Before discussing the specifics of H.R. 4246, I would like to provide an overview of the risks of severe disruption facing our nation’s critical infrastructure and the steps being taking to address these risks. In particular, the explosive growth in computer interconnectivity over the past 10 years has significantly increased the risk that vulnerabilities exploited within one system will affect other connected systems. Massive computer networks now provide pathways among systems that if not properly secured, can be used to gain unauthorized access to data and operations from remote locations. While the threats or sources of these problems can include natural disasters, such as earthquakes, and system- induced problems, such as the Year 2000 (Y2K) date conversion problem, government officials are increasingly concerned about attacks from individuals and groups with malicious intentions, such as terrorists and nations engaging in information warfare. The resulting damage can vary, depending on the threat. Critical operations can be disrupted or otherwise sabotaged, sensitive data can be read and copied, and data or processes can be tampered with. A significant concern is that terrorists or hostile foreign states could launch computer-based attacks on critical systems, such as those supporting energy distribution, telecommunications, and financial services, to severely damage or disrupt our national defense or other operations, resulting in harm to the public welfare. Understanding these risks to our computer-based infrastructures and determining how best to mitigate them are major information security challenges. The federal government is beginning to take steps to address those challenges. In 1996, the President’s Commission on Critical Infrastructure Protection was established to investigate our nation’s vulnerability to both cyber and physical threats. In its October 1997 report, Critical Foundations:ProtectingAmerica’sInfrastructures,the Commission described the potential devastating implications of poor information security from a national perspective. In May 1998, Presidential Decision Directive 63 (PDD 63) was issued in response to this report and recognized that addressing computer-based risks to our nation’s critical infrastructures required a new approach that involves coordination and cooperation across federal agencies and among public- and private-sector entities and other nations. PDD 63 created several new entities for developing and implementing a strategy for critical infrastructure protection. In addition, it tasked federal agencies with developing critical infrastructure protection plans and establishing related links with private industry sectors. Since then, a variety of activities have been undertaken, including development and review of individual agency critical infrastructure protection plans, identification and evaluation of information security standards and best practices, and efforts to build communication links with the private sector. In January 2000, the White House released its NationalPlanfor InformationSystemsProtectionas a first major element of a more comprehensive effort to protect the nation’s information systems and critical assets from future attacks. This plan focuses largely on federal efforts being undertaken to protect the nation’s critical cyber-based infrastructures. Subsequent plans are to address a broader range of concerns, including the specific roles industry and state and local governments will play in protecting physical and cyber-based infrastructures from deliberate attacks as well as international aspects of critical infrastructure protection. The end goal of this process is to develop a comprehensive national strategy for critical infrastructure assurance, as envisioned by PDD 63, and to have this plan fully operational in 2003. The plan proposes achieving its twin goals of making the U.S. government a model of information security and developing public-private partnerships to defend our national infrastructure through 10 programs listed in figure 1. The program involving sharing attack warning and information specifically seeks to bolster information exchange efforts with the private sector. In particular, the program aims to establish a Partnership for Critical Infrastructure Security and a National Infrastructure Assurance Council to increase corporate and government communications about shared threats to critical information systems. It also encourages the creation of Information Sharing and Analysis Centers (ISAC) to facilitate public- private sector information sharing about actual threats and vulnerabilities in individual infrastructure sectors. Two ISACs are already in operation: (1) the Financial Services ISAC, which exclusively serves the banking, securities, and insurance industries, and (2) the National Coordinating Center for Telecommunications, which is a joint industry/government organization. Several more ISACs are expected to be established by the end of the year. Partnerships such as the ISACs are central to addressing critical infrastructure protection. However, some in the private sector have expressed concerns about voluntarily sharing information with the government. For example, concerns have been raised that industry could potentially face antitrust violations for sharing information with other industry partners, have their information be subject to the Freedom of Information Act (FOIA), or face potential liability concerns for information shared in good faith. H.R. 4246 was introduced on April 12, 2000, with the aim of addressing these concerns and encouraging the secure disclosure and exchange of information about cyber security problems and solutions. In many respects, the bill is modeled after the Year 2000 Information and Readiness Disclosure Act, which provided limited exemptions and