of these, we need to have somebody, perhaps not of injure stature but as close as we can come in the months and years preceding it. we go to the gentleman from south carolina. >> mr. park, do you agree there's a difference between an innocent misstatement of a perceived fact and a deliberate attempt to deceive? >> yes. >> so do i. when did you first realize that you couldn't keep your health insurance even if you did like it, period? i don't recall. >> again, that's kind of a health policy matter, really outside my lane -- >> you don't know when you first realized you couldn't keep your health insurance even if you liked it, period? >> would you agree with me that credibility or the lack thereof in one area of life could impact credibility or the lack there of and any other area of life? >> i suppose it could. >> in your written testimony,

you wrote as you know, october 1st was the launch date of the new website, healthcare.gov. i did know that. i didn't know why. and i'm going to read to you a quote from secretary sebelius. she said and i'll paraphrase, she was hurried into producing a website by october the 1st because the law required it. i'll read you the direct quote. in an ideal world, there would have been a lot more testing. we did not have the luxury of that with a law that said it's go time on october the 1st of -- mr. park, i don't know what ideal world she's referring to so i'm going to stick with one we're in. what law was she referencing? what law required this website to launch on october the 1st? >> i can't really speak for secretary sebelius. >> i'm not asking you to speak for her. what law was she referring to? is there a law that required this website to required a

launch on october the 1st. >> again, that's a health policy legal matter that's not really -- >> it's a legal question. do you know if there's a law that requires this website to launch on october the 1st or do you know whether it was an arbitrary date that the administration settled on? >> i actually do not. >> would you find that to be important whether or not we really had to go given the october 1st given the fact we weren't ready to go october 1st? would you find that relevant, whether or not we had to launch a substandard product? >> sir, i respectfully just a technology guy -- >> don't -- don't short yourself. you're the smartest one in the room. >> that's not true, sir. >> trust me, i've been in this room for a while. it is true. there is no law that requires that. what secretary sebelius said was patently false.

there was not law that required a go time on october 1st. but i want to move to another component of her quote. some of us don't consider testing to be a luxury but let's assume that she's right, that additional testing would have been a luxury that would have been nice to have. how much more testing would you have done prior to launching? >> so, i'm not even familiar with the development testing regimen prior to october 1, so i can't really opine about that. >> let me ask you this. because you are the smartest one in the room. >> i'm not, sir. >> and very good at what you do, where in the heck were you for first 184 weeks? if you're being asked to fix this after october the 1st, in a couple of weeks, where were you for the first 184 after the so-called affordable care act passed? where did they have you hidden? >> so, sir, in my role of the

white house in the office of science and technology policy, i'm a technology and innovation policy adviser. i have a broad portfolio of responsibilities. >> but you're obviously good enough if they brought you in to fix what was broken, it's been called a train wreck, that's not fair to train wrecks. it's been called other things. they brought you in to fix. why didn't they bring you in to start it and build it? >> sir -- >> why didn't you build it? >> all hands on deck efforts across the administration to help under jeff zienst's leadership and in the lead up to october one, that wasn't part of my role. >> when will it be operational to your satisfaction?

>> we have a goal that the team is pursuing with tremendous intensity -- >> how many more weeks? i'm going to get asked when i go home. you can appreciate that. i'm going to get asked. when will it be operational? when will it be as good as it can get? you can see the first 184 weeks did not go swimmingly. is there going to be another 184 weeks? >> so, sir, i think the honest answer is that there's a team incredibly dedicated -- >> i get all of that. i'm looking for a number we can interpret the coin later. >> to have the site functioning by the end of this month, smoothly for the vast majority of americans. that's the goal -- >> the gentleman's time is expired. i might stipulate that mr. park was at hhs at the time of passage for the roughly first two years. his expertise does come out of the origins of obama care. >> my question, mr. chairman,

