Cybersecurity Act of 2012--Continued

Floor Speech

BREAK IN TRANSCRIPT

Mr. DURBIN. Mr. President, the bill pending before us is the Cybersecurity Act of 2012, as it is known, and for most people it is a term which they may have heard but may not fully understand.

It was about 2 months ago that Members of the Senate, including the Presiding Officer, were invited to a classified briefing. It was a briefing that Senator Mikulski of Maryland asked for to explain what this was all about because we had been hearing over and over again from the defense establishment in America that the No. 1 threat to America's safety and security was no longer just terrorism; it was cyber security threats and terrorism. For most people, they are not quite sure they have seen any examples of it that could make a difference.

So here is what we saw. They took us down to this classified room, closed the door, took away our BlackBerries and iPhones, and put them in a separate place--and I will explain why they did that in a moment--they took us in the room and briefed us on an example, just a theory. What if? What if a subcontracting company that supplied a major public utility in a city such as New York had a problem and someone stole a laptop from one of the employees, and that theft went unnoticed or unreported for a number of days, and then the laptop either reappeared or did not, what could happen?

Well, what could happen was, if that laptop computer had certain information in it that not only told you how to get into the computer system of the subcontracting company but also the public utility, bad things could occur. So getting inside that computer laptop, getting inside the technology of the subcontractor, and then finding that information bridge into the public utility could create an opportunity to turn out the lights in the city of New York.

That was the exercise we went through. God forbid it would ever occur, but they said: When you turn out the lights in a major American city such as New York, terrible things happen. Not only do traffic signals stop, and lights do not go on at night, and the New York Stock Exchange is not operating, hospitals are on emergency generators and problems start popping up in every single direction--water purification; the pumps that keep the subway system under the city of New York going so that the subway tunnels are not flooded--all of these things on top of one another. While this tragedy is occurring, the people in our government are trying to figure out: What happened? And how do we put things back into place and get them moving again?

That was one example.

There was another example. It was an example at one of our defense research laboratories. Top secret. Nobody can get in. Right? They told us of an example--and I will not even tell you the State where it was located--they told us of an example where the employees at our top defense research laboratory--who were trying to figure out countermeasures to stop attacks against the United States, and to develop our own weaponry--had what appeared to be a harmless e-mail sent to the employees saying: Explanation of Your New Health Care Benefits. Just Click Below. It turned out that click brought the hackers into the system.

So what we are talking about here has consequences that go far beyond the harassment of some teenage hacker who is trying to get into some company computer or even the school's computer.

I was on a plane yesterday with a gentleman who is working for the National Institutes of Health. I asked him about cyber security.

He said: We think about it every day--every day--because hackers are trying to get into the National Institutes of Health technology and computer system.

I said: What for?

He said: Well, some of them are in there for insidious reasons. But some of them are childish hackers.

I said: What do they do?

He said: Well, they will come in, for example, and change our published list of antidotes to certain poisons, so we always have to keep an eye on it to make sure they have not changed what people, doctors, should use across America.

Think about it. Think about all of the possibilities. What we are trying to do today is to come up with a line of defense for America. We are trying to establish a working relationship between all levels of our government and the private sector of the United States to keep us safe. Because what they told us was, every single day, China, Russia, Iran are on the attack--cyber security attacks into the United States--not just the ones I have mentioned but far beyond. Defense contractors building the planes and the armaments and all the artillery and the like have to worry about whether their secret plans, their patented information is being stolen right from under them, stolen by someone who wants to compete with them or perhaps wants to go to war with them. That is what is at stake.

So for a long time we have been warned and forewarned to do something about it. The bipartisan consensus among defense and intelligence experts in the public and private sector is that our Nation is dangerously vulnerable to cyber-attack at this moment.

FBI Director Bob Mueller--an extraordinarily great public servant--says the threat our Nation faces from a cyber-attack will soon equal or surpass the threat from al-Qaida and more traditional forms of terrorism.

