[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]
THE DHS INFRASTRUCTURE PROTECTION
DIVISION; PUBLIC-PRIVATE PARTNERSHIPS TO
SECURE CRITICAL INFRASTRUCTURES
=======================================================================
HEARING
before the
SUBCOMMITTEE ON INFRASTRUCTURE
AND BORDER SECURITY, AND
SUBCOMMITTEE ON CYBERSECURITY,
SCIENCE AND RESEARCH AND DEVELOPMENT
of the
SELECT COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED EIGHTH CONGRESS
SECOND SESSION
__________
APRIL 21, 2004
__________
Serial No. 108-45
__________
Printed for the use of the Select Committee on Homeland Security
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
23-278 WASHINGTON : 2005
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�0900012005
SELECT COMMITTEE ON HOMELAND SECURITY
Christopher Cox, California, Chairman
Jennifer Dunn, Washington Jim Turner, Texas, Ranking Member
C.W. Bill Young, Florida Bennie G. Thompson, MississPpi
Don Young, Alaska Loretta Sanchez, California
F. James Sensenbrenner, Jr., Edward J. Markey, Massachusetts
Wisconsin Norman D. Dicks, Washington
W.J. (Billy) Tauzin, Louisiana Barney Frank, Massachusetts
David Dreier, California Jane Harman, California
Duncan Hunter, California Benjamin L. Cardin, Maryland
Harold Rogers, Kentucky Louise McIntosh Slaughter, New
Sherwood Boehlert, New York York
Lamar S. Smith, Texas Peter A. DeFazio, Oregon
Curt Weldon, Pennsylvania Nita M. Lowey, New York
Christopher Shays, Connecticut Robert E. Andrews, New Jersey
Porter J. Goss, Florida Eleanor Holmes Norton, District of
Dave Camp, Michigan Columbia
Lincoln Diaz-Balart, Florida Zoe Lofgren, California
Bob Goodlatte, Virginia Karen McCarthy, Missouri
Ernest J. Istook, Jr., Oklahoma Sheila Jackson-Lee, Texas
Peter T. King, New York Bill Pascrell, Jr., North Carolina
John Linder, Georgia Donna M. Christensen, U.S. Virgin
John B. Shadegg, Arizona Islands
Mark E. Souder, Indiana Bob Etheridge, North Carolina
Mac Thornberry, Texas Ken Lucas, Kentucky
Jim Gibbons, Nevada James R. Langevin, Rhode Island
Kay Granger, Texas Kendrick B. Meek, Florida
Pete Sessions, Texas Ben Chandler, Kentucky
John E. Sweeney, New York
John Gannon, Chief of Staff
Stephen DeVine, Deputy Staff Director and General Counsel
ThomasDilenge, Chief Counsel and Policy Director
David H. Schanzer, Democrat Staff Director
Mark T. Magee, Democrat Deputy Staff Director
Michael S. Twinchek, Chief Clerk
______
Subcommittee on Infrastructure and Border Security
Dave Camp, Michigan, Chairman
Kay Granger, Texas, Vice Chairwoman Loretta Sanchez, California
Jennifer Dunn, Washington Edward J. Markey, Massachusetts
Don Young, Alaska Norman D. Dicks, Washington
Duncan Hunter, California Barney Frank, Massachusetts
Lamar Smith, Texas Benjamin L. Cardin, Maryland
Lincoln Diaz-Balart, Florida Louise McIntosh Slaughter, New
Robert W. Goodlatte, Virginia York
Ernest Istook, Oklahoma Peter A. DeFazio, Oregon
John Shadegg, Arizona Sheila Jackson-Lee, Texas
Mark Souder, Indiana Bill Pascrell, Jr., New Jersey
John Sweeney, New York Kendrick B. Meek, Florida
Christopher Cox, California, ex Jim Turner, Texas, ex officio
officio
(II)
?
Subcommittee on Cybersecurity, Science, and Research & Development
Mac Thornberry, Texas, Chairman
Pete Sessions, Texas, Vice Chairman Zoe Lofgren, California
Sherwood Boehlert, New York Loretta Sanchez, California
Lamar Smith, Texas Robert E. Andrews, New Jersey
Curt Weldon, Pennsylvania Sheila Jackson-Lee, Texas
Dave Camp, Michigan Donna M. Christensen, U.S. Virgin
Robert W. Goodlatte, Virginia Islands
Peter King, New York Bob Etheridge, North Carolina
John Linder, Georgia Ken Lucas, Kentucky
Mark Souder, Indiana James R. Langevin, Rhode Island
Jim Gibbons, Nevada Kendrick B. Meek, Florida
Kay Granger, Texas Ben Chandler, Kentucky
Christopher Cox, California, ex Jim Turner, Texas, ex officio
officio
(III)
C O N T E N T S
----------
Page
STATEMENTS
The Honorable Christopher Cox, a Representative in Congress From
the State of California, and Chairman, Select Committee on
Homeland Security
Oral Statement................................................. 28
Prepared Statement............................................. 1
The Honorable Jim Turner, a Representative in Congress From the
State of Texas, Ranking Member, Select Committee on Homeland
Security....................................................... 32
The Honorable Mac Thornberry, a Representative in Congress From
the State of Texas, and Chairman, Subcommittee on
Cybersecurity, Science, and Research and Development........... 1
The Honorable Zoe Lofgren, a Representative in Congress From the
State of California, and Ranking Member, Subcommittee on
Cybersecurity, Science, and Research and Development........... 23
The Honorable Dave Camp, a Representative in Congress From the
State of Michigan, a Chairman, Subcommittee on Infrastructure
and Border Security............................................ 21
The Honorable Loretta Sanchez, a Representative in Congress From
the State of California, and Ranking Member, Subcommittee on
Infrastructure and Border Security............................. 25
The Honorable Benjamin L. Cardin, a Representative in Congress
From the State of Maryland..................................... 40
The Honorable Ben Chandler, a Representative in Congress From the
State of Kentucky.............................................. 39
The Honorable Donna M. Christensen, a Delegate in Congress From
the U.S. Virgin Islands........................................ 37
The Honorable Norman D. Dicks, a Representative in Congress From
the State of Washington........................................ 42
The Honorable Bob Etheridge, a Representative in Congress From
the State of North Carolina.................................... 35
The Honorable Sheila Jackson-Lee, a Representative in Congress
From the State of Texas
Oral Statement................................................. 45
Prepared Statement............................................. 2
WITNESSES
PANEL I
Mr. Robert Liscouski, Assistant Secretary for Infrastructure
Protection, Department of Homeland Security
Oral Statement................................................. 3
Prepared Statement............................................. 6
Mr. George C. Newstrom, Secretary of Technology, Commonwealth of
Virginia
Oral Statement................................................. 13
Prepared Statement............................................. 16
PANEL II
Mr. Robert Dacey, Director Information Security Issues, General
Accounting Office
Oral Statement................................................. 48
Prepared Statement............................................. 50
Ms. Diane VanDe Hei, Vice Chair, Information Sharing and Analysis
Center Council
Oral Statement................................................. 80
Prepared Statement............................................. 82
The Honorable Dave McCurdy, Executive Director, Internet Security
Alliance
Oral Statement................................................. 72
Prepared Statement............................................. 74
THE DHS INFRASTRUCTURE PROTECTION DIVISION; PUBLIC-PRIVATE PARTNERSHIPS
TO SECURE CRITICAL INFRASTRUCTURES
----------
Wednesday, April 21, 2004
House of Representatives,
Subcommittees on Infrastructure
and Border Security,
and
Subcommittee on Cybersecurity, Science and Research
and Development,
Select Committee on Homeland Security,
Washington, DC.
The subcommittees met, pursuant to call, at 10:34 a.m., in
Room 2212, Rayburn House Office Building, Hon. Mac THornberry
chairman of the Cybersecurity subcommittee] presiding.
Present: Representatives Thornberry, Camp, Cox, Lofgren,
Sanchez, Dicks, Cardin, Jackson-Lee, Christensen, Etheridge,
Lucas, Chandler and Turner.
Mr. Thornberry. [Presiding.] This hearing will come to
order. I appreciate the witnesses and the members who are here.
There are obviously several substantial hearings going on at
the same time. I know our witnesses will understand as people
come and go. As you know, this is a joint hearing between the
Subcommittee on Cybersecurity, Science and Research and
Development, and the Subcommittee on Infrastructure and Border
Security. Chairman Camp and I will be sharing the gavel.
Since we have two panels and two subcommittees today, I ask
unanimous consent that all members submit opening statements
for the record so that we can move ahead. Without objection, it
is so ordered. I would also request our witnesses to work with
us on that. I think we are going to have votes come at about
12:30 or 1:00. If you could work with us on summarizing your
statements, then I would appreciate it. Without objection your
full written statements will be made a part of the record.
Prepared Statement of the Honorable Christopher Cox, a Representative
in Congress, From the State of California, and Chairman, Select
Committee on Homeland Security
Thank you Chairman Camp and Chairman Thornberry for holding this
important hearing. I join you in welcoming our witnesses today, who
will help us explore the Department's relationship with various
critical infrastructure sectors.
I want to take this opportunity to commend Secretary Ridge, Under
Secretary Libutti, Assistant Secretary Liscouski, and the men and women
of the Information Analysis and Infrastructure Protection (IAIP)
Directorate for their dedication and accomplishments in this critical
area. They have had to build this Directorate from scratch, while
facing both enormous expectations in a time of heightened alert and
unrelenting scrutiny. IAIP gets a lot of attention because it is truly
the nerve center of the great, new Department. IAIP is at the heart of
the Department's core mission to prevent terrorism and protect the
infrastructure that is vital to the security and economic well-being of
our Nation.
The Homeland Security Act of 2002 requires IAIP to integrate
information from various public and private sources to form a
comprehensive picture of the terrorist threats we face, and to map this
assessment against the vulnerabilities of our critical infrastructure
to produce a prioritized and risk-based plan for securing our homeland.
This is not a one-time task, but a continuous responsibility, in a
dynamic and constantly changing environment. We have no choice but to
continue to press IAIP to build the analytic capabilities necessary to
carry out its mandate under the Homeland Security Act. Risk-based
assessments produced by IAIP must guide both the Department's overall
homeland security strategy and the allocation of resources to priority
areas.
The President has exerted strong leadership in the effort to secure
our critical infrastructure. He has issued a national strategy, as well
as a Homeland Security Presidential Directive (HSPD-7). To secure our
critical infrastructure both documents envision a strong, sustained
public-private partnership. Eighty-five percent of our critical
infrastructure is owned by the private sector, and it is appropriate
that the private sector take a lead role in protecting these assets,
with assistance--including the provision of actionable threat-based
information--and oversight by the Federal government.
The President's fiscal year 2005 budget request includes $51.6
million for IAIP's ``outreach and partnership'' program, a 27-percent
increase over the previous year. This increase is a strong indication
of his commitment to enhancing the public-private partnership to
protect critical infrastructure. Among other things, this program is
intended to develop and coordinate strategic relationships between
public and private entities for national planning, outreach and
awareness, information sharing, and protective actions.
One key manifestation of the public-private partnership envisioned
by the Homeland Security Act is the continued operation of--and in some
cases, the creation of new--Information Sharing and Analysis Centers
(ISAC) for critical infrastructure sectors. Part of this hearing will
focus on obtaining information from the General Accounting Office on
its soon-to-be-completed review of the ISAC model, and exploring how
this model can be enhanced.
As we continue to work with DHS to enhance the public-private
partnership, we must resist efforts to make DHS the regulator of more
and more sectors of our economy. The Homeland Security Act clearly bars
any such role for DHS, and we should alter that formula only with great
caution. I see no reason to do so now or for the foreseeable future.
Mr. Chairmen, we share the bold vision of a safer America laid out
in the Homeland Security Act, the national strategies, and HSPD-7. We
are prepared to provide rigorous constructive oversight of critical
infrastructure protection activities and to act as full partners with
the Department, other government entities, and the private sector in
helping realize that vision.
Thank you, Mr. Chairmen, and I yield back the balance of my time.
Prepared Opening Statement of the Honorable Sheila Jackson-Lee, a
Representative in Congress From the State of Texas
Mr. Chairman, Thank you for convening this hearing on a subject
that is extraordinarily important to the safety of the American public.
I would like to welcome Assistant Secretary Liscouski back, as well as
this distinguished panel. It seems that indeed the Department of
Homeland Security is making progress in this area--putting people and
facilities in place to protect our nation's critical infrastructure.
However, a chain is only as strong as its weakest link. For
example, say I have a dozen chemical plants in my District in Houston.
If we spend billions of dollars and five years and make 11 of them
absolutely invulnerable, but we leave just one looking like the ones we
all saw on 60 minutes last fall, with unlocked gates, absent guards,
and unprotected tanks of deadly gas--what have we accomplished? A
would-be terrorist wanting to attack Houston would just have to spend
an extra day plotting his attack--going through the phone book and
driving by each chemical plant listed. It is essential that that we
plug ALL of the holes. We need to know where our vulnerabilities are,
and develop a comprehensive system to address those vulnerabilities.
That is why many of us have been standing behind the Ranking Member
of this Committee, urging the DHS to complete a thorough risk
assessment of our nation's critical infrastructure. That is why we need
to have clear performance metrics for critical infrastructure
protection. That is why we need seamless communication between federal
and state governments and the private sector. To get those things done,
we will need a fully staffed and functioning Office of Infrastructure
Protection. Until then, we are all at risk.
Today we should hear the progress being made within DHS and in
their work in the field. Do they have the funds, the expertise, and the
authority they need to get the job done? Is those in the private sector
willing partners? It will also be important to hear whether
stakeholders outside the DHS are getting the guidance they need.
I look forward to the discussion, and to working together we these
two subcommittees to ensure that we keep pushing the process forward.
So with that, let me turn directly to our witnesses. On our
first panel, we have two distinguished witnesses. The first is
Mr. Robert Liscouski, the Assistant Secretary for
Infrastructure Protection from the Department of Homeland
Security. He has been with us a number of times before.
Secretary Liscouski, thank you for being here. You are
recognized for a summary of your opening statement.
STATEMENT OF THE HONORABLE ROBERT LISCOUSKI, ASSISTANT
SECRETARY, INFRASTRUCTURE PROTECTION, DEPARTMENT OF HOMELAND
SECURITY
Mr. Liscouski. Mr. Chairman, thank you for the opportunity
this morning. It is always a pleasure to appear before your
committees. I thank you again for your recognition of the
importance of this topic. I do have an oral statement, but I
will try to go through this as quickly as I can in recognition
of our time constraints.
Since the inception of DHS, we have been working very
strongly to develop partnerships with the private sector. We
have made significant progress in evaluating and securing our
greatest vulnerabilities. In order for this public and private
partnership effort to succeed, we recognize that we have to
increase our efforts at information sharing. To this end, we
are making very good progress. Some would call it exceptional
progress in expanding our information-sharing capabilities with
respect to all types of information that must be shared,
including vulnerability information, exploits, threats,
incidents and best practices, as well as early warnings.
Our critical infrastructure sectors are very diverse, as
you well know. Consequently, the level of collaboration and
coordination with the Federal Government and each other within
the context of the private sector varies widely between the
sectors. We recognize these differences, and IAIP has developed
a very facilitative process to work in partnership with the
Federal sector-specific agencies as defined in HSPD-7, and to
help sectors organize themselves as inclusively as possible to
identify or construct the sector leadership entity for critical
infrastructure protection.
At the operational level, IAIP works daily on a periodic
and situational basis with ISACs, sharing information on
threats and developing suggested protective measures and alerts
and warnings. As you know, there are currently 14 ISACs
spanning most of the HSPD-7 critical infrastructures. The ISACs
serve as our gateway between DHS and the industry for tooling
information sharing and provide the industry with information
as an information clearinghouse for each sector.
Through up-to-date distribution lists maintained by the
ISACs, DHS is able to quickly disseminate threat warnings to
identify entities within each sector. To a lesser degree,
however, ISACs and their members provide DHS with incident and
suspicious activity. This has become very much more of a robust
information-sharing capability. This information holds for us
the potential for completing the situational awareness picture,
together with the intelligence community and law enforcement,
which is vital for us to understand the threats that we are
facing.
My organization is responsible for maintaining and
enhancing those relationships with the private sector through
the ISACs and through other efforts. Our staff actively
participates in ISAC-related advisory groups, committees, task
forces and working groups to maintain day-to-day contact with
those ISACs.
In protecting our country, we need to address the
protection from a holistic perspective, not one which is
artificially divided between a physical and a cyber-world. On
January 28 of this year, the Department of Homeland Security,
through the US-CERT, unveiled our national cyber security alert
system, which is an operational system to develop and deliver
targeted, timely and actionable information to Americans to
secure their computer systems. We strive to make sure that the
information provided is both understandable to all computer
users, technical and non-technical alike, and reflects the
broad usage of the Internet in today's society.
Our national strategy for cyber-security acknowledged one
of the most important constituencies is the private sector. It
is estimated that 85 percent of our critical infrastructure is,
of course, owned and operated by the private sector, and the
technology developed by the technology industry continues to
fuel the growth and the evolution of the Internet, as well as
obviously being ridiculously embedded in our business
processes. In December 2003, the National Cyber Security
Division co-hosted our first national cyber security summit,
which allowed the Department to work side by side with leaders
from industry to address key cyber-security issues facing the
nation.
Other partnership efforts with the private sector include
our National Cyber Security Alliance and Stay Safe Online,
which is a public-private organization created to educate home
users and small businesses on cyber security best practices.
Let me just take a moment to talk about the ISACs. The
ISACs have emerged over the last several years as the primary
conduit for critical information sharing between the Federal
government and our infrastructures and key resources throughout
the industries. The ISACs continue to evolve, although they
began with a focus on cyber back in the PDD-63 days. They now
include physical vulnerabilities as well. This emphasis has
really been gaining momentum since September 11. This just
demonstrates the recognition that the ISACs have matured, as
well as our strategy to include our physical and cyber
strategies are interlinked.
The blackout of August 14 last year is a good example of
the cooperation and effective communication between IAIP and
the industry, and specifically the electric power industry
through the electric industries electric sector ISAC. At the
time of the power outage, the electric sector ISAC had been
well established and the lines of communication between the
ISAC and IAIP were in place. Shortly after the blackout, the
IAIP electric sector specialists were on the phone with the ES
ISAC to establish a preliminary estimate of the extent of the
outage to determine how far it had spread and to what
extent.Following the discussions with the ISAC, we were able to
make an assessment that the outage did not appear to have been
caused by terrorist activity, and this information was quickly
passed on to the Secretary and to the White House.
Every couple of hours throughout the night and somewhat
less frequently over the next few days, the ES ISAC conducted
conference calls with the industry representatives to assess
restoration efforts, the results of which were daily summarized
in situation reports that were provided to senior officials
within DHS and the White House.
Since the creation of DHS, we have been leveraging newly
integrated capabilities in the Department to reach out to the
private sector. For example, in coordination with the U.S.
Secret Service, shortly after the creation of DHS a financial
services ISAC exercise was held in New York. The event was well
received by the financial sector participants. We built on that
effort and we are working with state homeland security advisers
to continually put out more tabletop exercises. DHS has
recently conducted exercises in Chicago, San Francisco and
Houston, and we are currently conducting one in St. Petersburg,
Florida with the FS ISAC.
The Administration and Congress have provided additional
tools to enhance our information-sharing capabilities with the
ISAC. I will just go through that very quickly. As the primary
operational interface with the nation's critical
infrastructures, my Infrastructure Coordination Division, or
ICD, continues to pass timely and substantive threat
information to the private sector. We regularly hold daily,
sometimes weekly teleconferences. Sector analysts provide
critical infrastructures and ISACs with threat updates on
terrorist activities potentially affecting their systems and
facilities.
In addition, the ICD sector analysts routinely assist our
intelligence analysts from IA in preparing the warnings that
identify and communicate infrastructure-specific threats and
trends. The Critical Infrastructure Information Act was
recently enacted at the request of the private sector, and
provided implementing regulations to private industry with
assurances that critical infrastructure information they
voluntarily share with the government will be protected from
release to the public from use in civil litigation.
The PCII program enables the Department to receive critical
information that would not have been previously available to
the government, thereby allowing a better understanding of
threats and vulnerabilities and the security of our nation's
critical infrastructure.
We recognize the need for better coordination for
information flow in the private sector and we have established
consequently the National Infrastructure Coordination Center
under the Infrastructure Coordination Division. Now in its
third month of official operation, the NICC provides
operational awareness of the nation's critical infrastructures
and key resources in collaboration with both private partners
and our counterpart government agencies.
Another key component of our strategy is connectivity. With
the announcement of the Homeland Security Information Network,
HSIN, DHS provides a new capability for enhancing many of the
critical infrastructures ISACs' capabilities to communicate
with their sectors. The system provides a secure encrypted
backbone capability for participants to communicate sensitive,
but unclassified information with DHS, with each other, and
other communities of interest which may have information useful
to them. It provides a collaborative feature that allows
government and industry participants to work together in real
time on problem solving. It has an alerting and notification
feature to disseminate information to members of a sector or
across sectors.
The system provides a capability for sectors to interact
with each other as necessity dictates. The features within that
system provides for basic and common communication service
among ISACs. I would be happy to discuss that further.
Let me just conclude by saying that in today's threat
environment where threats and vulnerabilities are continuously
evolving in both physical and cyber space, we need critical
infrastructure sectors' coordination and cooperation and
expertise and creativity to find the most effective,
sustainable, consistent and measurable ways to protect their
sectors. The partnerships we have developed and will continue
to develop will improve upon the relationships we have, but
they are absolutely key to the success of our goal to protect
our nation and its critical infrastructure.
Mr. Chairman, thank you.
[The statement of Mr. Liscouski follows:]
Prepared Statement of the Honorable Robert Liscouski
Good morning, Chairman Thornberry, Chairman Camp, and distinguished
members of the subcommittees. I am pleased to appear before you again
today to discuss Information Sharing between the Department of Homeland
Security and Critical Infrastructure Sectors.
The recent bombings in Madrid confirm that terrorists are willing
to exploit a wide range of infrastructure vulnerabilities. That is why
we must continue to be vigilant and flexible in our approach to
infrastructure protection. We in the Information Analysis and
Infrastructure Protection Directorate (IAIP) take that mandate to heart
in our collective efforts and activities to protect the Nation.
Since the inception of DHS in 2003, working in a continuing
partnership with private industry, we have made significant progress in
evaluating and securing our greatest vulnerabilities. In order for this
public-private partnership effort to succeed, increased information
sharing is essential. To this end, we are making exceptional progress
in expanding our information sharing capabilities with respect to all
of the types of information that must be shared including vulnerability
information, exploits, threats, incidents, best practices, and early
warnings.
Today I will discuss with you an overview of the current level of
relationships and information sharing we have with private industry,
illustrating accomplishments with specific examples. Then I will
describe recent initiatives we have implemented to enhance those
relationships. Finally, I will discuss some new initiatives we are
planning for later this year.
DHS and Private Sector Relationships
Any effective relationship with private industry requires
engagement at all levels. IAIP works hard to maintain a comprehensive
relationship with private industry, specifically focusing on the
critical infrastructure sectors and the owners and operators of key
assets. This relationship operates on three levels: (1) policy and
strategy; (2) planning and implementation; and (3) operational
execution.
Policy and Strategy
IAIP serves as the executive agent for two Presidential advisory
committees: The National Infrastructure Advisory Council (NIAC) and the
National Security Telecommunications Advisory Committee (NSTAC). Both
bodies provide policy and strategic advice to the President on
enhancing public-private partnerships and on specific strategic issues
related to critical infrastructure protection.
The NSTAC is chartered to provide industry-based advice and
expertise through the Secretary of Homeland Security to the President
on issues and problems related to implementing national security and
emergency preparedness (NS/EP) telecommunications policy. It is
composed of up to 30 industry chief executives representing the major
communications and network service providers and information
technology, finance, and aerospace companies. Since its inception, the
NSTAC has addressed a wide range of policy and technical issues
regarding telecommunications, information systems, information
assurance, critical infrastructure protection, and other NS/EP
communications concerns.
The NIAC, through the Secretary of Homeland Security, provides the
President with expert advice on the security of information systems for
critical infrastructure supporting other sectors of the economy:
banking and finance, transportation, energy, manufacturing, and
emergency government services. Because information and physical
security are inextricably linked within many critical infrastructure
sectors, the Council has addressed issues that cover both. The NIAC is
charged to enhance the partnership of the public and private sectors,
propose and develop ways to encourage private industry to perform
periodic risk assessments, foster improved cooperation among the
Information Sharing and Analysis Centers (ISACs), DHS, and other
Federal Government entities; and advise sector specific agencies with
critical infrastructure responsibilities, sector coordinators, DHS, and
the ISACs. The Council includes chief executives from industry,
academia and State and local government.
Both the NSTAC and the NIAC work closely with the Administration
and IAIP to identify key policy issues of importance to critical
infrastructure protection.
Planning and Implementation
At the planning and implementation level, IAIP works with cross-
sector bodies, such as the Partnership for Critical Infrastructure
Security (PCIS). The PCIS Board consists of all the sector leadership
entities that comprise the ``sector coordination mechanism[s]''
referred to in Homeland Security Presidential Directive 7 (HSPD-7).
These leadership entities have been previously affirmed by the sector
specific agencies. Private industry established the PCIS as a forum to
partner across sectors and with the Federal Government to address
critical infrastructure.
IAIP also works with the ISAC Council, whose members represent many
of the ISACs established in infrastructure sectors. Private industry,
on its own volition, organized this forum to share common issues and
best practices, and to find common solutions. ISACs are established
voluntarily by industry sectors to share information and analysis for
alerts, warnings and advisories, and act as a communication vehicle for
best practices and other security information tailored for each sector.
As a point of entry into the sector, sector leadership entities
have the mission of facilitating sector strategy and policy as well as
coordinating a wide range of critical infrastructure planning
activities, that include national planning involving critical
infrastructures, outreach and awareness, sector vulnerability
assessments, requirements for sector information sharing, identifying
sector-wide best practices, acting as the sector's point of contact
with the Federal Government at infrastructure protection meetings, and
serving as the strategic communication point back into the sector and
to its members from the Federal Government.
The critical infrastructure sectors are very diverse in their
composition, culture, and operations. Consequently, their level of
collaboration and coordination with the Federal Government, and with
each other, varies widely between sectors. Recognizing these
differences, IAIP has developed a facilitative process to work in
partnership with the Federal sector-specific agencies (as defined in
HSPD-7) to help the sectors organize themselves as inclusively as
possible to identify or construct the ``sector leadership entity'' for
critical infrastructure protection. This leadership entity could be an
individual, entity or group. Examples of how IAIP actively engages in
this sector development activity can be found today in the Agriculture
and Food sectors (in partnership with HHS and USDA), the Public Health
sector (in cooperation with HHS), the Postal and Shipping sector, the
Water sector (in cooperation with EPA), and the Emergency Services
sector.
IAIP leadership met frequently with both the PCIS and the ISAC
Council throughout the last year, and continues to meet with them, to
understand and gain deeper knowledge of sector issues from the private
sector representatives on various aspects of infrastructure protection.
Out of one of the briefings provided by IAIP to the ISAC Council, the
Council, on its own initiative, developed a series of white papers on
information sharing for its own use in strategic planning, and shared
them with IAIP.
With the support of IAIP, the PCIS Board and the ISAC Council began
holding joint meetings in December, 2003. They have worked jointly and
independently on various initiatives. In joint sessions, DHS has
provided comprehensive briefings on its initiatives and critical
issues, which have led the joint PCIS/ISAC Council to begin identifying
specific activities, tools/methodologies development, and programs
undertaken by each specific sector and then shared across sectors as
best practices to improve each sector's security. This study has helped
each sector identify gaps as they compare their activities. This joint
body represents a major forum for joint communication with the critical
infrastructure sectors.
IAIP has embarked upon national level planning efforts that will
involve the private sector in the development and/or implementation of
the plan. Under HSPD-7, IAIP has embarked upon the development of the
National Infrastructure Protection Plan (NIPP). This National Plan will
cover the 13 critical infrastructure sectors and four categories of Key
Resources. Sector-Specific Agencies both internal to and external to
DHS will have the lead for drafting these 17 sector-specific plans,
which will be integrated into the National Plan. The public-private
partnership in this Plan will be realized through engaging the private
sector in the planning process as represented by their ISACs, sector
coordinators, and other recognized sector stakeholders so that their
knowledge and information will be reflected in the substance of the
Plan itself.
In a second national planning effort under HSPD-5, DHS's Office of
Headquarters Integration Staff, along with the Department's
directorates, is developing the National Response Plan. For the first
time, the National Response Plan, which integrates the various federal
response plans, will include the private sector as an essential element
in preparedness, response, and recovery.
Relationships must be maintained at this level in order to assure
coordinated and integrated plans and programs that utilize resources
optimally and to assure engagement of operational leadership within the
private industry for mutual planning and goals setting.
Operational Execution
At the operational level, IAIP works on daily, periodic and
situational basis with ISACs sharing information on threats, developing
suggested protective actions, and alert and warnings. There are
currently 14 ISACs spanning most of the HSPD-7 critical
infrastructures. ISACs serve as a gateway between DHS and the industry
for two-way information sharing and provide the industry with an
information clearinghouse for each sector. Through the up-to-date
distribution lists maintained by the ISACs, DHS is able to quickly
disseminate threat warnings to identified entities within each sector.
To a lesser degree, ISACs and their members provide DHS with
incident and suspicious activity information. This type of information
holds the potential for completing the situational awareness picture
(together with Intelligence Community and Law Enforcement information)
concerning possible threats to the nation's critical infrastructures.
In my organization, the Infrastructure Coordination Division (ICD) and
National Communications System (NCS) are the two IAIP divisions
responsible for maintaining and enhancing relationships with the
private sector through their ISACs, the latter with specific
responsibility for the telecommunications sector. Staff from both
divisions participate actively in ISAC related Advisory Groups,
Committees, Task Forces and Working Groups and maintain day-to-day
contact with the ISACs.
In addition, the Protective Security Division (PSD), also within
the Office of Infrastructure Protection, has worked with owners and
operators of specific categories of critical assets to develop and
tailor protective practices for these assets. An example of this type
of product is the guidelines for protecting refineries that the oil
industry published last year. This type of work complements the
``buffer zone'' approach for communities that the division has
developed and deployed over the last fourteen months. In addition, PSD
is deploying regional/ field security representatives to work directly
with the owners and operators of critical infrastructure facilities and
community leaders to address protective measures. Together, these
practices constitute a holistic approach to infrastructure protection,
looking at the activity from a ``whole systems'' perspective, and
providing for a ``layered'' defense for the nation's critical assets.
In support of integrated operations, DHS's predecessor agencies
have granted security clearances to industry representatives when the
purpose is to help the Federal Government maintain and enhance our
national security, which includes critical infrastructure protection.
Clearances historically have been given to individuals who have unique
expertise, not available in government, on critical infrastructure
protection, operations, or technology or who must take specific
protective actions in response to classified information. In the past,
IAIP sector analysts have specifically relied on ISAC and industry
experts, generally with secret-level clearances, to help them assess
sector threat, risk, and vulnerability information. In particular,
these industry representatives work closely with DHS analysts to ensure
that government-generated warning products (e.g. Advisories and
Information Bulletins), when declassified to permit broad industry
distribution, still contain information that provides ``value added''
actionable intelligence when disseminated to sector members. DHS is
continuing to refine and working to accelerate the process for granting
security clearances to key sector individuals to assist DHS, and
ultimately their own sectors, regarding the production and receipt of
timely and actionable threat information.
In February, 2003, President Bush issued the National Strategy to
Secure Cyberspace (``the Strategy''). DHS recognized that in order to
meet many of the mandates in the Strategy and other objectives
addressing greater national cyber security, we needed to create an
operational mechanism for building a cyber security readiness and
response system. As such, through an initial partnership with the CERT
Coordination Center (CERT/CC) at Carnegie Mellon University, we created
the U.S. Computer Emergency Readiness Team, or US-CERT. Through that
partnership, US-CERT is able to leverage, rather than duplicate,
existing capabilities and accelerate national cyber security efforts.
US-CERT provides a national coordination center that links public and
private response capabilities to facilitate information sharing across
all infrastructure sectors and to help protect and maintain the
continuity of our Nation's cyber infrastructure. The overarching
approach to this task is to facilitate and implement systemic global
and domestic coordination of deterrence from, preparation for, defense
against, response to, and recovery from, cyber incidents and attacks
across the United States, as well as the cyber consequences of physical
attacks. To this end, US-CERT is building a cyber watch and warning
capability, launching the US-CERT Partnership Program to build
situational awareness and cooperation, and coordinating with U.S.
Government agencies and the private sector to deter, prevent, respond
to and recover from cyber--and physical--attacks. Through its Internet
portal, US-CERT is a crucial component of--and a distribution tool
for--our cyber security awareness activities.
On January 28, 2004, the Department of Homeland Security through
US-CERT unveiled the National Cyber Alert System, an operational system
developed to deliver targeted, timely and actionable information to
Americans to secure their computer systems. As the U.S. Government, we
have a responsibility to alert the public of imminent threats and to
provide protective measures when we can, or least provide the
information necessary for the public to protect their systems.
Furthermore, it is also important to inform the public about the true
nature of a given incident, what the facts are, and what steps they can
and should take to address the problem. The offerings of the National
Cyber Alert System provide that kind of information, we have already
issued several alerts and the initial products in a periodic series of
``best practices'' and ``how-to'' guidance messages. We strive to make
sure the information provided is understandable to all computer users,
technical and non-technical, and reflects the broad usage of the
Internet in today's society. As we increase our outreach, the National
Cyber Alert System is looking at other partners to distribute
information to as many Americans as possible.
As the strategy acknowledged, one of our most important
constituencies is the private sector. It is estimated that eighty-five
percent of America's critical infrastructure is owned and operated by
private companies, and technology developed by industry continues to
fuel the growth and evolution of the Internet. In December 2003, the
National Cyber Security Division (NCSD) co-hosted the first National
Cyber Security Summit in Santa Clara, California with the Information
Technology Association of America, TechNet, the Business Software
Alliance, and the U.S. Chamber of Commerce. This event was designed to
energize the public and private sectors to implement the Strategy. The
Summit allowed the Department of Homeland Security to work side-by-side
with leaders from industry to address the key cyber security issues
facing the Nation. Five interest areas were established to focus
specifically in the areas of:
Increasing awareness
Cyber security early warning
Best practices for information security corporate
governance
Technical standards and common criteria
Security across the software development lifecycle
Perhaps most importantly, the Summit served as a call to action. It
represented a logical transition point from developing a national
strategy to energizing the public-private partnership to implement
concrete, measurable actions to improve the security of America's cyber
systems. Over the past few weeks, summit participants have put forward
options for potential solutions in each of these key areas for both the
public and private sector. We are excited that the private sector is
showing such initiative and we are committed to working together.
DHS is also a sponsor of the National Cyber Security Alliance
(NCSA) and StaySafeOnline, a public-private organization created to
educate home users and small businesses on cyber security best
practices. Other NCSA sponsors include: The Federal Trade Commission,
AT&T, America Online, Computer Associates, ITAA, Network Associates,
and Symantec. DHS is providing matching funds to expand the NCSA end-
user outreach campaign, which will include a Fall 2004 Public Service
Campaign to increase awareness among Americans about key cyber security
issues.
In operational relationships of this kind, adding value, efficiency
and customer orientation is the key to building trust and sustaining
relationships. IAIP has worked hard to enhance its capabilities in this
regard over the last year with these activities. These relationships
represent on-going efforts that are essential for efficient planning
and implementation coordination. The long term commitment of
communications between the federal government and the private entities
is an essential element of building successful public-private
partnerships.
Private Public Partnerships Information Sharing
Adequate, actionable information is an essential enabler for all
facets of critical infrastructure protection, from deterrence to
response. Congress recognized its importance in the new tools it
provided to DHS to obtain and protect, analyze and disseminate
information from a wide variety of sources. Private industry owners and
operators of critical infrastructure have long understood their
responsibility for assuring their operations under a multitude of
circumstances ranging from accidents to natural disasters. They now
must add terrorism to the list of natural and manmade hazards they must
consider and accommodate in their investments and response
preparedness. The Federal government alone cannot protect this nation's
expansive and widely distributed national infrastructures. IAIP needs
private industry to be fully engaged in our national CIP program.
Consequently, two-way information sharing with the owners and operators
of critical infrastructures remains one of our highest priority public
private partnerships.
Current Information Sharing Initiatives
The Information Sharing and Analysis Center (ISAC) has emerged over
the last several years as a primary conduit for information sharing
between the Federal government and many critical infrastructures and
key resource industries. Each ISAC structure and operations tends to
reflect the culture, structure and operating processes of their sector.
The ISACs continue to evolve. They began with a focus on cyber security
vulnerabilities and incidents. Since September 11, 2001, most share
information on physical incidents as well.
