Flaw found in Office encryption

TalkBack 1 of 55:

Next »

• Thread View
• Flat View

'unstated ability to get access to systems'

From Transcript of Internet Caucus Panel Discussion on Encryption, Statement of Congressman Curt Weldon
http://www.techlawjournal.com/cong106/encrypt/19990928a.htm#weldon1
QUOTE
Schwartz: Congressman Weldon, thank you very much for being here. Do you have any questions.

Rep. Curt Weldon: Thank you. Let me see if I can liven things up here in the last couple of minutes of the luncheon. First of all, I apologize for being late. And I thank Bob and the members of the caucus for inviting me here.

Pardon me if I seem a little bit confused to our panel, but, I am, and have been, with the change in direction which has occurred. But before I begin, let me say at the outset one of my biggest projects for the past four years has been to build what is becoming the first smart region in America, linking up all of the institutions within a four state region -- Pennsylvania, Delaware, New Jersey, and Maryland -- _____. In fact, over the weekend, I hosted the Minister _____, who is the Minister of Information Technology for Malaysia. As we signed an ____ with them for uplink downlink ties between our hub initiative in the four states, and the new Malaysian super-computing corridor project that they are building in Malaysia. So, I am a strong advocate for the use of information technology.

But my other hat is to chair the Research Committee for National Security. And when Bob introduced his bill three years ago, my door was pounded incessantly by the Defense Secretary and his staff, by the Director of the CIA, and by the head of the NSA, and I would note for the record neither the CIA nor the NSA is here today.

Who is actually speaking for them today, I might add? OK.

NSA and CIA came in, and in a very intense way, lobbied me personally, and I am not a computer expert, nor am I a lawyer, and they asked me to give access to my subcommittee and the full Armed Services Committee to look at the security implications of the change in Bob's legislation. I respect Bob. I think that he is an outstanding member. But I felt that I owed it to my committee, and my responsibility to Congress to listen to what the administration was going to tell me.

We arranged a series of classified hearings and briefings. And, as with any Member of Congress expressing concern about the ability for our forces involved in a hostile environment to be able to respond quickly, ____ back to 1991 in Desert Storm where my understanding is that our commanders in the field had Saddam Hussein's commands before his own command officers had them, because of our ability to intercept and break the codes of Saddam's military. I want to make sure that we have that capability in the future. I responded in a very positive way to the argument that was being made by the CIA, by the NSA, and by DOD. And we took some very tough positions.

In fact, Ron Dellums and I offered the amendment last year that had only one dissenting vote in the House, and this year passed by a vote of 48 to 6.

In the past year none of those briefings have changed. And the people who have come to me as a Member of the National Security Committee, there has been no lessening of their impression of the threat. Yet all of a sudden I am told, and John Hamre, I think, he made the courtesy of calling me in advance, that there was a change.

Now, I agree with the gentleman from the White House, for the administration, that it was coincidence that this happened the day before Vice President Gore went to Silicon Valley. I agree that that was just a coincidence.

But the point is that when John Hamre briefed me, and gave me the three key points of this change, there are a lot of unanswered questions. He assured me that in discussions that he had had with people like Bill Gates and Gerstner from IBM that there would be, kind of a, I don't know whether it's a, unstated ability to get access to systems if we needed it. Now, I want to know if that is part of the policy, or is that just something that we are being assured of, that needs to be spoke. Because, if there is some kind of a tacit understanding, I would like to know what it is.

Because that is going to be subjected to future administrations, if it is not written down in a clear policy way. I want to know more about this end use certificate. In fact, sitting on the Cox Committee as I did, I saw the fallacy of our end use certificate that we were supposedly getting for HPCs going into China, which didn't work. So, I would like to know what the policies are. So, I guess what I would say is, I am happy that there seems to be a comming together. In fact, when I first got involved with NSA and DOD and CIS, and why can't you sit down with industry, and work this out. In fact, I called Gerstner, and I said, can't you IBM people, and can't you software people get together and find the middle ground, instead of us having to do legislation.

But I am not convinced that what we are doing here is necessarily logical. And I am not convinced that all of us, in fact, have the same understanding of what it is that you are coming out with in terms of a new policy position. And I guess we won't know that until the terms of the December 15th regulations are spelled out, and then we can debate the fine points, which is part of what Bob's question alluded to today

I don't want to hurt industry. In fact, I have advocated that we give significant new tax breaks to the encryption and software industry in this country to give them more incentive to stay in America and do their work here. But, I am also, as a senior member of the Security Committee, as a Chairman of the Research Committee, to seeing 47 billion dollars a year of our tax money going to Pentagon's IT systems, I want to be absolutely certain that in terms of our ability to deal with intelligence overseas, to be able to have information dominance overseas, to be able to use the kinds of tools that the CIA and the Defense Department needs in adversarial relationships that we are in fact providing that through this new policy.

So, I guess the devil is in the details, the proof is in the pudding, and I am going to withhold my support for what you have done until I have seen the details that you are supposedly going to review for us on December 15.

My question is also why wasn't the head of the NSA and CIA invited to appear? Was that the panel? Or, was that the decision of the administration?

Jerry Berman: [He said he invited the administration to send whoever they wanted.]

Weldon: My only question is, since, the administration used the CIA, and the NSA, to come to me as a Member of Congress to argue their position for the past two years. I would like to have had the NSA and the CIA here at the table so I could ask them the same questions that I am posing you. And I am not going to be happy until I get that opportunity.

______?: Congressman, we will make that opportunity available to you.

Weldon: I think it should have been done though in a public forum.

______?: Thank you.

Swire: Just one small, in the announcement on the 16th that Deputy Secretary Hamre spoke for Defense and national security, Attorney General Reno spoke for Justice and law enforcement. Secretary Daley for Commerce. I was asked to speak on privacy, as a representation of important goals that we were trying to meld together for this overall policy.

Weldon: I understand that. And John Hamre told me that when he called me a of couple of days before the announcement was going to be made. My point is, that when the administration wanted people to carry their water up on the Hill, they sent the head of the CIA and the head of NSA to see us personally. They did not have John Hamre do it. Although John did part of that. And I think that we should be hearing from the CIA and NSA directly because they are the people I am concerned, in terms of being able to break into systems of foreign adversaries, of both real and potential adversaries. I want to hear from them.

And I think we owe it to the public, as we have had an about face in this policy, and that is what I think that it is. I want to hear what has changed, and whether or not they are satisfied. Once again, I am not an information technology expert. I am not a lawyer. But, I want to hear from them. I want to get them to look me in the eye to tell me they are satisfied, and they are satisfied because what we have done here is consistent with their ability to provide the kind of level of security that we need in the future.

Wells: If I could say Congressman, one of the piece of the rollout was that the national security community will need additional tools. And, we look forward to the Congress to support that with appropriations.

Weldon: And we will do that. We have given, for the past five years, more money for the issue of information dominance in our defense bill, than the administration's request in each year. In fact, both ______ and John Hamre have had full and unequivocal support for all of their needs, as well as the needs of the CIA and the FBI, I mean the CIA and the NSA.

Schwartz: Congressman, I didn't really think we headed off into dull before, but when you said you were going to liven it up, you sure delivered on your promise.

UNQUOTE

Posted by: David Mohring   Posted on: 01/20/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now