January 22, 2015
Mr. President, I start with a question, a basic question: Why are we here? Why do we have those jobs? What is it we are supposed to do? The clearest expression of the answer to that question comes from the preamble to the Constitution, which lays out exactly what our responsibilities are.
We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defense, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America.
This is the purpose of the Constitution. It is the purpose of the government. The most solemn responsibility of any government, I would submit--any government, anywhere, any time--is to provide for the security of its citizens, to provide for the common defense. That is our most solemn and fundamental responsibility.
We are not doing that right now. We are avoiding, missing, obfuscating, and not dealing with one of the most serious threats facing our country. I refer to the threat of cyber-attack. Every intelligence official I have talked to in the last 2 years, every military official, everybody with any knowledge of the defense and the security, the national security of this country, has emphasized that the most serious threat we face right now is cyber.
What does that mean? Cyber-attacks. The disabling of critical infrastructure, attacks on our businesses, financial systems. This is a direct threat that is heading at us like a freight train on a track. The problem is we see it coming, but we are not doing what we should to deal with it.
To say it is coming is kind of an understatement. This is an unusual chart, but it goes in time from 2004 until today. It is basically the frequency and size of cyber-attacks in our country. The bigger bubbles are bigger attacks. The smaller bubbles are smaller attacks. From 2004 to 2006, a few but not many. It is bubbling up and it is about to boil over. Each year we have seen more attacks, larger attacks, more serious attacks. The evidence is overwhelming that this is a threat we are facing. Sony was a wake-up call if ever there was one. What if the Sony attack had been the New York Stock Exchange or the railroad system, where cars bearing toxic materials are derailed, or the natural gas pipeline system or any other of the critical infrastructure of this country, financial or physical, would have disabled us?
I was at a hearing yesterday in the Armed Services Committee. We had the testimony of two of the wisest men in America--Brent Scowcroft, Gen. Brent Scowcroft, who was the National Security Adviser to President Ford and President George H.W. Bush, and Dr. Zbigniew Brzezinski, who was the National Security Adviser to Jimmy Carter--talking about threats.
Brent Scowcroft said he believes the cyber-threat was analogous to the nuclear threat: People would not be killed, but our country could be destroyed. He saw this as one of the two fundamental threats we face. Yet what are we doing in Congress? Not much. It is as if we got a telegram from Admiral Yamamoto in 1941 saying, I am steaming toward Pearl Harbor and we are going to wipe you out, and we did nothing, or a telegram or a text message from Osama bin Laden saying, We are heading for the World Trade Center, what are you going to do, and we did nothing.
We have the notice. It is right in front of us. Yet we are not acting. What are the risks? The biggest risk is in the nature of our society. The good news is we are the most technologically advanced society on Earth. The bad news is we are the most technologically advanced society on Earth--because it makes us vulnerable.
It is what they call an asymmetric vulnerability. We are the most vulnerable because we are the most wired. We are in the most danger because of our technical advancement. What can they do to us? This gives you an idea of how this risk is accelerating and how it fits. This is the number of devices in the world connected to the Internet. Back in 2003 it was very few. By 2010 we were up to 10 billion devices connected to the Internet. The projection is, by the end of this year, we will be at 25 billion devices connected to the Internet. By 2020, not that long from now, 50 billion devices will be connected to the Internet and therefore vulnerable to cyber-attacks.
Critical infrastructure, I have mentioned. The financial system, what would it do to the country if all of a sudden everybody's bank account disappeared? Most of us, many workers in America, have their--we do not see cash money or a paycheck. It goes electronically into our bank account. What if all of that just disappeared? Chaos would ensue.
The same thing with transactions on the New York Stock Exchange or the great transactions of our banks. It would be chaos that would tumble through the economy and then into people's daily lives. Transportation could be paralyzed. The simply act of messing around with how red and green lights work in a major city could paralyze a major city for hours, if not days.
The transportation of toxic or volatile compounds could be compromised. Of course, the energy system, the electrical grid, we do not realize how dependent we are on these modern facilities until they go down. Periodically in Maine, when I was Governor, we had an ice storm where three-quarters of our people lost electricity for sometimes 2 weeks at a time. We learned what a disaster that was. One of the things we learned was that home furnaces, heating oil furnaces, need electricity to fire. People got cold. It was not just: Gee. I cannot watch TV tonight. It became life threatening.
The second area of vulnerability is financial. Data breaches, that is something that is happening all of the time. Then, finally, property ideas, theft of ideas. Where are these threats coming from? All over the place. North Korea, Russia, China, Iran. Terrorist organizations are now looking into the cyber field--hackers for hire, somebody in some country or somebody's basement somewhere in the world who hires out to take advantage of the vulnerability, particularly of the Western countries and particularly the United States.
We are already incurring huge costs, the cost of these data breaches, the cost of protection against these data breaches. Our financial system is spending a huge amount of money to protect itself from these breaches. We have to act. We have to act. It is beyond time to act.
