Senators, Tech Execs Recommend Hack Reporting Requirement

Alyza Sebenius and Rebecca Kern (Bloomberg) -- A bipartisan group of senators on Tuesday recommended that the U.S. consider requiring companies to disclose when they have been hacked.

At the first public hearing before Congress since a massive cyber-attack by suspected Russian hackers was disclosed in December, Senate Intelligence Committee Chairman Mark Warner, a Democrat, was joined by the vice chairman of the committee, Republican Senator Marco Rubio, in calling for the measure. Several others, including Senator Angus King, an independent, also voiced their support, as did several of the tech executives who were testifying.

There is currently no federal data breach notification law.

“It is time, not only to talk about, but to find a way to take action to impose in an appropriate manner, some kind of notification obligation on entities in the private sector,” said Microsoft Corp. President Brad Smith. “I think it is the only way we’re going to protect the country, and I think it is the only way we’re going to protect the world.”

FireEye Inc. Chief Executive Officer Kevin Mandia said he supported a requirement that companies notify an appropriate government agency about being hacked. But he urged that it be confidential, to encourage companies to participate amid liability concerns.

The hearing before Warner’s committee on Tuesday included Sudhakar Ramakrishna, the CEO of SolarWinds Corp. -- the Texas-based software firm that the hackers compromised as part of the attack. He told the committee that the tool hackers used to compromise the company’s software “poses a grave risk of automated supply chain attacks” across the software industry.

The senators mostly used a light touch in questioning Ramakrishna -- who started at SolarWinds in January after the hack was disclosed -- about his company’s responsibility in the massive cyber-attack. He said his company is investigating three possible ways the attackers may have used to gain access to the company’s networks but haven’t reached a conclusion.

The senators were much tougher on Amazon Web Services for not appearing at the hearing despite an invitation. According to SolarWinds, its Orion software platform -- which was compromised by the hackers -- could be deployed by customers on AWS among other cloud platforms.

“The operation we will be discussing today used their infrastructure, at least in part,” Rubio said. “Apparently they were too busy to discuss that here today.”

Amazon.com Inc. didn’t immediately respond to a request for comment.

The hackers responsible for the incident inserted malicious code into SolarWinds’s software, which was delivered to as many as 18,000 customers through software updates, though fewer are believed to have been targeted with additional hacking.

The White House has confirmed that the hackers leveraged this access to breach more than 100 companies and nine U.S. agencies with follow-on hacking aimed at espionage.