Dramatic increases in computer interconnectivity, especially in the use of the Internet, are revolutionizing the way our government, our nation, and much of the world communicate and conduct business. The benefits have been enormous. Vast amounts of information are now literally at our fingertips, facilitating research on virtually every topic imaginable; financial and other business transactions can be executed almost instantaneously, often 24 hours a day; and electronic mail, Internet web sites, and computer bulletin boards allow us to communicate quickly and easily with virtually an unlimited number of individuals and groups. In addition to such benefits, however, this widespread interconnectivity poses significant risks to our computer systems and, more important, to the critical operations and infrastructures they support. For example, telecommunications, power distribution, public health, national defense (including the military’s warfighting capability), law enforcement, government, and emergency services all depend on the security of their computer operations. Likewise, the speed and accessibility that create the enormous benefits of the computer age, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with these operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. Reports of attacks and disruptions are growing. The number of computer security incidents reported to the CERT® Coordination Center rose from 9,859 in 1999 to 21,756 in 2000 and 34,754 for just the first 9 months of 2001.And these are only the reported attacks. The CERT® Coordination Center estimates that as much as 80 percent of actual security incidents go unreported, in most cases because the organization was unable to recognize that its systems had been penetrated or because there were no indications of penetration or attack. As the number of individuals with computer skills has increased, more intrusion or “hacking” tools have become readily available and relatively easy to use. A potential hacker can literally download tools from the Internet and “point and click” to start a hack. According to a recent National Institute of Standards and Technology (NIST) publication, hackers post 30 to 40 new tools to hacking sites on the Internet every month. Experts also agree that there has been a steady advance in the sophistication and effectiveness of attack technology. Intruders quickly develop attacks to exploit vulnerabilities discovered in products, use these attacks to compromise computers, and share them with other attackers. In addition, they can combine these attacks with other forms of technology to develop programs that automatically scan the network for vulnerable systems, attack them, compromise them, and use them to spread the attack even further. Attacks over the past several months illustrate the risks. As we reported to this Subcommittee in August 2001, the attacks referred to as Code Red, Code Red II, and SirCam have affected millions of computer users, shut down web sites, slowed Internet service, and disrupted business and government operations, and have reportedly caused billions of dollars in damage. More recently, the Nimda worm appeared using some of the most significant attack profile aspects of Code Red II and 1999’s infamous Melissa virus, allowing it to spread widely in a short amount of time. As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. Government officials have long been concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence gathering, and acts of war. According to the Federal Bureau of Investigation (FBI), terrorists, transnational criminals, and intelligence services are quickly becoming aware of and using information exploitation tools such as computer viruses, worms, Trojan horses, logic bombs, and eavesdropping sniffers that can destroy, intercept, or degrade the integrity of and deny access to data. In addition, the disgruntled organization insider is a significant threat, since such individuals with little knowledge about computer intrusions often have knowledge that allows them to gain unrestricted access and inflict damage or steal assets. Examples of such attacks already exist: In October 2000, the FBI’s National Infrastructure Protection Center (NIPC) issued an advisory concerning an increased level of cyber activity against web sites related to Israel and pro-Palestinian organizations. This advisory noted that due to the credible threat of terrorist acts in the Middle East region, and the conduct of these web attacks, increased vigilance should be exercised to the possibility that U.S.-government and private- sector web sites may become potential targets. In less than a month, a group of hackers calling itself Gforce Pakistan defaced more than 20 web sites and posted threats to launch an Internet attack against AT&T. Further, in October 2001, this same group attacked a government web server operated by the National Oceanic and Atmospheric Administration, defacing a web site and threatening to release some highly confidential data unless the United States met several demands. According to recent Defense Intelligence Agency and Central Intelligence Agency estimates, at least 20 countries are known to be developing information warfare strategies that specifically target U.S. military and private-sector data networks. The fear is that computer viruses and worms unleashed by foreign hackers could wreak havoc on the U.S. infrastructure in the event of a military conflict. In his April 2001 written statement for the House Energy and Commerce Committee on intrusions into government computer networks, the director of the NIPC noted that terrorist groups are increasingly using new information technology and the Internet to formulate plans, raise funds, spread propaganda, and communicate securely. Citing the example of convicted terrorist Ramzi Yousef, who masterminded the 1993 World Trade Center bombing and stored detailed plans to destroy U.S. airliners in encrypted files on his laptop computer, the director concluded that while we have not yet seen terrorist groups employ cyber tools as a weapon against critical infrastructures, the reliance of these groups on information technology and acquisition of computer expertise are clear warning signs. After the September 11, 2001, attacks, the NIPC warned of an expected upswing in incidents and encouraged system administrators to follow best practices to limit the potential damage from any cyber attacks. In particular, it warned that political events and international situations would likely lead to increasing cyber protests and that such attacks were expected to now target the information infrastructure more often and exploit opportunities to disrupt or damage it. On November 2, the NIPC updated its warning, noting that hacking groups have formed and participated in pro-U.S. and anti-U.S. cyber activities, which have mainly taken the form of web defacements. The NIPC went on to say that while there has been minimal activity in the form of denial-of-service attacks, it has reason to believe that the potential for such attacks in the future is high and that infrastructure support systems must take a defensive posture and remain at a higher state of alert. Finally, while the warning of a potential “digital Pearl Harbor” has been raised in the past, the events of September 11, 2001, further underscored the need to protect America’s cyberspace against potentially disastrous cyber attacks. In his September 2001 testimony before this Subcommittee on cyber attacks, the former NIPC director warned that a cyber attack by terrorists or nation-states using multiple-attack scenarios could have disastrous effects on infrastructure systems and could also be coordinated to coincide with physical terrorist attacks to maximize the impact of both. Further, in his October congressional testimony, Governor James Gilmore, Governor of the Commonwealth of Virginia and Chairman of the Advisory Panel to Assess Domestic Response Capabilities for Terrorism Involving Weapons of Mass Destruction (commonly known as the “Gilmore Commission”), cautioned that our critical information and communication infrastructures are targets for terrorists because of the broad economic and operational consequences of a shutdown. He warned that systems and services critical to the American economy and the health of our citizens— such as banking and finance, “just-in-time” delivery system for goods, hospitals, and state and local emergency services—can all be shut down or severely handicapped by a cyber attack or a physical attack against computer hardware. Since September 1996, we have reported that poor information security is a widespread federal problem with potentially devastating consequences.Our analyses of information security at major federal agencies have shown that federal systems were not being adequately protected from computer- based threats, even though these systems process, store, and transmit enormous amounts of sensitive data and are indispensable to many federal agency operations. In addition, in both 1998 and in 2000, we analyzed audit results for 24 of the largest federal agencies and found that all 24 agencies had significant information security weaknesses. As a result of these analyses, we have identified information security as a governmentwide high- risk issue in reports to the Congress since 1997—most recently in January 2001. Our most recent analyses, of reports published from July 2000 through September 2001, continue to show significant weaknesses in federal computer systems that put critical operations and assets at risk.Weaknesses continued to be reported in each of the 24 agencies included in our review, and they covered all six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation. These six areas are (1) security program management, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented; (2) access controls, which ensure that only authorized individuals can read, alter, or delete data; (3) software development and change controls, which ensure that only authorized software programs are implemented; (4) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (5) operating systems controls, which protect sensitive programs that support multiple applications from tampering and misuse; and (6) service continuity, which ensures that computer-dependent operations experience no significant disruptions.