My favorite quote from Mark Twain--and there are many. But my favorite is: "History doesn't always repeat itself, but it usually rhymes."
History doesn't always repeat itself, but it usually rhymes.
Nothing new ever happens. This would not be the first time in history a great nation ignored threats to its existence. In August of 1939, Winston Churchill, in talking about the House of Commons, but he could have been talking about the U.S. Congress:
At this moment in its long history, it would be disastrous, it would be pathetic, it would be shameful for the House of Commons to write itself off as an effective and potent factor in the situation, or reduce whatever strength it can offer to the firm front which the nation will make against aggression.
Earlier in the thirties he said--and this is a perfect analogy of where we are today: "When the situation was manageable it was neglected, and now that it is thoroughly out of hand we apply too late the remedies which then might have affected a cure."
We are at the line between manageable and too late. I would argue it is almost over that line. Now is the time that we have to act, but we aren't acting because of a variety of reasons: the complexity of our process--four committees have to consider cyber legislation; the differences with the House; the differences with the White House. There are all kinds of complications in our system which seem to be preventing us from acting.
Again, Churchill is appropriate: "There is nothing new in the story. It is as old as the Sibylline Books. It falls into that long, dismal catalogue of the fruitlessness of experience and the confirmed unteachability of mankind."
Boy, that is a dark judgment. Continuing:
"Want of foresight, unwillingness to act when action would be simple and effective, lack of clear thinking, confusion of counsel until the emergency comes, until self-preservation strikes its jarring gong--these are the features which constitute the endless repetition of history."
Let's act before the crisis starts. Let's act while we still have time.
There are at least three bills that I know of that are available. One is a bipartisan bill that was heavily negotiated in the Intelligence Committee, came out of the committee I think 12 to 3 last summer. That is available. It is a new Congress, but the ink is barely dry. There is a bill that came out of the Judiciary Committee. A bill that came out of the homeland security committee in December of 2012--and lost in this body by a couple of votes--from my friends Senator Collins and Senator Lieberman also dealt with this problem. In other words, we don't have to start from zero. We don't have to invent these solutions; we just have to have the will to put them in place. Yet we don't act.
People say: Well, we have national security, Senator. What are you talking about? We are spending almost $600 billion a year on the defense of this Nation.
And the answer is yes, but in some ways it reminds me of the famous Maginot Line of France in the thirties. The Maginot Line has come to symbolize a faulty defense premise, which really isn't true. The Maginot Line worked. The problem was that the Maginot Line stopped. It went from Switzerland to the Belgian border. It stopped at the Belgian border, and the Germans came around it and behind it and overwhelmed France in 6 days. So the problem wasn't that the Maginot Line was not an effective defense--and our defense budget certainly is not ineffective; it is absolutely essential. But we are not defending the whole frontier. There is a piece of it, like Belgium, that is undefended, and that is our failure.
So what are we going to say when the crisis strikes? What are we going to say when we go home to our citizens in our home States when the financial system goes down and people can't get their money? There are threats of violence and violence across our country when toxic waste is spilled in our waterways. What are we going to say? ``Well, we would have done something about it, but that was in four committees, and that was really hard'' or ``You know, we just got in this argument with the White House and couldn't work it out'' or ``Gee, we would have solved it and your paycheck wouldn't have disappeared except the House--you know how they are.'' Can you imagine trying to defend yourself with that kind of argument? You would be laughed out of the place.
Come on. Let's do this. I don't know exactly how to proceed, except maybe those four committees should get together, talk to each other, and say: Let's bring a bill to the floor.
I would like to see this body decide that we are going to pass cyber-protection legislation between now and May 1. There is no reason we can't do it. The bills are drafted. We just have to pull ourselves together and take collective responsibility for defending our country.
If we don't do this--a friend and colleague on this floor yesterday--we were talking about it, and he said: It is political malpractice if we don't get this done.
This is a threat we know about. It is important. It is serious. We know at least some of the important things we have to do to coordinate better between the government and the private sector. We know how we can help to solve this; we just have to summon the political will to do it. And it isn't even that controversial. There are differences here and there, but this isn't one of the big fights in the Senate where we have great ideological differences, this is one where we should be able to come together. It is a lack of coordination and a lack of political will.
I don't know how I can say this more strongly. I think this is one of our most fundamental responsibilities. I go back to the preamble to the Constitution--the primary reason that governments are established and that our government was established, one of the basic reasons is to provide for the common defense. If we don't do that in the face of this threat, shame on us. This is one of the most solemn responsibilities we have as Senators, as Members of the Congress, and as members of the Federal Government of the United States.
I deeply hope that the next several weeks and months will be a time of productive discussions and a commitment to at least an attempted solution, the beginning of a solution to this grave threat facing the United States of America.