Navy ADM Mike Mullen, Chairman of the Joint Chiefs, said: ``The cyber threat has no boundaries or rules, and the reality is that cyber attacks can bring us to our knees.'' According to our Director of National Intelligence, James Clapper, countries such as Russia and China are already exploiting our vulnerability. His unclassified assessment--what he told the public--is that entities within these countries are already ``responsible for extensive illicit intrusions into U.S. computer networks and theft of intellectual property.''

We have to respond to this. We have to do it quickly. I wish to thank Senators Lieberman, Collins, Feinstein, and Rockefeller for putting together this bill, the Cybersecurity Act of 2012. They have introduced an approach that is balanced, bipartisan, and responsive to legitimate concerns raised by the intelligence community, private industry, and privacy advocates. The Cybersecurity Act of 2012 will help make us safer.

Our Nation's critical infrastructure--powerplants, pipelines, electrical grids, water treatment facilities, transportation systems, even financial networks--are increasingly vulnerable to attack. Bad actors in other countries have already demonstrated their ability to use the Internet to take control of computer systems.

Last year, there was a 400-percent increase in cyber attacks on the owners of critical infrastructure. This act has provisions that will reduce our vulnerability and shore up our defenses. In response to concerns raised by some in the private sector and some on the other side of the aisle, Senators Lieberman and Collins revised a section of the bill. The bill now creates a voluntary, incentive-based system of performance standards. Private companies and government agencies will work together to determine the best practices in each sector to prevent a cyber attack. Companies that voluntarily implement those standards will be rewarded with immunity from punitive damages in a lawsuit, receipt of real-time cyber threat information, and expedited security clearances, among other things.

This voluntary arrangement replaces the mandatory system in an early version of the bill. Many of us supported that approach. But in the spirit of compromise and responding to concerns expressed by the business community, the managers have included this voluntary approach. The Cybersecurity Act of 2012 also authorizes voluntary information sharing. The sharing provision will allow government agencies and willing private companies to enhance the mutual understanding of the real threat and our vulnerabilities.

Sharing this information on effective responses and recent cyber threats will enable both the government and the private sector to understand the threat and to respond. A handful of industries have already adopted this approach, and it significantly enhances their ability to identify and respond to cyber threats. We should empower the government to share its knowledge with these and other industries. We should make it clear the private companies can share cyber threat indicators with the government. That is exactly what this Act does.

I wish to thank the Presiding Officer, Senator Franken of Minnesota, as well as Senators Coons, Blumenthal, Sanders, and Akaka for working with me and the managers to ensure that we protect privacy and civil liberties. The Presiding Officer is chair of the Privacy Subcommittee of the Judiciary Committee. He has been a real leader on these issues. I was happy to work with him. As a result of his efforts and our efforts, the willingness of Senators Lieberman, Collins, Rockefeller, and Feinstein, we were able to significantly enhance the privacy and civil liberties protections in the revised bill. I believe--I have always believed and I will continue to believe--we can keep America safe and free. We can establish in our democratic society the appropriate defense to any threat without sacrificing our fundamental constitutional rights.

The revised bill, after we negotiated with them, now requires that the government cyber security exchanges be operated by civilian agencies within the Federal Government. Our thinking was that these agencies are more prone to oversight, and any excesses by them will be caught earlier than if this is done on the military side, to be very blunt.

Military and spy agencies should not be the first recipients of personal communications such as e-mails. But from time to time, they will need to be informed and we need to rely on their expertise. That is why the bill requires that relevant cyber threat information be shared with these agencies as appropriate in real time.

The revised bill eliminates immunities for companies that violate the privacy rights of Americans in a knowing, intentional or grossly negligent manner. To ensure that cyber security exchanges are not used to circumvent the fourth amendment, the bill requires law enforcement to only use information from the cyber exchanges to stop cyber crimes, prevent imminent death or bodily harm to adults or prevent exploitation of minors.