ISACs have widely varying levels of maturity and capability. ISACs
have served a valuable role in private partnership information sharing.
The purpose of the ISAC is to provide an efficient conduit for
dissemination, sharing and communications of indications, warnings, and
advisories related to potential threats vulnerabilities and incident
data.
The Northeast Blackout of last year is a good example of
cooperation and effective communications between IAIP and the Electric
Power industry through the industry's Electric Sector--ISAC. At the
time of the power outage the ES-ISAC had already been well established
and lines of communication between the ISAC and IAIP were in place. By
approximately 4:30 p.m. EDT, 15 minutes after the initiation of the
power outage, the IAIP's electric sector specialist was on the phone
with the ES-ISAC to establish a preliminary estimate of the extent of
the outage and to determine whether it had ceased to spread. Following
discussions with the ISAC, we were able to make an assessment that the
outage did not appear to have been caused by terrorist activity. This
information was immediately elevated to Secretary Ridge and to the
White House.
Every couple of hours throughout the night, and somewhat less
frequently over the next several days, the ES-ISAC conducted conference
calls with industry representatives to assess restoration efforts.
These calls were summarized in a Situation Report that was provided to
senior officials within DHS and to each IAIP Infrastructure Sector lead
for cross-infrastructure sharing purposes (since every sector depends
upon electricity). In addition, the ES-ISAC structure was used
effectively to share information with other industry sectors that are
dependent on electricity. For example, on the evening of the power
outage, the IAIP electric power staff addressed a conference call of
the Financial Sector-ISAC and was able (based on earlier ES-ISAC
inputs) to estimate the duration of the interruption of power supplies
to New York City. In summary, the August 14th power outage demonstrated
that the ISACs are an effective mechanism for receiving information
from the private sector as well as for providing information to the
private sector during a crisis.
A long standing example of the utility of ISACs is the National
Communications Center Telecommunications-ISAC, which is the primary DHS
interface with the Private Sector for the telecommunications
infrastructure. Built on an existing information sharing body, the NCC
Telecom-ISAC is grounded by well-established trust. This mature, close
relationship with industry is Government-supported, which facilitates
the ISAC's ability to provide a value-added service, reaching out to
the entire sector. This has provided a great role model for other
ISACs.
In the past, the Federal Government would conduct readiness and
terrorism exercise in the absence of private sector participation. For
example, in the TOPOFF-1 and TOPOFF-2 exercise series, the private
sector owners and operators of infrastructure were excluded from
``exercise play'', with the sole exception of hospitals, which were
always one of the key operations being "stressed and tested" in those
types of exercises. In contrast, based on prior planning and
coordination by the U.S. Secret Service component of DHS, a Financial
Services (FS)-ISAC Table Top Exercise was held in New York, March 2003
soon after the standup of the Department. DHS staff attended the
exercise to observe the scenario play and to ensure that participants
were aware of DHS's role, including ICD role, in aiding with real-world
recovery operations. The event was well received by the financial
sector participants.
Building on this effort and working with the state homeland
security advisors, DHS has continued these exercises in, Chicago, San
Francisco, Houston, and now, concurrent with this testimony, from 19-22
April 2004, the FS-ISAC is hosting its next Tabletop exercise in St.
Petersburg, Florida. The exercise will include two days of interactive
tabletop play. DHS is sponsoring this event and staff will be actively
participating in the exercises.
From the lessons learned of TOPOFF-2 and these other table top
exercises, IAIP recognizes the need to engage our private sector
partners in these planning and execution of these national level
exercises. Exercises, of all kinds, tabletop, command post and full
scale; are powerful 'best practice' training tools and provide another
venue for information sharing. IAIP plans to continue to include the
private sector in future exercises whenever it makes sense to do so.
New Information Sharing Initiatives
The Administration and Congress have provided additional tools to
enhance information sharing with the private sector. I will now discuss
IAIP's new information sharing initiatives.
As the primary operational interface with the nation's critical
infrastructures, ICD continues to pass timely and substantive threat
information to the private sector. At daily and/or weekly
teleconferences, sector analysts provide the critical infrastructures
via the ISACs with unclassified threat updates on terrorist activities
potentially affecting their systems and facilities. In addition,
classified threat briefings are presented to cleared ISAC
representatives and their industry members on a quarterly or semi-
annual basis. To maintain appropriate situational awareness for each
sector--a key division objective--ICD analysts on an ad hoc basis also
provide timely assessments of high threshold threats to critical
infrastructures through the ISACs. In addition, ICD sector analysts
routinely assist IA analysts in preparing warning products that
identify and communicate infrastructure-specific threats and incident
trends.
The National Infrastructure Coordinating Center (NICC) uses the
Infrastructure Protection (IP) Executive Notification Service (ENS) to
quickly notify ISAC leadership and Sector Coordinators of critical
infrastructure events ranging from notification of imminent threats,
dissemination of sector-specific warning products, and changes in
national threat level. ENS delivers rapid internal and external
messaging capability among government and private sector partners and
provides Interactive Secure Authentication, which ensures
confidentiality of communications, as well as confirmation of receipt.
Protected Critical Infrastructure Information
Critical to the Department of Homeland Security's mission is the
ability to effectively share information with homeland security
partners across the country to better protect the nation's critical
infrastructure. The Critical Infrastructure Information (CII) Act and
implementing regulations provide private industry assurances that
critical infrastructure information they voluntarily share with the
government will be protected from release to the public and from use in
civil litigation. The PCII Program enables the Department to receive
critical infrastructure information that would not have previously been
available to the government, thereby allowing for a better
understanding of threats, vulnerabilities and the security of the
nation's critical infrastructure.
With the protection from FOIA disclosure offered by the CII Act,
the private sector can share sensitive and confidential information
that can be analyzed to identify threats and vulnerabilities. Such
analysis will provide the basis not only for developing measures to
deter the threats and mitigate the vulnerabilities to which the
critical infrastructure is exposed, but also for improving Federal,
State, and local governments' emergency preparedness posture to respond
to any attacks more effectively.
The benefits to private industry are both practical and patriotic.
Information sharing will result in better identification of risks and
vulnerabilities, which individual companies can use to help protect
their assets. By voluntarily sharing such critical information, private
industry demonstrates responsiveness to Government need and the public
good. Private industry is demonstrating good corporate citizenship that
may save lives and protect our hometowns. By participating in the PCII
Program, industry is helping to safeguard and prevent disruption to the
American economy and way of life.
National Infrastructure Coordination Center (NICC)
The NICC is currently developing capabilities towards its targeted
operational capacity. Now in its third month of official operation, the
NICC is collecting and analyzing best practices. While this analysis
begins with watch center models, it also includes management practices,
information sharing systems, and other process development models from
a broad range of industries. The NICC will also work with its IAIPs
public and private sector partners to ensure that its operational
models most effectively and efficiently meet their needs.
DHS designed the NICC specifically to maintain operational
awareness of the nation's critical infrastructures and key resources in
collaboration with both private partners and counterpart government
agencies. The NICC also, by design, provides DHS with the ability to
coordinate information sharing between government, ISACs, and other
industry partners. The NICC functions as an extension of the Homeland
Security Operations Center (HSOC).
Homeland Security Information Network
With the announcement by the Secretary of the Homeland Security
Information Network (HSIN) in March, DHS provides a new capability for
enhancing many of the critical infrastructure ISACs' capabilities to
communicate with their sectors. The system provides a secure encrypted
backbone capability for participants to communicate Sensitive But
Unclassified (SBU) information with DHS, with each other, and other
communities of interest that have information that may be useful to
them. It provides a collaborative feature that allows government and
industry participants to work together in real-time on problem solving.
It has alerting and notification features to disseminate information to
members of a sector or across sectors. The system provides the
capability for sectors to interact with each other on the system as
necessity dictates. These features provide support for a basic and
common communications service among ISACs.
By providing access to these capabilities to the critical
infrastructure ISACs, IAIP adds value as a partner to the ISACs by
removing duplication of costs in implementation and operations, and
accelerates the development of value of the ISACs to their sectors.
From experience with its use through the JRIES community (consisting of
law enforcement at Federal, state and local levels) the collaborative
and real-time aspects of the system actually increases the pace and
volume of information sharing. Pilots with volunteer critical
infrastructure sectors will begin this year, with support from the
Infrastructure Coordination Division.
We have seen great progress in two way information sharing with the
private sector and these examples are illustrative of our efforts.
Conclusion
This Administration has upheld a consistent policy that public
private partnerships be one of the pillars of national critical
infrastructure protection. Partnerships are an essential element
described in every national strategy document that we have published on
homeland security and critical infrastructure protection. This policy
recognizes the new environment of terrorism, where both threats and
vulnerabilities are continuously evolving in both physical and cyber
space, will require an unprecedented adaptability and cooperation of
the stakeholders. Since 85 percent of the critical infrastructures are
owned and operated by private industry, how could a sustained effort be
institutionalized to protect them? Only a full understanding by the
stakeholders of their own vested interests related to this issue could
sustain such an effort and commitment. Public-private partnerships are
the only means that is responsive enough and adaptive enough to
accomplish our national goals in a scalable, sustainable, and effective
way.
We have learned many lessons about developing effective
partnerships both from our legacy agencies and from our own experiences
since DHS was implemented in 2003. I would like to share three of these
with you today. Lesson 1--Partnerships require a set of mutually
determined objectives and deliverables to achieve a value proposition
and trust. Lesson 2--Participation in planning and objectives setting
is essential to the success of the partnership. Both sides must
understand the expectations, values, concerns, risks and individual
objectives of each participant. Lesson 3--Constant communication
between all of the parties is an essential imperative.
With years of experience by agencies that are now part of DHS, the
successful partnerships built between federal lead agencies and their
counterparts in industry were those where the federal lead agencies
educated and learned, convened, listened and responded and then
supported their industry counterparts who took the lead to implement
programs to protect themselves. The Federal government sharing useful,
actionable information on threats induces greater information sharing
by industry in return. Making it easy for industry to receive and
provide information, providing products and services in return, based
on that information, and working with owners and operators to develop
and implement consistent and generally accepted protection practices,
will add value to any partnership.
In all relationships, there are challenges. Strong long-term
relationships depend, however, on how well the participants handle,
learn from, and adapt to those challenges. Some lessons learned from
the recent past in our dialogue with industry include involving them in
planning, mutual goals setting and development of operational learning,
such as input into our national plans, the NIPP and NRP, and direct
participation in major exercises such as TOPOFF3. We have responded and
adapted to many of the needs and expectations of industry in support of
their protection strategies and programs.
Some private institutions have committed tremendous resources in
time and money to supporting this national initiative, not just for
their individual institution but for their industry as whole. Even
before 9/11, some were doing so. Terrorists have innumerable weapons
and targets of choice in our open society. In order to sustain an
effective national CIP program, we need critical infrastructure
sectors' cooperation, expertise and creativity to find the most
effective and efficient ways to protect their sectors. It is incumbent
upon DHS to develop and strengthen these partnerships and we will do so
because there is more to do to help secure our homeland.
Mr. Thornberry. Thank you.
Also on our first panel, we have Mr. George Newstrom, who
is the Secretary of Technology and Chief Information Officer
for the Commonwealth of Virginia. He also serves as the
Chairman of the Security Committee of the National Association
of State Chief Information Officers. Secretary Newstrom, thank
you for being with us, and you are recognized for 5 minutes to
summarize your statement.
STATEMENT OF THE HONORABLE GEORGE NEWSTROM, SECRETARY OF
TECHNOLOGY, COMMONWEALTH OF VIRGINIA
Mr. Newstrom. Thank you, Mr. Chairman and members of the
committee. I will summarize my statement. You have the full
text in front of you right now. The Chairman has already
introduced me and the two hats that I come to you with today.
At NASCIO, I serve as the Chair of the Security Committee.
This committee addresses the role of information and
communications technology, both in terms of how it supports the
wider needs of state homeland security directors and how state
governments should be protecting their critical information
assets. We also oversee NASCIO's Interstate Information Sharing
and Analysis Center, the ISAC, which arose from a 2002
memorandum of understanding with DHS's Infrastructure
Coordination Division led by Jim Caverly.
Information infrastructure is only part of America's
critical infrastructure that is under attack everywhere all the
time. Unfortunately, cyber attacks on a national scale are
still treated as secondary to any physical threat, whether it
is chemical, biological, radiological, nuclear or explosive.
NASCIO believes that while cyber terrorism per se is still an
emerging threat, we must press forward toward a coordinated
intergovernmental approach to protecting government's critical
information assets if we are to ensure that critical government
business functions, especially those supporting homeland
security, will be available when needed.
If we can secure our systems from hackers and organized
crime, we will have gone a long way toward securing them from
terrorist and enemy nation-states. NASCIO has long realized the
interdependence of Federal, state and local information systems
which drive the need for intergovernmental approach. Toward
that end, we produced a document in 2002 titled Public Sector
Information Security, a call to action for public sector CIOs
that emerged from a forum convened by NASCIO in the wake of 9-
11. We also convened a roundtable discussion that included
local, state and Federal participants here last July.
The primary lessons we have learned are that government
ICT, information and communications technology personnel,
should be considered core competencies to state and local
emergency response capabilities because without them,
everything from databases to wireless communications first
responders cannot do their job. Also, given the fact that
states, counties and cities are the primary mechanism for the
delivery of critical services to citizens, including Federal
programs, if the information systems of states or local
governments go down, the ability of the other levels of
government to do business within jurisdictions will be
significantly impaired, if not interrupted. This creates a
cascading effect.
While the CIO is charged with protecting the state's
critical information assets, he or she is also charged with
managing the day-to-day operations of a wide variety of
information systems and infrastructures that support first
responders in homeland security leadership. Up to now, homeland
security has primarily been defined as those systems involving
law enforcement and emergency managers. However, as state
efforts fuse information from intelligence and all-hazard
incident management purposes become more sophisticated, a wide
range of information systems will be drawn together in an
effort from public safety, public health, transportation and
agriculture, among them.
Homeland security at the state and local level is less
about organizational change and more about cultural adjustment.
Homeland security, like technology, requires an enterprise
approach that synchronizes and harmonizes disparate parts under
a common umbrella. Key to this success with this cultural
change is achieving vertical and horizontal sharing and
integration of information, something that requires effective
application of technology. This will require the CIO, with
statewide oversight, to help manage the development and
deployment of systems that can meet the ever-changing needs of
homeland security decision makers.
As a caution and an urge to the Federal Government, we ask
that the Federal Government consolidate its information-
disseminating capability. While it may be necessary to separate
public safety, military and cyber efforts, we should not have
multiple, uncoordinated information dissemination efforts
within each of these categories as we do now. Virginia knows
from first-hand experience that the FBI and DHS are issuing
separate information products to law enforcement and non-law
enforcement communities respectively. This makes it difficult
for state homeland security directors and CIOs to understand
the full spectrum of threats faced by states, without staying
abreast of multiple channels and fusing the information
internally.
NASCIO knows by the work with other states that the other
Federal agencies, particularly those in the Departments of
Justice and Health and Human Services, are issuing cyber alerts
to state and local programmatic counterparts which are not
incorporated in the National Cyber Security Division, NCSD, of
DHS. NASCIO would be willing to work with Mr. Amit Yoran and
the Federal Chief Security Officers Council to develop an
intergovernmental warning process so state CIOs, homeland
security directors and program-specific leadership receives
coordinated, consistent and timely alerts and notices.
As the 9-11 commission has heard now on many occasions, the
issue may be less on what and how much information we know, but
how knows it and who they share it with. In the area of cyber
security, we are doing well at countering attacks on
infrastructure after they happen. Isn't our real objective to
try to identify potential attacks in advance so that we can
avert costly efforts to eradicate them once they happen? The
only way to do this is by connecting the dots, sharing
information across Federal and state agencies in a timely and
focused manner.
NASCIO has been actively engaged in sharing cyber threat
and incident information with and among states as part of our
interstate ISAC program. We have also gathered information and
targeted requests from DHS and provided feedback on the
effectiveness of various information sharing analysis
practices. We have drawn on the goodwill of our corporate
partners to provide the states with supplemental information to
help them respond to fast-moving threats like worms and
viruses.
Regarding specific efforts by the Commonwealth of Virginia,
as members of today's committee know very well, Virginia is
home to the Pentagon, one of the three sites in the United
States that were attacked on September 11. The memory of that
day and its aftermath continue to permeate the consciousness of
those serving in Virginia State government and the local
community, while serving as a guide for Virginia's efforts in
homeland security and critical information protection. To
respond to this challenge, Virginia has three specific efforts
under way. One is the Secure Virginia Panel. The second is the
National Capital Critical Infrastructure Vulnerability
Assessment Project. Three is the Virginia Alliance for
Securing, Computing and Networking. You have all those in the
detailed comments in my testimony.
The first one is a public-private partnership that the
Governor of Virginia established within 30 days of coming into
office. The second one is the District of Columbia, the State
of Maryland and the Commonwealth of Virginia working together
to ensure the entire region's assets. The third is the Virginia
Alliance for Securing Computing and Networking is in the
educational community to secure our research networks that are
very instrumental to all of us.
Mr. Chairman and members of the subcommittee, Virginia and
all the states represented by NASCIO are moving forward in the
context of protecting critical infrastructure from physical and
cyber vulnerabilities. This effort is requiring new ways of
thinking and new types of relationships between Federal and
state entities. Much progress has been made, but there is much
to be done.
I enjoy a close working relationship with Virginia's
homeland security team, state as well as local, as well as the
leaders of the Federal efforts in DHS. I know that we do not
have all the answers. We may not even have all the questions.
But we know that protecting our critical assets from cyber and
physical threat is a key to ensuring the safety of Americans
and protecting our economic security.
My message to you, in conclusion, is first, despite the
continuing daily attacks on our nation's information
infrastructure, cyber security is still seen as a secondary
threat and the interdependence of Federal, state and local
systems absolutely requires closer and a more cohesive
approach. second, we are encouraged by the organization and the
leadership at DHS to move smartly and timely with the
assistance of their state and local partners, and particularly
the recent evaluation of the ISAC approach and the new
opportunities for effective change that it represents.
NASCIO will do what it can to assist by working with DHS,
ICD and NCSD divisions to arrive at the most effective
approach, and also by developing the states and local addendum
to our national security strategy.
Let me take a moment and thank Robert Liscouski, Assistant
Secretary, sitting next to me, as well as Jim Caverly, who
heads ICD, and Amit Yoran, the Director of the National Cyber
Security Division, as well as Steve Cooper, the CIO of the
Department of Homeland Security. These folks have worked with
us, as well as George Foresman, Virginia's Assistant to the
Governor for Commonwealth Preparedness, to meet the goals that
we have outlined.
Mr. Chairman, thank you, and members of this committee for
the opportunity to be here with you today.
[The statement of Mr. Newstrom follows:]
Preprared Statement of the Honorable George C. Newstrom
Chairman Thornberry, Chairman Camp and Members of the
Subcommittees,
Thank you for inviting me to appear before you today. I am before
you today wearing two different hats: one representing the Commonwealth
of Virginia as its Secretary of Technology and the second as the Chair
of the Security Committee of the National Association of State Chief
Information Officers (NASCIO).
I would like to offer my perspective on the issues of partnership
and information sharing with particular regard to Virginia's cross-
sector efforts to secure its critical and information infrastructures
and NASCIO's efforts to coordinate DHS's interaction with the states on
these matters. Virginia and NASCIO appreciate your attention to this
important matter and willingness to get input from a state and
organization that have direct stakes in the outcome. We believe that
success in cross-sector infrastructure assurance and information
sharing will be the result of persistent effort by many parties,
advancing in spurts during times of urgency and more incrementally
during times when trust and cooperation must be solidified for the long
haul.
Efforts By NASCIO
At NASCIO, as I indicated, I serve as chair of their Security
Committee. This committee addresses the role of state Information and
Communications Technology (ICT) both in terms of how it supports the
wider needs of state homeland security directors and in how state
governments should be protecting their critical information assets. We
also oversee NASCIO's Interstate Information Sharing and Analysis
Center (ISAC) efforts, which arise out of a July 2002 memorandum of
understanding with DHS's Infrastructure Coordination Division (ICD),
led by James Caverly.
Protecting Governments' Critical Information Assets
The information infrastructure is the only part of America's
critical infrastructures that are under attack everywhere, all the
time. Unfortunately, ``cyber'' threat on a national scale is still
treated as secondary to any physical threat whether it be chemical,
biological, radiological, nuclear, and explosive. NASCIO believes that,
while cyber-terrorism per se is still an emerging threat, we must press
forward toward a coordinated, intergovernmental approach to protecting
governments' critical information assets if we are to ensure that
critical governmental business functions--especially those supporting
homeland security--will be available when needed. If we can secure our
systems from hackers and organized criminals, we will have gone a long
way toward securing them from terrorist and enemy nation states.
NASCIO has long realized the interdependencies of federal, state,
and local information systems, which drives the need for an
intergovernmental approach. Toward that end, we produced a document in
2002, titled ``Public-Sector Information Security: A Call to Action for
Public-Sector CIOs'' that emerged from a forum convened by NASCIO in
the wake of 9/11. We also convened a roundtable discussion that
included local, state, and federal participants last July here in
Washington.
The primary lessons we have learned are that government ICT
personnel should be considered a core component to state and local
emergency response capabilities, because without everything from
databases to wireless communications the first responders cannot do
their jobs. Also, given the fact that the states, counties, and cities,
are the primary mechanisms for delivering critical services to
citizens--including federal programs, if the information systems of a
state or local government go down, the ability of the other levels of
government to do business within that jurisdiction will be
significantly impaired, if not interrupted. This creates a cascading
effect.
Supporting State Homeland Security Decision-Makers
While the CIO is charged with protecting the state's critical
information assets, he or she is also charged with managing the day-to-
day operations of a wide variety of information systems and
infrastructure that support first responders and homeland security
leadership. Up to now, homeland security ICT has primarily been defined
as those systems serving law enforcement and emergency managers.
However, as state efforts to fuse information for intelligence and all-
hazards incident-management purposes become more sophisticated, a wide
range of information systems will be drawn into the effort, including
those from public safety, public health, transportation, and
agriculture among others.
Homeland Security at the state and local level is less about
organizational change and more about cultural adjustment. Homeland
security, like technology, requires an enterprise approach that
synchronizes and harmonizes disparate parts under a common umbrella.
Key to succeeding with this cultural change is achieving vertical and
horizontal sharing and integration of information--something that
requires effective application of technology. This will require the
CIO, with statewide oversight, to help manage the development and
deployment of systems that can meet the ever-changing needs of homeland
security decision makers while maintaining appropriate levels of
privacy and security. Our adversaries will continue to change their
tactics. Therefore, our information systems must be able to help state
homeland security directors and DHS gather the information they will
need to counter these evolving threats.
Focused Action By The Federal Government Is A Necessity
It is so important that the federal government consolidate its
information dissemination capability. While it might be necessary to
have separate public safety, military and cyber efforts, we should not
have multiple, uncoordinated information dissemination efforts within
each of those categories as we do now. Virginia knows from first hand
experience that the FBI and DHS are issuing separate information
products to the law enforcement and non-law enforcement communities
respectively. This makes it difficult for state homeland security
directors and CIOs to understand the full spectrum of threats faced by
the state without staying abreast of multiple channels and fusing the
information internally.
NASCIO knows by way of its work with all the states, that other
federal agencies, particularly those in the departments of Justice and
Health and Human Services, are issuing cyber alerts to their state and
local programmatic counterparts, which are not incorporated into the
National Cyber Security Division (NCSD) of DHS alert products. NASCIO
would be very willing to work with Mr. Yoran and the new Federal Chief
Security Officers Council to develop an intergovernmental warning
process so that state CIOs, homeland security directors, and program
specific leadership receives coordinated, consistent as well as timely
alerts and notices.
As the `911 Commission' has heard now on many occasions, the issue
may be less on what and how much we know but who knows it and who they
share the information with. In the area of cyber security, we are doing
well at countering attacks on our infrastructure AFTER they happen.
Isn't our real objective to try to identify potential attacks in
advance so that we can avert the costly efforts to eradicate them after
they happen? The only way to do this is to `connect the dots'--share
information across federal and state agencies in a timely AND focused
manner.
Sharing Information with the States
NASCIO has been actively engaged in sharing cyber-threat and
incident information with and among the states as part of our
Interstate ISAC program. We have also gathered information for targeted
requests from DHS and provided feedback on the effectiveness of various
information sharing and analysis practices. We have drawn on the
goodwill of our corporate partners to provide the states with
supplemental information to help them respond to fast-moving threats
like worms and viruses.
We applaud Amit Yoran's recent efforts at the National Cyber
Security Division (NCSD) to engage the states directly and make the US-
CERT a valuable tool for the entire ICT-using community, including
individual U.S. citizens. We are currently working with Jim Caverly at
ICD to further refine our ISAC program. We know that DHS, NASCIO, and
individual states have very limited resources to contribute to any
information sharing effort. Therefore, we seek to have an information
sharing and analysis program that is as transparent as possible between
DHS and the states. We also want it to provide targeted services with a
definable return on the sweat equity investment by the states. This
will take time. But, NASCIO has found its partners at NCSD and ICD to
be very receptive to our suggestions for improvement and we remain
committed to ensuring the success of any information sharing efforts
with the states.
Our NASCIO Security Committee currently has two deliverables in
progress for 2004, which might be of interest to you:
A state and local addendum to the National Strategy to
Secure Cyberspace. Following a meeting with DHS and White House
cybersecurity leadership, the National Governors Association
(NGA) began working with NASCIO to take on the joint role of
serving as ad hoc coordinators for the state and local sector.
In that role, we will be forming a task force or working group
to produce a brief addendum that will highlight the key sector
implications of the strategy. It will also provide an
opportunity to put forth some additional recommendations for
action by our sector. This group will include state, county,
and municipal chief information officers (CIOs) and chief
information security officers (CISOs) as well as participants
from the telecommunications directors, utilities commissioners,
and educational community.
Defining the role of the CIO in homeland security
decision support.NASCIO will shortly be releasing a detailed
brief on the role of the CIO in supporting intra-state
intelligence and situational awareness efforts, which combine
to provide homeland security leadership with what we are
calling ``decision support.'' It will include several calls for
very precise state and federal action that we hope will prepare
the states to fulfill the goals of the recently released
National Incident Management System (NIMS) as well as support
the ongoing deployment of new and enhanced information sharing
networks by DHS CIO, Steve Cooper.
Efforts Specific to the Commonwealth of Virginia
The efforts undertaken by the Commonwealth of Virginia in securing
its critical physical and infrastructure has been primarily focused on
the development of partnership among key state and local agencies, the
private sector and Virginia's institutions of higher education to
develop and implement strategies for securing and maintaining critical
infrastructure.
As members of today's committees know very well, Virginia is home
to the Pentagon one of the three sites in the United States that was
attacked on September 11, 2001. The memory of that day and its
aftermath continue to permeate the consciousness of those serving in
Virginia's state government and local communities while serving as a
guide for Virginia's efforts in homeland security and critical
infrastructure protection component.
To respond to these challenges, the Commonwealth of Virginia has
three specific efforts underway that will be discussed today. These
efforts are:
The Secure Virginia Panel
National Capital Region--Critical Infrastructure
Vulnerability Assessment Project
The Virginia Alliance for Secure Computing and
Networking (VA SCAN)
The Secure Virginia Panel
As one of his first acts of office to respond to the challenge of
protecting the Commonwealth, the Governor of Virginia, Mark R. Warner,
signed Executive Order 7 on January 31, 2002, establishing the Secure
Virginia Initiative and convening the Secure Virginia Panel. In
bringing together state government, local government and the private
sector, the Secure Virginia Panel and its working groups has served as
the primary conduit for developing public-private partnerships to deal
with the challenges in preparing for emergencies and disasters of all
kinds, including terrorism.
Through the Critical Infrastructure Working Group (CIWG) of the
Secure Virginia Panel, Virginia is tackling many of the same challenges
that are also being addressed by the federal government. Also comprised
of members representing state government, local government and the
private sector, the CIWG is specifically charged with making
recommendations that strengthen cyber and physical security for
critical infrastructure throughout the Commonwealth. By identifying
failure and inter-dependency points in critical infrastructure security
and developing a methodology for prioritization of those points, the
CIWG is attempting to answer three critical questions:
1. What critical infrastructure is needed to keep government
operational?
2. How does the Commonwealth of Virginia best coordinate with
local government and the private sector?
3. What organizational structure is best suited to ensuring a
coordinated approach to both cyber and physical security of
critical infrastructure located in Virginia?
To answer these questions, the CIWG has outlined six objectives
that it plans to meet by December 2004. These objectives are as
follows:
1. Development of a governance model that can best coordinate
critical infrastructure protection and risk mitigation.
2. Identification of critical infrastructure.
3. Identification of inter-dependency and failure points in
critical infrastructure protection.
4. Development of a methodology to prioritize critical
infrastructure protection initiatives.
5. Assignment of responsibility within state government for
coordinating critical infrastructure cyber and physical
security efforts.
6. Coordination among the public sector, private sector and
institutions of higher education to ensure the development and
utilization of a consistent assessment methodology.
These efforts are facilitated by prior recommendations that have
been developed by the Secure Virginia Panel. Specifically, in 2002, the
Panel recommended legislative changes that would protect from FOIA the
disclosure of critical infrastructure information submitted to state
government by the public sector. Titled the `Sensitive Records
Protection Act' (HB 2210), the legislation was passed by the 2003
General Assembly and subsequently signed into law by the Governor.
National Capital Region--Critical Infrastructure Vulnerability
Assessment Project
The vulnerability of the National Capital Region was made painfully
obvious on September 11th, 2001. The coordinated partnership by the
federal government, the states of Virginia and Maryland and the
District of Columbia to the unique situation of our Capital region
demonstrates the cooperative approach towards homeland security and
critical infrastructure protection that is being pursued today.
Under the auspices of the post 9 /11 funding provided by Congress,
Urban Area Security Initiative Grant Program as well as the Department
of Justice Community Oriented Policing (COPS) program, funded through
the Department of Homeland Security's Office for Domestic Preparedness,
a leading regional effort for critical infrastructure protection in the
National Capital Region is being lead by George Mason University. This
effort is part of a broader set of NCR initiatives being orchestrated
by the Mayor of DC and Governor's of Virginia and Maryland under the
auspices of their representatives on the Senior Policy Group in
partnership with community leaders.
The Urban Area Security Initiative (UASI) is a program that helps
develop sustainable models to enhance security and overall preparedness
to prevent, respond to, and recover from acts of terrorism in high-
density population centers. Specifically, UASI was created to ``enhance
the ability of first responders and public safety officials to secure
the area's critical infrastructure and respond to potential acts of
terrorism. Initially, seven metro areas were identified: New York City,
Washington, D.C., Los Angeles, Seattle, Chicago, San Francisco, and
Houston. For the 2004 fiscal year, this number increased to 50, now
including smaller cities such as Orlando, Florida, and New Haven,
Connecticut.
For the National Capital Region, a strategy was developed to
provide a strategic direction for preventing and reducing vulnerability
in the region. The strategy was developed based on a number of inputs:
the results of an assessment completed by communities in the National
Capital Region in July 2003, the National Strategy for Homeland
Security, the Eight Commitments to Action for the National Capital
Region, and the State Template published by the Homeland Security
Council. The Strategy focuses on four areas: planning, training,
exercise, and equipment. George Mason's activities fall within the
planning area.
The grant from the Department of Justice Community Oriented
Policing (COPS) program, complementing the efforts undertaken through
the UASI initiative, focuses on the telecommunications, water, energy,
and transportation sectors in the Commonwealth of Virginia.
In cooperation with five universities, including James Madison
University, the University of Virginia, Virginia Polytechnic Institute
and State University (Virginia Tech), the University of Maryland, and
Howard University, the NCR Critical Infrastructure Vulnerability
Assessment Project focuses on improving regional and sectoral
methodologies for conducting vulnerability assessments. The ultimate
objective of the project is to raise the level of security in the
National Capital Region by ensuring that critical infrastructure
sectors address the most important security concerns. The project seeks
to enhance the capability and capacity of the National Capital Region
to reduce vulnerability, minimize damage and increase resiliency. In
addition to the regional universities engaged in this initiative, GMU
is also working collaboratively with industry and government.
The Virginia Alliance for Secure Computing and Networking (VA SCAN)
The Virginia Alliance for Secure Computing and Networking (VA SCAN)
is a partnership of universities that seeks to strengthen information
security programs within the Commonwealth of Virginia. The partnership
includes security professionals from George Mason University, James
Madison University, the University of Virginia (UVA), and Virginia
Polytechnic Institute (VA Tech) as well as researches and staff from
the Institute for Infrastructure and Information Assurance (3IA) at
JMU, the Center for Security Information Systems at GMU, and the joint
GMU/ JMU Critical Infrastructure Protection Project (CIPP).
Representatives from other Virginia institutions, including Mary
Washington College, Radford University, The Virginia Institute of
Marine Science, The College of William and Mary, Virginia Commonwealth
University, and the Virginia Military Institute serve as advisors to
VASCAN partners.
VA SCAN began offering products and services in March of 2003. The
offerings are based on the principle that the most lasting improvements
to security programs can be made not by performing security functions
for organizations, but rather by educating and guiding management and
staff teams in defining and carrying out their own security strategies
and operations. Some of the products and services offered include:
A Virginia--Critical Infrastructure Response Team
(CIRT) group for tracking security threats
Self-assessment checklist for Commonwealth of Virginia
security standards
Security policy development and security awareness
training
Onsite training and security instructional materials
Onsite consulting on a variety of security topics and
an ``ask the expert'' email service
Web-based toolkit of security tools and best practices
Concluding Remarks
Mr. Chairman and members of the subcommittees, Virginia and all the
states represented by NASCIO are moving forward in the context of
protecting critical infrastructures from physical and cyber
vulnerabilities. This effort is requiring new ways of thinking and new
types of relationships between public federal and state efforts. Much
progress has been made but there is much more to do. I enjoy a close
working relationship with Virginia's homeland security team, state as
well as local, as well as the leaders of the federal efforts at DHS. I
know that we do not have all of the answers and we frankly do not have
all of the questions. But we know that protecting our critical assets
from cyber and physical threats is key to ensuring the safety of
Americans and protecting our economic security.
In conclusion, my message to you is that, despite the continuing,
daily attacks on our nations information infrastructure, cybersecurity
is still seen as a secondary threat, and the interdependence of
federal, state and local systems absolutely require a closer, more
cohesive approach. Secondly, we are encouraged by the organization and
leadership at DHS to move smartly and timely with the assistance of
their state and local partners, and in particular, the recent re-
evaluation of the ISAC approach and the new opportunities for effective
change that represents. NASCIO will do what it can to assist by working
with DHS's ICD and NCSD divisions to arrive at the most effective
approach, and also by developing the state and local addendum to our
National Strategy.
Let me take a moment to thank Robert Liscouski, Assistant Secretary
for Infrastructure Protection, DHS; Jim Caverly, director,
Infrastructure Coordination Division; Amit Yoran, director, National
Cyber Security Division; Steve Cooper, chief information officer, DHS
and George Foresman, Virginia's Assistant to the Governor for
Commonwealth Preparedness for all that they do towards our common
goals.
Mr. Chairmen, I thank you and the members of your committees for
the opportunity to testify before you today.
Mr. Thornberry. Thank you. Some very good points.
I yield to Chairman Camp.
Mr. Camp. Thank you, Mr. Chairman.
I appreciate both of your testimonies here this morning.
Assistant Secretary Liscouski, obviously we are very interested
in the role of the ISACs or the Information Sharing and
Analysis Centers in being a link to the private sector in terms
of infrastructure protection. I wonder to what extent you feel
that they have fulfilled their expectations. Do you still view
them as the primary public-private partnership link? To that
extent, I know that under your authority there is a significant
budget for public outreach, nearly $50 million. It is my
understanding none of that has gone to the ISACs. I think a
little bit of funding might help them in their role.
So I am really interested in to what extent you consider
their role important, and still that key link.
Mr. Liscouski. Mr. Chairman, thank you for the question,
and to the point about the partnership with the ISACs. We view
them as critical, along with the other sector-specific agencies
and the sector coordinators, to ensuring that we have not just
the good links to the private sector, but most importantly the
information coming back into DHS to understand what their
concerns are.
Let me just take a moment to address your question by just
taking a step back for a second to say that we recognize that
when PDD-63 was established, the direction the ISACs were going
into was a very good direction, but there was very little
leadership from the private sector to step up to really help
guide those ISACs to provide to the government what their
requirements were.
When we established DHS and I became responsible for those
ISACs, and particularly based upon my private sector
background, it was clear to me that the model we had to change
had to be one which was much more of a private sector-led
model, rather than a government-led model. To that end, and it
is a philosophy we live by today, we established a capability
within my organization for Infrastructure Protection, and
specifically with the Infrastructure Coordination Division, to
be that central point of contact for us into the ISACs; to
establish the links, to formalize those links, but most
importantly to develop or receive the requirements back from
those ISACs.
