PROTECTING YOUR PERSONAL DATA: HOW LAW ENFORCEMENT WORKS WITH THE PRIVATE SECTOR TO PREVENT CYBERCRIME FIELD HEARING BEFORE THE SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY TECHNOLOGIES OF THE COMMITTEE ON HOMELAND SECURITY HOUSE OF REPRESENTATIVES ONE HUNDRED THIRTEENTH CONGRESS SECOND SESSION APRIL 16, 2014 Serial No. 113–65 Printed for the use of the Committee on Homeland Security Available via the World Wide Web: http://www.gpo.gov/fdsys/ U.S. GOVERNMENT PRINTING OFFICE 88–784 PDF WASHINGTON : 2014 For sale by the Superintendent of Documents, U.S. Government Printing Office Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800 Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001 COMMITTEE ON HOMELAND SECURITY MICHAEL T. MCCAUL, Texas, Chairman LAMAR SMITH, Texas BENNIE G. THOMPSON, Mississippi PETER T. KING, New York LORETTA SANCHEZ, California MIKE ROGERS, Alabama SHEILA JACKSON LEE, Texas PAUL C. BROUN, Georgia YVETTE D. CLARKE, New York CANDICE S. MILLER, Michigan, Vice Chair BRIAN HIGGINS, New York PATRICK MEEHAN, Pennsylvania CEDRIC L. RICHMOND, Louisiana JEFF DUNCAN, South Carolina WILLIAM R. KEATING, Massachusetts TOM MARINO, Pennsylvania RON BARBER, Arizona JASON CHAFFETZ, Utah DONDALD M. PAYNE, JR., New Jersey STEVEN M. PALAZZO, Mississippi BETO O’ROURKE, Texas LOU BARLETTA, Pennsylvania FILEMON VELA, Texas RICHARD HUDSON, North Carolina ERIC SWALWELL, California STEVE DAINES, Montana VACANCY SUSAN W. BROOKS, Indiana VACANCY SCOTT PERRY, Pennsylvania MARK SANFORD, South Carolina VACANCY BRENDAN P. SHIELDS, Staff Director MICHAEL GEFFROY, Deputy Staff Director/Chief Counsel MICHAEL S. TWINCHEK, Chief Clerk I. LANIER AVANT, Minority Staff Director SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY TECHNOLOGIES PATRICK MEEHAN, Pennsylvania, Chairman MIKE ROGERS, Alabama YVETTE D. CLARKE, New York TOM MARINO, Pennsylvania WILLIAM R. KEATING, Massachusetts JASON CHAFFETZ, Utah FILEMON VELA, Texas STEVE DAINES, Montana VACANCY SCOTT PERRY, Pennsylvania, Vice Chair BENNIE G. THOMPSON, Mississippi (ex officio) MICHAEL T. MCCAUL, Texas (ex officio) ALEX MANNING, Subcommittee Staff Director DENNIS TERRY, Subcommittee Clerk (II) C O N T E N T S Page STATEMENTS The Honorable Patrick Meehan, a Representative in Congress From the State of Pennsylvania, and Chairman, Subcommittee on Cybersecurity, Infra- structure Protection, and Security Technologies ............................................... 1 The Honorable Yvette D. Clarke, a Representative in Congress From the State of New York, and Ranking Member, Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies ....................................... 4 The Honorable Mike Fitzpatrick, a Representative in Congress From the State of Pennsylvania .......................................................................................... 5 WITNESSES PANEL I Mr. Ari Baranoff, Assistant Special Agent In Charge, Criminal Investigative Division, United States Secret Service: Oral Statement ..................................................................................................... 7 Prepared Statement ............................................................................................. 9 Mr. Richard P. Quinn, Assistant Special Agent In Charge, Philadelphia Field Office, Federal Bureau of Investigation: Oral Statement ..................................................................................................... 16 Prepared Statement ............................................................................................. 18 Mr. John J. ‘‘Jack’’ Whelan, District Attorney, Delaware County, Pennsyl- vania: Oral Statement ..................................................................................................... 21 Prepared Statement ............................................................................................. 23 PANEL II Mr. Frederick ‘‘Ted’’ Peters, Chairman and CEO, Bryn Mawr Trust: Oral Statement ..................................................................................................... 37 Prepared Statement ............................................................................................. 39 Mr. Thomas Litchford, Vice President of Retail Technology, National Retail Federation: Oral Statement ..................................................................................................... 40 Prepared Statement ............................................................................................. 42 Mr. Matthew Rhoades, Director, Cyberspace and Security Program, Truman National Security Project and Center for National Policy: Oral Statement ..................................................................................................... 