WHO’S IN CHARGE?
Kenneth C. Watson
President, Partnership for Critical Infrastructure Security
Committee on Governmental Affairs
October 4, 2001
Good morning Chairman Lieberman, Senator Thompson, and
distinguished Committee Members.
I am honored to be here today on behalf of the more than 70
companies and organizations that comprise the Partnership for
Critical Infrastructure Security, or PCIS.
The question you are asking, “Critical infrastructure
in charge?” appears aimed at discovering leadership. America would like to be able to turn to a single government
executive or agency, and perhaps one industry belly button, with
the authority and responsibility to assure the continued delivery
of vital services to our citizens in the face of new and emerging
threats. What you will actually discover is an architecture that
requires distributed leadership, cooperation, and partnership
to accomplish that goal.
The need to coordinate and manage the assurance of our nation’s
critical infrastructures is not something industry and government
just started considering since September 11.
The members of the Partnership and our government
counterparts have been working on this since 1999, and some
industries, such as the telecommunications sector, have had formal
working relationships with government agencies dating from the
early 1980s. I’d
like to describe for you the environment of the critical
infrastructures, explain what we were doing before the horrendous
attacks three weeks ago, and what has changed since then.
I’ll also have recommendations for the Congress and the
Over the last 10 to 20 years, the United States, and the rest
of the developed world, have truly changed the way we live and
work, and there is no turning the clock back.
Each industry is now dependent on every other, and we are
all dependent on computer networks.
The Federal Government cannot function without services
provided by private-sector infrastructure owners and operators.
Many of these are multinational corporations, and all have
an interlaced network of suppliers, partners, and customers.
The Internet itself relies on key nameservers and routers
located around the world, with no central ownership or authority.
The health of the global economy is directly relevant to
the health of America’s national and economic security.
Just as the Internet is open, borderless, international, and
unregulated, responsibility for protecting critical
infrastructures is distributed among companies and government
of control is actually safer than centralization, and builds
resilience into the architecture.
Form follows function.
This applies not only to architecture, but also to how we
organize to protect our critical infrastructures.
Even with the best of intentions and the most modern tools, the
Defense Department could not defend America against a cyber attack
on a power plant in Omaha, that happens
to provide power to a major railroad hub’s switching
infrastructure protection requires a true public-private
partnership, with all the trust that implies, to succeed.
Activities that an enterprise can take—conducting
vulnerability and risk assessments, deploying security
technologies, investing in research and development, creating
incident response teams— must now be distributed and
coordinated. Many in
industry and government have been focusing on exactly how to
accomplish this coordination for at least the last five years.
The President’s National Security Telecommunications
Advisory Committee, or NSTAC, was established in 1982 to provide
advice on national security and emergency preparedness issues in
the telecommunications sector.
Comprised of most key service and equipment providers, the
NSTAC has consistently discovered and made recommendations to
mediate problems in that critical infrastructure.
The President’s Commission on Critical Infrastructure
Protection, reporting in October 1997, recognized that the need to
coordinate closely between the public and private sectors for
economic and national security no longer applied to a single
infrastructure sector. The
Marsh Commission correctly identified the vulnerability of all our
infrastructures to errors and intentional attacks, their
interdependency in both the cyber and physical dimensions, the
dependence of government on private-sector infrastructures, and
the resulting requirement for a robust public-private partnership
to develop solutions. Industry
responded to the government invitation to a dialog by launching
the Partnership for Critical Infrastructure Security at the World
Trade Center on December 8, 1999.
Since its formation, the PCIS has become a model for cross-sector
coordination, public-private cooperation, and a clearinghouse for
timely information needed by critical stakeholders.
Last year, the PCIS identified barriers to information
sharing with government, and now the Congress is working through
legislation based on our findings.
During the response to the Code Red worm, the PCIS
represented industry alongside the FBI and security experts as we
made the public service announcement that ultimately blunted the
impact of that infestation. Later
this year, the government will publish the unique public-private
National Plan, with industry sections coordinated by the PCIS.
I mentioned before that this is not just an American problem.
Several countries are following our example, establishing
similar partnerships. The
PCIS is forming close relationships with them, and we plan to
collaborate in several key areas.
