This Annual Report documents activities of the National Computer System Security and Privacy
Advisory Board during 1994, its sixth year. The Board, which met four times during the year, was
established by Congress through the Computer Security Act of 1987 to identify emerging computer
security and privacy issues. Dr. Willis Ware, of RAND, has served as Chairman of the Board since
July of 1989.
During the year, the Board continued to review cryptography related issues. During 1994, the
Escrowed Encryption Standard (EES) and the Digital Signature Standard (DSS) were approved as
Federal Information Processing Standards (FIPS 185) and (FIPS 186) respectively. The Board
heard briefings on escrowing release procedures, escrow program procedures, U.S. export
procedures, international cryptography proposals, international corporate key escrow, alternative
key escrow approaches, and software-based key escrow encryption.
The Board was briefed on the National Computer Ethics & Responsibilities Campaign (NCERC)
which included a series of initiatives coordinated over the course of 1994 and beyond. By way of
Resolution 94-2 (see attachment), the Board applauded the activities of the NCERC and supported
their efforts to make the ethical and responsible use of information technology a national priority.
The Board also urged support of the NCERC's efforts.
Security issues with regard to Electronic Benefits Transfer (EBT), Electronic Massaging (e-mail),
and the Internet were discussed throughout the year. EBT security concerns are similar to those
found in other systems (e.g., physical and system access, personnel, network operations, point of
sale terminal and card design, and equipment and system failure). Security and privacy were
concerns in the governmentwide e-mail program. A Security Infrastructure Program Management
Office was created under the General Services Administration that is responsible for ensuring that
security is addressed in the e-mail program. Internet security incidents remain a concern with the
advent of the Internet password sniffer. The sniffer/intruder looks for systems with uncorrected
vulnerabilities, and installs a backdoor to the system.
The Board also continued to follow activities related to the Common Criteria (CC), which remains
in draft form. Pieces of the International Standards Organization (ISO) document are in progress
now, which will be removed and substituted with the October 1994 draft of the CC. [Comments on
the CC will be reviewed and processed in March 1995.] The Board continued to examine the
question as to whether there is a business case for setting up a Trusted Technology Assessment
Program (TTAP).
I. Introduction
Board's Establishment and Mission
The passage of the Computer Security Act of 1987 (P.L. 100-235, signed into law on January 8,
1988) established the Computer System Security and Privacy Advisory Board. The Board was
created by Congress as a federal public advisory committee in order to:
identify emerging managerial, technical, administrative, and physical safeguard issues relative to computer systems security and privacy.
Appendix A includes the text of the Computer Security Act of 1987, which includes specific
provisions regarding the Board. The Act stipulates that the Board:
- advises the National Institute of Standards and Technology (NIST) and the Secretary
of Commerce on security and privacy issues pertaining to federal computer systems;
and
- reports its findings to the Secretary of Commerce, the Director of the Office of Management and Budget (OMB), the Director of the National Security Agency (NSA), and appropriate committees of Congress.
Board Charter
The Board was first chartered on May 31, 1988 and was rechartered for a third time on March 24,
1994 by U.S. Department of Commerce Assistant Secretary for Administration Thomas Bloom.
(See Appendix B for the text of the current charter.)
Consistent with the Computer Security Act of 1987, the Board's scope of authority extends only to
those issues affecting the security and privacy of unclassified information in federal computer
systems or those operated by contractors or state or local governments on behalf of the federal
government. The Board's authority does not extend to private sector systems (except those
operated to process information for the federal government), systems which process classified
information, or Department of Defense unclassified systems related to military or intelligence
missions as covered by the Warner Amendment (10 U.S.C. 2315).
Membership
The Board is composed of twelve computer security experts in addition to the Chairperson. The
twelve members are, by statute, drawn from three separate communities:
- four members from outside the Federal Government who are eminent in the computer
or telecommunications industry, at least one of whom is representative of small or medium sized companies in such industries;
- fo ur members from outside the Federal Government who are eminent in the fields of computer or telecommunications technology, or related disciplines, but who are not employed by or representative of a producer of computer or telecommunications equipment; and
- four members from the Federal Government who have computer systems management experience, including experience in computer systems security and privacy, at least one of whom shall from the National Security Agency.
Currently, Dr. Willis H. Ware, a senior researcher of the Corporate Research Staff of RAND, serves
as Chairman of the Board. He was appointed in July 1989. As of December 1994, the membership
of the Board is as follows:
- Chairman
Willis H. Ware, RAND
- Federal Members
Charlie C. Baggett, Jr. National Security Agency
Henry H. Philcox, Department of the Treasury, Internal Revenue Service
Cynthia C. Rand, Department of Transportation
Stephen A. Trodden, Department of Veterans Affairs
- Non-Federal, Non-Vendor
Genevieve M. Burns, Monsanto Corporation (Member Designate)
Cris R. Castro, KPMG Peat Marwick
Sandra Lambert, Citibank
Randolph Sanovic, Mobil Corporation (Member Designate)
- Non-Federal, Vendor
Gaetano Gangemi, Wang Laboratories, Inc.
Linda Vetter, Oracle Corporation (Member Designate)
Stephen T. Walker, Trusted Information Systems, Inc.
Bill Whitehurst, International Business Machines Corp.
In December of 1994, Ms. Cynthia Rand resigned from the Board, leaving a vacancy in the federal
member category.
NIST's Associate Director for Computer Security, Mr. Lynn McNulty, serves as the Board's
Executive Secretary and is the Designated Federal Official (DFO) under the Federal Advisory
Committee Act. The DFO is responsible for ensuring that the Board operates in accordance with
applicable statutes and agency regulations. Additionally, the DFO must approve each meeting and
its agenda. Through the Secretariat, NIST provides financial and logistical support to the Board as
stipulated by the Computer Security Act of 1987.
II. Major Issues Discussed
The following section summarizes the discussions held by the Board in 1994. Additionally, the
Board accomplishes much informal, non-decisional, background discussion and preparation for
meetings by electronic mail between meetings. The Board's activities complement those of the
individual Board members. (Note that the minutes and agenda from the March, June, September,
and December meetings are included as Appendices C to F, respectively. The required Federal
Register announcement notices for the meetings are presented in Appendix G.)
The work of the Board during 1994 was devoted to various topics related to security of federal
unclassified automated information systems. Among the most important were:
- Cryptographic Key Escrowing Procedures
- Alternative Key Escrow
- Security in the National Information Infrastructure (NII)
Escrowing Release/Program Procedures
The Department of Justice briefed the Board on procedures for release of cryptographic key
components, by the two escrow agents, to government agencies. The two escrow agents at the
National Institute of Standards and Technology (NIST), of the Department of Commerce and the
Automated Systems Division of the Department of Treasury. The agents act under strict procedures
to ensure the security of the key components and which govern their release for use in conjunction
with lawful wiretaps. NIST discussed the procedures for the key escrow program. Five federal
agencies share a role in the key escrow program: (1) the Department of Justices is a sponsor and a
family key agent that holds one of the components of the family key, (2) the Federal Bureau of
Investigation is the initial law enforcement user and a family key agent that holds the other
component of the family key, (3) NIST has a dual role as the program manager and a key escrow
agent, (4) the Department of Treasury is a key escrow agent; and (5) the National Security Agency
is the system developer that provides technical assistance. Alternative Key Escrow
Bankers Trust presented some rationales for key escrow encryption for corporations, which fulfills
management supervision and compliance duties, and reduces business risks. They maintain that the
Bankers Trust system can meet both U.S. and European needs. Their system has been discussed
with Canada, Britain, France, Singapore, and the U.S.; however, none of these countries have
endorsed the system.
Trusted Information Systems, Inc. gave a demonstration and overview of their approach to
software-based key escrow encryption. They said that software key escrow systems could be built
that meet the objectives of law enforcement. Also, that variations of their software key escrow
system can provide a commercial key escrow capability that will be very appealing to corporate and
individual computer users. They believe that widespread use of corporate key escrow, in which
corporations operate their own key escrow centers, and individual key escrow, in which bonded
commercial key escrow centers provide a key retrieval capability for registered users, will better
achieve the key escrow objectives of law enforcement that a government-operated key escrow
system.
