[inaudible conversations] [inaudible conversations] the committee will come to order. Thank you all for being here. I would like to thank Ranking Member whitehouse, my friend and collaborator. Its great to be here at doing this together. I was just saying to him, i told him i would tell you it would bt nice to them in his edges because hes a top question. He will take you to test. I would like to thank the witnesses for their attendance today. I would also like to highlight two empty chairs today, which i say for saved for two and find witnesses who apparently dont show your commitment to discuss these issues. One chair is for tik tok. If you dont know what tik tok is, you should. Its a chinese owned social media platform so popular among teenagers that Mark Zuckerberg is reportedly spooked. For facebook, that fear is lost social media market share. For the rest of us, the fear is somewhat different. A company compromised byif the Chinese Communist party knows where your childrenws are, knows what you look like, with their voice assembly, what theyre watching and what they share with each other. Ik tik tok claims they dont store american user data in china. Thats a nice, but all it takes is one knock on the door of their Parent Company, based in china, from a communist Party Official of that data to be transferred to the Chinese Governments hands, whenever they need it. Tik tok claims they dont take direction from china. They claimed they dont censor. In fact, inct a letter submitted day to this committee, tik tok said this, no government, foreign or domestic, moderate how we tik tok does not remove content based on sensitivities related to china or of the countries we have never been asked by the Chinese Government to remove any content, and we would not do so if asked. Thats what they say. Without objection i will enter the whole letter into the record. But thats not what former employees of tik tok say. Today the Washington Post is reporting that tik toks Chinese Parent Company impose strict rules on what could appear on the app in keeping with chinas restrictive view of acceptable speech. Former employees said Company Officials raised in beijing had the final call on whether flagged videos were approved. The former employees said their attempts to persuade chinese teenagers not to block or penalize certain videos were routinely ignored. Out of caution about the Chinese Governments restrictions. One former manager, tik toks Parent Company said this, they want to be a global company, tik tok, and numbers wise theyve had that success. But the purse is still in china. The money always comes from there, and the decisions all come from there. That issue a different story than the one tik tok has told this committee in this literature and thats a problem. Tik tok should answer for these discrepancies. Theyns should answer to the millions of americans who use the products with no idea of its risks. They should have been hereo tody but after this letter to this committee, they must now appear under oath to tell the truth about their company and its ambitions and what theyre doing with our data. The threatit isnt just to childrens privacy. Its a threat to our National Security. We dont know which i can do with this kind of social data in aggregate, what it tells china about our society. They can see who we talk to, what we talk about, where they congregate, will be captured on video. Not all of tik tok users are just kids. Some work in government or for the military. Others are celebrities or work for major American Companies, positions of influence. What does it mean for china to have a window into such users socialize . Why we believe that window open . The other empty chair belongs the company that is help open chinas window on american consumers, apple. We are accustomed to things like this one to hearing about apple as a good corporate citizen. It encrypts its messages. Limits its own Data Collection from users. It gives them privacy controls. But apples Business Model and practices are increasingly entangled with china. The fact they would rather not think too much about their china is essential to apples on applying both on the supply and the demand side of the business. Apples investment in chinese production have helped build the scientific and manufacturing capacity of americas greatest geopolitical rival. But chinese demand is even more critical to apples future and to service that the man apple is risking compromise with authoritarianism. The company hosts is chinese users icloud data in china as part of a joint venture with a Chinese Government controlled entity, g cbd. How quickly talks about encryption but where are those Encryption Keys for the data stored . China. Apple says it has control of those keys but who knows what that means, and apple isnt here to tell us. If you have family in China Business contacts there, you cannot count on encryption to keep your interactions secure from chinese authorities can. If youre a week or a chinese dissident or a protester in hong kong, apples corporate values will not too much to protect you. On in thehe midst of hong kong democracy protest, now in the 22nd we come apple pulled at from its store the top protesters and citizens stay safe during Violent Police crackdowns. Why . He because beijing push for it. Just a few days later tim cook was appointed to chair the board at the Business School or if youre an american user of an ios you cant t be confident tht the Chinese Government isnt reverse engineering the platform due to their privilege access to it via their joint venture with apple. With apple and tiktok we see two sides of the same coin when it comes to Data Security, the danger of chinese tech platforms entry into u. S. Market and the danger of American Tech Companies operations in china. Thats one of the most important subjects we can discuss at todays hearing, how does the withindustry entanglement china imperil our Data Security . I look for to the witnesses testimony. Thank you for being here and now senator whitehouse. Thank you, chairman. I welcome all of the witnesses who are here. I have a fairly long history with this issue in the senate and i can remember when the senate had pretty much close to zero interest in privacy and data, so long as the data was held in private sector hands. We would get quite animated about many data that our National Security apparatus might have access to. When, by contrast, arrive at platforms had more