The committee will come to order. Thank you all for being here. Id like to thank the Ranking Member senator white house and the collaborator its great to be here and doing this together. I was just saying i told him that it would be nice to have the answers because hes a tough questioner and he will take you to task. Id like to thank the witnesses for your attendance and also highlight two empty chairs today which i say that he invited witnesses who apparently dont share your commitment to discussing the issues. One is for tiktok. If you dont know what tiktok is, you should. Its a chinese owned social media platform so popular among teenagers mark is reportedly spoofed. For facebook the fear is lost to social media market share and for the rest of us it is somewhat different. A company compromised by the Chinese Communist party knows where your children are, what they look like, with their voicewhat theirvoices sound like watching and what they share with each other. They claim they dont store american user data on china. All it takes is one knock on the door of their Parent Company from a communist Party Official from the government hands. Tiktok claims they dont take direction from china or censor in fact in a letter sent to just today to this committee, tiktok said both governments foreign or domestic direct how the moderate content. They do not remove content based on sensitivities related to china or other countries and we wouldnt do so if asked. Thats what they say and without objection i will enter the whole letter into the record. Buit is and what the employees say. Today the Washington Post is reporting that tiktoks chinese Parent Company imposed stricter rules on both code appear in keeping the restrictive view of acceptable speech. Former and he said Company Officials based in beijing had the final call on whether these videos were approved. The former employees at the attempts to persuade the team not to block or penalize certain videos were routinely ignored. Out of caution about the Chinese Governments restrictions. One former manager of tiktoks Parent Company said they want to be a Global Company and numbers wise they have had a success. The purse is still in china and it always comes from the air and decisions all come from there. That is a different story than the one they told the committee in this letter and that is a problem. They should answer for these discrepancies. They should answer to the millions of americans who use their product with no idea of its risks and they should have been here today but after this letter to the committee, they must now appear under oath to tell the truth about the company and its ambition and what they are doing with our data. It isnt just for childrens privacy but its a threat to National Security. We dont know what china could do with this data in aggregate and what it tells about the society. They can see who he talked to, what we talk about, what we congregate and capture on video. Not all of the users are kids, some work in government or for r the military. Others are celebrity or work for other companies and positions of influence. What does it mean for china to have a window . Why would he leave that window open . The other belongs to a company that has helped open the window on american consumers, apple. We are accustomed to hearings as a good Corporate Citizen that encrypts its messages and limits its own Data Collection from users and give them privacy controls, but the Business Model and practices are increasingly entangled with china effect we would rather not think too much about. Its essential to the bottom line is on the supply and demand side of the business the investment in chinese production have helped build scientific manufacturing capacity of the greatest geopolitical rival. The chinese demand is even more critical and to service the demand, they are risking compromise with authoritarianism, the hosted the users data is part of a joint venture with the Chinese Government controlled entity. They frequently talk about encryption but there are those stored . China. Apple said they have control over them but who knows what that means and they are not here to tell us. If you have family or business contacts you cannot count on the encryption to keep your interactions to or from the authorities and if you are a chinese dissident or protester in hong kong, the corporate values wont do much to protect you in the midst of the democracy protest now in their 22nd week, they pulled an apple from the store that helped citizens stay safe during the Police Crackdowns because they pushed for it. A few days later tim cook was appointed to chair the board. If you are the user you cannot be confident that the Chinese Government isnt reversed engineering the platform and the Privileged Access to it with a joint venture with apple. We see two sides of the same claim when it comes to the Data Security. The danger of the chinese platforms and trade it to the u. S. Market and the danger of american Technical Company operations in china. Thats one of the most important subjects we can discuss, how does the industry entanglements with china in peril our Data Security. I look forward to the witnesss testimony, thank you for being here and now senator white house. I welcome all of the witnesses that are here. I have a fairly long history and i can remember when the senate had pretty much close to zero interest in privacy and data they have more data than the most intrusive government in the history of humankind and they pay virtually no attention. Im delighted that that wall has come down and we now see the risk from the huge aggregations of the private data. Ive also been involved in a lot of the efforts for the cyber legislation. At one point we made a lot of progress when the bill focused on