Transcripts For CSPAN Hearing Focuses On WannaCry Ransomware Cyberattack Implications 20170620

Maintaining an effective cyber tourity posture is important remain vigilant. Too often when we hear about the importance of Cyber Security we are left without concrete steps to take to ensure our positions position against emerging threats. One of the goals today is to learn about tangible measures the government can take to its i. T. Systems to defend against new and emerging threats including novel and sophisticated rent somewhere threats. The specific focus will be the wannacry ran somewhere attack. It was last month in a worldwide attack that impacted nearly every country in the world. Although the concept of ransom ware is not new, the type of rent somewhere employed by wannacry was novel. It made people pay to get access to documents. It signaled a new type of wo rming. It would spread more rapidly with each new infection. In light of the method of attack, Cyber Security experts including those we will hear from today have expressed concerns that the virus is only a preview of a more sophisticated rent somewhere infection many believe will be launched by hackers in the near future. Writteng in 2017 the somewhere infection moved rapidly across asia and europe, eventually hitting the United States. It affected 7000 computers in the first hour. 100 10,000 distinct ip addresses in todays and in almost 100 countries including the u. K. , russia, china, ukraine, and india. Got to found it 1,000,0002,000,000 systems worldwide prior to activating switch. In illinois, cook county systems wannacry. Omised by is work took county appropriately patched systems, it is important we work to be sure all vulnerabilities are appropriately remedied in event of a more sophisticated attack. Fortunately, the hackers killnsibly created a switch which was uncovered by an employee of cryptos logic and terminate the attack. They exploited a key mistake made by the hacker when they registered the domain connected to the rent somewhere attack. Ransomware attack. Although based on information best far, the federal Government Systems were fortunately spared. We want to make sure the government is sufficiently prepared and light of a more sophisticated attack. We want to hear what congress can do to appropriately address this climate of new and emerging Cyber Security threats. Through the lens of the aftermath, todays witnesses will help shed light on key steps to take to ensure systems are protected. We will also hear about how publicprivate partnerships are an instrumental tool to bolster the Cyber Security harsher. Finally we will learn about how the border which makes it mandatory on the executive branch is a significant step toward ensuring the federal government Cyber Security posture incorporates the most innovative measures to defend against evolving threats. It is my hope our discussions today will highlight areas where improvement is necessary while offering recommendations as we move forward to enter federal government is prepared to repair respond to emerging security threats. I look forward to hearing from our distinguished witnesses. I recognize the Ranking Member of the subcommittee for an opening statement. Thank you so much. Cyber security should be a key concern for every government, business, and private citizen. In 2014, the opposite of Personnel Management systems and contractorssed by were breached. A compromise the personal information of minds of americans and that same year, actors release personal information of sony records employees and copies of unreleased sony movies. Hackers took control of a power grid in western ukraine and shut up power for over 200,000 residents. These examples show the varied security breaches. We know the Cyber Security cry 00 the one a wannacr breech. Findingu to them for it. We are lucky that was found quickly and fortunate that federal systems work resistant to wannacry. We might not be as lucky next time. Security upload our uploads on our personal computers and smartphones. Executive order on strengthening the Cyber Security of federal networks seems to build on the arena. Uccesses in the im happy the Trump Administration Identive Group them on every topic but they have taken this next step. Reports of federal Cyber Security from every Government Agency and simultaneously the Trump Administration has been agenciesunderstaffed are going to have significant of a cultic meeting the executive order and frankly the budget cuts in the trumpmaldini budget tol make the task harder secure the systems. We have to make sure the federal government has the resources and staffing meet the need in this vital area. The executive order also calls for the government to begin using the Security Framework and i am glad we have them with here today the can help us beat Cyber Attacks. World renowned expertise and Standards Development will stop well served by using in this framework. On a precautionary note, i believe some efforts beyond the Current Mission is wellintentioned but perhaps misplaced. One final note. Bloomberg reported russian meddling and our system far worse than what was reported. According to the report, hackers in atto delete data and least one instance access day campaign database. These efforts did not need change votes to influence. We need to take Cyber Security threats seriously. It is a war on our democracy. During the last congress including the one protecting the election from cyber and voting attacks, given what we know about the meddling in 2016 i hope this will be a precursor to more hearings on how we can better protect our voting systems. Thank you for your opening statement. I recognize mr. Abraham for an opening statement. The eggs over the last few years we have seen an alarming increase in Cyber Attacks. Unfriendly governments have compromised personal information of millions of americans and businesses and employees and threatened interruption of services. Ublic the most recent demonstrates Cyber Attacks are going from bad to worse. The most recent affected 1,000,0002,000,000 systems and and more than 190 countries. It appears it couldve been even more catastrophic considering how fast the rent somewhere spread and while individuals were largely unscathed due in part to a Security Researcher with a kill switch, the potential destructiveness want us to expect similar attacks in the future. We need to make sure our Information Systems are ready. A witness reported earlier this year the u. S. Government office i quote, over the past four years, gao made about 2500 recommendations to federal informations to enhance februaryand as of 2017, about 1000 recommendations had not been implemented. It is clear the status will is a virtual invitation to more Cyber Attacks. We must take strong steps to secure our systems before happens. Yber attack committeene, this approved a Cyber Security framework. The bill i introduced is part of my interest over the state of our nation Cyber Security. This bill takes concrete steps to strengthen Cyber Security. One of the goals of todays hearing is to learn about real, tangible measures the government can take to ensure its i. T. Security systems are appropriately reinforced, to defend against new and emerging threats, including novel and sophisticated ransomware threats. The specific focus of todays hearing will be the recent wanna cry ransom attack, a new type of ransomware infection which infected over one million unique systems last month in a worldwide attack that impacted nearly every country in the world. Although the concept of ransomware is not new, the type of ransomware employed by wanna cry was novel. In house experts develop guidelines under the federal guideline information act of 20 14 and also develop in collaboration with government and private sector the framework for improving Critical Infrastructure Cyber Security that federal agencies are now required to use pursuant to the s recent Cyber Security executive order. I was very pleased to read that language. There is an urgent need to ensure americans at all federal agencies are doing everything they can to protect Government Networks and sensitive data. The status quo simply is not working. We cannot put up with more bureaucratic excuses and delays. Singularertise is a asset. We should take singular advantage of that asset starting with annual cyber audits of highpriority federal agencies. A Cyber Attacks in cyber andinals continue to evolve become more sophisticated, our government Cyber Defense must also adapt in order to protect Vital Public Services and shield hundreds of millions of americanss confidential information. We will fear about Lessons Learned and how the government can bolster security and we must keep in mind the next cyber