data on americans in the most intrusive governments in the history of humankind, and we paid virtually no attention to it. Im delighted that that wall. Hs come down and that we now see the risks from the huge aggregations of private data in private hands as significant. So delighted this is a topic. Ive also been involved in a lot of the efforts for cyber legislation. At one point back we made a lot of progress on a bipartisan bill focusing on critical infrastructure. My republican coordinates were senator kyle who was is numbero on the republican side, senator mccain who was then chairman on the armed services, so it was a pretty highlevel operation. We made a lot of progress. We had a considerable number of conversations where there wasnt a wholele lot of news and noiseo be made, but a lot of good hearts and sincere work with people from the private sector and from our defense and intelligence agencies. And when push finally came to shove, the republican leader went to the floor and said, no cyber bill is coming without repeal to obamacare attached to it. That ended that effort. Then along with chairman mccaul i was the culture of the report for the incoming president , which is a very helpful and thoughtful bipartisan cyber analysis. And when President Trump came in i looked at tom bossert who i think is a very wellversed, honorable professional in the cyberspace, great technician, and i looked at an attorney general who would come out of the senate and the bee and i had come out of the senate and i thought great, we opportunity between the substantive knowledge of tom bossert and g Political Savvy in the Senate Sessions and coats to get a real bill going. And, of course, as you know all of that has fallen apart. None of them work for the administration of any longer and i honestly couldnt tell you who i should t go talk to in the administration about cyber legislation, so low is their apparent level of interest. I hope we are finally in a good space to start doing some real work here. In closing i have remarks and i would i like to ask an incentive to put them in the record. I want to make a procedural point year ask unanimous consent particularly in the judiciary committee, we ordinary operate one of two ways. I do say this will be a a bipartisan and the Work Together and we agree on the witnesses, there are consensus panels and the shape of the hearing is agree to before hand, or you dont go that way. You got a partisan way, kind of an informal rule that one side pic so many witnesses, the other gets the opposite. The minority doesnt think its views of being fairly expressed or they can call witnesses of their own and you get a the fight panel but often very interesting. This is a bit of a hybrid. Until last week we had bipartisan agreement on two panels, and all of that changed rather rapidly. Im not going to get too excited about all this because the chairman has expressed an interest in trying to make sure that the administration witnesses whom we have scheduled will be rescheduled, and hope is true. The panel that actually is here is a panel that was agreed to in bipartisan fashion, but i do believe if were going to be doing is bipartisanwe hearings then we should see that through all the way to the hearing and not follow the bipartisan path down until the week before and then change to having sudden unexpected changes made. I just want to flag that, mr. Chairman, because i think you and w i have done good work befe and of what to make sure our ground rules for the chair and Ranking Member for these hearings are clear with each other. I am delighted to go forward with this hearing. I appreciate your leadership in this area and i just want to be very cautious about the hybrid. We are a bipartisan hearing into the last minute we are not, waiting business. Thank you. Thank you for your lawn work on this issue and the sender is alluding to a common goal of both share which is g to have government was senator whitehouse putter, Administration Officials testify in this committee, and that is a goal that i share and i look forward to doing with senator whitehouse, and we hope for their full cooperation. Now let me turn to introduce the witnesses. Mr. Tom burt as Corporate Vice president of Customer Security and trust at microsoft. Elite engineers, lawyers, all certificates, project managers, business professionals, data analysts and cybercrime investors to manage cybersecurity. He joined microsoft in 1995 and is held several roles in the corporate external and Legal Affairs department. Mr. William carter steph curry director of thehe Technology Policy program at the center for strategic and international studies. His research focuses on International Cyber and Technology Policy issues including Artificial Intelligence, surveillance to privacy, data localization, cyber conflict and deterrence combine agile sector cybersecurity and Law Enforcement and Technology Including encryption. Ms. Cara frederick is a fellow of the technology and National Security program at the center for a new american security, see nas. Before joining cns she helped create a late facebooks Global Security counterterrorism analysis program. She was also the team lead for facebook headquarters rachel Intelligence Team in menlo park, california. Write a facebook she served as a Senior Intelligence analyst for u. S. Naval special warfare command and spent six years at the counterterrorism analyst at the department of defense. Mr. Klon kitchen is a Serum TechnologyResearch Fellow at the heritages foundation. As their first senior fellow protect old compassion security and science policy to his research focuses on the intersection of technology and National Security with particular interest in Artificial Intelligence, autonomous weapon systems, space and intelligence issues. Prior to that he was National Security adviser to senator ben sasse. Thank you all for being here. In keeping with the tradition of the committee i will swear you in before beginning test one. Please raise and rise please rise and raise your right hand. [witnesses were sworn in] thanknd you. And now well hear your opening statements. Mr. Burt, we will start with you. Chairman hawley, Ranking Member whitehouse and members of the committee thank you for the opportunity to testify today. In my comments oh focus on the work that microsoft does to combat criminal and nationstate Cyber Attacks and i will discuss what government and the private sector must Work Together