critical infrastructure. My republican coordinates for senator kyl, senator mccain who has been the chairman of the Armed Services sai so it was pry highlevel operation. We made a lot of progress and had a considerable number of conversation where there wasnt a whole lot of news and noise to be made that with people from the private sector and the defense and agencies and when push came to shove, the republican leader went to the floor and said no cyber bill is coming without the cyber bill attached to it. So that ended that effort and then along with the chairman i was the cochair of the report for the incoming president which is a very hopeful and thoughtful bipartisan cyber analyst is. When the President Trump came and i looked at the very wellversed honorable professional in the cyber space, great technician and i looked at and attorney general to come out of the senate and the upgrade we have a great opportunity here to the Political Savvy to get the real bill going and of course as you know all of that has pulled apart and none of them work for the administration any longer and i couldnt tell you why i shouldnt talk to the administration about the legislation as their appearance level of interest. I hope that we are in a good space to start doing some real work here. In closing i have remarks i would like consent to put in the record. I want to make a procedural point. In the committees we ordinarily operates one of two ways. Operate one of two ways. Say this is good to be bipartisan Work Together and agree on the witnesses of the Consensus Panel into the shape of the hearing is agreed to beforehand or you dont go that way but theres a kind of informal rule on t ground rulesr with each other. Im delighted to go forward and appreciate your leadership in this area and i want to be very cautious about the hybrid. Thank you for your work on this issue and the senators eluting to the common goal which is to have Administration Officials testifying in the committee and that is a goal i share and look forward to doing it legal for the full cooperation. Now let me turn to introduce the witnesses. The Corporate Vice president of security and trust microsoft. There he leads engineers, lawyers, policy advocates, managers, business professionals, data analysts. He joined microsoft in 1995 and filled several roles in the Legal Affairs department. Mr. Carters Deputy Director of the program at the center for strategic and international studies. His research focuses on International CyberSecurity Policy issues including Artificial Intelligence, and privacy, data localization, Financial SectorCyber Security and Law EnforcementTechnology Including encryption. A fellow at the National Security program at the center for the new American Security studies. Before joining, ms. Frederick helped create and lead the Global SecurityCounterterrorism Analysis Program analyst team lead for the headquarters Regional Intelligence Team in california and prior to this book served as an Intelligence Analyst and spent six years in the counterterrorism at the department of defense. Senior technologsenior technolor the Heritage Foundation as the first senior fellow for technology, National Security and science policy his research focuses on the intersection of technology and National Security, the particular interest in Artificial Intelligence, autonomous weapon systems and intelligence issues and prior to joining cummings was the National Security adviser to senator ben zacks. Thank you for being here and i will swear you in the fourth week of testimony. If you would please rise and raise your right hand. Do you swear or affirm the testimony ithattestimony is thee whole truth and nothing but the truth, thank you. Now we will hear your Opening Statements. Thank you for the opportunity to testify today. I will comment on the work to combat criminal and nationstates Cyber Attacks and how we must Work Together in new ways to combat these attacks. The frequency and the success continues to grow and its estimated the Global Financial impact last year was a trillion dollars and the nationstate attacks continue to increase in number and sophistication and impact. For more than a decade, microsoft has fought back. But we have learned the best protect our customers when we were collaboratively with the government and others in the sector. The government has lawenforcement resources the private sector cannot match but the private sector has access to the site and the technological resources governments cannot match so we must work collaboratively. Today Microsoft Digital crime unit truly unique in the private sector conducts business email compromise crime and continues to lead the world in the efforts to shut down criminal but thats working closely we have now taken down 17 rescue includes 2,500,000,000 devices from these criminaletwos. Lawenforcement faces unique challenges in combatingse thats why we were strong supporters of the cloud act which modernized how the data can be accessed appropriately by Law Enforcement. We applauded the agreement announced between the United States and United Kingdom implementing the act and encourage the department of justice to continue their efforts to negotiate and conclude additional cloud act agreements. Despite the past success, we have not seen lawenforcement partner on the takedowns if youre concerned to rewaryouared recognition structures and the agencies do not today provided the incentives to devote more n. We Hope Congress will provide new incentives to prioritize the disruption and dismantling of criminal networks. In addition, we see increasing nations stayed attacks causing harm to citizens and enterprises around the world. We have used the disruption techniques that we pioneered to disrupt these actors intent on destroying democracy. We