Statements on Introduced Bills and Joint Resolutions

Floor Speech

BREAK IN TRANSCRIPT

Ms. COLLINS. Mr. President, I do rise today to introduce with the chairman of the Homeland Security Committee Senator Lieberman, as well as Senator Rockefeller and Senator Feinstein, the Cyber Security Act of 2012. As always, it has been a great pleasure to work with my friend and colleague from Connecticut on what I believe is the most important initiative we have come together on since perhaps our 2004 Intelligence Reform and Terrorism Prevention Act.

I am also delighted that three Senate chairmen who have significant jurisdiction in this area--Senators LIEBERMAN, ROCKEFELLER, and FEINSTEIN--have come together. We have all worked very hard on this bill. I also want to commend the staff of our committee, which has worked extraordinarily hard over several years to produce this bill. Our legislation would provide the Federal Government and the private sector with the tools necessary to protect our most critical infrastructure from growing cyber threats.

Earlier this month, FBI Director Robert Mueller warned that the cyber threat will soon equal or surpass the threat from terrorism. He argued that we should be addressing the cyber threat with the same intensity we have applied to the terrorist threat.

Director of National Intelligence Jim Clapper made the point even more strongly. He described the cyber threat as:

A profound threat to this country, to its future, its economy and its very being.

These warnings are the latest in a chorus of warnings from current and former officials. Last November, the Director of the Defense Advanced Research Projects Agency, or DARPA, warned that malicious cyber attacks threaten a growing number of the systems with which we interact each and every day--the electric grid, our water treatment plants, and key financial systems.

Similarly, GEN Keith Alexander, commander of U.S. Cyber Command, and director of the National Security Agency, has warned that the cyber vulnerabilities we face are extraordinary and characterized by ``a disturbing trend from exploitation to disruption to destruction. ``

As Senator Lieberman has pointed out, the threat is not only to our national security but also to our economic well-being.

A study by the company, Norton, last year calculated the cost of global cyber crime at $114 billion annually. When combined with the value of time that victims lost due to cyber crime, this figure grows to $388 billion globally, which Norton described as ``significantly more'' than the global black market in marijuana, cocaine, and heroin combined.

In an op-ed last month titled, ``China's Cyber Thievery Is National Policy--And Must Be Challenged,'' former DNI Mike McConnell, former Homeland Security Secretary Michael Chertoff, and former Deputy Secretary of Defense William Lynn noted the ability of cyberterrorists to cripple our critical infrastructure, and they sounded an even more urgent alarm about the threat of economic cyber espionage.

Citing an October 2011 report to Congress by the Office of the National Counterintelligence Executive, they warned of the catastrophic impact that cyber espionage--particularly that pursued by China--could have on our economy and our competitiveness. They estimated that the cost easily means billions of dollars and millions of jobs. This threat is all the more menacing because it is being pursued by a global competitor seeking to steal the research and development of American firms to undermine our economic leadership.

The evidence of our cyber security vulnerability is overwhelming and compels us to act. As the chairman mentioned, since 2005, our Homeland Security Committee has held nine hearings on the cyber threat. In 2010, Chairman Lieberman, Senator Carper, and I introduced our cyber security bill, which was reported by the committee later that same year. Since last year, we have been working with Chairman Rockefeller to merge our bill with legislation he has championed which was reported by the Commerce Committee.

Lately, after incorporating changes based on the feedback of our colleagues, the private sector, and the administration, we have produced a new version which we introduced today. Some of our colleagues have urged us to focus very narrowly on the Federal Information Security Management Act, as well as on Federal research and development, and improved information sharing. We do need to address those issues, and our bill does address those important issues.

Again, as did Senator Lieberman, I commend Senator Feinstein for her contributions in the area of improved information sharing, and Senator Carper for the work he has done on the Federal Information Security Management Act. But the fact remains that with 85 percent of our Nation's critical infrastructure owned by the private sector, government also has a critical role in ensuring that the most vital parts of that critical infrastructure--those whose disruption could result in truly catastrophic consequences, such as mass casualties or mass evacuations--meet reasonable, risk-based performance standards.

In an editorial this week, the Washington Post concurred, writing that:

Our critical systems have remained unprotected. To accept the status quo would be an unacceptable risk to U.S. national security.

The Post got it exactly right.

Some of our colleagues are skeptical about the need for any new regulations. There is no one who has worked harder than I have to oppose regulations that would unnecessarily burden our economy and cost us jobs. But we need to distinguish between regulations that hurt our economy and are not necessary and hinder our international competitiveness versus regulations that are necessary for our national security and that promote rather than hinder our economic prosperity, those that strengthen our economy and our Nation.

The fact is the risk-based performance requirements in our bill are targeted carefully. They only apply to specific systems and assets--not entire companies--that, if damaged, could reasonably be expected to result in mass casualties, huge evacuations, catastrophic economic damages, or a severe degradation of our national security. In other words, we are talking about truly catastrophic impacts. Moreover, the owners of critical infrastructure, not the government, would select and implement the cyber security measures the owners determine to be best suited to satisfy the risk-based cyber security performance requirements.

Our new bill would also require the Secretary of Homeland Security to select from among existing industry practices and standards or choose performance requirements proposed by the private sector--lots of collaboration and consultation. Only if none of these mitigates the risks identified through this public-private collaboration could the Secretary propose something different. That is extremely unlikely to happen.

The bill prohibits the regulation of the design and development of commercial IT products. It would require that existing requirements and current regulators be used wherever possible. The bill would allow Federal officials to waive the bill's requirements when existing regulations or security measures are already sufficiently robust.

As with our earlier versions of this bill, companies in substantial compliance with the performance requirements at the time of a cyber incident would receive liability protection from any punitive damages associated with an incident, giving them an incentive to comply.

The fact remains that improving cyber security is absolutely essential. We cannot afford to wait for a cyber 9/11 before taking action. The warnings could not be clearer about the vulnerabilities and the threat to our systems. Every single day nation states, terrorist groups, cyber criminals, and hackers probe our systems both in the public and the private sectors, and they have been successful over and over in their intrusions.

We don't want to look back after a catastrophic cyber event and say: Why didn't we act? How could we have ignored all of these warnings? So I would encourage our colleagues to continue to work with us and to come together and enact this vitally needed legislation.

Mr. President, I yield the floor.

BREAK IN TRANSCRIPT

Source