terrorist organization. it's dedicated to eradicating israel and killing jews. but the timing, the timing of the october 7 attack was very closely aligned to when a final next step in saudi-israeli reconciliation was about to move forward. they have been determined to prevent peace. there is a way forward whereby hamas may be eliminated from having any role in gaza and the west bank and in the future of the region by a regional cooperation which could be facilitated by achieving peace. and that is also much to be and that is also much to be >> the house will be in order. >> this year, c-span celebrates 45 years of covering congress like no other. since 1979 we have been your primary source for capitol hill. for balanced, unfiltered

coverage of government. taking you where the policies are debated and decided. all with the support of america's cable companies. c-span, 45 years and counting. powered by cable. >> data security executives testified before a senate commerce subcommittee on protecting consumer data against unauthorized access. they offered recommendations such as stronger authentication methods and the establishment of a federal privacy protection standard. this is about 90 minutes.

>> welcome to the subcommittee on consumer protection and security. we will come to order. senator blackburn is en route. we're at a pivotal moment in the age of technology that rely on amounts of consumer data. artificial intelligence has got then lion's share of publicity but that's nowhere near the limit. businesses collect or process data ranging from personally identifiable information, name, address, likeness, as they say these days. obviously sensitive data, browsing history. the threats to consumers' data

that companies face is complex and in almost every way, daunting. as companies collect more data, they become more attractive targets for data breaches. and by that, i mean criminal activity. each breach costs companies nearly $4.2 million per incident. consumers shoulder the financial burden and reputational harm of each incident. as more consumers -- how many more consumers need to be victims before we take action in how much longer should we allow data to be sold on the dark web for profit? when will cyber criminals be stopped or deterred from preying on our data. this data reaches -- breaches hurt small businesses, large corporations and everything in between. in 2023 alone, there were 3,205

data breaches in the u.s. that's what we know. 3,000 individuals who were severely impacted, 10% of publicly shared companies reported a data breach impacting in total 143 million individuals. these data breaches can have devastating effects nationwide wireless carriers breach exposed the data of 70 million customers. a large health insurer was recently widely reported saw their system grind to a halt which delayed important health care payments, exposed critical health data. this is why we need more protections for data.

we need a strong national standard that include data minimization and security. establishes specific categories to turn off the spigot of data for the -- so that -- data that companies collect from consume, so companies aren't just checking everything they can. we need to establish requirements for how companies safeguard the data they do collect so breaches are less common. we need to give consumers meaningful control over how their data is used and restore consumers' confidence in the technology that powers our economy. i think states clearly are not waiting for the federal government to act. already 16 states including colorado have passed their own state privacy laws. other states are talking about it. excuse me. there are lessons to be learned

from state laws. colorado has a temporary right to cure for businesses to comply or adapt to privacy requirements. the federal government has to step in and issue rules and apply enforcement. a consistent definition of key terms like sensitive data or to issue nationwide rules. the draft of the america's privacy rights act is an important bipartisan framework for us to build on. i commend members of the house in their efforts to bring this forward. we are committed to listening to all perspectives on data minimization and security. minimization and security are obviously interconnected, interrelated. together they represent the foundation of a strong data privacy framework upon which we can build. we have an opportunity right now and obligation right now to build meaningful, bipartisan

consensus around these complex issues. that's why i look forward to the hearing today and to our witnesses. i'd like to welcome each of our witnesses who are joining us today. james lee, chief operating office from identity theft resource center. dan kaplan, assistant general counsel of pala alto networks. and jake parker, senior director of security industry association. i now recognize our ranking member, our vice chair, senator blackburn, for her opening remarks. mrs. blackburn: thank you, mr. chairman. welcome to each of you. apologies for people kind of coming and going. we have a 2:30 vote that ended up getting called. but i am -- i know chair cantwell and ranking member cruz are on the floor right now but i

am appreciative that chair cantwell has brought privacy back into focus. and crews are on the floor. i'm appreciative that the chair has brought privacy back into focus. i've worked for over a decade for congress to take action in this area. and when senator welch and i were on the house energy and commerce committee, we brought forward the data security and breach bill. it was the first of the bills and it was bipartisan. it would take steps to protect the security of data from businesses. it would've required consumer

data breach notifications and allowed the state attorney general to hold companies accountable for violations of the law. that is where we were in 2012. and as we now know, this issue grows more and more urgent every single day. the need for the swift adoption of smart and effective data privacy and security legislation is pressing for several reasons. china and other bad actors are not slowing down. the fbi director was before us at a judiciary committee meeting and he said something significant.

he said if you are an american adult, it's more likely than not that china has stolen your personal data. he also said china's fast hacking program is the world's largest and they've stolen more american's personal and business data then any other country combined. we need to be paying attention to this. china seeks to become the world leader in artificial intelligence. consumers have valid questions about how their data is going

to be used to train these large language models. i hope today that we will discuss why we need federal privacy and security legislation to combat these threats. second, congress has passed the point where he risk giving up our authority to states and other countries. state governments are quickly enacting privacy laws creating a patchwork of regulatory headaches for businesses. 15 such laws exist, including tennessee and colorado. the europeans have beaten us to the punch. several years ago they did gdpr. they are using it as the foundation for regulating ai.