have disrupted the groups operating in russia, china, iran and north korea and we will continue to do this important work. Descriptiothe description is imt so is improving cybersecurity hygiene. Unpatched systems are exploited by our adversaries so we strongly promote prompt installation of security updates. We advocate for the use of the multifactor authentication and develop cuttingedge Security Services like microsoft. We can combat and defend that feels the need to reduce how many attacks are launched against our civilian enterpris enterprises. Longterm solutions for protecting cyberspace require clear and binding commitments that are acceptable to the behavior. This problem cannot be solved by government or the private sector acting alone. Multistakeholder solutions are essential to combat what is necessarily a multistakeholder problem. Thats why last year microsoft was proud to join in supporting the call for trust and security in cyberspace, a voluntary commitment to mine foundational security principles including from cyber attack, critical infrastructure, elections, the public core of the internet and intellectual property. The call has been endorsed by more than 65 governments in over 500 enterprises and organizations. Unfortunately the United States is not yet an obstacle. For the sake of the security of american citizens, those around the world endangered deescalating of the attacks online, microsoft continues to encourage the United States to join this landmark multistakeholder commitment. The private sector and government must Work Together to invent 21st Century Solutions to the uniquely 21st century threats. Microsoft stands ready to do our part. Thank you and i look forward to your questions. Distinguished members of the subcommittee, thank you for the opportunity to participate on this important topic. Threats remain one of the most important risks facing the nation. Companies that collect and use data face threats from malicious cyber actors and restrictive government policies. The lack of u. S. Leadership on global issues of cybe cybersecu, Data Governance into digital Law Enforcement has been in a difficult position caught between the need to secure data against lawful and unlawful of use and demand of access to data. They are growing fast. The attack is more of their lives move online and proliferate has created vulnerabilities that can be exploited by malicious actors and the Cyber Capabilities have become as tabs in the arsenals of the government. And the gray market and the capabilities has grown up to need that. Both administrations repeatedly demonstrated a lack of resolve to impose meaningful consequences on the nationstate violates the behaviors and engage in Cyber Attacks against the u. S. Cybercrime has also become an epidemic. In 2018, csi has estimated the cost was more than 600 billion. Nearly 1 of gdp. Of 35 from 2014. The cyber activities are largely consequence free. Only 0. 3 of the reported Cyber Attacks in the United States result in an arrest in cyber crime is a massively underreported crime, the attacks are one of many threats to private and Sensitive Data into the challenge for the companies is the growtcompanysince the grl exploitation of the data by governments. Countries wish to enforce the law and protect the citizens as they defined both of the goals and expect companies to do business to enable them to do so. The problems arise when they lack appropriate government mechanisms and when they lead to the Technology Platforms in the global populations they serve into thand the government inteny utilized commercially available technologies from the oppression and exclusion. U. S. Companies and u. S. Government developed a range of technologies and policies to combat the challenges. They utilize Technical Solutions like unrecoverable encryption for the data to be an accessible even with the legal order. U. S. Government has also helped companies protect data for example for the Electronic Communications act prevents companies from disclosing the contents of communication stored in the United States to the government on this at the mutual Legal Assistance request in the u. S. Government. This approach has the significant costs and tradeoffs. Implementing the solutions to prevent the companies from disclosing the data is great except it can also prevent them from providing data to serious crimes and terrorism. The rollout of the encryption on Facebook Messenger for example will hurt many of the tools ineffective and requiring new strategies to combat child porn. Policies like encryption mandated retention requirements of the companies preserve their accesaccess today that can leado worse security outcomes for everyone. When governments are not able to access the meme many of them turn to Cyber Attacks to fill the gaps. The government must play a role in addressing the threats of the Data Security both lawful and unlawful around the world. As the senator mentioned in 2015 he chaired a Cyber Task Force to strengthen security for the United States. The key recommendations remain within today. Incentivizing and regulating the adoption of the Cyber Security practices increasing penalty on playability for those that fail to protect data or products in addressing resource gaps for the fundamental Research Workforce development can help to advance cybersecurity around the world and creating serious consequences is also essential. We must empower Law Enforcement to effectively combat cyber crimes and to demonstrate the political will to impose penalties on the nationstates that engage in the cyber activities. Even when it was a strain on complex activity relationships. U. S. Government must also take the lead developing the Governance Framework for the world. Last year we produced a report called low hanging