Security in the NII
Mr. Lynn McNulty, Executive Secretary, briefed the Board on how security is being addressed in
the committee that the Administration has established to plan for the implementation of the National
Information Infrastructure (NII). The Board was advised that security was viewed as one of the
several "cross cutting" issues that was not assigned to any single NII committee or working group.
Rather, it was viewed as a concern that will be addressed by all of these groups in the context of
their individual charters. Mr. McNulty summarized a meeting that was held to address the subject of
security in the NII. Participating in the meeting were a number of representatives of government
components and inter-agency committees having a responsibility for information technology security
for some segments of the federal government.
The Office of Management and Budget (OMB) discussed the federal role in the development of the
NII, in particular, the government's role in stimulating competition for use, protecting law
enforcement's abilities, and promoting appropriate security.
The Board was briefed on a public meeting that was held mid-year to discuss NII security. The NII
Security Issues Forum was organized to provide a clear and direct means for the IITF to address
security issues. A meeting was held and the public was invited to appear before the IITF and
members of the NII Advisory Council to assess security needs and concerns of potential NII users.
III. Advisory Board Correspondence
During 1994, the Board issued seven letters to: 1) the Director, Computer Systems Laboratory,
NIST, with regards to NIST's Computer Security Program, 2) Senator Patrick Leahy, advising him
of Chairman Ware's testimony to Congressman Valentine's House Subcommittee on Technology,
Environment and Aviation, on the subjects of cryptography, Clipper, and the digital Telephony bill,
3) the Director, NSA, regarding a resolution passed by the Board endorsing the National
Performance Review objectives, 4) the Director, NIST, regarding the adopted resolution, which
affirms the Board's concerns that several unresolved issues documented during the Board's three
public hearings in 1993 on Clipper, are still inadequately addresses, 5) the Director, NIST, regarding
the adopted resolution, which underscores its continuing concern that major impediments remain in
the way of widespread adoption of FIPS 186, 6) the Executive Director, Federal Electronic Benefits
Transfer (EBT) Task Force, expressing their thanks for obtaining the Board's input on the Federal
EBT Task Force security and privacy plan, and 7) the Office of Management and Budget, Office of
Information and Regulatory Affairs, expressing their satisfaction with the presentation given by the
Internal Revenue Service in regard to their planning for privacy and security issues in the Tax
Systems Modernization program.
Exhibits
The Board's correspondence and replies (when received) are included in the following exhibits:
Exhibit I Letter dated December 30, 1993, from Chairman Ware to Mr. James Burrows of NIST, expressing their support and endorsement of NIST's computer security program FY94.
Exhibit II Letter dated March 25, 1994, from Executive Secretary McNulty to Mr. Peter S. Tippett, Director, Security & Enterprise Products, extending appreciation for their efforts to establish a National Computer Ethics and Responsibilities Campaign.
Exhibit III Letter dated May 16, 1994, from Chairman Ware to Senator Patrick Leahy, Subcommittee on Technology and the Law, concerning Chairman Ware's testimony summarizing the activities of the Board in regard to Clipper.
Exhibit IV Letter dated May 16, 1995, from Chairman Ware to Vice Admiral John McConnell, Director, National Security Agency, endorsing the National Performance Review objectives.
Exhibit V Letter dated May 16, 1994, from Chairman Ware to Dr. Arati Prabhakar, Director, NIST endorsing the National Performance Review objectives.
Exhibit VI Answer from Raymond G. Kammer, Deputy Director, NIST.
Exhibit VII Answer from Vice Admiral John McConnell, Director, National Security Agency.
Exhibit VIII Letter dated June 22, 1994, from Chairman Ware to Dr. Arati Prabhakar, Director, NIST, concerning public hearings held by the Board in 1993 on Clipper.
Exhibit IX Letter dated June 22, 1994, from Chairman Ware to Dr. Arati Prabhakar, Director, NIST, concerning the adoption of FIPS 186 and the patent issue.
Exhibit X Letter dated October 6, 1994, from Chairman Ware to Mr. Jack Radzikowski, Executive Director, Federal Electronic Benefits Transfer (EBT) Task Force, with regard to the Board providing comments on the EBT security and privacy draft plan.
Exhibit XI Letter dated October 21, 1994, from Chairman Ware to Ms. Sally Katzen, Office of Management and Budget, Office of Information and Regulatory Affairs, regarding
the Internal Revenue Service's Tax Systems Modernization
Exhibit XII Answer from Margaret Milner Richardson, Department of the Treasury, Internal Revenue Service The National
Computer System Security and Privacy Advisory Board
Established by the Computer Security Act of 1987
December 30, 1993
Mr. James H. Burrows
Director of Computer Systems Laboratory
Gaithersburg, MD 20899
Dear Jim,
At its recent meeting, the Computer System Security and Privacy Advisory Board was briefed by
Dr. Stuart Katzke on his research plan for coming fiscal year. We responded very favorably to it
and believe that it quite well meets the developing needs of the nation for computer and network
security technology standards. Accordingly, we adopted the enclosed resolution (number 93-8)
which expresses our support and endorsement of the plan.
We look forward to updates from time to time as the actual work unfolds and reaches fruition.
Sincerely,
/s/
Willis H. Ware
Chairman
Enclosure
CC: A. Prabhaker
R. Kammer
S. Katzke
B. McConnell - OMB
Executive Secretariat: Computer Systems Laboratory
COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD
RESOLUTION 93-5
September 1-2, 1993
Subsequent to the June 2-4, 1993 meeting of the CSSPAB, the Board has held an additional 4 days
of public hearings and has collected additional public input.
The clear message is that the preliminary concerns stated in Resolution 1 of that date have been
confirmed as serious concerns which need to be resolved.
Public input has heightened the concerns of the Board to the following issues:
- A convincing statement of the problem that Clipper attempts to solve has not been
provided.
- Export and import controls over cryptographic products must be reviewed. Based
upon data complied from U. S. and international vendors, current controls are
negatively impacting U. S. competitiveness in the world market and are not inhibiting
the foreign production and use of cryptography (DES and RSA).
- The Clipper/Capstone proposal does not address the needs of the software industry, which is a critical and significant component of the National Information Infrastructure and the U. S. economy.
- Additional DES encryption alternative and key management alternatives should be considered since there is a significant installed base.
- The individuals reviewing the Skipjack algorithm and key management system must be given and appropriate time period and environment in which to perform a thorough
review. This review must address the escrow scheme to allow it to be fully understood by the general public.
- Sufficient information must be provided on the proposed key escrow scheme to allow
it to be fully understood by the general public.
- Further development and consideration of alternatives to the key escrow scheme need to be considered, e.g., three "escrow" entities, one of which is a non- government agency, and a software based solution.
- The ec onomic implications for the Clipper/Capstone have not been examined. These costs go beyond the vendor cost of the chip and include such factors as customer installation, maintenance, administration, chip replacement, integration and interfacing, government escrow system costs, etc.
- Legal issues raised by the proposal must be reviewed.
- Congress, as well as the Administration, should play a role in the conduct and approval of the results of the review.
Moreover, the following are additional concerns of the Board:
- Implementation of the Clipper initiative may negatively impact the availability of cost-effective security products to the U.S. Government and the private sector;
and
- Clipper products may not be marketable or usable worldwide.
Computer System Security and Privacy Advisory Board
Established by the Computer Security Act of 1987
June 22, 1994
Dr. Arati Prabhakar
Director
National Institute of Standards and Technology
Gaithersburg, MD 20899
Dear Dr. Prabhakar:
The Computer System Security and Privacy Advisory Board (CSSPAB) is directed under the
Computer Security Act of 1987 to identify emerging public policy issues related to information,
computers and communications technology; and to bring them to the attention of national decision
makers for consideration.
At its June 1-2, 1994 meeting, the CSSPAB adopted Resolution 94-4 which underscores its
continuing concern that major impediments remain in the way of widespread adoption of FIPS 186.
In particular, the unresolved patent infringement issue which is commonly believed to still be a risk
will deter widespread adoption of FIPS 186. In addition, the lack of a certificate and key-management infrastructure will effectively negate any practical use of FIPS 186 even if the patent
situation is resolved.
The Board urges NIST's prompt attention to both.
If you would like further clarification of this action or wish to discuss it, please feel free to contact
me.