attack is just around the corner and can have a far greater impact than what we have thus far seen. Our Government Systems need to be better protected and that starts with more accountability, and transparency by federal agencies. I look forward to hearing our panel. Id yield back. I now recognize the Ranking Member of the research and Technology Committee for an opening statement. Thank you. The good news is that systems were not negatively impacted. This was a clear victory for Cyber Defenses but there are lessons to be learned. A combination of factors likely contributed to the success including getting rid of most of outdated windows operating systems, diligently and stalling patches and maintaining robust networks. As we know, microsoft sent out a Security Patch in march. Two months before the attack. Aese and other factors played role in minimizing damage to u. S. Businesses as well. Wannacry and its impact in the other places helps make let ourwe should never defenses down. Our defenses should evolve accordingly. The modernization act lays out responsibilities for security of civilian Information Systems. This, there are central roles in development and implementation of policy as well as tracking and response. This develops an update Security Standards and guidelines responsive to policies established by omb. Each agency is responsible for its own compliance and each office as an Inspector General to audit its compliance on an annual basis. We must continue to sport agencies and efforts to be compliant while conducting careful oversight. Structureritical infrastructure was released. It is currently being updated. While it is too early to evaluate the full impact, it appears the framework is being widely used to cost industry sectors. It was cosponsored to ensure the Cyber Security framework is easily usable by our nations small businesses. I hope we get into the president s desk quickly. In the meantime, there is an executive order directing agencies to use the framework to minimize their security risk. As we have heard and private hearings, many experts have applauded this and i applaud the administration from moving ahead. Administration the be responsible for framework and the variant of responsibilities. Budgetppointment in the proposals. The topline budget cut of 25 is so severe that if it were implemented, and if would have no choice but to reduce its Cyber Security efforts. This is penny wise pound foolish decision making. This is the best of the best for Security Research standards and our modest investment for their efforts help secure the federal systems not just of the government that the entire economy. I trust my colleagues will join me in ensuring this receives robust funding in the fiscal year 2018 budget and does not suffer from the drastic cuts of the president. Thank you to the extra witnesses for being here this morning and i look forward to your testimony. Id yield back. Thank you mr. Lipinski. I now recognize mr. Smith. I appreciate your holding this hearing. Ralphg next to me is abrahams. In the wake of last months this is an important conversation we must have as we look for ways to improve our Cyber Security posture. While wannacry failed to compromise Government Systems its almost certain the outcome was due in part to a measure of chance. Rather than seeing this outcome as a sign of bulletproof cybersecurity defenses, we must instead increase our vigilance to better identify constantly evolving cybersecurity threats. This is particularly true since many cyberexperts predict that we will experience an attack similar to wannacry thats more sophisticated in nature, carrying wit an even greater possibility of widespread disruption and destruction. Congress should not allow cybersecurity to be ignored across Government Agencies. I am proud of the work the committee has fleshed to improve the federal governments cybersecurity posture. During the last congress the Committee Conducted investigations into the federal deposit insurance corporation, the Internal Revenue service and the office of Personnel Management. As well as passed key legislation aimed at providing the government with tools it needs to strengthen its cybersecurity posture. President trump understands the importance of bolstering our Cyber Security. He signed a recent executive order on cybersecurity which is a vital step toward ensuring the federal government is positioned to detect, deter and defend against emerging threats. Included in the president s executive order is a provision mandating that executive Branch Departments and agencies implement nist cyberSecurity Framework. While continuously updating its cyberSecurity Framework, nist takes into account innovative cybersecurity measures from its private sector partners. Nists collaborative efforts help ensure that those entities that follow the framework are aware of the most pertinent, effective and cutting edge cybersecurity measures. I believe the president s decision to make nist framework mandatory for the federal government will serve to strengthen the governments ability to defend its systems against advanced cyberthreats like with the recent Wannacry Ransomware attack. Similarly the committees nist cyberSecurity Framework and assessment of 2017, sponsored by representative abraham, draws on findings from the committees numerous hearings and investigations relating to cybersecurity which underscore the immediate need for a rigorous approach to protecting u. S. Cybersecurity infrastructure and capability. Like the president s recent executive order, this legislation promotes federal use of the nist cyberSecurity Framework by providing guidance that agencies may use to incorporate the framework into Risk Mitigation efforts. Additionally the bill directs nist to establish a working group with the responsibility of developing key metrics to use. I hope our discussions here today will highlight distinct areas where cybersecurity improvement is necessary while offering recommendations to ensure cybersecurity objectives stay at the forefront of our National Security policy discussions. And with that, i yield back, mr. Chairman. Mr. Lahood thank you, chairman smith. At this time let me introduce our witnesses here today. Our first witness is mr. Salim neino, founder and chief executive officer of kryptos logic. Hes credited with discovering new solutions for Companies Like i. B. M. , dell and avaya. He received a bachelors degree in science from university of californialong beach. Kryptos is credited with largely stopping the wanna cry attack. Well hear more about that during his testimony today. Our second witness today is dr. Charles romine director of the Technology Laboratory at nist, he received a masters degree in mathematics and ph. D. In apply mathematics from the university of virginia. Our third witness, mr. Tuhill is a retired Brigadier General in the United States air force. Hes an adjunct professor of cybersecurity at Carnegie Mellon university. Previously he was chosen by president obama to serve as the nations chief Information Security officer. He received his bachelors degree from Penn State University and a masters degree in systems management and Information Systems from the university of Southern California and our final witness today is dr. Hugh thompson, chief Technology Officer for symantec. He also serves as an Advisory Board member for the antimalware Testing Standards Organization and on the Editorial Board of ieee security and privacy magazine. He received his bachelors degree and masters degree and ph in applied mathematics from the Florida Institute of technology. Were glad youre all here today and look forward to your valuable testimony. I now recognize dr. Nino for five minutes to present his testimony. Thank you, chairman lahood. Thank you for the opportunity to appear before you today at this joint subcommittee hearing, we greatly appreciate your interest in cybersecurity and look forward to sharing our thoughts and perfect i haves with you and members. A threat was identified. The intent of the threat was unclear it was immediately evident that its approach was unusually reckless. This threat has now popularly become known as wannacry. It was at this time that our director of Threat Intelligence for breach monitoring platform notified me of our teams active monitoring of the developing situation. On this date at approximately 10 00 a. M. Eastern time while investigating the code wannacry we identified what had looked like an antidetection mechanism which tested for certain do main a certain domain name. Our team registered this domain name and directed it to one of our sink holes. We noticed that the propagation of the attack came to a standstill because of what we refer to as a kill switch being