11 November 1997
Thanks to Peter Neumann and David Wagner

Forwarded message:
Date: Tue, 11 Nov 97 8:26:29 PST
From: "Peter G. Neumann" <neumann@csl.sri.com>
Subject: Senate hearings on PCCIP


[BCCed to my relevant crypto groups...]

Note the statement by Feinstein that she did not hear anything from any
CEOs.  I have flagged it with "*****".  Please help to get some flak sent
back to her from CEOs.  She seems hopelessly wedged, although this is
totally consistent with her appearance at our Senate hearing on crypto in
July when she said the FBI should get whatever it wants.

Peter
---------------

[JYA note: Probable date of hearing November 5, 1997]

Transcript of Senate Subcommittee on Terrorism Hearing on PCCIP...

Dr. Hamre is especially well-suited to discuss how Congress, the
administration and industry can work together to find solutions to the
challenges that this nation faces from the threat of information warfare. 

Having spent four years as undersecretary of defense prior to his
appointment as deputy secretary and 10 years prior to that as a professional
staff member of the Senate Armed Services Committee, where he worked with
the Defense Department and industry on procurement, research and development
programs.

Dr. Hamre, thank you very much for being here today.  We look forward to
your testimony.

HAMRE: Chairman Kyl, thank you very much for inviting me.  I must confess
to be a bit unnerved when an opening statement is better than my testimony.
So I am somewhat nervous about what I'm going to say.

But nonetheless, I would ask that you include my written testimony in the
record of the committee. 

KYL: It will be included in its entirety. 

HAMRE: Thank you. 

I, too, would like to add my words of thanks and commendation to General
Marsh and his panel.  I think they have just done a splendid job.  This is
probably the hardest, most complicated problem that anybody faces, and they
tackled it and they've just done a terrific job and I'm so glad that they are
here today. 

I apologize that I have to -- have asked to lead off as witness because I
must go to the White House for a meeting shortly.  But I, too, want to say
it's been tremendous service on their behalf.  And all the entire country's
grateful, frankly, for their efforts.

Mr. Chairman, I know that others have used the analogy before that we are
facing the prospect of an electronic Pearl Harbor.  May I take that analogy
-- I happen to agree with that.  But may I take that analogy in a slightly
different direction because I think it would help inform our thinking here
today.

As I mentioned to you in the previous session, there was not a single
battleship that saw service during World War II where we hadn't laid the keel
for that battleship before Pearl Harbor.  Many people think back that Pearl
Harbor was a shocking surprise attack and that we had done nothing to get ready
for World War II. 

That was not true.  It turns out if we were to go down to Norfolk, to the
Norfolk Navy Shipyard, you'd see the world's largest dry dock and that dry
dock was actually built in the mid-'30s, and it was built by naval planners,
with the support of Congress, who saw the need to have in place the
capability, the infrastructure, the weapons systems it was going to take to
defend the country in the next war.

I believe most firmly that that's exactly where we are today. There is
going to be an electronic attack on this country sometime in the future.
What we do now -- and frankly, your leadership here becomes absolutely
indispensable -- what we as a country do now is, I think, exactly analogous
to what those far-thinking planners did in the mid-'30s getting ready for
World War II.

We could either choose to be ready and have in place the infrastructure and
the discipline to be able to handle this or we can ignore it and I think suffer
very serious consequences if we choose to ignore it. 

That's why this hearing is so absolutely critical, and I strongly agree with
what you've said. 

Let me say that this is not primarily a defense responsibility. This new
electronic attack will differ from Pearl Harbor in one very important
dimension.  That was an attack on what was clearly military capability at
the time.

An electronic attack on us is going to be quite different because it's
not clearly going to be against just military capabilities.  More likely
than not, it's going to be against the private sector infrastructure that
we, the Department of Defense, will be using in the future and increasingly
using private sector resources.

So we have a very complicated new environment that's emerged -- one where
an attack against the United States is not necessarily an attack against the
traditional military infrastructure of the United States.  It could be an
attack much more broadly against its commercial and industrial
underpinnings.

This is a difficult issue to manage because, if an attack comes in it's one
of three things.  It's either an act of terrorism.  It's a deliberate act of
war.  Or it's a crime.  And those things are handled in different ways in our
government. 

Criminal activity is handled in our justice system, and rightly they need to
be first responders in that event. 

If it's an act of war, that clearly is our responsibility.  And if it's an
act of terrorism, it is in the foggy in-between. 

As you said in your opening statement, the troubling thing about this new
world of potential war in cyberspace is that the attack will inherently be
ambiguous.  An opponent, if they choose to do this, has years to probe
vulnerabilities in our system, and quietly accumulate information, an order
of battle, an electronic order of battle.

And they can build that quietly.  And to us, we will not see all the dots
and connect them.  You know that game we all played as kids where you
connect the dots to get a picture.

If only part of the dots are in the Department of Defense infrastructure
and most of the other dots are -- some are in private industry and some are
in other parts of them, who is going to pull that together and create a
coherent picture of what's going on in advance?

And that's the central challenge, I think, that we face here, and you
face as a leader of this country in the Congress, that we face working in
the department.
I come to you today in two roles.  I come to you as basically the chief
operating officer for the largest corporation in the world.  And I come to you
today as the deputy secretary of defense, responsible for the defense of this
country with the secretary of -- with Secretary Cohen. 

When you confront so far reaching a challenge as this, one can easily get
lost very quickly in the complexity of everything that's in front of us, and
so I have sat back and said -- What are the things we have to tackle first?

And I put them in three categories. 

First, I think we need to start investing in the tools of defense so that
we, at least, are starting down the road of buying what we need in order to
defend at least the Defense Department and then other elements of the
government and the country where we need to.

We're starting first with the Department of Defense.  In the last three
years, we have bought over 400,000 Fortezza cards, which is a kind of a
centerpiece for a key encryption system inside our most heavily defended and
most sensitive communications channels.

We have bought over 300 certificate work stations in order to hand out
certificates to people who must operate inside this network.

We have invested in early warning centers and centers that monitor our
own Department of Defense installations and our communications networks.
We've invested in secure Internet capability so that, while we're riding on
commercial Internet backbone, we have a secure capability on that backbone.

So we've been investing in the department in some of the tools that we're
going to need as the Department of Defense.

It is, as you said in your statement, obviously not sufficient in a world
where we're increasingly using private sector resources in order to
undertake our business and we're using those private sector resources to
hold down cost in peacetime, therefore we're dependent on the health and
well-being of those private sector infrastructure resources when it comes to
time of war.

The second thing that I think we have to do is -- and I think I'm
treading into what I know is a controversial area -- but we have got to
begin putting in place strong encryption in our information technology
systems, and we have to have a key recovery system to support -- and I'm
talking to you now as a businessman.

I run the largest business in the world, and it is inconceivable to me
that I can do business -- not just warfighting but actual business -- in the
future without having strong encryption and a key recovery system.