Based upon that, we developed our fiscal year 2004 funding
profile to ensure that the funding stream that went to the
ISACs met their initial requirements and their evolving
requirements. So we set aside $16 million for outreach that
would be used to assist the ISACs in developing and forming
themselves, as well as assisting them in their communications
capabilities. To date, we have spent approximately $6.5 million
to support the ISACs in the form of creating a common
communications mechanism under the Homeland Security
Information Network, which is a common platform for
communications which we are rolling out to the ISACs, which
effectively provides a no-cost entry for companies to form an
ISAC and then gain access to this information, as well as other
outreach efforts to include administrative support and research
support vis- -vis George Mason University's Critical
Infrastructure Protection Project, which is something we also
fund.
We have been working with the ISACs. Specifically back in
December, we had an ISAC sector summit in which we solicited
from the ISACs their very specific requirements for how they
thought they needed to be funded and where their funding
priorities are and where they remain.
Mr. Camp. What do you think the principal challenges are in
having the ISACs reach their fullest potential?
Mr. Liscouski. It depends upon the ISAC. It is not a one-
size-fits-all model. I think the expectation we have is that we
really need their requirements to be well defined as it relates
to both information sharing on the two-way street. I think we
have overcome many of the big challenges, for instance the
establishment of the ISAC Council, which as it relates to the
ISAC is our point of entry into the broad ISAC community to
make sure we get collective thought well represented back into
the government so we understand what those needs are. That is
one challenge we have overcome.
I think the other challenge is them defining specifically
what their requirements are in terms of not just linking up
with DHS, but most importantly conveying to us what their
information-sharing requirements are.
Mr. Camp. I think one of the critical things is the
coordination of risk assessment by DHS. I think that is
probably one of their most crucial roles. It appears as though
there are multiple requirements for risk assessment depending
on the agency, TSA or Coast Guard, or whatever. What steps are
being taken to resolve this overlap and multiple levels or
layers of risk assessment that really can be an undue burden on
the private sector?
Mr. Liscouski. I agree with that statement. As you know
when DHS was formed, TSA had already been in existence and had
been moving out in its effort very, very aggressively to try to
connect up with the private sector; similarly with the Coast
Guard going out and doing what they were doing; similarly with
Secret Service and others.
So we immediately began to coordinate the efforts for
critical infrastructure protection and come up with common
vulnerability assessments and risk analysis and capabilities
that could be spread across the entire spectrum. Over the past
year, we have been working on that, but we have really been
able to even more consistently address this through the
implementation of the Homeland Security Presidential Directive
Number Seven, which has really given us the impetus to bring
together all the various Federal agencies, not just within DHS,
but across the Federal Government, to understand these programs
and what their priorities are and how each respective sector-
specific agency is going to be addressing those priorities.
That is a normalization effort that we are currently engaging
in right now.
Mr. Camp. OK, thank you. I see my time has expired.
Mr. Liscouski. Thank you, sir.
Mr. Camp. Thank you, Mr. Chairman.
Mr. Thornberry. Thank you.
The gentlelady from California, Ms. Lofgren.
Ms. Lofgren. Thank you, Mr. Chairman.
Just a note, we have both Secretary Ridge and Secretary
Powell downstairs in the Judiciary Committee, so even though I
am very eager to hear what you have to say, I may be bopping
down there in the near future.
I hate to be a nag, but I am going to complain again, Mr.
Liscouski, about the lateness of your testimony. The committee
rules require that testimony be submitted 48 hours in advance.
Once again, yours was received last night at 7:04 p.m., as a
matter of fact is when we go the email. It is just not
sufficient time for the committee members to review the
testimony. There is a reason for the rule and I think it is
offensive for the whole committee. I hope that that is the last
time that this occurs. It is just not acceptable to me. I hope
that that will not occur again.
I want to ask a broad question, if I may. We need a
comprehensive risk assessment of our nation's critical
infrastructure. It seems to me that that has not yet been
completed. I would like to know when the comprehensive critical
infrastructure risk assessment will be completed. Specifically,
I would like to know who within the IAIP is in charge of this
risk assessment work. I would like to know the number of
employees that are assigned to its production and the number of
contractors and the number of detailees, the specific dollar
amount that is assigned to produce this analysis.
I would like to note that I have a number of questions. We
probably will not be able to get through with them. In the
past, we have submitted questions to the Department and
generally we never get answers to them from any of the
witnesses, including yourself. So I would like a commitment for
those questions that we cannot get through that we actually
will get written responses from you. I will not hold you
accountable for our friend Asa Hutchinson and the others who
have not responded, but I hope that the answers can be prompt.
And if you could address the questions that I have asked
now, I would be very appreciative.
Mr. Liscouski. Yes, ma'am. I apologize again for the
lateness of the submission of the testimony. With respect to
the questions that you just referenced, I know I personally
reviewed questions that you have submitted to me, so I know
that they are a work in progress and we will check on what the
status of those is so you can get them in a timely way.
With respect to the comprehensive risk assessment, as I
have said prior when I have appeared before this committee and
others, that is an ongoing process. If we do our job right, and
I know this can be taken out of context, we will continuously
revise that list. We have over 33,000 assets identified in our
national asset database, for which we are doing analysis on
those risk assessments and continually updating those things.
As you are aware based on my previous testimony, the
interdependencies between all those assets continuously change
based upon the threats. So we will never be satisfied based
upon the evolving threat environment, that we should sit back
and say that because we have done one risk assessment for one
particular asset, that we should not go back and revisit that.
So that is a continuous process.
I know it is a difficult thing, but the enormity and the
complexity and the scope of our critical infrastructure
protection mandates that we continuously revise and review our
risk posture and the changing threats, both of group
capabilities, as well as their intent. second, this is not just
a DHS effort, but this is a Federal Government as well as a
state and local and a private sector effort. So many of those
things over which we have responsibility, we do not directly
control and therefore our ability to get fidelity in the
comprehensive listing of all the assets is dependent upon the
cooperation we have with the various entities who play in that
space.
Homeland Security Presidential Directive Number Seven gives
us a significant leg up on our ability to coordinate these
activities within the Federal sector. So it is not just DHS in
the context of TSA and other responsibilities that Under
Secretary Hutchinson may have, as well as my own group, but it
is clearly those within DOT, Department of Agriculture, HHS,
and others, which have similar types of responsibilities.
So this is a national problem, as you well know, and not
just a Federal problem. So I would suggest to you that we are
working extremely hard and we have made significant progress
over the past year in really aggregating a list. That has given
us a very clear understanding of the major priorities that we
have to address and we are addressing those priorities.
Ms. Lofgren. If I could, we do understand that we are not
going to come up with a list and then never revisit it.
Obviously, it is an ongoing process. Am I to understand from
your testimony that the critical infrastructure risk assessment
has been completed and now it is a matter of updating it? Or if
not, what are the milestones?
Mr. Liscouski. The milestones are the outreach program that
we have with the state and local and Federal sectors. We have
tasked them specifically to identify what they believe are
critical, based upon the definition in the Patriot Act, which
is what we always go back to, to ensure that we have clarity of
what that list is. Oftentimes we find that what we have done to
identify critical assets in the United States and what the
states and local municipalities and cities have done often do
not reconcile. So we spend a significant amount of time
reconciling those assets, doing the consequence analysis and
the impact of attack on the exploitation and vulnerabilities of
those assets. So no, ma'am, it is not complete, but much of
that is outside the control of DHS per se, but based upon the
input that we get from folks in the respective jurisdictions
that you all represent, as well as other Federal agencies.
Ms. Lofgren. My time has expired, but I would ask that you
respond to me. By the way, you did not give me the number of
employees and detailees.
Mr. Liscouski. I would be happy to get back to you in
writing, if I may.
Ms. Lofgren. If you could also provide a list of what you
have prepared, the milestones that you have achieved, your
timelines for the rest of it, and then to the extent that there
are departments that you are dependent on that have not
actually produced, list them and tell us what they have not
produced so that we can then inquire with them. I think that is
essential.
Mr. Liscouski. I think it is. Let me just level-set the
expectation here. We are asking questions for which are not
quite sure what the answers are necessarily. I could ask each
one of the Representatives for input on what they think is
critical. There might be things in there that you know about,
that I do not know about. So I am asking a question on which I
am totally dependent upon the folks at the local level for the
answers.
So to suggest that there is a finite number of assets over
which I have some clarity in terms of a number, then I can
measure a milestone that I am at the 80 percent level or the 90
percent level, to be quite candid with you, is a little
unrealistic. We do not know all the assets out there.
Ms. Lofgren. My time has expired, Mr. Chairman.
Mr. Thornberry. Thank you.
The gentlelady from California, Ms. Sanchez.
Ms. Sanchez. Thank you, Mr. Chairman.
Thank you once again for being before us. I know that we
had an opportunity, Chairman Cox and Chairman Camp and myself,
to sit down with you about two or three weeks ago to discuss
this whole list of 1,700 critical sites. I did gain a lot of
information, but we were the only ones, and I know some of it
is secret information. But I think for the ability for some of
the committee members here today, if you could share with us
what intelligence or other information is used to determine the
priorities by which you are putting these critical pieces of
infrastructure on this list that you are working on.
Once the infrastructure is prioritized, what happens to it
when it is on this list? I know that you and I talked about how
you discuss this with local law enforcement, where this
critical infrastructure might be, and that they then are
supposed to approach in particular private businesses. Can you
tell us how that is going? How do you follow up on whether
anything gets done? Maybe some private business does not really
respond to local law enforcement when they come forward and say
you need to secure this particular area in a better way, and
here might be some ways in which you could do that. Have you
provided assistance to these local law enforcement agencies to
help them get that job done, of implementing it on the ground?
Mr. Liscouski. Thank you for your question. I always enjoy
the opportunity of explaining this methodology. Just to
underscore the complexity of this effort, in working with the
private sector and our colleagues on the state and local level,
we have developed a methodology which we are putting out as
widely as we can in terms of best practices, of understanding
what those risks are and how to assess those risks.
When we come up with a prioritized list, it is typically
based upon a five-step process. The first step in that process
is clearly identification of those assets, those things that
need to be protected. Although that sounds like a very simple
thing to do, it is who owns those things, and really what is
the definition that we are putting around that infrastructure
component, what are the interdependencies. There is a
significant amount of analysis that goes on to the front end of
this process to identify the asset.
Ms. Sanchez. And you are doing this? Or are you using the
state and local people's input into these assets in trying to
understand what they are?
Mr. Liscouski. It is actually all of that. It is DHS. It is
our state and local partners. It is the private sector. This is
a highly interdependent process. The second step in that
process is clearly understanding the vulnerabilities, what can
be exploited. The third part of that process is understanding
the consequence of the exploitation of that vulnerability. The
consequence analysis is based upon a number of factors, not
least of which is the consequence of loss of life or economic
impact, or the threat to our national security.
That gives us a prioritization around then what do we need
to be looking at first, independent of a threat environment,
because there are many different continuums upon which we have
to operate. But the baseline, the sort of steady-state
continuum that we operate under is one which is an absence of
threat. So we look at one from a vulnerability and consequence
of loss perspective.
The fourth step in our process is understanding what
programs we have to put out around to remediating or mitigating
those vulnerabilities. The fifth step, which if you asked about
challenges, is the most challenging. That is the metrics
component, the output, the output of understanding not just
what programs are being implemented to address those
vulnerabilities, but are they actually being implemented. More
importantly, are they being implemented well enough to address
the vulnerabilities themselves.
Then we layer on top of that threat information. So as we
get a better understanding of what vulnerabilities are, we then
understand how groups can exploit those vulnerabilities based
upon their capabilities and their intent, and our ability to
understand from an intelligence perspective who is operating
against us that might be targeting those vulnerabilities in a
particular sector.
That is how we prioritize them. We are actively engaging in
revising that prioritized list to make sure that we can
understand from a threat perspective what we need to address
first. That is done in concert with our counterparts,
particularly in the Information Analysis Division of IAIP and
other members of the community, and then clearly with the
ability to understand what is going on at the state and local
level from their priority perspective.
One part of your question also addressed what are we doing
to help state and locals. That becomes a part of what their
capabilities are. We find out, again, the rising tide, so to
speak, of DHS does not float all the boats. We have to ensure
that we can address some specific gaps with the state and
locals, particularly at the local level, again working with the
homeland security advisers in partnership in addressing those
gaps. DHS may provide best practices. We may work with them on
the ODP grant process, or we may go in there, depending on the
specific sector and the specific vulnerability against the
threat, to assist them in training and practical applications
of technology to ensure that we can counter that threat.
Ms. Sanchez. I think my time is up, Mr. Chairman.
Mr. Thornberry. Does the gentlelady have a quick follow-up?
Ms. Sanchez. A really quick follow-up. In looking through
your plans and your goals for this year, I just pulled out an
example. You had in there a desire to send out your team to
take a look at about 270 specific sites with relationship to
chemical possibilities. Of those 270, you have so far this year
visited 17, two of which are now non-active sites. Given that
record, just how far along are you on this plan of identifying
and actually taking a look and making back recommendations?
Mr. Liscouski. Again, thank you the opportunity to address
a misperception. The last number you just addressed, the 17 or
the top-most identified critical sites that we saw around the
United States from a chemical sector perspective, they were
addressed in fiscal year 2003, actually. The ones that we
thought we needed to have the greatest impact on very shortly,
we did that very early on in the creation of DHS. The number
actually of 360 sites we are addressing in fiscal year 2004
through our Buffer Zone Protection Plan. We have been very
aggressively going out there and visiting sites, providing
common vulnerability assessments.
Our assistance to these sites is one which is either a
physical visit, coordinated with state and locals and our
homeland security advisers, in which we will send DHS teams out
to conduct an assessment if we believe it is necessary, or we
will provide other types of assistance, such as common
vulnerability assessments, best practice methodologies,
interaction with them in a way that allows them to bolster
their own security without us having to actually make a site
visit, working with our state and local partners to do the site
visits.
We do not have enough bandwidth within DHS, nor was the
model ever envisioned that we would actually go out and do
assessments for the entire industry. We are working with our
industry partners, with our state and local authority partners,
to ensure that they know how to do vulnerability assessments
and report that information back to us. So we are making very
good progress. I do not have the exact number. I will be happy
to get back to you on that number. But the number for fiscal
year 2004 is on track, and I am putting significant pressure on
my team to make sure they stick with that number.
Ms. Sanchez. Thank you, Mr. Chairman.
Mr. Thornberry. Thank you.
Chairman Cox?
Mr. Cox. Thank you.
I want to thank both of our witnesses for outstanding
testimony. This is a very, very important aspect of what we are
doing. In fact, I think it is fair to say that infrastructure
protection, and IAIP is the heartbeat of this new Department. I
want to thank you, the Assistant Secretary, Mr. Liscouski, and
Mr. Newstrom for helping us focus on this today. Mr. Liscouski,
you and Secretary Ridge, Under Secretary Libutti and all the
men and women of IAIP deserve our congratulations and our
thanks for what you are doing in this critical area.
You have had to build your capability from scratch. This is
not one of the 22 agencies that were merged together to form
this Department. You have had to face enormous expectations
through periods of heightened alert and of course intense
scrutiny from the Congress because there is nothing more
topical or more urgent before the Congress. I think mostly you
get all of this attention because IAIP is in fact the nerve
center of this enormous new Department and you are the heart of
the Department's core mission.
With 85 percent of what we are denoting as critical
infrastructure key assets to preserve our way of life in the
event of attack in the private sector, this kind of
coordination that we are talking about today is just absolutely
important. The ISACs are not creatures of either the Homeland
Security Act or any other Federal statute. To a certain extent,
there is some experimentation going on with this. ISACs are
constructed along an industry model. They are stovepipes in
that respect. They are not cross-jurisdictional. We have other
councils that you are also sharing information with that are
cross-jurisdictional.
I want to ask, as the first of my two questions, whether or
not you think that we should continue this experimental
practical R&D process, or whether it is time for us to
formalize legislatively the ISAC process and fund it. The
second question I have relates particularly to a portion of
your testimony, Mr. Newstrom. You brought to our attention that
you know by way of your work with all the states that other
Federal agencies, particularly those in the Departments of
Justice and HHS, are issuing cyber alerts to their state and
local programmatic counterparts, that these are not
incorporated into the national Cyber Security Division of DHS
alert products. At the same time, there is not an
intergovernmental warning process that focuses everything from
one place in the Federal Government.
You bring to our attention that among others, the 9-11
Commission has emphasized that it is not just how much we know,
but how knows it, that is really important. The vastness of the
Federal Government, complemented by the vastness of all our
state governments, and then the private sector on top of it and
cross-jurisdictional concerns that we have makes this vitally
important.
Mr. Liscouski, you have told us, and I have every reason to
believe you, that DHS is now able to quickly disseminate threat
warnings to identified entities within each sector. It seems to
me that is a very significant accomplishment. The next step is
to consolidate warnings issued by IAIP to a single node for
dissemination to our private partners. The ultimate step would
be to consolidate warnings issued across the Federal Government
to a single node, which the Homeland Security Act contemplates.
I want to ask you both also to address that.
If you could, I hope that you did not forget my first
question. Talk first about whether the ISAC model is one still
under development and whether we ought to consider other
complements to it, or whether we are starting to get a feel for
exactly what we want to do in this area.
Mr. Liscouski. Thank you, Chairman Cox. I will give you my
private sector perspective, if I could, to add some fidelity
around my thinking. I think it is important to understand, as I
said earlier, this is not a government model. This really needs
to be a private sector model.
To your point about the formalization of the ISACs, I think
they are clearly making some very, very good progress in
developing a way that the industries can come together through
the ISAC model. My philosophy that I am providing as guidance
to the implementation of this and working with the ISACs and
the private sector, is one which really puts the onus on them
to define what their requirements are.
For a moment, I just want to digress to talk a little
philosophically about how information flow goes within the
industries, and how the information flow that goes through
industries is oftentimes predicated upon what types of problems
they solve. Because industries themselves, companies themselves
have many diverse problems over which they have to share
information as well. My personal background within aFortune 50
firm that I worked for, was that we often looked at not just
problems of manufacturing processes and the threats that they
might be subjected to. That might require us to go out to one
information pool to figure out how we do that, but then the
supply chain that feeds that manufacturing process might put us
into a different information pool or a different community of
interest. Similarly in the cyber world, that may also put us
into another community of interest; similarly with the HR
world.
We have to provide the capability for the private sector to
align itself with information or communities of interest based
upon their needs. We need to facilitate that process as best we
can. My fear in terms of legislating the ISACs would be from
the perspective of making it more rigid than the process really
should allow. Information flow really needs to be as free-
flowing, and we need to, from my perspective, facilitate
information flow processes. If we put labels on what that
process is at a top level based upon some sector alignment, I
think that is appropriate. If we get too down to a granular
level, we will create artificial stovepipes that will not
facilitate the collaborative process between companies and
between industries that is so necessary today.
Industries create this process irrespective of what the
government involvement is. That is why industry associations
are out there. That is why we do things at a level between
security officers between companies at a very high level to
ensure we have very informal networks for information. I think
the important model here is one that represents a very highly
integrated network model, meaning that if you notice terrorist
groups today operate in a highly networked environment
themselves. They leverage technology to be able to communicate
and develop expertise in areas that they can share in a highly
diverse networked way, which puts the information at the edges
of their organization.
Similarly with information we need to be sharing here in
the private sector, facilitated by the government, needs to be
equally diverse and robust in terms of its flow. It has to be
highly networked, highly capable of changing as situations
change. Frankly, I do not think the government can facilitate
that in any way that would allow us to do anything but create a
stovepipe if we get too involved in the process. I would be
interested in Mr. Newstrom's comment about that.
I think the government's value-added in this process is
relevant information. I think if we can provide information
into the process that allows us to know with some degree of
confidence that the private sector knows what they need to be
doing and they are sharing information and solving the
problems, we have ourselves a successful model.
I think we are going to wind up having to look at this very
carefully. I think you are going to hear on the second panel
today from Diane VanDe Hei how they are implementing their
information-sharing analysis center in an extremely diverse
sector. It is representative here. I think one thing we have to
be careful of is, these sectors are extremely diverse and we
have to ensure that whatever we create today can survive not
just in what we know about current diversity, but emerging
diversity.
I do not know if that answered your question fully enough.
I would be happy to add more, but I do not want to take any
more from Mr. Newstrom's time, but I would be happy to address
this more.
Mr. Newstrom. Thank you, Chairman Cox, for the question. I
was hoping to get away without getting a question. Mr.
Liscouski was doing such a great job in answering the others.
Let me talk about the second part of that question, which
was how it work together; what kind of fragmented information
we are getting right now. As I say that, I also commented about
how it has gotten substantially better. In fact, it has gotten
exponentially better in the last 12 months since the inception
of DHS and the creation of ICD and NCSD. Prior to that, let me
suggest the information flow was fragmented. It was not
focused. Around cyber security, it almost did not exist or it
was sporadic at best.
Now, with ICD, with NCSC, what Mr. Yoran is doing, what Jim
Caverly is doing, it is programmatic. It is institutionalized.
Even better, they have developed a partnership model with state
officials, with local officials as well as the private sector.
It is very apparent that that is the methodology, that is the
direction that DHS is going. So we applaud that direction. We
ask that we continue that direction.
Certainly, there is still some fragmentation that I
addressed in a couple of my comments. I hope that over a period
of time, hopefully of a short period of time, we can even
address those. But I do want to comment that the communications
in the last six to eight to twelve months has been
substantially better than it was prior to that.
Does that answer the question, Chairman Cox?
Mr. Cox. I think what Mr. Liscouski wants to know, let's go
to that question.
Mr. Liscouski. Let me just address how we are trying to
better coordinate. Let me just qualify this as a preface by
saying, I clearly understand that there were gaps in our
information flow in the past. We did not know what the FBI was
sending out. The FBI did not know what we were sending out when
we first got started, as well as all the other agencies. We
addressed that very quickly with the FBI. We have coordinated
alerts going on. We still may send them out independent
channels. The FBI has the responsibility of sending it out to
the state and local law enforcement authorities, over which DHS
does not have domain, and we with the private sector and our
state and homeland security advisers.
We are reconciling the fact that the creation of the
messages that go out now are coordinated and co-developed and
cleared off on by both agencies. That is a step in the right
direction. As Mr. Newstrom pointed out, we still have other
agencies in the Federal Government that are sending out alerts,
and we are reconciling that through the Homeland Security
Presidential Directive Seven effort, which is really
articulating some of the rules of the road, not just the lanes
in the road, of how we need to communicate so we have a good
message.
In the past, I was concerned that when messages went out,
one message said black, the other one said white, to the same
audience from two different senders, that would cause
confusion. Now, we may have two different senders or multiple
senders, but a much more consistent message says white from all
the senders or black from all the senders, so we have
consistency around the messaging.
To that end, and getting more consistency around that, let
me just address a couple of different ways we are doing that.
When it comes to a significant incident, particularly in the
cyber arena, Mr. Yoran has created the Cyber Interagency
Incident Management Group which stands up with not just the
Federal partners, but state and local and the private sector to
address incidents that have to be actively and dynamically
managed. He chairs the Chief Information Security Officer
Forum, or CISO Forum, which is an education and networking
venue for government security executives. Again, it is not just
alerts and warnings, but we are getting consistency around best
practices through that forum, as well as the G-FIRST, the
Government Forum of Incident Response and Security Teams, which
is a 24/7 government-oriented group that does an analysis that
accelerates and enhances an agency's ability to identify a
cyber crisis.
So we have a number of forums, depending upon the
particular audience, that gets more coordination and
centralization of the problem-solving approach and the alert
mechanisms that are going out there. We have work to do, but we
are on the right path. I am confident that as we continue to
move along this path, we will get more consistency, so that
stakeholders like Mr. Newstrom and others will not have to
worry about getting multiple messages from multiple providers.
Mr. Cox. Thank you.
Mr. Thornberry. The Chair recognizes the Ranking Member of
the full committee, Mr. Turner.
Mr. Turner. Thank you, Mr. Chairman.
Mr. Secretary, I continue to be amazed at the challenge
that you face. I sometimes wonder if we are really serious
about carrying out the task that was given in your directive in
the Homeland Security Act, which calls for development of that
national assessment of threat and vulnerability, from which the
Congress envisioned being able to then set priorities for
funding, and also to allow the Department and the government
generally to know where to allocate its resources in terms of
protecting against terrorist attack.
We know the Presidential Directive Number Seven that you
referred to postponed in my view the development of the
identification of the critical infrastructure by at least, as I
can read it, a year, because it says by the end of 2004, you
are required to develop a plan to develop a strategy to
identify, prioritize and protect critical infrastructure. I
know Admiral Loy mentioned on one occasion that he thought this
job ought to be done in a year. You were before this committee
a few months ago. You said 5 years was a reasonable timetable.
When we look at the staff that you have available to you, I
believe you have, if my numbers are correct, about 172 people
on board, with the responsibility of trying to carry out this
task of assessing and identifying our critical infrastructure.
It just seems to me you have a task that really requires you to
come in here and tell us what it is going to take to really get
this job done in a reasonable period of time. I think I hear
you saying to us that you are relying a lot on the ISACs and
the voluntary cooperation of the private sector. That is good.
That is important and I support you in that. But to really do
what the Congress mandated in the Homeland Security Act in any
reasonable time it seems to me it is going to require much
greater commitment in terms of personnel to ever get this job
done right.
I look just at the chemical industry, where you mentioned
you plan to visit, or have identified 360 sites that you think
are at high risk. I think you visited a few of those sites. I
think I saw the numbers here earlier. You have a lot of work to
do. I think I just heard you say you may not even be able to
visit them all. You may rely on our state partners to do that.
I am not even sure we have the authority to go look at those
chemical sites, in terms of getting onto the premises and to
evaluate them.
So you have that responsibility that seems to be virtually
in a posture where you are going to have a very difficult time
accomplishing it in any reasonable period of time. Then you
have this responsibility of trying to solicit information from
the private sector under the Protected Critical Infrastructure
Information Program that you have just issued rules on, which
is supposed to encourage industry to voluntarily tell you about
their vulnerabilities. Yet all I am hearing is that industry is
not satisfied with the regulations and are not sure they can
trust this agency, so they do not know if they want to tell you
anything or not. You have 32 employees dedicated to that
program, with collecting that sensitive information. The budget
is $3.9 million. My notes say that we have only received
information from two companies and two associations to date.
So I really think that what I would like to hear from you
regarding is, what do you really, in your gut, feel it is
really going to take to do this job in a reasonable period of
time? I know it is easy to say, well, I have my budget and this
is all they have given me to do this job and I am going to try
to do it the best I can and put the best face on it I can. But
you are the person there that is in charge of all this. What I
would like to have from you is some candid assessment regarding
what you really need to do to get this job done in a reasonable
period of time. I do not believe you have the staffing or the
capability or the momentum or the support of the private sector
yet to really ever get it done.
Mr. Liscouski. I was hoping you would ask me that question,
because this seems to me a perception we have to kill. The
comment that I made last time, the first time I testified
before you and said it was going to take us 5 years. I think
that was taken entirely out of context. As I stated to Ms.
Lofgren earlier, if we are doing our job right, we will
continually revisit that process. The national assessment of
our critical infrastructure is not just dependent upon what DHS
is doing. It is clearly dependent upon what the state and local
governments are doing; what the private sector is doing; and
our other Federal agencies.
That process has been ongoing and we have created a list.
We started this process back in March 2003 with 160 sites based
upon the Liberty Shield list that we stood up for, the Iraqi
war back in March. We have grown that list to over 1,700 high
priority sites, and a total list of 33,000 sites and are adding
to it daily. We are continuing to add to it because we get a
lot of input from our state and local partners and the private
sector on what is critical and what is not. That list is going
to continue to grow and we are doing assessments, both economic
as well as physical and cyber vulnerability assessments on all
those.
It is a significant amount of work, but I think we are
making very good progress on it. And yes, we are wholly
dependent upon the cooperation we get from the private sector
and state and local government. But I will tell you right now,
the private sector, and this is another perception that if I do
nothing today but tell you how much the private sector has
stepped up to the plate to help us and had been doing this long
before DHS came along, they have been doing a heck of a job.
When I was in the private sector, we regularly cooperated with
state and local law enforcement and the Federal Government to
ensure that we could coordinate and communicate our
vulnerabilities.
So, is there hesitation? Yes, there is hesitation because
it is a trust model that we have to build, but I think we have
a good stab at it. We are doing a very good thing with the
congressionally enacted PCII. Are we getting a low response on
it? I am thankful we are, because we have to do a lot of
marketing and outreach to the private sector to ensure that we
create the right model for them to ensure that they have the
trust model for DHS, but I think the mechanism is there. The
public comment period is still open, which I think will be open
until mid-May.
I am not surprised we had a slow start out of the block. I
was hoping for a slow start out of the blocks because I was
fearful that we would get too much information to be able to
handle it. Thankfully, we have not. So I am very pleased with
the mechanism we have created based upon congressional guidance
to ensure that we could provide better protection for the
private sector based upon their requests. I am confident that
we will continue to grow that program over time.
Let me just go back to the beginning of the question, the
very first question. I would like to take as much time with you
personally to get you to understand our methodology in this
process. The quantification of the metrics that we are trying
to use to get output from the activities that we are engaged in
is one in which there still has to be some research on. When we
look at critical infrastructure protection, there are three
major components against which activities have to be applied:
physical, cyber and people. When we look at the vulnerabilities
that are represented in those broad domains, we very
aggressively identify the assets the vulnerabilities
represented in those assets across each one of those common
themes, from people, physical, as well as cyber. We put
programs to be able to remediate and lower those
vulnerabilities.
But the output and the measurement of what is being done,
and to be candid with you, from a very private sector
perspective, it is not just putting money into the program; it
is making sure we have the right activities going on that can
be consistently measurable and consistently applied over time,
that the outputs can give us good indicators about what is
being done, and not just what is being done and is not being
done, but is it being done well enough to address the threat.
My vision on this, and this is going to take some time
because the technology does not exist yet, is to create a
national scorecard that allows us to identify where are we in a
given sector; how well does it look. Those metrics and that
quantification of these things, which has never really been
done before in the security industry, is something with which
we have been working in the academic and the private sector on
identifying.
So to your point, my goals in terms of what we can do with
this progress and this approach, is precisely to your point:
identifying the key priorities; where do we need to put the
funding stream; identifying who is doing what program and well,
so with our Federal partners in HSPD-7, we are working with OMB
to ensure that we get the metrics outputs to ensure that if a
department has X million dollars placed against a specific
requirement, that they are performing that. And ``performing''
does not mean are they spending money on time; ``performing''
means are they actually addressing the vulnerabilities and
reducing vulnerabilities, and is there a measurable way that we
can identify the outputs to ensure that we get some high degree
of confidence of how well we are doing our programs.
So you are precisely on the right track in identifying what
are the major priorities and challenges here, and that is
exactly what we are addressing. It is not an overnight process.
I am very prideful of the fact that what DHS has done over the
past year has been something that we can measurably identify
how we have addressed the vulnerabilities. It is more than just
a few chemical sites. Across all the sectors, we have done a
great job. The folks working for us, they have really worked
hard and they are working hard. It is not about DHS. It is
about working with all of our Federal partners and state and
local.
So I think the things that we are doing, we can tell a good
story. The biggest challenge we have is getting those metrics
that allow us to in quantifiable terms measure the progress
over time and identify the funding profile that you and your
committee is so concerned about. We are doing the right thing
and we can show what we are doing.
Mr. Thornberry. I thank the gentleman.
The gentleman from North Carolina, Mr. Etheridge.
Mr. Etheridge. Thank you, Mr. Chairman.
A couple of questions. Mr. Liscouski, I am going to start
with you because you talked about the risk assessment
vulnerabilities. Let me ask you one question. You talked
earlier about coordination with other Federal agencies. What is
the nature of the coordination between DHS and other Federal
and state agencies as it relates to developing the national
plan to deal with the appropriate countermeasures to combat
agri-terrorism, which deals with our food supply and a host of
other areas. Can you give us an update on where that is?
Mr. Liscouski. Yes, sir, I can. Recently, another
Presidential Directive, HSPD-9 addressed bioterrorism and
specifically the responsibilities in the agricultural industry
that needs to be addressed by Agriculture and HHS and others
that are partnering up in that space. We are coordinating that
effort again under HSPD-7. I apologize for using these
different directive numbers, but for critical infrastructure
protection, to ensure that we have a holistic look on all the
critical infrastructure sectors.
So in direct response, I would say that this is an area
that we really need to give some very sharp focus to in terms
of not just working with state and locals, but with the Federal
agencies and ensuring that Agriculture and HHS would have
respective leads in this space, and have the appropriate
outreach, the appropriate mechanisms to ensure that the state
and local governments are doing what they need to be doing, and
they are facilitating that process.
Mr. Etheridge. I do not want to interrupt you, but do you
have a timeline?
Mr. Liscouski. A timeline for?
Mr. Etheridge. Completion, or at least a marker of where we
can work from. This happens to be very important, because it
fits what you talked about and deals with our food supply, not
only here, but internationally in what we ship.
Mr. Liscouski. That specific plan is in process. I cannot
give you an accurate timeline at this point because that plan
is in process. I am afraid whatever I tell you today is going
to be inaccurate.
Mr. Etheridge. Would you get back to me?
Mr. Liscouski. I welcome the opportunity.
Mr. Etheridge. Let me follow that up, because it follows
that same thinking to some extent. I will not ask that
question, but I will just put it in so you can follow later,
because it deals with, several years ago we had a problem with
our school lunches and the food supply and the problems that
fell out from that. Let me ask what DHS is doing as it relates
to, you said earlier, its products, facilities and people. We
have seen in just the last couple of days what happened in Iraq
with the bombing that took place there and a number of school
children were killed. Can you tell me what is being done or
what coordination is being done as it relates to our schools if
a terrorist attack should hit?
Because we are looking at millions and millions of children
in this country who go to school every day. Many are in
buildings, but a large number now find themselves in what we
call makeshift trailers. I hate to call attention to it, but
there is a tremendous problem because they are isolated. What
is being done? Has any assessment been done as to the
comparability of protection within a brick and mortar building,
to students who happen to find themselves, along with staff, in
an isolated makeshift structure?
Mr. Liscouski. Yes, sir. I can address that specifically.
We have been working with the Department of Education, which as
you know has a significant outreach capability broadly across
the United States in K-12 as well as the university system. We
met recently with Under Secretary McPherson and Deputy Under
Secretary Price to incorporate them into our planning for HSPD-
7, to directly ask them for their plan. In fact, we are working
very collaboratively with them.
As you know, the education system is not identified as one
of the critical infrastructure components of the Homeland
Security Act, but we have the latitude of identifying other
sectors as necessary. That sector is being addressed both
directly and indirectly through my office's Soft Targets
Branch. We regularly look at soft targets, which schools are
one of, to address those specific types of requirements.
I cannot tell you specifically if we have looked at the
analysis in the school environment of the impact of a trailer
versus brick and mortar. I know we have done that in others.
Mr. Etheridge. Would you follow up on that?
Mr. Liscouski. I certainly would, sir.
Mr. Etheridge. I appreciate it.
I know my time is almost up, but Mr. Newstrom, I have one
for you. As Virginia's Chief Information Officer, what specific
support would you expect from DHS or other Federal agencies,
for that matter, if you computer system was attacked and was
down for more than several days, and you were out of business,
knowing that you have to have an off-site facility, but let's
say it was damaged and out of space. Do you think the Federal
Government could give you the expectations that you have? If
so, what would you like to see us do?
Mr. Newstrom. I am not sure that we look toward the Federal
Government in that specific scenario. We have established
backup plans. We have established backup facilities. We have
been redundant in those facilities and those plans. We work on
and practice those plans. We also go to the private sector to
ensure that we have not only internal Commonwealth resources
that are backups and redundancies, we also have backup with the
private sector.
From a Federal Government perspective, what I would see if
there is a catastrophic outage in a region of the country. For
instance, if there is an electrical outage; if there is a major
telecom outage; I would ask that our resources work together
very, very closely on that. But on the normal outages that you
described, I think it is our responsibility to address those.
Mr. Etheridge. Thank you, sir.
Thank you, Mr. Chairman.
Mr. Thornberry. I thank the gentleman.
The Gentlelady from the Virgin Islands, Mrs. Christensen.
Mrs. Christensen. Thank you, Mr. Chairman.
I want to welcome our witnesses this morning. I have a
concern, as I always do, about where health fits into the
picture. My first question would go to Mr. Liscouski. We had a
hearing or a briefing about a month ago on ISACs. At that time,
health was not established. In the GAO report which we will
hear about in a little while, health is not listed. I am
assuming that is because it is not established.
Where are we? Is health not a priority in this area? Has
something happened between the last briefing and today?
Mr. Liscouski. Yes, ma'am. I think the ongoing work that is
in progress there is that we have been working with the general
health sector, both within HHS and with the other more diverse
components, to establish their ISAC. It is a work in progress.