fruit evidencebased solutions to the challenge which outlined a series of recommendations to streamline collaboration between companies and governments and facilitate access to data making it easier to access and utilize data that is available and with appropriate safeguards to reduce the pressure to pursue harmful policies like the data localization and eight, data requirements and hacking and puts a spotlight on those that intentionally exploit the data to marginalize their citizens. Thank you for the opportunity to testify and i look forward to your questions. Distinguished members of the subcommittee thank you for the opportunity to testify today. I am here because the contacts t between the free open societies and closed regimes is playing out on the digital front and our data will make all o the difference. When i worked at the tech firm in silicon valley, the same way and we could do more in one day than others could accomplish in a week. Much of that impact was the result of the volume and variety of data at our fingertips and what we could do with it. My experience with the collection and analysis as a member of the u. S. Intelligence community similarly impressed upon me the advantage of Data Security but also what can happen when the vulnerabilities are exploited. Many people are working in america to get all of this right and its imperative that we do so. The context of the work is before us. Technology is being repurposed to undercut its original winterizinpotential. Further, authoritarian regimes continue at to attack with tools created with free societies. Russia is infuriating its complaint of cyber hacking and attacks against United States and europe. Iran is following through. North korea effort has not beta. And even as these tactics spread around the gold under global the technology is involving enabling sophisticated assaults. Synthetic media, machine language model with the potential to generate false information at scale and automated spearfishing to the more difficult situations to come. The United States a system of checks and balances is a bulwark against the technology within our own borders. Properly pride our democratic system offers a set of institutions and practices to act as guardrails on the internal use of the technology. That relying on the system is no longer enough. Americans are confronting deep systemic risks using platforms operating in and owned by companies in countries with a history of Cyber Espionage and transfer. Private Chinese Technology companys ability to resist the government is highly circumscribed at best. You import to Series National laws and standards that are broadly written and often compel the companies to comply with government requests for data. Russia also has a data localization requirement in a similar scenario is likely to play another regimes. Further, we should explore the implications of combining and correlating a massive data set two populations around the globe. China already has a president of synchronizing biometric and behavioral data for political and social control. The integrated joint Operations Platform and much discussed social Credit System are evidence of this. China is also exporting its values embedded in the technology itself to the world. It is unclear whether tiktok continues under the content moderation of fibroid 2019. Still, instead of importing the values of censorship and control to the u. S. , we should be exporting our values of transparency to them. This is all occurring against a backdrop of a digital environment growing more complex. For instance, technical signatures are becoming less conclusive when it comes to attribution as result when russia hijacked an iranian Cyber Espionage last month. This makes it that much more difficult to go back there attacks against her own system and respond accordingly. Solutions are overdue, a Democratic Society does not establish the rules of the road for a Data Security and privacy protection, authoritarians will do it for us. Congress with interagency of communing intercommunication technology the likelihood of systemic risk. Lawmakers should sign Data Protection especially for sensitive biometric data and incentivize transparency in the government and private sector. For private companies they play critical role. A sustained access to a high volume and variety of personal data with high commercial value within ordinance control. American Tech Companies should therefore adopt a set of rules, norms and Guiding Principles for the use of the technical globally. That will not tip the scale in favor of repression. American private companies, should treat u. S. National security as their own comparative. Thank you, i look forward to your questions. Thank you chairman holly and recommend white house and the members of the subcommittee. When i was in the United StatesIntelligence Committee our mission was to collect, to understand, predict and to shape Human Behavior and events. Those in government call this intelligence. Technology companies called this market research. Data analysis, segmentation or service provisioning. But in reality, the age of the economy, were all in the intelligence business now. The pool information of sensors in the data and the exponential growth in capacity are combining to reduce unimagined possibility for human thriving and agonist but these positive outcomes are not the only thing that is being crated. Cybersecurity risk are combined with aggressive hostile to create an environment that you understand and that fewer are prepared for. China is a simple concern in this regard. For decades, countries like china and russia have pursued a deliberate strategy of using their Foreign Policy and intelligence communities to copy into steel market technologies. These strategies are starting to