HAMRE: Let me just take a second to say why this is so important to us. 

As you know, we will increasingly be using private sector backbone for
our communications and for our information management. We will be riding on
that private sector backbone and we'll be sending messages across that
network.

We can't afford to have an opponent read all of our messages, know what
it is we're thinking and planning, and we cannot afford to have an adversary
who would present to us spurious information that's been altered, and to
change our perceptions of reality or our perceptions of what's happening.

Therefore, we have to have systems that have the strongest level of
encryption required for the sensitivity of that business activity so that we
know it is safe from prying eyes and that it's not susceptible to spoofing.

But when you're riding on a network, and you do not see who's on the
other end of the computer terminal that's sending you information, you then
have to have a system that lets you know that the person you're dealing with
is really who they say they are.

You cannot have individuals on a network who spuriously can introduce false
information when you're dependent on remote input of data.  Data upon which
you're going to make crucial war-fighting decisions. 

To solve that problem, you must have strong encryption.  And you must have a
way of validating that whoever is on that network is who you think it is. 

And if someone who is trying to come into that network who is not authorized
to be in that network, you can quickly find out that they're a fake. 

Fortunately, mathematicians, brilliant people, have given us some tools
to deal with this.  And it's enormously important for us to now utilize
those tools and put in place both a strong encryption environment and the
infrastructure for recovery of keys so that we know who is on the network.
And who is talking to us.

This is a controversial subject in our country, right now, but it is a --
I'm speaking to you again, as a businessman who must have confidence that
whoever I'm dealing with, I know their identity.

I also need, as a businessman, to know that, if I have someone who is
behaving improperly inside the government, that I know they're leaving
fingerprints by their electronic identity, when they're moving throughout
this network and that I can turn that off.  I can shut it down, if
necessary.  These are absolutely indispensable to me as a businessman.

I would also argue that this is absolutely indispensable to us as a
country for our -- in long-term security.

Every businessman in this country, when he sits down and -- he or she --
sits down and thinks about what it means to do business over the Internet,
or business over remote networks, knows they have to have encryption in the
future.  They also know they've got to be able to secure that data and know,
with confidence, who it is they're dealing with.

And therein lies the importance of this second pillar, I believe. Which
is encryption and key recovery.  It doesn't mean that you have to have the
strongest form of encryption.  We're not going to put Fortezza in all of our
systems.  We'll put Fortezza where we have our most pressing and most
sensitive data.  For example, our nuclear command and control system.

For routine business transactions, when it's, say, paying an invoice or
paying a travel voucher, we can use commercial software and commercial key
recovery techniques.  It's very possible to layer this in an appropriate
way.  We're not burdening everybody with the most expensive and the most
complicated solution.  I think that's the second thing that we need to focus
on as a government.

The third thing that I believe we need to focus on, as you said in your
opening statement, this is a complicated problem that involves both the
government and the private sector.

We need to find ways to establish a working partnership with the private
sector so that we and they, together, are working to solve this problem.
But that can happen only if there is -- if there are venues of trust that we
can build on where we are working on common problems already.

We have one of those in the Department of Defense where we work with the
National Communications System, and its counterpart in the private sector.
It is an important venue for us to be talking openly with our partners in
industry who are our indispensable allies in the future.

We have to understand their constraints.  They need to understand our
needs.  We really do share a very common future and we have to be working
together.  And we need to find ways to build that.

And Mr. Chairman, and Senator Feinstein, if there's one thing I could ask
you help as a subcommittee doing, is creating this cooperative spirit
between the government and the private sector to find constructive
modalities for us to be solving this problem collaboratively in the future.
We cannot do it by ourselves.  We cannot do it as the Department of Defense
by ourselves. And we certainly can't do it as a government by ourselves.
Your help would be indispensable in that regard.

I thank you for the opportunity to come.  I know this is an enormously
busy day.  I know there are going to be some roll call votes.  Let me stop
here and if you would like to ask questions, now, that would be fine.  And
I'd be glad, of course, to respond to anything in writing, as well.

KYL: Thank you very much, Dr. Hamre.  And I know you do have to leave.  I'd
just... 

(OFF-MIKE) 

OK.  So you have a little bit of time... 

HAMRE: I do. 

KYL: ... we'll try to accommodate your schedule, certainly. 

HAMRE: Yes. 

KYL: We've been joined by Senator Feinstein, and before we engage in any
questions, perhaps I could ask her to give you her opening comments, or if
you'd like to begin questioning, that would be fine, too.

FEINSTEIN: Thank you. I don't -- I'll put my statement, if I may, Mr.
Chairman, in the record.  Let me just say that I very much appreciate the
secretary's comments.  And one of the things that is a great surprise to me
is really how little we're able to cope with the world we're going into.

And as the world becomes more computerized, the real opportunity for
people to wreak havoc becomes expanded greatly.  And we saw it in San
Francisco just a week ago.  Somebody got into a transmission station at PG&E
and was able to turn off the power grid for a lot of the city, which shut
down computers everywhere.

And then the first question I asked, when the CEO of PG&E called to tell
me about it, was, did they go off at the airport?  And he said, no; that was
on a different grid, or system.  And then I began to think what would have
happened if somebody got into the computers at San Francisco International
Airport.  And all of that havoc that could have been played out.

And then I thought back and I remembered my time aboard some of the more
sophisticated naval vessels when I was mayor.  And then I began to think,
well what happens if somebody gets inside their computers?

And you can just go from there.  And I guess if I've learned anything in
the time I've been here, it really is that nothing in this area is
impossible.  That the minds that surround the computer world are really so
bright and so different from my mind, in any event, that many more brain
cells...

(LAUGHTER) 

... that they're really able to do things that no one ever thought
humanly possible.  And then it's -- so, I guess, the point, and I hope
you'll address it, and I'd like to defer to my chairman, because I don't
know what else we could other than have, you know, some form of key
recovery.  Or some methodology for getting at some of this.

And I know everybody's talking, but I gather, in terms of having really
finite solutions, there aren't too many, yet. 

HAMRE: Ma'am, we certainly do agree.  I think it's very important because
this is such a controversial issue.  I'm -- as I say, I'm speaking to you today
as the chief operating officer of this huge corporation.  And I am willing to
buy a key recovery system. 

You know, I think so many people are nervous, and they use freedom of
speech arguments and they use commercial competitivist arguments and all of
that.  And, I'm just saying, as a businessman, I'm willing to buy it.  It's
that important.

And as the Department of Defense, we have to have it for the future.  I
need to know at least our systems are secure.  I'm still going to be
dependent on the local power grid, and if the power grid goes down, we are
going to suffer consequences of that.  And so, ultimately we have to tackle
that, as well.

But right now, it is so important for us to have confidence in our own
systems that we have to have strong encryption and key recovery.  And I'm
willing to buy that.  And that's where we're going to start out here in the
next couple of months.  Because we've...