Earlier this year, Canada established the Office of
Critical Infrastructure Protection and Emergency Preparedness, and
its head, Margaret Purdy, has attended several PCIS meetings.
We are using the results of Canada’s outstanding
interdependency vulnerability study as we look at our own.
The United Kingdom recently formed the Infrastructure
Assurance Advisory Council, and its Executive Director, Dr. Andrew
Rathmell, will be speaking at the next PCIS Board meeting later
this month. Switzerland’s
Infosurance program is a public-private infrastructure security
partnership very similar to ours.
In August this year, the United States and Australia held a
bilateral meeting in Canberra, where we agreed to collaborate on
several key initiatives, including international security
There are several other public-private and international
Forum for Incident Response and Security Teams, or FIRST; the
Worldwide Information Technology Security Association; and others,
mainly in the information technology sector. Many people and organizations are beginning to grasp the
significance of the distributed nature of the new economy, its
implications on economic and national security, and the absolute
requirement for partnership and collaboration.
One of the keys to success is effective and timely information
sharing about threats, vulnerabilities, countermeasures, and best
practices within and between industries, and between the public
and private sectors. Information
Sharing and Analysis Centers, or ISACs, are proving their value as
both computer defense centers and awareness vehicles.
There are currently five ISACs in operation:
Oil and Natural Gas
ISACs have shared information on threats to members and helped
their sectors prevent damage and disruption from threats like Code
Red, Nimda, and Vote. The
Telecom ISAC, with its connections to National Infrastructure
Protection Center (NIPC), Joint Task Force –Computer
Network Operations (JTF-CNO), FedCIRC, and National
Communications Systems (NCS), is able to share vital
information from the government to industry that has proved both
valuable and timely.
Four additional ISACs are in various stages of development:
Information Service Providers
of this year’s top goals for the PCIS is to establish a
cross-sector and public-private information-sharing architecture. The existing ISACs, under the leadership of the NCS, met on
September 26, 2001 to develop operational information-sharing
meeting greatly accelerated the progress we have made in this
area, and the procedures they develop will form the foundation for
the overall PCIS cross-sector architecture.
They agreed to the following steps:
elements will immediately exchange e-mail, telephone numbers, and operational
ISACs will pass traffic deemed appropriate to other sectors that
does not duplicate publicly available information, but addresses
concerns to both physical and cyber elements of sector
The Telecom ISAC
will draft an SOP in one week (due yesterday), using operating
rules from all the ISACs.
The Telecom ISAC will provide a phone bridge that any ISAC can use
to initiate an alert to all.
NCS will offer a port to any ISAC operations center wishing
to join the ACN
as a second tier
The ISACS will establish this pilot program for 60-90 days and
then assess expanded participation.
NCS provided GETS cards to ISAC operations centers.
The Telecom ISAC will share government information as widely as possible with
What changed on September 11?
Information technology took a huge hit on September 11.
In addition to the people that we can never replace, one
estimate places losses in IT resources by the financial community
alone at $3.2 billion.
switching office at 140 West St. in Manhattan, supporting 3.5
million circuits, sustained heavy damage.
Verizon Wireless lost 10 cellular transmitter sites.
AT&T lost fiber optic equipment in the World Trade Center and had
switching equipment damaged in a nearby building.
Remarkably, AT&T switching gear in the basement of the
World Trade Center continued to function.
wireless network in New York City lost four cells.
Cingular Wireless lost six Manhattan cell sites.
service on 200 high-speed circuits in the World Trade Center
like the United States, the Internet was created as an open
society, with multiple communications paths and built-in
of its redundancy, the Internet provided many of the needed paths
for communication immediately following the attacks in New York
The day of the attack:
Messenger logged 1.2 billion messages – 100 times usual message
Verizon and AT&T reported that call volume and long-distance traffic doubled
One week after the attack, Verizon announced that it had restored
1.4 million of 3.5 million data circuits, and the New York Stock
Exchange had phone and data service to 14,000 of its 15,000 lines.
The exchange handled 2.37 billion transactions without
incident on its first day back in operation.
