BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. Madam President, I rise to speak about cybersecurity, but specifically about the cyber threat to our Nation's critical infrastructure. By critical infrastructure I mean the power grid that supplies electricity to our homes that keeps us warm in the winter and cool in the summer. I mean the financial services' processing systems that connect our ATMs to our accounts and move money around in our complex financial system. I mean the communications networks by which we talk and e-mail and text and message one another.
The men and women we have charged with our Nation's defense and we have confirmed in these roles in the Senate have repeatedly and consistently warned us about the danger of cyber attacks on this critical infrastructure. It provides power and light and heat, tracks and records financial transactions, allows communication and data transfer, keeps airlines safe in the air, controls our dams, and enables our commerce. The consequences of failure in these areas could be catastrophic. We must pay heed to these warnings about America's critical infrastructure as we consider cybersecurity legislation.
The administration has described this cyber threat in no uncertain terms. The Director of National Intelligence, James Clapper, has stated:
[I]t's clear from all that we've said [that] we all recognize we need to do something. ..... We all recognize this as a profound threat to this country, to its future, to its economy, to its very being.
Secretary of Defense Leon Panetta has warned:
The next Pearl Harbor we confront could very well be a cyber attack.
Secretary of Homeland Security Janet Napolitano has compared this threat to the September 11 attacks.
Prior to 9/11, there were all kinds of information out there that a catastrophic attack was looming. ..... The information on a cyberattack is at that same frequency and intensity and is bubbling at the same level, and we should not wait for an attack in order to do something.
Attorney General Holder stressed the urgency of responding to this threat in a recent Senate Judiciary Committee hearing. He said:
This a problem that we must address, our nation is otherwise at risk and to ignore this problem, to think it is going to go away runs headlong into all of the intelligence we have gathered, the facts we have been able to accrue which show that the problem is getting worse instead of getting better. There are more countries that are becoming more adept at the use of these tools, there are groups that are becoming more adept at the use of these tools, and the harm that they want to do to the United States and to our infrastructure through these means is extremely real.
Chairman of the Joint Chiefs of Staff Martin Dempsey has warned that ``a cyber attack could stop society in its tracks.''
NSA Director and U.S. Cyber Commander GEN Keith Alexander, a four-star general, has stated:
We see this as something absolutely vital to the future of our country. Cybersecurity for government and critical infrastructure is key to the security of this Nation.
A recent report from the Department of Homeland Security found that companies which operate critical infrastructure have reported a sharp rise in cybersecurity incidents over the past 3 years. Companies reported 198 cyber incidents in 2011, up from 41 incidents in 2010, and just 9 in 2009. This may reflect that the private sector is just now beginning to catch on. It is unfortunate but true that the private sector cannot be counted on to respond to this growing challenge on its own.
As Deputy Secretary of Defense Ashton Carter has explained, and I quote again:
There is a market failure at work here. ..... Companies just aren't willing to admit vulnerability to themselves, or publicly to shareholders, in such a way as to support the necessary investments or lead their peers down a certain path of investment and all that would follow.
These were administration warnings, but the concerns are bipartisan. A wide range of national security experts from previous Republican administrations have echoed this alarm. Former Director of National Intelligence and NSA Director ADM Mike McConnell has said, and I quote:
The United States is fighting a cyber-war today, and we are losing. It's that simple.
As the most wired nation on Earth, we offer the most targets of significance, yet our cyber defenses are woefully lacking. ..... The stakes are enormous. To the extent that the sprawling U.S. economy inhabits a common physical space, it is in our communications networks. If an enemy disrupted our financial and accounting transactions, our equities and bond markets or our retail commerce--or created confusion about the legitimacy of those transactions--chaos would result. Our power grids, air and ground transportation, telecommunications and water filtration systems are in jeopardy as well.
That ends the quote from Admiral McConnell.
Admiral McConnell also made a comparison to threats from the past.
The cyber-war mirrors the nuclear challenge in terms of the potential economic and psychological effects. ..... We prevailed in the Cold War through strong leadership, clear policies, solid alliances and close integration of our diplomatic, economic, and military efforts. We backed all of this up with robust investments--security never comes cheap. It worked, because we had to make it work. Let's do the same with cybersecurity. The time to start was yesterday.
Former Deputy Secretary of Defense Paul Wolfowitz has
also echoed the administration's warning that a cyber attack has the potential of causing devastation on the scale of another September 11. He stated:
I hope we do not have to wait for the cyber-equivalent of 9/11 before people realize that we are vulnerable.
Former Assistant Secretary for Policy at the Department of Homeland Security Stewart Baker has compared the threat to the catastrophic effects of Hurricane Katrina.