was simply if he's good enough to be rolled in to fix it after the locomotive crashed off the mountainside. where in the hell was he for the first 184 weeks when fs being broken? why wait until its crashed? if he's a savant, where has he been? the obama girls miss him -- i think they found her. the lady from the website. but where's he been? >> the gentleman's time expired. we now go to the gentleman from texas. would the gentleman yield for ten seconds? >> certainly. >> i want to make a statement and you're right on they should have had the a team on this and some of the people there clearly there for the train wreck. i want to know mr. park's possessive, duties did not include overseeing this website. and i do appreciate the fact that it appears as though in 60 days they are going to make right what wasn't ready on october 1st. and i think that's what the

gentleman wants to be able to explain back home. we've been told that november 30th this will work reasonably well, in other words, 60 day delay or less could have allowed this to be launched in a timely fashion. i thank the gentleman. >> thank you very much. and i do want to follow-up on that, mr. park. there are a lot of hedge words in there, vast majority of americans, mostly working. am i going to be to go to the irs and say it didn't work for me, couldn't get my insurance, i'm not going to be fined? i mean, you got to tell us when it's going to be in good shape. can you give us a date? is the end of the month realistic? >> the team is working really hard to hit that goal. that's what i can say right now. >> to me that -- as a former web developer that was what i was telling clients when we were missing a deadline, working hard to meet it. and i am a former web developer, certainly nothing to this gate but with $600 million i probably

could have put together a team to do it and do a better job. i'm not going to really throw the contractor under the bus. i think it's too much money and a lot of issues but one of the biggest struggles we had when we were developing a website was getting people, whether it was specifications, the copy we could change quick, cut and paste from an e-mail into an hdml letter. but when the actual specifications for how it goes change up to the last minute, it's very difficult to do. mr. chao, how late were there substantial changes being ordered to the website? do you have a time frame how long before that october 1st launch?

>> i don't think there were any substantial changes ordered. it was more a standard practice of looking at how much time you have left and watching your schedule very closely -- >> and then figuring out -- >> and the priorities that are set by the business. >> i want to follow-up on a couple of questions that asked and i didn't think it got completely answered. mr. jordan asked you, mr. chao, if it was thoroughly tested and you said yes. am jordan didn't ask the next follow-up question. how did it do on those tests? did it pass? >> i think what i was -- if i said thoroughly, i apologize. >> you said it was tested. >> it was tested under the prescribed. we were talking about security testing so i was saying it was tested under the prescribed security controls.

like mr. snowden, are those security risks there? also ask with respect to the private sector, if there's a data breach or compromise, your credit card information or your personal information gets released, there's a federal law requiring notice. i just got notice from a major software company that my credit card had been compromised. would we find out if our information on healthcare.gov is compromised? is there something in place where we'll know if that information has been hacked? >> yes, there are actually several laws and rules that apply like particularly are disclosing any incident or

breach that involves a person's -- >> so, no special exceptions that we will hopefully find out. again, i'm just concerned. we're at a time right now where the trust in government has never been lower. we have the irs looking at people for political purposes, so you'll excuse me me if i'm concerned that we've got a massive website that's target for hackers that a lot of people have information to. when ever you connect computers together, you open pathways to hackers, so i'm very concerned about the security issues. i just want to make sure we're going to know if there's problems and they're not going to be swept under the rug for political purposes. >> no, we work closely with frank bateman's security

operations at the department level as well as extensive computer -- >> you stated earlier in your testimony that the anonymous shopping feature, which i would love to see -- i don't even think it's in place now -- but it was disabled before the election, and we can talk about political purposes or not. >> i think the gentleman was saying before the october 1st launch. >> yes, but it's deleted. why wasn't the october 1st deadline pushed back because it didn't work? why wasn't the whole thing delayed? when you delayed the anonymous shopping part, the part we all feel most safe about, going in and finding out what it cost without revealing personal information, why did you delete that when you knew the whole thing wouldn't work? >> i think it was a tradeoff of knowing what something would be put in production. >> i have to say with my lack of trust in the federal government now, i am loathe to put my personal information in and would love to shop anonymously like i did in some of the