yet we can use the eu as a cautionary tale about the need to make a regulation smart and effective. i visited there last year and i heard stories from one of their data protection authorities about how they have been asked to resolve disputes over bank accounts after a couple divorced or how to resolve a dispute between neighbors about the location of an antenna. so let's not make these same mistakes and not overreach. we know the europeans have a heavier handed approach, which makes it more imperative that we act in a thoughtful manner. more without congressional action, the ftc will proceed ahead with their commercial

surveillance and data security rulemaking, which it launched in 2022 without congressional authority. congress should be setting these rules, not elected bureaucrat. finally, while this hearing will feature much discussion on concepts like data minimization and other practices, we must not forget about the cyber security threats posed by new and emerging technologies. one area of great interest to tennessee is quantum technologies. through methods like harvest now and decrypt later, once bad actors steel encrypted data today, nothing can stop them from decrypting it tomorrow. that is why this committee must with quickly to examine this and reauthorize the national

quantum initiative act. i would love to work on this with our chairwoman and the team here. tennessee is a leader in financial nfh and in technologies like quantum computing. and the oak ridge national lab is at the forefront of basic and applied science research. when i speak with people in the state they ask how we can best tackle privacy and data security issues while also continuing to allow innovation. this committee must be thoughtful in our approach but mindful of the realities the congressional calendar imposes. i look forward to our discussion today and i appreciate the testimony from each of you. >> now, we will hear opening

remarks from each of our witnesses. the term witness gives a false sense of insecurity, perhaps these days. we will start with tran nine. >> thank you, mr. chairman. i'm james leave and the chief operating officer of the identity theft -- just so everybody knows the core of our business is to provide ice assistance to those who are victims of identity crimes and we do research and analysis on trends that we make available to the public and private sector. a lot has happened since we were in this room and 2021 to talk about this subject. we've seen bad actors shift their focus and we've seen them accelerate innovation attempts.

we may be at the beginning of what is the golden age of identity crime. it's fueled by stolen personal data, made effective and efficient by ai with individuals and many businesses helpless to defend themselves. why do i say that? we give you a scope of the problem. data breaches are the fuel for identity crimes. and a fair portion of cyber attacks thanks to stolen log- ins and passwords. the total number of data compromises with 3205. it impacted 353 million people because some people were hit more than once. that is a 78% increase from the year before. it's a 72% increase from the previous high which happened the last time we had this hearing. from a financial standpoint, more than two thirds of the people who contact the itrc are

losing more than $500. within that subset 30% of them are losing more than $10,000 and we routinely hear from people losing's six and seven figures. the most troubling trend is people that decided that their only way out is self-harm. 60% of people who contacted us that they contemplated taking their own life. for decades before that, that number was never higher than 2 to 4%. now 16% and we do not see it slowing down. we now hear routinely from families who are still being attacked by the identity criminals who try to keep the scam going. we do not advocate one where the other for legislation, but we provide information.

we are still the same place we were the last time. the best way to help victims is to prevent victimization in the first place. an important part of preventing that is three uniform minimum standards for data protection. and technical and non-technical standards are essential in a world driven by software and data. compliance with comprehensive but not necessarily prescriptive minimum standards can reduce the risk of exploitation and they are more than just metrics. they are practices like data minimization, which is a concept predicated on a simple truth. if you don't have the data, you cannot lose it. and if it is secure, it cannot be misused until we get to quantum computing. routine risk assessments help ensure information systems are

secure in a manner equal to the risk. that is important. equal to the risk that an organization faces. you have privacy by design and security by default. and have all the tools needed to keep private he privacy and security at the forefront of their culture and every stage of a product's life. to be effective in reducing identity crimes, uniform standards need strong enforcement and defenders must measure progress and constantly adjust to the new task and you do that through audits. there also strong enforcement actions when it comes to data breach notices were increasingly ineffective. even if he noticed his issue. the first three months of this year 32% -- 32% of data breach notices had some information about what caused the date of breach.

reverse that number and it tells you how many did not include information about what happened. that number was 100% of data breach notices until the fourth quarter of 2021. the average number of new data breach notices in the u.s. is nine per day. in the eu, 335 every day. we are missing notices. let me leave you with a final thought. if we adopt data minimization, and if we give consumers more access and control, it's a vital part of data protection. they can significantly reduce the amount of personal information at risk of a data breach and misuse by criminals. personal information used responsibly is important for proving a person is who they claim to be from opening a bank account to applying for

government benefit. but they prevent someone from becoming a victim of identity fraud because of stolen personal information. restricting the use is part of consumer control or data minimization could have the unintended effect of aiding identity criminals and negatively impacting communities that are disproportionately affected by identity crisis. thank you for your time and i look forward to your questions. >> mr. kaplan, the assistant general counsel at palo alto networks and has spent a considerable amount of time in colorado. >> thank you, senator. thank you for the opportunity to testify on how cyber security is a critical and foundational element of data security and consumer protection. my name is sam kaplan and i'm

the assistant general counsel for public policy and public affairs at palo alto networks. i spent the bulk of my career working at the intersection of national security, data privacy, and i was proud to serve a number of positions across the federal government to include the dhs chief privacy officer. and at the u.s. department of justice. we were founded in 2005 and has since become the leading cyber security company. this means that we have a deep and broad disability into the cyber landscape. we are committed to being a cyber citizen and a trusted partner of the federal government. it does no question that they

cause disruptions to our regular lives like healthcare or emergency services to compromises of americans sensitive data. with that backdrop, palo alto network strongly believes that deploying cutting-edge cyber security defenses is a necessary enabler of data security and privacy. the bottom line, effective data security and data privacy requires cutting edge cyber security protections. organizations should be encouraged to protect data by implementing robust data and network security practices that can both prevent incidences and events from happening in the first place and mitigate the impact should an incident occur. to stay ahead of the evolving threat landscape, professionals regularly leverage security data, which is the network