It has not been listed by GAO, nor is it on our list because it
is a work in progress. We do not believe we have consensus
around who establishes what. I recall from my notes, and
forgive me, I am not going to go through them, but I believe,
as you well know, it is one of the more diverse communities in
which to work. One of the challenges is establishing leadership
in that community within one particular organization for the
ISAC.
My sense is, and I would be happy to correct this later in
subsequent research to get back to you in writing, but my sense
is because it is so diverse we may wind up creating many sub-
components of the ISAC, which may be aggregated up into one
larger health ISAC. It is clearly on our radar screen as a
priority, ma'am. So I just indulge you to not make a judgment
that it is not a priority for us. It is.
Mrs. Christensen. OK. Is there lead responsibility in the
Department? Has that been identified? Or the divisional
responsibility within DHS?
Mr. Liscouski. The Infrastructure Coordination Division, of
course, has the coordination requirement. Under HSPD-7, the
sector-specific agency is HHS. Correct me if I am wrong on
that. I should know this off-hand. But there is a sector-
specific agency established under HSPD-7 for the health sector.
We are working with them to ensure that we have the sector
aligned and coordinated to establish the ISAC.
So to answer your question, yes, ma'am, there is a sector-
specific agency responsibility for health.
Mrs. Christensen. OK. Mr. Newstrom, is health fully
integrated into NASCIO's program within the State of Virginia?
Mr. Newstrom. Health?
Mrs. Christensen. The health sector.
Mr. Newstrom. It is fully coordinated and integrated right
now. We are still working with HHS particularly on some of the
communications capabilities through the states. They have a
very good program within their sectors, but it is very
programmatic. We are encouraging HHS particularly to focus
through NCSD to channel their communications to the states. Our
entire issue is fusing the information, rather than the
stovepipes that Mr. Liscouski has talked about.
Mrs. Christensen. OK.
Mr. Liscouski, you have said that there is a great reliance
on the private sector in the development of the assessments,
and 85 percent of the assets are owned by them. Are there any
inherent conflicts between the objectives of the private sector
and the objectives of government and the Department that have
been identified, that had to be resolved as this process has
been developed? And how did you resolve them?
Mr. Liscouski. No, ma'am. I think the biggest challenge we
have had is on the information-sharing side, with the
vulnerability assessments back from the private sector and back
into DHS. That is what is being addressed through the Protected
Critical Infrastructure Information Act, the implementation of
that.
As I pointed out earlier, to make a general statement, and
you can always find exceptions to this, but the private sector
is stepping up to the plate of their responsibilities to ensure
that they understand what is vulnerable for them and in sharing
that with state and local governments, those who are
responsible for protecting, and ultimately with DHS. So again,
just to reiterate, I believe the one challenge which I think we
are addressing is the information sharing between the private
sector and DHS.
Mrs. Christensen. OK. My last question, and you have
probably been asked this both at the budget hearings and in
several different ways here today, but you said you do not have
sufficient bandwidth to do the assessment. That is why the
private sector is really responsible for doing that and getting
that information to you. Other testimony says that DHS has
limited resources. We have seen very close progress. A lot of
the questions have been around when is the assessment going to
be in place. You have said the synchronizing and harmonizing of
disparate parts is something that is still ongoing, and getting
a complete situational awareness picture is something that you
are still working on.
The Department has the primary responsibility for the
protection of our critical infrastructure. I am just concerned
that if these limitations exist and that we are not getting the
full picture of what you really need in your budget to ensure
that you are able to carry out the mandate of your directive
and the Department.
Mr. Liscouski. No, ma'am. I need to correct your statement.
I do not mean to be presumptuous, but the comment I made about
sufficient bandwidth is not relevant to do we have the
capability and the necessary resources. We do. You could give
me more money. It is not a money issue. What it is is that the
information that has to be collected is not about what DHS can
do. Nor would I suggest to you that this is a responsible role
for the Federal Government to do it all. The Federal
Government, and this is a national problem, you would not
create a mechanism as big as you would need to collect all the
information you want.
So the appropriate approach is the one that was created
with the Department of Homeland Security, which is clearly a
coordination-collaborative approach with our state and local
partners, with other Federal agencies to ensure that we can get
them to do what they have to do. That is precisely what we are
doing. It is leverage. It is not about bandwidth, necessarily.
What I meant about bandwidth is all the things that would scope
into that, time, and the enormity of the complexity of the
task.
This is not, do we need to have more resources at the
Federal Government level to do all this work. This is about
working with our partners and our stakeholders to get them to
do what they need to be doing. That is the essence of this. At
the end of the day, the questions and the concerns we need to
be addressing here are developing and creating consistent
sustainable programs which are effective and measurable over
time, that can answer the big questions of, are we protecting
what we need to be protecting? And are we really doing it well?
That is the process we are developing. Again, level-setting
the expectations here, this is not going to happen overnight.
If I had a magic wand, if you all could tell me if there is one
thing you could give to me that would allow me to do my job
better, it would have to be a want that I could just broadly
push across the United States and say, it's protected. But it
is a process. It is a process because our economic system and
everything we have built in this country is predicated on being
open. Our openness which is our greatest strength is our single
biggest vulnerability.
So it is an enormous thing to address. It is not about what
DHS can do. It is about mobilizing the American public. It is
about engaging with the private sector and the state and local
governments to ensure that we all know what we have to do and
we can measure it in a way that we can tell with confidence
that we are doing the right thing.
So again, I just want to correct a misperception I have
created, which is not about do I have enough resources. It is
about we all have to mobilize at all the levels of Federal and
state and local governments to do the right thing.
Mr. Thornberry. I thank the gentlelady.
The new member of the committee, the gentleman from
Kentucky. Welcome. You are recognized for 5 minutes.
Mr. Chandler. Thank you, Mr. Chairman. It is nice to be
here.
Mr. Liscouski, thank you for your testimony. Thank you for
being here today. I am interested in some information regarding
our efforts to protect and secure critical Federal facilities.
For the past several decades in Central Kentucky, our citizens
have lived next to a potentially dangerous chemical weapons
stockpile. This is the Bluegrass Army Depot near Richmond,
Kentucky. It contains well over 500 tons of chemical weapons,
nerve gas, mustard gas, that sort of thing.
In 1988, in its environmental impact statement, the
Department of the Army identified that in a worst-case
scenario, an incident that would occur at this depot could
result in plus or minus 15,000 fatalities in our area. So you
can imagine that this is something of great concern to us.
What I would like to know is what type of information-
sharing activities are occurring right now between the
Department of Homeland Security, the Department of Defense,
state and local governments, first responders, all those folks,
to ensure that we prevent and are prepared to respond to an
accident or a deliberate attack on facilities like this one,
Federal critical infrastructures.
Mr. Liscouski. Sir, you pointed out a key stakeholder in
your question, and it is the Department of Defense which has
responsibility for the defense industrial base and the supply
chain that feeds that, and that is clearly a component of that.
But we partner up very closely with DOD. They have a very
robust capability on critical infrastructure as it relates to
their facilities. Their partnership with state and local
governments is something we have integrated our efforts with,
as well as our response and recovery efforts.
I can speak to them at a top level. As you well know, that
is outside my directorate, but working with state and local
first responders under the directorate for EP &R, I do not know
if exercises have been held directly in that jurisdiction, but
I can get back to you on that.
Mr. Chandler. If you would, please do. That was another one
of my questions, whether exercises would be held. I do not
believe that they have been. I am very curious to know whether
there are plans in the works to hold exercises to make sure
that our folks are ready.
Mr. Liscouski. Yes, sir. I would be happy to get back to
you on that.
Mr. Chandler. I appreciate that very much. You all are
working with the Department of Defense, though, on these sorts
of issues; working very closely, but as I understand it, you
are not aware of precisely what has been going on.
Mr. Liscouski. At that particular site, sir, I do not know.
I cannot tell you that specifically. I would be happy to get
back to you on that one.
Mr. Chandler. OK. If I may just add one other question. You
may want to get back to me on this as well. If there was an
attack on that depot, we have already in place, and this is a
team that pre-dated the creation of the Department of Homeland
Security. It is the 41st Weapons of Mass Destruction Civil
Support Team. It is based in Louisville, Kentucky. It is
currently responsible for responding to a disaster at that
facility. I am interested in knowing whether DHS has gone back
to that team and checked on working out some sort of
information-sharing arrangement with them.
Mr. Liscouski. Sir, I will have to get back to you on that.
Mr. Chandler. OK.
Mr. Liscouski. Thank you.
Mr. Chandler. Thank you very much.
Mr. Thornberry. I thank the gentleman.
The gentleman from Maryland.
Mr. Cardin. Thank you very much, Mr. Chairman.
Let me thank both our witnesses for their testimony here
today. I find it very informative and very helpful.
I want to talk about the National Capital Region for one
moment, if I might. Tomorrow, the House of Representatives is
going to be talking about the continuity of the House of
Representatives in the event of an attack against us. I have
many concerns about how well we are prepared in the National
Capital Region itself. I know that there are committees that
have worked on it. I know there is cooperation between Maryland
and Virginia and the District of Columbia and the Federal
Government. I am concerned somewhat that I believe the region
that has been included in the studies are somewhat small, with
a restricted number of counties within Maryland and Virginia. I
represent Annapolis. I represent Baltimore. I know that there
is an episode that occurs at a chemical plant in Baltimore and
it will have an impact on the National Capital Region. I know
that on any given day trying to get out of the nation's capital
is a challenge. If we have a national emergency, it is going to
be impossible.
I just want to get some assurances from you that clearly
progress is being made here as to how we can prepared. We know
that this is the seat of government. We know that it has been a
target of terrorist attacks. We know the tremendous interests
of this area in disrupting our government. So can you just
share with us as to what special considerations are being made
in regard to the National Capital Region and how it is
affecting the surrounding jurisdictions beyond just the
immediate counties in Virginia and Maryland that are directly
working with you.
Mr. Liscouski. Sir, I appreciate your question. I am going
to have to defer to Under Secretary Mike Brown who is
responsible for the response requirements through the NCR. I
can tell you just based upon my level of understanding and
engaging on the critical infrastructure protection side, that I
have knowledge that there are regular exercises being conducted
throughout this region, which address some of the concerns you
have. But to give you more confidence, I just request to defer
that to Under Secretary Brown for a response.
Mr. Cardin. Let me bring you into this discussion, because
you are making assessments of the nation's infrastructure
sensitivities and priorities. I would just urge you that the
Federal facilities located in the National Capital Region and
surrounding areas are particularly vulnerable. The stress on
local governments is particularly great. The chemical plants in
Baltimore present an extra challenge. All chemical plants
present challenges. The fact that it is located close to the
nation's capital makes it an even more sensitive target. The
Federal facilities located in Annapolis or located along I-95
close to the nation's capital are particularly vulnerable
because of location.
As you are making your national needs assessment, is
location, those types of considerations, going into the
equation as to the type of fences that we need to put in place?
Mr. Liscouski. Yes, sir, it is. We have been doing a lot of
work, as you are probably well aware, with state and locals
here in the National Capital Region, doing the assessments for
the various infrastructure components to include the Federal
facilities. We have I think a robust capability there in
understanding not just what we have to do to protect, but the
actual protection of those facilities has been equally as
robust.
So yes, sir, to answer your question, we are working very
closely with the state and locals. We understand that there are
some limitations. We are trying to supplant those limitations
through the ODP grant process, but we are working very closely
with them. So from a protection standpoint, we have very good
clarity around the vulnerabilities that are here, as well as
the protection requirements that are needed to mitigate those
vulnerabilities.
Mr. Cardin. Did you want to respond?
Mr. Newstrom. Congressman, in my written remarks I address
the NCR specifically. In addition to what DHS is doing, the
Governors of Virginia and Maryland and the Mayor of the
District of Columbia have met together on this specific
subject. In fact, because of funding through and by DHS, we
have an initiative called the Urban Area Security Initiative,
which specifically focuses on the National Capital Region and
first responders. We have come a long way since 9-11.
Mr. Cardin. I was just going to point out that the concern
we have with that is it s the restricted jurisdictions that can
participate within Maryland and Virginia. When you look at
trying to evacuate people from the nation's capital, you need
to look beyond just the immediate counties in Maryland and
Virginia. As you look at protecting infrastructures, you need
to also look beyond those counties.
If you live in Anne Arundel County, Maryland, where many
people commute into Washington, D.C. or you live in Frederick
County, you are very much impacted also. We are concerned that
there is a limited interest and it needs to be expanded.
Let me let you continue on that.
Mr. Newstrom. Congressman, you are absolutely right. I
could not agree with you more. In fact, the initial steps were
originally around communications and the lack of ability by
policing entities from the different jurisdictions to be able
to communicate during and after 9-11, including the military.
So that was addressed very, very early. But around
transportation and the issues that you bring up, we are still
in the infancy stages of trying to define that.
Mr. Cardin. I would just urge you to give it a higher
priority.
Thank you, Mr. Chairman.
Mr. Newstrom. Yes, sir.
Mr. Thornberry. I thank the gentleman.
The gentleman from Washington.
Mr. Dicks. Thank you.
Mr. Liscouski, I am very concerned about something. It is
my understanding that your directorate has compiled a critical
asset target list for each state, and forwarded that list to
each state's primary point of contact to begin planning
security enhancement activities. I have reviewed this list of
critical assets in Washington State and I am deeply concerned
by several obvious omissions that fit well within the criteria
presented.
I have discussed this issue with my state's homeland
security adviser, who has told me that there was very little
opportunity for comments and revisions coming from the state
and local level. It is absolutely imperative that a list of
critical infrastructure be developed. I could do this. I think
any member of Congress could sit down in about 10 minutes in
their own district and write down a list of critical
infrastructure. If you have 170 people down there, I cannot
understand why it is taking so long to get this job done. I
worry about the gaps.
When you have a list that does not. . .you have the Seahawk
Stadium, you have the Husky Stadium, but you do not have Safeco
Field, the Tacoma Dome, the Port of Seattle, the Port of
Tacoma, Grand Coulee Dam. . .talk about a national icon. . .the
Boeing Company and Microsoft. None of them are on the list,
including the Puget Sound Naval Shipyard in my hometown of
Bremerton, Washington, which overhauls and repairs every major
nuclear ship on the West Coast; the Trident Submarine base, we
have nuclear missiles and nuclear weapons.
What is going on here? This list that I saw is the most
pathetic exercise I have ever seen since I have been up here.
There are a lot of pathetic things I have seen in 28 years in
Congress, but this is the worst I have ever seen. I could have
done this myself and done a better job. I do not understand who
is doing this. Who are they talking to? This is serious. It is
not getting done and I am very concerned about it. Can you give
me some assurance that we are going to get this thing
straightened out, that somebody will talk to the people in the
State of Washington? To General Lowenberg who is the Governor's
assistant, and get a credible list of things put on this thing?
Why is this not happening?
Mr. Liscouski. Thank you, Mr. Dicks. I am a little
surprised at the characterization from the homeland security
adviser that he has not been contacted or has not had any
input. In fact, the purpose of sharing that list is to solicit
the input.
Mr. Dicks. But the list has already been put out. Here it
is. They should have consulted with them before they put out
the list.
Mr. Liscouski. I will certainly get back to you to find out
if they had or had not been consulted.
Mr. Dicks. I have the list right here. None of these things
are on there. This is like the crown jewels of Washington
State. Every one of them is missing from this list. I just
cannot believe that this is happening.
Mr. Liscouski. Mr. Dicks, I just want to caution. We
typically do not publicly disclose the assets on that list. So
to talk about it in any degree of fidelity here, I would
suggest--.
Mr. Dicks. None of them are on there, so I have not
discussed anything that is on there.
Mr. Liscouski. To my point, I would be happy to discuss
with you in a separate setting--.
Mr. Dicks. To discuss the things that are not on there?
Mr. Liscouski. Sir, to my point, I would be happy to
discuss with you in a private setting where we can talk about
specifically what is on the list and what is not on the list,
but I do not think this is the appropriate forum right now.
Mr. Dicks. Can you answer this question? Let's go to the
process. Why is this thing so screwed up? With all due respect,
I do not get any sense of urgency here.
Mr. Liscouski. There is a significant sense of urgency,
sir. Again, without commenting on the specifics of that list, I
will go back and review the process and I would be happy to sit
down with you and talk to you about how that list was
developed. If there are gaps, we would be happy to correct
them. The mandate is for my folks to make sure we absolutely
engage with all the respective stakeholders at the state and
local sectors to ensure we have it right. I will be happy to
review it and get back to you, sir.
Mr. Camp. Would the gentleman yield just for a brief
moment?
Mr. Dicks. Yes, I yield.
Mr. Camp. The subcommittee did hold a classified briefing
where the Secretary did bring the full list. It was available
for all members to review who attended that briefing. I would
be happy to work with you to try to make sure so that not only
there, but other places--.
Mr. Dicks. The list that we have right here, this is not--.
Mr. Camp. It is classified, so we did not take any paper
out of the room, but I know that Ms. Sanchez was there and it
might have been difficult for other members' schedules to
attend that particular classified briefing. I know the Chairman
was there and others. But we had an opportunity to review this
list and we all looked at various assets from our states and
made comments.
Mr. Dicks. Apparently we were only given 24 hours notice of
that, but I appreciate the fact that you did it. I do not want
to be critical of that.
Mr. Camp. We did have more notice than that because we
worked on it for a long time to get it put together. So I would
dispute that it was only 24 hours notice, frankly.
Mr. Dicks. That is the actual time of the meeting.
Mr. Camp. Yes.
Ms. Sanchez. Would the gentleman yield?
Mr. Dicks. Yes, I yield. I am just worried about this.
Mr. Camp. We did have an opportunity to look at that.
That is just my point. Thank you.
Mr. Dicks. OK. I yield.
Ms. Sanchez. We are trying, I believe, to set up another
meeting with more notice to do the same thing. It is a
classified list. There are things that are omitted from that
list, even from my own district. You only get to look at it
when you are in there, but hopefully you can attend the
meeting; you can take a look at what is really on the list. I
do not know if that list is what is the list that we took a
look at when we were in the private meeting.
Mr. Dicks. Maybe there is a separate list that we were not
told about. This is what I was presented. The reason I am
concerned is there are a lot of things that should be on that
list that are not on there.
Mr. Liscouski. Sir, maybe if I can just have one final
comment, without drawing this out. The states were required to
submit their list, sir, so I suspect if we did not receive
their input, and again I will go back to our group to address
this, but there are a couple of different reasons as to why the
list you may have, it may be old or out of date, I am not quite
sure what, but we did not do anything without the state's
input, sir.
Mr. Thornberry. Does the gentleman yield back?
Mr. Dicks. Just for one second. The list we have is the
list that was given to the Adjutant General. He was quite
concerned about it and made that clear and made it clear to us,
the members of the delegation for the State of Washington, that
he was quite upset about it. Washington State has been as
forward-leaning as any state that I know of. They have done a
complete statewide plan. In that plan, it talked about all
these other issues that I mentioned that are not on this list.
So to me, I just hope we can get this straightened out.
Mr. Thornberry. I thank the gentleman. This is obviously
not an issue before my subcommittee. It is Mr. Camp's
subcommittee. When we are talking about information sharing, if
there are classified lists that are floating around in a way
that classified information is not supposed to be handled, I am
a little concerned about that.
Mr. Camp. Would the Chairman yield?
Mr. Thornberry. Sure.
Mr. Camp. I would be very concerned if the Adjutant General
is sharing that list in that format in an unclassified way,
frankly. That is not appropriate. So if that is the way that
information is getting out, I would question its accuracy and I
would certainly question the process.
Mr. Dicks. It was not presented to him in a classified
format.
Mr. Camp. It is probably not the correct list. So I think
what we need to do is have another classified briefing.
Mr. Dicks. We have to sort this out. I will glad to
apologize to anyone if this is not the list, because when I saw
this list I frankly was outraged, as you can tell.
Mr. Camp. The purpose of the meeting was to make sure that
members did have an opportunity to review lists from their
states, because we do think that it was in a classified setting
inside the skiff so that it was a confidential meeting. I will
be glad to work with the gentleman to try to set up an
opportunity.
Mr. Dicks. Let me just for the record, the person who
presented this list to the state was James McDonnell,
Protective Security Division, U.S. Department of Homeland
Security.
Mr. Camp. It may not be a complete listing of all of the
assets on the classified list. We will get to the bottom of it.
Thank you, Mr. Chairman.
Mr. Dicks. I appreciate the gentleman's help.
Mr. Thornberry. We are ready to move to the second panel.
Does the gentlelady from Texas have questions she would like to
ask of this panel?
Ms. Jackson-Lee. Yes, I do.
Mr. Thornberry. The gentlelady is recognized.
Ms. Jackson-Lee. Thank you very much, Mr. Chairman. I was
in a hearing with both the Chairpersons and the Chairman of the
full committee that I hope we will have, and that is with
Secretary Powell and Governor Ridge on the request for an
extension of the biometric passport. So I apologize to the
witnesses for my delay, but let me just ask one pointed
question to the Assistant Secretary.
Just for your information, I know many of us come from
areas that have their own critical infrastructure, but coming
from Houston, Texas obviously the refineries and the chemical
plants are very well known. In fact, in the last four to six
weeks, we had yet another explosion in the area that impacted
neighborhoods and impacted people. We are grateful that it was
a technical or an infraction that had nothing to do with
terrorism, but you can imagine the sensitivity to this issue.
So let me just cite specifically what we seek. I think that
you may be aware of a recent news program that highlighted the
conditions of chemical plants, and I might say the outrageous
condition of chemical plants, open gates, lack of guards,
dilapidated fences, all allegedly protecting chemicals that
could potentially kill or injure tens of thousands or even
millions of people nearby.
We know the ISACs are working on communication. I
understand that DHS is developing a best practices, but it is
hard to imagine that every plant manager does not already know
or that we cannot simply get out a manifesto to every plant
manager by way of inventorying all of these plants wherever
they might be, that closing the gates around tanks of chlorine
gas a mile from a school is a best practice.
So my question is, how can we secure the homeland when even
these simple tasks are not being done? One, has your particular
area done the risk assessment that many of us have been calling
on for a long, long, long time? Have you done that in the
context of getting out the simple to-dos, such as closing
fences, fixing gaping holes in fences, providing some kind of
lock system, trained security personnel? And do we have a
manifesto of sorts, a document that can easily be understood by
the myriad of chemical operations around the country?
I can assure you that we in Houston and the parameters of
our area have been faced with explosions throughout our
lifetimes. We have been fortunate that it has not been the
massive catastrophes that a terrorist act could bring about,
but we have lost lives. So I am very concerned, one, that we
still sit here in 2004 without a risk assessment. I would ask
you if you could respond to that, as well as any simple tasks
that have been given to these operators of these plants that
they could be implementing as we speak.
I thank the distinguished Chairman.
Mr. Liscouski. Yes, ma'am. Thank you. I addressed this
earlier and I would be more than happy to do it again when we
talk about the national assessment.
Ms. Jackson-Lee. I thank you for your indulgence.
Mr. Liscouski. This notion of a national assessment is
something we have discussed many times. It is ongoing. We are
making significant progress in compiling our national asset
database. As I mentioned earlier, when DHS was first created
back in March of 2003, we had started off with a list of about
160 critical sites in the United States that we thought were
the high priority targets. We quickly grew that to 1,700. Out
of a list of 33,000 assets that we have currently identified,
we are still getting information back from the state and locals
about what their priorities are and what should be on that
list. That list is growing.
We are prioritizing those activities. As it specifically
relates to the chemical sector, we have identified out of the
4,012 sites around the United States that we believe are those
that require the top tier. Not top tier, but of the 4,000 sites
we have identified, this year alone we are addressing the 360
sites around the United States that need to address their
security. We are addressing that in a variety of ways.
First of all, let me just qualify. The issue here is not
just a private sector problem, but this is a state and local
government and private sector problem. It needs to be a totally
integrated plan. We are working with state and local
authorities, as well as the private sector to put out best
practices. To that end, we have done a variety of things.
We have put out common vulnerability assessments and shared
those with best practices perspectives.
Ms. Jackson-Lee. Mr. Secretary, may I do this, because as
you indicated I came in and you had already indicated that. Let
me just be pointed.
Mr. Liscouski. Sure.
Ms. Jackson-Lee. Have you in any way secured the transcript
of that program, 60 Minutes? Have you visited any of those
plants, because they seem to be the worst-case circumstances.
If I may make a comparison, though it is probably an unreal
comparison, over the last 24 hours we had a number of bombings
at Iraqi police stations. That seems to be a notable target.
Maybe our allies and Coalition forces should be having an
inventory of police stations, knowing that they are targets.
We know that chemical plants can be targets. There are
atrocious activities going on, maybe for lack of direction.
Have you gone out into the field and visited these plants? When
you say ``ongoing risk assessment,'' I can only say to you that
``ongoing'' is positive to the effect that we always believe we
should continue to learn, but it is not positive from the
perspective of the crisis of terrorism in this country. So when
will we finish the risk assessment? Have you been to these
plants and given them any direction?
Mr. Liscouski. Yes, ma'am, we have.
Ms. Jackson-Lee. I am sorry?
Mr. Liscouski. Yes, ma'am, we have been to the plants. We
have been to plants specifically in your jurisdiction, in fact,
and I would be happy to share those details with you in a
different venue other than this. We have been very aggressive
about the prioritization of chemical plants. It is a top
priority for us. We recognize the vulnerabilities. We are
working with the industries, state and local governments, as I
pointed out. We have buffer zone protection plants in place. We
have shared best practices for vulnerability assessments. We
have shared common characteristics of terrorist operational
patterns with both the industry and state and local
governments.
So I am quite confident that we are addressing it. To your
point, we are in a continuous improvement process.
Unfortunately, those remarks get taken out of place. You always
ask me, am I satisfied? I am never satisfied. I think it is one
of the reasons I got this job. It is because you never want to
be satisfied with where you were. We never want to become
complacent.
So we are in a continuous improvement mode. Will we ever be
finished? We are going to continuously improve our ability to
provide protection in this country of ours, because this is an
incredibly complex problem. It is not just about what the
plants are doing. It is how are the groups themselves evolving
their techniques and their capabilities? So this is a multi-
dimensional process. This is not just one which becomes static
to say, put up a 12-foot-high fence and you have security,
because we know that terrorists can get a 15-foot-high ladder.
So we are continuously looking at what we need to be doing
here to improve security. I know you are very sensitive to
that. I appreciate your comments. I would be happy to share
with you with more fidelity about what we are doing. I know we
have done that many times with the staff up here. If you have
not had the benefit of a briefing, I would offer that to you.
Ms. Jackson-Lee. Mr. Chairman, I thank you very much. I
will accept your offer, Mr. Secretary. I would like to talk
specifically about the region and what you have done in that
area. I thank you very much.
Mr. Liscouski. Terrific. Thank you.
Mr. Thornberry. I thank the gentlelady. I thank both of our
witnesses.
I am going to submit my questions in writing to the
witnesses. Mr. Liscouski, if we could have a similar agreement
with you as we had before, and that is a real effort to try to
get answers to written questions in two weeks. I understand it
is not completely within your control, but if you can help push
on your end, I think it will help relations with all members.
We will also try to limit the number of questions.
Secretary Newstrom, let me also encourage you on behalf of
your organization to continue to discuss with us not just how
much we have improved, but what yet needs to be improving,
because it is only by identifying those areas that we still
need to make progress on, giving little pushes here and there,
that we can, as Mr. Liscouski said, though we will never be
satisfied, we can continue to improve. I think you hit on some
key points in your testimony.
With that, let me thank both these witnesses. You are both
excused. We will go ahead and bring up the next witnesses. We
should have votes starting soon, but we will press on until the
bells make us recess.
So thank you both. You are both excused.
Mr. Newstrom. Thank you.
Mr. Thornberry. Let me thank the members of the second
panel for your patience. Obviously, there is a lot of interest
in this issue. I have no doubt we will need to recess for votes
here in a moment and come back. We will do that.
As you all are getting situated, I will introduce our next
panel, which includes Mr. Robert Dacey, director, information
security issues for the General Accounting Office; our former
colleague, Hon. Dave McCurdy, executive director of Internet
Security Alliance; and Ms. Diane VanDe Hei, vice chair,
Information Sharing and Analysis Center Council.
Mr. Dacey, I think you are first. Would you like to submit
a summary of your statement before we go and vote? If you could
do that within 5 or 6 minutes, then we will go ahead and do
that, and then we will have to come back for the other
witnesses. Thank you again for being here, and you are
recognized.
STATEMENT OF ROBERT DACEY, DIRECTOR, INFORMATION SECURITY
ISSUES, GENERAL ACCOUNTING OFFICE
Mr. Dacey. Thank you, Mr. Chairman and members of the
subcommittee. I am pleased to be here today to discuss the
status of ISACs, including the initial results of our ongoing
review which we are performing at the request of the
subcommittees. As you requested, I will briefly summarize my
written statement.
Beginning with PDD-63, Federal policy has encouraged the
voluntary creation of ISACs as key information-sharing
mechanisms for the private sector entities and state and local
governments that own and operate most of the nation's critical
infrastructures, and for the Federal Government. Further,
Federal policy established specific infrastructure protection
responsibilities for the Department of Homeland Security and
other Federal agencies.
Although their missions are similar, the current ISACs were
established and developed based upon the unique characteristics
and needs of their individual sectors. Consequently, they
operate under different management and operational structures
and have different operational capabilities, which are
summarized in our written statement and include, number one,
various business models such as private entities, parts of
associations, or a partnership with the Federal Government.
Many also use contractors to support their operations. They
also vary in the nature of the hazards that are covered, such
as cyber, physical or all hazards, which would also include
natural events.
The second major point is the various funding mechanisms
that exist. They may be funded through special fee-for-service
activities including tiered levels, association sponsorship,
Federal grants, or voluntary or in-kind operations by the
participants.
The third major difference is the models or methods by
which they share information. While most have electronic
information shared via email and Web sites, some of which are
secured, others have regular conference calls for their
members, and some have established facilities for quickly
organizing crisis conference discussions.
DHS and the sector-specific Federal agencies have
undertaken a number of efforts to support the ISACs and to
build the public-private partnership called for in Federal CIB
policy. Mr. Liscouski earlier today discussed at some great
length the efforts being taken by the Department.
In addition, the sector-specific agencies are also taking
actions, including funding, to help ISACs increase their
memberships and improve their analytical and communications
capabilities. Nonetheless, according to ISAC representatives
and the ISAC Council which is also represented on this panel, a
number of challenges remain to their successful establishment,
operation and partnership with DHS and other Federal agencies.
These challenges include increasing the percentage of sector
entities that are members of the ISACs; two, building trusted
relationships and processes to facilitate information sharing;
three, overcoming barriers to information sharing; four,
clarifying roles and responsibilities of the various
governmental and private sector entities involved in protecting
our critical infrastructures; next, funding ISAC operations and
activities; and utilizing sector expertise.
According to a DHS official, these issues are being
considered by the Department and should be clarified with the
development of a plan that will lay out the current
relationships, goals for improving them, and methods for
measuring progress. To help ensure that a comprehensive and
trusted information-sharing process is established, it will be
important to consider input from all appropriate stakeholders
and to agree upon the respective roles, responsibilities,
relationships and expectations of the parties.
Mr. Chairman, this concludes my statement. I will be
pleased to answer any questions that you or other members of
the subcommittee may have.
[The statement of Mr. Dacey follows:]
Prepared Statement of Robert F. Dacey
United States Gengeral Accounting Office
CRITICAL INFRASTRUCTURE PROTECTION
Establishing Effective Information Sharing with Infrastructure Sectors
Messrs. Chairmen and Members of the Subcommittees:
I am pleased to be here today to discuss the status of private-
sector information sharing and analysis centers (ISACs) and their
efforts to help protect our nation's critical infrastructures. Critical
infrastructure protection (CIP) activities called for in federal policy
and law are intended to enhance the security of cyber and physical,
public and private infrastructures that are essential to national
security, national economic security, or national public health and
safety. Beginning with Presidential Decision Directive 63 (PDD 63)
issued in May 1998, federal policy has encouraged the voluntary
creation of ISACs to facilitate private-sector participation and serve
as mechanisms for gathering, analyzing, and appropriately sanitizing
and disseminating information to and from infrastructure sectors and
the federal government. Subsequent federal CIP policy, including
several national strategies, continued to emphasize the importance of
the ISACs and their information-sharing functions.\1\ Further, CIP
policy has established specific responsibilities for the Department of
Homeland Security (DHS) and other federal agencies with respect to
public-private collaboration to help protect private infrastructure
sectors.
---------------------------------------------------------------------------
\1\ The White House, The National Strategy to Secure Cyberspace
(Washington, D.C.: February 2003); The National Strategy for the
Physical Protection of Critical Infrastructures and Key Assets
(Washington, D.C.: February 2003); and Homeland Security Presidential
Directive 7, Critical Infrastructure Identification, Prioritization,
and Protection (Washington, D.C.: Dec. 17, 2003).
---------------------------------------------------------------------------
In my testimony today, I will discuss the management and
operational structures used by the ISACs, including their estimated
sector participation, business and funding models, and information
sharing and analysis mechanisms. I will then discuss activities by DHS
and other federal agencies with responsibilities for specific
infrastructure sectors to interact and support the ISACs. Lastly, I
will discuss some of the ISAC identified challenges to and successful
practices for their establishment, operation, and partnership with the
federal government.
As agreed, this testimony includes initial results of our ongoing
analysis of private-sector ISACs, which was requested by your
subcommittees. In conducting this work, we contacted officials for the
15 different ISAC organizations that had been established at the time
of our review: Chemical, Electricity, Energy, Emergency Management and
Response, Financial Services, Food, Information Technology, Multi-
State, Public Transit, Real Estate, Research and Education, Surface
Transportation, Telecommunications, Highway, and Water. Through
structured interviews with these officials, we obtained and analyzed
information to describe the ISACs' current organization and operational
models, funding mechanisms, sector representation and membership
criteria, as well as their challenges and successful practices in
establishing effective information-sharing relationships within their
sectors and with the federal government. We also contacted officials of
the Healthcare Sector Coordinating Council to discuss their efforts to
establish an ISAC for the healthcare sector. Further, we contacted
officials of the ISAC Council, which was created by 11 ISACs to address
common issues, and obtained and analyzed its series of white papers on
a range of ISAC-related issues and challenges. Within the federal
government, we obtained and analyzed information on efforts to work
with the private-sector by DHS and other agencies assigned
responsibilities for specific industry sectors, including the
Departments of Agriculture, Energy, Health and Human Services, and the
Treasury and the Environmental Protection Agency. We did not validate
the accuracy of the data provided by the ISACs, DHS, or other agencies.
We performed our work from November 2003 to April 2004, in accordance
with generally accepted government auditing standards.
Results in Brief
Beginning with PDD 63, federal policy has encouraged the voluntary
creation of ISACs as key information-sharing mechanisms between the
federal government and critical infrastructures. While PDD 63 suggested
certain ISAC activities, CIP policy has essentially left the actual
design and function of the ISACs to the entities that formed them. As a
result, although their overall missions are similar, the current ISACs
were established and developed based on the unique characteristics and
needs of their individual sectors. They operate under different
management and operational structures and, among other things, have
different business models and funding mechanisms. For example, most are
managed or operated as private entities with some, such as the Water
and Chemical ISACs, part of associations that represent their sectors.
Others have partnered with government agencies, such as the
Telecommunications ISAC, which is a government-industry operational and
collaborative body sponsored by DHS's National Communications Systems/
National Coordinating Center (NCC). Different funding mechanisms used
by the ISACs include fee-for-service, association sponsorship, federal
grants, and/or voluntary or in-kind operations by ISAC participants.
Examples of fee-for-service funding include the Financial Services,
Information Technology, and Water ISACs that offer tiered memberships
with fees based on the level of service provided.
DHS and the sector-specific agencies have undertaken a number of
efforts to address the public-private partnership called for by federal
CIP policy and continue to work on their cooperation and interaction
with the ISACs and with each other. For example, in January 2004, DHS
held a 2-day conference to describe the information they are analyzing
and its use in the partnership with the private sector and to discuss
information sharing between the federal government and the private
sector. Also, in February, the department established the Protected
Critical Infrastructure Information (PCII) Program that enables the
private sector to voluntarily submit infrastructure information to the
government, which can be protected from disclosure according to
provisions of the Critical Infrastructure Information Act of 2002.
According to ISAC representatives and a council that represents
many of them, a number of challenges remain to their successful
establishment, operation, and partnership with DHS and other federal
agencies. These challenges include increasing the percentage of sector
entities that are members of the ISACs; building trusted relationships
and processes to facilitate information sharing; overcoming barriers to
information sharing, including the sensitivity of the information,
legal limits on disclosure (such as Privacy Act limitations on
disclosure of personally identifiable information), and contractual and
business limits on how and when information is disclosed; clarifying
the roles and responsibilities of the various government and private
sector entities involved in protecting the critical infrastructures;
and funding ISAC operations and activities. According to a DHS
official, these issues are being considered and should be clarified
through the department's development of a plan that documents the
current information-sharing relationships between DHS, the ISACs, and
other agencies; goals for improving that information sharing
relationship; and methods for measuring progress.