The revised bill creates a vigorous structure for strong, recurring, and independent oversight to guarantee transparency and accountability. It gives individuals authority to sue the government for privacy violations, to ensure compliance with the rules for protecting private information. These commonsense reforms improve the information-sharing section of the bill, and they protect privacy. That is why they have been widely embraced across the political spectrum from left to right. I think we have found the sweet spot. I think we have found the right balance. That kind of endorsement across the political spectrum suggests that is the case.

We are very vulnerable in the United States at this very moment. Our critical infrastructure is at risk, and billions of dollars' worth of intellectual property is being stolen. Our national security is compromised. To put the cyber threat in perspective, GEN Keith Alexander, Director of the National Security Agency, was asked: How prepared is the United States for a cyber attack on a scale of 1 to 10, with 10 meaning we are the most prepared. What was his answer? Three--three out of ten. That is an alarming assessment. It is a failing grade by any standard.

If we do not act now, we will continue to be at risk for not only the loss of information and economic loss but even worse, mass casualties, a crippled economy, the compromise of sensitive data. I know this bill has some controversy associated with it. I know there are some in the business sector who think we have gone too far. I would plead with them, work with us. Let us do this and do it now. To let this wait is to jeopardize the security of this country. We did not think twice to respond quickly after the 9/11 attacks to make America safe. We see it everywhere we turn. If one can even imagine what life was like in the United States before 9/11, before we took our shoes off when we went to the airport, before searches were commonplace in American life, before armed guards stood outside the U.S. Capitol--those are the realities of what we face today because of that attack.

Let's be thoughtful. Let's be careful. Let's come together, the private and public sector. Let's do this the right way to keep America safe. The people who sent us to represent them expect no less.

FOR-PROFIT COLLEGES

Mr. President, the Senate HELP Committee released a report after completing a 2-year investigation of for-profit colleges. The 1,096-page report is the most comprehensive analysis yet. It provides a broad picture of the for-profit college industry. What Senator Tom Harkin and the committee discovered and carefully documented is an industry driven by profit, which too often has limited concern for the students or the actual learning process.

The report profiles 30 of the biggest for-profit colleges, virtually from every State in the Union, including Illinois. There are good schools there, make no mistake, and my colleague Senator Harkin has been careful to point them out. But there are also some that are not making an effort. Some are trying to improve student outcomes. But unfortunately there are many of these for-profit schools that are just taking in, soaking in Federal subsidies in the form of student aid so they can pay their shareholders extra money.

DeVry is the third largest for-profit college in the country. It is based in my State of Illinois. DeVry operates 96 campuses and offers classes online. In 2010, DeVry had over 100,000 students, an increase of 250 percent of enrollment in 10 years since the year 2000. It derives almost 80 percent of its revenue from the Federal Government.

Similar to the other companies profiled in the report, DeVry's tuition is significantly higher than that of public colleges. The cost of tuition for a bachelor of science in business administration at DeVry's Chicago campus is $84,320--for a bachelor's degree--considerably more than the same program at the University of Illinois, where the 4-year tuition is $75,000.

DeVry looks good compared to many of its peers in the for-profit sector. Unlike some other schools, DeVry's internal documents reveal the school has chosen not to use aggressive price increases in the future. I salute them for that. I have spoken to their leadership and told them that if they want to distance themselves from the pack of bad for-profit schools, they have do it by making decisions and implementing them to demonstrate they are a different kind of for-profit school.

There are still areas where DeVry can make improvements. DeVry's institutional loan program, a private loan program, charges a 12-percent interest rate--12 percent. The Federal Government student loan, 3.4 percent in contrast. So this rate is roughly three times the Federal loan.

The HELP Committee estimates that in 2009, when all sources of Federal funds, including military and veteran's benefits are included, the 15 largest publicly traded for-profit education companies received 86 percent of their revenue from taxpayers--86 percent. They are 14 percent away from being totally Federal agencies.