in new ways to combat these attacks. The frequency ofmb success that cybercrime exploits continues to grow. Its estimate the Global Financial impact last year was 1 trillion. Nationstate attacks continued increase in number, sophistication and impact. For more than a decade microsoft passport back. We have learned we best protect our customers when we worked collaboratively with government and others in the private sector. Government has Law Enforcement and intelligence resources that the private sector cannot match but the private sector has access to data and technological resources that governments cannot match. So we must work collaboratively to find solutions. Today Microsoft Digital crimes unit truly unique in the private sector combats this is email compromise crime and continues to lead the world in our efforts to shut down criminal botnets. Working closely with Law Enforcement and private sector partners we have not taken down 17 botnets, resting close to 500 million devices from these criminal networks. Law enforcement faces unique challenges in combating these borderlessss crimes. Thats why we were strong supporters of the class act which modernize crossborder data can access appropriately by Law Enforcement. We applaud the agreement recently announced between the United States and the United Kingdom implementing the cloud act and we encourage department of justice to continue their efforts to negotiate and conclude additional cloud act agreements. Despiteag a pass success we have not seen Law Enforcement partner with us on recent botnets takedowns. We are concerned reward and recognition structures in our Law Enforcement agencies do not today provide the incentives to devote more and stronger resources to activities that protect victims but do not yield arrests and convictions that we Hope Congress will provide new incentives for Law Enforcement toen prioritize the distraction and dismantling of criminal networks. In addition, we see increasing nationstate attacks causing significant harm to citizens and enterprises around the world. We have used the botnet distraction techniques that we pioneered to disrupt these nationstate maligned actors who are intent on destroying democracy. We have disrupted groups operating from russia, china, iran, and north korea, and will continue to do this important work. Disruption is important but so is improving cybersecurity hygiene. E. Unpatched systems are exploited by our adversaries, so we strongly promote a prompt installation of security updates. Updates. We advocate for use of multifactor authentication and we develop cutting edge Ai Security Services like microsoft offender atp. We can combat and we can defend, but we also need to reduce how many attacks are launched against our civilians and enterprises. Longterm solutions for protecting cyberspace require clear and Binding International commitments that define acceptable online nationstate behavior. This problem cannot be solved by governments or the private sector acting alone. Multistakeholder solutions are essential to combat what is necessarily a multistakeholder problem. Thats why last year microsoft was proud to join in supporting thee paris call for trust and security in cyberspace, a voluntary commitment to nine foundational cybersecurity principles, including protecting from cyber attack, critical infrastructure, elections, the public core of the internet, and intellectual property. The paris call has been endorsed by more than 65 governments and over 500 enterprises and organizations. Unfortunately the United States has not yet endorsed the paris call. For the sake of the security of american citizens, those around the world endangered by escalating ssas get a tax online, microsoft continues to encourage the United States to join this landmark multistakeholder commitment. The private sector and government must Work Together to invent 21st Century Solutions to these uniquely 21st century threats your microsoft stands ready to do our part. Thank you, and i look forward to question. Think, mr. Burt. Mr. Carter. Chairman hawley, Ranking Member whitehouse, distinguished members of the subcommittee, thanks for the opportunity to in todays hearing on this importantn topic. Threats to private and Sensitive Data remain one of the most important risks facing our nation. Companies that collect and use data face growing threats from both malicious cyber actors and restricted government policies. The lack of Youth Leadership on global issues off cybersecurity, Data Governance digital Law Enforcement have put the companies a difficult position between secure data and the demands of Global Governance for access the data. Cyber threats are growing fast. The attacks affect more of our lives as we move on life and connected devices proliferate is renewable of those they can be exploited by malicious actors. Offense at cyber cube of those have become must have an arsenal of smallll National Governments and the thriving gray market and offensive cyber King Abdullahs has grown up to feed that need. Both theha obama and trump administrations have demonstrated a lack of resolve to impose meaningful consequences on nationstates that violate norms of state beavers and engage in Cyber Attacks against the u. S. Cybercrime has also become an epidemic. In 2018 csis estimated cybercrime cost the Global Economy more than 600 billion nearly 1 dollars nearly 1 of gdp. Up 35 from 2014. Malicious cyber activities are largely consequence free. Only 0. 3 of reported Cyber Attacks in the United States result in an arrest and cybercrime is an underreported crime. Cyber attacks are one of many threats to private and Sensitive Data. In many ways the more troublesome chums for u. S. Companies is the growth of lawful exportation of technology and dated by governments. Countries wish to enforce the laws of protect their citizens as they define both of these goals and expect companies to do business in the cards to enable them to do so. Problemsck arise when countries like appropriate governance mixes to prevent abuse oft that data. When cultural defensively to clashes between values of western Technology Platforms and the global populations they serve, and whe government intentionally utilize commercially Available Technology from malicious surveillance, repression and exclusion. U. S. Companies and u. S. Government has developed a range of technologies u and policies o combat these challenges. Companies utilize Technical