Background
As reliance on our nation's critical infrastructures grows, so do
the potential threats and attacks that could disrupt critical systems
and operations. In response to the potential consequences, federal
awareness of the importance of securing our nation's critical
infrastructures, which underpin our society, economy, and national
security, has been evolving since the mid-1990s. For example, issued in
1998, Presidential Decision Directive 63 (PDD 63) described the federal
government's strategy for cooperative efforts with state and local
governments and the private sector to protect the systems that are
essential to the minimum operations of the economy and the government
from physical and cyber attack. In 2002, the Homeland Security Act
created the Department of Homeland Security, which was given
responsibility for developing a national plan; recommending measures to
protect the critical infrastructure; and collecting, analyzing, and
disseminating information to government and private-sector entities to
deter, prevent and respond to terrorist attacks.
More recently, issued in December 2003, HSPD-7 defined federal
responsibilities for critical infrastructure protection, superseding
PDD 63.
CIP Policy Has Continued to Evolve
Federal awareness of the importance of securing our nation's
critical infrastructures has continued to evolve since the mid-1990s.
Over the years, a variety of working groups has been formed, special
reports written, federal policies issued, and organizations created to
address the issues that have been raised. Key documents that have
shaped the development of the federal government's CIP policy include:
Presidential Decision Directive 63 (PDD 63),
The Homeland Security Act of 2002,
The National Strategies for Homeland Security, to
Secure Cyberspace and for the Physical Protection of Critical
Infrastructures and Key Assets, and
Homeland Security Presidential Directives 7 (HSPD-7)
and 9 (HSPD-9).
Presidential Decision Directive 63 Established an Initial CIP Strategy
In 1998, the President issued PDD 63, which described a strategy
for cooperative efforts by government and the private-sector to protect
the physical and cyber-based systems essential to the minimum
operations of the economy and the government. PDD 63 called for a range
of actions that were intended to improve federal agency security
programs, improve the nation's ability to detect and respond to serious
computer-based and physical attacks, and establish a partnership
between the government and the private-sector. Although superseded in
December 2003 by HSPD-7, PDD 63 provided the foundation for the
development of the current sector based CIP approach.
To accomplish its goals, PDD 63 established and designated
organizations to provide central coordination and support, including
the National Infrastructure Protection Center (NIPC), an organization
within the FBI, which was expanded to address national-level threat
assessment, warning, vulnerability, and law enforcement investigation
and response.
To ensure the coverage of critical sectors, PDD 63 identified eight
infrastructures and five functions. For each of the infrastructures and
functions, the directive designated lead federal agencies, referred to
as sector liaisons, to work with their counterparts in the private-
sector, referred to as sector coordinators. Among other
responsibilities, PDD 63 stated that sector liaisons should identify
and access economic incentives to encourage sector information sharing
and other desired behavior.
To facilitate private-sector participation, PDD 63 also encouraged
the voluntary creation of information sharing and analysis centers
(ISACs) to serve as mechanisms for gathering, analyzing, and
appropriately sanitizing and disseminating information to and from
infrastructure sectors and the federal government through NIPC. PDD 63
also suggested several key ISAC activities to effectively gather,
analyze, and disseminate information--activities that could improve the
security postures of the individual sectors and provide an improved
level of communication within and across sectors and all levels of
government. These activities are: establishing baseline statistics and
patterns on the various infrastructures; serving as a clearinghouse for
information within and among the various sectors; providing a library
of historical data for use by the private-sector and government, and
reporting private-sector incidents to NIPC.
The Homeland Security Act of 2002 Established the Department's CIP
Responsibilities
The Homeland Security The Homeland Security Act of 2002, signed by
the President on November 25, 2002, established DHS. To help accomplish
its mission, the act Act of 2002 Established the established five under
secretaries, among other entities, with responsibility over
directorates for management, science and technology, information
analysis and infrastructure protection, border and transportation
security, and emergency preparedness and response.
The act made the Information Analysis and Infrastructure Protection
(IAIP) Directorate within the department responsible for CIP functions
and transferred to it the functions, personnel, assets, and liabilities
of several existing organizations with CIP responsibilities, including
NIPC (other than the Computer Investigations and Operations Section).
IAIP is responsible for accessing, receiving, and analyzing law
enforcement information, intelligence information, and other threat and
incident information from respective agencies of federal, state, and
local governments and the private-sector, and for combining and
analyzing such information to identify and assess the nature and scope
of terrorist threats. IAIP is also tasked with coordinating with other
federal agencies to administer the Homeland Security Advisory System to
provide specific warning information along with advice on appropriate
protective measures and countermeasures. Further, IAIP is responsible
for disseminating, as appropriate, information analyzed by DHS within
the department, to other federal agencies, to state and local
government agencies, and to private-sector entities.
Moreover, as stated in the Homeland Security Act of 2002, IAIP is
responsible for (1) developing a comprehensive national plan for
securing the key resources and critical infrastructure of the United
States and (2) recommending measures to protect the key resources and
critical infrastructure of the United States in coordination with other
federal agencies and in cooperation with state and local government
agencies and authorities, the private-sector, and other entities.
National Strategies Establish Information-Sharing Initiatives
The National Strategy for Homeland Security identifies information
sharing and systems as one foundation for evaluating homeland security
investments across the federal government. It also identifies
initiatives to enable critical infrastructure information sharing and
to integrate sharing across state and local government, private
industry, and citizens. Consistent with the original intent of PDD 63,
the National Strategy for Homeland Security states that, in many cases,
sufficient incentives exist in the private market for addressing the
problems of CIP. However, the strategy also discusses the need to use
all available policy tools to protect the health, safety, or well-being
of the American people. It mentions federal grant programs to assist
state and local efforts, legislation to create incentives for the
private sector, and, in some cases, regulation.
The National Strategy to Secure Cyberspace provides an initial
framework for both organizing and prioritizing efforts to protect our
nation's cyberspace. It also provides direction to federal departments
and agencies that have roles in cyberspace security and identifies
steps that state and local governments, private companies and
organizations, and individual Americans can take to improve our
collective cybersecurity. The strategy warns that the nation's private-
sector networks are increasingly targeted and will likely be the first
organizations to detect attacks with potential national significance.
According to the cyberspace strategy, ISACs, which possess unique
operational insight into their industries' core functions and will help
provide the necessary analysis to support national efforts, are
expected to play an increasingly important role in the National
Cyberspace Security Response System \2\ and the overall missions of
homeland security. In addition, the cyberspace strategy identifies DHS
as the central coordinator for cyberspace efforts and requires it to
work closely with the ISACs to ensure that they receive timely and
threat and vulnerability data that can be acted on and to coordinate
voluntary contingency planning efforts. The strategy reemphasizes that
the federal government encourages the private-sector to continue to
establish ISACs and, further, to enhance the analytical capabilities of
existing ISACs. Moreover, the strategy stresses the need to improve and
enhance public-private information sharing about cyber attacks,
threats, and vulnerabilities and to encourage broader information
sharing on cybersecurity among nongovernmental organizations with
significant computing resources. The National Strategy to Secure
Cyberspace also states that the market is to provide the majorimpetus
to improve cybersecurity and that regulation will not become a primary
means of securing cyberspace.
---------------------------------------------------------------------------
\2\ The National Cyberspace Security Response System is a public-
private architecture, coordinated by the Department of Homeland
Security, for analyzing and warning; managing incidents of national
significance; promoting continuity in government systems and private
sector infrastructures; and increasing information sharing across and
between organizations to improve cyberspace security. It includes
governmental entities and nongovernmental entities, such as private-
sector ISACs.
---------------------------------------------------------------------------
The National Strategy for the Physical Protection of Critical
infrastructures and Key Assets provides a statement of national policy
to remain committed to protecting critical infrastructures and key
assets from physical attacks. It outlines three key objectives to focus
the national protection effort: (1) identifying and assuring the
protection of the most critical assets, systems, and functions; (2)
assuring the protection of infrastructures that face an imminent
threat; and (3) pursuing collaborative measures and initiatives to
assure the protection of other potential targets. The National Strategy
for the Physical Protection of Critical Infrastructures and Key Assets
also states that further government leadership and intense
collaboration between public--and private-sector stakeholders is needed
to create a more effective and efficient information-sharing process to
enable our core protective missions. Some of the specific initiatives
include
defining protection-related information requirements
and establishing effective, efficient information-sharing
processes;
promoting the development and operation of critical
sector ISACs, including developing advanced analytical
capabilities;
improving processes for domestic threat data
collection, analysis, and dissemination to state and local
governments and private industry; and
completing implementation of the Homeland Security
Advisory System.
The National Strategy for the Protection of Critical
Infrastructures and Key Assets reiterates that additional regulatory
directives and mandates should only be necessary in instances where the
market forces are insufficient to prompt the necessary investments to
protect critical infrastructures and key assets.
Current Federal Agency CIP Responsibilities
In December 2003, the President issued HSPD-7, which established a
national policy for federal departments and agencies to identify and
prioritize critical infrastructure and key resources and to protect
them from terrorist attack. It superseded PDD 63. HSPD-7 defines
responsibilities for DHS, lead federal agencies, or sector-specific
agencies that are responsible for addressing specific critical
infrastructure sectors,and other departments and agencies. It instructs
federal departments and agencies to identify, prioritize, and
coordinate the protection of critical infrastructure to prevent, deter,
and mitigate the effects of attacks.
The Secretary of Homeland Security is assigned several
responsibilities, including
coordinating the national effort to enhance critical
infrastructure protection;
identifying, prioritizing, and coordinating the
protection of critical infrastructure, emphasizing protection
against catastrophic health effects or mass casualties;
establishing uniform policies, approaches, guidelines,
and methodologies for integrating federal infrastructure
protection and risk management activities within and across
sectors; and
serving as the focal point for cyberspace security
activities, including analysis, warning, information sharing,
vulnerability reduction, mitigation, and recovery efforts for
critical infrastructure information systems.
To ensure the coverage of critical sectors, HSPD-7 designated
sector specific agencies, formerly referred to as lead agencies, for
the critical infrastructure sectors identified in the National Strategy
for Homeland Security (see table 1). These agencies are responsible for
infrastructure protection activities in their assigned sectors, which
include
coordinating and collaborating with relevant federal
agencies, state and local governments, and the private-sector
to carry out their responsibilities;
conducting or facilitating vulnerability assessments
of the sector;
encouraging the use of risk management strategies to
protect against and mitigate the effects of attacks against the
critical infrastructure.
identifying, prioritizing, and coordinating the
protection of critical infrastructure;
facilitating the sharing of information about physical
and cyber threats, vulnerabilities, incidents, potential
protective measures, and best practices; and
reporting to DHS on an annual basis on their
activities to meet these responsibilities.
Further, the sector-specific agencies are to continue to encourage
the development of information-sharing and analysis mechanisms and to
support sector-coordinating mechanisms. HSPD-7 does not suggest any
specific ISAC activities.
Table 1: Critical Infrastructure Sectors Identified by the National Strategy for Homeland Security and HSPD-7
----------------------------------------------------------------------------------------------------------------
Sector Description Sector-specific agency
----------------------------------------------------------------------------------------------------------------
Agriculture Provides for the fundamental need for Department of Agriculture
food. The infrastructure includes
supply chains for feed and crop
production.
----------------------------------------------------------------------------------------------------------------
Banking and Finance Provides the financial infrastructure Department of the Treasury
of the nation. This sector consists
of commercial banks, insurance
companies, mutual funds, government
sponsored enterprises, pension
funds, and other financial
institutions that carry out
transactions including clearing and
settlement.
----------------------------------------------------------------------------------------------------------------
Chemicals and hazardous materials Transforms natural raw materials into Department of Homeland Security
commonly used products benefiting
Department of Homeland society's
health, safety, and productivity.
The chemical industry Security
represents a $450 billion enterprise
and produces more than 70,000
products that are essential to
automobiles, pharmaceuticals, food
supply, electronics, water
treatment, health, construction and
other necessities.
----------------------------------------------------------------------------------------------------------------
Defense industrial base Supplies the military with the means Department of Defense
to protect the nation by producing
weapons, aircraft, and ships and
providing essential services,
including information technology and
supply and maintenance.
----------------------------------------------------------------------------------------------------------------
Emergency services Saves lives and property from Department of Homeland Security
accidents and disaster. This sector
includes fire, rescue, emergency
medical services, and law
enforcement organizations.
----------------------------------------------------------------------------------------------------------------
Energy Provides the electric power used by Department of Energy
all sectors, including critical
infrastructures, and the refining,
storage, and distribution of oil and
gas. The sector is divided into
electricity and oil and natural gas.
----------------------------------------------------------------------------------------------------------------
Food Carries out the post-harvesting of Department of Agriculture and
the food supply, including Department of Health and Human
processing and retail sales. Services
----------------------------------------------------------------------------------------------------------------
Government Ensures national security and freedom Department of Homeland Security
and administers key public
functions.
----------------------------------------------------------------------------------------------------------------
Information technology and Provides communications and processes Department of Homeland Security
telecommunications to meet the needs of businesses and
government.
----------------------------------------------------------------------------------------------------------------
Postal and shipping Delivers private and commercial Department of Homeland Security
letters, packages, and bulk assets.
The U.S. Postal Service and other
carriers provide the services of
this sector.
----------------------------------------------------------------------------------------------------------------
Public Health and Healthcare Mitigates the risk of disasters and Department of Health and Human
attacks and also provides recovery Services
assistance if an attack occurs. The
sector consists of health
departments, clinics, and hospitals.
----------------------------------------------------------------------------------------------------------------
Transportation Enables movement of people and assets Department of Homeland Security
that are vital to our economy,
mobility, and security with the use
of aviation, ships, rail, pipelines,
highways, trucks, buses, and mass
transit.
----------------------------------------------------------------------------------------------------------------
Drinking water and water Sanitizes the water supply with the Environmental Protection Agency
treatment systems use of about 170,000 public water
systems. These systems depend on
reservoirs, dams, wells, treatment
facilities, pumping stations, and
transmission lines.
----------------------------------------------------------------------------------------------------------------
Source: GAO analysis based on the
President's National Strategy documents and
HSPD-7.
In January, the President issued HSPD-9, which
established a national policy to defend the agriculture and
food system against terrorist attacks, major disasters, and
other emergencies. HSPD-9 defines responsibilities for DHS,
lead federal agencies, or sector-specific agencies, responsible
for addressing specific critical infrastructure sectors, and
other departments and agencies. It instructs federal
departments and agencies to protect the agriculture and food
system from terrorist attacks, major disasters, and other
emergencies by
identifying and prioritizing sector-critical
infrastructure and key resources for establishing
protection requirements;
developing awareness and early warning
capabilities to recognize threats;
mitigating vulnerabilities at critical
production and processing nodes;
enhancing screening procedures for domestic
and imported products; and
In addition, the Secretary of Homeland Security, in
coordination with the Secretaries of Agriculture,
Health and Human Services, and other appropriate
federal department and agencies, are assigned
responsibilities including:
expanding and continuing vulnerability
assessments of the agriculture and food sectors; and
working with appropriate private-sector
entities to establish an effective information-sharing
and analysis mechanism for agriculture and food.
enhancing response and recovery procedures.
Prior GAO Recommendations
We have made numerous recommendations over the last several years
related to information-sharing functions that have been transferred to
DHS. One significant area of our work concerns the federal government's
CIP efforts, which is focused on sharing information on incidents,
threats, and vulnerabilities and providing warnings related to critical
infrastructures both within the federal government and between the
federal government and state and local governments and the private
sector. Although improvements have been made in protecting our nation's
critical infrastructures and continuing efforts are in progress,
further efforts are needed to address the following critical CIP
challenges that we have identified:
developing a comprehensive and coordinated national
plan to facilitate CIP information sharing, which clearly
delineates the roles and responsibilities of federal and
nonfederal CIP entities, defines interim objectives and
milestones, sets timeframes for achieving objectives, and
establishes performance measures;
developing fully productive information-sharing
relationships within the federal government and between the
federal government and state and local governments and the
private-sector;
improving the federal government's capabilities to
analyze incident, threat, and vulnerability information
obtained from numerous sources and share appropriate timely,
useful warnings and other information concerning both cyber and
physical threats to federal entities, state and local
governments, and the private-sector; and
providing appropriate incentives for nonfederal
entities to increase information sharing with the federal
government.
ISAC Structures and Operations Reflect Sector Needs and Evolving Goals
PDD 63 encouraged the voluntary creation of ISACs and suggested
some possible activities, as discussed earlier; however, their actual
design and functions were left to the private-sector, along with their
relationship with the federal government. HSPD-7 continues to encourage
the development of information-sharing mechanisms and does not suggest
specific ISAC activities. As a result, the ISACs have been designed to
perform their missions based on the unique characteristics and needs of
their individual sectors and, although their overall missions are
similar, they have different characteristics. They were created to
provide an information-sharing and analysis capability for members of
their respective infrastructure sectors to support efforts to mitigate
risk and provide effective response to adverse events, including cyber,
physical, and natural events. In addition, the ISACs have taken several
steps to improve their capabilities and the services they provide to
their respective sectors.
Management and Operational Structures Vary, But Provide Similar Basic
Capabilities
The ISACs have developed diverse management structures and
operations to meet the requirements of their respective critical
infrastructure sectors. To fulfill their missions, they have been
established using various business models, diverse funding mechanisms,
and multiple communication methods.
Business model--ISACs use different business models to accomplish
their missions. Most are managed or operated as private entities,
including the Financial Services, Chemical, Electricity Sector, Food,
Information Technology, Public Transit, Real Estate, Surface
Transportation, Highway, and Water ISACs. Many are established as part
of an association that represents a segment of or an entire critical
infrastructure sector. For example, the Association of Metropolitan
Water Authorities manages the contract for the Water ISAC and the
American Chemistry Council manages and operates the Chemical ISAC
through its CHEMTRAC.\3\ In addition, the North American Electric
Reliability Council (NERC),\4\ a nonprofit corporation that promotes
electric system reliability and security, operates the Electricity
Sector ISAC using internal expertise.
---------------------------------------------------------------------------
\3\ The American Chemistry Council represents the leading companies
engaged in the business of chemistry. CHEMTREC (Chemical
Transportation Emergency Center) is the American Chemistry Council's
24-hour emergency communications center. It was established in 1971 to
provide emergency responders technical assistance in safely mitigating
a distribution incident.
\4\ The North American Electric Reliability Council's (NERC)
membership includes small and large electric utilities, regional
utility companies, power marketers, and other entities responsible for
power generation, transmission, control, and marketing and distribution
in the United States, Canada, and a portion of Mexico.
---------------------------------------------------------------------------
The legal structure of ISACs continues to evolve. The Financial
Services ISAC has evolved from a limited liability corporation in 1999
to a 501(c)6 non-stock corporation and is managed by a board of
directors that is comprised of representatives from the Financial
Services ISAC's members. According to the Financial Services ISAC
Board, the change to be a 501(c)6 non-stock corporation, as mentioned
above, was made to simplify the membership agreement and to make the
process for obtaining public funding easier. The Energy ISAC also
changed from a limited liability corporation to a 501(c)3 nonprofit
charitable organization to eliminate membership barriers.
Also, government agencies have partnered with the private-sector to
operate certain ISACs. For example, DHS's National Communications
Systems/ National Coordinating Center (NCC) for Telecommunications
sponsors the Telecommunications ISAC, which is a government/industry
operational and collaborative body.\5\ DHS provides for the
Telecommunications ISAC facilities, tools and systems, the NCC manager,
and the 24x7 watch operations staff. The private-sector provides
representatives who have access to key corporate personnel and other
resources. In addition, DHS's United States Fire Administration
operates the Emergency Management and Response ISAC. New York State,
through its Office of Cyber Security and Critical Infrastructure
Coordination, is coordinating efforts of the Multi-state ISAC. The New
York State Office of Cyber Security and Critical Infrastructure
Coordination is currently studying best practices and lessons learned
to assist in developing a structure that will include representation by
member states.
---------------------------------------------------------------------------
\5\ The National Coordinating Center for Telecommunications is open
to companies that provide telecommunications or network services,
equipment, or software to the communications and information sector;
select, competitive local exchange carriers; Internet service
providers; vendors; software providers; telecommunications professional
organizations and associations; or companies with participation or
presence in the communications and information sector. Membership is
also allowed for National Coordinating Center member federal
departments and agencies, and for national security/emergency
preparedness users.
---------------------------------------------------------------------------
Six of the ISACs included in our study use contractors to perform
their day-to-day operations. According to an Association of
Metropolitan Water Agencies (AMWA) official, they chose a contractor to
operate the Water ISAC because the contractor had the appropriate
expertise. In addition, the contractor's personnel had government
clearances and the ability to operate a secure communication system and
facility. In addition, ISACs use contractors to supplement their
operations. For example, a formal contract provides for the daily
staffing and performance of the Emergency Management and Response
ISAC's tasks. It chose this model because of federal requirements and
the shortage of positions for federal full-time employees at the United
States Fire Administration. The Telecommunications ISAC contracted for
analysts to operate the 24 x 7 watch operations under the management of
a government official.
ISACs also differ in the nature of the hazards that they consider:
cyber, physical, or all hazards (including natural events such as
hurricanes). For example, during events of the power outage in August
2003 and Hurricane Isabel in September 2003, the Financial Services
ISAC was contacted by DHS to determine the Banking and Finance sector's
preparedness and the impact of those events. However, the Multi-state
ISAC will remain focused on cyber threats because other state
organizations are in place to address physical and natural disaster
events.
Funding--ISACs fund their activities using a variety of methods--
fees-for-service, association sponsorship, federal grants, and
voluntary, or inkind, operations by existing participants. For example,
the Financial Services, Information Technology, and Water ISACs use a
tiered fee-for-service model for members. This model establishes
different tiers of membership based on the level of service provided.
These tiers typically include some basic level of service that is
provided at minimal or no cost to the member and additional tiers that
provide--for a fee--more personalized service and access to additional
resources. To help ensure that cost is not a deterrent to membership
and that the ISAC's coverage of its sector is extensive, the Financial
Services ISAC recently, as part of its next-generation ISAC effort,
shifted to a tiered fee-for-service approach. It offers five levels of
service that vary in cost--Basic (no charge), Core ($750 per year),
Premier ($10,000 per year), Gold ($25,000 per year), and Platinum
($50,000)--for ascending levels of information and analytical
capabilities. In addition, there is a partner-level license agreement
for select industry associations ($10,000) for distribution to eligible
association members of Urgent and Crisis Alerts. For example, the
Information Technology ISAC recently started to work on a tiered basis
with fees set annually at $40,000; $25,000; $5,000; $1,000; and free.
The Water ISAC also uses a tiered approach, with membership fees
ranging from $7,500 to $750 annually. The Surface Transportation ISAC
assesses an annual fee from its Class I railroad members of
approximately $7,500.
Some industry associations that operate ISACs fund them from
budgets. For example, the North American Electric Reliability Council
(NERC) funds the Electricity Sector ISAC, and the American Trucking
Association funds the Highway ISAC from their budgets. The American
Chemistry Council fully funds the Chemical ISAC through the previously
existing Chemical Transportation Emergency Center, known as CHEMTRAC.
The ten trade associations that are members of it fund the Real Estate
ISAC.
In addition, some ISACs receive funding from the federal government
for such purposes as helping to start operations, funding memberships,
and providing expanded capabilities. Examples include the following:
The Public Transit ISAC initially received a $1.2
million grant from the Federal Transit Administration (FTA) to
begin operations. Members pay no an annual fee and there are no
membership requirements from the association that started the
ISAC--the American Public Transportation Association.
For FY 2004, the Water ISAC received a $2 million
grant from EPA to cover annual operating costs, including the
expansion of memberships to smaller utilities.
The Financial Services ISAC received $2 million
dollars from the Department of the Treasury to enhance its
capabilities, including technology to broaden membership
service.
The Highway ISAC received initial funding from DHS's
Transportation Security Administration (TSA) to start the ISAC.
The Energy ISAC received federal grants to assist
entities within its separate sectors to be members.
DHS provides funding for the operation of the
Telecommunications ISAC that is combined with in-kind services
provided by the corporate participants. DHS also fully operates
the Emergency Management and Response ISAC.
States also provide funding for ISACs. For example, the Multi-state
ISAC is funded by and functions as part of the New York State Cyber
Security Analysis Center. In addition, the Research and Education
Network ISAC is supported by Indiana University.
Sharing mechanisms--ISACs use various methods to share information
with their members, other ISACs, and the federal government. For
example, they generally provide their members access to electronic
information via e-mail and Web sites. For example, the Chemical ISAC
members receive e-mail alerts and warnings in addition to the
information that is posted to the ISAC's Web site. The Highway ISAC
provides members on its Web site with links to IT resources.
Some ISACs also provide secure members-only access to information
on their Web sites. For example, the Financial Services ISAC's Web site
offers multiple capabilities for members at the premier level and
above, including, among other things, access news, white papers, best
practices, and contacts. The Energy ISAC offers its members access to a
secure Web site.
In addition, some ISACs hold conference calls for their members.
For example, the Chemical ISAC holds biweekly conference calls with
DHS. The Financial Services ISAC also conducts threat intelligence
conference calls every two weeks for premier members and above with
input from Science Applications International Corporation (SAIC) and
DHS. These calls discuss physical and cyber threats, vulnerabilities
and incidents that have occurred during the previous two weeks, and
they provide suggestions on what may be coming. The Financial Services
ISAC is capable of organizing crisis conference calls within an hour of
the notification of a Crisis Alert, and it hosts regular bi-weekly
threat conference calls for remediation of vulnerabilities (viruses,
patches).
ISACs also use other methods to communicate. For example, they may
use pagers, phone calls, and faxes to disseminate information. In
addition, the Telecommunications ISAC uses the Critical Infrastructure
Warning Information Network (CWIN).\6\ The Financial Services ISAC also
sponsors twice yearly members' only conferences to learn and share
information.
---------------------------------------------------------------------------
\6\ CWIN provides connectivity and 24x7 alert and notification
capability to government and industry participants. It is engineered to
provide a reliable and survivable network capability, and it has no
logical dependency on the Internet or the Public Switched Network.
ISAC Coverage and Participation Varies
According to the ISAC Council, its membership possesses an outreach
and connectivity capability to approximately 65 percent of the U.S.
private critical infrastructure. However, the ISACs use various
matrices to define their respective sectors' participation in their
activities. For example, the Banking and Finance sector has estimated
that there are more than 25,000 financial services firms in the United
States. Of those, according to the Financial Services ISAC Board,
roughly 33 percent receive Urgent and Crisis Alerts through license
agreements with sector associations--accounting for the vast majority
of total commercial bank assets, the majority of assets under
management, and the majority of securities/ investment bank
transactions that are handled by the sector, but less than half the
sector's insurance assets. According to an American Public
Transportation Association official, the Public Transit ISAC covers a
little less than 5 percent of the public transit agencies; however,
those agencies handle about 60 to 70 percent of the total public
transit ridership. Further, according to NERC officials, virtually all
members of NERC are members of the Electricity Sector ISAC. As for the
Energy ISAC, officials stated that its 80-plus members represent
approximately 85 percent of the energy industry. Membership in the
Information Technology ISAC also represents 85 to 90 percent of the
industry, including assets of Internet equipment hardware, software,
and security providers. For other ISACs, such as Chemical and Real
Estate, officials stated that it is difficult to determine the
percentage of the sector that is included.
Table 2 provides a summary of the characteristics of the ISACs that
we included in our review. In addition to these ISACs, the Healthcare
sector is continuing to organize, including efforts to establish an
ISAC. According to DHS officials, the Emergency Law Enforcement ISAC
that was formally operated by the NIPC and transferred to IAIP is not
currently staffed and will be considered in current efforts to organize
the Emergency Services sector.
Table 2: Summary of ISAC Characteristics
--------------------------------------------------------------------------------------------------------------------------------------------------------
Critical Infrastructures and their
ISAC(s) Coverage Funding model Hazards covered Analysis capability Sharing mechanisms
--------------------------------------------------------------------------------------------------------------------------------------------------------
Agriculture
None at this time.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Banking & Finance
--------------------------------------------------------------------------------------------------------------------------------------------------------
Financial Services 200 members, including Funded by and operated Cyber Physical Operates 24 hours a Text-based alerts,
(est. Oct. 1999) commercial banks, with tiered day, 7 days a week. through a
securities firms, and membership fees. Watch desk analyzes notification system,
insurance companies. Contractor operated. and categorizes backed up by
Represents 90% of the threats, incidents, telephone. Biweekly
financial sector's and warnings based threat intelligence
assets. on the sector's conference call with
needs. DHS and SAIC.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Chemicals & Hazardous Materials
--------------------------------------------------------------------------------------------------------------------------------------------------------
Chemical (est. April 2002) 538 individual members Funded and operated by Cyber Physical Operates 24x7. E-mails alerts and
representing the ACC's Chemical Currently working to warnings. Chemistry
chemical industries. Transportation develop an analysis ISAC Web site.
285 businesses. Emergency Center. center. Biweekly conference
Represents 90% of calls with DHS.
chemical sector. Secure
communications
network with DHS.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Defense Industrial Base
None at this time.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Emergency Services
--------------------------------------------------------------------------------------------------------------------------------------------------------
Emergency Management & Response 10 FEMA Regions 6 Funded by FEMA's Cyber Physical Developing 24x7 Electronic messaging
(est. Oct. 2000) major stakeholders of Office of Cyber operations. Analyzes Telephone and when
EMR sector. Security with and disseminates necessary, a secure
Represents 100% of supplementation from actionable telephone unit.
the essential USFA. Contractor intelligence on
components of the EMR operated. threats, attacks,
Sector. vulnerabilities,
anomalies, and
security best
practices.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Energy
--------------------------------------------------------------------------------------------------------------------------------------------------------
Electric (est. Oct. 2000) More then 90% of NERC Funded and managed/ Cyber Physical Operates 24x7. The ES- Secure telephone,
members are members operated by NERC. ISAC and NERC have fax, and Web server
of the ISAC including created the E-mail Satellite
large and small Indications, telephones.
electric utilities, Analysis, and Information such as
regional electric Warnings Program incident reports and
utility companies, (IAW) that provides warnings,
and power marketers. a set of guidelines vulnerability
for reporting assessments, and
operational and related documents
cyber incidents that are posted on the
adversely affect the public Web site.
electric power
infrastructure.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Energy (est. Nov. 2001) 80 plus members from Funded by grants from Cyber Physical Operates 24x7. Conference calls Fax,
the oil and gas DOE. Contractor Analyzes threats, Email, pager.
sector. Represents operated. vulnerabilities, and Detailed information
85% of the oil and incident on warnings provided
gas sector. information. on a membership
Provides security only, secure Web
information and site.
solutions.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Food
--------------------------------------------------------------------------------------------------------------------------------------------------------
Food (est. Feb. 2002) Over 40 food-industry No current funding. Physical Operates 24x7. No E-mail Watch
trade associations Operated by volunteer analysis capability, Commander List
and their members. labor from each due to members' Currently working to
member association. privacy concerns. develop a secure
Depends on DHS for email system.
analysis.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Government
--------------------------------------------------------------------------------------------------------------------------------------------------------
State Gov. (est. Jan. 2003) 49 states (excluding Funded and operated by Cyber Physical & Operates 24x7. Issues Monthly conference
Kansas) and the New York State. Natural bulletins, calls E-mail
District of Columbia. States provide time (as it relates to advisories, and Telephone
and resources as cyber). alerts.
appropriate.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Information Technology &
Telecommunications
--------------------------------------------------------------------------------------------------------------------------------------------------------
IT (est. Dec. 2000) 90% of all desktop Funded and operated by Cyber Physical Operates 24x7. CWIN Encrypted e-mail
operating systems. foundational member Analyzes cyber SSL-protected Web
85% of all databases. contributions, will alerts and sites Cellular
50% of all desktop soon implement advisories and phones VoIP
computers. 85% of all membership fees reports physical telephony GETS) \7\
routers. 65% of (tiered). Contractor issues. system for priority
software security. operated. calls
--------------------------------------------------------------------------------------------------------------------------------------------------------
Telecom (est. Jan. 2000) 95% of wireline Funded by NCS. Cyber Physical Natural Operates 24x7. E-mail Telephone Fax
providers. Over 60% Operated by NCC. Analyzes data to Meetings CWIN
of wireline vendors. Agencies bear the avoid crises that
95% of wireless costs of their own could affect the
providers. 90% of personnel. entire telecom
wireless vendors. 42% infrastructure.
of Internet Service
subscribers. 90% of
Internet Service
networks. 6 of the
top system
integrators in the
U.S. Federal IT
market. 15% of Domain
Name Service root and
global Top Level
Domain operators.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Research & Education Network (est. 200 Universities. All Funded and operated by Cyber Operates 24x7. Public information
Feb. 2003) U.S. universities and Indiana University. Receives and restricted to
colleges that are disseminates aggregate views of
connected to national information the network.
R&E networks have regarding network Information
basic membership. security identifying
vulnerabilities and institutions or
threats in the individuals not
higher education reported publicly.
community. Detailed and
sensitive
information shared
only with affected
institutions.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Postal & Shipping
None at this time.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Public Health &
Healthcare
--------------------------------------------------------------------------------------------------------------------------------------------------------
HealthCare
None at this time.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Transportation
--------------------------------------------------------------------------------------------------------------------------------------------------------
Public Transit (est. Jan. 2003) Approximately 100 of Federally funded. Cyber Physical Operations 24x7. E-mail tree Secure e-
the major national Contractor operated. Collects, analyzes, mail Public Transit
transit and disseminates Web site Links to
organizations. security HSOC, and DOT and
information. TSA's Operation
Centers.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Surface Transportation (est. May Includes the major Funded by membership Cyber Physical Natural Operates 24x7. Surface
2002) North American fees and a grant from Conducts mid--to Transportation Web
freight railroads and the Federal Transit longterm technical site. Secure
Amtrak. Represents Administration (FTA). analysis on all telephone.
95% of the U.S. Contractor operated. threats.
freight railroad
industry and Amtrak.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Highway (est. March 2003) Over 90% of the Funded and operated by Cyber Physical Developing 24x7 Highway ISAC Web site
largest for-hire the American Trucking operations. Channels Highway watch center
motor carriers. Association (ATA). warnings, threat Blast fax E-mail
Represents 60% information, and Print media
economic activity advisories to the communications Amber
with over 50% of long industry and to alerts
haul. drivers through its
call center.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Drinking Water & Water Treatment
Systems
--------------------------------------------------------------------------------------------------------------------------------------------------------
Water (est. Dec. 2002) 275-300 small and Funded by tired Cyber Physical Operates 24x7. Encrypted e-mail
large water membership fees and a Analyzes threat and Secure portal Secure
utilities. Represents grant from EPA. incident information electronic bulletin
45% of water Contractor operated. for its potential boards and chat
utilities with secure Receives impact on the rooms
portals. Represents contributions from sector.
85% of the water AMWA.
utilities that
receive e-mail
alerts.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Other Sectors That Have
Established ISACs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Real Estate (est. April 2003) 10 trade associations Funded by trade Physical Operates 24x7. 2-way communications
representing hotels, associations. Depends on DHS for network and Web site
realtors, shopping Contractor operated. threat analysis. Conference calls
centers, and others. with top executives
from various sectors
as needed.
--------------------------------------------------------------------------------------------------------------------------------------------------------
\7\ Government Emergency Telecommunications Service (GETS)
Sector Coordinator Roles Differ
As discussed earlier, federal CIP policy establishes the position
of sector coordinator for identified critical infrastructure sectors to
initiate and build cooperative relationships across an entire
infrastructure sector. In most cases, sector coordinators have played
an important role in the development of their respective infrastructure
sectors' ISACs. In many cases the sector coordinator also manages or
operates the ISAC.
The North American Electric Reliability Council, as
sector coordinator for the electricity segment of the energy
sector, operates the Electricity Sector ISAC.
The Association of American Railroads, as a sector
coordinator for the transportation sector, manages the Surface
Transportation ISAC.
The Association of Metropolitan Water Agencies, as the
sector coordinator for the water and wastewater sector, manages
the Water ISAC
In addition, regarding the telecommunications ISAC, sector
coordinators participate as members of the ISAC. For example, the
Cellular Telecommunications and Internet Association, the United States
Telecom Association, and the Telecommunications Industry Association
are all members of the NCC, which operates the telecommunications ISAC.
In the case of the Financial Services ISAC, no formal relationship
exists between the Banking and Finance Sector Coordinator, the
Financial Services Sector Coordinating Council, and the ISAC; however,
according to Financial Services ISAC officials, there is a good
relationship between them.