telemetry. the ones in the zeros. the malware analysis. the ip address. we must ingest and analyze in real time to optimize cyber defenses. to that end, we are heartened to see cyber security generally included in frameworks that companies like ours can use to collect, process, retain, and transfer security due to two in turn better protect those systems and data from compromise. today's landscape requires that approach and everyone's personal privacy will benefit from that framing. to that end, panel alters networks focus on the following actions to bolster their cyber resilience and increase their data security posture. first, leverage the posture of a.i. and automation. for too long, cyber defenders have been inundated with alerts to triage manually, which can lead to data breaches. a.i. can help flip this paradigm. second, ensure complete and

identify and mitigate vulnerabilities before they can be exploited. third, implement a zero-trust architecture to prevent and limit an attacker from moving laterally across the network. fourth, promote, and secure a.i. by design, and assist with a.i. usage, commit policy controls, and ensuring applications are built with artificial intelligence. fifth, protect cloud infrastructure and applications. as cloud adoption accelerates, cloud security cannot be an afterthought. sixth, maintain a response plan to prepare for and respond to cyber incidents. artemi pill alto networks is dedicated to securing our way of life. we enthusiastically participate in a number of forums and share our situational awareness and

understanding of the threat landscape with those key partners. our collaboration reinforces that cybersecurity is truly a team sport. thank you again for the opportunity to testify and how cyber security is a foundational requirement of data privacy and i look forward to your questions. >> thank you, mr. kaplan. i will now introduce tram trivedi. >> ranking member blackburn, members of the committee, thank you very much for the opportunity to speak today. i am tram trivedi. a nonprofit and nonpartisan organization dedicated to realizing the promise of america in an era of rapid technological and social change. since 2090 open technology institute has worked to ensure every committee has an access. we have long emphasized the need for strong federal

standards in privacy and data security while retaining sufficient innovation. that takes me to my point. data security and privacy are two sides of the same coin. strong safeguards are vital to protecting consumers. and data minimization as you mentioned in your marks a powerful principle that requires collecting, using, sharing, and retaining only the data necessary to provide a service or product. and safeguards are urgently needed in this era of a.i., training many a.i. models which requires using huge data sets. as company's race to acquire more data, the pressures to adequately protect and keep increasing so a baseline standard on data security is essential to ethically and essentially regulating a.i. development. and i will add cybersecurity practitioners also recognize benefits go beyond consumer privacy because it can reduce

threats posed by breaches and other security incidents. in short, companies cannot misuse data that they have in hackers cannot steal data that companies don't have. my next point is that research shows that americans want strong data security and migrations. and americans know that all my data collection and tracking of their activities is pervasive. that is probably why 75% of americans lack confidence that a government will hold a company accountable if they misuse their data and all this concern about data security and privacy is negatively impacting consumer trust in a.i. and in leading a.i. companies, many of which are u.s. companies, small and large. the good news is that more than two thirds of republicans and democrats secure more legislation of companies and we are heartened to see the recent re-emergence of an incredible bipartisan legislation for the

privacy rights act. the next point i like to make is that a strong federal data regime would approach on notice and consent along. we know it would take people hundreds of hours to read all the privacy policies that they encounter in just a year and most americans -- even most privacy professionals -- sponsor this unfair burden by clicking on agree without reviewing those policies. this is that meaningful notice and it is not meaningful consent and is not clear that most is achievable in most of our online activities. data minimization is important because it shifts the responsibility to use only what the companies need to provide products and services. and i want to point out this is far from a new concept in law or corporate risk playbooks. so i think we can get the benefits without overburdening smaller companies. and the last main point i would like to make is that a broad set of best practices in data

security should become baseline safeguards across all sectors of our economy and here's a short list of those best practices. first as i have emphasized so far, collect, use, and retain only data that is relevant. second, whenever possible, use encryption to properly store and access data. third, placed on consoles so that only people who should be able to access data can access that data. fourth, you strong method for authentication including multifactor authentication. fifth, further study and standardized uses of technologies. and six, routinely assess and mitigate against data vulnerabilities. something you have heard from other witnesses as well. there is no such thing as common data security but these should be in federal law if applied flexibly enough to account for different company sizes and technical capacity. in conclusion, data protection is consumer protection, and we need a national legislative

framework that incentivizes responsible data stewardship. continued u.s. leadership on a.i. requires congress to address the consumer trust gap. and we appreciate the committee's bipartisan leadership on data security and privacy. thank you again for the opportunity to testify before the subcommittee. i look forward to your questions. >> thank you very much. we now go to mr. parker. you are the senior director of securities. thank you for being here. >> good afternoon. thank you for the opportunity to participate in today's hearing. security industries association. a nonprofit trade association representing more than 1500 companies to provide products for protecting lives, property, schools, and critical infrastructure throughout the nation. data security is essential to the operation of security systems and services in our members are committed to protecting personal data whether it is consumer or

operational data. practices like data minimization and security by design enhance many types of these products. for example, when it comes to access control of video systems, features like data encryption which we talked about here, permissions based access, decentralized data storage, device processing, and data deletion schedules also to limit the availability of data from potential use and limit the usefulness of data if it is compromised. another example that our members provide is the multifactor authentication and proofing services that are becoming essential to prevent identity theft and fraud as attackers become more sophisticated. these are provided by our industry, especially biometrics. they are providing higher assurance identification. it is not far more vulnerable by exploitation from identity hackers. there are increasing threats

