Prepared Witness Testimony

The House Committee on Energy and Commerce

Cybersecurity & Consumer Data: What's at Risk for the Consumer?

Subcommittee on Commerce, Trade, and Consumer Protection
November 19, 2003

 

Prepared Statement of The Honorable Cliff Stearns

Good morning and welcome to the Subcommittee on Commerce, Trade and Consumer Protection's hearing on cyber security and consumer data. I am pleased that we are joined this morning by a group of distinguished witnesses and look forward to having their testimony.

On November 15th, 2001, nearly two years ago to the date, the subcommittee held a hearing entitled: "Cybersecurity: Private-Sector Efforts Addressing Cyber Threats." The focal point of that hearing, as it is with this hearing, was cyber security as it related to consumer data used in stream of commerce. We are fortunate that three witnesses, Ms. Davidson and Messrs. Schmidt and Morrow, all of whom testified at the hearing two years ago have joined us today to reflect on what has transpired with regards to cyber security in the last two years. I am confident their insights along with the testimony of the other witnesses will be particularly helpful to our better understanding the issue, its evolution and its increasing significance.

The subcommittee's hearing two years ago was held in the shadow of the tragic events of September 11th, when we as a nation, it seemed, had become obsessed with security. Of course that is understandable. Yet, the problems that gave rise to cyber security concerns then predated September 11th. In just the years 2000 and 2001and as a result of only three cyber attacks - the I Love You and Code Red viruses and February 2000 denial of service attacks - the media reported losses in excess of $10 billion. The number of cyber attacks, as reported by the Computer Emergency Response Team (CERT) at the Carnegie Mellon University, was expected to nearly double in 2001 from 2000 to some 40,000.

Fast-forward two years, in 2003 the "SQL Slammer" worm disrupted computers around the globe and during the attack half of all Internet traffic was being lost. The Sobig.F virus clogged e-mail boxes and networks around the world and became the fastest-spreading virus on record, infecting one in 17 e-mails at its peak. Showing a bit of humor, the creator of the Blaster worm - which caused some 500,000 computers running Windows to crash - targeted the Microsoft website from which users could download a program to patch a known vulnerability in Microsoft Window's code, the very weakness in Windows that the worm itself was exploiting.

The virus and worm attacks of '03 did bring about disruptions, such as the SQL Slammer worm knocking out Bank of America's ATM machines for a while, but overall they did little reported damage. Although, the ultimate objective of the Sobig.F virus is not known, the '03 vintage of viruses and worms like most of the ones that preceded them did not have a malicious or destructive "payload". If they did, their impact would have been very different.

These virus and worm attacks are external attacks to the networks and as such, according to some estimates, only represent 30% of computer attacks. The remaining 70% of the attacks are carried out from within the corporate firewalls. Those attacks or security breaches taking place within the corporate firewalls, many argue, are the most costly and least reported.

I raise the issues of virus and worm "payloads" and within corporate firewall security breaches, because one key question I want answered today is: What are the real risks and costs to consumers from cyber security breaches and what poses the most risk to cyber security?

One response to breaches in cyber security by industry and government alike has been increased spending on security technologies. UBS Warburg estimates that such spending will increase from $6 billion in 2001 to $13 billion in 2003. Meanwhile, other data suggests that companies spend less than 3% of their technology budgets on security - the technology budgets tend to be around 3% of revenues. So why are these expenditures so low? Some argue, because there is no real understanding of quantifiable costs associated with cyber security breaches, even among senior managers. Is that true? This is another question for our panel to consider.

Finally, many argue that cyber security is not just a "technological" problem and thus can't be solved by adding new and improved technologies defending against cyber attacks. Rather, they argue that is as much a governance or management issue as it is a technological problem. Strategic decisions, such as deciding the appropriate balance between cost and risk are ones that only senior managers can take. And without a clear mandate from top management, cyber security measures will be disregarded as nuisances by rank and file employees. Moreover, it appears that there is increased management participation mostly when it is mandated either directly or indirectly by government regulation (e.g., Gramm-Leach-Bliley Act; Sarbanes-Oxley Act; and Health Insurance Portability and Accountability Act (HIPPA)) or enforcement actions (e.g., enforcement action taken against Eli Lilley, Microsoft, and Guess! by the Federal Trade Commission). Are these observations accurate? If so, is there an optimal role for the federal government to play when in comes to protecting consumers from cyber security threats?

With that question, I conclude and wish to thank the witnesses again for participating.

Printer Friendly