produce meaningful results with several foreign Tech Companies legitimately rivaling u. S. Tech leaders in both innovation and market capitalization. If left unaddressed, this could pose a challenge not only to the Economic Security but also the greater National Security. In january 2020, for example, a new chinese sidin secured logo d effect and Companies Operating in the country will have no place left to hide. The new law is part of beijings yearlong effort to expand the surveillance programs and rooted in a cybersecurity overhaul adopted in 2016. Next year, all Companies Including foreign owned companies, must arrange and manage their Computer Networks so that the Chinese Government has access to every bit and byte of data that is stored on transits over or in any other way touches chinese information infrastructure. Put simply, the Chinese Government will have lawful and technical access to all digital data within its borders and perhaps large volumes of data beyond those borders. Companies have long known that the intellectual property or ip, trade secrets and communications are highly sought by the market competitors in asia and by the Chinese Government in particular. Many of these risks are some but accepted as the price of doing business in china. Those risks that are deemed unacceptable are mitigated by Security Technologies and networking strategies that have critical information from prying eyes. All of these technologies and strategies under the new law will be illegal. For example, this currently place for Companies Operating in china to set up private networks and which are data and communication stored and sat when the encrypted pipe the outsiders these dpms have an underlying encryption to prevent access from the Chinese Government will no longer be allowed. There will be no truly private or encrypted messaging in china, no confidential data, no secrets. No exemptions. If the Company Operates in china, it will be required to operate in such a way as to provide the countries intelligence and Law Enforcement authorities on federate visual access. The days of paying the it text for access to the worlds Fastest Growing market are over. This access will not cost you everything. Imprecisely the chinese plan. To put a simple, our longterm economic and an interNational Security must account for and rollback a sustained campaign of cyber enabled economic warfare, the likes of which will take a leap forward in just two months. I provided ample fine inflammation in my summative testimony and im happy to answer your questions to the best of my ability. Thank you. Thank you to all the witnesses, id like to start with tiktok if we could and what theyre doing with all the data there there collecting from american users. I want to get it on the record that tiktok is collecting a lot of data in terms of service, i will quote, it collects contac t details in your location. It collects thirdparty social Network Providers and technical and behavioral information about your use of the pot for pride in it collects information contained in the messages you send through the tiktok platform and information from your phonebook. That is a lot of data. Its pretty comparable to the daba harvesting machine like facebook and google are scooping up. Tiktok says they store american user data here or in singapore not in china, but let me address this question, that doesnt necessarily mean the fact that they store the data here or in singapore does not mean that beijing cannot get to it. Is that right . The greater question is that the law applies to the Parent Company. That is essentially the problem. There is a parallel in china which tiktok ever since the 50th investigation came to light, has made the moves to extricate their dealings and what goes on in china and to do so explicitly in the alpine china is basically like the parallel version of tiktok but existing in china. They have showed the themselves by saying everything in tiktok is u. S. Or western friendly nation based in stored in the u. S. But by dance, the 2017 acquisition is what is being investigated, that is a problem and something we need to think about and it would be the Parent Company in china. Bite dance is the Parent Company of tiktok and its a chinese based company. They are subject including the 2017 National Intelligence law which requires chinese organizations and companies to cooperate with state intelligence work. Thats the designation and the law. Is that right . That is correct, as a Chinese Company the Parent Company is reasonable to assume that any individual information included information of american users can be harvested and excluded. One other point, technically it must be true. A lot of the development of this application is done in china still. Even the operating company. Have to be able to push from Chinese Development into the u. S. Market if they want to have an updated increasing capable technology. The idea that they can somehow meaningfully, technically warding off information from china does not make sense operationally. Thats a really important point. Much of the app is developed into the content of whats used in developing china is pushed to users here in the United States, the Parent Company is a chinabased company excepted to the restrictions or having their doors open anytime by the Chinese Communist party under chinese law. In todays Washington Post article, the leverage of the government, the Chinese Government has over the people who have access to the data, thats whats relevant, do you agree with that . The ability of beijing to go to bytedance there. Company and say you are required under chinese law to give us access to all the data, that means that bytedance could take american users data and taken to beijing is offered as a. Without a doctor. Me