that must be addressed. beyond technical standards, product features, best practices, and security tools, having the right public qualities in place will also address data privacy and security. there is a key role for those. colorado, texas, tennessee, and by my count by the end of this month, there will be a total of 19 states with active data security and privacy laws that account for almost half the population. however, having a uniform national standard could provide more benefits while further enhancing data security. a national standard is something our members apart. here in congress regarding the development of such a standard we are encouraged by the progress. and it is essential that data can continue to be utilized as needed for safety and security purposes. for example, our members are often the first to raise the alarm in emergencies. data helps law enforcement

another responders get to where they need to be as quickly as possible. and as i also mentioned earlier, there are many technologies used for authentication that will be essential to accomplishing the goals of the draft proposal that we are looking at in section 9 as mentioned earlier. so having a uniformed and workable national standard requires strong state and local preemption to avoid glaring additional requirements. this is really important to our industry. it also needs to limit risks of lawsuits which we certainly are seeing in some jurisdictions over privacy matters. and we need to make sure you accomplish those two objectives and what we put forward. so i appreciate you holding us here with your leadership and putting a spotlight on data security. now as an organization, we are doing what we can to our data advisory board for data

security and our industry as i outlined in my written statement. again, thank you for the opportunity to participate in my members look forward to working with you on these issues. >> rate. thank you all. i realize how busy you all are. some sacrifice. you have shared your data with us. let me start off with you. lincoln famously said with public sentiment nothing can fail but nothing can succeed. period states have established their own laws. it is soon to be 19 states that have passed their laws. and this is all about what types of data businesses can collect and how consumers should be notified. consumers can be better protected. i think businesses can more freely compete when there are clear and consistent rules, especially for small businesses this is essentially important.

so how do you believe a national standard for data minimization ultimately benefits customers and their privacy? have you thought about how they get the word out to them? how do we get that sentiment behind us? >> thank you so much for that question chairman hickenlooper. people know that their data represents the most vulnerable portions of their lives. would set uniform expectations for all companies which is something they have been clamoring for as well. and the kind of clarity in the regulatory environment is sorely needed because the u.s. just of my regime for data privacy and security is fragmented in ways that make consumers more vulnerable and then require companies, and perfectly burdensome for smaller companies, to develop complicated responses to state

patch works in the absence of clear national rules on the road. i would also add to your question about small business in particular -- many of these small businesses do not want to be's who bring out as much data as possible to run their small business. but because there are not strong flexible standards they may feel there is a disadvantage if they are not collecting as much data as possible. that puts consumers at risks and also companies at risk progressively data minimization approach that is common on the federal level help these companies do what they want to do which is be responsible data stewards. >> i agree and certainly hope you are right. a.i. has created a fascination with the value of all data and there seems to be a little bit of a race. minimization is not appearing as frequently as it had been since a.i. has gotten more and more currency.

mr. kaplan, on a bipartisan basis, congress passed the cyber reporting for infrastructure critical act to require critical infrastructure operators to quickly report cyber instances so we can understand the threat landscape as it changes. the ftc has also investigated changes that were unfair or deceptive in their data security practices after the consumer data was exposed. gathering and sharing information about specific ongoing attacks as well as the broader industry trends helps us establish defenses and prevent future incidents. especially obviously data breaches across sectors. so in your experience, mr. kaplan, which vulnerabilities do you think are most important to address in order to prevent criminals from accessing

consumer data? >> thank you, senator. that is a very great question. so in our experience and conveniently every year palo alto networks publishes a response report which provides an aggregate date summary of the key trends we have seen and how adversaries are looking to break into systems across the country. and in this past year, we found that internet spacing software vulnerabilities actually surpassed phising attacks as the primary attacks to take place. these are essentially opened doors available in public websites that have not been patched to updates and software and systems. as a result, the adversaries are able to leverage these with relative ease to gain entrance into these systems. in that vein, all vulnerability should be taken seriously, but the one vulnerability we have

noticed that is particularly troublesome is called a remote desktop vulnerable or a rdv vulnerability. this can put a mission of privilege into a victim's system to quicker infiltrate data. these rdv vulnerabilities will unlock the keys to the kingdom so they are of concern to our company. it is critical that we make it as difficult as possible through layered defenses and some of the best practices i have identified in my opening statement with regard to zero trust architecture to prevent attackers from moving laterally across the system and to close those open doors and have better understanding and visibility into your relative attack surface. >> and we will get back to some of that. that danger of anything like

this is we do call attention to these open doors. but it increases your commercial activity. i will turn it over to my vice chair, senator blackburn, for some questions. >> and thank you all so much for your testimony. and i appreciate getting your perspective on this. i want to start with gdp are. i mentioned that in my opening remarks. let me ask you, are each of you involved in some way in the eu? are your company's involved in some way in the eu? okay. you are trying to decide if you are or not.

as we look at this and as i mentioned our friends in the eu know that they went a little bit too far but companies already have these particles in place to meet the gdpr standard. so as you look at what they have done in the eu and canada has a lot in new zealand has a law and australia has a law all protecting their citizens in the virtual space -- mr. lee, start with you and just go down the line. what should be the lessons that we learned and what should we take away from the gdpr experience? just very quickly so i can get to my questions. >> the things they got right deal with some of the more technical aspects. making sure that you are having the programs that you need in place.

and that they meet the risk you are facing. so it is not a prescriptive necessary standard, but you have to assess and report. and when there is a data breach, you have to report that to the data authority for that country. >> so their assessment reporting mechanisms. usa they got it right. mr. kaplan? >> thank you, senator. that is a great question. i would say from a macro level the things they got right are sort of a uniform standard. regulatory complexity across multiple markets. it just increases cost and from the cyber security perspective, the resources that are dedicated to responding to incidents should be operationally responding to incidents rather than looking at regulatory -- >> i was going to say we need one set of rules for the entire internet ecosystem with one regulator. >> predictability and lessening regulatory complexity. >> that is one of the things.

