Transcripts For CSPAN3 Senate Subcommitee Hearing On Corporations Data Breaches 20240713

And thank you for transcribing all that were doing. And thank you to cspan for covering us. Without objection, all members will have five legislative days within which to submit additional written questions. Just a few moments left in this testimony. Well go live now to capitol hill for a Senate Subcommittee hearing on data breaches and cybersecurity. Among the witnesses is the Vice President for microsoft. This is live coverage on cspan3. For two invited witnesses who apparently dont share your commitment to discussing this issues. One is for tiktok. If you dont know what tiktok is, you should. Its a chineseowned social media platform so popular among teens that Mark Zuckerberg is reportedly spooked. For facebook, the fear is lost social media market share. For the rest of us, the fear is somewhat different. A company compromised by the Chinese Communist party knows where your children are, knows what they look like, what their voices sound like, what theyre watching, and what they share with each other. Tiktok claims they dont store american user data in china. Thats nice, but all it takes is one knock on the door of their Parent Company based in china from a communist Party Official for that data to be transferred to the Chinese Governments hands whenever they need it. Tiktok claims they dont take direction from china. They claim they dont censor. In fact n a letter submitted today to this committee, tiktok said this. No governments, foreign or domestic, direct how we moderate tiktok content. Tiktok does not remove content based on sensitiviti sensitivit to china or others. Thats what they say. Without objection, ill enter the whole letter into the report. But thats not what former employees of tiktok say. Today the Washington Post is reporting that tiktoks chinese Parent Company imposed strict rules on what could appear on the app, in keeping with chinas restrictive view of acceptable speech. Former employees said Company Officials based in beijing had the final call on whether flagged videos were approved. The former employee said their attempts to persuade chinese teams not to block or penalize certain videos were routinely ignored. Out of caution, about the Chinese Governments restrictions. One former bite dance manager, thats tiktoks Parent Company, said this. They want to be a global company, tiktok, and numbers wise, theyve had that success, but the purse is still in china. The money always comes from there, and the decisions all come from there. Thats sure a different story than the one tiktok has told this committee in this letter. And thats a problem. Tiktok should answer for these discrepancies. They should answer to the millions of americans who use their product with no idea of its risks. They should have been here today, but after this letter to this committee, they must now appear, under oath, to tell the truth about their company and its ambitions and what theyre doing with our data. The threat isnt just to childrens privacy. Its a threat to our National Security. We dont know what china can do with this kind of social data in aggregate, what it tells china about our society. They can see who we talk to, what we talk about, where we congregate, what we capture on video. Not all of tiktoks users are just kids. Some work in government or for the military. Others are celebrities or work for Major American Companies in positions of influence. What does it mean for china to have a window into such users social live . Why would we leave that window open . The other empty chair belongs to a company that has helped open chinas window on american consumers, apple. Were accustomed in hearings like this one to hearing about apple as a good corporate citizen. It encrypts its messages. It limits its own Data Collection from users and gives them privacy controls. But apples Business Model and Business Practices are increasingly entangled with china, a fact they would rather we not think too much about. China is essential to apples bottom line, both on the supply and the demand sides of their business. Apples investments in chinese production have helped build the scientific and manufacturing capacity of americas greatest geopolitical rival. But chinese demand is even more critical. To service that demand, apple is risking compromise with authoritarianism. The company hosts its chinese users icloud data in china as part of a joint venture with a Chinese Governmentcontrolled entity, gcbd. Apple frequently talks about encryption, but where are those Encryption Keys for the data stored . China. Apple says it has control of those keys, but who knows what that means. And apple isnt here to tell us. If youve got family in china or business contacts there, you cannot count on i message encryption to keep your interaction secure from chinese authorities. If youre a uighur or chinese dissident or a protester in hong kong, apples corporate values wont do much to protect you. In the midst of the hong kong democracy protests, now in their 22nd week, apple pulled an app from its store that helped protesters and citizens stay safe during Violent Police crackdowns. Why . Because beijing pushed for it. Just a few days later, tim cook was appointed to chair the board of a chinese universitys school. If youre an american user of an ios you cant be confident that the Chinese Government isnt reverse engineering the platform through their Privileged Access to it via their joint venture with apple. With apple and tiktok, we see two sides of the same coin when it comes to Data Security, the danger of chinese tech platforms entry into the u. S. Market, and the danger of american operations in china. Thats one of the most important subjects we can discuss at todays hearing. How does the tech industrys entanglement with china imperil our Data Security . I look forward to the witnesses testimony. Thank you for being here. Now senator whitehouse. Thank you, chairman. I welcome all of the witnesses who are here. I have a fairly long history with this issue in the senate, and i can remember when the senate had pretty much close to zero interest in privacy and da data so long as the data was held in private sector hands. We would get quite animated about any data that our National Security apparatus might have access to, when by contrast, private platforms had more data on americans than the most intrusive governments in the history of humankind and we paid virtually no attention to it. Im delighted that wall has come down and that we now see the risks from the huge aggregations of private data in private hands as significant. So im