Perhaps this would be acceptable if students were learning and gaining skills to succeed, but what the committee found is troubling. One of the main reasons student outcomes are so poor at these schools is that the schools do not provide students with basic support services that they need to find a job and succeed. Student support services are essential to helping students adapt and do well while they are in school and find a job. What happens instead? They drop out or, if they graduate, they cannot find a job.

In 2010, the 30 for-profit colleges examined employed 35,000-plus recruiters--35,000 recruiters. The same schools collectively employed 3,500 career service staff and 12,452 support staff. So by a margin of 2 1/2 to 1, the schools had more recruiters than support service employees.

So we cannot be shocked when we learn that one-half million students who enrolled in 2008-2009 left without a degree or certificate by mid-2010. Among 2-year associate degree holders, almost two-thirds of the students in these for-profit schools departed without a degree, just a debt.

The report also highlighted a growing problem among for-profit colleges, the use of lead generators. For-profit colleges gathered contact information on perspective students or leads, as they call them, by paying third-party companies known as lead generators. These generators specialize in gathering and selling information--in this case, very personal information.

Here is how it works. A student browsing the Internet searches for terms such as ``GI bill,'' ``student loan,'' ``Federal student aid'' or any variation. They are directed to various Web sites that are owned by these lead generator companies. The Web site then claims to pass the prospective student contact into an appropriate school for the student online. Typically, there is no disclosure to the student that their personal information is being sold to for-profit colleges.

When a perspective student does give their contact information, watch out. They will be bombarded with calls and e-mails from aggressive recruiters at these for-profit schools. Remember that 35,202 people are employed as recruiters. This is what they do. One of the Web sites, gibill.com, was owned by a company called QuinStreet until last month, when 23 attorneys general across the United States did what Congress should have done first. As part of an agreement, QuinStreet gave up its right to the Web site to the Veterans' Administration where it belongs. So gibill.com is no longer a deceptive Web site, at least in these 23 States where there has been an agreement. Other Web sites used the name of Federal student aid programs and misled students into believing this was a real government program.

One of the HELP Committee's recommendations is to further regulate the private student line market. Senator Harkin and I introduced the Know Before You Owe Private Student Loan Act this year. Our bill requires private student loan lenders to verify the prospective borrower's cost of attendance with the school before disbursing the loan.

It also requires the schools to counsel students as to whether they are still eligible for Federal student loans at a much lower interest rate. Federal student loans have flexible payment plans, consumer protections, and as I said, less cost. But many times students who have not exhausted their Federal student loan aid are steered into private loans with interest rates three and four times higher. There is money to be made off those young and sometimes uninformed students.

I urge the private lenders and the for-profit schools that keep telling me ``we are doing the right thing,'' do not wait for this law. Do it now. Make this a policy at their school and prove it.

One of the students I wanted to mention is Mirella Tovar from Blue Island, IL. She graduated from Columbia College in 2010 with a B.A. in graphic design and with $90,000 in debt and with a 10.25-percent interest rate. Her balance started to grow. She did not take out any Federal loans. She thought all the loans were the same. She did not know the difference.

No one told her about the consumer protections in the Federal loans. After she used her 6-month forbearance permitted by her lender, Mirella was expected to pay $1,500 a month. Unable to get a full-time job in her field, she thought about filing for bankruptcy.

It would not have done any good; student loans are not dischargeable in bankruptcy even if they come from for-profit colleges. Her dad wanted to help, so he cosigned her private student loans. Guess what. He is now on the hook for the payments too.

Mirella says that if the school counselor would have told her more about what her monthly payment would be like, she would not have taken out so much, and she may have never been steered to a private student loan.

I thank Senator Harkin for his leadership and his amazing work on this issue. I plead with my colleagues, on behalf of these students and their families and on behalf of the taxpayers who are subsidizing these schools, join us in setting standards so there is an opportunity for young people to get the education they need without inheriting the debts that can drag them down for a lifetime.

I yield the floor.

BREAK IN TRANSCRIPT

Source