isn't it, mr. trivedi? >> i think the first lesson is something highlighted which is moving swiftly to establish that uniform standard. i think that is something we should emulate. i think it is fair to say that gdpr is not strong enough towards data minimization. i think the united states could do it better. i think that gdpr gives too much preference to decide what minimization means and while we should have sort of a reasonableness and flexibility and a strong flexible approach i think there is an opportunity for an american approach that is different and works for us. >> okay. mr. parker? >> the instances on reasonableness and consent are similar to what a lot of states have done already. they are a little bit different than what the proposal we are talking about now at the federal level is. but just based on some feedback from members, there has definitely been an issue with

conflicting interpretations over time from the national data protection authorities within the eu that is causing problems for businesses or doing work across the eu in different jurisdictions. but also there is the potential is of any relevance for us that there is overlap between the a.i. act in the gdpr. and sometimes they may get resolved in one way or another and cause confusion. >> and digital marketing and digital services and some of the other overlap there. i want to go to the data minimization issue. and, again, just down the line, mr. lee, starting with you, what is your opinion of data minimization as a security principal in this debate? >> i think it has to be enter cool. if we are going to reduce identity crimes and have your

crimes, we have to reduce the supply of data that can be abused by individuals if it is stolen or even if it's just accidentally exposed. if you don't have it, you cannot expose it. >> okay. as you said, data breaches are the fuel. mr. kaplan? >> senator, from a macro perspective, i think data minimization is an increasingly useful principle, especially in lessening the attack surface for those companies that are doing business with consumer- focused data. to that end, we think there is legitimate and broad -- not broad -- but targeted purposes like protecting the information can be critical. but minimization can be an important role. >> so you would segment it? >> rx. >> mr. trivedi? >> i would say data minimization is a central part for the reason other witnesses

have highlighted. like when you're intentional about collecting only what you need. you cannot! trade or hack there in the first place. >> all right. mr. parker? >> i would say there is a difference between operational principle and policy principle. certainly from an operational standpoint, it definitely plays a big role in data security. and policy, there is a big difference in having a set number of purposes for collecting and processing data. it certainly could work. i know there are questions up there about future proofing this. will it be too narrow? will it cover what it does now? those are all good questions but certainly an interesting approach. >> okay. i have got another question i want to ask. >> ask your question.

>> i do. i wanted to talk about china. because we just enacted legislation for bytedance to divest from tiktok. and the data security threat from china is broader than just tiktok. and a more holistic approach rather than playing whack a mole is that the problem goes beyond apps. and we know that china issues drones and potentially routers to spy on americans. so how should congress approach the broader data security threat from china? and what do you see as a good policy solution? to this? mr. lee? >> i am just a humble victim

and advocate. but we do have to recognize that nationstates, maybe not for the same reason as professional criminals, they want the information and it is important that it is protected from whomever wants to misuse it for whatever reason they want to misuse it. china is certainly a nationstate that has great capabilities. we know that they have a lot of data about individuals for intel purposes. we have to assume there are other countries, friends and foes, that do the same. and approach for data protection needs to be universal in its approach to whomever is acquiring the information. >> mr. kaplan? >> yeah. the threat from china is something we are tracking every day on a regular basis. both the threat with explicating information to china but other belying nationstates looking to leverage data within the united states. as a cybersecurity company, we are focused on the networks and

information systems upon which that data relies. so broader policy sort of questions about how to deal more holistically with the problem may be outside of our purview. to that end, we would encourage strong cyber protections and encourage information sharing with the federal government like we enjoy and wrigley partner with. >> i thank you for the question. you're partly highlighting the ways in which data security and data protection have a national security dimension. we have been talking to consumer protection which is vital. we have been talking about consumer privacy. but this is not all happening within our own borders. there are a number of nations in competition with one another's data. the right policy approach at the top of the list should be establishing a federal data security and privacy protection standard. right? i think that is essential because it does all the things we have talked about.

>> yes. and certainly what is mentioned is establishing that standard in the federal privacy framework that we are talking about. you can go a long way to doing that. certainly internet-connected devices are a target for exploitation by nationstate actors. implementing, you know, certain encryption protocols. it is pretty important. protecting those specific kind of devices. and on a side note, there has been a large shift away from manufacturers in china and sourcing equipment there that could possibly have vulnerabilities. i would say in the commercial sector has been a near-complete move away from those sources. >> right. thank you. senator walsh? >> thank you very much. senator blackburn, it is always fun to see you continuing this work that you began when you're in the house. and it has only gotten more complicated. let me ask you a few questions.

about privacy for individuals. and then cybersecurity, which is essential for everyone. as you know, about 72% of americans believe there should be more regulation over what companies do with people's data. 67% report little to no understanding of how companies use their data. and 73% report they believe they have little to no control over what companies do. so there is a question about my data, citizens data, and what companies do, and there is the question about hacking into systems. and companies -- tech companies -- have a high self interest in doing everything possible to protect against hacking because it hurts them and their customers. i mean, where is the difference

in responsibility for protecting the system from being hacked? and i hear you saying there should be a national standard, and that national standard, what does that mean for small businesses that do not have the financial where to bear that burden? and how would those recommended protections -- how could they be integrated affordably, organically into systems that a small mom and pop business might deploy? and i guess i would start with you, mr. lee. >> thank you, senator. i guess -- let me work backwards. particularly for small businesses, this concept of the risk assessment is very important. >> they have to do it themselves? >> yes. because that is where they