45 Prepared Statement ............................................................................................. 47 (III) PROTECTING YOUR PERSONAL DATA: HOW LAW ENFORCEMENT WORKS WITH THE PRIVATE SECTOR TO PREVENT CYBERCRIME Wednesday, April 16, 2014 U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON HOMELAND SECURITY, SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY TECHNOLOGIES, Philadelphia, PA. The subcommittee met, pursuant to call, at 10:18 a.m., at the Paul Peck Alumni Center, Drexel University, 3142 Market Street, Philadelphia, PA, Hon. Patrick Meehan [Chairman of the sub- committee] presiding. Members present: Representatives Meehan, Fitzpatrick, and Clarke. Mr. MEEHAN. The Committee on Homeland Security, Sub- committee on Cybersecurity, Infrastructure Protection, and Secu- rity Technologies will come to order. We are waiting for a moment, although we will begin, because by the time I am concluded with our opening statements and other things—my partner, Ms. Clarke, the Ranking Member from New York, had a little bit of trouble with the trains this morning, but she is, I know, out of the train and on her way up, so I think we will try to get the hearing start- ed, and I will look forward to having her make her opening state- ment as soon as we begin. I am—want to first express my deep appreciation to Drexel Uni- versity for allowing us to use this beautiful venue for this hearing, and to also take a moment to plug the tremendous work that Drexel University is doing with the creation of their new cyber in- stitute, which is not only using research and development to work with—the educational sector to work with the private sector and the Government sector in identifying the newest and best ways to deal with the threat of cyber—with cybersecurity, and dealing with the threats to information, but they are also going to be training the next generation of participants in the process of helping us to create better protections. I think it is a remarkable new area, and we are very grateful to have that kind of a commitment here in this region. I know it is something shared with other universities as well, but particularly what Drexel is doing is noteworthy around the country. I also have to make note of this, guys, and it is not customary, because of the angles of the sun, it is generally law enforcement (1) 2 that has people locked in rooms with lights shining in their faces. Then they, you know, then they ask the tough questions. So this is kind of turnabout. We will have to see how you enjoy that aspect of it. At this moment I am going to ask unanimous consent for Con- gressman Mike Fitzpatrick to participate in the hearing. Hearing no objection, so ordered. I want to express my deep appreciation to Congressman Fitzpatrick, not only for the work that he does in the broad spectrum of issues for our region, but because Congressman Fitzpatrick is growing in his importance on the Financial Services Committee. This is an area in which he has been spending time as well, and I am very grateful for his participation. When my col- league, Ms. Clarke, arrives, I will take a moment to comment on our relationship. But allow me to begin by doing an opening state- ment. I want to welcome all of the witnesses, and extend my thanks for participating in today’s hearing, and I appreciate the effort taken on behalf of all of those involved in this important field hearing. This is an official Congressional hearing, as opposed to a town hall meeting, or something else that we would traditionally do, so we have to abide by certain rules of the Committee on Homeland Secu- rity, and the House of Representatives. This is as if we are sitting in the House today, so photography, and cameras and other things are limited to accredited press, and we want to make sure that we respect the decorum and the rules of the committee. I am going to give my colleague a moment to collect herself as I do my opening statement, but I would also—I did want to take a moment while Congresswoman Clarke was here to share with you—we have had the great fortune to be working together for much of the last term on this important committee. While, cer- tainly, there are a few occasions where we have to zealously argue for our philosophical positions, the fact of the matter is it has been a remarkable working relationship. We have had the ability to col- lectively identify and work on a number of issues with respect to cybersecurity, including some very substantial legislation that has passed the committee unanimously, and in a bipartisan fashion, and has been a real joy to be able to work with Congresswoman Clarke in this capacity. I want to express my deep appreciation for you taking