activated by our domain registration efforts. While our efforts stopped the attack and prevented wanna cry from deploying the ransom component, we knew it had propagated freely for many hours at minimum. Based on our estimates, we believe that anywhere between one and two million systems may have been infected in the hours prior to activating the kill switch. Contrary to widely reported and more conservative estimates of 200,000 systems. One month after registering he killswitch domain, we have mitigated over 60 million infection attempts. Approximately seven million of those are in the United States. And we estimate that these could have impacted at minimum 10 million to 15 million unique systems. I will note that the largest attack we thwarted and measured to date from wanna cry was not on may 12 or may 13 when the attack started but began suddenly on june 8 and 9 on a wellfunded hospital on the east coast of the United States. It is very likely the Health System is still unaware of the event. We measured approximately 275,000 thwarted infection attempts within a twoday period, another hospital was also hit on may 30, in another part of the country. A high school in the midwest was hit at the beginning of june 9. Presumably every system at this location would have had its data held hostage if not for the kill switch. Moreover, cryptos logic has been under attack by those attempting to knock us offline thus propagating the attack. Many of these came from a wellknown botnet which took down parts of the United Kingdom and the east coast. Despite tease attempts our systems remain resilient. We believe the success of wanna wannacry illustrates two key facts about our nations systems. Vulnerabilities exist at virtually every level of computer infrastructure, ranging from operating systems to browsers, from Media Players to internet routers. Exploiting and weaponizing such vulnerabilities has a surprisingly low entry barrier. Anyone can join in, including rogue teenagers, nation states, and anyone in between. So how to we adapt an overcome and mitigate the threats and weaknesses . While many cybersecurity experts who have come before me offer the usual gloomy there are no silver bullets. I have had the opportunity to see both sides. Our attack responses must be more agile and with higher velocity and intensity. While the nation has considerable risks the actual resources for cyberdefense are scarce and there simply is not presently an adequate level of highly skilled, highly experienced and highly available operators in the cybersecurity field. While theres no shortage of good ideas which claim to be able to solve the problem and every subsequent idea Needs Development and support and testing, maintenance, etc. , all of which we characterize as developer debt. Many of these take too long to procure and end up being outdated and essentially useless before the ink is dry on the paper its written on. I am hopeful that there is a path forward. Mitigations are effective and have increased the cost of attacking systems. Other mitigations include various design approaches, including data systems and transmissions. Such they measurably raise the bar for Critical Software like internet browsers, web servers and every protocols which are fundamental to business continuity. Investing in technology doesnt necessarily guarantee any actual improvement. In fact, one could argue that introducing more Intel Technology exacerbates the maintenance an creates immediate monetary loss because there are few metrics to measure the effectiveness of any particular tech nothing. This is ca terms of the sword and shield battle. As these resources ebb and flow, knowledge gaps are also created. And the loss of domain specialists who cannot immediately fill these gaps. We must be less risk averse in terms of the defensive operations we undertake, more open to failure and ready to adapt and learn from failure. We need a stronger focus on threat modeling and fire drill simulation that will focus on the events of magnitude which will cause significant damage. A significant response with the wannacry incident was there was no real cry for the course of action well communicated. The media focused on points contrary to the defense whodunit and this could have resulted in a complete breakdown of processes had this been an unpatched zero day vulnerability and there was no luxury of a kill switch. The largest success, though incomplete, was the ability for the f. B. I. And ncsc of the United Kingdom to disseminate the information we provide sod cryptos logic provided so affected organizations could respond. Information sharing can be valuable but our framework could be vastly improved by triaging cybersecurity threats in a clear and repeatable scale. Not too dissimilar to the Richter Scale which measures the energy released in an earthquake. Likewise a scale that takes technical and social elements of a threat into account to evaluate its allows first responders, us, to focus on the most important areas of risk. While there do exist various scoring systems for evaluating the purely technical element, they fall short in terms of clear and actionable information. We focus too much on vulnerables with names like emmitt172010. None of these impact the wider environment. We need an easier to grasp method to prioritize threats that largescale destructive potential. To this end, once we determine a method to evaluate the risk, we can apply the appropriate mitigation. In conclusion, one of the largest issues the transer to nature of the crisis. The transitory nature of the crisis. We think this can be explained by the fact that organizations are too slow to adapt. Theres a vast Human Resource shortage and lit bill way of metrics to demonstrate return on investment in defensive technologies. Again, i thank the subcommittee for inviting me here today to discuss our involvement and the Lessons Learned from wanna cry and i welcome the opportunity to answer any questions you may have when theyre fielded. Mr. Lahood thank you, mr. Neino. I now recognize dr. Romine for his opening statement. Chairman lahood, Ranking Member smith and others, thank you for the opportunity to appear before you today to discuss nists key roles in cybersecurity and how they relate to recent incidents. In the area of cybersecurity we have worked with federal agencies, industry and academia since 1972 starting with the development of the data encryption standard. Nists role to deploy standards to protect the federal governments Information Systems against threats to the confidentiality, integrity and availability of information and services was recently reaffirmed in the federal Information Security modernization act of 2014. Nist provides ways to recover from these attacks by ensuring that the recovered system is trustworthy and capable. Nists guide for cybersecurity event recovery provides guidance recover from a cyber event and integrate the processes and procedures into the Enterprise Risk Management plan. The guide discusses hypothetical cyberattack scenarios including one focused on ransomware and steps taken to recover from the attack. Thee years ago, nist issued the framework. It created through tight collaboration between industry and government promotes guidelines and practices. The framework prompts decisions affecting infection by the ransomware, propagation of the ransomware and recovery from it. While the framework does not prescribe a baseline of cybersecurity, for example a baseline that would have prevented wannacry, it does prompt a sequence of interrelated cybersecurity Risk Management decisions which should help prevent virus, infection, and propagation and support expeditious response and recovery activities. On may 11, President Trump signed executive order 13800, strengthening these have Security Networks that mandated federal agencies to use the framework. Under the executive order, every federal agency or department will need to manage their cybersecurity risk by using the framework and provide a Risk Management report to the director of the office of management and budget and to the secretary of Homeland Security. On may 12, nist released a draft interagency report, the cyberSecurity Framework implementation guidance for federal agencies which provides guidance on how the framework can be used in the United States federal government in conjunction with the current and planned suite of nist security and privacy Risk Management guidelines and practices developed in response to the federal Information Security Management Act as amended, or fisma. Another nist resource that can assist in protecting against similar future attacks is the most recent release of the nist National Software Reference Library or nsrl. It provides a collection