delighted this is a topic. Ive also been involved in a lot of the efforts for cyber legislation. At one point, we made a lot of progress on a bipartisan bill focusing on critical infrastructure. My republican coordinates were senator kyle, senator mccain, who was then chairman on armed services. So it was a pretty highlevel operation. We made a lot of progress. We had a considerable number of conversations in the skiff where there wasnt a whole lot of news and noise to be made. A lot of good hearts with people from the private sector and from our defense and intelligence agencies. And when push finally came to shove, the republican leader went to the floor and said no cyber bill is coming without repeal obamacare attached to it. So that ended that effort. Then along with chairman mccaul, i was the cochair of the csis report for the incoming president , which is a very helpful and thoughtful bipartisan cyber analysis. And when President Trump came in, i looked at tom bossert, who i think is a very wellversed, honorable professional in the cyberspace, great technician, and i looked at an attorney general who had come out of the senate and a dni who had come out of the senate. I thought, great, we got a great opportunity here between the substantive knowledge of bossert and Political Savvy in the senate of sessions and coats to get a real bill going. And of course, as you know, all of that has fallen apart. None of them work for the administration any longer, and i honestly couldnt tell you who i should go talk to in the administration about cyber legislation, so low is their apparent level of interest. So i hope that were finally in a good space to start doing some real work here. I have remarks that id like unanimous consent to put into the record. I want to make a procedural point here. In the committees, particularly the judiciary committee, we ordinarily operate one of two ways. We either say this is going to be a bipartisan hearing and Work Together and agree on all the witnesses. Its a consensus panel. And the shape of the hearing is agreed to beforehand. Or you dont go that way and do a partisan way and theres a kind of informal rule that, you know, one side gets so many witnesses, the other side gets the opposite. The minority doesnt think its views are being fairly expressed by the majority witnesses. They can call witnesses of their own, and you get a divided panel, but theyre often interesting. This is a bit of a hybrid. Until last week, we had bipartisan agreement on two panels. All of that changed rather rapidly. Im not going to get too excited about all of this because the chairman has expressed an interest in trying to make sure that the administration witnesses, who we had scheduled, will be rescheduled. I hope that is true. And the panel that actually is here is a panel that was agreed to in bipartisan fashion, but i do believe if were going to be doing these bipartisan hearings, then we should see that through all the way through the hearing and not follow the bipartisan path down until the week before and then change to having sudden, unexpected changes made. So i just want to flag that, mr. Chairman. Because i think you and i have done good work and good hearings before. I want to make sure that our ground rules as chair and Ranking Member for these hearings are clear with each other. Im delighted to go forward with this hearing. I appreciate where ayour leader this area. I just want to be very cautious about the hybrid. Were a bipartisan hearing until at the last minute were not way of doing business. Thank you. Thank you, senator whitehouse. Thank you for your long work on this issue. The senator is alluding to the common goal we both share, which is to have Government Administration officials come and testify to this committee. That is a goal that i share and that i look forward to doing with senator whitehouse. We hope for their full cooperation. Now let me turn to introduce the witnesses. Mr. Tom bird is corporate Vice President of Customer Security and trust at microsoft. There he leads engineers, lawyers, policy advocates, project managers, business professionals, data analysts, and cyber crime investigators. Mr. Burt joined microsoft in 1995 and has held several leadership roles in the corporate, external, and Legal Affairs drpt. Mr. Will carter is Deputy Director of the policy program for strategic and international studies. His research focuses on cyber and technology policies, including Artificial Intelligence, surveillance and privacy, data localization, cyber conflict and deterrence, Financial Sector cybersecurity, and Law Enforcement and technology, including encryption. Ms. Carrie fredrik is a fellow at the National Security program for the center for new american security, cnas. Before joining cnas, she helped create and lead facebooks Global Security counterterrorism analysis program. She was also the team lead for facebook headquarters regional intelligence team. Prior to facebook, she served as a Senior Intelligence analyst for a u. S. Naval special warfare command and spent six years as a counterterrorism analyst at the department of defense. As heritages first senior fellow for technology, National Security, and science policy, his research focuses on the intersection of technology and National Security with particular interest in Artificial Intelligence, autonomous weapon systems, space, and intelligence issues. Prior to joining heritage, mr. Kitchen was National Security adviser to senator ben sass. Thank you all for being here. In keeping with the tradition of the committee,ly swear you in. If you would rise and raise your right arm, hand. If youd repeat after me. Do you swear or affirm the testimony youre about to give the committee is the truth, the whole truth, and nothing but the truth so help you god . Thank you. All right. Now well hear your Opening Statements. Mr. Burt, well start with you. Chairman holly, Ranking Member whitehouse, and members of the committee, thank you for the opportunity to testify today. In my comments, ill focus on the work that microsoft does to combat criminal and nation state cyber attacks. Ill discuss why government and the private sector must Work Together in new ways to combat these attacks. The frequency and success of cyber crime exploits continues to grow. Its estimated that the Global Financial impact last year was a trillion dollars, and nation state attacks continue to increase in number, sophistication, and impact. For more than a decade, microsoft has fought back. But weve learned we best protect our customers when we work collaboratively with government and others in the private sector. Government has Law Enforcement