We must begin now to protect our critical infrastructure from attack. And so far, we have done little. We are all living in a digital New Orleans. No one really wants to spend the money reinforcing the levees. But the alternative is worse. ..... And it is bearing down on us at speed.
Former NSA Director and CIA Director Michael Hayden has said:
We have entered into a new phase of conflict in which we use a cyberweapon to create physical destruction, and in this case, physical destruction in someone else's critical infrastructure.
Former Republican officials have also noted the cybersecurity gap in the private sector due to this market failure. Former Secretary of Homeland Security Chertoff said:
The marketplace is likely to fail in allocating the correct amount of investment to manage risk across the breadth of the network on which our society relies.
The following examples are emblematic of the market failure that both Democratic and Republican national security officials have identified in this cybersecurity area for critical infrastructure.
When the FBI-led National Cyber Investigative Joint Task Force informs an American corporation that it has been hacked, 9 times out of 10 that American corporation had no idea.
Kevin Mandia of the leading security firm Mandiant has said, and I quote:
In over 90 [percent] of the cases we have responded to, Government notification was required to alert the company that a security breach was underway. In our last 50 incidents, 48 of the victim companies learned they were breached from the Federal Bureau of Investigation, the Department of Defense, or some other third party.
In operation Aurora, the cyber attack which targeted numerous companies, most prominently Google, only 3 out of the approximately 300 companies attacked were aware that they had been attacked before they were contacted by the government.
We cannot count on the private sector to defend itself against a threat about which it is so unaware. An advanced persistent intrusion of the U.S. Chamber of Commerce's systems also went undetected until the chamber received help from the government. The Wall Street Journal reported that a group of hackers in China breached the computer defenses of the U.S. Chamber, gained access to everything stored in its systems, including information about its 3 million members, and remained on the network for at least 6 months and possibly more than a year. The chamber only learned of the break-in, according to the article, when the FBI told the group that servers in China were stealing its information. The special expertise of our national security agencies is a consistent theme through these examples. As former Assistant Attorney General, OLC Director, and Harvard Law School Professor Jack Goldsmith has explained:
The government is the only institution with the resources and the incentives to ensure that the [critical infrastructure] on which we all depend is secure, and we must find a way for it to meet its responsibilities.
By the way, that was Goldsmith at the Department of Justice in the Bush administration. This is a Republican appointee speaking. These warnings have been repeatedly communicated to us in the Senate. We cannot plead ignorance of them.
I ask unanimous consent to have printed in the Record a letter to Senate Majority Leader Reid and Minority Leader McConnell dated January 19, 2012.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. This explains that the threat is only going to get worse; inaction is not an acceptable option. This letter was signed by former Secretary of Homeland Security Michael Chertoff, former Deputy Secretary of Defense Paul Wolfowitz, former Director of National Intelligence and NSA Director ADM Mike McConnell, former Vice Chairman of the Joint Chiefs of Staff General James Cartwright, former Defense Secretary Dr. Willian Perry, former Deputy Attorney General Jamie Gorelick, former Deputy Secretary of Defense William J. Lynn, III, and former Special Advisor to the President for Cyber Security, Richard Clarke.
I also have a letter written to Majority Leader Reid and Minority Leader McConnell, dated June 6, 2012, which I ask unanimous consent to have printed in the Record.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. Secretary Chertoff, Admiral McConnell, Deputy Secretary Wolfowitz, General Hayden, and General Cartwright urged us to:
..... bring cyber security legislation to the floor as soon as possible. Given the time left in this legislative session and upcoming election this fall, we are concerned that the window of opportunity to pass legislation that is in our view critically necessary to protect our national and economic security is quickly disappearing.
They specifically focused on the threat to critical infrastructure, stating that ``protection of our critical infrastructure is essential in order to effectively protect our national and economic security from the growing cyber threat.''
We must not ignore this chorus of warnings issued by those who are the most informed and most alert about the danger to our critical infrastructure. We must pass cybersecurity legislation, and we must ensure that the cybersecurity legislation we pass addresses our Nation's critical infrastructure. No bill that fails to address critical infrastructure can be said to have done the job of protecting our country.
Our Nation will be vulnerable if critical infrastructure companies fail to meet basic security standards, as they do right now. Legislation must include a mechanism to end this continuing vulnerability. If operators object to a particular approach to cybersecurity for our critical infrastructure on the basis that it is too burdensome or too unwieldy, they will find many Members of the Senate on both sides--myself and Senator Blumenthal included--who are ready and eager to work with them. But if the purpose of the exercise is to come to an end point in which the operators of our critical infrastructure do not have to reach adequate levels of cybersecurity, then we need to move on and we need to vote and go beyond that.
