Date: 2012-04-27
Speaker: JACKSON LEE (democrat)
Chamber: H
State: Texas

Mr. Speaker. I rise today in support of H.R. 2096. the "Cybersecurity Enhancement Act." The bill would reauthorize several National Science Foundation (NSF) programs that aim to enhance cybersecurity. In addition. it would require the National Institute of Standards and Technology (NIST) to continue a cybersecurity awareness program and to develop standards for managing personal identifying information stored on computer systems. Further. it would establish a task force which would recommend actions to improve our Nations cybersecurity. Cyberspace can easily be considered the nervous systemthe control system of our country. Cyberspace is composed of hundreds of thousands of interconnected computers. servers. routers. switches. and fiber optic cables that allow our critical infrastructures to work. Thus. the healthy functioning of cyberspace is essential to our economy and our national security. This issue is not new to me nor to any other Member of Congress. As a senior Member of the Judiciary Committee I have faced the problems which arise when there are breaches and how best to protect our system in both the Crime and Intellectual Property Subcommittees. As a senior Member of the Homeland Security Committee. I am deeply concerned about vulnerabilities in our cyber security protection. For the last few years. threats originating in cyberspace have risen dramatically. The policy of the United States has been to protect against the debilitating disruption of the operation of information systems for critical infrastructures and. thereby. help to protect the people. economy. and national security of the United States. I realize that we must act in advance to reduce all of our vulnerabilities to these types of threats. in order to prevent any damage to the cyber systems supporting our Nations critical infrastructures. According to the Government Accountability Office (GAO) the threat posed by cyber attacks is heightened by vulnerabilities in federal systems and systems supporting critical infrastructure. Specifically. significant weaknesses in information security controls continue to threaten the confidentiality. integrity. and availability of critical information and information systems supporting the operations. assets. and personnel of Federal Government agencies. For example. 18 of 24 major Federal agencies have reported inadequate information security controls for financial reporting for fiscal year 2011. and inspectors general at 22 of these agencies identified information security as a major management challenge for their agency. Moreover. GAO. agency. and inspector general assessments of information security controls during fiscal year 2011 revealed that most major agencies had weaknesses in most major categories of information system controls. These and similar weaknesses can be exploited by threat actors. with potentially severe effects. In addition. the number of cybersecurity incidents reported by Federal agencies continues to rise. and recent incidents illustrate that these pose serious risk. Over the past 6 years. the number of incidents reported by Federal agencies to the Federal information security incident center has increased by nearly 680 percent. These incidents include unauthorized access to systems. improper use of computing resources. and the installation of malicious software. among others. Reported attacks and unintentional incidents involving Federal. private. and infrastructure systems demonstrate that the impact of a serious attack could be significant. including loss of personal or sensitive information. disruption or destruction of critical infrastructure. and damage to national and economic security. Federal agencies are facing a set of emerging cybersecurity threats that are the result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Examples of these threats include spam (unsolicited commercial email). phishing (fraudulent messages to obtain personal or sensitive data). and spyware (software that monitors user activity without user knowledge or consent). Cyber attacks are analogous to guerilla warfare. Attribution of an attack to a specific source or entity is a significant challenge in cyberspace because the Internet was built on an open. anonymous platform. This architecture permits the original source of an attack to be easily masked. While an attack may be traced to a specific country. this does not necessarily mean that the government of that country is behind the attacks. Moreover. because of the near universal access to the Internet. disruptive activity can come from individual actors located in any corner of the globe. In February 2009. the Director of National Intelligence testified that foreign nations and criminals have targeted government and private sector networks to gain a competitive advantage and potentially disrupt or destroy them. and that terrorist groups have expressed a desire to use cyberattacks as a means to target the United States. The Federal Bureau of Investigation has identified multiple sources of threats to our Nations critical information systems. including foreign nations engaged in espionage and information warfare. domestic criminals. hackers. virus writers. and disgruntled employees and contractors working within an organization. For these reasons and more. I support this bipartisan legislation. We must continue to support the research and development of technology that will help to combat threats to our cybersecurity. It is also essential to train and develop the professionals who are able to continue with the implementation of countermeasures and are the future of R&D.