we need a uniform national standard for data security and data breach note fakes, and we need it now. while i remain hopeful that law enforcement officials will quickly determine the extent of these latest cyberattacks, they serve as a reminder that all companies have a responsibility to protect personal information and to promptly notify consumers when that information has been put at risk. and we have a responsibility as lawmakers to make certain that this happens. and now i would like to recognize the vice-chairman -- oh, i'm sorry. i didn't see the ranking member, mr. butterfield, for his five-minute opening statement. >> thank you, chairman bono mack for your diligence. i've been in my office with 28 constituents, one of whom was a world war ii veteran and several vietnam veterans, and they wanted to take pictures, and you know that drill, and so i had to accumulate them as best as i could. but we're here, and thank you very much for convening this hearing today. i certainly thank the two witnesses for your presence. mad a. chairman, thank you for holding this hearing on data sec

data usage is skyrocketing. interest of economy, businesses depend more than ever on having a beneficial relationships with their customers. and there's no question that protecting customer information should be a party for all businesses. and the customers deserve to be promptly notified if a security breach has put them at risk of identity theft or other harm. at the same time, the chamber urges policy makers to ensure that any legislation does not hindered innovation and beneficial uses of data. the chamber recently got this safety data act. the united states and the national economy -- almost every state has a breach provision. many differ from one or another in mature ways. it's a not only makes compliance difficult for businesses, but can also create confusion for customers who receive notices from many sources. the chamber supports the laws to create a uniform standard that will create regulatory certainty and minimize compliance costs for businesses who participate in multiple states. the chamber worries

on data security, the commission supports the enactment of a federal data security and breach notification legislation. i am pleased the legislation proposed in this committee aims to accomplish all of these goals. thank you for your leadership on consumer privacy and data security. we look forward to continuing to work closely with you on these critical issues. >> thank you, ms. brill. welcome, mr. ckerry. >> thank you, chairman rockefeller, senator thune, members of the committee. i bought them the opportunity to be here today and discuss with the -- i welcome the opportunity to be here today and discuss with you how we can best protect data privacy and the digital age. this is an issue that affects everyone. at this committee's hearing on march 16, the obama administration urged legislation to establish basic commercial data privacy protection for all u.s. consumers. what we recommended an had three elements. the first is baseline privacy protection in the form of a consumer privacy bill of rights, adapted from widely accepted fair information practices principles. the second is for gov

most importantly reflects the changing landscape of data breaches and data security since that time. it's an upgraded 2.0 version of data security legislation, encompassing many lessons learned, the aftermath of data breaches at sony in that song, which was more than 100 million consumer accounts at risk and those are just the ones we know about. the subcommittee chairman protection from identity theft and online fraud is one of my top priorities. just last week, citigroup, which has the world's largest financial services network revealed the security breach in which hackers have gained personal information from hundreds of thousands of accounts. according to law-enforcement officials they were able to gain access to customer names, account numbers and contact information such as e-mail addresses. yesterday we learned that next kernel website either wackier plant was victimized by cyberattacks and earlier this week they claimed responsibility for attacks on fox, pbs and 70 also asked the senate's public website. in recent years, cyberattacks intended to gain personal information abou

the safe data act is a start. i'm sorry we're not starting with the text that passed the house in the last congress. over the next few weeks, madam chairman, i hope you will work with me and my staff to strengthen this draft bill. together we can ensure consumer protections while allowing businesses flexibility to adapt their policies and procedures in today's rapidly evolving information age. thank you for having this hearing. i thank the commissioner for her presence today. and i think i might reserve my time. i'm old the gentle lady from illinois is coming. she is not here. i yield back. >> i just want to remind and enforce to the pam we intend having a full and bipartisan product to the best of our ability and that will be our goal. now i would like to turn our focus to the witness table. we have two panels today. on the first panel, we are honored to have honorable edith ramirez, commissioner at the f.t.c. thank you very much for being here today. you will be recognized five minutes to summarize your statemen