private companies in texas. i don't think you have to give up your personal information to get prices on something. you don't have to do it on airline web sites, you don't have to do it on amazon. i yield back. >> i thank the gentleman. is the gentlelady from new mexico prepared to go? >> yes, mr. chairman, i believe so. >> you're recognized. >> well, thank you very much. >> thank you for coming back. >> absolutely. thank you. and actually, before i start, i realize i wasn't here for this statement, but i want to echo what my colleague congressman langford said coming back nearly 20% on insured. two things have occurred.

one, people as of october 1st couldn't get on the website and are continuing to follow this issue very closely. their individual or family plans expired or were expiring, so they went off the exchange because they can't get on, and purchased brand new policies for another year, and unlike the small businesses, they're in that now for a year. and they're paying much higher rates than they would have could they have gotten on the individual exchange. because new mexico is a partnership state. and then second, as december 15 looms ever closer, we know that's another important deadline for many individual plans. and we have the same issue. and i'm very concerned about that, and i appreciate that it was brought up. so i told you about what we're working through and that we have

been fighting for a long time in new mexico to find ways to have access to affordable coverage. so i need, we need, my constituents need this website to work. they need to enroll in exchange, and i know you've heard all day long that we're all frustrated. they're frustrated, i'm frustrated, and while i wish we had better solutions for them early on, my biggest concern is that we're reaching a critical point in the implementation timeline. in order to ensure them that there is no gap in coverage between plan years, individuals and families who would like to choose a plan from the exchanges, as i said earlier in my remarks, have to be enrolled by december 15. your stated goal of fixing the website by the end of november leaves very little room for error. and i know it's not easy, but while you're here, i just want to make sure that for the record we're emphasizing that there is real urgency here. mr. park, i think that you have a deep appreciation for how transformative good technology can be, but i'd like to know if this is a time constraint that you're aware of, and also more broadly if you feel the same urgency as i do about getting

the site operational for as many users as possible. >> absolutely. >> then i can imagine that leaving your office for at least an entire day would have pretty important impacts on your work fixing the website. what would you be doing if you weren't here today? >> i would be working with a team on the site. >> so mr. park, i wish that you were working on healthcare.gov on the website right now. part of this committee's job is to ensure you have all the tools and resources you need to do your job. what else can we do to assist you to get this done? >> i'm a small part of a broad team working incredibly hard led by mr. tagler and the cns team. i would just say to one member of the team if you could just be responsive to that and their request for assistance, that

would be great. >> great. i think we'll need more clarity about that, and i also agree with this committee's efforts to talk about reforming i.t. procurement. i don't know if today is the day to deal with those best practices, and given the states do it poorly and that the federal government is doing it poorly and that we've spent millions, i guess billions of dollars on i.t. projects that haven't gone well anywhere in the public sector, we have to figure out a better way to do that. and i hope that this committee will continue to lead that effort in a bipartisan way. but i want to go back to the situation that we're in. i want to be results-oriented and i want to solve these problems. and i feel like we shouldn't be pulling a surgeon from the operating room today. so thank you, mr. park. i yield back. >> may i make one more statement

if that's okay? >> i just want you to yield. do you yield? >> i do. >> i just wanted to -- and actually not lose the second to last thread that you started, which was i.t. procurement. i think it's a phenomenally important issue. i think this team has done great on it. i think they need to do more. i would love to see a bipartisan effort attacking this issue from all dimensions. i know less about the people on this committee. what i do know is there are not a single silver bullet. there are decades of practices and rules and laws that have led to where we are now, but i think with a concerted effort we can actually take this out and deliver better, faster, higher return results to the american people. >> i the gentlelady had an additional 30 seconds and i yield to the ranking member. >> i just want to get to the bottom line real quick. what will happen is that people