Solutions like unrecoverable encryption to render their data and accessible to governments, even with ait legal order. The u. S. Government has also helped companies toco protect da for example, to Electronic Communications privacy act which prevents u. S. Companies from disclosing the contentmp of his medications stored in the tray to a Foreign Government unless that government submits a mutual Legal Assistance request to the risk of it. This process and if it can cost and tradeoffs. Its been Technical Solutions to prevent companies from disclosing data to governments tore prevent abuses great except they it can also prevent companies from providing data that can the rollout of him to end encryption on facebook messenger, for example, will render many of the tools currently used to combat child pornography on messenger ineffective requiring new strategies to combat child pornography. O policies like data localization, encryption dandies and requirements the compass for pue to preserve access to data can leadad to worse sigrid outcomes for everyone. When governments are unable to access data to lawful means many turn to Cyber Attacks to fill thoseem gaps. Ae u. S. Government must play leading role in addressing the many threats to Data Security both lawful and unlawful around the world. As senator whitehouse mentioned, in 2015 he chaired to Cyber Policy Task force for the 45th present to strengthen cybersecurity for the United States. Its key recommendations remain relevant today. Incentivizing and were necessary regulating the adoption of basic cybersecurity practiced and cyber hygiene, increasing penalties unlike those forpr countries that fail to protect data or so insecure products and addressing resource gaps to support for fundamental research and workforce deponentng cannot advance cybersecurity around the world. Creating cisco sequential phone malicious malicious actors is essential. We must of our Law Enforcement to effectively combat cybercrime and demonstrate the political will to impose penalties on nationstates that engage in malicious activity. Even when it puts a strain of complex security relationships. The u. S. Government must take the lead in developing a functional as a stable Data Governance framework. Last year we produce a report called low hanging fruit evidencebased solutions to the digital evidence challenge which outlined recommendations to see my cooperation between companies and government and facilitate appropriate access to data. Making it easier for governments to access data that is available and appropriate circumstances andnd with appropriate safeguar, cannot reduce the pressure to pursue harmful policies like data localization, encryptionn methods, Data Retention requirements and government hacking. I thank you for the opportunity to testify at a look forward to your questions. Thank thank you, mr. Carter. Ms. Frederick. [inaudible] distinguish those of theem subcommittee, thank you for the opportunity to testify today. I am here because growing contest between free open societies and closean repressive regimes is playing out on the digital front and our data make all of the difference. At a Big Tech Firm in Silicon Valley the same when we can do more in one day and others can accomplish in a week. Much of themp outsized impact ws the result of the volume and variety of data at our fingertips and what we could do with it. My expense with Digital Intelligence collection and analysis as a abuse Intelligence Community and pressed upon meet the great advantage of the Data Security but what can happen when data vulnerabilities are exploited. Many talented people are working in america to get all of this right and it is imperative we do so. The context of our work is before us. Technology is being repurposed abroad to undercut its original liberalizing potential. The Chinese Government uses Digital Systems to enable pervasive surveillance and exacerbate gross human rights abuses by targeting and persecuting uighurs throughout china. The consequences of these abuses did not stop in mainland china. Beyond chinas borders countries are adopting Chinese Technology to strengthen their own brand of technical illiberalism. Further, authoritarian regimes continue to attack democracies with the tools created by free societies. Russia is invigorating its campaign of cyber hackingng and information tax against the United States and europe. Iran is following suit. North koreas efforts have not yet abated. Even as these tactics spread around the globe, the Technology Behind it is evolving. Even more sophisticated assaults. Synthetic meaty, realistic bots, machine language models with the potential to generate false information at scale and automated spearfishing fortes of the difficult challenges to come. Yet the United States is a system of checks and balances is a bulwark against the Perverse Technology within our own borders. Properly applied the democratic system offers a set of institutions and practices to act as guardrails on our internal use but relying on the system is no longer enough. Americans are confronting deep Systemic Risk when using platforms operating in an owneds by compass in countries with a history of Cyber Espionage and tech transfer. Private Chinese Technology companies able to resist their government is highly circumscribed at best. Due in part to a series of National Laws and standards that are broadly written and ultimately compel these companiesen like tik toks bytedance to comply with a ritual custody to rush has data localization requirement in a similar snip is likely play out in otheras regimes. Further, we should explore the implications of combining and correlating massive data sets are populations around the globe. China has a presence agonizing biometric and behavioral data for political and social control. As theyre in a joint Operations Platform and much discussed social Credit System are evidence of this. China is importing as those embedded the technology itself to the world. It is unclear whether tiktok contends that censorship practices under the guise of content moderation after and updated its Privacy Policy february 2019. Still instead of importing the valleys of censorship and control to the u. S. , we should be exporting our values of openness and transparency to them. This is occurring against the backdrop of a digital of ivan growing more complex. For instance, tactical signatures are becoming less conclusive and it comes to attribution