The question of how we get to cybersecurity is one we should engage in the Senate. The question of whether we protect our privately held critical infrastructure in a responsible way is one we should not allow to deter us from getting this job done to protect our national and economic security.
Whatever the ultimate solution, we simply must find a way to improve the cybersecurity of our critical infrastructure.
I yield the floor to Senator Blumenthal, who has been engaged in efforts with me to try to find a way through to a bipartisan bill that will protect our critical infrastructure. He has expertise in this area as a superbly trained lawyer, a multiply elected Attorney General of his home State, a former marine dedicated to our national security, and as a person who brings the highest level of legal talent to this discussion, having argued, I think, five separate cases before the U.S. Supreme Court. He has been an enormous asset, and I appreciate his participation.
I yield the floor.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. Madam President, I am delighted to respond to the Senator in two ways. First, as the Senator so well pointed out, this is not a future threat or a prospective threat that we need to prepare ourselves against; this is an ongoing, current threat. There is a campaign of attacks into our national security infrastructure, into our intellectual property, and into our critical infrastructure, such as the power grids and the communications networks we count on in our daily lives for what we consider the American standard of living here at home. So time is not our friend.
As one of the individuals I quoted said--I think Admiral McConnell--the day to get this done was yesterday. So the sooner the better. We do need to form a consensus in this body, enough to move through the parliamentary obstacles that exist in this body, which allows us to go forward and will allow us to go forward in a way that does something serious about forcing the operators of our critical infrastructure to put in adequate cybersecurity protections.
If they have to do it because they have incentives to do it, that is one way of getting there. If they have to do it because there are regulations that demand it, that is another way of getting there. There are different ways of getting there. And as the Senator from Connecticut and I have discussed--and we are actually working together on this--we are open to different ways to get there, but it should be agreed amongst us in the Senate that getting there, getting to the point where America's critical infrastructure is protected from cyber attack as reasonably well as we can should be the nonnegotiable goal. Anything short of that should be seen as failure.
There is another thing I wanted to add. The Senator was very generous in his remarks and credentialing of a great number of Senators who have been working very hard. I would also like to single out Senator Coons, who has been very helpful in our efforts.
I will stay on our side of the aisle at this point and add in particular Senator Mikulski. Barbara Mikulski serves on the Intelligence Committee. She is keenly aware of the cyber threat. She has taken deep dives into this issue in her role as a cardinal on the Appropriations Committee. She does the appropriations for many of the national security agencies and law enforcement agencies that are deeply involved in this. So when she speaks, she speaks with real authority and she speaks with real impact. Her participation in this effort is extraordinarily helpful, in addition to the efforts of the many Senators whom my colleague singled out as well.
With that, I yield the floor. I see the Senator from Louisiana is here, and I thank the Senator from Connecticut.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. Mr. President, we were here two winters ago, in February, when Washington was hit by a snowstorm that achieved the nickname Snowmageddon. The city and, in fact, much of the mid-Atlantic was buried under feet of snow. It was the biggest snowstorm in 90 years for this area. People in Washington were struggling to get to work and school, and people went without power for days.
This being Washington, some of our colleagues in the Senate seized on that opportunity to mock climate change and to suggest these winter snowstorms were inconsistent with the projections of what would happen from global warming and climate change. As an initial matter, that is a false comparison from the very get-go all by itself. Climate science models have predicted consistently that as polar icecaps and glaciers melt and more water enters the system, we can expect heavier precipitation events. One of the ways it has been described is that if you have a pot on the stove and you have the heat under it and it is simmering, when you turn up the heat, you get more activity in the pot. You add energy to a dynamic system like a pot of boiling water, and it creates more energy in the dynamic environment.
In the same way, the extra energy coming in because of climate change, our carbon pollution in the atmosphere, is energizing our atmosphere and our weather, and we are getting weather extremes as a result.
There was an article in Science Daily, headlined ``Arctic Ice Melt Is Setting Stage for Severe Winters.'' It says this:
The dramatic melt-off of Arctic sea ice due to climate change is hitting closer to home than millions of Americans might think.
That's because melting Arctic sea ice can trigger a domino effect leading to increased odds of severe winter weather outbreaks in the Northern Hemisphere's middle latitudes--think the ``Snowmageddon'' storm that hamstrung Washington, DC, during February 2010.
I ask unanimous consent that this article be printed in the Record at the end of my remarks.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. That shows the original challenge to climate change theory, based on the incident of Snowmageddon, was like so much that is said to challenge climate change--phony, outright wrong, a misunderstanding of how it works, and misrepresenting what it shows.