will -- are sitting there -- i agree with the gentlelady. we are looking at results. when we go back to what happened with langford and he was trying to get on the page with mr. park, and he couldn't get there, can you talk about that for a minute? because that's real. there are probably people watching us right now who are trying to get on the page. and can you kind of tell us what you were doing and how that affects things like that. because, you know, they got reporters to sit on telecasts and they say i waited an hour, i waited two hours. tell us how that relates to what you're doing so our constituents can have some kind of assurances that things are going to get better. you follow me? >> absolutely, sir. thank you for the question. i'll just answer quickly because i know we have limited time. one, there have been dramatic improvements in the ability to, as a consumer, create an account and get onto the site in all the metrics that we're seeing, and

that's been a function of basically improving the ability of that part of the sector to handle volume through property expansion, software work and also fixing bugs. so many more people are able to get through now than at the beginning. that being said, it's not perfect yet. i actually would really love to follow up with the congressman to actually understand his specific use case and dial that back for the team. also, there are folks who early on got caught in the middle of that cycle and are stuck there, and those are folks that we're now reaching out to, as we talked about earlier in the hearing, to actually get them through the process cleanly. so it's an issue that actually, i think, has been in very large part addressed, but there's still more work to do, and i do want to follow up with the congressman. i understand the specific use case he's in and his situation so we can figure that out. >> thank you. >> now as we go to mr. massey, who, from the standpoint of his education and known i.q., could

in fact rival you as the smartest guy in the room. >> i'm from the trade school rival you as the martest guy in the room. >> no, i'm from the trade school that's a mile down the river from your art school that you attended. in any case, we share -- >> maybe you better share that with the rest of the world. >> i went to m.i.t., harvard. >> you definitely kicked my butt, sir. and maybe we can share some numbers later. we share an affinity for numbers. but first i want to talk about the final security control assessment that was prepared. i was unable to adequately test the confidentiality and integrity of the hix system in full. the testing efforts were test g

ing expected function of the application. so this was miner's final control assessment. we're throwing around a lot of three-letter acronyms. hix, ato. but i've got cya over this, mr. khao. this is the authority to operate to maryland tavern, which she signed off on. in this letter that you stated, due to system readiness issues, the sca, that's security control assessment, was only partly completed. this constitutes a risk that must be accepted, and mitigated to support the marketplace day one operations. in this sentence here, and this was written on september 27th, or certainly signed off on september 27th. were you trying to tell your bought -- >> there was acceptance with a

fairly significant rollout of the marketplace system. >> but that risk existed because there had never been an end-to-end security test on this, is that true? that's basically what the letter states here. >> i think in the previous testimony i've also said end-to-end is a highly subjective term. >> but if it's subjective, how are you going to get it done in 60 to 90 days? >> it all depends on the scope of what you're trying to put in production. >> the scope is our data safe? for instance, in this same letter, it's a very short letter signed by maryland tavern, september 27th, you suggested we conduct a full security control assessment -- so i'll let you define what that is -- in a stable environment, which implies that don't have a stable environment right now, where all security controls can be tested within 60 to 90 days of going live on october 1st. here's what troubles me about this letter. you're basically saying, look,

we can go live, but there's going to be security risks. but let's test it on real people's data, on real personal information. let's test it for 60 to 90 days. >> no, that's not what i said. that's not what the memo alludes to. when we do security testing, we don't do it in terms of using live people's data. we do secure testing in a pre-implementation environment -- >> well, i would contend we're well beyond pre-implementation. we're testing this in the real market and it is failing. you said the ato is not typical, is that true? >> that's true. >> you've never seen that sort of format before. is it a problem that you were not given the final security control assessment prior to authoring the ato, the authorization -- >> i don't think that's necessarily a problem. because my staff were copied on it. >> but you didn't get to see it? you said, actually, i didn't get a copy of the final -- >> correct.