understand where the risk is. you have to do x but you have no risk of that happening, there's no incentive. that is a time of their energy and money. but if you understand exactly what risks you are doing in your unique business based on the information you have from your customers, then you are meeting that risk as it is today and monitoring it to see what you have to do moving forward. >> let's say a small record producer in nashville is a new startup. i mean, for that person and business to be talking to customers about what they need and then being able to make the decisions to deploy -- that requires a level of sophistication that may not be the level of sophistication required to be a good record producer. i mean, a small law firm, let's say. i was in a small law firm for lawyers. we started small. we do not have the demands and

capacity to do what the major law street firms do. so what you are describing seems out of reach to me for the millions of small businesses we have. it seems that they should be just available. baked into what you by. >> that is actually the foundational step. it is the one size fits all approach which we have taken here before that has burdened small businesses but when you take a tailored approach that is specific to their business and specific to their data, then you don't have to do things that you which -- >> but the expense associated with that? >> it depends on which tool you're using. >> and me a ballpark. i mean, i am right about the small businesses having to deal with these massive impacts on their small-business. >> we have got representatives of the world's largest cybersecurity organization. but there are small mom-and-pop management services providers.

that is what they do. there are hundreds of them even in the national area. >> mr. parker, thanks. you mentioned future proofing, which makes a lot of sense to me. but one of the things i have found frustrating as a member of the house and now in the senate is we cannot keep up with all the changes and all the methodologies by which there is hacking. tonight, even those who are far more expert in congress on technology issues, senator bennet and i think that the time has come where we actually need an agency, a digital commission, much like say the ftc or fcc, that is properly staffed and properly resourced and has the capacity to keep up because if it is a one-off bill dealing with problem a or problem b, it is a very cumbersome and difficult process to get it all done in a

timely way through congress. do you have any wisdom on having such an entity that would have this ongoing challenge protecting privacy? and considering other issues related? >> that is a great question. i apologize. i don't have a great answer. but i know that obviously the state of california has done something like that. having a privacy agency. so i know the issues discussed here, there is probably the opinion that we have existing agencies that are playing that role. but i know what you're saying. >> well, mr. trivedi, you mentioned this should be a national standard. right? >> yes. yes. >> it makes sense to me. who determines what that

national standard is? >> i think that legislation would emerge from a number of stakeholders working together but i would emphasize it should be both strong and flexible to your point about how smaller businesses are able to comply. cannot have a small record store collecting potentially far left digital data. >> what what a national standard look like? strong and flexible makes a lot of sense to me. what you're saying i agree with. i agree with the practical way, a, to implement it, b, to change it. >> sure. thank you, senator. it is a very good question. i think there are some best practices i have listed out as near universal. some can set about an implement practices so that employees who don't need certain data can't access it. they can engage in data

minimization relative to their capacity. think hard about what they really need and don't need percolation to keep it because it is also a risk to them. >> the legislation has to determine that. unit asking individuals to determine that. right? >> there should be a strong set of practices but also flexibility and how businesses of varying sizes comply with it but there should be some requirements that are common. >> you have a template of what you think congress should pass? >> we have seen some credible bipartisan proposals. there is a good discussion on the american privacy rights act. i think that is a very promising proposal on the table today. but in terms of templates for how specifically small businesses can operate, that is something we should get back you on. >> i yelled back. >> thank you. now we have senator klobuchar. >> thank you very much, mr.

chair. thank you to the witnesses. i will just start out by generally saying that we need a national privacy law that creates rules and roads. i support the review of the discussion draft of the american privacy rights act. is privately the consumer should have access and control over how their personal data is being hughes. mr. trivedi, do you believe consumer should have the ability to access their data and control how it is being used by companies? >> i do, senator. i think access and control rights are very important to consumers. >> okay. thank you. mr. lee, and i'm having trouble hearing. i will just try my best here. mr. lee, we also need to educate americans on how to identify and react to cyber

threats. we know there are phishing schemes going on. senator kuhn and i have been introducing the american cybersecurity literacy act to educate the public on cyber security risks by requiring a cybersecurity campaign. can you talk about the importance of educating americans on how to identify and avoid cyber security threats? >> well, education is the key to so many different things and in this case it is a part and parcel of keeping people safe. one of the things we learned from talking to victims every day is, they are very curious about how to make sure it does not happen to them again. so having a comprehensive approach that is led by the federal government would be very helpful because we overall -- identity crimes do not support anyway because people think of them as victimless crimes. and trying to avoid that crime is even more difficult so education is going to be a key part of making sure that we are

keeping people safe in this increasingly dangerous cyber world. >> agreed. mr. kaplan, in just the past five months, we have seen significant data security breaches. obviously, united health group, at&t, microsoft, because these companies maintain large amount of data on huge swaths of the population, it can often affect tens of millions of people. and your testimony, you noted that large companies have twice the number of systems exposed on the internet than what they were monitoring. what complications for tech and consumer data arise from simply holding such vast amounts? >> thank you for that question, senator. yeah. holding that vast amount of data just increases sort of your attack surface and your vulnerability and that you a more likely target of sort of the malign threat actors and nationstates looking to divide

and exploit and pull out that data to make strategic use of it. with regards of the attack surface, this was one of the basic cyber principles that we also talked about. it is understanding what your internet-exposed attack surface looks like. understanding how many of the portals into your system are opened to the public internet and having visibility into existing vulnerabilities, mis- configurations, you know, not updated pieces of equipment or software exposed to the open internet that just give those maligned actors entrie into the system. so having visibility into the ecosystem and what the attack surface looks like to the attacker we think is a critical, critical piece on securing your infrastructure. that interest in knowing where your data is is only critical element of maintaining. >> you also noted in your testimony that united healthcare change data breach is likely to be the largest