as a song when russia hijacked rain Cyber Espionage operation last month. This makes it that much more difficult to combat their attacks against our own systems and respondth accordingly. Solutions are overdue. If. Democratic societies do not establish the rules of the road for our Data Security and privacy protections, authoritarians will do it foroc us. Congress should mandate interagencyy reviews of information and Communications Technology against the criteria that encompasses the likelihood of Systemic Risk. Lawmakers should entrench data protections for sensitive biometric data and incentivize transparency within the government and the private sector. For private companies play a critical role. Theres sustained and unfettered access to high volume and variety of personal data with high commercial value gives them inordinate control. American Tech Companies should adopt a set of rules, norms and Guiding Principles for the use of the technology globally and for interfacing with authoritarian regimes that will not tip the scale in favor of repression. American private company should create u. S. National security as their own strategic imperative. Thank you, and i look forward to question. Thank you, ms. Frederick. Mr. Kitchen. Thank you, chairman hawley, Ranking Member whitehouse and subcommittee. When i was in the United StatesIntelligence Community, our mission was to collect, toen understand, to predict and to shape Human Behavior and events. Those incoming call this intelligence. Technology companies called this market research, data analysis, audience segmentation, or service provisioning. What in reality in the age of the socalled knowledge ofge economy, were all in the intelligence businesss now. The proliferation of sensors, the delusion of data and expansion growth and capacity are combining to produce these positive outcomes are not the only thing thatut is being created. General cybersecurity risks are now combining with increasingly aggressive hostile foreign actors to create an environment that few understand and that even fewer are prepared for. China is a central concern in this regard. For decades, countries like china and russia have pursued a deliberate strategy of using their Foreign Policy and intelligence communities to copy and to steal american technologies. These strategies are starting to produce meaningful results with several for Tech Companies noul legitimately rivaling use tech leaders in both innovation and market capitalization. If left unaddressed, this could pose a a challenge that only to our Economic Security but also our greater National Security. In january 2020, for example, a new chinese cybersecurity law will go into effect and Companies Operating in the country will have no place left to hide. The new law is part of their yearlong effort to expand its domestic surveillance programs and is rooted in a massive cybersecurity overall adopted in 2016. Next year all companies, including foreign owned companies, must arrange and manage their Computer Networks so the Chinese Government has access to every bit and byte of data that is stored on, transits over, or in any other way touches chinese information infrastructure. Put simply, the Chinese Government will have lawful and technical access to all digital data within its borders and perhaps large audience of dataap beyond its borders. Companies have long known that their intellectual property, or iv, their trade secrets and even there communications are highly sought by their marketing competitors in asia by the Chinese Government particularly. Many risk or except as a price for doing business in china. Those risks that are deemed unacceptable are mitigated by Security Technologies and networking strategiess that have high critical information from prying eyes. All of these technologies under the t new law will be illegal. For example, it is currently, place a Company Operating in china to set Virtual Private Networks on which their data and communications stored and an encrypted pipe that outsiders cannot crack or intercept. These dpms and underlying encryption to the degree to prevent access by the Chinese Government will longer be allowed. There will be no truly private encrypted messaging in china no confidential data, no trade exemptions. If the Company Operates in china, it will be required to operate in such a way as to what the countries intelligence of offers and authoritiesa, unfettered digital access. The days of paying the ip tax over. This access will now cost you everything. This precisely is the chinese plan. To put it simply, our longterm economic and National Security must account for and rollback a sustained campaign of cyberenabled economic warfare, the likes of which will take a giant leap forward in just two months. I have provided ample point information in my submitted testimony and im happy to answer your questions to the best of my abilities. Thank you. Thanks to all of the witnesses. I would like to start with tiktok if we could and what theyre doing with all of the data are collected from american users. For one thing i want to get in on the record that tiktok is collecting a lot of data, i mean a lot. Its terms of service date, i will call, that it collects content details, content you create and your location. It collects still quarter, from thirdparty social Network Providers and technical and behavioral information about your use of this that collects information conveyed in the messages you send through the tiktok platform and information from your phone book. Thats a lot of data. Its pretty comparable to what the massive data harvesting machines like facebook and google are scooping up. Tiktok says they store american user data either here or in singapore, not in china. Ms. Frederick, let me address this question to you. That doesnt assuming the fact that tiktok allegedly stores the data here or in singapore, that doesnt assuming beijing cant get to it, is t that right . So i think the greater question here is the fact that the laws that apply to the Parent Company, bytedance can serve as essential ofco the thee is a parallel app in china tiktok ever since the investigation came to light has potentially made some moves to thought of extricate their dealings with what actually goes onex in china, and to do so explicitly. The app in china is a parallel version of tiktok but existing in china. Theyey b attempted to shield themselves by saying hey, everything that people use tiktok