of software from various sources and unique file profiles, most often used by Law Enforcement, government and industry organizations to review files on a computer by matching the profiles in the system. Nist retains a database of all known vulnerabilities, such as the one exploited by the wanna cry malware. The list is an authoritative source of security vulnerabilities that nist updates dozens of times daily. Nist analyzes and provides a common severity metric to each identified as a rule initial. We recently initiated a project at our National Center of excellence focused on recovering from cyberattacks. Organizations will be able to use the results of the research to recover trusted backups, roll back data to a known good state, alert administrators when theres a change to a critical system, and restore services after a wannacrylike cyberattack. Nist is extremely proud of its role in establishing and improving the comprehensive cybersecurity Technical Solutions standards and plans to address cyber threats. In general and ransomware in particular. Thank you for the opportunity to testify today on nists work in cybersecurity and in preventing Ransomware Attacks. Id be happy to answer any questions you may have. Mr. Lahood thank you, dr. Romine. I now recognize dr. Touhill. Good morning, chairman lahood, Ranking Member beyer, members of the committee, thank you for the opportunity to appear today to discuss cyber Risk Management. Im retired air force Brigadier General greg touhill. I serve on the faculty of Hines College where i instruct on cybersecurity and Risk Management. Prior to my current appointment i served as the United States chief Security Officer and before that in the United States department of Homeland Security where i served as Deputy Assistant secretary for cybersecurity and communications. During that period i also served as director of the National Cybersecurity integration system, commonly referred to by its acronym, n. K. During my air force career i served as one of the air forces first Cyberspace Operations officers and i currently maintain both the certified Information Systems security professional and certified Information Systems management. Cybersecurity is a risk but manyt issube people mistakenly view this as solely a technology concern. s have a security Cyber Security is a multidisciplinary management issue and an essential part of an Enterprise Risk Management program. I recognize we have a very full agenda of topics today and im sensitive to your time. I have submitted for the record a written statement and in that i discuss the recent wannacry attack and assess how it may impact the public and private sectors. I view wannacry as a slow pitch softball while the next one may be a high an fast fastball. I also discuss the publicprivate partnership. And i urge the congress to continue its great efforts to strengthen our enterprise risk posture. I urge you to authorize and empower the federal chief Information Security officer position which currently is not authorized for specified position. I also suggest that instead of calling it the nist cybersecurity frame without objection and im a huge fan of this framework, i suggest we call it the National CyberSecurity Framework. To reinforce the fact that it applies to everyone. Further, nist did a brilliant job in crowdsourcing the go this framework but it was really people from around the country that brought to the table best practices. Nist was a great trail boss for this but it is really a National CyberSecurity Framework. Finally, in regards to the proposed h. R. 1224 legislation, i congratulate the committee and the members of the congress for taking the initiative to really reinforce the need to implement the framework across the federal government. I do suggest based upon my experience in both the military and the government sectors of the federal government, that we do two things with that act. One, is we amend that act to make it apply to National Security systems as well. Having served extensively in the military and in the federal government, i believe that the National CyberSecurity Framework applies equally to National Security systems and i recommend you make that amendment. Further, i concur with my colleagues who suggest that lets leverage the Inspector General and auditing communities that are currently in the different departments and agencies and reinforce their need to conduct appropriate audits using that cyberSecurity Framework. Again, i thank you for inviting me to discuss cyber Risk Management with you today and i look forward to answering any questions you may have. Further, i concur with my colleagues who suggest that lets leverage the Inspector General and auditing communities that are currently in the different departments and agencies and reinforce their need to conduct appropriate audits using that cyberSecurity Framework. Again, i thank you for inviting me to discuss cyber Risk Management with you today and i look forward to answering any questions you may have. Mr. Lahood thank you. I now recognize dr. Thompson to present his testimony. Mr. Thompson thank you for having me. Chairman lahood, vice chairman abraham, Ranking Member lipinski and Ranking Member beyer, i appreciate the opportunity to be opportunity to be here today to talk about what is a critical subject. Understanding the current threat environment is essential to crafting good policy and effective defenses. Last months wanna cry Ransomware Attack is one of the manifestations of the kinds of disruptive attacks we are now facing. The timeline of wannacry i think has been well covered by the other folks on this panel. But i did want to share with you a graphical timeline that hopefully you can see in the monitor, apologies for the small print. Whats interesting, i think, about that and where id like to add some color is to give you some is to give you symantecs perspective on events as they unfolded. We are the Worlds Largest Cybersecurity Company, with technology protecting over 90 of the fortune 500 and being used extensively by Government Agencies around the world. In addition, we protect tens of millions of home users through our norton and lifelock branded products. The threat to the threat telemetry we get from these represents the largest in the world. Wannacry was unique and dangerous because of how quickly it could spread. It was the first ransomware as a worm that had such a rapid global impact. Once on a system it propagated autonomously by exploiting a vulnerability in microsoft windows. After gaining access to a computer, wannacry installs the ransomware package. This payload works in the same fashion as crypto ransom ware. It demands payment from those infected. Symantec worked closely with the u. S. Government from the first hours of the outbreak. We connected d. H. S. Researchers with our experts, provided analysis and received the same back. During the outbreak, d. H. S. Held twice daily calls with private sector to coordinate operational activities. From our perspective this was one of the most successful publicprivate collaborations that weve been involved in our involved in. Our analysis of wannacry revealed that some of the tools and infrastructure it used had strong links to a group referred to as lazarus by the Security Community. Which the f. B. I. Has connected with north korea. Lazarus was linked to the destructive attack on Sony Pictures in 2014. And also the theft of approximately 81 million from the Bangladesh Central Bank last year. The links we saw between wannacry and lazarus include shared code, the reuse of i. P. Addresses and similar code obfuscation techniques. As a result, we belief it is highly likely that the Lazarus Group was behind the spread of wannacry. Beyond wannacry, the Threat Landscape continues to evolve very quickly. Were seeing attacks become more sophisticated, not just in technology but in the social engineering of social engineering approaches these attacks use. Were also seeing more attacks being leveraged against i. O. T. Devices such as the massive weaponization of i. O. T. Devices that we saw with the morai botnet last fall. Moria launched one of the largest distributed denial of services ever. The explosive growth of attacks like wannacry and morai underscores the need for preparation and employing integrated and layered defenses. These attacks showed the response and recovery planning and tools as an essential part of cyber Risk Management because when good defenses will stop any attacks, we have to be prepared that a determined adversary may get through those initial defenses and we must lay a foundation for recovery. Theres no question that wannacry was an important event but unfortunately it will not be the last of its kind. In fact, its more