talk about the ways that tiktok or other Chinese Company could abuse this data. Am i right in thinking that the thomas Weapons Systems rely on Artificial Intelligence and able to interpret and identify imag images. That is true. If china obtains images of our servicemen and women through social media or the opium attack, could that have relevance to how they train their a. I. And a thomas weapons . Absolutely. One of the criticisms that china has developed up until this point is centric perhaps they were able to upgrade, this would be a way of addressing the delinquency. Because of the sheer amount of data and imagery we get of western users. Yes, sir. This a be the final question. How can we ensure tiktok or other chinese Tech Companies arent trojan horses that are gathering data on americans and sending information back to china to be collected and gathered and used for the beijing government purposes. So youre asking how we can assure that, im not sure we can. The law that i described simply requires access and anyone who thinks that a Chinese Company even if they have an american portion of the company can look at the government in beijing and tell them no thats a fundamental misunderstanding of how the government in beijing works. Thank you very much. Senator whitehouse be executor men. One of the things that is a stress test to see how good it is of performing an assigned task of providing cybersecurity, im reading us recent survey of 1500 Business Leaders by microsoft and marsh found 37 of firms believe the industry standards are effective at preventing Cyber Attacks, the same survey found no confidence that they can prevent Cyber Threats and 22 had no confidence they could respond to cyber events. At the time of the stress test framework . Senator, i think two things about the survey one that was performed by marsh in collaboration with microsoft. One thing we saw which you think is a positive development is between 2017 when we did it the first time in the most recent survey, we seen the number of people in the enterprises that were surveyed were aware of the risks that they face in the need to take steps has increased significantly. That is a good thing. Not enough. Its not enough absolutely. The framework we believe were one of the contributors working with it on that and we believe the framework is actually a very useful Framework Companies should be assessing their cybersecurity maturity. Its one of the things that we regularly assess our Cyber Security maturity as a Company Relative to the framework and i know from discussions with others around industry in general that increasing companies are adopting and using it. Be quick my time is short. Its very complex, this framework is complicated and if you dont have a big it staff it be hard to implement. Thats what we but with others in the industry and simpler tools for small and mediumsize business to apply a simple version of the framework. Mr. Carter, between the desire of the private sector and not reputational harm when they been hit by cyber attack and the over classification that the federal government indulges in, how complete do you think the picture is that the American Public gets of which are country and company are under cyber attack . I think the picture is very incomplete partly because there are a lot of disincentives to accurate reporting partly because there are no clear mechanisms for consolidation of that reporting partly because many are obvious to the victims. And partly because in many cases the information that is shared and auto mice to the point that is largely used for understanding the threat environment that we face. Back to you, you guys were the leaders in botnet takedowns, i was fighting to get the department of justice to do more back then when you first complaint was filed, i was telling chairman, were both recovering lawyers, what a joy it was to read the complete because it existed and be when he got to count six or Something Like that there was account of trespass channels which is a doctrine from the medieval English Common law that i probably slept there in my foundation of the property law class, but clearly microsoft has been a leader in fighting them for a long time, what more could the department of justice do now to continue the process of constant weed cutting that needs to take place is there any good use for a botnet . Or is it a week, what marsh we do to weed whack them. Almost all our weeds. There are some for Research Purposes that can be identified. In our view, almost all botnets that meet the standard are weeds that need to be eradicated. Theres two things we like to do with the department of justice and Law Enforcement to improve. One we need more strategic coronation when i meet with leaders across Law Enforcement and then told his community, dhs we always talk about public partner ship but are not doing enough to realize that. Its an area were were committed and no if we can meet strategically to identify, what are the key botnets in the most serious ones, how can we join together in a collaborative way to do something about that. That would be step one. Its a full smart supplier for some evildoer. Its an evildoer who has managed in fact thousands or millions of computers with their malware they can coordinate cybercrime across all the computers without their victims even knowing that the computers have been infected. The second thing for the department of justice and fbi to have the right incentives in the right priorities paid to reducing botnets to attack botnets even when they cannot necessarily get handcuffs on the perpetrator because theyre living in countries with no extradition or the other challenges we face. Disrupting the botnets alone and stopping the criminal enterprises is in itself an important thing to do. Finally