Cybersecurity Act of 2012--Motion to Proceed

Floor Speech

BREAK IN TRANSCRIPT

Ms. COLLINS. Mr. President, first, let me thank the Senator from West Virginia for his comments. He has worked so hard on this issue for many years but, in particular, the past 3 years, as he and the chair of the Senate Intelligence Committee, Senator Feinstein, have worked with Senator Lieberman and me.

I rise this evening to urge our colleagues to vote to begin the debate on the Cyber Security Act of 2012. Senator Lieberman and I have introduced this bill along with our colleagues Senator Rockefeller, Senator Feinstein, and Senator Carper. It has been a great pleasure to work with all of them--and work we have--in numerous sessions over literally a period of years, as we have attempted to merge the bills that were reported by the Commerce Committee and the Homeland Security Committee.

Of course, it is always a great pleasure to once again work with my dear friend the chairman of the Homeland Security Committee, Senator Lieberman, as we bring forth yet another bipartisan bill to the Chamber for its consideration.

FBI Director Robert Mueller has warned that the cyber threat will soon equal or surpass the threat from terrorism. He has argued that we should be addressing the cyber threat with the same kind of intensity we have applied to the terrorist threat. This vital legislation would provide the Federal Government and the private sector with the tools needed to help protect our country from the growing cyber threat. It would promote information sharing, improve the security of the Federal Government's own networks, enhance research and development programs and, most important of all, it would help to better secure our Nation's most critical infrastructure from cyber attack. These are the powerplants, the pipelines, the water treatment facilities, the electrical grid, the transportation systems, and the financial networks upon which Americans rely each and every day.

The fact is the computerized industrial controls that open and close the valves and switches in our infrastructure are particularly vulnerable to cyber attack. Indeed, the Internet is under constant siege on all fronts by nations such as China, Russia, and Iran, by transnational criminals, by terrorist groups, by activists, and by persistent hackers. That is why our Nation's top national security and homeland security leaders from the current and former administrations have urged us to take legislative action to address this unacceptable risk to both our national security and our economic prosperity.

Earlier this year, Defense Secretary Leon Panetta described our bill as ``essential to addressing our Nation's critical infrastructure and network cyber security vulnerabilities, both of which pose serious national and economic security risks to our Nation.''

Just last month, the Secretary reiterated his call for Congress to pass our bill and stress the potential for a cyber attack to cripple our critical infrastructure in a way that would virtually paralyze this country.

The Director of National Intelligence, James Clapper, has also sounded the alarm. He has described the cyber threat as a ``profound threat to this country, to its future, its economy and its very being.''

The warnings have not been confined to officials in the Obama administration. Former national security officials, including Michael Chertoff, Michael McConnell, Paul Wolfowitz, Michael Hayden have written that the cyber threat ``is imminent and ..... represents one of the most serious challenges to our national security since the onset of the nuclear age sixty years ago.'' They have urged us to protect the ``infrastructure that controls our electricity, water and sewer, nuclear plants, communications backbone, energy pipelines, and financial networks'' with appropriate cyber security standards.

Similarly, in a letter to our colleague, Senator John McCain, GEN Keith Alexander, the commander of U.S. Cyber Command and the Director of the National Security Agency, wrote:

Given DOD reliance on certain core critical infrastructure to execute its mission, as well as the importance of the Nation's critical infrastructure to our national and economic security overall, legislation is also needed to ensure that infrastructure is sufficiently hardened and resilient.

The threats to our infrastructure are not hypothetical; they are already occurring. For example, while many of the details are classified, we know multiple natural gas pipeline companies have been the target of a sophisticated cyber intrusion campaign that has been ongoing since December of last year.

The cyber threat to our critical infrastructure is also escalating in its frequency and severity. According to DHS's Industrial Control Systems Cyber Emergency Response Team, last year, almost 200 cyber intrusions were reported by critical infrastructure owners and operators. That is nearly a 400-percent increase from the previous year, and these are only the intrusions that have been reported to the Department of Homeland Security. Many go unreported and, even worse, many owners are not even aware their systems have been compromised.