and intelligence resources that the private sector cannot match. But the private sector has access to data and technological resources that governments cannot match. So we must work collaboratively to finds innovative solutions. Today microsofts digital crimes unit, truly unique in the private sector, combats business email compromised crime and continues to lead the world in our efforts to shutdown criminal bot nets. Working closely with Law Enforcement and private sector partners, weve now taken down 17 bot nets, rescuing close to 500 million devices from these criminal networks. Law enforcement faces unique challenges in combatting these borderless crimes. Thats why we were strong supporters of the cloud act, which modernized how crossborder data can be accessed appropriately by Law Enforcement. We applaud the agreement recently announced between the United States and the United Kingdom implementing the cloud act, and we encourage the department of justice to continue their efforts to negotiate and conclude additional cloud act agreements. Despite our past success, we have not seen Law Enforcement partner with us on recent bot net takedowns. Were concerned that the reward in recognition structures in our Law Enforcement agencies do not today provide the incentives to devote more and stronger resources to activities that protect victims but do not yield in arrests and convictions. We Hope Congress will provide new incentives for Law Enforcement to prioritize the disruption and dismantling of criminal networks. In addition, we see increasing nation state attacks causing significant harm to citizens and enterprises around the world. Weve used the bot net disruption techniques that we pioneers to disrupt these nation state malign actors who are intent on destroying democracy. Weve disrupted groups operating from russia, china, iran, and north korea. And we will continue to do this important work. Disruption is important, but so is improving cybersecurity hygiene. Unpatched systems are exploited by our adversaries, so we strongly promote the prompt installation of security updates. We advocate for use of multifactor authentication, and we develop cutting edge Ai Security Services like microsoft defender atp and azure sentinel. We can combat and we can defend, but we also need to reduce how many attacks are launched against our civilians and enterprises. Longterm solutions for protecting cyberspace require clear and Binding International commitments that define acceptable online nation state behavior. This problem cannot be solved by governments or the private sector acting alone. Multistake holder solutions are essential to combat what is necessarily a multistakeholder problem. Thats why last year microsoft was proud to join in supporting the paris call for supporting the paris call for trust and security in cyberspace, a voluntary commitment to nine foundational cybersecurity principles, including protecting from cyberattack critical infrastructure, elections, the public core of the internet and intellectual property. The paris call has been endorsed by more than 65 governments and over 500 enterprises and organizations. Unfortunately, the United States has not yet endorsed the paris call. For the sake of the security of american citizens those around the world endangered by escalating and sophisticated attacks online microsoft continuing to encourage the United States to join this landmark multistakeholder commitment. The private sector and government must Work Together to invent 21st Century Solutions to these uniquely 21st century threats. Microsoft stands ready to do our part. Thank you and i look forward to your questions. Thank you, mr. Burt. Mr. Carter. Chairman hauly. Thank you for the opportunity to participate in this hearing on this important topics. Threats to frieft and Sensitive Data remain one of the most important risks. Companies collecting and using data face growing threats from malicious cyberactors and restrictive government policies. The lack of u. S. Leadership on global issues of cybersecurity, Data Governance and digital Law Enforcement has put companies in a difficult position. Between the need to secure data against lawful and unlawful abuse and need for access hollywood. Dangerous are growing fast. Its kboengs as more lives move on connected devices pro liver eight creating new vulnerabilities. Offenser cybercapabilities are a musthave in the arsenal of even small governments and a tliefgt gray market in offensive cybercapabilities has grown up to feed the need. Both obama and Trump Administration haves a lack of resolve to enforce consequences on nation states violating norms of behavior and initiate cyberattacks. Cybercrime has become epidemic. Cis estimated in 2018 that the cybercrime cost 600 billion. 1 of gdp. Up 35 frers process somehow 2014 appear and malicious activity is largely consequence free. Only 0. 3 of reported cyberattacks in the United States result in arrest and cybercrime is massively underreported crime. Cyberattacks are one of many threats to private and Sensitive Data. In many ways the more troublesome challenge tor u. S. Companies is growth of lawful exploitition a of data and technology by governments. Countries wish to enforce laws and protect citizens as they define the goals and expect companies doing business in the countries to enable them to do so. But problems arise for companies when countries lack appropriate governance mechanism to prevent abuse of the data. When cultural differences between li lead the clashes between the platform and the global populations they serve appear when governments intentionally utilize commercially available text willtology for malicious repressing. U. S. Companies and u. S. Government have developed a raenl of technologies and policies to combat the challenges. Companies utilize Technical Solutions to render data inaccess hollywoodable to kwo government processes. The u. S. Government has protected data through the Electronic Communications privacy act. Preventing disclosure of data to Foreign Governments unless that government submits a mutual Legal Assistance request through the u. S. Government. But this approach has significant costs op tradeoffs. Implementing Technical Solutions preventing companies from disclosing at a time dart to governs to prevent abuse is great except it prevents company from providing data that could the prevent sr. Crimes and terrorism. The rollout of end to end encryption on facebook merge messenger will will render many tools to combat child pornography on messenger ineffective requiring new strategies. And policies like data localization backup encryption mandates and Data