Cybersecurity Information Sharing Act of 2015
Floor Speech
Mr. KING. Mr. President, the United States is under attack. We are under attack--not a week ago, a month ago, September 11 or yesterday, but right at this moment. We are under attack from state actors, from terrorist nonstate actors, and from garden-variety criminals. This cyber issue is one of the most serious that we face.
When I first got here, I was appointed to the Armed Services and Intelligence Committees. On those two committees over the past 3 years, at least half of our hearings have touched upon this issue and the threat that it presents to this country. The leaders of our intelligence community and our military community, in open session and in closed session, have sounded the alarm over and over and over. The most dramatic--I don't remember what the hearing was--was when one of our witnesses said: ``The next Pearl Harbor will be cyber.''
As the Senator from Missouri just pointed out, we are fortunate that we have had a number of warning shots but none have been devastating. But we have had warning shots--at Sony, at Target, at Anthem, at the Office of Personnel Management of the U.S. Government, and at the home email of the Director of the CIA. We have had large and small intrusions and cyber attacks that have been more than annoying, but, so far, they haven't been catastrophic. That is just a matter of time. That is why we have to move this bill.
This bill isn't a comprehensive answer to this question, but it is at least a piece of it. It is a beginning. We are going to have to talk about other aspects of our cyber strategy, but at least we can pass this bill, which came out of the committee 14 to 1. It is bipartisan, and it has support in the House. Let's do something.
I do not want to go home to Maine and try to explain to my constituents, when the natural gas system or the electric system is brought down, that we couldn't quite get around to it because of the difference of committee jurisdictions or because we had other priorities or because we were tied up on the budget. This is a priority. It is something we should be doing immediately, and I am delighted that we have moved to it.
Now, as I have sat in the Intelligence Committee every Tuesday and Thursday afternoon for the past 3 years, it occurred to me several months into those debates and the discussions of this and other issues that really we in the Intelligence Committee and also we in this body really are working with and weighing and balancing two constitutional provisions.
The first is the preamble of the Constitution. The most basic responsibility of any government, anywhere, anytime, is to provide for the common defense. That is why governments are formed, to provide the security, and also to insure domestic tranquility. Those two together are the basic functions of why we are here--to protect our people from harm. And that is clearly what this bill is talking about.
But the other constitutional provision in the picture that we also have to weigh is the Fourth Amendment: ``The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated. ..... '' That is a fundamental premise of who we are as a people.
These two provisions of the Constitution are intentioned--neither one dominates, neither one controls the other--and it is our job in this body to continuously weigh and calibrate these two provisions and their balance in light of threats and evolving technologies.
When the Fourth Amendment was written, nobody had ever heard of telephones. They certainly had never heard of the Internet. They never thought about any of these things. But they said: The rights ``shall not be violated.'' It is interesting--``unreasonable searches and seizures.'' They didn't know the threats we would be facing when they said it was a fundamental premise of the U.S. Constitution that we should protect against both foreign and domestic enemies. That is what we have to do, and that is what this bill does.
This bill is very carefully worked up, with a lot of discussion and negotiation, to be effective in protecting the public, while, at the same time, to be effective in protecting the public's privacy rights in respecting these two principles. We have had warning after warning after warning, and now it is time for us to act.
The good news about the United States is that we are the most wired nation in the world. Technology has been a huge boon to our economy and to our people, and we are way ahead of a lot of the rest of the world in our interrelationship with technology and how we have used it to enhance our lives. That is the good news. The bad news is that we are the most wired country in the world, because that means we are the most vulnerable--asymmetric vulnerability. We are more vulnerable because we are more connected. That means we have to take great care in this country to be sure that we don't allow that vulnerability to result in a catastrophic loss for our people.
Not only are we talking about national security issues, but we are talking about individual people's lives. If the electric grid went down, people's lives would and could be lost--in hospitals, at traffic intersections, across the country. If the natural gas system--the vast pipeline system that links our country in terms of energy--somehow went awry because of a cyber intrusion into the operating system, that would have devastating consequences for human lives and also, of course, for the economy of our country. Somebody could get into the routing system of a railroad, and a train carrying hazardous material would be caused to derail. These are the kinds of things that can happen and will likely happen unless we take steps to protect ourselves.