Other infrastructures also demonstrated tremendous robustness and
generators were brought in to provide power for lighting,
telecommunications, and Internet access in lower Manhattan.
All the involved sectors and governments worked together,
overcame a restriction on diesel fuel deliveries, and accomplished
the miracles we have all witnessed.
The terrorist attacks on the World Trade Center and the Pentagon
did not change the architecture of the new economy, our
interdependency, or the interlinked nature of the economies and
national security of the nations of the develop world.
What those attacks did was to create a sense of urgency and
a need to “do something”
about security among those that had paid little attention
to security before. Just
as the Administration carefully and deliberately seeks out those
that conducted and supported these barbaric acts and learns about
this new battlefield environment, I urge the Congress, the
Administration, and the American people not to move too quickly to
try to solve the infrastructure protection problem.
The challenge for this Administration is to streamline its
organization to become an effective partner to industry.
The current mix of lead agencies, sector liaisons, and
uncoordinated budgets makes synchronized action difficult.
The Critical Infrastructure Assurance Office (CIAO),
working with the National Coordinator for Security, Critical
Infrastructure Protection, and Counter-Terrorism, has overcome
immense obstacles and achieved a high level of cooperation and
coordination among government departments and agencies.
We believe the events of September 11 will also ultimately result
in changes to the National Plan for Critical Infrastructure
Protection, for which the PCIS plays a key coordination role.
We will work closely with the CIAO as the government
organizes itself to manage Homeland Security, Counter-Terrorism,
and Critical Infrastructure Protection.
We are confident that there will be much more on
cross-sector reconstitution in the plan than originally
So what can we do to protect our critical infrastructures?
We can raise the bar of security worldwide, through
research and development, interdependency vulnerability studies,
information sharing, raising awareness, and removing legislative
Administration initiatives to streamline coordination within the
Federal Government. Any
overall federal coordinator must have budget authority and
accountability to be effective.
Support initiatives that will secure the next-generation
network of networks as well as the patches and fixes we are
applying today. The
PCIS is developing a research and development road map that will
include a gap analysis of current industry, academic, and
government programs, and recommendations for focusing resources to
meet sector and cross-sector needs.
government organizations, businesses, and individuals to practice
sound information security. Several
organizations publish lists of effective means to secure computers
and networks against
malicious activity, like updating passwords, disallowing
unauthorized accounts and unneeded services, and installing
firewalls and intrusion detection.
This is now not just common sense, it is a matter of cyber
consider the impact
of any new legislation on the freedoms Americans
cherish—individual privacy, freedom of expression, and
all understand that without security there is no privacy, but we
must always strive for balance.
The PCIS Public Policy Working Group is investigating many areas
of current and pending legislation with the purpose of discovering
ways to improve critical infrastructure assurance at all levels.
We welcome any invitation to discuss our activities with
you at any time. We
believe a dialog where we can hear your insight, and you can hear
our concerns, will be healthy and fruitful.
We are all in this together—industry, academia, the
Administration, the Congress, and the American people—and we
need all points of view to ensure that our critical
infrastructures continue to provide for the health and welfare of
all citizens and the pursuit of liberty.
Thank you very much. I’m
happy to answer any questions you have.
PCIS Board of
of American Railroads
Ed Hamberger, President
Association of Metropolitan Water Agencies
Diane VanDe Hei, Executive Director
Bank of America
Rhonda MacLean, Chief Information Security and Business
Bob Wright, Director, Information Security
Cisco Systems, Inc.
Ken Watson, Manager, Critical Infrastructure Assurance
Edison Company of NY
Lou Rana, Vice-President
Information Technology Association of America
Harris Miller, President
The Institute of Internal Auditors
Bill Bishop, President
Merrill Lynch & Co., Inc. Steve
Katz, Chief Security and Privacy Officer
Howard Schmidt, Chief Security Officer
Billy Gillham, Manager, Global Security
North American Electric Reliability Council
Michehl Gent, President
Telecommunications Industry Association
Gerry Rosenblatt, Director, Technical and Regulatory
Union Pacific Corporation
Rick Holmes, Director, Information Technology
United States Telecom Association
Fred Tompkins, Director, Network Assurance