Other ISACs were created and are operated without a formal sector
coordinator in place, including the Chemical, Emergency Management and
Response, and Food ISACs.
Council Established to Improve ISACs' Efficiency and Effectiveness
Eleven ISACs created an ISAC Council to work on various
operational, process, and other common issues to effectively analyze
and disseminate information and, where possible, to leverage the work
of the entire ISAC community. The ISACs initiated this effort without
federal sponsorship. Currently, the participating ISACs include
Chemical, Electricity, Energy, Financial Services, Information
Technology, Public Transit, Surface Transportation, Telecommunications,
Highway, and Water. In addition, the Multi-state and Research and
Education Networks ISACs are participants.
In February 2004, the council issued eight white papers to reflect
the collective analysis of its members and to cover a broad set of
issues and challenges, including
Government/Private-sector Relations. Explains the need
for DHS to clarify its expectations and to develop roles and
responsibilities for the ISACs.
HSPD-7 Issues and Metrics. Describes specific issues
related to the private-sector that DHS should address when
responding to HSPD-7.
Information Sharing and Analysis. Identifies future
goals that the ISACs may want to work on achieving, including
developing an implementation plan.
Integration of ISACs into Exercises. Discusses the
importance of the ISACs and the private infrastructure sectors
being involved in government exercises that demonstrate
responses to possible incidents.
ISAC Analytical Efforts. Describes the various levels
of capabilities that individual ISACs may want to consider
supporting, including cyber and physical analysis.
Policy and Framework for the ISAC Community.
Identifies common policy areas that need to be addressed to
provide effective, efficient, and scalable information sharing
among ISACs and between ISACs and the federal government.
Reach of Major ISACs. Describes and identifies the
degree of outreach that the ISACs have achieved into the U.S.
economy. As of September 2003, the ISAC Council estimated that
the ISACs had reached approximately 65 percent of the critical
infrastructures they represent.
Vetting and Trust. Discusses the processes for sharing
information and the need to develop trust relationships among
individual ISAC members and among the various ISACs.
Federal Efforts to and Interaction with the ISACs Continue
As outlined in HSPD-7 and presented in table 1, DHS and other
federal agencies are designated as sector-specific agencies for the
critical Establish Cooperation infrastructure sectors identified. In
addition, DHS is responsible for coordinating the overall national
effort to enhance the protection of the critical infrastructure and key
resources of the United States and has established organizational
structures to address its CIP and information-sharing responsibilities.
DHS and the sector-specific agencies have undertaken a number of
efforts to address the public/private partnership that is called for by
federal CIP policy, and they continue to work on their cooperation and
interaction with the ISACs and with each other.
DHS Actions to Improve Information-sharing Relationships
The functions DHS provides to each ISAC differ, and its
coordination and levels of participation vary for each sector-specific
agency. However, the department has undertaken a number of efforts with
the ISACs and sector specific agencies to implement the public/private
partnership called for by federal CIP policy.
DHS has established functions within the department to support the
ISACs and other CIP efforts. IAIP, as the DHS component directly
responsible for CIP activities, carries out many of these functions.
The Infrastructure Coordination Division within IAIP plays a key role
in coordinating with the ISACs concerning information sharing.
Nonetheless, ISACs may interact with multiple components of the
department. For example, the ISACs may discuss cyber issues with the
National Cyber Security Division. According to a DHS official, the
department does not intend to establish a single point of contact for
ISACs within the department. Rather, the department plans to develop
policies and procedures to ensure effective coordination and sharing of
ISAC contact information among the appropriate DHS components. In
addition, the Infrastructure Coordination Division is in the process of
staffing analysts who are responsible for working with each critical
infrastructure sector. The analysts would serve as the primary point of
contact for the sectors and would address information sharing,
coordination, information protection, and other issues raised by the
sectors.
Further, according to DHS officials, TSA, within the department's
Border and Transportation Security Directorate, is working with
organizations in the private sector to establish information-sharing
relationships. For example, Surface Transportation ISAC analysts stated
that they have a good working relationship with TSA, and TSA's
Operations Center has office space designated for them.
In addition, other DHS actions include the following:
Last summer, DHS, the Department of Agriculture
(USDA), and the Department of Health and Human Services' (HHS)
Food and Drug Administration (FDA) initiated efforts to
organize the agriculture and food critical infrastructure
sectors to raise awareness and improve security efforts. An
introductory conference was held with about 100 leading sector
corporations and associations to make the business case for
participating in CIP efforts, including the importance of
enhancing security and sharing information within the sectors.
In December, DHS hosted a 2-day CIP retreat with ISAC
representatives, sector coordinators, and high-level DHS and
White House Homeland Security Council officials. Participants
discussed the needs, roles, and responsibilities of public--and
private-sector entities related to information sharing and
analysis, incident coordination and response activities,
critical infrastructure information requests, and level of DHS
funding. During this retreat, DHS participated in the first
meeting of the Operational Clarity and Improvement Task Group,
which was formed by the ISAC Council and sector coordinators to
address the need for a common conceptual framework and to
clarify current and future efforts to protect the nation's
critical infrastructure.
In January, DHS's IAIP Directorate held a 2-day
conference to describe the information it is analyzing and the
use of that information in the partnership with the private
sector to discuss information sharing between the federal
government and the private sector.
In February, the department established the Protected
Critical Infrastructure Information (PCII) Program, which
enables the private sector to voluntarily submit infrastructure
information to the government. DHS's IAIP Directorate is
responsible for receiving submissions, determining if the
information qualifies for protection and, if it is validated,
sharing it with authorized entities for use as specified in the
Critical Infrastructure Information Act of 2002.
In addition to the efforts listed above, DHS officials stated that
they provide funding to some of the ISACs. For example, DHS has agreed
to fund tabletop exercises for the Financial Services,
Telecommunications, and Electricity Sector ISACs. DHS anticipates that
the tabletop exercises will be completed by August 2004. Also, DHS
expects to fund a cross-sector tabletop exercise. According to the
Financial Services ISAC, funding for their tabletop exercise is
$250,000.
Another effort that DHS has undertaken is to maintain regular
contact with the ISACs. For example, a DHS analyst specializing in the
chemical sector stated that the Chemical ISAC is in daily contact with
DHS and that it participates in DHS-sponsored biweekly threat meetings.
The department also conducts weekly conference calls with several
ISACs, other DHS components, and private-sector organizations to
discuss threats and viruses.
Sector-specific Agencies Have Taken Action to Assist the ISACs
HSPD-7 designates federal departments and agencies to be sector-
specific agencies. These federal agencies, among other things, are to
collaborate with the private sector and continue to encourage the
development of information-sharing and analysis mechanisms. In
addition, sector-specific agencies are to facilitate the sharing of
information about physical and cyber threats, vulnerabilities,
incidents, potential protective measures, and best practices. Another
directive, HSPD-9, establishes a national policy to defend the
agriculture and food system against terrorist attacks, major disasters,
and other emergencies. Some sector-specific agencies have taken steps
to help the ISACs to increase their memberships and breadth of impact
within their respective sectors and to improve their analytical and
communications capabilities.
Environmental Protection Agency (EPA). As noted
earlier, EPA is the sector-specific agency for the water
sector. According to EPA officials, its Office of Water (Water
Security Division), which has been designated as the lead for
drinking water and wastewater CIP efforts, is currently
revising EPA's Office of Homeland Security's Strategic Plan. In
addition, the division is working on a General Strategic Plan,
to identify measurable goals and objectives and determine how
the division will accomplish that work. Further, these
officials stated that for fiscal year 2004, EPA issued a $2
million grant to the Water ISAC to enhance its capabilities,
for example, to fund 24x7 operations and to increase and
support ISAC membership. They also stated that EPA issued $50
million in grants to assist the largest drinking water
utilities in conducting vulnerability assessments. There are
also state grants to build communications networks for
disseminating information, particularly to smaller utility
companies. EPA's Water Security Division also makes publicly
available various resources related to water security
including, among other things, emergency response guidelines,
risk assessment and vulnerability assessment methodologies, and
a security product guide. The division has also developed a
``Vulnerability Assessment Factsheet'' that gives utility
companies additional guidance on vulnerability assessments.
Moreover, the Water Security Division holds biweekly conference
calls with water associations to promote communications between
EPA and the private sector, and it provides EPA publications
and other information to the Water ISAC through e-mail
distribution lists. In addition, the division has 10 regional
offices that work with the states.
Department of the Treasury (Treasury). As the sector-
specific agency for the Banking and Finance sector, Treasury's
Office of CIP and Compliance Policy is responsible for CIP-
related efforts. It has developed policy for its role as a
sector-specific agency. The policy includes steps to identify
vulnerabilities with the assistance of the institutions,
identify actions for remediation, and evaluate progress in
reducing vulnerabilities. A major effort by Treasury was having
consultants work with the Financial Services ISAC's board of
directors to evaluate ways to improve the overall reach and
operations of the ISAC. According to Treasury officials, this
effort, in part, led to a $2 million grant from Treasury to the
ISAC for developing the ``next generation'' Financial Services
ISAC. The one-time grant was earmarked for enhancing the ISAC's
capabilities. Regarding interaction with the Financial Services
ISAC, Treasury informally shares high-level threat and incident
information with the sector through the ISAC. The department
also chairs the Financial and Banking Information
Infrastructure Committee (FBIIC), a group of regulators who
coordinate regulatory efforts to improve the reliability and
security of financial systems. This group has done a number of
things to raise awareness and improve the reliability of the
institutions. For example, under the sponsorship of the Federal
Deposit Insurance Corporation, there are regional outreach
briefings that address why the private sector needs to partner
with the federal government to improve its security. Moreover,
FBIIC has sponsored the 3,600 priority telecommunications
circuits for financial institutions under the National
Communications System's Telecommunications Service Priority and
Government Emergency Telecommunications Service programs.
Department of Energy (DOE). As the sector-specific
agency for the Energy and Electricity sectors, DOE's Office of
Energy Assurance is responsible for fulfilling the roles of
critical infrastructure identification, prioritization, and
protection for the energy sector, which includes the
production, refining, and distribution of oil and gas, and
electric power--except for commercial nuclear power facilities.
However, DOE does not address situational threats such as
natural disasters or power outages with its ISACs because, in
part, the ISACs are determining whether it is their role to
address these types of threats. Information sharing with the
ISACs is an informal process, and no written policy exists. For
example, DOE is collecting threat information related to
hackers and computer security, but the department is not
disseminating it to the ISACs or to private industry. The
Office of Energy Assurance hopes to clarify and expand on this
subject in its International Program Plan, which is currently
in draft form.
Department of Health and Human Services (HHS). As
mentioned earlier, HHS is the sector-specific agency for the
public health and healthcare sector, and it shares that role
with USDA for the food sector. Currently, there is no ISAC for
the healthcare sector. Efforts to organize the healthcare
sector have been ongoing. In July 2002, HHS officials and other
government and industry participants were invited to the White
House conference center to discuss how they wanted to organize
the sector. A Healthcare Sector Coordinating Council (HSCC) was
formed, and HHS requested that MITRE, its contractor, lend
technical support to the new group as it continues to organize
the sector and establish an ISAC. In addition, HHS officials
stated that the department provided $500,000 for ISAC efforts
in fiscal year 2003 and budgeted $1 million for fiscal year
2004. HHS officials stated that the department would likely be
agreeable to continuing to provide funding for an ISAC. They
also stated that an ISAC could be operational within the next
year. In the meantime, HHS is sharing information with the
industry through an e-Community group that MITRE has set up on
a secure Web site.
Agriculture and Food were only recently designated as critical
infrastructure sectors and, as with the healthcare sector, efforts to
organize the sectors are in the beginning stages. HHS has worked with
the Food Marketing Institute-operated Food ISAC since it was
established, but the department has focused more of its efforts on
organizing the agriculture and food sectors. As we mentioned earlier,
HHS helped initiate efforts to organize the sector by holding an
introductory conference last summer for about 100 leading sector
corporations and associations to make the business case for
participating in CIP efforts. Recently, the department co-hosted a
meeting with DHS and USDA in which industry participants were asked how
they wished to organize into an infrastructure sector, including
addressing the existence and expansion of the current Food ISAC. As a
result of this meeting, participants agreed to establish a council of
about 10-15 private-sector food and agriculture organizations to
represent the sector. A federal government council will be created to
interact with the private sector and with state and local governments.
The government council will initially include several federal
government agencies and state and local entities. According to HHS
officials, the timeframe for organizing the sector and setting up an
expanded Food ISAC has not been determined, but officials anticipated
this occurring by fall of 2004.
Department of Agriculture (USDA). As mentioned above,
USDA shares with HHS the sector-specific agency designation for
the food sector. USDA participated in a conference held last
summer and a recent meeting with the industry. In addition to
those events, USDA's Homeland Security Council Working Group is
involved in enhancing the agriculture sector's information-
sharing and analysis efforts, which may include replacing or
improving the current Food ISAC. Another USDA effort uses
training to reach out to the industry and raise awareness. For
example, USDA is providing training to private-sector
veterinarians and animal hospitals on recognizing possible
signs of bioterrorism activity.
Although no longer a sector-specific agency for the transportation
sector, DOT, through its Federal Transit Administration, has provided a
grant to the Public Transportation ISAC to provide for memberships at
no cost.
Challenges to ISAC Establishment and Partnership with the Federal
Government
Increasing Sector Participation and Reach
Our discussions with the ISACs and the series of ISAC Council white
papers confirmed that a number of challenges remain to the successful
establishment and operation of ISACs and their partnership with DHS and
other federal agencies. Highlighted below are some of the more
significant challenges identified, along with any successful ISAC
practices and related actions that have been taken or planned by DHS or
others.
Many of the ISACs report that they represent significant
percentages of their industry sectors; at least one--the Electricity
ISAC--reports participation approaching 100 percent. The ISAC Council
estimates that the overall ISAC community possess an outreach and
connectivity capability to reach approximately 65 percent of the
private critical infrastructure. The Council also recognizes the
challenge of increasing sector participation, particularly to reach
smaller entities that need security support, but have insufficient
resources to actively contribute and pay for such support. Officials in
DHS's IAIP acknowledge the importance of reaching out to critical
infrastructure entities, and are considering alternatives to address
this issue.
The Financial Services ISAC provides a notable example of efforts
to respond to this challenge. Specifically, officials for this
organization reported that, as of March 2003, its members represented a
large portion of the sector's assets, but only 0.2 percent of the
number of entities with small financial services firms and insurance
companies, in particular, were underrepresented. To increase its
industry membership, this organization established its next generation
ISAC, which provides different levels of service--ranging from a free
level of basic service to fees for value-added services--to help ensure
that no entity is excluded because of cost. Further, it has set goals
of delivering urgent and crisis alerts to 80 percent of the Banking and
Finance sector by the end of 2004 and to 99 percent of the sector by
the end of 2005. To help achieve these goals, the Financial Services
ISAC has several other initiatives under way, including obtaining the
commitment of the Financial Services Sector Coordinating Council
(FSSCC--the sector coordinator and primary marketing arm for this ISAC)
to drive the marketing campaign to sign up its members for the
appropriate tier of service; encourage membership through outreach
programs sponsored by the Federal Deposit Insurance Corporation and the
FSSCC in 24 cities; and to work with individual sector regulators to
include in their audit checklists whether a firm is a member of the
ISAC. The Financial Services ISAC believes that its goals are
attainable and points to its industry coverage, which it says had
already increased to 30 percent in March 2004--only three months after
its new membership approach began in December 2003.
Other issues identified that were related to increasing sector
participation and reach included the following,
Officials at two of the ISACs we contacted considered
it important that the federal government voice its support for
the ISACs as the principal tool for communicating threats.
The ISAC Council has suggested that a General Business
ISAC may need to be established to provide baseline security
information to those general businesses that are not currently
supported by an ISAC.
Many of the industries that comprise our nation's
critical infrastructures are international in scope. Events
that happen to a private infrastructure or public sector
organization in another country can have a direct effect in the
United States, just as events here could have effects in other
countries. Therefore, an ISAC may need to increase its reach to
include the reporting and trust of international companies and
organizations.
Building Trusted Relationships
A key element in both establishing an ISAC and developing an
effective public/private partnership for CIP is to build trusted
relationships and Building Trusted Relationships processes. From the
ISAC perspective, sharing information requires a trusted relationship
between the ISAC and its membership, such that companies and
organizations know their sensitive data is protected from others,
including competitors and regulatory agencies. According to the ISAC
Council, the ISACs believe that they provide a trusted
informationsharing and analysis mechanism for private industry in that
they manage, scrutinize, establish, and authenticate the identity and
ensure the security of their membership, as well as ensuring the
security of their own data and processes. Other steps taken by ISACs to
safeguard private companies' information, which may help to foster
trusted relationships, included sharing information with other entities
only when given permission to do so by the reporting entity and
providing other protections, such as distributing sensitive information
to subscribers through encrypted e-mail and a secure Web portal.
Building trusted relationships between government agencies and the
ISACs is also important to facilitating information sharing. In some
cases, establishing such relationships may be difficult because sector-
specific agencies may also have a regulatory role; for example, the
Environmental Protection Agency has such a role for the Water sector
and HHS' Food and Drug Administration has it for portions of the Food
and Agriculture sectors.
Information Sharing Between the Private Sector and Government
Sharing information between the federal government and the private
sector on incidents, threats, and vulnerabilities continues to be a
challenge. As we reported last year, much of the reluctance by ISACs to
share information has focused on concerns over potential government
release of that information under the Freedom of Information Act,
antitrust issues resulting from information sharing within an industry,
and liability for the entity that discloses the information.\8\
However, our recent discussions with the ISACs--as well as the
consensus of the ISAC Council--identified additional factors that may
affect information sharing by both the ISACs and the government.
---------------------------------------------------------------------------
\8\ U.S. General Accounting Office, Critical Infrastructure
Protection: Efforts of the Financial Services Sector to Address Cyber
Threats, GAO-03-173 (Washington, D.C.: Jan. 30, 2003); and Critical
Infrastructure Protection: Challenges for Selected Agencies and
Industry Sectors, GAO-03-233 (Washington, D.C.: Feb. 28, 2003).
---------------------------------------------------------------------------
The ISACs we contacted all described efforts to work with their
sector specific agencies, as well as with other federal agencies,
ISACs, and organizations. For example, the Public Transit ISAC said
that it provides a critical link between the transit industry, DOT,
TSA, DHS, and other ISACs for critical infrastructures and that it
collects, analyzes, and distributes cyber and physical threat
information from a variety of sources, including law enforcement,
government operations centers, the intelligence community, the U.S.
military, academia, IT vendors, the International Computer Emergency
Response Community, and others. Most ISACs reported that they believed
they were providing appropriate information to the government but,
while noting improvements, still had concerns with the information
being provided to them by DHS and/or their sector specific agencies.
These concerns included the limited quantity of information and the
need for more specific, timely, and actionable information. In
particular, one ISAC noted that it receives information from DHS
simultaneously with or even after news reports, and that sometimes the
news reports provide more details.
In its recent white papers, the ISAC Council also has identified a
number of barriers to information sharing between the private sector
and government. These included the sensitivity of the information (such
as law enforcement information), legal limits on disclosure (such as
Privacy Act limitations on disclosure of personally identifiable
information), and contractual and business limits on how and when
information is disclosed (e.g., the Financial Services ISAC does not
allow any governmental or law enforcement access to its database). But
the Council also emphasized that perhaps the greatest barriers to
information sharing stem from practical and business considerations in
that, although important, the benefits of sharing information are often
difficult to discern, while the risks and costs of sharing are direct
and foreseeable. Thus, to make information sharing real, it is
essential to lower the practical risks of sharing information through
both technical means and policies, and to develop internal systems that
are capable of supporting operational requirements without interfering
with core business. Consequently, the technical means used must be
simple, inexpensive, secure, and easily built into business processes.
According to the Council, the policy framework must reduce
perceived risks and build trust among participants. Further, the
Council identified three general areas that must be addressed in policy
for the information-sharing network to assure network participants that
there is good reason to participate and that their information will be
dealt with appropriately. These areas concern policies related to what
information is shared within ISACs, across ISACs, and to and from
government; actions to be performed at each node in the information-
sharing network, including the kinds of analysis to be performed; and
the protection of shared information and analysis in terms of both
limitations on disclosure and use and information security controls.
The white papers also described the processes that are believed to
be needed to ensure that critical infrastructure and/or security
information is made available to the appropriate people with reasonable
assurance that it cannot be used for malicious purposes or
indiscriminately re-distributed so as to become essentially public
information. These processes and other information-sharing
considerations and tasks identified by the Council included the
following:
The ISAC information-sharing process needs to
recognize two types of information categories--classified and
sensitive but unclassified. However, the majority of
information sharing must focus on the unclassified ``actionable
element'' that points the recipient to a problem and to
remediation action.
Each ISAC is responsible for initially validating the
trust relationship with its member organizations and for
periodically re-assessing that trust relationship. The security
structure must understand and continually be in dialogue with
its vetted members and must manage this trusted relationship.
Each individual who receives shared information must
have a background check completed by and at a level of
comprehensiveness specified by the sponsoring organization.
Consequences and remediation must be developed and
understood to address situations in which information is
disclosed improperly--either intentionally or unintentionally.
The government's data and information requirements for
the sectors and the sectors' requirements for the government
need to be defined.
The government should establish a standing and formal
trusted information-sharing and analysis process with the ISACs
and sector coordinators as the trusted nodes for this
dissemination. This body should be brought in at the beginning
of any effort, and DHS products should be released to this
group for primary and priority dissemination to their
respective sectors.
Building this trusted information-sharing and analysis process is
also dependent on the protections the government provides for the
sensitive data shared by ISACs and private companies. As discussed
earlier, DHS recently issued the interim rule for submitting protected
critical infrastructure information, which provides restrictions on the
use of this information and exempts it from release under the Freedom
of Information Act. However, it remains to be seen whether these
protections will encourage greater private-sector trust and information
sharing with the federal government.
Identifying Roles and Responsibilities
Federal CIP law and policies, including the Homeland Security Act
of 2002, the National Strategy to Secure Cyberspace, and HSPD-7,
establish CIP responsibilities for federal agencies, including DHS and
others identified as sector-specific agencies for the critical
infrastructure sectors. However, the ISACs believe that the roles of
the various government and private sector entities involved in
protecting critical infrastructures must continue to be identified and
defined. In particular, officials for several ISACs wanted a better
definition of the role of DHS with respect to them. Further, officials
for two ISACs thought other agencies might more appropriately be their
sector-specific agencies. Specifically, the Energy ISAC would like its
sector-specific agency to be DHS and not the Department of Energy,
which is also the regulatory agency for this sector. On the other hand,
the Highway ISAC thought its sector-specific agency should be the
Department of Transportation--the regulatory agency for its sector--and
not DHS.
The ISAC Council also identified the need for DHS to establish the
goals of its directorates and the relationships of these directorates
with the private sector. The Council also wants clarification of the
roles of other federal agencies, state agencies, and other entities--
such as the National Infrastructure Assurance Council.
Obtaining Government
Ten of the ISACs we contacted, plus the Healthcare sector,
emphasized the importance of government funding for purposes including
creating the ISAC, supporting operations, increasing membership,
developing metrics, and providing for additional capabilities.
According to ISAC officials, some have already received federal
funding: the Public Transit ISAC initially received a $1.2 million
grant from the Federal Transit Administration to begin operations, and
the Water ISAC received a $2 million grant from EPA for fiscal year
2004 to cover annual operating costs and expand memberships to smaller
utilities. In addition, the Financial Services ISAC received $2 million
from the Department of the Treasury to help establish its next-
generation ISAC and its new capabilities, including adding information
about physical threats to the cyber threat information it disseminates.
Despite such instances, funding continues to be an issue, even for
those that have already received government funds. For example, the
Healthcare Sector Coordinating Council, which is the sector coordinator
for the healthcare industry, is currently looking to the federal
government to help fund the creation of a Healthcare ISAC. Also,
officials at the Public Transit ISAC noted that funding is an ongoing
issue that is being pursued with DHS. Officials at the Financial
Services ISAC, who notes that the ISAC's goal is to become totally
self-funded through membership fees by 2005, are also seeking
additional government funding for other projects.
The ISAC Council has also suggested that baseline funding is needed
to support core ISAC functionalities and analytical efforts within each
sector. The Council's suggestions include that the government should
procure a bulk license for the ISACs to receive data directly from some
vulnerability and threat sources and access to analytical or modeling
tools and that the funding for an ISAC analyst to work at DHS to
support analysis of sector-specific information or intelligence
requirements.
According to the Financial Services ISAC, DHS has agreed to fund
tabletop exercises for some ISACs. For example, according to DHS
officials, exercises are occurring this week involving the Banking and
Finance sector and exercises for other sectors are currently being
explored. In addition, energy sector-related exercises were held
earlier in the year. DHS officials also stated that funding
considerations for the critical infrastructure sectors and the ISACs
would be based on their needs.
Utilizing Sector Expertise
In our discussions with ISAC officials, several, such as officials
from the Surface Transportation and the Telecommunications ISACs,
highlighted their analysis capabilities and, in particular, their
analysts' sector-specific knowledge and expertise and ability to work
with DHS and other federal agencies. The ISAC Council also emphasized
that analysis by sector specific, subject matter experts is a critical
capability for the ISACs, intended to help identify and categorize
threats and vulnerabilities and then identify emerging trends before
they can affect critical infrastructures. Sector-specific analysis can
add critical value to the information being disseminated, with products
such as 24/7 immediate, sector-specific, physical, cyber, all threat
and incident report warning; sector-specific information and
intelligence requirements; forecasts of and mitigation strategies for
emerging threats; and cross-sector interdependencies, vulnerabilities,
and threats.
The Council also emphasized that although government analytical
efforts are critical, private-sector analytical efforts should not be
overlooked and must be integrated into the federal processes for a more
complete understanding. The private sector understands its processes,
assets, and operations best and can be relied upon to provide the
required private-sector subject matter expertise.
In a few cases, the integration of private-sector analytical
capabilities with DHS does occur. For example, the Telecommunications
ISAC, as part of Participation in National Homeland Security DHS's
National Communication System, has watch standers that are part of the
DHS operations center and share information, when the information owner
allows it and when it is appropriate and relevant, with the other
analysts. In addition, a Surface Transportation ISAC analyst also
participates in the DHS operations center on a part-time basis to offer
expertise and connection to experts in the field in order to clarify
the impact of possible threats.
Participation in National Homeland Security Exercises
The ISAC Council highlighted the need for ISAC participation in the
national-level homeland security exercises that are conducted by the
federal government, such as DHS's May 2003 national terrorism exercise
(TOPOFF 2), which was designed to identify vulnerabilities in the
nation's domestic incident management capability. However, according to
the Council, there has been little or no integration of active private
industry and infrastructure into such exercises. For example, private
industry participation in TOPOFF 2 was simulated. The Council believes
that with such participation, both national and private-sector goals
could be established during the creation of the exercise and then
addressed during the exercise.
The Council did identify examples where the private sector is being
included in exercises, such as efforts by the Electronics Crime Unit of
the U.S. Secret Service to reach out to the private sector and support
tabletop exercises to address the security of private infrastructures.
Further, according to a DHS official, the department has agreed to fund
tabletop exercises for members of several ISACs, including Financial
Services, Chemical, and Electricity, as well as a cross-sector tabletop
exercise.
Additional Challenges
Additional challenges identified by our work and/or emphasized by
the ISAC Council included the following.
Obtaining Security Clearances to Share Classified
Information. As we reported last year, several ISACs identified
obtaining security clearances as a challenge to government
information sharing with the ISACs. Seven of the 15 ISACs with
which we discussed this issue indicated either that some of
their security clearances were pending or that additional
clearances would be needed.
Identifying Sector Interdependencies. Federal CIP
policy has emphasized the need to identify and understand
interdependencies between infrastructure sectors. The ISAC
Council also highlighted the importance of identifying
interdependencies and emphasized that they require partnerships
between the sectors and the government and could only be
modeled, simulated, or ``practiced'' once the individual
sectors' dynamics are understood sufficiently. The current
short-term focus for the ISACs is to review the work done by
the government and the sectors regarding interdependencies.
Similarly, a DHS official acknowledged the importance of
identifying interdependencies, but that it is a longer-term
issue.
Establishing Communications Networks. Another issue
raised through the ISAC Council's white papers was the need for
a government-provided communications network for secure
information sharing and analysis. Specifically, the Council
suggested that although functionality would be needed to
satisfy the ISACs' requirements, DHS's Critical Infrastructure
Warning Information Network (CWIN) could be used as an interim,
first-phase communications capability. According to the
Council, some of the ISACs are conducting routine
communications checks at the analytical level in anticipation
of expanded use of CWIN. In discussing this issue with a DHS
official, he said that ISAC access to a secure communications
network would be provided as part of the planned Homeland
Security Data Network (HSDN). DHS recently announced a contract
to initiate the implementation of HSDN, which is be a private,
certified, and accredited network that provides DHS officials
with a modern IT infrastructure for securely communicating
classified information. According to DHS, this network will be
designed to be scalable in order to respond to increasing
demands for the secure transmission of classified information
among government, industry, and academia to help defend against
terrorist attacks.
DHS Information-Sharing Plan
At the time of our study, the relationship and interaction among
DHS, the ISACs, sector coordinators, and other sector-specific agencies
was still evolving, and DHS had not yet developed any documented
policies or procedures. As we discussed earlier, HSPD-7 requires the
Secretary of Homeland Security to establish uniform policies for
integrating federal infrastructure protection and risk management
activities within and across sectors. According to a DHS official, the
department is developing a plan (referred to as a ``roadmap'') that
documents the current information-sharing relationships among DHS, the
ISACs, and other agencies; goals for improving that information-sharing
relationship; and methods for measuring the progress in the
improvement. According to this official, the plan is to define the
roles and responsibilities of DHS, the ISACs, and other entities,
including a potential overlap of ISAC-related responsibilities between
IAIP and the Transportation Security Administration. Further, the
official indicated that, in developing the plan, DHS would consider
issues raised by the ISAC Council.
In summary, since first encouraged by federal CIP policy almost 6
years ago, private-sector ISACs have developed and evolved into an
important facet of our nation's efforts to protect its critical
infrastructures. They face challenges in increasing their sector
representation and, for some, ensuring their long-term viability. But
they have developed important trust relationships with and between
their sectors--trust relationships that the federal government could
take advantage of to help establish a strong public/private
partnership. Federal agencies have provided assistance to help
establish the ISACs, and more may be needed. However, at this time, the
ISACs and other stakeholders, including sector-specific agencies and
sector coordinators, would benefit from an overall strategy, as well as
specific guidance, that clearly described their roles,
responsibilities, relationships, and expectations. DHS is beginning to
develop a strategy, and in doing so, it will be important to consider
input from all stakeholders to help ensure that a comprehensive and
trusted information-sharing process is established.
Mr. Chairman, this concludes my statement. I would be happy to
answer any questions that you or members of the subcommittee may have
at this time.
If you should have any questions about this testimony, please
contact me at (202) 512-3317 or Ben Ritt, Assistant Director, at (202)
512-6443. We can also be reached by e-mail at [email protected] and
[email protected], respectively.
Other individuals making key contributions to this testimony
included William Cook, Joanne Fiorino, Michael Gilmore, Barbarol James,
Lori Martinez, and Kevin Secrest.
Mr. Thornberry. Thank you, sir. I appreciate your much more
detailed written statement which I read last night, that goes
into considerably more detail.
Mr. McCurdy, if you can do 5 minutes, we will go ahead and
have you at it.
STATEMENT OF THE HONORABLE DAVE MCCURDY, EXECUTIVE DIRECTOR,
INTERNET SECURITY ALLIANCE
Mr. McCurdy. Mr. Chairman, I am used to a 2-minute rule,
actually.
[Laughter.]
I will submit even the summary of my statement for the
record as well. Let me just briefly, as I understand what the
subcommittee is interested in. The Internet Security Alliance
was actually formed in April 2001, 5 months before 9-11. I was
actually in Tokyo at an OECD meeting on 9-11 defining cyber
security best practices. So we have been at this for quite some
time.
We formed a novel model. We had looked at the ISAC models
and we in industry, in representing the Electronic Industries
Alliance of over 2,500 member companies, found that those
models were not sufficient for the needs of industry in
improving cyber security. We created a cross-sectoral
international organization that integrates many of the security
services into one coherent model. The Internet Security
Alliance is structured in a fundamentally different way than
the traditional ISACs.
Let me just briefly say what they are. Cross-sectoral, we
have members from the financial industry, from insurance,
telecommunications, defense and security industries, consumer
electronics, food products, and even the National Association
of Manufacturers that represents over 12,000 companies. We
designed the organization this way because quite frankly the
Internet is structured this way, cross-sectoral. It knows no
borders. It knows no boundaries, whether it is national or
international. A cyber-attack on the Internet affects a lot of
these companies the same way. I do not care if you are AIG,
Coca-Cola, Sony, Verizon or Visa, all of whom are members of
the Internet Security Alliance.
I said it is international. We have members on four
continents. These are trusted partners, but they are dealing
with similar concerns, and that is consistent with the national
plan to secure cyber space. We are also developing security
anchor programs in Latin America and other countries such as
India.
Finally, our model attempts to provide, when I say a
comprehensive, coherent and integrated approach to cyber
security, we go beyond just information sharing. We had a
partnership with the CERT/CC. I serve on the board of advisers
for the Carnegie Mellon Software Engineering Institute and
developed this relationship over quite some time on how they
could improve their dissemination of information and get the
feedback from industry.
We developed best practices. We are in our third practice
book that just came out for small businesses. We had one for
corporate leadership, the CEO-level leadership in major
companies, and we had one for individual users. We have teamed
with groups in order to make that work. We get that information
from industry, working to build on the research also at
Carnegie Mellon. These practice editions have been endorsed by
TechNet and Partnership for Critical Security, NAM, the U.S.
Chamber, and others.
In addition to that, we believe that wide distribution is
critical, but currently it is not being done sufficiently. So
we have developed some market-based incentives and some
programs to try to get higher buy-in from the industry
leadership. We have developed a program with AIG insurance
where you have discounts if you follow best practices. There
are tools being developed by a consortium on security trying to
have metrics by which they can even determine whether or not
there is a qualified member in order to participate.
Finally, a lot of this I think when people think of cyber,
they think it is only an IT issue. It is both a physical and an
IT issue. They are interlinked. We have been doing this for
some time. TIA, Telecommunications Industry Association, is our
sector association in that space, and they have been a sector
leader on critical infrastructure long before 9-11 or the
recent concerns.
We are also working on risk management relationships and
initiatives with industry. Lastly, I think the headline from
this hearing and the question you really have is, how are we
working with DHS? I commend DHS for their efforts. They finally
have staff on the ground in place, and I think they are looking
at developing plans. They appear to have decided on the ISAC
Council as their prime link to the private sector, but the
ISACs, while critical elements in this struggle, quite frankly
do not represent everyone.
My concern from my experience, having sat where you do in
this very room for many, many hours, I can assure you that
government's approach is often silo-based and that is part of
the problem that we have seen in dealing with government
institutions and sharing. We decided we had to reach beyond
that. That is why we created the Internet Security Alliance. We
want to work with DHS. We want to be fully integrated into
their discussions and we want to be full members of the
partnership, whether that means that we are a cross-sector ISAC
at some point of a tier-one partner. We do not know what the
classification should be, but we do reach out. We have a great
deal of experience.
We also have a great deal of experience with the CERT/CC on
how we can help them improve the type of information which is
relevant to industry. We were talking about information
overload. I get emails every single day with another alert.
There were four this morning, as a matter of fact. I think
there is a way to narrow those. Mr. Dacey mentioned conference
calls. We want to analyze the information and we pull groups
together that actually take these alerts and translate them to
meaningful, actionable items that the corporate sector or
industry can actually work to improve their security.
Again, I appreciate the opportunity. I look forward to
working with you all. I commend you for your efforts. I know
how serious you take this and how important it is for the
nation. Again, this is just not a national issue. This is
cross-border. It is international. We think we have opened the
way to help address the bigger plan, the bigger strategy of
reaching other countries as well.
Thank you.
[The statement of Mr. McCurdy follows:]
Prepared Statement of the Honorable Dave McCurdy
Thank You Mr. Chairman.
My name is Dave McCurdy. I am President of the Electronic
Industries Alliance and Executive Director of the Internet Security
Alliance (ISAlliance).
I am delighted to be here today to discuss how the federal
government can improve its coordination with the private sector and
thus, improve worldwide information security.
As a cross-sector, international organization, which integrates
many different security services into one coherent model, the Internet
Security Alliance, is structured in a fundamentally different way than
traditional Information Sharing and Analysis Centers (ISACs). We
believe this model has much to recommend, not as a substitute for the
ISACs, but as a complement to them. I am concerned, however, that we
are not yet seeing this potential realized. Greater involvement and
coordination with the ISACs and the Department of Homeland Security
(DHS) would be extremely helpful to organizations like the ISAlliance,
and the companies they represent and I believe would be in the best
interests of our own national security.