Scientists have recently published an article in Oceanography that demonstrates that link between climate change and severe winter weather in the northern Hemisphere's middle latitudes. I think that can be debunked as a phony claim against the facts of climate change that are surrounding us. Look around at what is happening now. We are seeing extreme weather on the other side.
Last week, Eugene Robinson wrote a Washington Post column that was entitled ``Feeling the Heat.'' He wrote:
Still don't believe in climate change? Then you're either deep in denial or delirious from the heat.
He points out that the evidence is mounting in irresistible and ultimately irrefutable ways. To quote from his article:
The National Oceanic and Atmospheric Administration says the past winter was the fourth-warmest on record in the United States. To top that, Spring--which meteorologists define as the months of March, April and May--was the warmest since recordkeeping began in 1895.
Again, this spring--March, April, and May--was the warmest since recordkeeping began in 1895.
If you don't believe me or the scientists, ask a farmer whose planting seasons have gone awry.
The Bloomberg news recently wrote a story entitled ``U.S. Corn Growers Farming in Hell as Midwest Heat Spreads.'' The story reported that corn crops are in the worst condition since 1988 and that 53 percent of the Midwest is experiencing moderate to extreme drought conditions.
I ask unanimous consent to have printed in the Record, at the conclusion of my remarks, the Bloomberg article I have just referenced.
BREAK IN TRANSCRIPT
Mr. WHITEHOUSE. It is not just the agricultural sector that is getting clobbered by the drought and the heat. As the Presiding Officer, Senator Udall of New Mexico, knows all too well, and to quote from a New York Times story:
Explosive wildfires have burned across much of the west in recent weeks. In southwestern New Mexico, the largest wildfire in state history has burned nearly 300,000 acres.
Of course, New Mexico is the Presiding Officer's home State, but the article also describes other fires on the loose in Colorado and Utah.
The High Park Fire, which has been burning for weeks near Fort Collins and is one of the largest and most destructive blazes in the state's history .....
The article also mentions that Colorado had more than half a dozen fires burning and said conditions have not been this bad in a decade.
So we are seeing exactly the kind of extreme weather conditions the climate scientists, whom the deniers have always mocked and made fun of, actually predicted. They predicted this would happen, and it is, in fact, happening.
It is clear we can't take a particular storm and say this storm, this fire, this drought was the product of climate change. The example people use to describe what is going on is that it is akin to loading dice. The more someone loads the dice, the more the numbers they have loaded the dice to show up will show up. So we will get more weather events. Even if we don't load the dice, we are sometimes going to get double sixes. We can't show every double six is because the dice were loaded, but when we see more and more double sixes showing up--more than history would suggest or more than the odds would suggest--then something is going on. That is what we have done by loading our atmosphere with carbon pollution. We have loaded the dice for these extreme weather events, and now we are reaping that bitter harvest from the pollution we have thrown up there.
Unfortunately, the bitter harvest in this city is that we continue to listen to propaganda and nonsense from the polluters designed specifically to create enough doubt to prevent us from taking action about something that is creating these immense consequences for foresters and firefighters in the West, for corn farmers in the Midwest, and for anybody who has to experience extraordinary weather events like ``snowmageddon,'' so-called, here in Washington. These things are beginning to have an effect as real life begins to model what the climate scientists predicted.
NOAA's Chief Jane Lubchenco spoke before an audience in Australia, which is experiencing very similar conditions, and said these extreme weather events are convincing many Americans that climate change is a reality. We are seeing that more and more.
Yale, George Mason University, and the Knowledge Networks did some polling on this subject, and 69 percent of the respondents said they agreed that ``global warming is affecting the weather in the United States'' versus 30 percent who said they disagreed. So better than 2 to 1 the American people are ready for us to do something about this. They know there is a connection and they expect us to take responsible action.
Gallup polls are reflecting a rebound in the public's concern about climate change from 51 percent in 2011 up to 55 percent in March of this year. Before the recession, it was all the way up to 66 percent, until the economic issues pushed it aside.
The contention the polluting industries and their mouthpieces here in Washington make--that the jury is still out on climate change caused by carbon pollution--is simply false. The jury is not still out. The verdict is in, the verdict is clear, and we should start doing something about it.