Retention Requirements Companies pursue to preserve akds to dat can lead to worse outcomes for everyone. When governments cant access through lawful means many turn to cyberattacks to fill the gaps. The u. S. Motivate must play a role in tracing threats to Data Security unlawful and lawful around the world. As senator whousz mentioned in 2015 he chaired a cyberpolicy task force for the 45th president is strengthen security. Its recommendations remain relevant today. Inenincentivizing and cyberhygiene increasing penalties and liability for Companies Fail to protect data or sell insecure products and addressing resource gaps tlor fundamental reaches and development can advance cybercurate apprehend the world. Creating serious consequences for malicious actor is essential. We must empower Law Enforcement to effectively combat cybercrime, and we must demonstrate the political there to consistently engage penalties on nation whites with cybercrime. Even when it puts a strain on economic recommendations. The u. S. Government muftd take the lead in developing a functional framework for the world. Last year we produced a report called low hanging fruit Evidence Based Solutions to digital challenge which outlining a serious of recommendations to streamline cooperation between companies and governments. And facility lawful appear appropriate access the data. In appropriate circumstances and with appropriate safeguards can reduce the pressure to enkrpgs mandates, data res tension requirement and government hacking and put the spotlight on companies that intentionally exploit data to monitor marginalize and oppress citizens. I thank you for the opportunity to testify and look forward to questions. Thank you, mr. Carter. Ms. Fredrick. Chairman hawley. Ranking member whitehouse there we go. Distinguished members of the subcommittee thank you for the opportunity to testify today. I am here because the growing contest between free open societies and closed repressive regimes is playing out on the digital frant and our data will make all the difference. When i worked at big five tech firm in the Silicon Valley the saying went we can do more in one day than others in a we can. Much of the outized impact was the result of the volume and variety of data at our finger tips and what we could do with it. My experience with digital and o intelligence collection and analysis as a member of the u. S. Intelligence community similarly impressed upon me the great advantage of Data Security but also what can happen when data vur vulnerabilities are exploited. Many talented emwork in america to get it right and its imperative we do so. The context of our work is before us. Technology is being repurposed abroad to undercut the original liberalizing potential. The Chinese Government uses Digital Systems to enable pervasive surveillance and exacerbate gross human rights abuses by targeting and uyghurs in china. The consequences of the abuses do not stop in mainland china. Beyond the borders countries are adopting Chinese Technology to strengthen their own brendon of technical ill liberalism. Further authoritiarian regimes attack democracy z. Russia is invigorating campaign of cyberhacks against the United States and europe. Iran is following suit. North koreas efforts have not yet abated. And even as these accurate tactics spread around the globe the technology is evolving. Enable even more sophisticated assaults. Synthetic media, realist iks b. O. T. S machine language models with a potential to generate false information at scale and automated spearfishing are a foretaste of the difficult challenges to come. Yet the United States system of checks and balances is a the bullwork against the perversity of the technology in the our borders. Our system offers institutions and practices to act as guard rails on our internal use of technologies but relying on this system is it no longer enough. Americans are confronting deep Systemic Risk when using platforms operating in and owned by companies in countries with a history of cyberespionage and forced tech transfer. Private Chinese Technology companies aability to resist government is highly circumcircumcise described at best due no part to aers soo of National Laws and standards nar broadly written and ultimately compel the Companies Like tiktok parent bite dance to compete for data. Russia has a data requirement and a sla similar snor isically to reply play out in other regimes. Further we should combine massive the data sets for populations around the globe. China has a precedent of synchronizing biometric appear bafrm data for plilkt political and social control. The integrated joint Operations Platform and much discussed social Credit System are evidence of this. Mcis also exporting values emobeyed are bedded in technology itself to the world. The its unclear whether ticket, inc, ic tint continueses the censership after updating the Privacy Policy in february of 2019. Still, instead of importing the values of case censership to the u. S. Weshtd export ourvilles of openness and transparency to them. This is all occurring against the back drop of a digital environment growing more complex. For instance, technical signatures are becoming less conclusive when it becomes to attributesition using as we saw when russia high shaujd a iranian espionage operation last month. Making it more difficult to combat attacks against our systems and respond accordingly. Solutions are overdue. If democratic societies do not establish the rules of road for Data Security and private briefcy protections authoritiarians will do it for us. Congress should mandate inner agency import reviewsen of Tv Technology against a criteria encompassing the likelihood of Systemic Risk. The lawmakers should enshrine Data Protection are especially for biometric data and incentivize transparency within the government and private sector. Processor for private companies play a critical role. The sustained and unfuterred access to high volume and variety of data gives them inordinate control. American Tech Companies should adopt a set of rules norms and Guiding Principles for the use of technology globally and for interviewsing with authoritiarian regimes that will not tip the scale in favor of repressing. American private companies should treat u. S. National security as their own strategic the imperative. Thank you i look forward to the questions. Thank you ms. Fredrick. Mr. Kitchen. Thank you for the tune to testify before you. When i was in the United States Intelligence Community, our mission was to collect, understand, to predict and to shape Human Behavior and events. Those in government call this intelligence. Technology