What would a successful cyber attack on our critical infrastructure look like? We have just seen recently what a serious storm that leaves more than 1 million people without power can cause: the loss of life, the blow to economic activity, the hardship for the elderly, the nonworking traffic lights that resulted in accidents. Multiply that impact many times over if there were a sustained cyber attack that deliberately knocked out our electric grid.

The threat is not just to our national security but also to our economic edge, to our competitiveness. The rampant cyber theft targeting the United States by countries such as China has led to the ``greatest transfer of wealth in history,'' according to General Alexander. You have heard many of us use his quote. Let me give some specifics of his estimates. He believes American companies have lost about $250 billion a year through intellectual property theft, $114 billion to theft through cyber crime, and another $274 billion in downtime the thefts have caused.

In their op-ed earlier this year, former DNI McConnell, former Homeland Security Secretary Chertoff, and former Deputy Secretary of Defense Bill Lynn warned that the cost of cyber espionage and theft ``easily means billions of dollars and millions of jobs.''

The threat of a cyber attack doesn't just go to our national security, critical though that is. It also directly is a threat to America's ability to compete, to our economic edge.

In recent years, a growing number of U.S. firms, including sophisticated firms such as Google, Adobe, Lockheed Martin, RSA, Sony, NASDAQ, and many others have been hacked by malicious actors. Earlier this month, the security firm McAfee released a report on a highly sophisticated cyber intrusion dubbed ``Operation High Roller,'' which has attempted to steal more than $78 million in fraudulent financial transfers at at least 60 different financial institutions.

Trade associations have been attacked too. The Chamber of Commerce was the victim of a cyber attack for many months, blissfully unaware until informed by the FBI that its membership data was being stolen. The evidence of our cybersecurity vulnerability is overwhelming. It compels us to act.

Yesterday 18 experts in national security strongly endorsed the revised legislation we have introduced. The Aspen Homeland Security Group, made up of officials from both Republican and Democratic administrations and chaired by former Secretary Chertoff and former Congresswoman Jane Harman, urged the Senate to adopt a program of voluntary cybersecurity standards and strong positive incentives for critical infrastructure to implement those standards. This group called for action on our bill, saying:

The country is already being hurt by foreign cyber intrusions, and the possibility of a devastating cyber attack is real. Congress must act now.

Mr. President, you have heard some Members of this body say that somehow this process has been rushed or the bill inadequately considered. Nothing could be further from the truth. Since 2005--7 years ago--our Homeland Security and Governmental Affairs Committee alone has held 10 hearings on cybersecurity. Other Senate committees have also held hearings, for a total of 25 hearings since 2009, not to mention numerous briefings the Presiding Officer and Senator Mikulski of Maryland have helped to convene--classified briefings--for any Member to attend.

In 2010, Chairman Lieberman, Senator Carper, and I introduced our cybersecurity bill, which was reported by our committee later that same year. As I indicated, we have been working with Chairman Rockefeller to merge our bill with legislation he has championed, which was reported by the Commerce Committee. We have also worked very closely with Senator Feinstein, an expert on information sharing.

The bill we are urging our colleagues to proceed to today is the product of these efforts. It also incorporates substantial changes based on the feedback from the private sector, our colleagues, and the administration.

This new bill is a good-faith effort to address the concerns raised by Members on both sides of the aisle by establishing a framework that relies upon the expertise of government and the innovation of the private sector. It improves privacy protections that Americans expect from their government.

It also reflects many concepts proposed by Senators Kyl, Whitehouse--the Presiding Officer--Blunt, Coats, Graham, Mikulski, Blumenthal, and Coons. We have revised our bill in a very substantial way. We have abandoned the approach--which I still believe to be a good idea--of mandatory standards and, instead, have adopted a voluntary approach to standards. This is a significant change from our initial bill, and it was one that was promoted by Senator Kyl's and Senator Whitehouse's group.

The new version encourages owners of critical infrastructure to voluntarily adopt the cybersecurity practices in exchange for various incentives for entities complying with these best practices. This was also one of the primary recommendations of the House Republican Cybersecurity Task Force.