if i may go on, ive been arguing for quite some time should pursue a coalition of the willing to create International Cybersecurity norms. I think the Obama Administration made a mistake try to bring the russians and chinese into a productive discussion on the subject. Its a little bit like trying to bring burglars into a productive discussion on home security. Forget them, i would consider it would be wise for us as a nation, try to set norms with countries that share our values with a secure internet and im wondering if you believe the cybersecurity the private sector entered into in the institute that the private sector has stood up to eliminate the need or pursuit the government should engage in. Its a pursuit they should engage in. The cybersecurity is a group that microsoft initially set up but now we have over 120 companies around the globe who Work Together to endorse key principles of cybersecurity for the customers but also to articulate the view of the community on key issues about cyberSecurity Policy and appropriate norms. The Cyber Peace Institute is a nonprofit to be based in geneva that will do work that is not happening elsewhere in the private sector to bring transparency to the impact of nation states Cyber Attacks. The harm, the human harm that the Cyber Attacks are and work to increase resiliency around the world to these attacks. Those are both important. What you said is absolutely right, the United States must join other likeminded countries to establish an enforceable norms of nation state behavior, if that means we can isolate those countries to abide by the rules, so much the better. At least will have isolation clear, but we the United States play a stronger diplomatic role, theres two pending United Nations efforts underway, one sponsored by the United States and one sponsored by russia, the working sidebyside to try to establish norms of conduct for cyberspace. And we are working on both of those processes to ensure they are productive and result in useful outcomes. Those are both areas where we need the United States to be actively engaged in pushing for the norms. Maybe with International Sanctions to backup the norms. Thank you for letting me go on all my time. I have a few more questions. Only, too, i become increasingly concerned about the willingness of American Companies, tiktok the American Companies to store data in the tools necessary to read the data in china and i want to think about apple for a second which provides Cloud Services in china, a longtime apple store Encryption Keys into the United States the beginning last year in moved it over to china for the data that is stored there. Let me ask you what are simple questions, encryption are what you need to be things like protected emails and Text Messages is all right . That is correct. If you have the Encryption Keys, you can read private communications that are stored in the cloud, is that right. That is correct. They say because apple chose to move Encryption Keys to chi china, chinese authorities will have far easier access to Text Messages, email another data stored in the cloud, do you agree with that and can you talk to us about the application . I think the short answers i agree with, there is a distinction we made. The actionable took, it moved Encryption Keys associated with chinese users of the capabilities. Its not all users, its chinese, as you mentioned, data localization. That being said in her Opening Statement you raise the point that by having the access or the significant axis that they enjoy, they will gain greater insight into the interworking of apple and icloud account. Which could allow them to do a great deal more with collecting outside the border. That is a concern. Let me ask you this, how does chinese access to Encryption Keys for data stored in china by apples chinese users, how does that affect an american who sends an email or text to a Family Member in china or friends in china or business contacts. It can be captured. In other words, it could potentially the fact that the keys are stored in try to cope with the whole communication string at issue. If you have an american here sending information to friends, Family Members, Business Associates whatever, the fact that is encrypted and nobody can get to it, that is not necessarily true sense encryption key are stored in china for china user data, my correct about that. Thats correct. If there is any chinese within the loop it compromises the entire network. Let me ask you this, you alluded in your last testimony, would you trust any tentative data being stored in china, would it concern you if you location data was stored in china or email data . As a member of the Intelligence Community i assume they have much of my data. And i dont like that. So no, i dont think that is okay, i dont think any person has to make a recognition that is likely the case in the real change now is these governments in the capabilities themselves are becoming sufficiently big to where thats a problem, up until the point is been theoretical. Now were developing the capability to exploit the information in ways that are meaningful to the chinese and u. S. Systems. Would you say that apple and Companies Like them are compromising American Interest in Data Security by storing the data itself as well as Encryption Keys . All make two points, any company that is complying with china suit Country Security laws affect more than the bottom line. These decisions are not risking our own National Security. China imprisons and tortures and kills religious minorities and using companies to do this at scale. Now operating according to the laws of the country where you do business is only rational to agree those laws are just. But lets remember there were plenty of people who were following the law in nazi