we have no data on its.this was supposed to encourage people in areas where people who were not participating in the choices. it was supposed to give them an extra encouragement towards participation. do we have any data that shows whether there were more applications? i want to see what the impact was before we start stumbling down on who is using it. i was saying and it's totally the only people i know who receives the preference are middle of -- i was saying the only people i know who received a preference are middle-class people. i am not convinced it has the equity of fact we are assuming it has a very good >> i think that is very true, and the other thing is i do not think the choice is between equity and feeders. i think that is an important thing. it is very difficult to do analysis until the children turned up in school, because there's so much movement. we agree it is hard not knowing how effective this is, and i do not think we will have a full chance until january. our specific guidelines on the

regarding the data presented, i think about the usefulness of this data in other aspects. how many people use these buses? that is also how many jobs are leaving san francisco on a daily basis. the question i have is, regarding the data, the lag time of a few years, is that just perpetual in the collection of data in annual report? is there any other way to have more real time numbers? >> commissioner farrell, it is an easy question but it had different layers. i will be very brief with you on this. the lag for the data in this report is just a result of the sar process. we need to consult with all the parties. it takes time. at some point, you have to stop collecting data to do the report. one of the goals in the process is precisely to set up a data collection mechanism that is not expensive and can generate more up-to-date data, at any given point, and be of use for other persons as well. we have a good track record in terms of designing systems that can do that. you may or may not be familiar with our cycle track application system. we develop an application for iphone

it is a data warehouse. today, if you want to know something very simple such as if there was a robbery in your apartment building, you would think that we could just look on a system that. we cannot do that today. we have the information, somebody entered the information, but it has been printed and put in a large room with other paper documents. what we hope to do is to simply automate that so that we can create searchable data for crime reports. from that, it will be san francisco data that will be community crime reports, so back to what the commissioner was asking, there is committed the crime reports that are available in 20 languages. that will be searchable as well. we will add the bay area crime reports. if i wanted to know the person walked with a limp, had a long, silver-barrelled handgun, i can pull up that day in an automated fashion. we have completed the first phase. that we have actually got the crime report online and searchable right now. we are working on the front end where the police off

data breach notification. privacy and data security are not coterminous comics. cdia's numbers of every class of regular today, including fair credit reporting, graham graham billy shillelagh do not cominco concepts to regulate entities to find information brokers at the to secure information and provide notices to consumers for there's a breach data. as discussed in a written testimony, privacy issues can interfere with development of data used to prevent fraud, identity theft and manage risk like those who discuss. let's move on claim to be security and notification which will establish a national entertainment should u.s. businesses can comply, which is always their high school. >> two munich very much. ms. rusu. i'm going to skip and jump right into it. i think we can all agree to logical advances over the past decade has created incredible fantastic tools for consumers to use. however, privacy is so important in with it today. even in today's of extensive sharing, few people agree every piece of informati

we have data from about 3000. so we think it is relatively good-quality sampling of the employer community. i will note that there is a different health care expenditure rate that applies to businesses between 20 and 99 employees, medium-sized employees -- medium-sized businesses. this ordinance declines those as medium-sized businesses. large businesses are those with 100 or more employees, and different expenditure rates replied -- apply to those. approximately half the reporters to us are medium-sized. have are the large size. the first way to broadly understand how these employers were making health care expenditures was the total dollars spent. supervisor campos alluded to this. 90% of all the health care data -- health care dollars are allocated to group health insurance plans. 3% son was allocated to the city option, the health the san francisco program, and at 7% was allocated to reimbursement plans. we can answer follow up questions. andres powers -- president o'brien: sorry to interrupt you. 90% were spe

this data is inconclusive. therefore, i am not sure i agree with what is before us to drop drop at this stage. otherwise, based on what is before us, i see no other legal maneuver. >> again, my hope is that you would not come to the conclusion that drop is costing money. supervisor chu: thank you, supervisor. are there any the members of the public who wish to speak on this item? >> gary, president of the san francisco police officers association. it is that same waiver. i hope you can take care of me. i want to talk to some of supervisor mirkarimi's increase -- questions and talk about the looming armageddon that we will see from a shared number standpoint if the drop is discontinued. we believe that if this drop is sunseted, we believe we will have another one had a 50 to 175 officers going into this in it the next week. that number will be approximately 325 officers that would then be in the drop program, with the clock running over the next one to three years. furthermore, we anticipate an attrition rate of