Sincerely,
/s/
Willis H. Ware
Chairman
Enclosure
cc: John McConnell - NSA
Leon Panetta - OMB
Identical letter sent to:
Honorable Ronald Brown
Department of CommerceExecutive Secretariat: Computer Systems Laboratory
COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD
Wednesday, September 14, 1994
Introduction
A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at
the Hilton Hotel, Gaithersburg, Maryland. Besides Dr. Ware, the following members were present:
Cris Castro, Don Gangemi, John Kuyers, Sandra Lambert, Henry Philcox, Cynthia Rand, Steve
Walker, and Bill Whitehurst.
Mr. Lynn McNulty, Board Secretary, introduced the new Board member nominees. Ms. Genevieve
Burns from Monsanto Corporation, will fill a non-government/non-vendor vacancy and Mr. Charlie
Baggett, NSA replaces Mr. Pat Gallagher, who recently retired. (Additional vacancies are in the
process of being filled, hopefully by the December meeting.)
Mr. McNulty, advised the Board of a plan to reduce Board expenses by at least 5%, as required by
the National Performance Review. This will be accomplished by holding three of the four meetings
next year on the NIST campus or at a nearby Hotel, in order to reduce the cost of staff travel, and
by asking the Board members to utilize government air contract carriers.
Mr. McNulty then reviewed the agenda and materials distributed to the Board. Among the materials
distributed to the Board was a paper from Dr. Herb Lin of the National Research Council (NRC),
National Academy of Sciences (NAS) on their Study of National Cryptography Policy. Dr. Ware
commented that the NRC/NAS does not discuss the status of reports or NRC study groups until
completed. (See Reference #1.)
The Chairman welcomed the two new members-designate and advised them to watch their e-mail as
that is how the Board communicates most of the time. He also noted that he looked forward to
their formal appointments so they could vote on Board matters.
The entire meeting was held in open, public session.
Recent Criteria Activities
Dr. Stu Katzke, Chief, NIST Computer Security Division, gave the Board an update of the Common
Criteria activities. He reported that the April draft document went out for review with final
comments due back by June 5. Following the receipt of comments the report went to the Common
Criteria Editorial Review Board for review. Eighty-seven reviewers looked at the sponsors' draft of
the criteria. The next draft of the Common Criteria will be ready in the January/February 1995
timeframe. The U.S. will begin trial evaluations of conformant products in mid 1995. Meanwhile,
NSA will continue with Orange Book evaluations. In response to a question, Dr. Katzke said that
the Canadian and European sponsors are still supportive of this activity. Dr. Katzke noted that there
will be a session on the Common Criteria at the National Computer Security Conference in October.
The discussion will be primarily at the conceptual level.
Ms. Pat Toth, NIST Computer Security Division, briefed the Board on the Developmental
Assurance Workshop held on June 16-17, 1994. She reported that developmental assurance is not
meant to replace evaluations, but could help to speed up the evaluation process. She said that NIST
would continue developmental assurance at an international level. Ms. Toth offered the opinion that
the workshop raised issues rather than solved problems. A second workshop is planned for
December. The Board asked that Dr. Katzke and Ms. Toth return to the December Board meeting
with a more extensive briefing.
Cryptographic Activities
Mr. Michael Rubin, NIST Deputy Chief Counsel, briefed the Board on the status of cryptographic
patents affecting the Escrowed Encryption Standard (EES) and the Digital Signature Standard
(DSS). He reported that during the public comment process preceding adoption of the EES there
were comments from two patent holders, Mr. Andrew Logan and Professor Silvio Micali. Mr.
Rubin stated that NIST concluded that there is no patent infringement; however, in the case of the
Micali patent it was a close call. Accordingly, the government entered into a licensing agreement
with Micali. The scope of the Micali license includes anyone using Clipper, Capstone or
Tessera/Fortezza. The agreement resulted in Professor Micali granting rights for anyone to use his
patent provided that it is done for a law enforcement purpose (i.e., escrowing of keys with a
government designated agent.)
The Digital Signature Standard (DSS) was issued in May 1994. There were allegations of
infringement from Mr. Claus Schnorr and Public Key Partners (PKP). Again, Mr. Rubin indicated
that there is no infringement by the DSS of any patent licensed by PKP.
DSS Update
Mr. McNulty reported that the DSS was approved by the Secretary of Commerce and issued as
FIPS 186 on May 19, 1994. The FIPS is mandatory for the federal government in outgoing and
incoming documents. However, there is some confusion about whether government agencies will
accept documents signed using other algorithms. Mr. McNulty said that the focus had shifted from
algorithm issues to Public Key Infrastructure (PKI), which the government will build to support the
DSS. He went on to say that the government needs practical experience in a limited PKI operation.
The strategy will be for NIST to award contracts to provide prototype certificate management
services for two or three federal agencies. A draft RFC will soon be published in the Commerce
Business Daily, which will translate into an RFP to be issued in early 1995. (See Reference #2.)
Update on Proposed Procurement for Prototype Infrastructure Services
Mr. Robert Rosenthal, Manager, NIST Protocol Security Group, discussed NIST's Public Key
Infrastructure (PKI) Pilot Procurement that is designed to support NIST's Federal Information
Processing Standard Publication on the Digital Signature Standard. Mr. Rosenthal explained the
need to gain practical experience managing public key certificates. He indicated that real operations
data from the Pilot will be used to guide future PKI policy implementation decision. In addition,
cost information on building, installing and operating the Pilot PKI will guide decision to
incrementally scale up an operation, PKI. Finally, technical experience and lessons learned from the
Pilot will provide feedback to operators integrating commercial off-the-shelf components needed to
provide certificate management services. Several technical issues were also discussed including:
Specification of the certificate management hierarchy;
Generation and distribution of public keys;
Managing and distributing the certificates and their revocation lists; and
Interoperability among and between other PKI prototypes.
The Board invited Mr. Rosenthal to present an in-depth report at the December meeting, with the
other committee representatives. (See Reference #3.)
Status of Alternative Key Escrow Initiative Working Group and other Cryptographic News
Because of Vice President Gore's letter to Rep. Cantwell, stating the Administration's desire to seek
alternative key escrow approaches, a series of government/industry workshops is being held to
develop and test various industry approaches to key escrow. Mr. McNulty said that vendors
believed there was a significant market for escrow products. Mr. Whitehurst and Mr. Walker
disagreed with this statement. A full report of the first NIST workshop is available in NISTIR
5468. (See Reference #4.)
TIS Approach to Software-based Key Escrow Encryption
Mr. Steve Walker, President, Trusted Information Systems, Inc. (TIS) and Mr. Carl Ellison (TIS),
gave a demonstration and overview of their approach to software-based key escrow encryption. Mr.
Walker stated that software key escrow systems could be built that meet the objectives of law
enforcement. He believes that variations of their software key escrow system can provide a
commercial key escrow capability that will be very appealing to corporate and individual computer
users. He also believes that widespread use of corporate key escrow, in which corporations operate
their own key escrow centers, and individual key escrow, in which bonded commercial key
escrow centers provide a key retrieval capability for registered users, will better achieve the key
escrow objectives of law enforcement than a government-imposed key escrow system. (Reference
#5.)
Overview of EBT Task Force Workgroup Report
Mr. Jack Radzikowski, Executive Director, Federal Electronic Benefits Transfer (EBT) Task Force
presented an overview of the recently published NPR report on EBT. The objectives of the task
force are to:
construct a uniform nationwide EBT operating environment;
issue a base service EBT payments in at least one region in 1996;
expand the base service capabilities to multiple regions; and
extend EBT service to all other appropriate benefit programs.
The objective of creating a national EBT is to replace multiple paper-based benefit delivery systems
with a single electronic system that delivers benefits for a full range of federal and state programs.
Mr. Radzikowski stated that the goal is to begin implementing basic EBT services for the major
federal and state programs by march of 1996 and expanded to additional benefit programs by March
1999. (See Reference #6.)
Security Issues in EBT
Mr. Roy Saltman of NIST briefed the Board on the security issues in EBT that he identified during a
recent study. Mr. Saltman stated that theft of equipment, funds, and intellectual property were of
concern as well as damage and alteration to equipment, programs or information. Also of concern is
the unapproved information retrieval of privacy information, which could affect not only the
recipient of benefits but also the distributor of those benefits. EBT system security concerns are
similar to those found in other systems. They are: physical and system access; personnel; network
operations; point of sale terminal and card design and equipment and system failure. With electronic
benefits there is the same concern of collusion between the recipient and the retailer as there is in
paper-based systems. Administrative procedures should be able to handle most security concerns.