Some of these attacks and intrusions are sponsored by nation-states. We know that. Some of them are sponsored by just garden-variety criminals who are trying to steal our money. Or some of them are large international criminal organizations that are trying to steal our commercial intelligence and how we build our products and how we compete. Some of them are terrorist organizations that see this as a cheap way to attack America. Why go to all the trouble to build a bomb and smuggle it into the country and all the risk that entails, when you can disrupt the country in just as great a way with a few strokes on a laptop?
It is economic security, national security, economics. It has been estimated worldwide that cyber crime costs our country $445 billion a year. That is to the global economy--a half trillion dollars a year. Some 200,000 jobs in the United States could be and are being affected, and 800 million personnel records were stolen, and 40 million were Americans.
The cost of cyber crime is estimated to be between 15 and 20 percent of the value created by the Internet. We always talk that we don't want any taxes on the Internet. This is a tax. This is a tax we are all paying. The users of the Internet are paying to ward off this epidemic of cyber crime.
It is not only the government. Of course, it is companies, such as Sony, Target, Anthem, the industrial base, JP Morgan, Home Depot. The list goes on and on. Most importantly, it is not just the big guys. Sometimes we feel that OK, this is the large banks, the large insurance companies that have to worry about this. In the State of Maine, we have to worry about it.
My staff and I in Maine have reached out to businesses large and small across the State. Every single one, with one exception, listed cyber intrusion as one of their greatest issues.
The Maine Credit Union League, with $2.5 million a year, and local credit unions are having to deal with cyber intrusion.
One of our Maine health care providers has experienced thousands of attempts to steal confidential data every year. Keeping the data safe is costing them more than $1 million. This is costing us real money.
At one of our Maine financial institutions, 60 to 70 percent of the emails they get in the bank are phishing emails trying to compromise their secured data.
One of our utilities spent over $1 million a year just on preventative costs to defend against cyber crime. This is in a State of 1.3 million people. This is real. This is real in our State.
I had a forum over the August break with businesses throughout Maine--mostly small businesses and homeland security. We had 100 businesses come just to visit and sit for a day to talk about this issue. These were small businesses, and all of them were seeing these kinds of problems.
One was a small business with 35 employees that did a deal overseas, and a cyber criminal in effect stole their payment. They sent a fake invoice to the customer overseas, the customer paid it, and the money went to the crook, not to my company in Maine. That is the kind of thing that is happening, and that is one of the reasons we have to take action today.
No business is immune. No individual is immune. And, of course, this country is not immune.
The price of inaction is just too high. This is something we must attend to. As I mentioned, this bill is not the whole answer, but it is a part of the answer.
Some people say: Well, it is not broad enough. My answer is this: OK, I understand that, but let's do what we can do and then take it one step at a time.
Some people say it compromises privacy. I don't believe that it does. Extraordinary measures were imported into this bill in order to protect the privacy of individuals. This is not about individual data. This is about a company voluntarily telling the government and perhaps some other companies: Here is what I am seeing as an attack. How can we collectively defend ourselves against it?
That is what this bill is really all about. We have to take action, and now is the time.
I thank the chair and the vice chair of the Intelligence Committee, the members of the Homeland Security and Governmental Affairs Committee, the members of the Judiciary Committee, and all of those who have contributed to the finalization of this important piece of legislation.
There is an attitude out there that we can't get anything done around here. I think this gives us an opportunity to prove that idea wrong. We can get things done. We should get things done. This is a chance for us to protect our people, to provide for the common defense--which is our most solemn constitutional responsibility--in a way that also protects the interests of the Fourth Amendment and individual privacy rights.
I hope we can move swiftly, complete the consideration of this bill this week, work out our differences with the House, and get this matter to the President. We have no place to hide if we don't get this done. This is what we are here for.
Again, I thank my colleagues who worked so hard to bring us to this point.
I yield the floor.
BREAK IN TRANSCRIPT
Mr. KING. I would suggest to the Senator that if you are in a fight and all you can do is defend and never punch, you are going to eventually lose that fight. I think this is an important area. The theory of deterrence, as distasteful as it might have been, the mutually assured destruction during the nuclear era did in fact prevent the use of nuclear arms for some 70 years. I think we need to be thinking about a deterrence that goes beyond simply defensive measures. I commend the chairman for raising this issue and appreciate your thoughtful consideration.
Mr. President, I yield the floor.
BREAK IN TRANSCRIPT
Source