When I come to the Senate floor to give these talks, I often quote a letter from back in October 2009 that was signed by virtually every major scientific organization in the country--the American Chemical Society, the American Geophysical Union, the American Meteorological Society, the American Society of Agronomy, the Botanical Society of America, the Soil Science Society of American, the American Statistical Association, and I could go on and on. The point is not to name all the multiple responsible and respected scientific organizations that signed the letter but to read what it was they said. If we think about it, as I read it, think about how cautious scientists ordinarily are in the language they use. Here is what they said:
Observations throughout the world make it clear--
that climate change is occurring, and rigorous scientific research demonstrates--
Not suggests, demonstrates--
that the greenhouse gases emitted by human activities are--
Not maybe, are--
the primary driver. These conclusions are based on multiple independent lines of evidence, and contrary assertions are inconsistent with an objective assessment of the vast body of peer-reviewed science.
That is a very ``sciencey'' way of saying something that is pretty harsh, which is that all these contrary assertions about climate change simply cannot be reconciled with an objective assessment of the facts, of the vast body of peer-reviewed research. If it can't be reconciled with an objective assessment, what kind of assessment is it getting? What it is getting, I submit, is a phony assessment, a political, propaganda-driven assessment, and an assessment with the purpose of creating enough doubt to slow down political action, to preserve the status quo, and to allow pollution to continue to pour out of these smokestacks.
I speak very specifically about smokestacks because Rhode Island is a downwind State, and so much of the coal pollution that gets piped up into the atmosphere through
Midwestern smoke stacks ends up landing in my State. It lands in the form of ozone, in particular. There are days in a Rhode Island summer that look clear, look beautiful, and someone can be driving by sparkling Narragansett Bay in the morning on their way to work when off goes the radio and the radio jock, in giving the news announcements of the day, says: Today is a bad air day in Rhode Island. Infants should stay indoors. The elderly should stay indoors. People with breathing difficulties should stay indoors.
This is an otherwise beautiful day. Yet children, seniors, and people with breathing difficulties should stay indoors? Yes, because corporations, pumping carbon pollution and other forms of pollution out of their Midwestern smokestacks, will not clean up their act. So they get to hold Rhode Islanders, on a clear summer day, captive indoors because they will not clean it up? That is wrong. It is just plain wrong.
I am going to continue to come to the floor on a regular basis to keep pointing this out. For some reason, this has become the issue in Washington that dare not be mentioned. Enough of that. It is time we started to mention it. It is time we started to force this issue, and it is time we started to do something about it because any other form of activity faced with these facts would be wildly irresponsible.
Let me give the example I have used before. You are a parent. You have responsibility for the welfare and well-being of your child. Your child is showing symptoms. You don't know quite what is wrong, but you take her to the doctor and the doctor says: Something is wrong here. She needs treatment. Treatment is not going to be easy, it will not be cheap, but she needs it. You think: OK. That is bad news. I tell you what, I am going to be a responsible parent and I am going to go get a second opinion. So you go and get a second opinion and that doctor says the exact same thing: Your daughter is sick. She needs treatment. So you ask a couple more doctors who are friends. You get a third and fourth opinion.
Let's say you are the most determined parent in the world and you go out and you get 99 second opinions. You contact 100 doctors about your daughter's condition, and 97 of them, 97 of those doctors say your daughter is sick and she needs to be taken care of and she needs this treatment. At that point you say: There is still doubt. There are these three other doctors who aren't so sure about this, so I am not going to do it. That is not something a responsible parent would do. I suspect in some circumstances that would be so irresponsible that it might land you in the child and family services office of your local government.
That is exactly what we are being asked to do about climate change--to ignore the 97 percent of peer-reviewed climate scientists who understand this is real, this is man-made, and the consequences are going to be ferocious for us because there is a 3-percent doubt. It gets even worse because so many of the scientists involved in the 3 percent are scientists for hire who have economic ties to the polluting industries. Some of them even go back to previous fights, such as those over whether cigarette smoking is good for you or whether lead paint is safe for children. These are scientists who have made a career of manufacturing doubt on behalf of the cigarette and tobacco industry, on behalf of the lead paint industry, and now on behalf of the big carbon polluters. In a nutshell, they are phonies, and we are being asked to believe them.
I see the Senator from Florida is here, and I think my time at this point has probably expired. I appreciate the time to come before this body and share these views again. I will close by pointing out if there is one place we truly need to worry about climate change and about the effects of our carbon pollution, it is not just in our atmosphere, it is not just in the climate or in the weather, it is in the oceans. The oceans are undergoing historic changes as a result of the amount of carbon in our atmosphere. We are acidifying our oceans at a rate that is unprecedented. We are now out of a bandwidth that has lasted for 8,000 centuries--8,000 centuries. Our entire species has developed within a safe bandwidth of atmospheric carbon and of ocean acidity that we have now, for the first time, stepped out of and a long way out of. If we do not take this issue on in a responsible way, we are going to bear an even more bitter harvest.
BREAK IN TRANSCRIPT