supply chain breach, mr. lee. the largest supply-chain attack in history because of how many organizations depend on change to process insurance payments. when an entire industry relies on only one or two digital supply-chain providers, which hold and process huge amounts of data, how does that affect the impact of such a cyber attack? >> for a cyber criminal, it is a nirvana if you can find a supply-chain. rather than have to attack a series of companies one at a time. if you can find that one organization that has weak cybersecurity from all of the companies that they support, you are going to get massive amounts of data. we have seen a 2600% increase

in the number of organization hits by supply-chain attacks. you may have 100 companies attacked last year, but you had 2600 companies that were impacted by it. their data was exposed. so for a criminal, these things are incredibly profitable. and at the whole topic of this conversation is how can we bring these other organizations up to speed so you do not have that risk of vendors to the larger organization. >> yeah. i mean, we have been helping dozens and dozens of hospitals and pharmacies and other healthcare providers in our state to remain whole and be able to function since this data breach, and clearly work has to be done here. you cannot have all this data in one place. and then they do not have backup systems. would that be one of your

suggestions? what would be your suggestion to protect this data? and this will be my last question. >> from a data collection standpoint, there is a lot to that. only one part of which will be backups. you know? there are just so many parts of the healthcare supply-chain. it has been the industry that is the most attack for the last six years running because there are so many different parts of it and so many different members from mom-and-pop organizations all the way up to united healthcare. so while there are key things that need to be done, a big part of it is just making sure that everybody in that supply- chain is aware that they are a target. they are at risk. and they must act accordingly. >> exactly. thank you very much. thanks, everyone. i appreciate it. >> i have still got some questions. there may be one or two people on their way here so i will indulge myself.

mr. parker, i don't want to get you in trouble with any of our members in any way, but, you know, the requirements for reporting a breach, whether it is ransomware or phishing , or whatever it is, really the penalties, unless they pay the ransom, the penalties don't seem to be significant. does there seem to be some sort of incentive or some way to reward some of the smaller breaches that are happening more frequently that don't get the attention and get our, as i am sure you are aware, costing us tens of hundreds of millions of dollars in the country. i mean, within the framework of your membership, how do we get everyone eager to make sure that they report each incident? >> yeah. that is a great question. i think every state has a law.

breach notification is different in some ways. some have a private right of action applied to them. >> they have some of those requirements as well but there is not just a heavy-handed. it is fairly light. >> i know for the other witnesses, they may have a better idea here, but it is certainly something that should be a priority for the enforcers of these roles. >> there needs to be some incentives of moving people's -- anybody want to comment on that? >> i don't feel the obligation because i have got more questions. >> oh, i have got comments. to your point, it took from 2003 to 2018's to get all states and the district of columbia to have it. they all have different triggers of what constitutes a breach. they are different requirements of what is in a breach notice.

and in every notice, it is the ordination that has lost control of the data that gets to decide if there is a notice. oregon will allow a consultation with law enforcement but other than that the organization makes the determination. where you live determines how much information you have, if you have any information, and what resources are made available to you. so when we talk about national standards, that is when we mentioned that data breach organizations have to be part of that because they are data breaches for the individuals and to make sure that they do not have repeat occurrences. >> absolutely. anyone house? >> you all referred to in at one point or another. i don't know whether or not there is a certain amount of irony, but the swiftness or response -- would you all agree that the swiftness needs to be a goal? something that we should find

ways both within government but within the business community of accelerating responses and making sure that swiftness becomes an important factor. we will start with mr. parker. just for a change in direction. >> i absolutely agree with that. >> i think both on cybersecurity and the incident response side, swiftness is essential. >> could you say that louder when you say that? i am just kidding. we want it to fill the room. senator? swiftness when responding to a cyber incident is critically important. one of the things we have seen from palo alto networks the average response time for companies as recently as 2021 was 44 days that it would take to address a cyber incident when it occurred. and it was 44 days until they

started seeing data exfiltration from those attackers. we have seen that exfiltration timeline decreased to just days and hours. if you take that in context with the average time that it takes for a company to respond and mitigate it, that is six days. if they are starting to exfiltration in just one day, a handful of hours, swiftness is critical. >> i agree. >> right. thank you. >> can i have one more question. >> thank you, mr. chairman, and thank you all for being here today. so with the commerce business, a lot of work takes place online and there is a large volume of sensitive data that goes into those interactions. in many ways, data has become the lifeblood of the digital

economy. so i know this firsthand in the small business end. they have run digital advertising campaigns myself. i also know that the majority of businesses taking a security extremely seriously. burdening customers with what they feel are overly sensitive identification are ways to create trust. mr. parker, you mentioned how important the uniform standards and laws are to the security association members. is there an example you can share with conflicting laws where states have reduced business opportunities for any member companies? >> sure. absolutely. so a prime example of this is the l&i biometric data privacy lot known as bipa, which was formulated more than 15 years ago when that technology was in

its infancy. the way it was structured and the task in the environment where there is tremendous litigation risk in fielding technology, even if they are deemed to be compliant and as a result there is a number of our member companies who did not actually offer their products to companies in illinois anymore because of what has happened to that. >> any particular incidents that you recall? >> within biometrics, there have been different types of objects but just to give you an idea, 88% of the lawsuit law have been on regarding biometric time clocks. a way to authenticate your identity for punching in and out of work. no allegations and harm actually occurred to anyone. there was a misstep in collecting consent that was found and that was based on class-action lawsuits. things like that. and some product certainly in the security area, there are

rules but in other cases, you know, some people are like forget it. we will not even bother. >> yeah. the savings from those systems, i would know firsthand. they make them more competitive. to make the employees more. they hire more employees. mr. parker, can you speak to how uniform national requirements and legal liabilities would protect personal data? >> yes. so i think having a national standard, you know, that fully preempts state and local law would definitely save a compliance cost but it would also be better, you know, for the global competitiveness of our company if they could align with what they are doing, you know, with other parts of the world as well versus having people track what is going on in the individual states.