likely an indicator of whats to come. Good fortune played a significant role in minimizing its impact, particularly in the u. S. , but we will not always have luck on our side. Which is why we must learn the lessons of wannacry and make the necessary improvements to our defenses and response capabilities. This hearing is an important part of that effort and we appreciate the opportunity to be here. Look forward to answering any questions that you may have. Thank you. Mr. Lahood thank you, dr. Thompson. Thank all the witnesses for your testimony. The chair recognizes himself for five minutes and well begin questioning. As i talked about in the begin, the title of this hearing is Lessons Learned from wannacry. And weve talked a lot this morning about wannacry and how that played out across the world. But in terms of what we learned about the genesis and origin of where this came from, i know the Washington Post came out with an article yesterday that the n. S. A. Linked the wannacry computer worm to north korea. Im wondering if, dr. Neino, you can talk about the genesis and origin of where this came from, particularly because it appears its from a nation state and i know theres references to what occurred with Sony Pictures and also with the Bangladesh Bank and what we know about it and what is being implemented, i guess, on the government side to prevent this or hold an entity or the government accountable. Dr. Neino thank you, mr. Chairman. I think if i understand your question, youre asking about one, the origin, and our conjecture to that, and number two, perhaps if i understood also correctly what would be the rules of engagement for Something Like that with another nation state. While we think its ambiguous, to conjecture over the origin of wannacry, there are codes in there that suggest some nation state could be responsible. Unfortunately, anyone could have created this level of attack and often misdirection is found, typically in binaries like these attacks we see. I would compare it perhaps an analogy to photo shop being a program to look a certain way, or it could have simply been what it is, which is exactly what we see. Its hard to tell. So we wont i wont say that i know the origin of the attack, nor should i conjecture on it. What i can say is that these attacks are very difficult to attribute. We are a Cybersecurity Company not an intelligence agency. It would be difficult for us to pursue an answer to that. As far as rules of engagement, i think the question segues the same way. It would be difficult to create attribution or origin to any attack and therefore rules of engagement would be difficult for us to give an assessment on. Mr. Lahood dr. Thompson . Dr. Thompson this is an interesting attack. We spent a lot of time in our Research Labs looking at both the code used in wannacry but also where wannacry communicated out to. And there were very, very close similarities to other kinds of attacks that we have seen. Specifically attacks that we attribute to a group called lazarus. And these attacks, malware, the reuse of strings in that malware, the reuse of command and control infrastructure out on the internet by that malware led our researchers to believe this is strongly linked to the Lazarus Group. Now similar to my colleague on the end, were not the Intelligence Community either. And i agree with those comments that attribution is often difficult. But what weve seen leads us to believe it was a part of this Lazarus Group. Separately the f. B. I. Has linked the Lazarus Group with north korea. And i think chairman lahood, the article that youre referring to from yesterday is another potential evidence point on that as well from the n. S. A. Mr. Lahood thank you. Dr. Neino, we talked about the kill switch and how that stopped the attack but we also referenced the fact that last week a hospital on the east coast and a high school were subject to attack. Can you explain how, if the kill switch was implemented correctly how the hackers responsible for wannacry were able to continue to perpetuate the attack despite registration of the kill switch . Dr. Neino absolutely. Though id like to be a doctor, its mr. Neino. Mr. Neino you have to understand the makeup of the malware. Why wannacry was so significant is that its selfpropagating. Thats what givests it the title the worm. Meaning the actors dont need to be in existence. Sometimes we refer to these things as zombies, zombie botnets, because they continue to proliferate regardless of the actors that were parents or creators of the attack. In the case of the examples i gave in the testimony regarding Health Systems, of which there are many, that was just a case that was very significant, the worm continues to propagate because it is scanning and seeking to expand itself and that portion of the worm is not subject to the kill switch. So its ex so its expansion and spreading, which in effect, its still exploiting systems worldwide. What its not trigger is the payload, the ransom component. And that component therefore doesnt trigger most of these organizations worldwide right now dont know theyre getting actively exploited still. But its because they dont see the ransom portion of it. So thats why we have 60 million attacks thwarted to date. If not more. Just nobody knows its still happening. Thats why i said, i dont think the message has resonated, given those figures, that this still needs to be patch and this again points to the to be patched and this again points to the question of resources. Mr. Lahood thank you, mr. Neino. I yield to Ranking Member beyer. Mr. Beyer im so impressed by our panel today, congratulations to dr. Romine and dr. Thompson for being ph. D. Mathematician. Mr. Neino, congratulations on winning the hacking tournament, i never had a chance to say that before, its very cool. And general touhill this is its in general to the touhill it is very cool that now after all the things youve done in your life, combat and diplomacy and first ciso to be at Carnegie Mellon with their buggy races around the park. Every university has something that makes it cooler than every place else. And general, i want to start with you. You talked in your long written testimony about h. R. 1224, cosponsored, a bipartisan bill here. But we have expressed a lot of concern about the audit function that nist would be asked to take on. I was particularly fascinated by your points which we didnt raise when we had the hearing here that it would make it much more difficult for nist to be viewed as an honest broker, that this would change the perceptions about their current and future roles. And have a Chilling Effect on many of the relationships nist has within government and industry. A lot of these relationships are quoteunquote learning relationships based on a common quest to identify and incorporate best practices and this would change those relationships not in a good way, might inhibit or stifle the Free Exchange of information from public and private entities to nist. Can you expand on that at all . It seems to be a powerful argument against that audit function. Mr. Touhill im a fan of the legislation, section 20a in making sure folks are in fact using the cyberSecurity Framework across the federal government is brilliant. We need to follow through on that, big time. Frankly it was something i was promoting while i was the United States chief Information Security officer. As a matter of fact, my last federal chief Information Security officer Council Meeting in january of this year, i proposed and we had a unanimous vote amongst counsel to do Risk Assessment based on the framework. That portion of the legislation im wholly supportive of. Section 20b, the proposal to do the auditing and compliance activities, i am also a fan of. I think its important that we do auditing and compliance. However, i do stand by what i wrote in the written testimony that i think that nist is not the best place to put that. It doesnt have the culture. It doesnt have the mission. It doesnt have the personnel. To do it as effectively as the existing Inspector General and auditing functions. From a practical standpoint, nist is a Great Organization that ive been working with for the last 35plus years. And the relationships that nist has is in fact as a neutral party that is on the quest to choreograph efforts to find the best ways of doing things. An auditing function or compliance function on the other hand is looking to see if you are in fact following the checklist. I think that if we want to have an auditing and compliance function, which i definitely think we should be doing, we should be giving direction to those folks that whose job it is to do that auditing and compliance function. And frankly, this is an operational issue. Inspector