Companies Call this market research. Data analysis. Audience segmentation or service provisioning. But in reality in the age of the socalled knowledge economy were all in the intelligence business now. The proliferation of sensors, the deluge of digital data and exponential growth in computation alcapacity bitcoin to previously unmadalynn possibility for human thriving and happiness with you but the positive outcomes are not the only thing being created. General cybersecurity risks are now combine withing increasingly aggressive hostile foreign actors to create an iermt voo few understand and that even fewer are prepared for. China is a central concern in this regard. For decades countries like china and russia have pursued a deliberate strategy of using Foreign Policy and intelligence communities to copy and to steal american technologies. These strategies are starting to produce meaningful results with several foreign Tech Companies now legitimately rivally u. S. Tech leaders in both innovation and market capitalization. If left unaddressed, this could pose a challenge not only to our Economic Security but also our greater National Security. In january, 2020, for example, a new chinese cybersecurity law will go into effect and Companies Operating in the company will have no place left to hide. The new law is part of beijings yearslong effort to expand domestic surveillance programs and rooted in a massive cybersecurity overhaul adopted in 2016. Next year all companies, including foreignowned companies, must arrange and manage their Computer Networks so that the Chinese Government has access to every bit and byte of data that is stored on, transits over or in any other way touches chinese information infrastructure. Put simply, the Chinese Government will have lawful and technical access to all digital data within its borders and perhaps to large value volumes of data beyond the borders. Companies have long known their intellectual property or i. P. , trade secretsen and Even Communications are highly sought by market competitors in asia and by the Chinese Government particularly. Many of these risks are simply accepted as the price of doing business in china. And those risks deemed unacceptable are mitigated by Security Technologies and networking strategies that attempt to hide critical information from prying eyes. All of these technologies and strategies under the new law will be illegal. For example, it is current commonplace for Companies Operating in china to set up Virtual Private Networks or vpn on which the data is stored and swent encrypted pipe that outsider cant krk or intercept. The vpns and underlying incontraception to the degree preventing access by the Chinese Government will no longer be allowed. There will be no truly private or encrypted messaging in china. No confidential data, no trade secrets, no exemptions. If a Company Operates in china it will be required to operate in such a which as to provide the countrys intelligence and Law Enforcement authorities unfettered digital access. The days of paying the i. P. Tax for access to the worlds Fastest Growing market are over. This access will now cost you everything and the precisely the chinese plan. To put it simply, our longterm economic and National Security must account for and rollback a sustained campaign of cyberenabled economic warfare, the likes of which will take a giant leap forward in just two months. I have provided amplifying information in had my submitted testimony and happy to answer your questions to the best of my abilities thank you. Thank you, mr. Kitchen and thanks to all of the witnesses. Id like to start with tiktok if we could and what theyre doing with all of the data that they are collecting from american users. For one thing i want to get ton the record that tiktok is collecting a lot of data. Its terms of service im quoting now. That it collects contact details, content you create, and your location, it collects still quoting from third party social Network Providers and technical and behavioral information about your use of the platform. And it collects information contained in the messages you send through the tiktok platform. Opinion and information from your phone book. Thats a lot of data. Pretty comparable to what the massive data harvesting machines like facebook and google are scooping up. Now, tiktok says that they store american user data either here or in singapore, not in china but miss fredrick let me address this question to you. The fact that they allegedly store the data here or in singapore that doesnt necessarily mean that beijing cant get to it. Is that right . So i think the greater question as it is the fact that the laws that apply to the Parent Company byte dance. That is essentially the. Problem. There is a parallel app in china which tiktok ever since the cfius investigation came to light has potentially made moves to extricate their dealings with what goes on in china and to do so explicitly. The doen app in china is basically like the parallel version of tiktok but existing in china. They have attempted to shield themselves by saying hey everything that people use on tiktok is u. S. Or western friendly nationbased and stored in the u. S. That kind of thing. But byte dance, the 2007 acquisition of music cli is being vepgted in cfius right now. Thats the problem thats something we need to think about, the law that klon discussed would apply to tiktoks Parent Company byte dance in china. Byte dance just so the facts are clare, the byte dance is the Parent Company of tiktok, located in china. Its a chinesebased companies. They are subject to the laws mr. Kitchen you were talking about in including the 2017 National Intelligence law which requires chinese resisting ohs and companies to cooperate with state intelligence work. Thats the designation in the law. Is that right, mr. Kitchen in. Thats right correct, zblier as a chinese parent the kparnt company its completely reasonable to assume that any individuals information including the information of american users on the service can be harvested and exploited. And just one other point, techically this must be true. A lot of the development of the application is done in china still. Even if it has an american kind of Front Company or operating company. And so they have to be able to push updates from chiebz development into the u. S. Market if they want to have an updated increasingly capable technology. And so the idea that they can meaningfully technically kind of warden off this information from china doesnt make sense operationally. I think an important point. Much of the app is developed and the content much of whats used