because i was with the information system security officer in herndon when these tests were being conducted. and it was determined that there were no high findings -- >> it was the person's responsibility to operate it, i think you should have been at your desk reading the final security control assessment. if one was -- >> i was there in person. >> but i'm glad to see that you covered yourself by putting this sentence in here. >> i didn't -- that was not to cover myself. that was a decision memo between her and i. >> are any among you today willing to bet your job that thousands of people's personal data won't be released because the implementation of this website? >> that's certainly a yes or no question. >> that's a yes or no question. would you attest to that? >> you know, they're trying to ask us to predict something that security vulnerabilities are, as some folks have mentioned before, it happens every day. that's why we do security testing. >> obviously from the documents

here, you weren't comfortable with this. you were trying to transmit to your boss -- let me read your words again -- this constitutes a risk that must be accepted and mitigated to support the marketplace day one operations. in other words, to launch this thing by october 1st, you were telling your boss, she's going to have to accept some risks that are not normal for this. i did want to get into the numbers briefly. >> quickly, the gentleman's time is expired. >> mr. park, we've got mr. chao says 17,000 users an hour can subscribe. mr. langford has been waiting over an hour and a half. we have five hours of magnitude difference. which is closer to the truth? >> the gentleman may answer. >> how many people an hour are able to enroll in health care? you must know this. >> the gentleman previously said 17,000. is that correct? >> 17,000 region strastrations

hour. >> you've got some big number, the only number that matters, how many are enrolling right now per hour? can you tell us? >> so actually what the -- >> just a number. come on. we both love numbers. >> let the gentleman answer. your time is expired. it's a harvard m.i.t. problem, i think. we can talk more afterwards. in terms of enrollment numbers, those will be released by the lately. >> it seeks to increase competition in the marketplace, to help bring down health care costs. it ends the practice of denying coverage to those with preexisting conditions and lifetime limits on health care benefits. it also enables parents to keep their children on health care until they're 26 years old.

it also makes small businesses eligible for tax credits to ease the burden of employee coverage. the law also works to strengthen medicare, and will make prescription coverage for seniors more affordable. these tax credits are desperately needed in my district where nearly 9.4% of my constituents live below the poverty line. 70,000, that's 10.5%, do not have health insurance in my district, including 6,500 children. and they'll be able to utilize the subsidies offered under the affordable care act, finally, to get health care. now, i also want to get to the bottom of what's going on with this website, healthcare.gov. and i support oversight hearings for that purpose. however, this hearing, like so many previous hearings this committee has held, is clearly an extension of the politically motivated repeal or delay agenda that some of my friends on the

other side of the aisle have been pushing since this law was first passed in 2010. it seems to me if the chairman were so worried about getting this website fixed so the people could actually access affordable health care, he would not have subpoenaed mr. park to come in and testify today. in fact, mr. park agreed to testify before this committee just two and a half weeks later. but the chairman refused that offer, and subpoenaed him anyway. the chairman's subpoena combined with the constant leaking of partial transcripts, taking witness' quotes out of context, seems like it's part of a pre-determined political strategy rather than a constructive effort to conduct responsible oversight as this committee is supposed to do. in fact, although the chairman claimed otherwise in his opening statement here today, the house republican conference is politicizing this issue, and here's the proof. they have issued a playbook to republican members, they

actually call it that, a playbook, right on the cover of the thing, and it doesn't say how to fix problems with the website or improve the process, or work to ensure americans with health care. it tells them how to exploit how any challenges or glitches for their own political gain. i'm not just saying -- i'm not saying all republicans are doing this. but it certainly seems to me in this form that the chairman of this committee is. >> would the gentleman like to place that in the record? because i haven't seen it. >> yes. >> without objection, so ordered. >> it is my hope we can have oversight without this gamesmanship and partisan politics. as this committee has been able to do in the past. i would really like to get to the bottom of what's going on with the website. because i want my constituents to be able to sign up for quality affordable health care. mr. chao, on november 7, chairman issa issued a press