generals have always been in my book the folks that do performance inspections that are the ones that are going to help those commanders in the field in the military as well as the executives in the federal government. Do their job better and have better visibility into their risk posture. I believe we need to have the Inspector Generals and auditing functions currently in place be the ones who execute the intent of the committee and congress. Thank you, general, very much. Mr. Neino. Based on your testimony you should be a doctor, its filled with interesting things. Your threepart conclusion that the largest issues were, a, that organizations are too slow to adapt, b, that we have a vast Human Research shortage, and c, there are lit bill way of met rics to demonstrate return on investment, an you talk about creating a method to prioritize threats, Something Like the Richter Scale, magnitude in a clear and repeatable scale. Who should put this together, who should manage it, who should maintain it, how do we make this happen . Mr. Neino i think it would be interesting to see nists participation in Something Like this, or basically crowd sourced but various commercial and private entities to see how their prioritizing how theyre prioritizing risks and threats and see if that could be put into some sort of simulation system that allows it to be scalable, where people as a resource, is not scalable, technology can be. That would be an effective area. Technology can be and that would be an effective area. And i see the commercial sector alone can produce that as well and that could be adopted. But i think any time you have some sort of regulatory mandate that is taken much more seriously. What i mean by that, if we had an event that was measured and put an arbitrary number with a 7. 5 magnitude, some arbitrary figure, shouldnt that particular event be required to be fixed by organizations . Mostly voluntary. With the water system or a power grid doesnt fix it, post, shouldnt we see that sort of mandate where we can know that is regulated because that has context versus you cant boil the ocean. We arent going to win that war. But we should be able to win the war. I now recognize chairman abraham. I stand on the brain cell on our panel and we could use a couple of those as we go through our budget process. Dr. Thompson, if north korea has a role in this virus exploitation, i find it ironic that it suppresses and uses a libly call name. My question to you, when news started spreading did nist take to ensure that Information Systems were protected and was nist involved in any government meeting that took place around that time . Thank very much for the question. The response for an event like wannacry, the primary goal as an institution that provides guidance is to learn as much as we can about the incident not the origin, but the technical origins and to determine whether the guidance that we issue is sufficiently robust to help organizations prevent this kind of attack. Im not aware of specific meetings that we were involved in that were discussing the operational side of the wannacry. I think the Law Enforcement and intelligence communities you heard reference to d. H. S. Being quite active in helping the private sector to deal with this issue. From our perspective its more learning whether we can improve the guidance we make available to entities to try to not only prevent these attacks but recover from them and to be prepared from them in the future. In your testimony, which i did read, you said nist recommendation in the nist guide cyberSecurity Framework would sufficiently address the wannacry incidents, will the executive order to agencies to implement the framework help them be better prepared in the future to prevent against these types of incidents and will this be enough or should more be done . Thanks for the question. Its difficult to know whether it will be enough for the next event. One of the important things that emerged in our discussions with the private sector in the development of the framework was the we are often thinking about detection and prevention of attacks. Sometimes we dont pay enough attention to response and recovery. And so one of the things that the framework does is to spell out the five functions to identify, respond and protect and we are providing with the guidance we provided. To help different organizations be better prepared to respond and recover. One of the analogies that i have drawn recently, the boy and girl scouts are right. Their motto is be prepared. And the better prepared an organization is prepared through its Risk Management activities, which we think the Risk Management framework from fsma coupled with federal agencies and under the umbrellas of the cyberSecurity Framework, we think those are the tools necessary to implement the kind of preparedness that organizations should have. What specific steps in lieu does nist take to help agencies be better prepared . We are looking at some of the consequences associated and some of the Incident Response work that we have. Some of the data integrity work. We launched the integrity project. It has a very strong tiein with attacks. We launched it before the wannacry came out. We are accelerating the work thats going on so we hope to be able to provide very practical guidance or practical examples of how to be prepared so that organizations can see how its done. Thank you for your service to the country. I yield back. I recognize Ranking Member lipinski for his questioning. Mr. Lipinski i thank the witnesses for their testimony and all the work that you do. We are i think taking cybersecurity more seriously in washington although there is much more we need to do. Part of the problem is understanding what this really means and the impact it can have. We also need to make sure the American Public knows the significance of cybersecurity and what could happen. We know when we are dealing with cybersecurity that technology is part of the solution. What often merits is more that is personal behavior and organizational behavior. Individuals and Information System managers must regularly install security passes. Organizations prioritize cybersecurity for a quick response. These are social science issues. Another social science angle is understanding criminal and terror networks. Using that understanding to help inform our intelligence gathering and our Cyber Defenses. I would like to hear from each of our witnesses your thoughts on whether we are investing enough in the Human Factors of cybersecurity and what more would you like to see us do so we are taking care of these issues . Thank you, mr. Lipinski. I think it is a great point that you bring up. There are other issues other than technology at play. Cybersecurity is hard. One thing that we know will be quite difficult is resources, resources to fully maintain their need for quite some time and technology is evolving. Systems are changing. We have to relearn our resources and people. This makes it very difficult for those responsible in those areas to manage risk to actually keep up with the actual threat, the pragmatic threat, not just the way we measure our own threats. In that case, i think we could see a huge value if we were to see investments in things that allow for threat prioritization, again going back to the event magnitude. You cant boil the ocean but look at the areas that can hurt you the most and the people that hurt you the most. And we will have a better chance of being more resilient. I would like to talk with r about two nist programs. I dont want to comment. And i have seen people saying it was china and others saying it has been people. Im not an expert in intelligence. Mr. Higgins when Security Software design, how easy is it to build a back door access that would be virtually undetectible within that cyberSecurity Software . We have seen that a multitude of times and seen it from a variety of areas. The level of entry to do that is very low. Mr. Higgins thank you for concluding that, my question to you Brigadier General. Thank you for your service. Are you familiar with the labs out of moscow, manufacturer of cybersecurity products. A long list of cybersecurity products that top intelligence officials at the f. B. I. , c. I. A. , n. S. A. And others advise this body that they dont trust the lab, and will not use their product on their personal devices. However its still used widely across the United States government. Can you explain that to this committee . I dont know what kind of conversation my colleagues from those agencies had with this committee. However, as i go and take a look at the different products that are in the market today, i believe the American Products are the best ones out there and just on a value