in the app is developed in china pushed to users here in the United States. The Parent Company is a chinabased company. They are subject to these restrictions or frankly subject to having the doors opened at any time by the Chinas Communist Party under chinas law. As alex stamos puts in the Washington Post article, the leverage of the government, meaning the Chinese Government it has over the people who has access to the data, thats whaels relevant. Do you agree with that, mr. Kitchen . In other words the ability of beijing to go to byte dance, the Parent Company and say you are required under chinese law to give us access to all that data. Means byte dance could scoop up american users data and make that available to beijing. Is that fair to say. Thats without a doubt true. Let me talk talk about some of the way that is ticket be or other companies could abuse this kind of data. Mr. Kitchen am i right in thinking that autonomous Weapons Systems rely on Artificial Intelligence rely on weapons system release on that dat. Yes. If if he obtains data on the service men or women or the opm attack could that have relevance how they train the autonomous weapons. Absolutely. One of the criticisms of some of the Image Recognition that china is developed up to this point is that it was sino centric. Not able to operate in western environments as they might. This would be a way of addressing that delinquent zbli because of the sheer amount of data and frankly imagery they get of western users. That is that what you are saying mr. Kitchen. Yes, sir. This will be the final question for you. How can we ensure tiktok or other Chinese Company arent troenlen horses gathering data on americans and sending the information to china to be gathered and collected and used for beijing government purposes . Youre asking me how we can assure that . Im not sure we can. The law that i described simply requires access. And anyone who thinks that a Chinese Company even if they have an american portion of the company can look at the government in beijing and tell them no, thats a fundamental misunderstanding of how the government in beijing works. Thank you very much. Senator whitehouse. Thank you, chairman. One of the things that ive been pushing for is for kind of a stress test of the framework to see how good it is at actually performing its assigned task of providing critical z cybercurate im reading a survey by the 1,500 Business Leaders by microsoft and mar be found only 37 of firms believe that soft industry the the industries believe that thement 19 of firms had had no confidence that they could prevent cyberthreats and 13 had no confidence that this they could respond to cybernurts. Mr. Burt is it time to stress test the nst network. Two things about that survey performed with microsoft and mash be. One of the things which we think is a positive development between 2017 when we did the first time and then the recent survey we have sienna the number of people these enterprises that were surveyed that are aware of the risks that they face and the need to take steps has increase the significantly. And thats a good thing. But it is not enough. More needs to be done absolutely. The nst framework. We were we were one of the contribute toes the nsht framework. We believe its actually a very useful framework for. Beats having nothing before. And companies should be assessing cybersecurity maturity. We do. Its one of the things we regularly assess cybersuitor security the maturity as a company are relative to the framework. I know from discussions around the industry . General increasingly companies are aadopting and use going. Thank you. I would say one thing important. Be quick because my time is short. Its very complex. The nst framework is complected if you dont have a big i. T. Staff it can be hard to implement. Thats correct. Thats which why we belt in industry with other simply simpler tools for small appear medium size businesses to apply a simpler version of the nsp framework but we immediate are attention more attention tad. Mr. Are the canner between the desire of the private sector and not to suffer reputational harm when hit by a cyberattack and the overclassification that the federal government indulges in how complete do you think the picture is that the American Public gets to the extent which you which our companies and country are under cyberattack. I think the picture is very incomplete. Partly because there are a lot of disincentives to accurate reporting by companies partly because there are no clear mechanism for consolidation of the reporting. Partly because many types of attacks arent obvious to victims and partly because in many cases the information that is shared is anon myselfed to the point that its largely useless in understanding the threat environment we face. Back to you, mr. Burt. You guys were the leaders in botnet takedowns. I was fighting to get the department of justice to do more on botnet back then when your first complaint was filed. I was telling chairman hawley the were both recovering lawyers what a joy it was to read that complaint, a because it existed and b because when you got to count, i dont know 6 or Something Like that there was a count of trespass to chattels, which is a doctrine from the medieval English Common law that i probably slept through in my foundations of property law class. But clearly microsoft has been a leader in fighting botnets a long time. What more could the department of justice be doing now to continue the process of constant weed cutting that needs to take place to strip first, is there any good use for a botnet . Or is it a weed . And second what more should we do to weed whack them . Almost all botnets are needs, senator whitehouse. There are some for researches and purposes and others. But those can be identified. In our view almost all botnets meeting that standard are weeds and need eradicated. There is two things we would like to do with the department of justice and Law Enforcement to improve this area. One is we need more strategic coordination. When i meet with leaders across Law Enforcement in the Intelligence Community, d. H. S. Here we talk about Public Private partnership but we arent doing enough to realize that. And this is an area where we are committed and we no that if we could meet strategically to identify are what are the key botnets, the most impactful and serious ones, how can we join together and in collaborative way do something about that . That would be step done. A botnet in a nutful is a force multiplier for some doer. An evil doing who managed to infect thousands or millions of computers with their malware. And can deploy