so there is definitely a tremendous advantage to having a national framework and standard. thank you. >> you mentioned implementing resources like how to counter a.i. threats to physical security products just as an example. are your member seen criminals use a.i. in anyways? >> i was just talking to some of our cybersecurity experts in the industry about this. one thing that is emerging is the ability to detect when video has been altered. so a security video is obviously very important to what we do. but you want to make sure that cannot be manipulative by bad actors for fraudulent purposes or maybe to further some other criminal activity. there is some material to make sure that data has to be stored has not been altered so that is

one area. thank you. >> thanks the panel. i will be quick. a couple of you already commented on this. i just put in a fair amount of work -- our office put a fair amount of work on the american privacy rights act. it affects what we are talking about today. it is about security in addition to privacy. there is a connection there that is -- what is your feelings then we will go down the list on apra. do you think we need to have a sense of urgency? a couple people referred to quantum computing as it comes down the pipe. does not give a sense of urgency around these issues. >> i do think there should be a sense of urgency just because

-- we don't even have to get to quantum. we can look at artificial intelligence. just the efficiency and the depth and breath that is bringing to everything from creating malware to a phishing attacked. we are seeing more and more phishing attacks that are more basic better letter perfect that fully even professionals. they are so good. a couple years ago, bank of america was not spelled with b- a-n-k. you have got a deep fake video. you have voice cloning. you have risks that are primarily to businesses but individuals will be the vehicle to get to the business attacks are there is a sense of urgency. so on the privacy rights act, beware of the laws' unintended

consequences. as i talked about with data minimization, we need data and we need it for some very specific purposes because it is used for identity verification to prevent identity crime so in our zeal to protect consumers and give them access, we also have to be realistic that we need some data. >> thank you. mr. kaplan? >> senator, we are still evaluating apra. we do think there are some beneficial aspects. >> so there is a sense of urgency? >> i can hit that. what we have seen with regard to artificial intelligence for example is to echo what mr. lee said. we have seen this leveraged to create really sophisticated spear phishing attacks. senator blackburn brought up quantum threats right now. there is a campaign into harvest now into encrypt later were nation states are collecting encrypted data knowing this day is coming

where they will be able to decrypt it so really hard in your system secure your systems now and secure your data now. one of the beneficial aspects of apra that we see are the strong permissible purposes . mr. lee also talked about the uses of data for our cyber defenses but also in the artificial intelligence. just a quick stat. we leveraged a.i. across our systems and capabilities and we are able to detect 3.2 million unique attacks that were not there the day before. this is a process of continuous discovery, and we are able to leverage our security data on those a.i. tolls to block 11.3 billion attacks per day. and that is just one player or one company in the cyber ecosystem. so the utility of this system is proven and that reflects like the permissible purposes of apra are critical to

securing everybody's data. >> thank you for the questions, senator. and we said publicly that the apra include some of the necessary pillars of sound legislation. i will list all of them . strong data minimization principles. online civil rights protections. privacy rights for users to be able to view, crack, and opt out and delete their data. these are essential elements. so we are heartened to see this incredible proposal re-emerge. in terms of areas to focus on, i think one of the focuses has been the scope of fcc focus. we have seen a recent announcement from the fcc defining wireless carriers. the depths of their expertise and ability to act to be a cop on the beat with respect to isp privacy -- internet service provider privacy -- and i think

that is essential. so we would focus on this issue . their long standing expertise in the domain of privacy. >> interesting. mr. parker? >> you know, three years ago, there was one state that had their data privacy law, and now there is 19, so i think there is a window of opportunity to have a federal standard. and those states that have enacted it with very similar frameworks, there is potential different enough to harm the economy. so, you know, it is important to consider acting soon. we are still looking at the proposal and gather info for members. so we definitely think l and rogers for working together. one example we are happy with the private

security and physical security which are well-defined and well- crafted. but there are some other issues in question that need to be addressed moving forward. mentioned how important it is to have strong prevention. i got questions from members about other what is in the proposal now is adequate to be truly the national standard that it is intended to be so that needs a clear -- you know -- a clear answer. and there are a few other detailed answers in the bill but we are still looking at dividing it . >> we will keep those coming. it is like they used to say on tv. we appreciate all those comments. i have a great sense of urgency. and i think this is a wonderful time to work on something like data privacy on a bipartisan basis. right before a a collection. but this should not be a

partisan issue. we see a lot of bipartisan participation so far. but i am hopeful the people you will represent will continue to push with a sense of urgency this year. represent will continue to push with a sense of urgency this year to get this done i think it is doable. i think we are done for today but thank you for your effort. members, can submit additional questions for the record until may 22nd. we thank you in advance for taking the time to, and the chance, to answer those -- provide responses by june 5th. with that, i will adjourn.

announcer: c-span's washington journal, our live forum involving you to discuss the latest issues in government, politics, and public policy from washington and across the country. friday morning we will talk about the recent protests on college campuses as a potential impact on campaign 2024 with the national review editor in chi,