proposition, i buy american. Mr. Higgins i concur. Thats the Brigadier General speaking right there. Thats an american speaking, sir. Mr. Higgins let me say, although there is no public evidence of collusion between the labs and the russian government, it is not a large leap. And eugene has suggested that his products have no ties to the russian government. However as part of the national conversation, mr. Chairman, and its widely known that the russians have been involved efforts to influence governments across the world with cyberattacks and he has suggested that he would testify before this body and i suggest that we take him up on his offer. I would like to talk to him regarding the tail switch. The kill switch in north korea. That having been rather glaring error on the part of the designer that that worm cyberattack, what do you think should happen to that guy in north korea . It was a kill switch, wasnt it . This message should it get to any of the cyber experts in north korea, if you can get out of the country, you are welcome in the west and would love to have you before this committee and give you some real good food. Mr. Chairman, i yield back. I now yield to congresswoman esty. Ms. Esty there are a couple of points i want to return to and drill down on and one is the Human Element because it is important because you can buy all the great equipment in the world and if you leave the door open, it doesnt do you any good. And i think a little bit about the analogy in hospitals about people washing their hands and it may be low tech, but it works. But one thing we have to emphasize, hygiene. What are proper hygiene practices. And how we make that standard operating procedure. Government and nongovernment. We have an issue in the federal government in particular, in all levels of government of really old systems and look at the fact this was exploiting a vulnerability. Who is using this systems . It is local and state governments who dont have any money and they are still using these old systems so that makes it an even greater issue. Your point about threat assessment, we knee triage help threat assessment, we need triage help to recognize what devcon level is this. Defcon level is this. Everybody gets those notes on those phones and i dont have time to upgrade my system. And thats the reality. I suggest a couple of things. We ought to be social media experts to your point, dr. Thompson. That means to part of what nist is doing. Stay ahead of the game. We need to do it. We had a briefing where some of the folks from the top level of the private sector talking about how our emphasis has been the incentive for us to be on attack mode. We are developing our attacks. We have left it to the private sector. Obviously, we need to be doing more defense. How do we incentivize it. It is less sexy and what can we do to the cultural change . Is that out of nist to put the incentive there and make sure we are getting the broader sector talent pool. It may not strike people bringing in people who do snapchat for figuring out how do we make sure people dont click on that link. If we dont do that. If we look at the hacking on the electoral system and last year with John Podestas email. And going to be the strongest and weakest link at the same time. Anyone who has thoughts that is what happens when you are at the end of the hearing and batting cleanup and raise a number of issues. Thank you for your efforts and in joining with us and figuring out how to do better for america. Ill make two quick points. We have active Research Going on now under the program we just talked about, trying to understand susceptibility to phishing attacks and what are the factors of people not recognizing it is a fishing attack. Phishing attack. With regard to culture change, it is going on in board rooms and among c. E. O. s in light of the framework as a catalyst for this, but i think this might have been on their radar. But the framework is a means of cataloging the understanding of board rooms and c. E. O. s managing risk to financial reputation and business Operational Risk and all the other risks that you are managing as a c. E. O. , you now have the tools that you can use to incorporate cybersecurity risk into that entire Risk Management. I would like to pile on. The cyber hygiene, we all need to do better. And we work very closely with nist to help promote the National Cyber Education Programs that we have. And i think we need to do better on that. I propose that we probably need a woodsy owl. Lets get kids out there fully educated and bring that pipeline up. And we have been working with nist and across the agency to do that. We need to incentivize. We should not be seen as the government who is here to help but not help but overregulate and need to encourage to do the right thing and buy down their enterprise risk. Risk is an intrinsic part of management of any business and we have to be careful we dont ham shackle the boards from actually managing their risk and need to give them the tools and support to be good wing men. And finally, we have had a lot of discussions publicly in this town over the last two, three, four years about who does what. As for me, having served in uniform for over 30 years and done some Public Service on top of that, it takes team work and i view the d. O. D. And n. S. A. And intelligence communities mission to help us with deterrence and interdiction and stop them and take the fight to the bad guys but protecting Hometown America that is more appropriate for d. H. S. To cor yeoh graph different activities across the federal government. The kinds of folks that are the practice of security is changing very much because of that. I think about the folks we hire at symantec as an example. The kinds of folks that are hunting the malicious Networks Today arent just computer scientists and experts but computational linguists, psychologists and and flow poll gifts and people who are looking at the Human Behavior of an attacker group. Thats one side. On the consumer side, which seem to ignore, we spend an amazing amount of time thinking about how do we make security similar to the ipad . And i call it the ipad because its the only piece of technology i have ever given to my mom and i didnt have to give her any instruction about how to use it. She just understood it. And we spend a massive amount of time now today on design. How do we make it intuitive and make it more secure than less secure . And that is where a lot of effort must go in in the Security Community today, how do we make it easier to be more secure than less secure. I was thinking as you referenced smokey the bear, maybe a new company, smokey the bear malware. I recognize mr. Palmer for his questions. Mr. Palmer accept our thanks that allowed the kill switch to prevent so many infections but with regard to your measurements, 200,000 infections is too low and before the implementation of the kill switch, there may have been one or two million infections. How do you explain practically no one tried to pay the ransom . The measure of success is hard to determine. Mr. Palmer i think there were some who try to pay the ransom. A largeyou have got is portion of the Companies Pay the rent by monitoring the bitcoin seems that less than 500 people did so. Thats 200ths of 1 . That is inconsistent what what you are saying. It is hard to associate the payments to the actual spread and ill tell you for a variety of reasons. When you look at the actual attack and magnitude of the attack and trace it to the payments, if you look to the mechanisms, not clear whether you would get your system back and at this point, the attacks have been abandoned. If you paid it, you didnt go anywhere. Most of the media and experts were asked not to pay the attack. What i can say the data we are receiving is absolute. Its not just one, but doing this close to a decade and we see analyzed data. It is accurate. Mr. Palmer i would like to address this question to the general and i would like to thank you for your service. Your testimony refers to people that people were running windows 95, but most infected was windows 7. The main reason people were infected was because a vulnerability was leaked to the public . Sir, thanks for the question. Just for clarity sake. I highlighted windows 95 being used as an exemplar, but there were plenty of operating systems that were susceptible including windows me, mr. Palmer im asking about Intelligence Community vulnerability that was leaked to the public. If we look at it from that standpoint, im concerned about that and this highlights a couple of things. We have been telling you all along to do that. Second of all, that as we take a look at the leakage of information or the attribution of leakage of information that