protections for the private sector in order to facilitate the sharing on information on Y2K readiness. In particular, H.R. 4246: protects information being provided by the private sector from disclosure by federal entities under FOIA or disclosure to or by any third party, prohibits the use of the information by any federal and state organization or any third party in any civil actions, and enables the President to establish and terminate working groups composed of federal employees for the purposes of engaging outside organizations in discuss to address and share information about cyber security. In essence, the bill seeks to enable the federal government to ask industry questions about events or incidents threatening critical infrastructures, correlate them at a national level in order to build a baseline understanding of infrastructures, and use these baselines to identify anomalies and attacks—something it is not doing now. Addressing similar concerns proved valuable in addressing the Y2K problem. Although Y2K was a unique and finite challenge, it parallels the critical infrastructure challenge in some important respects. Like critical infrastructure protection, for instance, Y2K spanned the entire spectrum of our national, as well as the global, economy. Moreover, given the scores of interdependencies among private sector companies, state and local governments, and the federal government, a single failure in one system could have repercussions on an array of public and private enterprises. As a result, public/private information sharing was absolutely essential to ensuring compliance in supply chain relationships and reducing the amount of Y2K work. Early on, Y2K information bottlenecks were widespread in the private sector. According to the President’s Council on Year 2000 Conversion,antitrust issues and a natural tendency to compete for advantage made working together on Y2K difficult, if not inconceivable, for many companies. Moreover, the threat of lawsuits had companies worried that they would be held liable for anything they said about the Y2K compliance of products or devices they used or test processes and results for them. Legal considerations also prevented companies from saying anything about their own readiness for date change. Thus, as noted by the council, their business partners, as well as the general public, may have assumed the worst. According to the council, the Year 2000 Information and Readiness Disclosure Act paved the way for more disclosures about Y2K readiness and experiences with individual products and fixes. Several major telecommunications companies, for example, indicated their willingness to share Y2K information with smaller companies who contacted them. And the leaders of the electric power industry began a series of regional conferences for local distribution companies in which they discussed identified problems and solutions, particularly with embedded chips, as well as testing protocols and contingency planning. Moreover, the act helped facilitate the work of the more than 25 sector- based working groups established by the council and other outreach activities. For example, the council and federal agencies were able to establish partnerships with several private-sector organizations, such as the North American Electric Reliability Council, to gather information critical to the nation’s Y2K efforts and to address issues such as contingency planning. Concerned about the lack of information in some key industry areas, the council also convened a series of roundtable meetings in the spring and summer of 1999, which helped to shed light on the status of readiness efforts relating to pharmaceuticals, food, hospital supplies, transit, public safety, the Internet, education, and chemicals. The assessment reports resulting from these and other activities substantially increased the nation’s understanding of the Y2K readiness of key industries. Removing barriers to information sharing between government and industry can similarly enhance critical infrastructure protection. Both government and industry are key components of the infrastructure, both are potential targets for cyber threats, and both face significant gaps in effectively dealing with the threats. As such, both must work together to identify threats and vulnerabilities and to develop response strategies. In particular, by combining information concerning the type of incidents and attacks experienced with the information obtained through federal intelligence and law enforcement sources, the government can develop and share more informative warnings and advisories. In turn, companies can develop a better understanding of the threats facing their particular infrastructures and be better prepared to take appropriate actions to protect their sectors. By addressing private sector concerns about sharing information, H.R. 4246 could have a positive effect similar to the one the Year 2000 Information and Readiness Disclosure Act had in resolving the Y2K problem. At the same time, there are two formidable challenges to making this legislation a success. First, while information sharing is important, the government needs to be sure that it is collecting the right type of information, that it can effectively synthesize and analyze it, and that it can appropriately share its analysis. A significant amount of work still needs to be done just in terms of ensuring that the right type of information is collected. For example, what information is required that will enable the government to detect a nationally significant cyber attack? Will information on intrusions, software anomalies, or reports of significant system failures provide an accurate baseline for making these determinations? Today, officials in the intelligence community do not know with real certainty what constitutes a cyber attack.