is u. S. Or western friendly nation based and stored in u. S. And that kind of thing. Bytedance, the 2015 acquisition of what is being invested, right now that his problem. Thats something we we need to think about,at the law that woud apply to tiktoks Parent Company bytedance in china. So bytedance is the Parent Company of tiktok. Bytedance is located in china. Its a chinesebasedbased company. They are subject to which her tight butt including the 2017 National Intelligence law which requires chinese organizations, companies to cooperate with state intelligence work. Thats the designation in the law. Is that right, mr. Kitchen . Thats correct. As a Chinese Company, the Parent Company is completely reasonabls to assume that any individuals information including information ofny american users can be harvested and exploited. Just one otherin thing. Technically this must be true. A lot of the development of this application is done in china still, even if it has an american Front Company or operating company. They have to be able to push updates from Chinese Development into thech u. S. Market if they want to have an updated increasingly capable technology. So the idea theyin can somehow meaningfully, technically warden off this information from china doesnt make sense operationally. Thats an important point. So much of the app is developed in the content, which is in the efficacy of an china, is pushed to users here and the United States, the Parent Company is a chinabased company. Their subject to these restrictions or subject having the doors opened the doors open anytime that the chinese comes party under chinas law. As it was put in todays Washington Post article 11 of the government means the Chinese Government that has over the people who have access to the data, thats whats relevant. Do you agree with that . In other words, the p building f beijing to go to bytedance and say you are required under chinas law to give us access to all of this data. That means bytedance could scoop up american users data and make that available to beijing. Is that fair to say . Thats without a a doubt tr. Let mers talk about the ways tiktok of the Chinese Companies could use this data. Mr. Kitchen, a right in thinking that autonomous weapon systems rely on Artificial Intelligence and they are able to interpret and identify images, correct . Thats true. If china obtains images of our servicemen and women either the social media Something Like the opm attack, could that have relevance to have a training that i and their autonomous weapons . Absolutely. In fact, one of the criticism of the Image Recognition china has developed is that it was seen as center, that perhaps there were not able to operate in western alliances as it might. This would be a way of addressing that the link which it. Because of the sheer amount of data and a imagery they will get of western users come is that what youre saying. Was yes, sir. My final question for you. I can reach tiktok part of the chinese Tech Companies are not trojan horses that are gathering data on americans and then sending that information back to china to be collected and gathered and used for the beijing governmentd purposes . Youre asking how we can assure that . Im not sure we can. The law i described simply requires access, andm anyone wo thinks aib Chinese Company evenf you have an american portion of the company can look at the government in beijing and tell them no, thats a fundamental misunderstanding of how the government in beijing works. Thank you much. Senator whitehouse. Thank you, mr. Chairman. Business leaders by microsoft and marchant 37 of firms believe soft industry standards are effective at preventing Cyber Attacks. And 19 of firms had, quote, noconfidence they could prevent Cyber Threats and 22 had no confidence they could respond to cyber events. Is it time to stress test the framework. Two things about that survey, performs from collaboration with microsoft. One of the things we saw that we think is a positive development is from 2017 when we did at the first time in the most recent survey, we have seen a number of people in these enterprises that were surveyed that are aware of the risks they face and the need to take steps has increased significantly. It is not enough and more needs to be done. We were one of the contributors working on that. We believe this framework is a very useful framework. And companies should be assessing their Cyber Security. Our Cyber Security as a country relative to the framework and i know from discussions with others around industry, one thing is important here. Be quick because my time is short. This is complicated and if you dont have a big it staff it can be hard to implement and that is why we have built together with others, simpler tools with small and mediumsized businesses. The desire of the privatesector not to suffer reputational harm when hit by cyber attack and over classification the federal government indulges, how do you think the picture is the American Public at the extent to which our country and companies are under cyber attack . The fixture is very incomplete. There are a lot of disincentives to accurate reporting. And they were not obvious to the victims. In many cases the it was largely to the threat environment we faced. You were the leaders of takedowns. I was fighting to get the department of justice done. When your first complaint was filed, recovering lawyers, what a joy it was to read that complaint and you have got to count 6 or Something Like that, a trespass to channels which is a doctrine from the medieval commonlaw, and they were fighting but net for a long time. What more could the department of justice be doing to continue the process of constant weed cutting that needs to take place. Is there any good use for a botnet or is it a weed . What more should we do to weed whack . Almost all botnets are weeds. There are some for Research Purposes and some that could be identified. Almost all botnets that meet that standard are weeds that need to be eradicated. There are two things we would like to do to improve this area. One is we need more strategic coordination. When i meet leaders across Law Enforcement, Intelligence Community and dhs we talk about Publicprivate Partnership but we arent doing enough to realize that and this is an area where we are committed and if we could meet strategically to identify the key botnets, how can we join together in a collaborative way . That would be a