FEINSTEIN: I'm very pleased... 

HAMRE: ... got to get going. 

FEINSTEIN: ... to hear that. 

KYL: And just to put this in a real-world context and not to get into the
details of the classified exercise this was just briefed to us, but anyone can
imagine that when people in the Pentagon begin to hear reports from different
places that something is going on. 

That the communications are down over here.  And there seems to be a
befuddlement of some kind over here.  And then a very explicit message comes
through by someone saying, I am messing with your system, and if you don't
comply with my demands, I'll mess with it even more.  Immediately, then, you
know you've got a problem. 

KYL: So, how do you begin communicating with each other in a way that you
know is secure?  You already know they've gotten into parts of your system.
And you don't know which parts you can trust or not. And that's precisely
the problem that, Dr. Hamre, you've been -- one of the many problems you've
identifying here.

I also have to respond to the analogy you drew early on -- well, the
Pearl Harbor comment, which I found to be very illuminating.  That the keels
of all of the capital ships that fought in World War II were actually laid
before Pearl Harbor.

Now that did show some advance planning.  And I heard, this morning at a
breakfast, a comment attributed to Bobby Knight, the colorful basketball
coach at the University of Indiana.  He said, almost anybody can have the
will to win.  But what real champions have is the will to prepare to win.
That takes real discipline.  And commitment.  And that is what impressed me
about Dr. Hamre's presentation and the desire to begin this preparation.

Can I quote something in a -- if we could just go back and forth Dianne... 

FEINSTEIN: Yes, that's fine. 

KYL: ... that'll be in front of me.  The very reputable Defense Science
Board has a task force on information warfare and I'll just quote one
sentence of their 1996 report, which said, we conclude that there is a need
for extraordinary action to deal with the present and emerging challenges of
defending against possible information warfare attacks on facilities,
information, information systems and networks of the United States, which
would seriously affect the ability of the Department of Defense to carry out
its assigned missions and functions.

And in trying to convey to the American people the need to support this
kind of effort, both financially and in policy that the Congress and the
administration would set.  And also to communicate to the commercial world
in general how important it is for them to participate, the challenge you
laid before us.

Let me give you the opportunity to try to express in words that Americans
need to hear to help us respond adequately to this challenge.  How you view the
Defense Science Board's comment that this is the -- now is the time for, in
their words, extraordinary action? 

HAMRE: We agree.  When the Defense Science Board wrote that report, and
of course it had months of preparation before it, we were just in the very
earliest stages as the Defense Department coming to grips with this.  Since
that time, we have invested heavily and will continue to invest heavily.

We have now placed -- we have a network monitoring capability for all of
our megacenters.  We have network monitoring capabilities for our
Internet-based communications systems.  We now have network monitoring
capabilities at every Air Force installation.  This is a new thing we're
just opening up this year.

It is very important for us all to realize: this threat is in our future.
It isn't here right now, but how we prepare for it is very much how we're
going to be judged by history.  And that is not just us in DOD.  We cannot
fix this problem by ourselves.

We will be anybody's partner to fix it.  But we cannot fix this problem
by ourselves.  Just like the chairman-CEO of a utility, is going to bear
responsibilities.  He'll be accountable to not only his stock owners.  He
will be responsible to his regulatory authorities. And frankly, to all the
people that are in his service area.

Every one of our business people have a broader sense of responsibility
and we cannot ignore this problem.  This problem is our shared problem.  And
it's our national problem.

We will be anybody's partner in trying to fix it.  But we do need to
have, as you said earlier, a strategy that's coherent, that reaches out over
time to address this problem.  And it's one that has to involve the entire
government.  And we will be working on that over the next several months.
As we've just received the report that the Marsh panel has produced, we
think it's a great starting point, we now need to give you a priority list
of actions.

Where do we start first?  What should we really be acting on? What is the
first line of -- first items to be acting on?  How will we measure our
progress?  That's what we need to be presenting to you in the next couple of
months.  And we would be glad to be coming back to you to tell you where we
are.

FEINSTEIN: Thank you very much, Mr. Chairman.  I may be a little behind
the curve here, but let me ask this question.  Last year, the DOD
authorization bill contained a provision written by Senators Nunn, Lugar,
and Domenici, which focused on the need for local law enforcement and fire
fighters to be better prepared to respond to either nuclear, chemical or
biological or other terrorist kinds of attacks.

And I think over 100 million has been authorized for DOD to move in that
area.  And the commission recommends doubling it.  Can you tell us what has
been done to date...

HAMRE: Yes, ma'am. 

FEINSTEIN: ... and what you see needing to be done in that regard? 

HAMRE: When the legislation was passed, and it was put into the Defense
Authorization Bill, and we received funding to get started, everybody at the
time knew that this was just a starting point.  In the long run, this was
largely a process that had to be carried on by the Federal Emergency
Management Administration, not by the Department of Defense.

But, because we're command-oriented, you can give us a mission and we'll get
out and we'll get started.  We may not be terribly efficient and we may not get
A-minuses every time, but at least we'll get going. 

We've done that.  We have pulled together teams.  We now have, I think, met
with -- we have identified 108 cities that we are going to go through detailed
consultation.  We have already met with 27 of the cities. 

We sit down and these are comprehensive meetings.  We sit down with the
police department, the fire department, the emergency civil defense folks,
the local National Guard units; this sort of thing. And we go through a
two-week process of surveying: where are they? what are their capabilities?
do they know what their needs might be? what can we bring to the table?
what kind of training program should we develop?

Fairly comprehensive program.  But it's very much in the survey mode.  Where
are we as a country?  Where are we in these metropolitan areas? 

I think it's fair to say it's an uneven picture.  If -- we just had a team
that was out at Indianapolis and, frankly, they did a splendid job.  The people
in Indianapolis had been thinking and worrying about this problem for over 18
months.  And they are really on top of it.  It was a model. 

Not all the other cities we've been to are nearly as far along. We will
continue to go through -- the list in the survey phase of the 108 cities.  And,
of course, those are the 108 largest metropolitan areas. 

We are in the process of transitioning this effort over to the Federal
Emergency Management Administration, which really has the civil defense
interface responsibilities with local authorities.  It belongs there and we are
perfectly happy to work with them and transition that effort over.  And we will
continue to be partners with them as long as we can be constructive. 

We feel there's a long-term role for the Department of Defense through the
National Guard in our Reserve components in working with local communities.
Especially on things like terrorist incidents involving chemical and biological
weapons.  This is a terrifying prospect in our future. 

FEINSTEIN: Have any cities refused to participate? 

HAMRE: To my knowledge, no city has refused to participate.  I will --
but I will give you a formal response for the record.  I think the more
likely, fuller answer would be, some cities have not really seen the
necessity for this as others have.  And so we've had an uneven level of
response.