those computers. And they can toward are coordinate cybercrime across all computers without the victims even knowing that their computers have been infected. And the second thing we need is for the department of justice and fbi to have the right incentives and the right priorities paid to reducing botnets to attack botnets, even dsh even when they cant necessarily get handcuffs on the perpetrators because they are living in countries with no extradition or the other challenges that we face in this space. Just disrupting the botnet alone and stopping those criminal enterprises is in itself an important thing to do. And finally if i may go a moment. Yes you may. Ive been argue rg for quite some time that we should pursue a coalition of the willing to create International Cybersecurity norms. I think the Obama Administration made a mistake trying to bring the russians and chinese into a productive discussion on this subject. Its a little bit like trying to bring a couple of burglars into a productive discussion on home security. Forget them. I would consider that it would be wise for us to as a nation try to set norms with countries that share our values in a secure and safe internet. And to that end im wondering if you believe that the cybercurate tech accord that the private sectored entered into and the the the private sector peace eliminated that need or whether this is a pursuit government should engage in. Its absolutely a pursuit government should ij naj in the psychiatric curate tech accord is a group that microsoft initialingly set up but now we have over 120 companies from around the globe who Work Together to endorse key principles of cybersecurity for customers but also to articulate the view of the Tech Community on key issues about cybersecurity policy and appropriate norms. The cyberpiece institute is a newly established nonprofit to be based in again eve iaaf going to do work not happening in elsewhere in the government or private sector to bring transparency to the impact and of nation state cyberattacks. The harm, human harpt harm that the nation state hiesh sooish attacks cause and the work to increase resiliency around the world to let attacks those are both important. But what you said is absolutely right. The unts must join with like minded countries to establish norms of behavior. If we can isolate the countries refusing to abide by the rules so much the better. At least we have that isolation clear. But we need the United States to play a stronger diplomatic role. There is two pending United Nations efforts under which. One initially respondered by the United States but one by russia. Theyre working side by side to try to establish norms of conduct for cyberspace. And we are working on both of those processes to try to ensure that they are productive and result in useful outcomes. But those are both areas we need the United States to be actively engaged in pushing for the norms. Maybe even with International Sanctions to back up the norms. Mr. Chairman, thank you for letting me go on beyond my time this is a good hearing. Absolutely. I have just a few more questions. Mr. Kitchen, let me come back. I have become increasesingly concerned about the willingness of some American Companies now talking about tiktok chinese based companies but American Companies to store data and the tools necessary to read that data in chf. And i want to think about apple for a second providing Cloud Services in china. For a long time apple stored encontraception skis in the United States but beginning last carrier it moved its incontraception keys to china for the data stored there. Let me ask you what i think are simple question Encryption Keys are what you need to read things like protected emails and text messages. Is that right . Thats correct. So if you have the Encryption Keys you can read private communications stored in the cloud. Is that have i got that right. Thats correct. No routers wrote that aloft because any moved to mc. Chinese authorities have far eastier access to text messages, email and other data stored in the cloud. Do you agree with that . And can you talk to us about the implication sns. Yes, i think the short answer is i do agree with that. There is a distinction to be made. The apple the action apple took was it moved the encontraception keys associatewood chinese users of the icloud capabilities. Its not all use are. Its chinese and thats in kpliengs with the chinese law as you mentioned senator of data localization. That being satisfied in your Opening Statement you raise add good point that by having the unfettered access or the significant access that they likely joy they will gain greater insight into the inner working of apples i clouds accounts and the broader Technological Capabilities which could allow them to do more in terms of collecting outside of the borders. Thats a very real concern. Thank you for that. Let me ask you about this. How does chinese access to enkremgs keys for data stored in the usebers how do does that affect an american sending a email or messages to those in china. It can be captured. In other words, it it could potentially the fact that the keys are stored in china could put the whole communications string at issue, right, if you have an american again here sending information to friends, fireman members, Business Associates what have you, that whole i messages alone the fact that its encrepted nobody can get to it thats not true since the encryption see are skis are stored in china for mcuser data am i correct about that. If there is know chinese node within the lup it compromiseding the sbar new york. You alluded to in your last testimony. Would you trust any Sensitive Data stored in china . In other words would it concern you if your location data was stored in china or email data . As a member of the intelligence kmupt after the opm pac i assume they have much much my dat data. I dont like that. No i dont think thats okay. I think any person has to make a recognition that is likely the case. And the real change now is that these governments and the Technological Capabilities themselves are becoming sufficiently big to where thats a real problem. Unup until this point its theoretically. Now we are developing the computation alcapability to exploit this information appear in ways meaningful to both the chinese and u. S. Citizens. Would you say that apple and Companies Like them are compromising american interests in Data Security by storing both the daft itself in country in china as well as the Encryption Keys in. So if i might ill make two points. Any company complying with chinas cybercurate laws are making stigss affecting more than their