is unacceptable. Mr. Palmer with regard to the patch, and that happened in january, 2017 and microsoft released a patch that addressed that vulnerability three months later. So it was not a problem. Seems out of date and if you hadnt put all the recommended patches on, all the machines within 60 days, you would become a victim. It was a zero day attack. There was no way to protect the computer from it. I dont believe i would characterize this one as a full zero day attack. From my perch, frankly because the fact that we had some patches and microsoft went through extraordinary measures to go out and create those patches for operating systems that had previously been declared unsupportable many years before and i used windows 95 in my testimony because windows 95 had been online for 19 years before it was retired. And for the last three years, microsoft had not been supporting it and for them to come back and put out that patch in march was extraordinary. And through federal government and other organizations around the world, we went out and we clearly communicated and Carnegie Mellon was one of them, communicated to the communities of interest, this is an important patch. Mr. Palmer i have one more question. No one was actually paying the rans omp m it was to allow access to machines. Thanks for your question. Its difficult to anticipate what the true intention was of this attack, whether it was ransomware. But what is interesting as a characteristic of the attack which i think goes back to your first question of why didnt we see the quote normal or expected rates of ransomware payment, it was very weak compared to the typical piece of ransomeware we see out there in the wild. It is incredible that these attacks have a very robust infrastructure behind them. They have almost the equivalent of Customer Support of people that have been infected with the ransomware and didnt see that level of sophistication on the back end. I yield to congressman webster for his questions. Mr. Webster thank you, mr. Chairman. Thank each of you for coming. My mind has been on Something Else and the statements that were given here were similar to that in that they fit. There was an attack yesterday and i thought about the fact that it was an advanced persistent threat and not only that, it was a personalized attack. And there are some people who acted heroicically to turn it around. And so i just that was on my mind. The Capitol Police service who protected life and heroic acts by members of this congress, maybe its a different kind of threat, but it was real. And in this case, there was no human error. And so i want to take this time i have just a few minutes and say thank you for our people who work here and for the members who serve here who prove there are still heroes in our country. So thank you, mr. Chairman. I yield back. We have a couple of more questions and go for a short second round. I yield myself five minutes. You note in your written testimony that the national vullingnerkt data base that nist maintains and updates dozens of times daily of all known and publicly vulnerabilities that vullingnerkts were exploited. A recent report notes 75 of the vulnerabilities were disclosed elsewhere first and takes seven days between the discovery of a vulnerability and reporting. What is the reason for the delay there if you talk about that and is nist working to get rid of that lag time . Thank you for the question. We are interested in trying to shorten time to deliver Important Information to our stakeholders. Our goal is not first to disclose or first to disseminate although we want to do it as early as we can, our real goal duration, accurate curation, including assessment of the impact that a vulnerability might have and that requires a certain analysis before we can include something in the National Vulnerability data base. The disclosures are often from sources that are not necessarily reliable. Was there a delay in reporting the vulnerability that the want to come across the wannacry exploited the i believe it was a matter of days. General, you were the first chief Information Security office. You to best position last september under the Obama Administration . Yes or. Yes sir. You believe the government should have this position. I know the Trump Administration any reason why you left at the time that you did and whether it will be refilled . Thank you for the question. I believe this is a best practice to have a chief Information Security officer in different organizations. The first chief Security Organization was created in the private sector 20 years ago and took 20 years for the federal government to create one. I think it is important as part of an Enterprise Risk Management approach that you have someone who is focused on Information Security and the risk to the enterprise and advising the Corporate Community as it were, up, down and across as far as what those risks are and best practices to buy down and manage that risk. We still dont have an authorization for a federal chief Information Security officer in statute. It was my position was appointed because the Cyber Security do something that we as directed. You never know who the attack is and focusing on that doesnt solve the problem we are vulnerable. You leave the door open. There could be thousands of people who walk by your house everyday. Would it matter because you leave yourselves exposed . They do it because they can and should not make it that way. We should make it so we are resilient and strong nation in regards to defense. Do you want to pile on at all . I do. We dont look at who is the country behind it and who is the person behind it but it is very critical of us to associate patterns of behavior. It will let us learn more about that group and the tactics and make us better prepared to protect against a new attack sight unseen and that was the case with a. V. Engines because of previous training on this against the Wannacry Malware and leave it up to the Intelligence Community to decide who that group actually belongs to. Mr. Lipinski, any followup questions . Mr. Lipinski i thank the witnesses for the testimony and all the work as i said and im sure we will be continuing this discussion. So thank you. In closing, i want to thank all the Witnesses Today for your important, insightful and impactful testimony. And as our committees looks to cybersecurity and the issues of National Security, economic vulnerabilities, privacy, we look forward to work with you on those issues and appreciate you taking time out of your busy schedule to be here today. And the record will remain open for two weeks for additional written comments and questions from members. At this time, the hearing is adjourned. [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy. Visit ncicap. Org] [captions Copyright National cable satellite corp. 2017] conversation] interior secretary testifies today. He will be before the Senate Energy and Natural Resources committee at 10 00 a. M. Federal communications commission, we will hear from commissioners. They are testifying before the Senate Appropriations subcommittee on Financial Services and it gets underway at 2 30 p. M. Eastern. Recently on cspan, new orleans mayor on the removal of a robert e. Lee statue. Lay out thely reasons why the statues were erected in the first place. Why we were taking them down. And how we could recover from the hold battles that have divided us for so long. And because of new orleanss role in that dark time. We were one of the countrys markets. Lave i felt that i and other people in the city had a responsibility to help the nation move through racial discord. Announcer actress mira skill hargitay on a task force for ending sexual violence. Words like dehumanizing. These lives derailed. The way lives go off track. These are not kids sitting on ace a show. These are kids sitting on a shelf getting derailed. Children getting derailed. What is life supposed to be . Cannot even make sense of what we havening to me and been letting perpetrators go by and saying weese do not care about the issue. We will discuss something even more important than the and arms sale. We will discuss whether or not we should be actively involved with refueling the saudi planes, targets, with having advisers on the ground . Should we be at war in yemen . Announcer cspan programs are available at cspan. Org, on our homepage, or by searching the cspan library. 42 decision on monday, the Supreme Court ruled that undocumented aliens cannot sue the government for civil rights approval fromout congress. It did however detainees were allegedly subjected to harsh conditions including sleep deprivation in frequent strip searches. This oral argument from januarys just under one hour. Morning,rgument this