Invariably, when you sit down and talk to people and you talk to
individuals, they will say, yes, this is a problem.  This is something we
all need to work on.

They also think, well, maybe this is a way we can get some money to do
something.  And so, you tend to get sidetracked, sometimes, off on some rabbit
warrens.  But by and large, as soon as you have a chance to talk to people who
are in the business of emergency response, they say, yes, we need to do this. 

FEINSTEIN: The reason I'm raising this is, I think this is an
extraordinarily important effort.  I think if you ask most Americans, you
know, are there a lot of terrorists in this country?  Despite what even
happened at Oklahoma City, most bore (ph) at the World Trade Center most
people would say, no, when in fact there are.

And those of us that have had the briefings know that.  And I think it's
extraordinarily important that, you know, Mr. and Mrs. America understand that,
to be forewarned and prepared is really to be forearmed.  To be able to deal
with this.  Some of these things can happen in such a way that they run a risk
to loss of tremendous life. And I hope no city has refused to participate in
this effort. 

HAMRE: I will give you a formal response and check that for the record.  I
don't know the answer to that, here. 

Again, let me emphasize.  We at the Department of Defense are prepared to be
partners with anybody.  Ultimately, this is a law enforcement and emergency
response responsibility and we need to count on the lead agencies, the Justice
Department and FEMA for a lot of this.  But they can count on us being right
there with them as partners. 

FEINSTEIN: Thanks, Mr. Chairman. 

KYL: You bet.  Thank you, very much.  I think in view of your
responsibilities, Dr. Hamre, we can excuse you at this point.  We may want to
submit some other questions to you. 

HAMRE: Yes. 

KYL: I guess I would like to conclude by again thanking you.  I thank the
Department of Defense and the secretary for their support for our effort to
identify this problem to especially discuss the national security implications
of it. 


KYL: And lay the ground work for the continuing discussion of the
commission report as we begin to implement solutions to the problems as you
identified here today and we look forward to working with you and again, thank
you. 

HAMRE: Secretary Cohen asked to specifically say we admire you for your
leadership and you can count us in being your partners here in the next years on
this issue.  

KYL: Thank you very much.  As the chairman of the commission, General Marsh
comes up.  Let me officially ask to add into the record a list of documents
including copies of previous acts of the Congress and executive orders which I
will submit for the record. 

And without objection, we will include those in the record of this hearing.
Now, as our featured witness for today, I'm very pleased to welcome Tom Marsh. 

General Marsh, after retiring from a long and distinguished career in the
Air Force that culminated as commander of Air Force Systems Command, took on
numerous responsibilities in the private sector, including most recently,
CEO of Thiokol Corporation.

In 1996, he was appointed by President Clinton to chair the President's
Commission on Critical Infrastructure Protection.  The purpose of the
commission was to assess the threats to, as well as the vulnerabilities of, our
national infrastructures and to make recommendations as to how deal with them. 

Mr. Marsh is here today to discuss with us these recommendations. In so
doing, it is important to put the commission's report in context. 

The commission was created only last July by executive order and required to
appoint its members and complete its report with recommendations upon its
disbandment within 15 months which was just over two weeks ago.  That's a hefty
assignment by anybody's book. 

So, I want you to know, Mr. Marsh that this subcommittee recognizes that
your commission was presented with an enormously difficult task and I want
to especially commend you and your colleagues for a job well done.

Your service to the nation is equally distinguished by that -- by your
leadership of this commission as by your many years of dedicated service in
uniform.  So, we thank you very much for being here.  We look forward to your
testimony and certainly the opportunity to benefit from your insights. 


MARSH: Thank you, Mr. Chairman and members -- Senator Feinstein. I'm
pleased to be here today to discuss with you the work of the commission,
outline its principle findings and recommendations that are reflected in our
report that was just issued, "Critical Foundations."

Before my prepared remarks, I'd like to express my appreciation to you,
Senator Kyl.  Your far-sighted vision in this area for the needs and the
well-being of the country really has been key to the establishment of the
commission itself and for many of the other actions that have been taken by
the FBI, by the Department of Defense in this past year.

And I think you've seen results of much of your prodding start to take
action and we sincerely appreciate that.  To give you some perspective on
the commission's challenge imagine, if you will, the power goes out in the
Northwest, the 911 system is disrupted in a major city because someone's
flooded out the phone lines with repeat calls, two bridges across the
Mississippi River are destroyed -- bridges that not only carry trucks and
trains but also telephone cables -- and two Internet service providers in
New York City are out of service.

Well, what do you do in such a situation?  Whose in charge?  Is it merely
coincidence or a concentrated attack and you referred to eligible receiver,
Mr.  Chairman, as clear evidence of this statement of the problem.

But these are the types of questions that the commission has been
considering.  Questions to which there are really no easy answers. Questions
we hope our recommendations will help lay the foundation for answering.

Appreciate the opportunity to talk about the commission's work, discuss
why we have come to believe that protecting our infrastructures is so
important in light of the new vulnerabilities and threats of the cyber age,
present our key findings and then briefly summarize our recommendations.

I must say right up front that our findings, conclusions and
recommendations are very different from what we anticipated and different
from what our stake holders anticipated.  Many thought that this was an easy
problem that government alone could solve in a few easy steps.

But during the past year and a half, we definitely concluded that
protecting our infrastructures is a public/private undertaking that requires
a new kind of partnership and protecting the infrastructures is going to
take time and require long-term efforts and a new way of thinking.

The commission was established by the executive order on July 15, 1996.
It was a joint government and private sector endeavor that was charged to
develop a national policy and an implementation strategy for protecting our
critical infrastructures from both physical and cyber threats and assuring
their continued operation.

The president identified eight infrastructures as our national life
support systems.  These national infrastructures are vital in that their
incapacity or destruction would have a debilitating impact on the defense
and economic security of the United States and these are the
infrastructures:

Critical infrastructures have long been lucrative targets for anyone
wanting to attack another country.  Our nation relies on its infrastructures
for national security, public welfare and its economic strength.

Those who would attack the infrastructures would do so to reduce our
ability to act in our own interests or erode our public confidence in
critical services or reduce American economic competitiveness.  In the Gulf
War, for example, disabling Iraq's infrastructures was one of the keys to
our success.

A lesson noted with much interest by many countries around the world.  The
commission was uniquely tailored for the task recognizing that the critical
infrastructures are largely owned and operated by the private sector, the
commission's structure was a joint public/private undertaking. 

The commission was comprised of representatives of both industry and
government.  The steering committee of senior government officials oversaw the
work of the commission and guided us through myriad government concerns. 

A presidentially-appointed advisory committee of key industry leaders
provided the unique perspective of owners and operators of the
infrastructures and finally the Infrastructure Protection Task Force was
established at the same time as the commission to support infrastructure
protection until the commission's recommendations are acted upon.