The use of data analysis could be used to identify possible recipient/retailer collusion such as the
purchase of alcohol and/or drugs. (See Reference #7.)
EBT Application Briefings
Ms. Joyce Kohler, Food and Nutrition Service (FNS), gave an overview of the existing Department
of Agriculture's Food Stamp Program currently using the EBT system. Ms. Kohler reported that
illegal sale of food stamps is the biggest problem. Clients sell coupons or EBT benefits to the
retailer for cash (e.g., 50 cents on the dollar). EBT delivers about 2% of food stamp benefit dollars
to about 2% of food stamp households. States deliver food stamps through local offices which
determine client eligibility and calculate benefit levels. The FNS reimburses the states 50% of their
administrative costs.
She stated that security requirements follow existing federal security policies; for example, security
plans are required as part of design documentation and security reviews have been conducted in
EBT demonstration projects by the FNS. The Food Stamp Program security assessment looked at
all system linkages. Vulnerabilities were assessed in terms of probability of occurrence, value of the
asset, opportunity for abuse, and the effect on the system. In conclusion, Ms. Kohler stated that
there are few serious vulnerabilities and none that required immediate attention or reconsideration of
the cost of providing EBT services for the delivery of food stamp and cash benefits.
Ms. Kohler gave an overview of specific privacy issues for EBT systems. She said that recipients
names do not appear on point of sale receipts, or on the terminal display. Balances may not appear
on terminal displays, and EBT regulations require ensuring the privacy of household data and
providing benefit and data security. (See Reference #8.)
Ms. Dale Brown from the State of Maryland briefed the Board on the EBT system used in
Maryland. Ms. Brown stated that Maryland is the first state in the nation to provide its citizens,
receiving public assistance and food stamps, an opportunity to use state-of-the-art technology.
Through the use of a debit card with a magnetic strip, called the "Independence Card" recipients
access their monthly benefits electronically through point of sales devices at retail stores and at
automated teller machines, therefore replacing food stamp coupons, child support and cash benefit
checks. One of the problems that the state has encountered is the ongoing 6% replacement of EBT
cards. The replacement of the cards is a result of the client losing or selling their cards. When the
card is lost or sold, the client must go into their local office to replace the card (which is currently
free) and receive a new PIN number. (See Reference #9.)
Mr. McNulty asked Ms. Brown if there are any security lessons for the overall EBT program to be
drawn from her state's experience. She said that separation of duties is the most successful. She
discussed other security measures that have been resolved and they include, but are not limited to,
improved workstation audit trail reporting, reduced number of user IDs with access to the system,
automatic aging of inactive user IDs, and updated procedures for establishing new EBT recipients.
Ms. Brown talked about future projects to include: EBT for gas and electric, housing, and farmers
market vendors.
Mr. Tom Martin, U.S. Department of Agriculture, Office of the Inspector General, discussed the
fraud, waste, and abuse of EBT in the Food Stamp Program. He said that even though EBT
replaces coupons, fraud is still a problem. Internal controls are applied such as separation of duties.
The Privacy Act is applied to all EBT programs including law enforcement except in the case of
fraud.
Mr. Tom Musselwhite, U.S. Secret Service, is involved in EBT to investigate food stamp and
financial institute fraud. He said that secure systems for the delivery of government benefits should
be employed. An EBT program should address the following:
Applicant/Recipient Verification.
Any document can be counterfeited. 100% verification can be obtained by
fingerprints encoded on the card.
Card User Verification.
Lost and stolen cards can be used by criminals.
Physical Card Security.
Features in the EBT card can prevent counterfeiting.
Authorized Purchases.
Measures should be taken to ensure that program funds are spent for intended
purposes.
Computer Systems Integrity.
Can reduce potential for compromise of systems. (See Reference #10.)
Dr. Ware complimented the State of Maryland for a job well done and for their strong message on
computer security.
Worksite Verification Recommendation
Dr. Susan Martin, Executive Director, U.S. Commission on Immigration Reform, briefed the Board
on the Commission's recent report on ways to reform U.S. Immigration policy. The Commission
was mandated by the Immigration Act of 1980. The first report on immigration reform is due to
Congress by September 30, 1994 and the second report is due in 1997. One major recommendation
is to deter and prevent illegal immigrants employment. Two problems remain:
1. employers are able to hire illegal aliens; and
2. potential is high for discrimination because of looks or accent.
The Commission is proposing the development of a computer registry based on SSN that will allow
employers to check the SSN against the registry. This will eliminate the current process.
The Commission proposes five pilot programs with three approaches:
1. Issuance of temporary SSN card linked to database;
2. Issuance of drivers license as basic identifier issued by DMV linked to database; and
3. telephone verification, asking name, SSN, mothers maiden name.
There are various security and privacy concerns:
1. preventing the system from fraudulent use; and
2. concerns that the database does not have any weaknesses.
The Commission is very concerned about the security and privacy issues and hopes to identify some
of the problems through pilot programs as well as seek the Boards advice. It is the hope of the
Commission to deter the illegal alien by removing the magnets, which are jobs. (See Reference
#11.)
The meeting recessed at 5:05 p.m.
Thursday, September 14, 1994
Governmentwide Electronic Mail
Dr. Neil Stillman, Deputy Assistant Secretary for Information Resources Management, Department
of Health and Human Services, briefed the Board on an Office of Management and Budget (OMB)
chartered task force to establish a government infrastructure for interagency electronic mail. Dr.
Stillman discussed the vision which would be: 1) a service that appears to the user to be a single
unified electronic postal system, 2) offers robust and trustworthy capabilities with legally-sufficient
controls for moving all forms of electronic information among employees at all levels of government,
and with the public, and 3) like the nations telephone network, is affordable, ubiquitous, efficient,
accessible, easy-to-use, reliable, cost-effective, and supported by an effective directory service. Dr.
Stillman discussed the idea of "Business Quality", loosely defined as security and availability. There
was some discussion between Board members and Dr. Stillman to more closely define what
"Business Quality" Email means. The Board highly recommended that the task force not use this
term, as it is not recognized by the community and has different meanings to different people. Dr.
Stillman went on to outline the functional, management, and technical requirements. He discussed
the task force's recommendations to OMB which are:
1. Promote Electronic Government;
2. Require Governmentwide E-mail Connectivity;
3. Establish a Governmentwide E-Mail Standard;
4. Promote Public Access;
5. Establish governmentwide E-Mail Directory;
6. Issue E-Mail Policy;
7. Establish E-Mail Program Office;
8. Establish E-Mail Management Council; and
9. Provide Funding for Governmentwide E-Mail.
Dr. Stillman said that OMB would look favorably on those agencies that have e-mail in their budget;
however, OMB is not planning on providing agencies additional funding for this effort. Board
members expressed concern that privacy was not addressed and that policy is needed first.
(See Reference #11).
Reaction to Public meeting on Information Superhighway Security
Mr. Martin Ferris, Computer Security Program Manager, Department of Treasury, briefed the
Board on the public meeting on NII security held in July of this year. He reported that the
Information Infrastructure Task Force (IITF) recognized that they had not addressed security in the
National Information Infrastructure (NII); therefore, the NII Security Issues Forum was organized.
A meeting was held and the public was invited to appear before the IITF and members of the NII
advisory council to assess security needs and concerns of potential NII users. The participants were
asked to address three principal questions:
1. How will the NII be used;
2. What security exposures or risks are of concern; and
3. What type of approaches should be taken to address those concerns.
There were several hundred people in the audience and 32 speakers participated. The speakers were
from several communities, including:
commerce/banking trade;
business/manufacturing/industry;
health services;
electronic publishing/entertainment;
education/libraries; and
government services.
The presenters discussed the importance of security. They would like and need additional dialogue.
Mr. Ferris said that the speakers recognized many of the security needs and solutions within the NII.
He also expects the federal government to have a role in some of the solutions to the NII security
needs. Mr. Ferris reported that the next steps will be to continue dialogue via additional meetings.
The process for those meetings is yet to be determined. (See Reference #12).