Today I would l like to cover three main points.
1. I would like to outline the model the Internet Security
Alliance operates under and suggest some fundamental
differences from the traditional ISAC model.
2. I want to discuss how this model facilitates the development
of an integrated, comprehensive, and coherent approach to cyber
security, and I want to offer a couple of examples of how this
approach can enhance our efforts to promote cyber security.
3. I want to raise some organizational issues regarding DHS
coordination with models such as ours. I believe that
organizations such as our need to be fully integrated into the
public private partnership between DHS and the private sector
either as an inter-sectoral ISAC or with equivalent status
within the tier one partnership with the ISACs.
Before I begin I want to make our posture with respect to the ISACs
very clear. About a quarter of our membership also participates in
ISACs. Some of our Board members also serve on the Boards of various
ISACs. We regard the ISACs as ``comrades in arms.''
It is surely true that there are some issues unique to industry
sectors that are most effectively dealt with by a sector specific
domestic entity. However, the ISAlliance also concurs with the National
Strategy to Secure Cyber Space that found that ``some cyber security
problems have national implications and cannot be solved by individual
enterprises and sectors alone.''
We do not seek to displace the ISACs; we seek to work more closely
with them, and DHS.
THE INTERNET SECURITY ALLIANCE MODEL
CROSS-SECTOR INFORMATION SHARING & ANALYSIS AVAILABLE TO ALL
The ISAlliance was created in April of 2001, five months before the
attacks on the Pentagon and the World Trade Center. We created it
because, even then, we saw the need for a new approach to the growing
cyber threat.
In contrast to the ISACs, which are generally structured along
traditional industry specific silos, the ISAlliance has members from
many different sectors. We designed the organization this way because
the Internet is organized this way. Essentially, we are all using the
same Internet. So, from the cyber security perspective the threats and
attacks may be very similar regardless if you are Coca-Cola, Sony, Visa
or VeriSign (all members of ours). As a result, there is much to learn
from, and help can be offered to, your brother companies regardless of
industry sector.
As a member of the Board of Advisors of the Software Engineering
Institute at Carnegie Mellon University, I have had substantial contact
with the experts at the CERT/cc at Carnegie Mellon who educated me on
this growing problem in 2000. We decided then that the private sector
needed to not only contribute to, but to demonstrate leadership in
making this critical infrastructure more secure. We devised a creative
public private partnership, which integrated and maximized the
complementary assets of CERT, the federal government and private
industry.
CERT/cc, which was funded primarily by the U.S. federal government,
had long been recognized as the premier center for Internet threat and
vulnerability information. But it lacked a practical channel to get
this information to the private sector, or stimulate interest in the
necessary education, training, policy development and incentive
programs that would be required to fully achieve the goal of
information security.
EIA has been involved in physical security through the
Telecommunications Industry Association (TIA) which is both a sector of
EIA and an ISAC sector coordinator. Since we understood that physical
and cyber security are most effectively dealt with in an integrated
fashion, we sought a mechanism to bring these entities together.
We decided on collaboration between CERT/cc and EIA called the
ISAlliance. Using the EIA member companies as a marketing base we
recruited corporations to join the ISAlliance. They paid dues, and in
return, operating under strict non-disclosure agreements would receive
access to prime CERT/cc information. They would share this information
with each other and the CERT/cc to identify and analyze looming threats
and collectively work on solutions.
Since the ISAlliance members were receiving more from CERT/cc than
the general public they agreed to pay a fee for this benefit. It was
seen as a user fee similar to that paid by patrons at National Parks.
While some companies using other, non-CERT, the ISAlliance services
paid substantial dues, we never wanted money to be a barrier to entry
into the ISAlliance. Dues entitling companies to the same CERT/cc
information (albeit fewer copies) were set as low as $3,000 a year--
affordable for virtually any private firm. And, though we don't like to
publicize it for obvious reasons, we have made financial adjustments
for companies who had difficulty making the specified dues payment.
INTERNATIONAL
The ISAlliance is also focused internationally, where ISACs tend to
be U.S.--centric. The ISAlliance has members on four continents. Our
current Chairman of the Board. Dr. Bill Hancock, is from a British
company and we have four other non-U.S. based companies on our Board
along with eleven U.S. based companies. The international aspect of our
efforts is important because cyber security is inherently an
international issue. Many attacks originate offshore and implementing a
truly effective means of securing cyber space must include finding and
working with trusted offshore partners.
As the U.S. National Strategy to Secure Cyber Space states, in
part; ``America's cyberspace is linked to the rest of the world''. . .
. Securing global cyber space will require international cooperation to
raise awareness, increase information sharing, promote security
standards. . .The United States will seek the participation of U.S.
industry to engage foreign counterparts in peer-to-peer dialogue with
the twin objectives of making an effective business case for cyber
security and explaining successful means for partnering with government
on cyber security.''
I'd like to offer a quick example of our efforts. After making a
presentation to the Organization of American States (OAS) first broad
conference on cyber security last August, OAS staff requested that the
ISAlliance construct a specific program to integrate the private sector
in the OAS region into the state-to-state programs for cyber security
that were being developed. We came up with what we call our ``Security
Anchor'' program.
This program is built on the ``Transition Partner'' program
developed at Carnegie Mellon University. Under the Security Anchor
Program private sector entities would obtain a special membership with
the ISAlliance, which will allow them to essentially become ``branch
offices'' within their regions. The Security Anchor for the region
would distribute appropriate information about threats and
vulnerabilities and hold meetings and conferences, but on local time
providing translation as necessary for materials. The Anchor ``tenant''
would also be required to send personnel to Carnegie Mellon where they
would be trained as trainers. The Anchor would then provide this
training in their region, for which they could receive payment. We
believe providing a market incentive to our Anchor partner is the most
efficient and effective way to accomplish the goals set forth in our
National Strategy.
In this way we hope to make international cyber security ``home
grown.'' We believe this is the only way that we can hope to succeed in
reaching the international goals as set forth in the National Strategy.
The U.S. can't expect to ``export'' security.
AN INTERGRATED COMPREHENSIVE AND COHERENT APPROACH TO CYBER SECURITY
USING MARKET FORCES AS INCENTIVES
The ISAlliance attempts to provide its members with a
comprehensive, coherent and integrated approach to cyber security that
uses market forces to drive on-going improvements in cyber hygiene.
INFORMATION DISSEMINATION AND ANALYSIS
Like many ISACs, we begin with information dissemination and
sharing about emerging threats, vulnerabilities and attacks on the
Internet. We have historically done this though a contractual
relationship with the CERT/cc as a founding partner in the ISAlliance.
In our three years of operations we have sent out literally
thousands of these notices. We just released our first quarter
technical report to the membership, which showed that in 2004 alone we
have already sent out through our e-mail channel hundreds of reports,
which have been followed by scores of analytical conferences between
the members and CERT/cc.
When we, started several years ago, our prime activity was
information sharing, mostly through e-mail notices. However, experience
has taught us that simply disseminating information is by no means
enough. In fact, our members have told us that at times there is too
much information being circulated and the real need is to be able to
separate out what is important and what is simply noise.
Information analysis is critical if threat and vulnerability data
is to be used effectively. We facilitate the analytical process with
regularly scheduled, as well as specially scheduled, meetings where in
our members discuss the state of the network with the CERT/cc
professionals. We have found the regularity of this process creates,
over time, a sense of trust and confidence that we think is vital for
effective information sharing.
DEVELOPING BROADLY ENDORSED BEST PRACTICES
While information sharing and analysis is a critical first step on
the road to cyber security, is not sufficient to secure cyber space.
Virtually every recent major attack we have experienced such as
Blaster, Slammer, or MyDoom, resulted from a vulnerability, which was
already well known, in the community.
At the ISAlliance we took the collaborative process of sharing
information and built from it a systematic program of best practices.
The process of developing the best practices is lead by the experts at
Carnegie Mellon and CERT/cc and is consistent with the years of
grounded research they have done and the theory of security that has
evolved from their experience and analysis.
However, we also involve the full membership in our processes, so
that the perspectives of actual businesses from multiple sectors and
counties are folded into the final product. One advantage of this
inclusive process has been that our practices have received an
impressive level of support and endorsement from a wide breadth of the
user community.
For example, our first publication, ``The Common Sense Guide for
Senior Managers'' was endorsed by the National Association of
Manufacturers (NAM) which represents 12,000 of the most traditional of
industries, as well TechNet which primarily represents the high-tech
companies in Silicon Valley. Internationally it has been translated
into Spanish and Japanese and was endorsed by the U.S. India Business
Council and distributed by the Organization of American States.
CREATING MARKET INCENTIVES TO ENCOURAGE ADOPTION OF BEST PRACTICES--THE
QUALIFIED MEMBER PROGRAM
However, developing best practices is also not enough. CEOs are
overwhelmed with information. To succeed with them on this subject,
which has traditionally been viewed as a ``cost center,'' you have to
do more than just tell them it's the right thing to do. We have to talk
about issues they care about, like profitability, liability protection
and marketing. We need to develop market incentives to increase the
Return on Investment (ROI) for cyber security.
The ISAlliance has taken the lead on this issue. In the final
quarter of 2003 we signed an agreement with AIG, which is the world's
market leader in cyber insurance. Under this new agreement AIG will
provide insurance premium credits of up to 15% for companies that will
join the ISAlliance and subscribe to our best practices. We believe
this is the first operating program which specifically ties a widely,
and independently endorsed set of cyber security best practices
directly to lower business costs.
We are working through AIG and the Global Security Consortium
(GSC), comprised of the big auditing and accounting firms, on empirical
standards with which we will be able to use to measure compliance with
these practices. Not only will this tool enable us to more reliably
determine who qualifies for the credits, but also it opens up another
potential market incentive for improved security. We want to interest
firms in marketing cyber security.
Firms that achieve a specified score will be deemed a ``Qualified
Member'' allowing them to use that designation as a market
differentiator. Through this mechanism we hope to make cyber security a
useful marketing tool for good actor companies, much like the Baldrige
Award has been used for high quality companies. GSC hopes to have their
tool completed shortly and then this phase of the program can begin.
DISCOUNTED EDUCATION AND TRAINING COMPLETE THE LOOP
Finally, for firms who don't yet score at an appropriate level to
qualify for our discounts, we offer access to a wide range of training
programs through Carnegie Mellon University. In keeping with the market
orientation of our program, the more active a company is in the
ISAlliance, the greater the discount they can receive on their
training. Our interest is to accurately inform organizations where they
stand in relation to the widely endorsed best practices, and help them
reach an appropriate level if they are not already there. Most
importantly, the people doing the training are operating on the same
assumptions and best practices that we started with in the first place
thus creating a truly coherent program.
BEST PRACTICES FOR SMALLER BUSINESSES
This program is just one example of our activities. In fact, this
afternoon we will be testifying before another Committee on a similar
program, this time specifically targeted to the unique needs of smaller
businesses. The National Cyber Summit, recognizing the value of
programs such as I have just described, and realizing that there was
not nearly enough being done to reach out to smaller businesses, asked
us to undertake this new effort this past December.
Although smaller businesses have not until now been our prime
market interest we agreed to take up the challenge. Working with the
U.S. Chamber of Commerce, the National Federation of Independent
Business (NFIB) and NAM we followed the same integrated, market
centered model we described above. We held ten focus groups involving
nearly 100 small businesses to find out what needed to be done to
improve their cyber security.
What we learned was that smaller institutions are indeed different
from larger ones. In fact, we found that organizations across a wide
spectrum of business types had remarkably similar problems from a cyber
perspective. The similarities for these businesses were not the type of
business they were in, but the size of their business and the extent of
the technology available to them. As a result, the ``Common Sense Guide
to Cyber security for Small and Medium Sized Businesses'' looks quite
different from the Guide for Senior Corporate Managers.
We are happy to report that what was not very different is the
response, which has been extremely positive. Already the Cyber Security
Partnership that grew out of the National Cyber Summit as well as on
the web sites for the ISAlliance, the Electronic Industries Alliance
and the National Association of Manufacturers is distributing the Small
Business Guide. The U.S. Chamber of Commerce has informed us they
expect to endorse the document at their next Board of Directors meeting
and the Financial Services Sector Coordinating Council, an alliance of
28 financial services trade associations will be making it available to
their members and holding a series of meetings with thousands of its
members where the Guide will be highlighted.
Given the fact that this project is only a couple of months old we
are naturally very encouraged. When mature, we fully expect this
program will be coherent, measurable and market driven just as was the
case with the Senior Managers program.
CYBER AND PHYSICAL SECURITY--REACHING OUT TO RISK MANAGERS
Another area we are working on is the integration of cyber and
physical security. We believe, as Secretary Ridge has said, that you
can't have cyber security without physical security and you can't have
physical security without cyber security. However, in corporate America
there remains a misconception that cyber security is an ``IT problem.''
While obviously there are many IT aspects to cyber security it is not
properly classified only as an ``IT problem.''
Cyber security is a management problem. It is an economic problem.
It is an employee training, compliance and retention problem. Most of
all, cyber security is a risk management problem. However, most
corporate structures still relegate the discussion of cyber security to
the IT department rather than fully integrating it into the discussions
with physical security and risk management. We have heard a good deal
of talk recently about structures within the federal security
bureaucracy which may have limited information sharing and proper
threat management. Private industry is not immune to these same types
of organizational problems.
Therefore, we have recently undertaken a pilot study reaching out
to the risk managers in industry in an attempt to find out how we can
better involve them in the cyber security discussion. We believe that
it's critical to better integrate physical and cyber security issues
within the overall corporate risk management structure. We are trying
to find out how we can do that, from the people who are actually making
the organizational, budgeting, and resource allocation decisions.
Although we have initiated this study, it is too early to report
results. We do expect however, that, as was the case with our other
projects, we will learn from this effort and we can make further impact
in securing cyber space. We look forward to sharing these approaches
both with industry, and to the federal government.
NOT JUST SERVICES; A COHERENT INTEGRATED PROGRAM
We believe the comprehensiveness of the ISAlliance program is
making a positive contribution to the cause of information security.
Hundreds of technical notices about Internet threats
and vulnerabilities each year to our members from the best
source available to private industry.
Scores of analytical conferences to discuss the data
and what to do about it
Development of best practices that are widely endorsed
and disseminated both domestically and abroad.
Development of independent, auditable third-party
evaluation tools and methods
A program of market-based incentives to improve the
ROI for cyber security
Education, training and public policy programs.
Initiating new programs to push the envelope into
heretofore underserved populations
But the key aspect is that it is a coherent program. We start with
the hard data we get from CERT and we blend into that the real world
needs and experiences of industry and develop programs, practices and
policies which can drive pragmatic improvements. And then, if
individual entities can't make the grade they are offered training
based on the same theories and practices that were used to develop the
best practices.
COORDINATING WITH THE ISACS AND DHS
As proud of these accomplishments as we are, we have some concerns
for the future.
We supported, and continue to support, the creation of the
Department of Homeland Security. We in no way wish to be critical of
the effort and sincerity of the people who are working at DHS. They are
working very hard to accomplish an enormous task virtually immediately.
We sincerely hope that our testimony at this point will be taken in the
spirit it is given, constructive suggestions that we believe will
assist all of us who are working in this space to be more effective.
In fact the ideas we offer the Committee today have been previously
raised with staff and principals and we are continuing to work on them.
We anticipate that in the due course of time they will be
satisfactorily resolved. We believe, however, that there are very
important issues, which must be appropriately addressed.
DHS SHOULD COORDINATE WITH ALL INFORMATION SHARING ORGANIZATIONS--
NOT JUST ISACS
We suggest DHS broaden its systematic communication to include
organizations, such as the ISAlliance, who are providing important
services, although they are not ISACs.
In the interdependent cyber world the ``critical infrastructures''
may be dependent on the ``non-critical'' organizations that service
them. In addition to the IT, telecom and financial institutions we
represent we count the National Association of Manufacturers among our
sponsors. These are the people who manufacture the parts used to
construct our defense products and operate the supply chains upon which
many ``critical'' businesses rely. These organizations also need to be
systematically included in the on-going public private partnership with
DHS.
Moreover, while we are focused on cyber security today from a
national security perspective, most Internet attacks have nothing to do
with international terrorism. Cyber security is also a critical
business issue and from a business perspective the ``non-critical''
portions of the economy deserve as much protection as the rest of the
economy.
The Department of Homeland Security seems to have decided upon the
ISACs and the ISAC Council as the primary linkage to the private
sector. Since we are not formally an ISAC, we are not part of the ISAC
Council and hence we are not in many of the meetings and discussions
from which DHS appears to be receiving their primary input. We would
like to work with DHS and the ISAC Council to integrate our broad
membership into this forum.
Two years ago Congress passed legislation, which attempted to
facilitate the sharing of information between private industry and the
government. In the initial drafts of that bill the adjustments to FOIA,
etc. were confined to ISACs. It was correctly pointed out to the
drafters that there is in fact information sharing outside of the
formal ISAC structure and the legislation was redrafted to read
``information sharing organizations.'' We believe DHS should follow
this precedent in developing their public private partnership.
COMPANIES NEED THE CERT/CC DATA THEY HAVE COME TO RELY ON
Over the past several years the nearly 60 companies who are members
of the ISAlliance have come to rely on our working relationship with
CERT/cc. Last year, DHS announced that they would be launching USCERT
utilizing in main the facilities formerly known as CERT/cc at Carnegie
Mellon.
We have no objection to DHS creating USCERT. Indeed, we see it as
following and extending the model we created over three years ago for
how to disseminate CERT/cc data to the private sector.
However, it would be problematic if suddenly the ISAlliance members
who have relied on this information to build their corporate security
plans and policies, are now denied access to that data.
Indeed, such an outcome could result in a substantial reduction in
corporate cyber security as companies scramble to find alternative ways
to receive this information. Moreover, the fact that this data might
now be available though an ISAC is not an answer since the majority of
the ISAlliance members, do not participate in ISACs
We would like to work with DHS to assure that the transfer from
CERT/cc to USCERT and their new partners does not ironically result in
less information being available to some worthy companies.
I want to conclude by noting that DHS has been open to meeting with
and discussing ways to coordination with us. Just a few weeks ago I met
privately with Assistant Secretary Liscouski who was most gracious and
cooperative. I also want to single out Director Yoran, who has been
especially helpful and has directed that at least for the short term
the ISAlliance not be denied access to the data its membership has come
to rely on. We are now hoping to finalize an appropriate long-term
solution. Moreover, DHS staff have attended meetings with our
membership and been very supportive. We want to thank and congratulate
the whole team at DHS for their commitment and efforts.
And finally I want to thank you, Mr. Chairman and the joint
Committee for all your work and for holding this hearing this morning.
Mr. Thornberry. Thank you. A lot of issues to pursue. This
hearing will stand in recess until five minutes after the
conclusion of these votes. It will be more than 30 minutes, so
if you all have a chance to go get something to eat or
whatever, please do.
We stand in recess.
[RECESS]
Mr. Thornberry. We are going to go ahead and get started. I
think Mr. McCurdy will be back shortly. Apparently, he went
down to have a sandwich and probably had long lines.
Thank you all again for your patience. Ms. VanDe Hei thank
you particularly for yours. Now, we will turn to you and give
you an opportunity to summarize your statement and then we will
turn to questions.
STATEMENT OF DIANE VANDE HEI, VICE CHAIR, INFORMATION SHARING
AND ANALYSIS CENTER COUNCIL
Ms. VanDe Hei. Thank you, Mr. Chairman. I assume that my
written testimony will be part of the record. The summary can
be as well.
Mr. Thornberry. Previously, we had unanimous consent for
all full written statements to be made part of the record.
Ms. VanDe Hei. I am also assuming you have saved the best
for last, so I thank you, Mr. Chairman.
Mr. Thornberry. Absolutely. Let me just say this, we are
much more relaxed on time now. We have no more votes today, so
that may work to your benefit or your detriment, depending on
how you look at it.
Ms. VanDe Hei. Thank you, Mr. Chairman and distinguished
members of the subcommittees. It is an honor for me to be here
today to talk with you about the private sector's relationship
with the Department of Homeland Security. My name is Diane
VanDe Hei. I serve as the vice chair of the ISAC Council. I
also serve as the executive director of the Association of
Metropolitan Water Agencies and the WaterISAC, Water
Information Sharing and Analysis Center.
In the way of background, the ISACs originated when the
Federal Government issued its policy on critical infrastructure
protection, otherwise known as Presidential Decision Directive
63. That directive carried through to the new Administration
but it is now embodied in a new directive called HSPD-7. I
cannot tell you what it stands for, but we do pay attention to
what it says. It continues the emphasis on ISACs and the need
to share information.
The ISAC Council brings together 14 sectors at this point,
including the eight originally designated critical
infrastructures. We have tried to be inclusive, rather than
exclusive, wanting to learn from each other. The goal of the
ISAC Council is to look at not only how we can learn from each
other in terms of the models we use, but also to look at
interdependencies. We have formed trusted relationships with
the other sectors including electric, rail sector, and others
so that if something happens to them, they can work with us.
One of the primary goals of the ISAC Council was to build that
kind of trusted relationship among sectors, but also to begin
to look at how we could better share information with the
government and the government could share it with us.
To improve the ISACs and to help communicate with
government, the ISAC Council has developed eight white papers
that reflect the collective analysis of the members of the
ISACs and cover a broad set of issues and challenges. These
papers recognize the critical leadership role played by the
private sector with respect both to the organizational
structure established in the ISAC, for analysis and information
sharing, and in the interaction of the ISACs with the
Department of Homeland Security and other government agencies
addressing the challenges of infrastructure protection. We have
shared these papers with Hill staff, DHS and GSA.
One of the primary challenges to government and the private
sector is the establishment of a trusted partnership. You have
undoubtedly heard that a number of times. As I think you all
know, trusted partnerships cannot be legislated, regulated or
even stipulated, nor can partnerships be purchased, traded or
incorporated. We have learned that our ISACs need the full
support and confidence of certain key elements of government to
create and maintain a successful comprehensive security
strategy.
Furthermore, we are also keenly aware that we, the critical
infrastructures, need to maintain a trusted relationship with
our government partners so that we can work with them and their
staffs to maintain the delicate balance between security and
privacy. Our relationship with DHS has had a few bumps in the
road, but overall we have progressed, and I believe have common
goals and agree on the strong need to partner in information-
sharing and analysis.
As with the maturation of DHS, so has each of our
collective ISACs. I do believe that the government assisting
the private sector with baseline funding for certain sectors is
ideal. The WaterISAC, the one I am most familiar with, for
example has received funding from Congress and the U.S.
Environmental Protection Agency, while we as a sector continue
to build the private sector contribution to the ISAC. Although
the information on the WaterISAC is available to 54,000
community water systems and over 15,000 publicly owned waste
water treatment facilities, our fee for service is based on
populations served. We do not differentiate between the kind of
information utilities receive, but we differentiate based on
the size of the system. The range in price is from $500 a year
to $7,500 a year.
By doing this, we hope to get all of the utilities
subscribing to the ISAC. Having said that, that has not
happened. So our next enhanced phase of the WaterISAC is going
to be development of a push email service that will go to
thousands of drinking water and waste water, utilities, a
service that will send DHS and EPA notices and advisories that
need to be sent out simply because that is the ethical thing to
do. So we are working on that this year and hope to have the
new system in place before the end of the year.
Other ISACs, as you might expect, are structured
differently depending on the composition of the sector and the
breadth and scope of the services that sector has decided is
needed. Banking and finance is different from water is
different from electric is different from telecom.
In addition, the DHS IAIP regularly meets with the ISAC
Council and listens to many of our concerns regarding the need
for their strong support of the ISACs and the improvement of
our information-sharing capabilities.
If I could leave you with two recommendations, it would be
these. We need your help to ensure that the private sector's
investment in their ISACs is built upon and strengthened. I
believe that once you lose this voluntary work, research that
people have been doing, that it will be lost for good. So we
need your help to ensure that the investments that have been
made in building these things is built upon, used and enhanced.
Second, we need your help to insist that the private sector
be included up front in the analysis of intelligence.
Government must learn to trust infrastructure owners and
operators with real information that allows us to apply our
resources in a smart way to protect the infrastructures. Again,
I will just give you a quick example. The WaterISAC employs
analysts that have top security-plus clearances so that they
can communicate with intelligence officials in order to provide
insights into what its impact on water might be. Even with that
capability, we find that it is after the fact that we are often
involved, or allowed to participate in any sort of review into
what a threat to our water system might be. So we could use
your help in that manner as well.
That concludes my remarks. I would be glad to answer any
questions you might have.
[The statement of Ms. VanDe Hei follows:]
Prepared Statement of Diane VanDe Hei
Introduction
Good afternoon, Chairman Thornberry, Chairman Camp, and
distinguished members of the subcommittees. It is an honor and a
privilege to meet with you today to discuss the private sector
interaction with the Department of Homeland Security (DHS).
I would like to thank both the Cyber Security, Science, Research &
Development Subcommittee and the Infrastructure and Border Security
Subcommittee for creating this important opportunity and inviting the
ISAC Council to be here today.
My name is Diane VanDe Hei. I serve as Vice Chair of the
Information Sharing and Analysis Center (ISAC) Council. I am also
Executive Director of the Association of Metropolitan Water Agencies as
well as the Water Information Sharing and Analysis Center (WaterISAC).
Background
ISACs originated when the Federal Government issued its policy on
Critical Infrastructure Protection, otherwise known as Presidential
Decision Directive 63. PDD-63 has been replaced with HSPD-7, to
authorize and encourage national critical infrastructures to develop
and maintain ISACs between the private sector in cooperation with
federal government as a means of strengthening security and protection
against cyber and operations attacks.
The ISAC Council
Homeland security presents significant challenges for the ISAC
community and we look forward to working directly with you in the
coming months. The work you are doing is extremely important and you
have the commitment of the ISAC Council to do everything we can to
assist in protecting the critical infrastructures of the United States.
I am here today to briefly discuss the ISAC Council and its role in
protecting critical infrastructures. Members of the subcommittees, the
ISAC Council voluntarily formed almost two years ago. Our goals are to
discuss interdependencies and how we can develop better
communications--among the various sectors and across borders--as well
as what information should be shared on both physical and cyber issues
within the sectors and with the government.
The Council has grown from representing eight sectors to include 14
sectors. In addition to the private sector membership, the ISAC Council
also includes government ISAC's such as Emergency Management and
Response who report to DHS as well as the Multi-state ISAC.
Early on the ISAC Council saw the need to be a very inclusive
group. Although each of our sectors is unique in composition they are
also intimately intertwined with each other, and a catastrophe in one
sector can impact many others. We have seen this on a number of
occasions. Take 9/11 for example, we had a physical impact on the twin
towers, which impacted telecommunications and electric services, as
well as closing Wall Street for four business days. Additionally, the
northeast power outage impacted several sectors including drinking
water, wastewater, transportation and small businesses alike.
To improve the ISACs and to help communicate with government, the
ISAC Council has developed eight white papers that reflect the
collective analysis of members of the ISAC Council and cover a broad
set of issues and challenges. The topics include:
Government--Private Sector Relations
HSPD-7 Issues and Metrics
Information Sharing and Analysis
Integration of ISACs into Exercises
ISAC Analytical Efforts
Policy Framework for the ISAC community
Reach of the Major ISACs
Vetting and Trust
These papers recognize the critical leadership role played by the
private sector, with respect both to the operational infrastructures
established in ISACs for analysis and information sharing and in the
interaction of ISACs with the Department of Homeland Security and other
government agencies addressing the challenges of critical
infrastructure protection. We have shared these papers with Hill staff,
DHS and GSA.
We believe that these papers are only the beginning steps in
tackling the serious policy and process issues challenging the
implementation of an effective private sector and government
information sharing and analysis partnership. The ISAC Council is
continuing to work on concrete actions to increase ISAC support to the
nation. To facilitate this effort, the ISAC Council members communicate
on a daily basis (conference calls or by email) on operations and on an
as needed basis for large new vulnerability announcements and/or
incidents.
Government--Private Sector Partnerships
One of the primary challenges to government and the private sector
is the establishment of trusted partnerships. I believe we all agree
that partnerships between government and the private sector are
essential and since 9/11, it has become even more critical for these
partnerships to mature in order to effectively address homeland
security issues.
As you all know, trusting partnerships cannot be legislated,
regulated, or even stipulated. Nor can partnerships be purchased,
traded or incorporated.
Partnerships are built between people and organizations that
recognize the value in joint collaboration toward a common end. They
are fragile entities that need to be established and maintained by all
participants and built upon a foundation of trust.
We have learned that our ISAC's need the full support and
confidence of certain key elements of the government to create and
maintain a successful and comprehensive security plan. Furthermore, we
are also keenly aware that we, the critical infrastructures, need to
maintain a trusted relationship with our government partners so that we
can work with them and their staffs to maintain the delicate balance
between security and privacy.
Our relationship with DHS has had a few bumps in the road, but
overall we have progressed and, I believe, have a common goal and agree
on the strong need to partner in information sharing and analysis.
As with the maturation of DHS, so have each of our collective
ISAC's. I do believe that the government assisting the private sector
with baseline funding for certain sectors is ideal. The WaterISAC, for
example, has received funding from Congress and the U.S. Environmental
Protection Agency (EPA) while we continue to build the private sector
contribution to the ISAC. Although the information on the WaterISAC--
available to 54,000 community water systems (90 percent publicly owned
and 10 percent investor owned) and 15,000 publicly owned treatment
works--is available to all subscribers, our fee for service to these
utilities is tiered based on population served. By doing so, we hope to
make the WaterISAC affordable to all drinking water and wastewater
utilities. In addition with the help of congressional funding, this
year we will broaden the reach of the WaterISAC by developing a push
email system that will be capable of reaching thousands of drinking
water and wastewater utilities with federal advisories and notices.
Other ISACs, as you might expect, are structured differently
depending on the composition of the sector and the breadth and scope of
the services the sector decides is needed. That being said, we must
keep our ISAC models in tact, meaning that the government should not
attempt to dictate how the individual ISACs are structured nor how
information is provided analyzed and reported to government.
On a very positive note, DHS has agreed to pilot the HSIN network
with the water and electric sectors and has also provided funding to do
tabletop exercises with the Financial, Telecommunications, and Electric
Sectors.
In addition, DHS IAIP regularly meets with the ISAC Council and
listens to many of our concerns regarding the need for their strong
support of the ISACs and the improvement of our information sharing
capabilities.
Summary
The ISAC Council plays an important role in homeland security. It
brings together diverse sectors, examines commonalties and most
importantly cements trusting partnerships that allows us to share
information, learn the best from each other and enhance communication
among interdependent sectors.
If I could leave you with two recommendations it would be these: We
need your help to ensure that the private sector's investment in their
ISACs is built upon and strengthened. Once lost, this type of voluntary
commitment will be very difficult if not impossible to rebuild.
Secondly, we need your help to insist that the private sector be
included ``up front'' in the analysis of intelligence. Government must
learn to trust infrastructure owners/operators with real information
that allows us to apply our resources in a smart way to protect the
infrastructure.
Thank you for the opportunity to testify today. I would be happy to
answer any questions.
Mr. Thornberry. Thank you.
Ms. Lofgren?
Ms. Lofgren. I am interested, Ms. VanDe Hei, on how not
every water entity belongs to the ISAC. Am I correct?
Ms. VanDe Hei. That is correct.
Ms. Lofgren. So how do you disseminate and communicate with
those entities that are part of the whole system, but not
actually part of the ISAC?
Ms. VanDe Hei. From 9-13-2001, the first thing we did was
to develop an email push system that could reach thousands of
utilities. We maintain that today. So although the subscribers
to the WaterISAC receive it, the WaterISAC is both the
knowledge base that we house sensitive information on, and also
a means of sending out encrypted email. At the same time, we
have maintained the push email system that we had developed
almost three years ago. So when need be, we just push it out.
This advanced system that I was talking about earlier where
we were developing a new system where it would just be pushed
out to thousands of utilities, we have the funds to do that
today and we hope to have that by the end of the year. So we
will be reaching both subscribers and those who do not join the
WaterISAC.
Ms. Lofgren. Looking at it from the other point of view,
the information that DHS needs about threats, from what Mr.
Liscouski said, they are dependent upon the entities involved.
So you would have information about your part of the water
world. How do you involve the rest of the water world that is
not a part of the ISAC in that threat assessment activity? Are
they asked to participate? How are they identified and
included?
Ms. VanDe Hei. In the assessment of their individual
utilities?
Ms. Lofgren. We have yet to accomplish a comprehensive
threat assessment.
Ms. VanDe Hei. Yes.
Ms. Lofgren. What I think the testimony is that we are
soliciting information from various entities in charge of
aspects of American life about what the threat is. ISACs are
part of that protocol, but not everybody who is a part of the
world is a part of the ISAC. How do we include them? Do you
play a role in that? Does the Department do it directly?
Ms. VanDe Hei. What we have done is we have included both
on the secure site and on the public site an incident reporting
form that anyone can fill out. It comes into the WaterISAC for
the analysts to look at. That information is shared with the
intelligence community, particularly if it looks like it is a
pattern in a region. So we have it available both on the
private site and the public site. So you could go to the public
site and report an incident, and it would go to the analysts
and be treated seriously.
Ms. Lofgren. That may or may not be good news if it is a
public site and the terrorists have access, too.
Ms. VanDe Hei. It will go into the system is what it will
do.
Ms. Lofgren. Have you, for example in your ISAC, been
solicited for critical information, threat assessment
information?
Ms. VanDe Hei. No. Drinking water systems are a little bit
different in that they were required in 2002 to do
vulnerability assessments and to provide them to EPA. So we
know that the 500 largest systems serving over 100,000 people,
those are done.
Ms. Lofgren. Right, but we do not know whether DHS has
actually availed themselves of that information.
Ms. VanDe Hei. We do not, but they are being treated as
sensitive documents. I understand that they have requested the
ability to view them. How often, how frequently, I am not
privileged to that information.
Ms. Lofgren. Just out of curiosity, thinking about this is
structured, in California, if you know, who belongs to the ISAC
in the water world? Who belongs and who does not belong in the
WaterISAC?
Ms. VanDe Hei. I do not have that list with me today.
Ms. Lofgren. Could you send it to me later?
Ms. VanDe Hei. Sure.
[No list provided to the Committee by the time of
printing.]
Ms. Lofgren. I appreciate that. Thank you very much.
I am interested, Mr. Dacey, on the ISACs, it is the same
question. The Department of Homeland Security needs to reach
out for this critical infrastructure assessment. Do you know
what DHS is doing to reach out to non-ISAC entities for this
information?
Mr. Dacey. I am not familiar with the exact actions they
are taking, but I think that is certainly an area that has been
identified by pretty much everyone as an area that needs to be
addressed. If you look broadly across the ISACs when they were
initially formed, although if you look at the numbers a large
portion of the operations of the industry generally are
represented, oftentimes that is concentrated in a relatively
small number of entities that are the leaders in those
industries. We have a large number, and we gave some examples
in our testimony in financial services, a large number of
entities that are not participants in the ISACs, but are
members of the industry; that are important, but do not
represent the same level of volume. So I think that has been a
longstanding issue.
With respect to financial services, they actually worked
with the folks at Treasury who is their sector-specific agency,
and came up with what is called the next-generation ISAC,
because their views were that this rebel population was not
willing to pay a significant amount of money in order to
participate in the ISAC. So they have developed a model where
there is a certain basic level of services that are available
free to all participants who want to join the ISAC and then
have a tiered approach where you pay more at different levels
to get a higher level of services. I think that is an issue
that needs to be addressed. There are tiers in several of them,
but not certainly across all of them. That is one of the areas
that needs to be thought through as to how that will be
accessed and how that information will be paid for, whether the
Federal Government should continue to fund communications for
this type of thing for that layer.
Additionally, there are some ISACs that have the funding
actually to try to develop some of their operations, because
again those were concerns about how they would fund their
initial operations and set up, and then there was Federal
funding to help that get started as well.
Ms. Lofgren. I guess that raises a question of if the
financial obligations are a barrier to participation and it is
really in the interests of the Nation that people participate,
whether we ought to put those, I mean, there is a dual purpose.
The entity involved is going to benefit, but the reason why we
were asking about these ISACs is to protect America against
terrorist threats. If they are not participating because of the
fee structure, perhaps we should not have that fee structure at
all if we really want entities, both private and public, to
participate.
Mr. Dacey. It gets back to the basic models. These were set
up as voluntary organizations. To the extent that their
respective memberships felt it was cost-effective, they funded
those operations and provided the level of services that were
appropriate for that particular sector.
Ms. Lofgren. Right, but from their point of view.
Mr. Dacey. Exactly, from their point of view. That gets to
the next question, well, if the Federal Government has
expectations about the level of capabilities and services that
are to be provided by these ISACs, that needs to be articulated
and discussions entered into with industry as to how that would
be paid for; whether incentives might be appropriate.