Our approach recognized that most of the infrastructures operate within an
existing framework of government policy and regulation.  But they are also
privately owned, competitive enterprises. 

As such, protection recommendations should not undermine a company's
competitive position.  We recognize that any solution would have to be
viable in the marketplace as well as the public policy arena.

Thus, we adopted the following guiding principles: first, we knew that this
could not be a big government only effort.  Government must set the example.
But it is the owners and operators who are the key to success. 

They have a strong economic stake in protecting their assets and
maximizing customer satisfaction.  They understand the infrastructures and
know best how to respond to disruptions.

Second, while we may be undergoing an information revolution, we felt
that utilizing the best ideas and processes from current structures and
relationships was the proper way to proceed.  This means building on
existing organizations and relationships as well as fostering voluntary
cooperation.

Partnership between industry and government will be more effective and
efficient than legislation or regulation. Finally, this is a long-term
effort which requires continuous improvement.

We must take action in practical increments.  There is no magic solution.
We must aim not only to protect the infrastructures but also to enhance
them.

Outreach was a cornerstone of our effort.  In fact, our conclusions and
recommendations result directly from the conversations and meetings we had
with approximately 6,000 individuals from industry, academia, science,
technology, the military and government.

We held five public meetings around the country, participated in numerous
conferences, hosted simulations, games and focus groups and sought to
increase awareness of this effort throughout the media and our web site.


MARSH: In the past, broad oceans and peaceable neighbors provided the
infrastructure protection we needed.  That all changed during the Cold War.
Technology became preeminent and geography became less relevant.  Soviet and
U.S. nuclear weapons were targeted against each other's power grids, rail
networks and energy industries. 

But the costs remained high and the ability to carry out such an attack
was available to only a few major powers.  Computers and electrons changed
the picture entirely.  Now, the capability is widely available at relatively
little costs.  This is the new geography in which the commission has focused
its efforts.  A border less, cyber- geography whose major typographical
features are technology and change.

We've long understood physical threats and vulnerabilities.  But not so, in
cyber space.  The fast pace of technology means we are always running to catch
up in the cyber dimension. 

Thus, the commission's work and our report focus primarily on coping with
the cyber threat.  Our foremost concern is the interdependencies presented
by the system of systems we rely on for the daily operation of our critical
infrastructures.

Furthermore, information that describes our vulnerabilities is increasingly
accessible.  Most of it is unclassified and much of it is available on the
Internet.  We had to be careful in compiling this information not to provide a
handbook for those who would use it for harmful purposes. 

So, who is the threat?  We view the threat as anyone with the capability,
technology and intent to do harm.  While we've not found a smoking keyboard
-- if you will -- that is, we do not know who has the intent to do harm.  We
do know that the threat is a function of capability and intent.

We characterize capability as a combination of skills and tools. Skills
that even most teenagers have.  And tools that are readily available,
widespread even on the Internet.  In short, the opportunity to do harm is
expansive and growing.  The bad actors who use these tools range from the
recreational hacker who thrives on the thrill and challenge of breaking into
another's computer.  To the national security threat of information warriors
intent on achieving strategic advantage.

Common to all threats is the insider.  We could spend millions on
technology to protect our infrastructures.  But a well placed insider or
disgruntled employee could render near all protection useless. 

The new arsenal of weapons of mass destruction in the cyber world include
Trojan horses, viruses and e-mail attacks that can be used to alter or steal
data.  These tools recognize neither borders nor jurisdictions.  They can be
used anywhere, any time by anyone with the capability, technology and intent
to do harm.  And they offer the advantage of anonymity.

We examined the respective roles of the private sector and the federal
government in light of this new threat and the potential bad actors.  We
concluded that the private sector has a responsibility to protect itself
from local threats such as individual hackers and criminals.  And that the
federal government has a larger responsibility to protect our citizens from
national security threats.

In short, we found that infrastructure protection is a shared
responsibility.  The private sector is responsible for taking prudent
measures to protect itself from common place hacker tools.  If these tools
are also used by the terrorists, then the private sector will also be
protecting against cyber terrorists attack.  And will be playing a
significant role in national security.

The federal government is responsible for collecting information about the
tools, the weapons, the perpetrators and their intent from all sources,
including the owners and operators of the infrastructures.  The government must
share this information with the private sector so that industry can take the necessary protective measures. 

In some respects, our most important finding is that adapting to this
challenge requires thinking differently about infrastructure protection.  We
must look through the lens of information technology as we approach the
third millennium.

Specifically, we found that information sharing is the most immediate
need.  Responsibility is shared among owners and operators and government.
The federal government has an important role in the new alliance.
Infrastructure protection requires a focal point within the government.  We
must develop an analysis and warning capability. The existing legal
framework is imperfectly tuned to deal with cyber threats.

And finally, research and development efforts are inadequate to support
infrastructure protection.  We know our infrastructures have substantial
vulnerabilities to domestic and international threats. Some have been
exploited.  So far, chiefly by insiders.

Protecting our infrastructures into the 21st Century requires that we
develop greater understanding of the vulnerabilities and act decisively to
reduce them.  In the last 15 months, the commission has thoroughly reviewed
the vulnerabilities and threats facing our infrastructures, assessed the
risks, consulted with thousands of experts and deliberated at length as to
how best to assure our nation's critical foundations in the decades to come.

Our fundamental conclusion is that waiting for disaster is a dangerous
strategy.  Now is the time to act to protect our future. 
And this action requires a new partnership to address the risks of protecting. 

The commission's recommendations are the products of much research,
discussion and deliberation.  They are founded on shared core principles and
they are based on fact.  They are aimed at improving coordination and
establishing roles for infrastructure protection, fostering partnerships among
all stake holders and coordinating diverse interests. 

Every recommendation was discussed at length in a series of deliberations
that addressed all feasible options and the pros and cons of each.  All
commissioners accepted the final report as reasonable, balanced and acceptable
for submission to the president. 

The commission's recommendations fall generally into three categories.
Actions the federal government must take, actions the owners and operators of
the infrastructures must take and actions that require partnership between
government and industry. 

During our extensive outreach efforts, we heard time and again that the
owners and operators of the infrastructures need more information about
cyber threats.  They also said that a trusted environment must be built so
that they can freely exchange information with each other and with
government without fear of regulation, loss of public confidence, incurred
liability or damaged reputation.

The commission's recommendations laid the foundation for creating a new
collaborative environment that includes a two way exchange of information,
not more burdensome regulation.  Our recommendations focus on protecting
proprietary information and ensuring anonymity when necessary.  Reviewing
legal impediments to information sharing, such as antitrust provisions and
the Freedom of Information Act.  And creating information sharing mechanisms
both within industry and between industry and government.

As to actions that the government should take, we recommend specific
steps to ensure owners and operators and state and local governments are
sufficiently informed and supported to accomplish their infrastructure
protection roles.  These include designated federal agencies continuing and
expanding the availability of risks assessment services to the private
sector.