These incentives include liability protection against punitive damages. I, for one, am open to making that a more robust liability protection. They include the opportunity to receive expedited security clearances, eligibility for prioritized technical assistance from the government, and access to timely cyber threat information held by the government.

These major changes from the approach we initially proposed demonstrate our willingness to adopt alternatives recommended in good faith by our colleagues, and we are still open to changes to the bill.

Our bill also includes strong information-sharing provisions that promote voluntary information sharing within the private sector and the government, while ensuring that privacy and civil liberties are protected. And again, we incorporated some suggestions from the Democratic side of the aisle to strengthen these provisions.

To be sure, more information sharing is essential to improving our understanding of the risks and threats. But let us be clear: More information sharing, while absolutely essential, is not sufficient to ensure our Nation's vital, critical infrastructure is protected. If you survey the vast majority of experts in this field, they will tell you that to pass a bill that only provides for more information sharing does not begin to accomplish the job that must be done to better secure our Nation from this threat.

With 85 percent of our Nation's critical infrastructure owned by the private sector, government obviously must work with the private sector. Our bill--both our original bill and our revised bill--has always envisioned a partnership between government and the private sector. We have a very stringent definition of what constitutes covered critical infrastructure. It is infrastructure whose disruption could result in truly catastrophic consequences.

What do I mean by that? I am talking about mass casualties or mass evacuations or severe degradation of our national security or a serious blow to our economy. That is the kind of disruption we aUnknownre talking about. Obviously those who have claimed that every company or every part of our infrastructure is going to be considered as critical infrastructure have not read the definition in our bill.

But here is more evidence of why we must act. A study done in 2011 by the computer security firm McAfee and CSIS revealed that approximately 40 percent of the companies surveyed--the critical infrastructure companies--were not regularly patching and updating their software, despite the fact these safeguards are among the most basic and widely known cybersecurity risk mitigation practices. We have even found reports where companies haven't bothered to change the default password that came with the industrial control software. In many cases, the control devices used

to operate our Nation's most critical infrastructure are inherently insecure.

A Washington Post special report last month noted that security researchers found six out of seven control system devices are ``riddled with hardware and software flaws,'' and that ``some included back doors that enabled hackers to download passwords or sidestep security completely.''

Another front-page story in the Post earlier this month highlighted the fact that as technological advances have allowed everyone from plant managers to hospital nurses to control their systems remotely via the Internet, these vital systems have become even more vulnerable to cyber attacks. To prove the point, the story described how a security researcher was able to easily steal passwords from a provider that connects millions of these systems to the Internet.

These examples illustrate that far too many critical infrastructure owners are not taking even the most basic measures to protect their systems, and this is simply dangerous and unacceptable to the security of our country. These basic practices need not be expensive. In most cases, they are not expensive. And I will tell you, they are a lot less costly than the consequences of a breach, not to mention a major cyber attack.

A recent report by Verizon, the Secret Service, and other international law enforcement agencies analyzed 855 data breaches and found that 96 were not difficult to pull off and 97 percent of them could have been prevented through fairly simple and inexpensive means.

The point is, we must act, and we must act now. We cannot afford to wait for a cyber 9/11 before taking action on this legislation.

In all the years I have been working to identify vulnerabilities facing our country in the area of homeland security, I cannot identify another area where I believe the threat is greater and that we have done less.

I urge my colleagues to listen to the wisdom of former Homeland Security Secretary Michael Chertoff and former NSA Chief General Hayden. They wrote the following:

We carry the burden of knowing that 9/11 might have been averted with the intelligence that existed at the time. We do not want to be in the same position again when ``cyber 9/11'' hits--it is not a question of ``whether'' this will happen; it is a question of ``when.''

And this time all the dots have been connected. This time we know that attacks are occurring against our Internet systems and cyber systems each and every day. This time the warnings from all across the board are loud and clear. I urge our colleagues to heed these warnings and to support the motion to proceed to the cybersecurity bill.

BREAK IN TRANSCRIPT

Source