Ms. Lofgren. Do you have a recommendation on how these
might be changed? Would you think about whether you could give
us a recommendation that would forward the government's
interest in having sectors which are not currently
participating participate?
Mr. Dacey. We certainly can look into that. We have a broad
recommendation we have had out for a number of years, at least
for a year, that the sectors needed to assess the need for
additional public policy tools to provide the appropriate
incentives for participation in ISAC and other CIP activities.
So we have had that broad recommendation out starting basically
in January and February of last year.
Ms. Lofgren. And you think we could just adopt that and
that would solve it?
Mr. Dacey. I think you need to think about this from a
strategic level and think about how you want to do that, not
that one size fits all. How do you want to apply those
incentives to the sectors? I think you need some ground rules,
some criteria, some structured process so that it is
transparent as to how the government is going to go about doing
that process.
Ms. Lofgren. Right. OK, I want to think about that.
Finally, and I do not want to hog the time here, the
Chairman is being indulgent and I am sorry I missed your
testimony, Mr. McCurdy, and the two secretaries, but has the
Department of Homeland Security met with the variety of
industry partners that you represent to get their assessment of
threat in this sort of quest for the holy grail of the threat
assessment that we are waiting for?
Mr. McCurdy. First of all, the Internet Security Alliance
was formed, Ms. Lofgren, as a private, it was really the first
public-private partnership, to be honest, because we teamed
with Carnegie Mellon and Carnegie Mellon was running the CERT
which was funded by the Department of Defense. Their incentive
was to try to reach out to the private sector which had a lot
of expertise, but it was not getting out to industries.
Together, we came up with the new model of having the cross-
sector relationship and international. There are 88 CERTs
around the world, and yet there is not the kind of coordination
that we felt was needed, nor was there the incentive in a lot
of other countries to even involve the private industry, even
though private industry owns about 85 percent of the
infrastructure.
So DHS has gone through an evolution, as you know. As I
stated in my earlier comments, we were officially launched 5
months before 9-11. We were formed prior to that. This was an
effort from industry in trying to gain greater access to
information that we felt was critical in this continuum of
ensuring that the Internet itself, the best practices and the
standards and the security, was increased.
DHS, I think now that they do have people in key positions,
both Mr. Liscouski and Amit Yoran, have been more receptive to
our involvement and to our comments. One of the critical points
that needs to be raised, it is true, one size does not fit all.
My concern, having spent as much time as I have in government,
is back in the intelligence days and also in defense, there is
a tendency to become stovepiped. We felt in this age that we
had to cross-cut that.
The second thing is, somewhat to our chagrin, there has not
been the level of concern by certain levels within industry,
corporate leadership, to provide the funding or even the
awareness that there was as much at risk. That is why we
developed the best practices for the C-level entities and for
the organizations, trying to raise this concern, and also have
them ask themselves in their organizations and enterprises the
questions that they should be asking to understand what their
level of security is. The second point is, whether it is a push
system or a pull system, I think there have to be incentives
for industry to participate at certain levels. We have a fee
structure. At one level, it is quite high, but we have more
members than most of the ISACs. The reason they have joined,
early on it was because they wanted access to the information,
but we learned something in this multi-year process, now 3
years, and that was information alone is not enough. You need
to be able to analyze it. You need to understand it. So we
convened these working groups. If there is a call, they can
quickly filter through and say, I do not have that particular
information; SNMP is not my concern. OK? I will not participate
in that call.
If I have a vendor or a system that relies on that, I can
tell you that they will have active engagement in discussions,
learning from the experts and from each other, and that
information flows back towards government through the CERT. I
think there have to be market-based incentives, and that is why
we have started with the insurance program; that is why we are
working with risk management; that is what we are trying to do
with the anchor system, with trusted partners in other
countries.
We actually when we began the Internet Security Alliance
made a conscious decision really not to be involved with
government. That was before 9-11. Post-9-11, it is obvious that
industry, regardless of on which continent it resides, has to
be engaged somewhat in this system. So I think there is not
only increased awareness, but I think there is increased
willingness to participate and not to be as concerned about the
privacy of their data or what their receiving from government.
It is not going to be quite as biased.
The last point I would make, if we could, it needs to be
inclusive, not exclusive. There is a concern that a certain
incumbency or PDD-63, whatever the foundation happened to be,
that that is the model that is the model and will be the model.
I think we need to explore a lot of different models. I think
that is what Mr. Dacey and others have been saying. There are
some that have worked quite well. We have gone beyond the basic
information sharing to a whole new level. But if for some
reason our members were cut off from that information flow, I
think it would affect not only their business, but I think it
would affect the security of the Internet.
Ms. Lofgren. Is there legislation that we could adopt that
would assist in providing incentives or disincentives to
accomplish what you have outlined here?
Mr. McCurdy. Government is usually quicker to have
disincentives than they are incentives, especially in fiscally
difficult times. I am sure there could be a combination. We
would like to see it on the incentive side, because actually
that is where our CEOs and others respond. There are research
incentives. There could be incentives for implementing or
employing certain technologies. There is the FOIA concern.
There is liability, safe harbor kinds of issues that obviously
provides some incentives.
Mr. Putnam had drafted legislation that he considered
introducing. I think it was originally intended to be around
the Y2K model, which worked. Unfortunately, it was starting to
look more like Sarbanes-Oxley, which is a burden on industry,
and actually you would get pushed back, and if anything you
would actually deter people from being more open and
responsive.
So we would like to find the right approach. Mr. Clinton,
who is our chief operating officer, is going to testify later
today before that committee, about some of the market-based
incentive packages that we have developed. As far as I know, we
are the only ISAC or information-sharing group or organization
out there that has even gone that far. But we have gone beyond
just best practices. We have published those and we are
creating more.
Ms. Lofgren. I have seen those.
Mr. McCurdy. Yes. That is actually where government, if
there was going to be funded and people talked about where this
money is going to go, distribution actually costs money, in
getting that out. We just produced one for small businesses.
Who bears that cost? Those are our natural constituency, quite
frankly, in my association, but we decided we had invested a
great deal of money in the Internet Security Alliance to get it
started and up and running. Ms. VanDe Hei mentioned the need to
protect some of that private investment. Well, there has been a
significant investment, and not always willingly, some of it
because of my experience really pushing the industry to be on
the cutting edge and up front before I think even some
recognized that there was a threat. Now, they are starting to
see it a little bit more.
Ms. Lofgren. I will stop and let the Chairman ask his
questions, but isn't it true that certainly there is a burden
to participating in the ISACs on the part of any entity,
private or public, just in terms of the personnel costs and the
time taken from other tasks. That is a burden that may be
easier to bear for a larger entity than a small entity. For a
small business, that can become a daunting, in addition to the
fees, just participating, and for a threat that is inchoate.
There may not really be the business incentive. So it may not
be occurring. So there is a cost to disseminating the
information, but disseminating the information without
incentives to actually implement is another issue, whether
there would be insurance benefits, which has been discussed, or
other benefits that would allow a small business person or
persons or a small company to actually justify the expense and
time away from other bottom-line activities.
Mr. McCurdy. We learned a great deal in developing the best
practices document for small businesses. On one level, they are
similar vehicles. I mean, they are using the Internet, but
their capability and their access to personnel, policies,
technology is far different. You are right. It is a hurdle for
many, not only in just cost, but also time. It is a real
challenge to find the right incentive to get them involved.
We learned from some of our partners, our founding members,
VISA for instance has what they call the digital dozen. They
are in a different modality. They are able to require their
merchants to meet certain practices. One of our other members,
Nortel, has considered, I do not know if they have implemented,
and I probably should not be speaking for them, but they want
their supply chain, they want their suppliers to be at a
certain level of security. So they are encouraging them not
only to belong to Internet Security Alliance, but also to meet
certain best practices.
So there are a lot of companies and a lot of entities are
doing it differently, but that does not mean it is not as good.
Actually, I think that diversity is part of the strength. The
question is, what is the partnership? All we are asking is that
whether it is DHS or other entities within the government, that
they are open and that they continue to build on the experience
that we have been able to gain.
Ms. Lofgren. Thank you, Mr. Chairman, for allowing me all
that extra time.
Mr. Thornberry. I thank the gentlelady for some excellent
questions.
Ms. VanDe Hei, let me ask you, you have heard and you are
familiar with Mr. McCurdy's organization. Does the ISAC Council
have a position on whether other cross-cutting organizations or
information-sharing organizations are good and should be
brought into the system in some formal way? What, if any,
position does the ISAC Council have about that?
Ms. VanDe Hei. The ISAC Council, like I mentioned, wants to
be inclusive, rather than exclusive, so we have gone from 8 to
14. Basically what it takes is for somebody from that
particular information-sharing organization to come and talk to
us about what they do. I am not aware of anyone being turned
away.
Mr. Thornberry. But you do not have, that meets regularly
with the ISAC Council do you, some sort of a cross, I am using
cross-sector, but you know what I am trying to say, companies
in different businesses that may share a concern over cyber
security in this case. Nobody like that sits at the table with
you, do they?
Ms. VanDe Hei. I guess I am not quite understanding the
question, in that all the ISACs that sit around the table
represent different sectors.
Mr. Thornberry. Right.
Ms. VanDe Hei. So I sit next to the electric sector, and
water depends upon electric. And I sit next to the railroad
people, and water depends on the railroad. So we have set up
communications between each other so that when something
happens like in the power outage, we were able to talk to the
electric sector and to the transportation folks about how long
the outage would continue. So maybe I am missing something.
Mr. Thornberry. I understand. ISACs are organized by
sectors, and Mr. McCurdy's basic point is that maybe that is
not the only way to organize; that you could have other
organizations that cut across different kinds of businesses
that could add an element to this debate. I do not want to give
his arguments for him, but maybe you could even argue that if
you are not strictly organized by sector, you would be more
likely to share information because it is not your competitors
that are setting right there with you. There are other pros and
cons. I am just trying to figure out whether the ISAC Council
has formally taken a position on these other kinds of
organizations.
Then Mr. Dacey, I want to get to you and see whether you
have analyzed these different ways of organizing ourselves.
Part of what concerns me is we could be here 5 years from now
and still be talking about different ways to organize
ourselves, and we may not have really done anything. So in some
respects, we have to do something even if it is imperfect just
to move the ball a little bit.
Do you have anything else? Then I will go to him.
Ms. VanDe Hei. There is no barrier to a group like Mr.
McCurdy's from joining the ISAC Council at all. You do need to
be aware there is another group of sector coordinators that
have met under the PCIS, Partners for Critical Infrastructure
Security. That group is predominantly cyber-focused and brings
together companies from all different, Cisco, you name it, they
are part of this coordinating group. The ISAC Council meets
with them regularly now as well, so that we are sure that the
sectors are looking at the bigger picture; that the ISACs are
in tune with what they are doing. So we have begun to meet
jointly to ensure that. But just to answer your question, there
is no barrier with an ISAC that does things differently from
joining the ISAC Council and perhaps informing us about how
better to do things. ``Evolving'' has been maybe overly used
today, but we are looking for ways to do this better.
Mr. Thornberry. Yes, absolutely.
Mr. Dacey, what can you help us with here?
Mr. Dacey. I think, again not to be too trite about
the``evolving,'' but I think things have changed a lot and
there are continuing developments and very positive things have
happened. When this first started in PDD-63 it in fact
envisioned one ISAC for everybody, and then it was quickly
determined that really a sector-based approach would be more
appropriate at that time.
There are some benefits that we have identified in talking
to a lot of people and working in this area for a while. First
of all, there is a significant amount of industry-level
expertise that exists that is very important for the analysis
side of this whole equation. So I think you have to factor in
how you get that sector-level, industry-level expertise for the
various sectors; how some of these threats translate into
impact.
I think also there are established and building trust
relationships within those sectors, because people know each
other. A lot of them are in associations where there is always
some affinity and some aggregation of interests. So I think
there is some benefit, too, there in terms of that trust
relationship, which I think is very critical to this whole
process. They are unique at this point in meeting the sector
needs.
At the same time, the ISAC Council is a relatively recent
event on the spectrum of timelines since we started this
in1998. I think the opportunity exists for them to start
sharing with each other and breaking down those silos. I think
that is particularly important in an area that has not been
talked about, but not extensively pursued. I know it is on
everybody's radar screen, and that is interdependencies. That
will drive the discussion of the need to work together and it
will be in everyone's self-interest. I do not think we are
quite there yet. I think we need to evolve to that point so
everyone really understands how is my sector affected by that
sector, so I care about what they are doing.
Second, the sharing and getting together can bring about a
lot of good practices that are really out there and that can
help others and benefit everyone across the community. It is
fair to say that some of these ISACs have been more at the
forefront than others. They have been around a long time. Some
of them have a longstanding relationship with the Federal
Government, which has been a step up for many of them.
So I think in answer to the question, you need to keep that
industry-level expertise and trust relationship, and you need
to figure out ways to start bringing them together
collectively. I think that started at the ISAC level. It is
starting at the sector coordinated level. I think that needs to
be built up over time. The question is, how much time and who
is in the best position to do that. I would leave it up to Ms.
VanDe Hei just to talk a little bit about where they see it
going, but that is my view personally on the way that needs to
develop. It needs to be integrated in the end, so there is no
silo.
Ms. VanDe Hei. Could I make one statement?
Mr. Thornberry. Sure.
Ms. VanDe Hei. It was the primary purpose for the ISAC
Council to come together to talk about interdependencies and
how we might work together, but this brings up another area
where you could help us, in that I found in talking with the
intelligence community, whether it was with the FBI or now with
DHS, that they tend to be as stovepiped as we are or when
looking at a threat. If it is a threat to electric, then it is
an electric threat, and not necessarily a water threat or not
somebody else's threat. So bringing together their analysts
that look at the different sectors and having them look
together in terms of the interdependencies and what the threats
might be to them, I think is a fairly new phenomena. I am not
sure it is taking place very well.
So I think as they begin to look at things in an
interdependent way, that information will be coming to us in
that way as well.
Mr. Thornberry. I think that is an excellent point. It is
part of what raises these questions in my mind. For example, if
you have an issue related to electricity, it goes, say, to the
electricity ISAC and the people who regulate it are going to be
focused on it. But what about all the customers of electricity?
How can they prepare for some eventuality?
Cyber is another example which cuts across every sector,
which makes it, I will not say unique, but I think has some
particular characteristics. I suspect this is why Mr. McCurdy's
organization is focused on cyber. I do not know how many others
there are like that, telecommunications, electricity, cyber,
probably cut across just about everybody. But some way, we have
to consider not just the producer side, but the consumer side
of these ISACs. I am not sure we are there yet.
Mr. McCurdy?
Mr. McCurdy. Mr. Chairman, actually that is a great point.
There is one interdependency now. There is one continuum, and
that is we are hooked up to the network. The Internet has
become that glue. So cyber is a cross-cutting modality that I
think we need to be concerned about.
The other is, there has been a history with the regulated
industries. Why is the FS-ISAC more mature? Because they have
been in a regulated industry, or you look at some of the
others. Part of our concern was, as I sat in PCIS and other
meetings, oftentimes, and I know the industry well, most of our
members in the association, you usually had security people in
a room talking to security people about what the threats were,
as opposed to engaging the consumer and the user. That is why
we shifted our focus. I think that has been the maturation of
the Internet Security Alliance. That is why we have companies
like Coca-Cola. They are not dependent upon one factor or
another. They are a user of the Internet.
Ms. VanDe Hei. Water.
Mr. McCurdy. Water, OK. Yes, we are all dependent upon
water. We are 98 percent water, right?
[Laughter.]
But the key is that there has to be, the Internet is the
interdependency, but it is also the one area that is least
regulated. So back to the question that Ms. Lofgren asked
earlier, what is the way that you are able to engage the users
in as deregulated a way as possible. I think that is the
approach clearly that you have had working from your district
in California in that industry, is you do not want to go to the
old telecom model or to another model. You are trying to find a
way to engage people in the Internet world. That is why we have
to look at incentives. That is why your industry leaders are
standing up every day saying here are some things that we ought
to be looking at.
Mr. Thornberry. This is an interesting conversation. I do
not want to continue on forever, but that does make me think to
a critical point that Mr. Dacey includes in his report citing
the ISAC Council that says the greatest barrier to information
sharing stems from the practical and business considerations
that although it is important, the benefits are kind of hard to
get your hands around, but long-term it gets back to Ms.
Lofgren's point that maybe the national interest. It is more
amorphous and the rubber does not really hit the road until
something happens, and that is part of our challenge, I think,
in trying to sort our way through all this.
Mr. McCurdy. We have actually looked at three areas, if I
could, Mr. Chairman.
Mr. Thornberry. Sure.
Mr. McCurdy. What is going to get the C-level interest?
Sure, regulation will step up there and taxes would. But I
think it is clear that they are interested from a marketing
standpoint, and there are some market advantages. They are
looking at a cost standpoint and potential liability. If we can
help reduce their liability by becoming a qualified member,
which is what we are trying to do, and this is where the
maturation has occurred. You cannot be a qualified member if
you do not have some way to measure that, and so you need some
metrics. That is why we are working with the consortia on
global security to develop metrics and tools so that we can
actually have the benefits like insurance and reduced potential
liability. So there are a number of these things that we are
working on.
Mr. Thornberry. And those would be metrics set by some
organization, not set by government regulation or law that
would freeze them in place.
Mr. McCurdy. That is exactly right.
Mr. Thornberry. OK.
Let me turn to slightly different issues, if I may. Ms.
VanDe Hei, you were patiently here listening to a lot of
questions go to the Department, Mr. Liscouski, earlier about
vulnerability assessments and what they are doing. What is your
overall view, or what is the overall view of the ISAC Council,
if you can, about where the Department is, not just in giving
out information that it has, but in receiving information from
the various sectors.
Ms. VanDe Hei. I think the flow of information from the
various ISACs is, I would not say it is limited, but it is
different depending on the ISAC in question. I think that for
some ISACs that are, my ISAC is made up primarily of publicly
owned entities. Most drinking water and waste water systems are
publicly owned. So the sharing of information with the
government is not new to these people or with each other,
because they do not compete with each other. So that is a
fairly easygoing sort of sharing of information.
For some of the other sectors, it is proprietary
information. Am I getting at your question?
Mr. Thornberry. Yes, yes.
Ms. VanDe Hei. It is more difficult to share with the
government. Mr. Liscouski talked about the new CII program
which is intended to provide the private sector with some place
to put sensitive information or proprietary information and
expect some confidentiality or protection to that information.
I think the proof will be in the pudding on whether or not that
program is sufficiently protective that it actually gets
information from entities or the private sector that is
concerned about that.
So I guess I cannot speak for all of the ISACs, but I
suspect that the sharing of information is very different
depending on whether you have competition, that you have trade
secrets, that there are things you want protected.
Mr. Thornberry. It goes a little bit to the point made
earlier that more regulated industries are in a different
situation than less regulated industries.
Mr. Dacey, what is your perspective on how far along the
Department is as far as getting and receiving information?
And second, do you think it is clear for an industry to
whom they report information? It is not at all clear to me, for
example, if the water industry says, well, we have talked and
we think we may have a little problem here. Who do they go tell
it to? Is the structure within the Department such that the
answer to the second part of that question is clear?
Mr. Dacey. Two things, I think unquestionably there has
been a lot of effort and actions being taken by the Department
to try to address a lot of the issues that have been understood
as being challenges going forward. Again, Mr. Liscouski
elaborated on quite a number of those activities earlier today.
I think things are improving. We are hearing about regular
meetings taking place from both sides. With ISACs and the
Department, there is more and more sharing of information.
I think the critical issues, though, get down to a couple
of things that need to be done. We talk about that in our
testimony. That is, I think the roles and responsibility of all
the respective players deserves to be clarified a bit. I know
we have this national infrastructure protection plan that is
due out by the end of this calendar year. I realize it is being
built up on a sector basis and it will be issued. I think it is
going to be important that that lay out some of those roles and
responsibilities, as well as initiatives, clear milestones,
something that you all as Congress can look at in an oversight
capacity and measure progress, some of the things that you need
to see, well, when are we going to have this or that; is that
the right strategic direction for the Department to take across
these wide variety of areas we have all been discussing today.
At this point, we do not have that. We have had interaction
and discussion with the Department, and they have shared with
us their thoughts and ideas, but to a large extent we do not
believe that is immortalized in writing so that somebody can
independently look at it and understand and evaluate the
process. Again, I do not want to insinuate that they are not
doing things. It is just that we have not seen it documented in
a way that it could be independently reviewed.
The other part of that is really coming up with the
detailed procedures and policies. If you look at HSPD-7, that
was one of the charges that the Department was supposed to
develop those to help clarify, including the issues that you
talked about. Who do you report to? In our discussions with the
Department, they indicated that they were not going to try to
make everyone go through one single point in the Department
because they felt if that person was not available or could not
get through, it would be problematic. Some of the cyber issues
would seem to naturally go to the NCSD, which is the Cyber
Security Division, and we know the ISACs have those issues.
They indicated that they were developing processes or planned
to develop process to coordinate within the Department the
contact information as it comes in so that if it came in one
place, the other people who needed to know would know. But I do
not think that is in place today.
I do think there is some confusion from what have heard
about who to talk to and who to report to. Again, as with
anything, there are some trust relationships that are probably
built up over time in certain parts of different organizations
in the government that people would probably prefer to contact.
We need to figure out a way to make that easier, and set up
kind of a policies, procedures and clarity in what is the
expectations are for that contact.
Mr. Thornberry. Mr. McCurdy, go ahead.
Mr. McCurdy. Yes, just one quick point on cyber. Cyber,
again, is a little different as far as sharing information. I
have found even at the international level the one trusted
organization that people are more willing to enter into
discussions with regard to threats and vulnerabilities has been
the CERT/CC. However, our concern is the timeliness of the
information as they change the nature and move to the U.S.
CERT. I think there is a concern that it will become too large
and too bureaucratic. Right now, it works reasonably well
because there is not only a trust relationship, but there are
ongoing dialogue and conversations beyond just the threat
warnings. It goes to what does it actually mean.
Eventually, we want to get out of the reactive mode into
the prevention mode, where we can work with our industry and
say, if you take these prophylactic steps, or if you do this,
then you are better protected against potential threats or
attacks regardless of the nature.
One last point on that, we have members that are members of
ISACs, Financial Services ISAC, the IT ISAC, and they have
become more involved with us primarily because of the value add
on top of just information. It is the value add that is going
to be to them the most important, when they have to go justify
their cost to their bosses, and those value adds are again, the
market-based incentives, the best practices, the public policy,
just letting them know what is going on is critical, too.
Mr. Thornberry. Actually, you anticipated the question I
was going to get to next, and that is, as U.S. CERT comes
along, do some of your members have concerns that it is too
much of a government agency in order to have that sort of trust
relationship continue that they have had with the Carnegie
Mellon CERT?
Mr. McCurdy. It is interesting. The CERT/CC when it was
originally Carnegie Mellon, was a hybrid. It was funded by
government, but it was actually run by an academic institution.
We in industry when we all saw this triangle, we had
government, academic and industry, there was a lot of friction
there and concern about how well they actually could work
together. I think our experience has been over time that we
have been able to overcome the worst things of academia and the
worst parts of government mentality and probably some of the
worst instincts in industry, to have a working relationship.
That is what I think our members are most concerned about
is losing that synergy that has evolved. It is going to take
some time. What we would like to hear from you all, what we are
hoping to hear from Amit Yoran and Bob Liscouski and others is
that first of all we are not going to break what is already
working with a very successful organization, and that is access
to the CERT data, just like the ISACs are going to have through
the U.S. CERT. That is a baseline for us. Once we know that,
then we are entering into additional relationships with
Carnegie Mellon because they are creating what they call a
CyLab to take it to another level of trying to add value.
What happens to U.S. CERT? We have all been involved with
government. You have to conduct very close oversight, not on
whether it meets timelines and all that, which is critical, but
also what are the tendencies towards creating more and more
bureaucracy, become more risk-averse, less open, less
cooperative. Those are the concerns that we have as big
institutions start to emerge. When that occurs, when it becomes
a bureaucracy, watch industry go the other way. Then you are
going to have to regulate to get them involved. Right now, it
is not there, but if we are not careful, if we do not work with
them, you could end up with that result.
Mr. Thornberry. The problem is, once you see that
happening, it is too late.
Mr. McCurdy. Yes.
Mr. Thornberry. It is hard to reverse.
Mr. McCurdy. You are in a different situation. This is not
the 1940's. This is a work in progress and the fact that you
are having these having these hearings, there needs to be
dialogue. I think your staff is having those dialogues. If a
government entity learns anything from a hearing like this, and
that is, they need to hear the questions and what is behind the
questions. The questions are not always artfully phrased, but
there is a genuine concern behind those.
Mr. Thornberry. Something is going on.
Mr. McCurdy. That something is going on. That is where this
dialogue is critical.
Mr. Thornberry. That is right.
Ms. VanDe Hei, let me get back to you just to clarify. If
the water folks got together and said, oh, we have this problem
that we have not told anybody about. Would it be clear to you
who in the Department of Homeland Security to go talk to about
it?
Ms. VanDe Hei. No. Yes, and no, OK? They have a watch unit
that you can call an 800 number and report an incident or a
number of incidents to. I actually had experience with trying
to do that. This is not particularly sensitive information, but
there were seven to ten utilities in the Northeast that
received threatening letters postmarked the same place. So I
gave that information to DHS and to the WaterISAC analyst. I
waited a couple of days and did not hear anything back. So I
called. I was told that it had been dismissed; that they did
not deem it to be credible, I guess. I asked on what basis and
that sort of stuff.
But I am not confident at all, one, that I reached the
right people, or two, that it was reviewed in a way that made
sense. Two weeks later, I got a call from the police department
in New York State that had not dismissed the letters. So no, it
is still a maze and I think that there are a number of places
where you can call and refer things, but I do not have a
comfort level that I hit the right place or that it was
reviewed. It might have been, it is just that that is a secret
to me.
Mr. Thornberry. I think a lot of people have that concern,
not just for immediate information that you have, but in trying
to look at an industry and say, OK, what are some
vulnerabilities; maybe we better talk to somebody about it. You
never know. Do you go to the IA; to you go to the IP; how does
all that work.
Ms. Lofgren?
Ms. Lofgren. Just one final question. This has been very
helpful. I know it is a long day to sit there, but it has been
very helpful to me to hear what you have had to say. It is
really for Mr. Dacey since you reviewed all of this. I will use
water as an example, but I think it is equally true for any of
the sectors.
You have people involved in, say, a water wholesaler in
Santa Clara County, the water district. They know water more
than they know terrorism. Unless they are reading Tom Clancy
novels to figure out what could go wrong, they may see a
vulnerability, but it may not be what the Department of
Homeland Security might see. We know, taking water again,
because of delusion, putting a substance in the Crystal Spring
Reservoir is not something I am going to lose any sleep over
because it is going to be diluted. It is not going to be
effective. But what the Department of Homeland Security might,
for example, see as a threat to water would be pollution, say,
if you dumped some PCBs in Crystal Springs Reservoir. It would
not really kill you, but it would disrupt the distribution of
water in a way that is significant and serious and have a huge
economic impact. The water wholesalers might not see that, but
DHS might. Theoretically, they are doing a list of what we
should be worried about. How is that list being assembled and
how is it being communicated to the various sectors to guard
against the Tom Clancy novel scenarios? Or is it?
Mr. Dacey. I cannot speak exactly to what they are doing in
that regard. I can say from a standpoint of what direction I
think needs to be taken and is being taken, is that even
starting in 1998 the idea was that the sector coordinators and
at that point lead sectors, now sector-specific agencies were
to sit down and look at vulnerabilities on a sector basis, the
kind of high-level vulnerabilities. What are the types of risks
and threats? I think Mr. Liscouski talked about that earlier
this morning. And assess them and determine how significant
they are, again, not at an entity level, but at a sector level.
I am not familiar with how far they have gotten in that
process. In theory, some of that will be addressed through
these sector plans that are being part of this national
infrastructure protection plan, but perhaps you might get more
specifics on the water.
Ms. Lofgren. I was just using that as an example.
Mr. Dacey. As to how the water sector is involved in that
process, so you might be able to provide some information.
Ms. Lofgren. You could have the same question about
electricity or banking or Internet technology.
Mr. Dacey. Right. But that has been again on the books
since PDD-63. We have had some initial strategies that came out
from many of the sectors, but I do not think they have dug down
to that level in detail about specific vulnerabilities and
going through a formal assessment of the risks related to
those.
Ms. VanDe Hei. For the water sector, in addition to the
utilities doing a vulnerability assessment, EPA was required to
do a threat document that was distributed to every water system
that served over 3,300 people. So they tried to bring the two
together so that people would have something to assess their
vulnerabilities against. That kind of document, as far as I am
aware of, has not come out of DHS, and the one from EPA was
done a couple of years ago, and I think could use some
improvement.
I think you would hear from DHS that providing threat
guidance is one of the hardest things they have to do, because
it is a moving thing, it is a moving target. What is the threat
today to D.C. versus what is the threat someplace else tomorrow
or the day after? I am not aware of any document like that that
is available, but it is needed. It is desperately needed.
Ms. Lofgren. All right. Thank you, Mr. Chairman.
Mr. Thornberry. Thank you.
I have just two or three final questions I would like to
ask. Mr. McCurdy, there are lots of articles in the press today
about a reported new vulnerability on the Internet. The
Department had issued a warning about it on Tuesday. We are in
the middle of something. How do you see where we are at being
able to get information out and to do something to fix a
vulnerability, now that we are kind of in the middle of one of
these episodes?
Mr. McCurdy. First of all, there have been four in the last
couple of weeks. The one that was listed in the paper about TCP
obviously got headlines because there is an announcement by a
British citizen that I think is having a press conference or
something. In most instances, the vulnerability is communicated
prior to even the threat level. In some instances, we worked
literally months with our trusted members, including the
vendors, to address the vulnerability prior to it becoming
released. That is this whole sensitivity of who actually gain
access. That is why you do not make it all public.
Now, it is true sometimes we get something reported on CNN
before we do CERT, but that is generally not the case. If you
look at the numbers of vulnerabilities and threats that are
being reported to the CERT, it has gone up exponentially every
year. It is over 100,000 threats that are reported this year
and probably 5,000 or 6,000 vulnerabilities. Vendors can go
crazy with those things and there is this tension between the
vendors and the users, and what is the appropriate reporting
period and how do you assess this and how do you get them the
opportunity to try to address it before it becomes public.
It is not just a question, as I said earlier, of just the
threat reporting. It is true. It is out. What is really
critical is how the reports are made. I have examples of those
that we sent to our membership. It not only identifies the
threat, and we do digests of lists of all the recent ones, and
how you can go into a secure site in order to understand it
better. But it talks about the vulnerability on the systems
affected, the overview, the description of what it is, which
sometimes is very lengthy and for many of us we could not
understand a word it says; the impact. But more importantly,
there is a solution. That is where you need the time and this
trust relationship. The solutions often come from that
communication with the industry.
When we are talking information sharing and people say it
is proprietary and they do not want to release it, it is
usually general counsel's that are kind of sending that
message, the lawyers are out there saying that. But the people
who work it every day, when they have this conference call that
we have and they are saying, well, this is how we are dealing
with it; boy, lights go on or this is how the experts at
Carnegie Mellon or Southern Cal or Purdue are dealing with it.
And then obviously they say apply a patch from your vendor.
Well, that is an easy solution sometimes.
It is pulling all those people together that I think we
have evolved to the point we now have that working. That is why
some of our industry members are willing to pay so much for
that. It is also why some of the other companies are sitting
out there glad that they are paying that and are doing that
because they are getting a free ride off of them. But then once
you get that threat information, how do you develop the
practices to ensure against it in the future and get out of the
reactive mode.
Mr. Thornberry. Let me ask, to just get back to the central
focus of this hearing, which you raised. Do any of you see a
step that Congress needs to take to better protect, whether it
is private sector data or whatever, related to critical
infrastructure? Part of this, we are still feeling our way
through. The protections we have already granted, is that
enough? But at this stage in the proceedings, is there some
additional step that you see that we need to take in order to
help develop this trust relationship to share that information?
And if you do not, say no. I am just curious at this stage
whether you do.
Mr. Dacey. Yes, just to step back a bit. A few years ago we
reported on a lot of the concerns by the private sector with
the FOIA and civil liability and antitrust being three of the
primary areas of concern at that point. Certainly in the
deliberations of Congress, you put provisions in the Homeland
Security Act which provided certain protective measures forFOIA
and those have embodied themselves in the CII process. Again,
it is not a final rule that is in place. I think it will take a
little time to figure out if that is adequate or not. So I do
not know that I would rush to change that dynamic at this point
until we see. Obviously, one of the issues gets back to risk.
There has to be a benefit perceived in sharing that information
as opposed to a potential downside that might exist. So I think
that some of that will take time.
In terms of some of these other issues, I think, again I
would go back to a comment that I made earlier that I think it
is important that some of the strategies and some of these
plans be laid out, and that be in full cooperation with the
private sector and state and local governments. That is
happening now and I hope it happens well, but it needs to be
fully bought into by all those parties. As part of that
process, I would hope they would be identifying along the way
issues as you discussed, where legislative relief is
appropriate or would benefit them. I think that would be the
best process to follow.
If you get all these heads together, you are going to come
up with a good list and then you can consider whether you want
to deal with that collectively. At the top of my head, I do not
have any just glaring issues that need to be addressed from a
legislative standpoint, but that is certainly one area to think
about going forward. Again, that is supposed to be out this
fall, and it is going to be critical that all the players join
in on that effort. I am hoping that that will happen.
Mr. McCurdy. Without that final rule on FOIA, there is not
the communication. The communication also has to be a two-way
street. Mr. Liscouski used the magic words, probably because
that is what we are preaching to them. Do not expect just to
have private industry tell you all the vulnerabilities, and
then have it go off into some massive organization never to get
reported back or some affirmation that it was useful or not. If
it is just that flow, then it will be cut off. That information
will not flow.
The other thing just from being on both sides of these
tables, I think effective oversight is a neglected art and I
think you are doing it here. Do not just think you have to have
a bill. It is always fun to have our names on legislation, but
I think following up regularly and, you do not have to beat
them up, but it has to be a communication, and it too has to be
two-way. They need to be sensitive to that.
It certainly would help if this committee becomes a
permanent committee that the different lanes of jurisdiction
are addressed, because I feel for these individuals in
government who spend all their time trying to deal with
stakeholders. They are hearing from us in the private sector,
but they are hearing from you as the overseers, as the board in
effect, and they cannot do it all. I do not care how big the
staff is. The more staff that they have, the more staff that
you will have, the more requests that get going back and forth.
So I think there has to be some good on-record
conversations and there probably has to be some good off-the-
record field discussions that take place. I always found those
to be the most interesting and informative. We would invite
you, by the way, there are facilities nearby. I know you have
seen a number of those, but in the cyber world that are quite
remarkable. Seventy percent of the world's Internet flows just
a few miles from here. Some of our members, where it is a
VeriSign or at the very hub or the old Cable and Wireless,
which is now another company, but they control a lot of the
critical nodes. They are the pulse of a lot of activity that is
pretty amazing. It takes a very professional set of wisdom and
experience in order to understand what that all means as it
goes through. Government is not going to do that. That is in
the private sector.
So I would encourage you to do what you are doing. I would
encourage you to reach out to industry more because industry
does not understand always your drive from a national security
perspective. They are market-driven, but the market can work in
favor of national security if we have the right kind of
exchange, and we would welcome that.
Mr. Thornberry. Thank you.
Ms. VanDe Hei?
Ms. VanDe Hei. I guess I would suggest that perhaps the
bioterrorism bill that was passed in June 2002 had some
protections in it for the vulnerability assessments that needed
to be submitted to EPA that were stronger than in the homeland
security bill. In fact, there were criminal penalties attached
to misuse of the information. I think that you might want to
tighten up that part of the legislation to add to the comfort
level of some of the private sector. It certainly did give some
comfort to the drinking water systems because they do feel
fairly vulnerable.
The other thing I would like to add, though, to Mr.
McCurdy, is that your oversight of the Department, I think it
is very important that Homeland Security needs to be done
differently than any of the other departments and how they
work. We are regulated by EPA and we know how that works and
what the thought process is. But security cannot, I think,
succeed in the same sort of bureaucratic stovepipe kind of
thinking. What I see as the Department grows, when somebody
says to me, hi, I am so and so and I have been in the
government for 30 years, my comfort level does not go up that
it is going to be done differently. So I think it is really
important that you keep an eye on keeping it lean and mean and
that they are doing things in a way that is different, so that
regulation is not the only answer that you see down the road. I
think that can be done and I think it is important that we try
to do that before going in any other direction.
Mr. Thornberry. I appreciate all three of you and your
valuable insights. It has been very helpful for me. I
appreciate your willingness to be before us. I also appreciate
your willingness to answer some written questions if there are
follow-up things that we need to submit.
With that, this hearing stands adjourned.
[Whereupon, at 2:34 p.m., the subcommittees adjourned.]