botnet in a nutshell is a force multiplier for some evildoer. And evildoer who managed to impact thousands or millions of computers with their malware and they can coordinate cybercrime without their victims knowing that their computers have been infected. The second thing we need is for the department of justice and fbi to have the right incentives and priorities paid to reducing botnets to attack botnets even when they cant necessarily get handcuffs on the perpetrators because they are living in countries with no extradition or the other challenges we face. Just disrupting the botnets and stopping those criminal enterprises is in itself an important thing to do. Finally, something for the moment. I have been arguing we should pursue a coalition of the willing to create International Cyber security norms. The Obama Administration made a mistake trying to bring the russians and chinese into a productive discussion on this subject, like trying to bring a couple burglars into a discussion on home security. Forget them. I would consider it would be wise as a nation to set norms with countries that share our values and to that end i wonder if you believe the Cyber Security tech accord the privatesector entered into and the Cyber Peace Institute the privatesector has also stood up eliminate that need or whether this is the pursuit government should still engage in. It is absolutely a pursuit government should engage in. The Cyber Security tech accord is a group of microsoft initially set up but now we have 120 companies around the globe who Work Together to endorse key principles of Cyber Security for their customers but also to articulate the view of the Tech Community on key issues about Cyber Security policy is appropriate norms. It is a newly established nonprofit to be based in geneva that will do work that is not happening elsewhere in government or the private sector to bring transparency to the impact of nationstate Cyber Attacks. The human harm these nationstates Cyber Attacks cause to increase resiliency around the world to these attacks. Those are both important but what you said is absolutely right. The United States must join with other likeminded countries to establish enforceable norms of nationstate behavior and if that means we can isolate countries that refuse to abide by those rules so much the better. At least we will have that isolation clear but we need the United States to play a strong diplomatic role. There two pending United Nations efforts underway, one sponsored by the United States and one for russia. And to establish norms of conduct for cyberspace and we are working on both those processes to ensure they are productive and result in useful outcomes but those are both areas the United States needs to be engaged in pushing for these norms. Even with International Sanctions to back up the norms. Thank you for letting me go on. This is a good hearing. A few more questions. Let me come into you. Im increasingly concerned about the willingness of some American Companies, we are talking about tiktok, to store data and the tools necessary to read that data in china. Think about apple for a second which provides Cloud Services in china. For a long time apple stored Encryption Keys in the United States. They moved in corruption keys to china for the data stored there. Encryption keys, what you need to read things. That is correct. If you having corruption keys you can read private communications stored in the cloud. Because apple chose to move Encryption Keys, and text messages, email or other data stored in the cloud. Do you agree with that and can you talk about the implications . The short answer is i do agree with that. There is a distinction to be made. The action apple took, the chinese users, and in compliance with the chinese law as you mentioned. You raise a good point, by having unfettered access, the significant access they likely joy, and the apple i cloud account and technological capabilities. They allow them to do a great deal more. That is a real concern. How does chinese access to corruption keys for data stored in china affect an american, to Family Member in china. It can be captured. The communication string at issue. If you have an american sending information to friends and Family Members and business associates, nobody can get to it, that is not necessarily true since encryption skis am i correct about that . If there is any chinese note within that loop and compromise the network. You alluded to this in your last piece of testimony. Would you trust any Sensitive Data being stored in china . Would it concern you if your location data is restored in china or email data. I assume they have much more data. I dont like that. High dont think that is okay. Any person has to make a recognition the real change, they are becoming sufficiently big to where it is a problem. Until this point it has been theoretical. Now we are developing computational capability to exploit this information in ways that are meaningful to the chinese and us citizens. Would you say apple and Companies Like them are compromising interest in Data Security by storing the data itself in china as well as the Encryption Keys . I will make two points. Any company complying with china Cyber Security laws are making decisions that affect more than their bottom line. These decisions are risking our own National Security. China imprisoned, tortured and killed religious minorities and political dissidents and Compliance Companies to do this at scale. Operating according to the laws where you do business it is only rational to the degree those laws are just. And they are just following the law in nazi germany, that does not excuse them from the consequences of their actions. Im struck by what you just said that beijing is using Compliance Companies to carry out repression, that sums it up. If i may ask two questions. The opm hack is very significant and highly relevant, could you give a minute on what the opm hearing hack was and what it discovered about you. And who did it. I will discuss this as reported in the news. The chinese were responsible for infiltrating and exploiting a number of databases held by the office of personnel management, and they were able among other things to ask filtrate what is called the 86 form in the government gives you everything about ourselves. Theyve got fingerprinted a host of other things. This information is hard to scope just how that information couldnt be used in