Update on Congressional Privacy and Security Issues
Mr. Lynn McNulty, Associate Director for Computer Security, NIST, gave the Board an update on
Congressional activities. Mr. McNulty discussed the Digital Telephony Bill (HR 4922). He said
that this is the third attempt to get legislation going on this Bill; however, this is a new proposal
expected to be passed during this session of Congress. The purpose of HR 4922 is to make clear a
telecommunication carrier's duty to cooperate in the interception of communications for law
enforcement purposes, and for other purposes. He outlined the key provisions telecommunications
carriers must ensure:
1. Intercept communications;
2. Access call identifying information;
3. Deliver intercepted communication to the government; and
4. Do the above in a surreptitious manner.
Mr. McNulty said that the law does not authorize any Law Enforcement Agency to require specific
design features or to prohibit the adoption of specific features. He said the Bill also relieves carriers
of any responsibility for decrypting communications, unless encryption is provided by the carrier.
Mr. McNulty reported on the status of a staff draft of a Bill, tentatively titled the Encryption
Standards & Procedures Act. It is the purpose of this Act to allow government to issue voluntary
encryption standards but only under a formal rulemaking process where stakeholders have
opportunity to influence final program. The key provisions are to:
1. Authorize NIST to establish an encryption standard & procedures program;
2. Authorize the Computer System Security & Privacy Advisory Board to review any
standard before issuance and submit recommendations and advise;
3. Establish statutory requirements for key escrow agents and establish key release
procedures; and
4. Criminalize misconduct by escrow agents or law enforcement officials. (See
Reference #13).
Tax Systems Modernization - Business Changes - Security Challenges
Mr. Hank Philcox, Chief Information Officer, and Mr. Jim Robinette, Information Security Officer,
Internal Revenue Service (IRS), presented the Board with IRS' Tax Systems Modernization
program. Under the old program, 25 year old systems were not connected to each other and there
was inadequate monitoring detection and prevention capabilities. Mr. Philcox said that they began
to look at how they could transform the delivery of services to customers and change the way they
do business. Mr. Robinette discussed their new operating concept which would give immediate help
to customers by providing: more electronic and telephone activity; education/outreach; research;
redefining of jobs; new measures; an emphasizes on training; and streamlining paper. Some of the
security challenges will be to:
ensure data access to IRS users (tax payers in the future);
prevent browsing;
detect and prevent fraud (e.g., artificial intelligence techniques);
educate IRS users; and
provide physical protection of information.
Mr. Philcox discussed an IRS video that has been seen by all IRS employees. The video has a series
of vignettes showing the types of privacy issues employees may encounter.
The Board commended IRS' efforts and made a motion to draft a statement. The motion was made
by Mr. Steve Walker and seconded by Mr. Cris Castro. Mr. Philcox abstained. Dr. Ware said that
he and Mr. McNulty would draft a statement to be delivered to appropriate government officials.
(ACTION CHAIRMAN AND SECRETARY.) (See Reference #14.)
Status of Security Handbook
Mr. Ed Roback and Ms. Barbara Guttman, NIST, presented the Board with a status of the NIST
handbook effort. Mr. Roback and Ms. Guttman remarked that 500+ copies of the draft handbook
were mailed out for review and was also available on the NIST bulletin board. Forty-five comments
were received. Some of the questions posed to readers were:
Are we missing topics? If so what are they and where do you suggest we add them?
Suggested text would be welcome.
Do you have any additions to any of the cost considerations or interdependencies sections to
add? Please be specific.
We would like our references to be as useful and current as possible. Do you have nay
additional ones? should any be deleted?
Do you thing the Handbook will be useful? (The majority said yes.)
Some of the major general comments from readers had to do with the title of the document. Some
readers also felt that the document needs better finding aids. They questioned whether there is an
audience such as the one described in the document.
Mr. Roback and Ms. Guttman discussed some major comments on specific topics. Some
commentors suggested that the authors work with the Office of Management and Budget (OMB) to
go along with their approach on accreditation and certification. There was significant disagreement
about the policy chapter. The handbook refers to three types of policies and comments received
(including some Board members) argued that there is only one type of policy, and that is an overall
security policy (i.e., that establishes an organizations's computer security program. Other topical
comments were discussed, such as, program management, audit, assumptions, trusted systems, and
networks. The handbook is being written in coordination with other projects, for example, OMB's
A-130, the Generally Accepted Systems Security Principles, and the UK Department of Trade and
Industry (DTI) Codes of Practice. NIST will be reviewing the handbook over the next few months
and hopes to obtain the assistance of a technical editor in the process. (See Reference #15.)
Status of Generally Accepted Systems Security Principles (GSSP) Effort
Ms. Barbara Guttman, NIST Computer Security Division, addressed the status of the Generally
Accepted Systems Security Principles (GSSP) effort. The GSSP's are a task under the National
Performance Review. It began as an Information Systems Security Association (ISSA) effort as a
result of the Computers At Risk recommendation. NIST and ARPA prepared a proposal to the
GSSP Committee to expand the effort. NIST also has a task item under the NPR to draft high level
GSSPs. In August, NIST and ARPA sponsored a meeting to explore what is needed with GSSPs.
Ms. Guttman stated that they wanted to get from the community what they needed in GSSPs and
did they in fact want GSSPs. Participants decided it would be better to do something quickly with
the work that has already been done and concluded that it would be helpful to publicize and move
existing GSSP documentation forward by:
Publishing executive principles based on OECD;
Publishing and keeping up to date practices (DTI/Handbook);
Continuing with Common Criteria and Evaluation Efforts; and
Looking to see what else is needed.
Ms. Guttman noted an ISSA draft report that is due out in the near future. Mr. McNulty said he
would see that Board members receive a copy. (ACTION SECRETARY). (See Reference #16.)
Public Participation
At this time the Chairman asked if any of the members of the public at the meeting had any remarks
they wished to address to the Board. There were no comments from the floor.
Board Discussion
During Board discussion the minutes from the June meeting were approved. The Secretary agreed
to provide a signed copy to the Board members. (ACTION - SECRETARY) Also, Dr. Ware
agreed to draft a letter to Ms. Sally Katzen of OMB, to inquire about the future plans for security
and privacy issues being addressed by the IITF Security Forum. (ACTION - CHAIRMAN)
Closing
The Chairman advised the Board members that there was no further business for the group to
consider. He asked if the Board members had any additional suggestions for the December meeting.
Ms. Lambert suggested briefings from the medical community on security and privacy issues.
There being no additional business for the Board, the Chairman adjourned the meeting at 3:25 p.m.