Encouraging industry and assisting, when necessary, the development of risks
methodologies.  The U.S. security policy board should study and recommend how
best to protect specific private sector information on threats and
vulnerabilities to their critical infrastructures. 

And, the funds appropriated under the Nunn-Lugar-Domenici domestic
preparedness program -- that we just discussed -- should be doubled to expand
and accelerate sharing of capabilities to mitigate the effects of WMD attacks. 

MARSH: And we heard that from law enforcement and emergency responders
throughout the nation. 

Key to the success of these initiatives is educating our citizens about
the emerging threats and vulnerabilities in the cyber dimension. The culture
has changed, and our way of thinking about technology and the resulting
threats and vulnerabilities must also change.  The commission's
recommendations are aimed at all levels of education, from grammar to
graduate school and beyond.

They include a series of White House conferences to spur new curricula in
computer ethics and intellectual property for elementary and secondary
schools; a nationwide public awareness campaign, simulations and roundtable
discussions to educate the general public, as well as industry and
government leaders; grants by the National Science Foundation to promote
graduate-level research and teaching of network security; and partnership
between the Department of Education and Industry to develop curricula and
market demand for properly trained information security technicians and
managers.

Infrastructure assurance is a joint responsibility, but the federal
government has an unmistakable duty to lead the effort. Clearly, the federal
government must lead by example as it exhorts the private sector and state and
local governments to raise the level of security of their systems.  The federal
government must pursue the tools, practices and policies required to conduct
business in the cyber age. 

This includes improving government information security through developing,
implementing and enforcing best practices and standards, and then conducting
certification and measures against those standards; working with industry to
expedite efforts for alternative information security and encryption key
management pilot programs. 

We strongly believe that we must lower the temperature of the encryption
debate and demonstrate a key management infrastructure management system
with good encryption that can allay the concerns of all of the various
interests that are involved in the encryption debate.

Elevating and formalizing information assurance as a foreign intelligence
priority, and we've made such a formal recommendation. Recruiting and retaining
adequate numbers of law enforcement personnel with cyber skills.  We found this
problem at all levels -- the FBI, state and local law enforcement agencies. 

And finally, conducting a thorough risk assessment of the national
aerospace system, of the planned national aerospace system, and the planned
sole reliance on the global positioning system. That's a specific but a very
important matter.

We examined a full range of legal issues relating to protecting the critical
infrastructures, but with three goals in mind: Increasing the effectiveness of
government's protection efforts; enhancing the private sector's ability to
protect itself; and enabling effective public-private partnership where most
needed. 

We propose the further review of major federal legislation as it relates to
the critical infrastructures and the cyber threat.  We have developed modest
recommendations in the area of criminal law and procedure.  Specifically, the
federal sentencing guidelines, to take into account the true harm done by
attacks on the critical infrastructures. 

We call for an expert study group representing labor, management, government
and privacy interests to make recommendations for long-term reform in the
employer-employee relationship, yet balancing security and privacy. 

And we recommend easing legal impediments to information sharing, such as
antitrust provisions, federal and private liability, and the Freedom of
Information Act. 

Federal research and development efforts are inadequate to meet the
challenge presented by the emerging cyber threats.  About $250 million is
spent each year on infrastructure assurance-related R&D, of which 60 percent
or $150 million is dedicated to information security, largely conducted by
the National Security Agency and DARPA.

There is very little research supporting a national cyber defense.  The
commission believes that real time detection, identification and response tools
are urgently needed, and we concluded that market forces are insufficient to
meet those needs. 

Thus, we recommend doubling federal R&D funding for infrastructure
protection to $500 million the first year, with 20 percent increases each
year for the next five years.

We recommend this funding target risk management, simulation and modeling
and decision support, contingency planning, incident response and recover,
information assurance, vulnerability assessment and system analysis, and
early warning and response monitoring and threat detection.

I need to talk a little about how the federal government and industry can
work together to address infrastructure protection concerns.  It might be
easiest if I first explain a little about our methodology before jumping
right into our partnering recommendations.

First, the commission identified five general functions that are the
foundation of infrastructure protection and assurance efforts, and they are
shown here -- policy formulation and so on.  Next, we flesh them out to
include all the tasks that must be formed, performed, to assure our
infrastructures, as shown there.

We knew that a great many people and organizations needed to accomplish
these tasks, but we were not sure who or where.  We devised a framework or
matrix to help determine who should be responsible for each task.  Along the
top of this matrix, roles range from the purely public to the purely
private.

Along the side, roles range from decentralized to centralized. The top left
quadrant, for example, is the role of the federal government, centralized and
public.  The bottom right quadrant is the place for individual companies,
decentralized and private. 

Using this framework, we plotted the specific tasks of infrastructure
assurance where we thought they should be performed. And the result is a
high concentration in the four distinct quadrants, but also a high
concentration along the borders.  And it was the concentration along the
borders that gave us pause, for these are the functions that require a new
awareness, a new way of doing business, and a new partnership.

We next look at how infrastructure assurance is being performed today,
and there are many players in this game, including the privately-owned
infrastructures as well as federal, state and local governments.  There are
also a great many existing relationships, such as regulating or enforcing
laws.  But there are no specific relationships for infrastructure protection
and assurance, and we focused on bridging this gap.

And this is how we propose to facilitate the public-private partnership,
how to bridge the gap to best protect our infrastructures.  At the
policymaking level, we recommend an office of national infrastructure
assurance, located within the White House, to serve as the federal
government's focal point for infrastructure protection.

Secondly, a national infrastructure assurance council comprised of selected
infrastructure CEOs and cabinet officials to propose policy and advise the
president.  And, an infrastructure assurance support office to support both the
council and the national office. And this office we recommend be located in the
Department of Commerce. 

At the operational level, we recommend sector infrastructure assurance
coordinators as focal points within each industry infrastructure to share
information.  These would be clearinghouses that would provide anonymity and
protect the proprietary information that the industry would want to share with
the other agencies and government. 

And then federal lead agencies to promote and assist in establishing
those sector coordinator clearinghouses.  And an information sharing and
analysis center staffed by both private industry and government to receive
and share information about infrastructure intrusions, to be located in the
private sector.

And finally, a warning center designed to provide operational warning
whenever possible of an attack on the infrastructures, either physical or
cyber, and we propose that that be built upon the existing and embryonic
warning center of the CTAC within the FBI.

In conclusion, just as the risks are shared between the public and
private sectors, so will the solutions be found.  Our national and economic
security has become a shared responsibility, one that will require a new
kind of partnership between government and industry, one which encourages
information sharing, and one which requires the government to lead by
example.

I believe the findings and conclusions of the commission are based on
accurate and reasonable information and analyses.