what i mean by big data is massive data sets, such as the data set involving the health information of the entire world community. imagine if you could, not just digitize it, but take the unstructured data in dinner languages and different format,combine that show, sort through it, and actually codify it so you could do data mining and dig through it to find the absolute best outcomes for any medical condition. think about the learning you can get from that about health, about the economy, about ecology. it would be spectacular and it's a whole new field just emerging. >> one of the fields ibm helped create is data storage, magnetic tape and everything that followed that. but what you're getting to is accessing and looking at that data, not just storing it. that's something entirely different. >> exactly. what i'm talking about doing is understanding it. you're basically going from being impressed by finding the proverbial need nettle haystack to finding the grain of sand under mount everest and that grain of sand have a profound impact on society. if you find it and can understand it,

understanding that you have no other data.i understand that perfectly, but that means that we have to try to take, you know, analyze something and make some presumptions, lots of presumptions about what may happen in the future, so i just want to suggest that if there is no difference, and then i do not see why we should not " -- " put ctip above feeder. to change the choice patterns into change in attendance patterns. but since we do not know yet, having no data that takes into account feeders, it seems to me that a more important message is how we put what we value into the order in which we place these things, so i am with the let's put the equity issue above the feeder issue, because, actually, i have been kind of nervous about -- i think we have made a lot of presumptions about people wanting these proposed so-called things, but i am not sure. we made a judgment about what we thought people would value without actually having any data on which to do that, so i still think since there is absolutely no data with which to ma

the idea is to put government data on the web, make it accessible to the public. it has been very successful. i know the general services administration department and 311 has now taken the lead on this and is getting departments more data on the web, but out of this initiative, we had over 60 applications created at no cost to the city that the public, simply by having access to the data on their own time, whether it is companies, whether it is just interested citizens with technical abilities, have created applications that citizens can use in san francisco to access services to utilize the city data to get the services they want without going toward traditional us coming to you asking for money, going through a long process to create these applications. the next one, enterprise applications, is a generic term we use to talk about rather than doing things on a department by department basis, really looking for commonalities across departments where we have shared applications where we are doing similar things. there is a number of examples i think we could use t

even where our members have data, we build enterprise- wide data security. for ann't speak individual company but all of our companies are involved in trying to build greater security into their products and companies who bring tools to businesses and services to support their and vermin. we recognize that they are ones that we would be subject to and our members are completely welcoming this legislation with some fine tuning we would like to see but it is important to act and important to act this year. >> thank you. >> with the standard it would make it easier for companies to comply versus the 46 or 47 state rules. >> we may not be hitting the bulova we are hitting that target. eye, but we are hitting the target. do your company is conducting assessments and how what this impact your company's ability and members to resolve the security breach? >> i will take a pass. >> i cannot speak specifically because those assessments would be dictated by the state laws that are out there which dictate different standards. that is one of the reason why a national sta

do we know if we can get more demographic data on these students? what i would really like to note -- to know, their socioeconomic status, we want to know, and also, and eventually, as something we want to know later, we actually want to note -- to know whether they are adding to the diversity of the school. >> we can do as part of the monitoring look to see what is the democratic profile of what they are requesting to help meet the board's goals of creating more diverse enrollments, and i will deftly make a note of that and include that in part of the work we are doing under monitoring. to answer the question about choice, like our children getting their choice, yes, they are. they are. there were only 622 children applying to sixth grade who lived in these areas, and the board deliberately did that. you divide it into quintiles. it would be less impactful. the number is always going to be a small, and i think your question about what schools that are requesting, we can get back to you on that, but in terms of if they are getting their choices, yes

so that will allow us to search data, count data, and the great news about not having a data warehouse currently is that we are able to leapfrog ahead of other major cities, and the technology we are implementing is really tremendous. it will allow us to do searching on all kinds of different factors. i was reading this morning about the blue to the bandit who is ge