References
#1 - NRC Study
#2 - McNulty slides /s/
#3 - Rosenthal slides Lynn McNulty
#4 - McNulty slides Secretary
#5 - Walker slides
#6 - Radzikowski slides
#7 - Saltman slides CERTIFIED as a true
#8 - Kohler statement and accurate summary
#9 - Brown slides of the meeting
#10 - Musslewhite slides
#11 - Stillman slides
#12 - Ferris slides
#13 - McNulty slides /s/
#14 - Philcox slides Willis Ware
#15 - Roback/Guttman slides Chairman
#16 - Guttman slides
Meeting of the
Computer System Security and Privacy Advisory Board
December 7-8, 1994
Sheraton Reston Hotel
Reston, Virginia
AGENDA
WEDNESDAY, DECEMBER 7, 1994
I. INTRODUCTION
9:00 Welcome
Lynn McNulty, Board Secretary
9:10 Opening Remarks
Willis Ware, Chairman
II. RECENT CRITERIA ACTIVITIES
9:15 Common Criteria Update
Stu Katzke, Chief, Computer Security Division
National Institute of Standards and Technology
9:45 Discussion
10:15 BREAK
III. KEY ESCROW UPDATE
10:30 Key Escrow Approaches Workshops
Lynn McNulty
IV. PRIVACY ISSUES
Information Infrastructure Task Force (IITF) on Privacy
Rob Veeder, Privacy Advocate
Internal Revenue Service
11:30 Discussion
12:00 LUNCH
V. CONGRESSIONAL UPDATES
1:30 U.S. Congress Report Summary: "Information Security and Privacy in Network
Environments"
Joan Winston, Project Director
Office of Technology Assessment
2:15 Update on H.R. 5199 - Encryption Standards and Procedures Act of 1994
Anthony S. Clark, Professional Staff Member
House Science, Space, and Technology Committee,
Subcommittee on Technology, Environment, and Aviation
2:45 Discussion
3:00 Computer Network Security and Privacy
Walt Koscinski, LEGIS Fellow for Sen. Roth (R-DE)
3:15 Crime Bill Revision, 18 U.S.C. Sec. 1030 A5
Stevan Mitchell, Trial Attorney, Computer Crime Unit
Department of Justice
3:45 Discussion
VI. PUBLIC COMMENT PERIOD
4:15 Public Comment
(max. 5min. per speaker - sign up in advance with secretary)
VII. GENERAL DISCUSSION
4:45 Board Discussion
5:00 RECESS
THURSDAY, MARCH 23, 1995
VIII. REVIEW OF DISA SECURITY PROGRAM
9:00 Program Overview
Robert Ayers, Director, Center for Information Systems Security
Defense Information Systems Agency (DISA)
IX. SECURITY OF GOVERNMENTWIDE E-MAIL
9:30 Governmentwide Electronic Mail
Tom DeWitt, Acting Program Manager
General Services Administration
10:00 BREAK
10:15 Security Protocol for the World Wide Web
Greg Bergren, Technical Director, Architecture and Standards
National Security Agency
10:45 Discussion
X. GENERALLY ACCEPTED SYSTEMS SECURITY PRINCIPLES (GSSP)
11:00 Status of GSSP Effort
Will Ozier, Chair, GSSP Committee
President and CEO of OPA
11:30 NIST's Participation in GSSP Effort
Stu Katzke, NIST
11:45 Discussion
12:00 LUNCH
XI. GOVERNMENT DIGITAL SIGNATURE ACTIVITIES
2:00 Panel
Security Infrastructure Program Management Office
Al Williams, Telecommunications Specialist
General Services Administration
Update on Proposed Procurement for Prototype Infrastructure Services
Robert Rosenthal, Manager, Protocol Security Group
NIST
Postal Electronic Commerce Services
Dick Rothwell, Senior Director, Technology Integration
U.S. Postal Service
3:00 BREAK
XIII. ARPA SECURITY PROGRAM
3:15 ARPA NII Security/Privacy Program
Teresa Lunt, Program Manager
ARPA/CSTO
3:45 Board Discussion/March Agenda/1995 Workplan
4:30 ADJOURN
------------
Next Meeting - March 22-23, 1995
Holiday Inn
Gaithersburg, Maryland MINUTES OF THE
DECEMBER 7-8, 1994 MEETING OF THE
COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD
Wednesday, December 7, 1994
Introduction
A quorum being present, the Chairman, Dr. Willis Ware, called the meeting to order at 9:00 a.m. at
the Reston Sheraton Hotel, Reston, Virginia. Besides Dr. Ware, the following members were
present: Charlie Baggett Jr., Cris Castro, Don Gangemi, Sandra Lambert, Henry Philcox, Cynthia
Rand, Stephen Trodden, Steve Walker, and Bill Whitehurst.
Mr. McNulty, Board Secretary, introduced two designate members, Mr. Randolph Sanovic,
Corporate Manager, Computer Security Planning, Mobil Corporation and Ms. Linda Vetter, Vice
President, Product Management Server Technologies Division, Oracle Corporation. He also
welcomed, again, Ms. Genevieve Burns, Monsanto Corporation, as a designate member, who was
present. Mr. McNulty noted that he had received a letter of resignation from Ms. Cynthia Rand. He
said that the Board would be looking within the government for a replacement to be at the March
meeting.
Mr. McNulty stated that there was nothing to report on the merger at NIST between the Computer
Systems Laboratory (CSL) and the Computer and Applied Mathematics Laboratory (CAML);
however, an off-site was scheduled for the week of December 12 to discuss the reorganization. He
said that the process to select a Director for the new laboratory remains underway.
The entire meeting was held in open, public session.
Recent Criteria Activities
Dr. Stuart Katzke, Chief, NIST Computer Security Division, gave the Board an update of the
Common Criteria (CC) activities. He reported that copies of the CC were distributed to members
of ISO at the September meeting. All sponsors expressed their intent to adopt the CC as their
national criteria when it is complete. Based on that, ISO sent a proposal to the national bodies
proposing to accept the CC as the basis for the ISO document. The Chairman asked Dr. Katzke if
ISO will definitely use the CC as a replacement for the ISO document. Dr. Katzke reported that he
believed the pieces of the ISO document that are in progress now will be removed and substituted
with the October draft of the CC. [Comments on the CC will be reviewed and processed in March
1995.] The CC Editorial Board will spend the first two weeks in April analyzing the contents to
decide which issues to handle. Two workshops will take place in May, one in Canada and one in
Europe. Attendees will be those people who submitted comments to discuss the issues and how to
solve them. Dr. Katzke stated he hopes to have a briefing at the October 1995 National Computer
Security Conference on the status of the CC; however, he does not think there will be a new version
for the conference. The completion date is still to be decided.
Dr. Katzke discussed the evaluation issue. He said that NIST and NSA has been working this issue
for some time, but are having difficulty establishing a TTAP. There is little vendor or commercial
interest for evaluated products. Dr. Katzke pointed out that there may be a need to rethink the
importance, relevance, and cost-effectiveness of evaluations for obtaining trust in commercially-oriented products/systems. Dr. Katzke and the Board discussed whether there is a need for a new
evaluation process.
Individual Board members made the following recommendations:
- Assure that security is built into the product during the development process. Expand the
process to include both hardware and software. Allow vendors to trade off security options
and hardware/software options when developing networks for differing degrees of assurance.
Base network components on functionality, cost, performance, and the minimum level of
assurance needed. Evaluation of Commercial-Off-The-Shelf (COTS) products is not
achievable due to the short lifetime of COTS product versions and the inability of the current
evaluation process to keep up. The evaluation process needs change from being an
evaluation of a product of effecting the development process of a vendor's product.
Determining the vendor's "security process capabilities" during their development cycle will
be key.
- Have the client work with the developer to find the appropriate assurance level. Automate
the auditing process team more. Develop baseline controls for each type of application in a
business environment.
- Expand the entire security process to include not only incorporation of security in the
development process, but also testing, evaluation, and auditing of operational networks.
- Measure the vendor's product security development process. Establish a gray scale to detect
functionality of the network/total system. Ensure deployed/operational network use and
security maintenance measurement. Require periodic assessments and testing/verification of
high-level assurance networks.
- Expand the CC framework applied against the most important business areas in the US.
Change the focus of the CLEFs to apply a general application analysis approach.
At this time, Mr. Lynn McNulty, acknowledged Mr. Hank Philcox, recipient of the Government
Executive of the Year Award from Government Computer News.
Key Escrow Update
Mr. McNulty reviewed the status of the recent workshops held to discuss alternative approaches to
key escrow encryption find alternative ways to accomplish the fundamental policy objectives of the
government's key escrow approach. The White House assigned NIST the responsibility of
organizing a workshop to try to look for other approaches to accomplish key escrow, particularly
software alternatives. A meeting was held in June of 1994 with twenty vendors participating. The
meeting was held according to Vice President Gore's letter to Rep. Maria Cantwell in late July of
this year. A second meeting was held in August with greater vendor participation. Meetings were
scheduled for October and December but because some basic policy questions could not be
answered by then, the government postponed the meeting until early 1995. The vendor community
has agreed that no substantive progress can be made at looking at alternative key escrowing
techniques until some basic policy issues, raised by industry, are resolved. Five policy issues, or
principles, were referred to industry by government.
In summary, Mr. McNulty said that the next workshop is on hold until the policy issues are resolved.
He said that NIST continues to receive requests for participation. (See Reference #1.)
Ms. Lambert asked Mr. McNulty to give a status of the Micali patent agreement. He said that NIST
previously announced that the government had reached an agreement with Professor Silvio Micali,
of MIT, to obtain exclusive license to use his patents when used on government approved key
escrow encryption devices or chips. Professor Micali received an initial partial payment for his
techniques. The second payment has been held up due to allegations about whether Professor Micali
was the sole inventor. Meanwhile, Professor Micali has sold his patents to Bankers Trust of New
York City. Mr. McNulty emphasized that he has not been involved with any of the legal
negotiations of the patent holders and is relating second hand information.
Privacy Issues
Mr. Robert Veeder, recently selected as Privacy Advocate for the Internal Revenue Service and
chair of the Privacy Working Group under the Information Infrastructure Task Force (IITF),
discussed privacy issues within the government. He said that because the National Information
Infrastructure (NII) is interactive, it seeks advice from many different privacy experts and private
and public sector parties. Two public hearings were held, one in Sacramento and one in
Washington, D.C. These meetings brought panels together from particular sectors (e.g., financial
services, law enforcement, and public archivists) to address NII privacy and the effects of NII
privacy on their operations.