MARSH: Our recommendations if implemented, will create the partnerships
and structures essential to reducing vulnerabilities in our infrastructures.
They will provide the impetus for research and development to increase
information security and provide a cyber defense system.  They will increase
the nation's ability to prepare, protect and respond to any threats --
strategic or otherwise -- directed against our infrastructures, thereby
ensuring their continued effective operation in support of our defense,
economic growth and general well-being.

Mr. Chairman, that completes my statement.  I'd be pleased to answer any
questions that you or Senator.... 

KYL: Thank you very much, Mr. Marsh. There are so many questions and for the
benefit of the audience, let me tell you that we expect a vote on the motion to
proceed on Fast Track at 4:20. 

Now that's 10 minutes from now, and therefore, Senator Feinstein and I
conclude that we will try to do our best to conclude this hearing at about
4:30, which should enable us to run to get to the vote.  And so, we'll try
to be as quick as we can.

But we need to ask you some questions for the record, and you've already
indicated a willingness to continue the dialogue informally. So, I know
we'll be able to count on that too.

You discussed the best practices concept.  And I wonder if you would tell
us some of the ways that you think we could actually and establish an
institutionalize best practices for information assurance, not only in the
government, but also in the private sector?

MARSH: Yes, Mr. Chairman.  We believe that NIST within the Department of
Commerce and the NSA are best equipped of all the agencies of government to
identify those best practices, best fire walls, best means of controlling
access by way of password control, etc., best to describe under what
conditions encryption ought to be used and how it ought to be implemented.
And therefore, we believe NIST in collaboration with NSA ought to be charged
to develop and disseminate best practices within government.

We believe that this information and analysis center that we're proposing,
would be the mechanism then, to exchange those best practices.  And we advocate
they be exchanged with the private sector out through the clearing houses that
we've proposed creating. 

KYL: The reason I mention this is, it's critical that because government
uses so much of the private sector for its own purposes, and because the
private sector constitutes the vast majority of the communications and the
telecommunications and the energy sector, all of the other things that were
identified; five out of the eight are totally private sector.  And elements
of the other three are, at least two of the three are also private sector.

It's critical that the private sector also embrace these best practices.
And the model could be anything from something that I wouldn't propose which
is standards such as we have under the Clean Air Act let's say.

The industry shall remove a certain amount of its pollutants or not emit
more than X amount of pollutants, and here are the practices that we approve
for the purpose of achieving those goals.  That's a very heavy handed
approach to it.  All the way from that to a purely voluntary kind of thing.

But, because the government itself relies upon many of these private
sector communications and systems, is it your view that we're going to have
to find incentives and other mechanisms sufficient to ensure that these best
practices are built into the private sector systems as well as the
government systems?

MARSH: Mr. Chairman, we debated that a length within the commission that
whether or not we ought to seek mandatory means of imposing best practices and
standards. 

And our considered conclusion was that we not do that, that we attempt as
a first step to get this information sharing system really working, and we
believe through an education and awareness process that businessman will
find that it's in their very best interest to incorporate these best
practices against the commonplace threats.

And if they'll do that, and they need to do that; we believe that will give
us a great measure of protection against the more serious threats.  And
therefore, we do not believe it's yet time to mandate such best practices upon
the private sector, except that that of course, is an option if we find that
they are not well accepted. 

KYL: Well, and again, I reiterate that that's not my preference
certainly.  I think we are going to have to face up to the realistic
challenge however, of providing incentives for industry to adopt best
practices.

Because, it is no longer a matter of going it alone.  Everyone is depended
upon everyone else at this age, and that's part of the whole point of this
exercise. 

And given that interdependence and due to the inter operability of the
systems, I think we're going to have to have us some national commitments here
that enable us to secure our systems against the kind of challenges that you've
discussed.  

Let me just ask one other question and then turn to Senator Feinstein.
About 20 percent of the recommendations in the report pertain for the need
for additional studies.  And, some might read into this the kicking the can
down the road approach.  I know that is not your approach to this.  How
would you characterize the level of urgency with which we should move
forward?

MARSH: I believe I tried to summarize in the statement that it would be
totally irresponsible to delay taking action against this problem.  And we
believe it's an urgent problem that steps be taken now, and if they should
not be taken; I believe we're facing a very likely major challenge within
the coming years.

FEINSTEIN: Thank you, Mr. Chairman.  General, take my comments with a
grain of salt because I'm one that's still trying to master my little IBM
think pad.  So, I'm new to cyberspace and I find it quite a wondrous world.
Having said that, you know, I'm not necessarily new to matters that are
related to security.

And in prior hearings that Senator Kyl has had, and I've been ranking
member, this whole subject of encryption and key recovery has come up and
I've made some comments, saying, you know, I think this is really important,
and etc. etc.

******************************************************************************
And everybody says, you're going to get a storm of protests.  How can you
say that from California.  Do you know I didn't have a single phone call
from any CEO of any computer company, anywhere.
******************************************************************************

Now the trade people went off, you know, on sort of a lark.  I think that
the CEO's of these big companies really understand that we're in a new day.
And, I wanted to just brashly make a recommendation to you that it might be
well to convene a meeting of top CEO's throughout the United States, and
really kind of give them your views of where we are as a nation, what the
threats are, and to kind of bring them in on a cooperative basis right at
the very beginning.  Because, I think you'll have some very willing
partners.

MARSH: Senator, I think that's right.  I believe that as we've interacted
with the CEO's, and we have them on our advisory council as well as many other
fora over the course of the last year, when you sit down and talk about this
problem; we get a shared feeling of the nature of the problem on the part of
all.  Very few are skeptical of our undertaking. 

FEINSTEIN: Can you outline any of the concrete changes that might be able to
be immediately implemented to strengthen our system against cyber or physical
threat, that we might be able to take now? 

MARSH: Senator, there are wide range of techniques and tools available to
the private sector right now.  Such arcane things as fire walls and good
password control, good discipline, good system administrators managing the
networks, whether it be within your company or within your office.  And the
tools are available.  It takes a commitment on the part of management to
invest, and that investment is not large to install such mechanisms and to
enforce the disciplined used of them.

So, much of that is available.  And certainly, encryption is available.
And we want to see that adopted over all critical control functions at a
very early date.  And that's why we're so anxious that this debate evolve
and be completed early.


FEINSTEIN: You spoke about establishing a new office of national
infrastructure assurance.  And placing it within the confines of the White
House.  I'm not really sure that's the right place for it. 


FEINSTEIN: I mean I would hope that, based on what the -- Dr. Hamre said and
the concern of the Defense Department and what Senator Kyl has just said about
there really needs to be a whole separate branch in defense -- I hope I'm not
misspeaking... 

KYL: No. 

FEINSTEIN: ... to really deal with this, it would sort of seem to me that
perhaps a separate branch in defense that had the R&D potential, was able to
really go out and tap the best brain cells in the nation might really be a
better way to go. 

Why did you not recommend that? 

