they need to----
    Chairman Johnson. Going back to your testimony, where 67 
percent of the businesses that you are potentially auditing do 
not even know they have been breached.
    Mr. Bejtlich. That is right.
    Chairman Johnson. So how do you account for that? Is it the 
point where they actually are aware of it? Is that when the 
data breach notification requirement would hit in? I mean, you 
also have to account for that as well, right?
    Mr. Bejtlich. Right. There needs to be some time--because 
you can receive a notification and it may not actually 
represent a real problem. I have been involved with some of 
those as well. You do need some time to identify yes, this 
notification does point to something real and--for example, if 
someone stole dummy data that was not actually real and the 
bureau noticed it, there is no problem there. It was dummy data 
for testing or whatever. But if you get the notification, you 
see this is real data, now I have to report.
    Chairman Johnson. Mr. Nojeim.
    Mr. Nojeim. So the biggest obstacle to passing information-
sharing legislation is failure to pass legislation to deal with 
the NSA's bulk collection program. I think you have to do that 
before you get to cybersecurity information sharing, because 
everybody knows that some of this information shared under the 
cybersecurity program is going to end up at the NSA. Unless you 
do something to reform NSA, I do not think you can do the cyber 
first.
    The biggest obstacle to the data breach notification 
legislation is the way, for example, the White House bill 
preempts State laws that protect data that the White House bill 
does not protect. So, for example, California protects health 
information, but the White House bill explicitly carves that 
protection out. But it would preempt that California protection 
anyway. I think that is a problem that needs to be fixed.
    Chairman Johnson. OK. We have the second vote called, so I 
am going to have to be closing this hearing. But I want to ask 
one more question because I want to go back to the data breach 
notification.
    When you are not even aware that you have been hacked and 
some of that information is already flowing, I mean, how do we 
address that to make sure that companies are not unfairly 
penalized?
    Mr. Beshar. I would just say, Mr. Chairman, it has to flow 
from discovery.
    Chairman Johnson. Discovery, OK. Very good. Well, again, I 
just want to thank all the witnesses for your, again, 
thoughtful testimony and answers to our questions.
    The hearing record will remain open for 15 days until 
February 12 at 5 p.m. for the submission of statements and 
questions for the record.
    This hearing is adjourned.
    [Whereupon, at 3:07 p.m., the Committee was adjourned.]

                            A P P E N D I X

                              ----------     
                              
                              
                              
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                 [all]
```