One task the group is looking at is developing principles that would at least govern some kinds of
behavior and define some kinds of relationships with the participants of the NII. The second task
was set by the National Performance Review to look at creating, at the national level, a privacy
board, privacy commission, data protection commission or other entities that would have as its sole
focus the privacy interests both from the private and public sectors.
Mr. Veeder stated that there are two reasons for developing a new set of principles that could be
used to define behavioral relationships in the NII is: (1) to develop principles that describes a static
environment, and (2) a desire to have the federal government's leadership role on this issue. The
group debated, wrote, and developed some principles, sent them out for review, received comments
back and published them on April 29 in the Federal Register. The latest draft needs go to the IITF
for final approval. Mr. Veeder shared with the Board what he considers to be a final draft of the
principles, but they have not yet been approved by the full IITF Committee. He said they tried to
define the environment. There are two kinds of participants; those who provide information and
those who collect and use information.
Dr. Ware suggested that the group might consider using the principles as a basis of amending or
rewriting the Privacy Act, the Fairness Relations Code, and health care regulations/rules.
When asked if these guidelines map to the OECD guidelines, Mr. Veeder said that he was
comfortable that they are consistent with the OECD guidelines and in some respects a little stronger.
(See Reference #2.)
U.S. Congress Report Summary: "Information Security and Privacy in Network Environments"
Ms. Joan Winston, Project Director for the Office of Technology Assessment (OTA), briefed the
Board on OTA's recent report: "Information Security and Privacy in Network Environments." Ms.
Winston began by noting that the views and opinions expressed were her own, and not those of
OTA, the Technology Assessment Board, the Technology Assessment Advisory Council, or
individual members. Ms. Winston explained that OTA is an analytical arm of Congress created to
provide analysis of technological issues. The report was requested by the Governmental Affairs
Committee. The request for the assessment originally came from Senator Roth, then Ranking
Minority Member of the Senate Committee on Governmental Affairs in the 102nd Congress. OTA
was asked to study the changing needs for protecting unclassified information and for protecting the
privacy of individuals. Senator Glenn and Representative Markey also endorsed the request.
The report focuses on safeguarding unclassified information in networks, but because of limited
resources, the report mainly deals with confidentiality and integrity of the information and leaves
aside the issue of network security. The report also focuses on the processes that the government
uses to regulate cryptography and to develop Federal Information Processing Standards (FIPS)
based on cryptography. The report highlights the main policy issues.
Ms. Winston pointed out that each policy issue lays out options, rather than recommendations. In
answer to a question by the Chairman, Ms. Winston said that it was not clear that the current
working relationship between NIST and NSA is necessarily achieving the proper balance. Greater
oversight enforcement is needed of at least the Computer Security Act as it is written. She said that
this could be contingent on what OMB does.
Board members asked Ms. Winston what happens with the options. She said that the options were
available to Congress to act as it deems appropriate. (See Reference #3.)
Mr. Anthony S. Clark, Professional Staff Member, House Science, Space, and Technology
Committee, Subcommittee on Technology, Environment, and Aviation, gave an update on H.R.
5199, the Encryption Standards and Procedures Act of 1994.
Mr. Clark said that Representative Brown introduced this Bill for two reasons: (1) A recognition
that if the Administration seeks to persuade the private sector to use encryption standards, the only
success would be public buy-in; and (2) To protect the public's constitutional legal rights and
protections.
H.R. 5199 would essentially bring under the rule of the law the encryption standard setting process
of the government and make clear, in law, that any such standard is voluntary. To require it or to
outlaw the use of any other standards would require an act of Congress. The way this bill is
structured, any party can challenge the standard for administrative or judicial means. A case would
have to be made that their rights and protections have been infringed upon and that the requirements
that are laid out in this particular statute are not adhered to in any particular way. It gives the
opportunity for recourse for any expectant party that does not now currently exist in the law. The
only recourse that any party has is through persuasion, or advocacy. The Chairman will reintroduce
this bill in its current form. It is anticipated that it will be referred in the House solely to the
Committee on Science.
Mr. Clark noted that one important thing to remember about the Clipper Chip initiative for the
Administration's encryption policy is it goes beyond the original intent of the Computer Security
Act. This may be inconsistent with other laws concerning individual privacy, protection of private
property, and government authority to conduct lawful electronic surveillance.
(See Reference #4.)
Computer Network Security and Privacy
Mr. Walt Koscinski, a Legislative Fellow for Senator Roth, discussed the Senator's plans as he
assumes the Chairmanship for the Government Affairs Committee and where he thinks the Senator is
heading with computer security issues during the next Congress. Mr. Koscinski noted that anything
he said were his views and did not necessarily represent those of Senator Roth or his staff. He said
he thought that the Senator's primary initiative will be to review the involvement and proper role of
the government, whether it is computer security, deployment of the Clipper Chip, or export controls.
Additionally, there is a perception that the government needs to correct its own deficiencies
regarding computer security. Overall, however, privacy is the Senator's paramount concern. Mr.
Koscinski said that at this point they were clearly in a fact finding mode. He said that they had met
with NSA to get their views. He told a group of about twenty representatives from industry and
academia, that there was resounding support for many of the conclusions recently published in the
OTA report. There is also support for some proposed options. Mr. Koscinski said that there were
distinct concerns regarding privacy, protection of privacy data, current export controls, the need for
better practices and awareness within the government for computer security, and a need to replace
or eliminate government involvement. Mr. Koscinski said that the Senator was very concerned
about the amount of government involvement in developing both standards and technology. He also
noted that the government needed to clean up its own house regarding the lack of management
attention to security and security training. He emphasized that the Senator's number one concern is
the protection of the privacy of Americans' personal data on computer networks. He said that
current law was out of synch with today's widespread use of computer and computer networks.
(See Reference #5.)
During the question and answer period, Mr. Clark wanted to clarify two important legal aspects of
encryption. First, the government cannot mandate or outlaw any encryption method used by the
private sector without an act of Congress. Secondly, a private escrow agent cannot be used to carry
out the Administration's policy without an act of Congress. The reason is a question of liability.
When asked if that provision extended to quasi governmental bodies (e.g., Postal Service, Federal
Reserve Board, or the Securities and Exchange Commission), Mr. Clark said that the main
distinction was what is governmental and what is private. The quasi governmental issue needs to be
resolved.
Crime Bill Revision, 18 U.S.C. Section 1030 A5
Mr. Stevan Mitchell, Trial Attorney, Computer Crime Unit at the Department of Justice, briefed the
Board on the revision of the Crime Bill. He discussed the hacker provision and specifically the
newly revised version of 1030 A5. in the Crime Bill Congress repealed the predecessor 1030 A5
and replaced it with a rewritten subsection, which is broader and more useful, in some respects.
Mr. Mitchell gave a brief overview of all the subsections of Section 1030. He said that 1030 was the
Computer Fraud and Abuse statute, with six substantive subsections, 1030 A1 through A6. Some
subsections protect the confidentiality of information, and others guard against unauthorized access
to various computers deemed in the federal governments interest.
Mr. Mitchell went on to discuss the old 1030 A5, which prohibited unauthorized access that then
resulted in the alteration, the damage, or the destruction of information, or the denial of use, of what
is termed a "federal interest computer."
The first positive point of the new 1030 A5 is that it improves upon the access threshold. It no
longer depends on access, but on "knowingly causing the transmission of a program, information,
code or command." This criminalizes the actions taken by the actor rather than the results of the
action. The second positive point is that it provides insider coverage and applies when a defendant
acts "through means of a computer used in interstate commerce or communications."
In closing, Mr. Mitchell said that the Department of Justice would be working on a high-tech
legislative package during the coming months.
He said that he would like to come back before the Board to share with them some ideas and to seek
the Boards views on the proposed legislation. (See Reference #6.)
Public Participation
At this time Mr. McNulty asked if any of the members of the public had any remarks they wished to
address to the Board. There were no comments from the floor.