MARSH: Senator, we felt that this was a multidisciplined problem, if you
will.  That is it has the law enforcement dimension, and that's a very
important one.  It has an intelligence dimension. It has the defense.  But
it also has an economic dimension.  That is the economic concerns of the
private sector have to be taken into account as you formulate policy and
all.

And it was our judgment that, therefore, that office ought not be viewed
strictly as a national security/national defense problem, but in this broader
context.  And we felt placing it in the White House would give it that kind of
emphasis across all branches of government. 

FEINSTEIN: Not to belabor it, but I think placing it in defense would
give it a status and a credibility and remove it from any political
dimension, which I think is extraordinarily important in this.  I mean I
really believe this is a major threat to the well- being of all of us.

And the more we have, you know, our top defense people in a sort of
separate effort working on it, the better off our nation is going to be in
the long term.

I hate to see it get involved in politics in any way -- not that -- you
know, and I'm not casting any aspersions on the White House. But you know,
we all -- I've been around here long enough now to see what happens, and
that, dependent on the president, you get a certain amount of criticism for
whatever you do if you're not in that party.

And I would not like to see that happen with something as critical as this. 

MARSH: We do not want the problem to be politicized if at all possible. 


FEINSTEIN: Now, I thank you very much.  I think both you and Dr. Hamre
were really very -- very effective in stating the urgency of this.  And I
would just hope that nobody, you know, looks at this as anything but top
priority, and we really move fast.

And I, for one, am willing to help my chairman just as much as I possibly
can in this regard.

MARSH: Thank you, Senator. 

KYL: Mr. Marsh, let me make a couple of statements maybe that you would feel
less comfortable making just to put a couple of things in context, too. 

The administration, having just received your report, has begun the process
of evaluating it, vetting it among the various departments, agencies, that
they'd like to get responses from in order to develop its official response in
terms of actions that it might take or recommendations to Congress and other
steps that might be taken. 

So we appreciate the fact the administration has not yet responded and are
not asking anyone from the administration to respond at this point. 

We felt it important to have you brief the public in an open session as soon
as the report was declassified, and the report is now declassified, so at least
in this version of it.  There is also a classified version of it. 

And we view this as the beginning of the debate. 

Senator Feinstein, I think importantly, mentioned a couple of points and I
second her motion of bringing people with industry together as much as possible
as soon as possible.  You did that as a part of your commission.  I think the
president was wise to include the private sector segment. 

I know we've dealt with the NSTAC people before.  I had to ask my staff
-- remind me exactly what that stands for -- the National Security
Telecommunications Advisory Council, a group of CEOs that has been very
aggressive in working with government and trying to advise the president on
how he could help to deal with some of these problems.

And so I know that there are some very good people in the private sector who
very much want to work on these problems. 

I think the thing that we would like to leave the public with today is
the same point that Senator Feinstein ended on.  And that the sense of
urgency which is why I asked you that last question and why I read the
Defense Science Board recommendation to Dr. Hamre.  And he reiterated the
point of urgency.

It is important, while the administration evaluates your report, that it
also takes steps like the Interagency Task Force and other steps to
immediately begin to deal with the problems.  And if I could kind of
conclude on this note, for those who haven't had the benefit of reading the
report and other documents, we're really talking about a couple of different
things here.

In terms of the threat, we're not just talking about the security threat,
a challenge by a foreign nation, for example, to multiple parts of our
national infrastructure, but also as you pointed out lesser threats -- a
terrorist threat, which may or may not be strategic in its implications;
just a sophisticated hacker, as you pointed out; and also natural events,
which also threaten our infrastructure.

And in addition to talking about the computers at the Defense Department,
we're talking about all of the telecommunications intertwined with all the
switching in the country and the energy grids, as they go through all of
their complicated intertwined connections.

You mentioned the global positioning satellite, how our airplanes all
depend upon getting where they're going at exactly the right place and time
on a system which could be very vulnerable.

All of these things are subject to all of those different kinds of
threats.  And so, as we evaluate the proper response for it, we have to keep
them all in mind.

I tend to agree with Senator Feinstein that, as to the security of the
nation in terms of a strategic threat, clearly there needs to be within the
Defense Department a central command to deal with that. In order to insure
that we have the proper law enforcement follow-up and strategic warnings
that only a group like the FBI can provide, we need to have a clear
component in the FBI or the Justice Department or some similar place to
insure those capabilities.

I mentioned these -- and then the emergency response that Senator
Feinstein mentioned earlier and so on.

All of this, I think, illustrates the complexity of the problem, the
complexity of the structures that are going to be necessary to deal with it,
the fact that many different committees in Congress are going to be dealing
with this, many different agencies of the government.

You've tried to pull all of that together in some sense in this report to
begin to discuss how this all relates together. 

I commend you again and the members of the commission for the job well
done under very difficult circumstances, and pledge to you our cooperation.
I'm sure I speak both for the -- both sides of the aisle here.  This is not
a partisan issue at all.  And we look forward to the continuing dialogue
with you.

I would like to request a couple of things from you if you could provide
them for the record.  A copy of the legal database which the commission
assembled would be very valuable to us.

MARSH: Yes, sir. 

KYL: And also any other studies or products that you used in the
production of your report that might be useful to us as well.  We'll submit
a specific list for you as well as possible additional questions for the
record.

Senator Feinstein, anything else... 

FEINSTEIN: Thank you very much. 

KYL: We'll look forward to working with you...  

MARSH: Thank you very much. 

KYL: ... General Marsh and thank you very much for being here. 

END

NOTES:
????  - Indicates Speaker Unkown
- Could not make out what was being said. 
off mike - Indicates Could not make out what was being said.



[Added by JYA]

[Congressional Record: November 5, 1997 (Digest)]
[Page D1214-D1217]
From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr05no97-1]
 
                                        Wednesday, November 5, 1997

                                 Senate

[Excerpt]

NATIONAL INFRASTRUCTURE PROTECTION

Committee on the Judiciary: Subcommittee on Technology, Terrorism, and 
Government Information concluded hearings to review the findings and 
recommendations of the President's Commission on Critical 
Infrastructure Protection report, and to examine policy implications of 
new risks to the information-based national infrastructure, after 
receiving testimony from John J. Hamre, Deputy Secretary of Defense; 
and Robert T. Marsh, former Chairman, President's Commission on 
Critical Infrastructure Protection.

-------------------------------------------------------------------------

[Congressional Record: November 6, 1997 (Digest)]
[Page D1228-D1231]
From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr06no97-2]
 
                        House of Representatives

[Excerpt]

COMPUTER SECURITY--U.S. INFRASTRUCTURE

Committee on Science: Subcommittee on Technology held a hearing on the 
Role of Computer Security in Protecting the U. S. Infrastructure. 
Testimony was heard from Robert T. Marsh, Chairman, President's 
Commission on Critical Infrastructure Protection; and public witnesses.