germany and that does not excuse them from the consequences of their actions. Im really struck by what you said that beijing is using Compliant Companies to carry out repression at scale. That i think sums it up. Anything further . I may ask two questions, you mentioned the opium hack, i think the opm hack is very significant and highly relevant to the hearing. Could you give a minute on what the opm hack was and what it discovered about you and other government workers. And who did it. Im going to discuss this as reported in the news. It was publicly reported in the news and is been identified that the chinese were responsible for infiltrating and exploiting a number of databases that were held by the office of personal management the federal government hr organization. And they were able to among other things x will treat what is called the express 80 form which gives you everything about ourselves, they got fingerprints and a whole host of other things. This information is hard to scope this teleinformation couldnt be used. In terms if you thought about as a counterintelligence that, you can look at the individuals who have been processed with the fs86 and how they been allowed to enter into the Intelligence Community and if it was your objective to place a spy within the community, you would have the ability to determine what is the perfect legend for that purpose. How do we optimize them so they can get in with as little difficulty as possible. You now have the information. If you want to build a profile on the type of people in the community. You can do that. There was original remainder cells feel better by saying certain agencies were involved but again their absence, you can use that to discover who they were by exclusion, if youre under state department covert operating overseas but not in the database, guess what, they know who you are. So these are just obvious kinds of things. The broader problem, this is going to a broader strategy with the chinese strategy. Theyre building a mosaic of insight and awareness that is a catastrophic National Security concern that we have not dealt with. If an American Company has access to enormous amounts of personal data of an american like google or facebook, and theyre trying to monetize that. What are the constraints on them doing business with either a Foreign Company that front for the government or Foreign Government directly and selling as they would to any other customer, the information that they offer or the service of providing information as they offer. Sometimes they dont tell the customer the information they do say trust us, well do it will hit all the people you want to hit. What are the restraints on an American Corporation doing that with a Foreign Government or front corporation for Foreign Government. The problem here, the restraints are deficient. There is not enough transparency, right now we dont have granularity into what these American Companies are necessarily collecting. I alluded early on into the work that prevent abuse, the system we have in place that is critical to make sure the data by americans is not exploited, facial recognition is a huge topic. The problem we have not figured it out. Thats what i mean but the rules of road have not been set, u. S. Government does not have that much transparency into the behavioral data, the biometric content and everything American Companies. That is a problem. We need to Work Together with publicprivate partnerships are critical in this way and we need to help draft legislation that puts a proper constraint on this. Basically says data matters, there should be value your data that is propagated throughout the american populace. I think we basically need to do better in that regard. I think willful blindness seems to be a theme, they dont want to ask the questions, they dont want to hear the answers, when facebook is doing something as obvious of selling potable advertisements and accept payment in google, you would think summer and the genius apparatus, somebody might have thought, im selling political ads in my home country and the payment is dominated in rubles. What might that mean. That they did not care to look, didnt try to look they didnt want to look, they wanted to cash him and move on. And then when they improved their genius strategy and trying to prevent foreign interference in our election they went all the way to making you create a corporation. Facebook does not even require that the corporation is buying the potable advertisement, its whos behind it. So if you were to set up boris and natasha llc as a phony delaware corporation, facebook would happily sell you political advertising time even though it be obvious to an ordinary person that something is up. This business is trying to figure out how you create the incentive so blindness is not a successful Business Model for the security, its something worth our attention. I thank you for the hearing. Thank you to the witnesses for being here. Will standard drink. [inaudible conversations] [inaudible conversations] [inaudible conversations] [inaudible conversations] [inaudible conversations]or micd former acting fbi director Andrew Mccabe discuss u. S. Intelligence and Election Security from the National Press club. Thank you very much. This is a great turnout, i am flattered if there Something Else important in washington, d. C. Tonight, i think you know what im talking about. [laughter] thank you for coming. I am dean of the policy of government at george mason university. And respond to the Michael Hayden center for intelligence policy and interNational Security that has put on a number of wonderful programs over the past few years and we will continue to do so. I look very much forward to this special event and for those of you who do not know, george mason