General Discussion
The Chairman suggested that the Board finish discussion to further address Common Criteria and
TTAP issues at the March meeting. If it is to be discussed in March, the Board must identify the
issues for which they may wish to take a position. Dr. Katzke discussed whether there remains a
business case for setting up a TTAP. He said that he was faced with moving ahead with a TTAP
kind of program, which is the next step after the criteria. When asked what he means by "business
case," Dr. Katzke said that it means there is a need for a TTAP based on government funds.
Mr. McNulty, Dr. Katzke, and Ms. Vetter agreed to frame the agenda for the March meeting for a
one day overview of Common Criteria and TTAP issues. (ACTION - Mr. McNulty, Dr. Katzke,
and Ms. Vetter.)
There being no additional business for the Board, the Chairman recessed the meeting at 5:25 p.m.
Thursday, December 8, 1994
Review of DISA Security Program
Mr. Robert Ayers, Director, Center for Information Systems Security (CISS), Defense Information
Systems Agency (DISA), briefed the Board on the security program at DISA. He said that they are
instituting a program to improve all aspects of information systems security.
CISS is working on four main areas of INFOSEC Management and Policy Improvements. First,
they plan to standardize, within DoD, certification and accreditation methodologies. Secondly, they
intend to develop an INFOSEC products and systems program to ensure the availability of efficient,
cost-effective INFOSEC products for all of DoD. The third area is the use of a DoD INFOSEC
services contract for rapid and cost-effective acquisition of all INFOSEC services. This would
enable services and agencies to easily get INFOSEC services and to promote cost-effective
management and integration of INFOSEC resources to support common security requirements. The
last area is the establishment of a systems integration management office.
Mr. Ayers went on to discuss the INFOSEC architecture program. The objective of the program is
to develop a DoD-wide Goal Security Architecture within the DoD technical architecture
framework for information management.
He concluded with a review of current efforts. He said that various DoD
directives/instructions/manuals would be revised, consolidated, and canceled as INFOSEC is made a
distinct security discipline. Also, DoDD 5200.28, "Security Requirements for Automated
Information Systems" will be revised. (See Reference #7.)
Security of Governmentwide E-Mail
Mr. Tom DeWitt, Acting Program Manager, General Services Administration (GSA) briefed the
Board regarding GSA's new Electronic Messaging Program Management Office, or E-Mail PMO.
He related that this new office is still in the formative stages and he discussed the next steps that will
occur in the future. He reviewed some recent events that led up to the formation of the PMO. In
June, 1993, with the activity of the National Performance Review (NPR) gearing up, GSA offered to
establish a National Performance Review E-Mail Laboratory, which is now complete. The
laboratory supported four pilot projects to identify four existing government mission offices. The
sponsors were to conduct a re-engineering of the process involved.
Mr. DeWitt said that the four sponsors learned that all were extremely different when looking at it
from a practical business stand point. After customers requirements were evaluated and their basic
cultural characteristics were acknowledged, they found that: (1) the Office of Science of Technology
Policy Group is Internet technology oriented; (2) OMB is OSI technology oriented; (3) the
Administrative Conference of the US, because of their financial circumstances, was a suitable fit for
using a CompuServe forum primarily because they could not underwrite the technology as they had
no mechanism to recover cost; and (4) an action plan was developed for the Office of the Manager
of the National Communications Systems (NCS). NCS looked at the application of the Multilevel
Information Systems Security Initiative (MISSI) technology in the environments of end users.
The e-mail Task Force suggested to OMB that a program office be formed with central authority.
OMB assigned them a mission to provide a service, which appears to the user, to be a single unified
electronic postal system. This service would offer robust and trustworthy capabilities with legally
sufficient controls for moving all forms of electronic information among employees at all levels of
government and with the public. Like the nation's telephone network, it would be affordable,
ubiquitous, efficient, accessible, easy to use, reliable, cost-effective and supported by an effective
directory service.
Mr. DeWitt went on to discuss the charter of the PMO, which says that the program manager will
develop a two-year plan. The plan is not publicly available until the board of directors of the
Government Electronic Mail Steering Subcommittee (GEMSS) approves it. Mr. McNulty said he
would provide the Board with copies of the plan when it becomes available. (ACTION -
SECRETARY)
Board members relayed their concerns regarding security and privacy in the e-mail program. Mr.
DeWitt suggested that the Board review the two-year plan after it is ratified by the GEMSS. Board
members asked Mr. DeWitt to summarize the security aspects of the plan for them. He reviewed the
plan's nine points.
Mr. DeWitt said he did not feel that the security infrastructure is the responsibility of his office. He
said that he was confident that his office and the Security Infrastructure Program Management
Office have a clear understanding of their respective responsibilities. A separate program
management office will be responsible for security. Chairman Ware asked: (1) if there are security
safeguards in the plan and (2) whether privacy issues have been addressed. He said that the role of
his offices is to provide guidance, a framework, and information. End users, program managers,
developers, and those who administer agency systems within would have the information to decide
their security requirements. He did not suggest that his office regulate that process or intervene in
all of those programs and systems throughout the government and set their requirements and enforce
technology solutions. The security and privacy community will be involved in all aspects; however,
there is not one program that is specifically targeted toward security or privacy. Security and
privacy requirements will be imbedded throughout, based on information from the security and
privacy community.
Mr. DeWitt discussed "Business Quality" e-mail. Ms. Burns said that if his charter is to provide
"Business Quality" e-mail to the government, that he not even consider an Internet e-mail as the low
end but that he raise his sights to something much higher. She said that business would not tolerate
the transmission of electronic mail that anyone can access. It has to be securely transmitted from the
sender to the receiver without any interruption, modification, or browsing. She went on to say that
if he were to raise his expectations to what "Business Quality" e-mail means in the business
community, some security and privacy concerns will automatically be satisfied. Ms. Burns invited
Mr. DeWitt to visit Monsanto to discuss these issues. (See Reference #8.)
Security Protocol for the World Wide Web
Mr. Greg Bergren, Technical Director for Architecture and Standards at the National Security
Agency, briefed the Board on Security for the World Wide Web (WWW). Mr. Bergren discussed
security as the enabler for many WWW applications such as Electronic Commerce.
WWW security includes the following requirements that will: Account for services provided; Make
access control decisions; Record unauthorized access attempts; Prevent fraud; Prove liability;
Protect integrity of information and systems; Protect Intellectual property; Protect company bids,
plans and secrets; Allow multiple policies; Negotiate algorithms, modes and parameters; and Provide
interoperability with existing clients and servers without security.
To meet the above requirements, Mr. Bergrens' organization will provide the following services:
Identification and authentication to support control and accounting; Non-repudiation; Integrity; and
Privacy.
Two groups at NSA are working in two areas of WWW security, specifically in Mosaic. They were
concentrating on the security interface between the user and the secure Mosaic program, and the
interface to the security protocol mechanisms. The effort is focused on providing identification and
authentication and adding other services such as privacy and integrity.
Mr. Bergren concluded that challenges still lay ahead for making electronic commerce work.
Regarding the infrastructure, he said that most people would need public key certificates and
directory access. He also discussed interoperable certificate management and reliability. There
needs to be a way to know who is responsible and how to protect intellectual property. Network
architectures, particularly firewalls, are important factors in protecting systems. (See Reference #9.)
Status of Generally Accepted Systems Security Principle's (GSSP) Effort
Mr. Will Ozier, Chair, GSSP Committee under the sponsorship of the Information Systems Security
Association (ISSA), and President and CEO of OPA, briefed the Board on the status of the GSSP
effort which arose from a recommendation of the 1990 Computers at Risk study by the National
Research Council. NIST and ARPA are also involved in this effort. Mr. Ozier said the GSSP
Committee will be:
1. Responsible for identification of appropriate principles, guidelines, and product profiles that
will preserve the availability, integrity, and confidentiality of information systems.
2. An authoritative source for opinions, practices, and principles for the information security
profession and information systems products.
3. Maintaining a close liaison and coordination with other international authoritative bodies
who have developed related works to establish and maintain GSSPs, base on these efforts.
4. Working with the Information Infrastructure Task Force (IITF) to provide guidance for
establishing secure commerce on the Information Superhighway.
Mr. Ozier discussed the pervasive principles that specify the general approach information security
should take to establish, maintain, and report on the security of systems in their charge. He said that
these principles formed the basis for other principles. The following nine pervasive principles are
based on the work of the Organization for Economic Cooperation and Development (OECD):
