"Not at all, Senator." Hammacher sipped from his water glass. "As you can see, the interest in security was primarily from the government, and more specifically the defense community. In 1981, the Department of Defense chartered the DoD Computer Secu- rity Center which has since become the National Computer Security Center operating under the auspices of the National Security Agency. In 1983 they published a series of guidelines to be used in the creation or evaluation of computer security. Officially titled the Trusted Computer Security Evaluation Criteria, it is popularly known as the Orange Book. It has had some minor updates since then, but by and large it is an outdated document designed for older computer architectures.
"The point to be made here is that while the government had an ostensible interest and concern about the security of computers, especially those under their control, there was virtually no overt significance placed upon the security of private industry's computers. Worse yet, it was not until 1987 that any proposed criteria were developed for networked computers. So, as the world tied itself together with millions of computers and net- works, the Government was not concerned enough to address the issue. Even today, there are no secure network criteria that are universally accepted."
"Mr. Hammacher." Senator Rickfield spoke up for the first time. "You appear to have a most demeaning tone with respect to the United States Government's ability to manage itself. I for one remain unconvinced that we are as derelict as you suggest. Therefore, I would ask that you stick to the subject at hand, the facts, and leave your personal opinions at home."
Nancy Deere as well as much of the audience listened in awe as Rickfield slashed out at Hammacher who was in the process of building an argument. Common courtesy demanded that he be per- mitted to finish his statement, even if his conclusions were unpopular or erroneous.
Hammacher did not seem fazed. "Sir, I am recounting the facts, and only the facts. My personal opinions would only be further damning, so I agree, that I will refrain." He turned a page in his notebook and continued.
"Several laws were passed, most notably Public Law 100-235, the Computer Security Act of 1987. This weak law called for enhanced cooperation between the NSA and NIST in the administration of security for the sensitive but unclassified world of the Govern- ment and the private sector. Interestingly enough, in mid 1990 it was announced, that after a protracted battle between the two security agencies, the NCSC would shut down and merge its efforts with its giant super secret parent, the NSA. President Bush signed the Directive effectively replacing Reagan's NSDD-145. Because the budgeting and appropriations for both NSA and the former NCSC are classified, there is no way to accurately gauge the effectiveness of this move. It may still be some time before we understand the ramifications of the new Executive Order.
"To date every state has some kind of statute designed to punish computer crime, but prosecutions that involve the crossing of state lines in the commission of a crime are far and few between. Only 1% of all computer criminals are prosecuted and less than 5% of those result in convictions. In short, the United States has done little or nothing to forge an appropriate defense against computer crime, despite the political gerrymandering and agency shuffling over the last decade. That concludes my opening re- marks." Hammacher sat back in his chair and finished the water. He turned to his lawyer and whispered something Scott couldn't hear.
"Ah, Mr. Hammacher, before you continue, I would like ask a few questions. Do you mind?" Senator Nancy Deere was being her usual gracious self.
"Not at all, Senator."
"You said earlier that the NSA endorsed a cryptographic system that they themselves could crack. Could you elaborate?" Senator Nancy Deere's ability to grasp an issue at the roots was uncanny.