terms of a counterintelligence threat. You could look at the individuals who have been processed, how they have been allowed into the Intelligence Community. It was your objective to place a spy within that community, you would have the ability to determine the perfect legend for that person. How do you optimize them to get in with as little difficulty as possible . If you want to build a profile for people in that community, you can do that. You made ourselves feel better than certain agencies werent involved, you can use that to discover who they were, if you were under the state Department Cover operating overseas but not in the database. These are the obvious kinds of things. The broader problem is this goes into a broader strategy, the thousand grains of sand strategy building a mosaic of insight and awareness that is a catastrophic National Security concern. It is an American Company with access to personal data. They are trying to monetize that. And the Foreign Government directly, the service of providing information they offered. They say trust us, we will do it and hit all people you want to hit. What are the strengths on an American Corporation and the front corporation for a Foreign Government. The restraints it efficient. There is not enough transparency. We dont have granularity to what these American Companies are necessarily collecting. I alluded early on to the ball work that prevents abuse. The system we have in place that is critical to make sure it isnt exploited. Facial recognition is a huge topic in this area. The problem is we havent figured it out yet. That is what i mean by the rules of the road havent been set. Us government doesnt really have that much transparency into the behavioral data and everything American Companies are sucking up. You Work Together, Publicprivate Partnerships are critical in this way. We need to help you all draft legislation that puts constraints on this but that means data matters and there should be value for your data propagated throughout the american populace. We need to do better in that regard. Willful blindness seems to be a theme among our platforms. They dont want to ask the questions because they dont want to hear the answers. Facebook doing something as obvious as selling political advertisements and accept payment in rubles. You would think somewhere in the geniuss apparatus somebody might have thought i am selling political ads and my whole country, the payment is denominated in rubles. What might that mean . They didnt try to look . They didnt want to look . They wanted to cash the rubles and move on and improve their genius strategy in trying to prevent foreign interference in our elections, they went all the way, a Shell Corporation. Facebook doesnt even require that the Shell Corporation vying political advertisement is behind it. If you were to set up boris and natosha llc with a phony delaware Shell Corporation facebook would happily sell you political advertising time. And this business of trying to figure out how to create incentives, it is at stake, something worth our attention. Thank you to all the witnesses for being here. We stand adjourned. [inaudible conversations] [inaudible conversations] [inaudible conversations] live coverage on cspan2 will continue with acting National CounterterrorismCenter DirectorRussell Travers talking about the trump administrations counterterrorism policy. We have that live from the Washington Institute starting at 12 30 eastern today. Live on cspan, democratic president ial candidate joe biden holds a rally at the New Hampshire state house after filing candidacy paperwork, watch live coverage at 1 00 eastern on cspan. Donald trump will deliver remarks at a black voices for trump rally live at 3 00 eastern on cspan. We see live events online, cspan. Org or listen with the free cspan radio apps. Watch the cspan Networks Live next week as the House Intelligence Committee holds the first public impeachment hearing. The Committee Led by chairman adam schiff will hear from three state Department Official starting wednesday at 10 am eastern on cspan3, top us diplomat in ukraine William Taylor and Deputy Assistant secretary of state george kent will testify. Friday 11 00 eastern on cspan2, former Us Ambassador to ukraine will appear before the committee. Follow the impeachment inquiry live on the cspan networks, online, cspan. Org, or listen live with the free cspan radio apps. Cspan. Org making it easier for you to watch cspans coverage of the impeachment inquiry in the administrations response. If you miss any live coverage go to our impeachment inquiry page, cspan. Org impeachment or video on demand. We added a tally from the Associated Press showing where each House Democrats stand on the impeachment inquiry against donald trump. Follow the impeachment inquiry on our webpage, cspan. Org impeachment, your fast and easy way to watch cspans unfiltered coverage anytime. Sunday night on booktv at 9 00 eastern on after words, former speaker of the house Newt Gingrich with his latest book trump versus china. I dont think the chinese have any great planning in the next 20 or 25 years to try to take us on militarily in a traditional sense but i do think they are trying to build the kind of Cyber Capabilities and this is where huawei is an Extraordinary National asset for them and i think they are trying to build the capability in space, both of which have global implications. At 10 00 eastern, journalism professor Pamela Newkirk talks about her book diversity inc. Im not are pessimistic about white americas ability to see past the fiction of africanamericans, the centuries old demeaning images of people and how that has as much to do with lack of diversity. Watch booktv every weekend on cspan2. Up next, how Artificial Intelligence will impact National Security. Foreign Affairs Experts including Obama Administration defense undersecretary Michelle Flournoy and Anders Rasmussen discussed the growth of ai. The National Security commission on Artificial Intelligence is the host of this one our discussion. [applause] thanks, chris. Can you hear me . By the way, staff for this commission is so good. [applause] they produce 120 questions for me to interrogate this panel with. This is a 10 hour session, not a one hour session. I am thrilled to be with this panel, old friends and new friends are with me on stage. To my left is andrea thompson, the former undersecretary for arms control. And 25 years in service, time