bottom line. These decisions are now risking our own National Security. China imprisoned and tortures and kills religious minorities and political disdents and using Compliant Companies to do this at scale. Now operating according to the laws of a country where you do business is only rational to the agree are dree degrees that the laws are just. S lets rememberpeople are plenty were is it of people were following the law in nazi germany and does not excuse them from the consequences of actions. Im really struck by what you just said that beijing is using Compliant Companies to carry out repressing at scale. That is that i think really sums it up. Anything further, more senator whitehouse. If i may ask two questions. First, mr. Kitchen you mentioned the opm hack. I think the opm hack is very significant appear highly relevant to the hearing. For the sake of the hearing record could you give a minute on what the opm hearing hack the opm hack was and what it discovered about you and other government workers. And who did it. So im going to discuss this as it was reported in the news. Correct. It was publicly reported in the news and has been identified that the chinese were responsible for infiltrating and exploiting a number of data bases that were held by the office of personnel management, the federal governments hr organization. And they were able to among other things exfill trait whats called the sf 86 form, which is people who worked in the Intelligence Community and government we fill out a 100 page report giving you everything about ourselves. They got fingerprints and a whole host of other things. This information its hard to scope just how that information con couldnt be used in terms of if you thought it about it as a counterinterrelation is intelligence threat you could look at individuals who had been processed with the sf 86, how they had been allowed to enter into the Intelligence Community and if it was your objective to place, you know, a spy within that community, well you would have the ability to determine what is the perfect legend for that person how do we opt myself them to get in with as little difficulty as possible. You now have that information. If you wanted to simply build a profile on the types of people in that community, you could do that. Now, there was some original we made ourselves feel better bay by saying certain agencies werent vochd in that information. But the absence you can use that discover who they were by exclusion. If youre under a state Department Cover operating overseas but not in that database, guess what with, they know who you are. Sthees are just some of the obvious things. But the broader problem is that this this is going to a broughter strategy the cheyennes chinese are operating called the thousand grains of sand strategy building a mosaic of insight and awareness that is a straesk National Security concern we havent dealt with. Miss fredrick if an American Company has access to enormous amounts of personal data of an american, google oh or facebook and trying to monetize that, what are the constraints on them doing business with either a Foreign Company that fronts for the government or even a Foreign Government directly and selling as they would to any other customer the information that they offer or the service of providing information that they are offer . Because sometimes they dont tell the customer the information. They just say trust us well do it and hit all the people that you want to hit. What are the restraints on an American Corporation doing that with a Foreign Government or with a front corporation for a Foreign Government . So the problem here the restraints are deficient. There is not enough transparency. We dont have grant lart into what the American Companies are necessarily collecting. And i alluded early on to the bullwork that prevents abuse, the system we have in place thats critical to make sure that this data by americans isnt supplied ptd facial recognition is a huge huge topic in the area. The problem is we havent figured it out yet. Thats what i mean by the rules of the road havent been set. The u. S. Government doesnt really have that much transparency into the behavioral data, the biometric content. Everything that even American Companies are sucking up. That is a problem. I think we basically need to Work Together, public, private partnerships are critical in this way and we need to draft or help you all draft legislation that puts the proper constraints on this. That basically says data matters, that there should be value for your data that is propagated throughout the american populous. I think we need to do better in that regard. Mr. Chairman, i think willful blindness seems to be a theme among our platforms. They dont want to ask the questions because any dont want to hear the answers. When facebook is doing something as obvious as selling political advertisements and accepts payment in rubles, youd think that somewhere in the geniuss apparatus somebody might have thought hmm im semg political ads in my home country and the payment is denominated in rubles. What might that mean . But they didnt care to look. Didnt try to look. Didnt want to look. They wanted to cash the rubles and move on. When they improved the genius strategy in private to prevent foreign interference in elections any went all the way to making you create a Shell Corporation. But facebook dont even require that the Shell Corporation thats buying the political advertisement disclose who is really behind it. So if you were to set up boris and natasha llc as a phoney delaware Shell Corporation. Facebook would happily sell you political advertising time, even though it would be obvious a ordinary person that something is up. And this business was as miss prerkd saids to that the willfuled blindness is not a Security Model anwar the United States of the United States is at risk. Is workings worth our thank you for all the witnesses for being here. Well stand adjourned. On wednesday, President Trump holds a Campaign Rally in monroe, louisiana. Watch live at 8 00 p. M. Eastern on cspan. Online at cspan. Org or listen live with the free cspan radio app. Next, a panel on the roll of Energy Policy and Climate Change in the 2020 president ial campaign. Among the speakers were former obama Administration Officials along with representatives from several Energy Advocacy organizations. From the tlanic council, this is an hour and 20 minutes. From the atlantic council. Afternoon, everyone. My name is randy bell, the director of the Global Energy center here at the atlantic council. Thank you for joining us today for this discussion, assessing democratic