or data breach notification. the members limit the variety of laws that limit their businesses today including the fair credit reporting act, and more. we urge this committee to -- such as provisions that regulate entitys with the duty to -- sensitive information and provide notices where there has been a breach of data. privacy can even interfere with the development of data which is used to prevent fraud and identity theft and risk. it will benefit consumers by establishing a national standard and ensuring businesses can comply, which is always their highest goal. thank you, mr. chairman . >> thank you. >> thank you chairman and members of the committee. i'm going to skip over the intro and jump right into it. tech logical advances have created a fantastic tool for consumeers to use. however privacy is still important and relevant today. even in today's age of extensive sharing, few people would think all information about them should be available to everyone for every conceivable purpose. 82% of respondants we

the bulletins are based on data collected by local governments. this man pays attention to the news, but he also checks radiation levels online. he's the father of two elementary school-aged children. he and his family live in a city about 65 kilometers from fukushima daiich i. they're out of the evacuation zone, but sometimes they experience the same measurements found in the no-go areas. he's frustrated because officials haven't released radiation readings for his neighborhood. so he's not taking any chances. to protect his children, he keeps their bedroom windows closed. he also blocks ventilation openings with plastic wrap. here sato is worried. >> translator: i'm not sure i can believe e numbers on the city's website. i was afraid radiation levels might have been higher in my neighborhood than in other places. >> reporter: that concern prompted sato to take action. he's one of an increasing fnumbr of people measuring radiation levels on their own. he borrowed one of the devices from a volunteer group that's trying to protect children from rad

so that will allow us to search data, count data, and the great news about not having a data warehouse currently is that we are able to leapfrog ahead of are able to leapfrog ahead of other major cities, and the

of reference data bases, and the collection of data in the warehousing of the data and distribution of them. there's a second smaller part which is devoted to research and analysis which is devoted to risk assessment, forensics, looking at crisis and why they occurred, what went wrong, financial innovation and how it's affecting the quality and character of our data, and the evolution of the financial system, and so on. the ofr will have a director and deputy directors who support each of those two sides of the organization so our goal in terms of research is to produce, promote, and sponsor financial research to publish non-confidential financial data, reference data, and i'll tell you exactly what that means in a moment, analytical tools, to establish fellowship and visiting scholar programs for people who want to work on financial research and collaborate with and provide data services for all the financial regulators and statistical agencies and finally to promote best practices in risk management for financial firms. we have underway several research projects in collaboration w

plus data from smart phones. >>bayen: typically the smart phone is able to capture its position, its speed, lots of different parameters. and if you have a lot of this data you can put it in models that can recreate traffic at a global scale. >>reporter: being able to see into the future might help one aspect of your journey. but getting from point a to point b is only part of the challenge. >>harrison: so you've made it into town using all the latest technology and gadgets to ease your commute. but you're not at your destination yet, there is just one more problem to overcome: parking. >>reporter: getting to point c - a parking space, could take you another 15 minutes. a ucla report found that 30 percent of all traffic circulating around a city is looking for parking. at san francisco based start up streetline, zia yusef wants to change that. >>yusuf: so it all starts with the sensors that we put into the ground so this is an example of one of them. as you can see it's very strong. inside the sensor is a pretty

have filed class action lawsuits over the data theft. during the hearing, schaaff called for increased protection against cyber attacks. he made reference to similar attacks that occurred at a u.s. aircraft company and a national research institute during the past two months. >>> russia has banned the import of fresh vegetables from the european union as deadly food poisoning e. coli bacteria spreads in germany. so far the e. coli outbreak has claimed 18 lives and sickened more than 1,000 others. the first victims died of hemolytic uremic syndrome which causes kidney failure. on thursday they announced a total ban from eu countries after cucumbers imported from spain was suspected of infection. russia russia said despite repeated requests the european union has not released proper information. the eu issued a statement that urged russia to end its ban it shows the it shows the source of the infection was not cucumbers from spain and the outbreak of e. coli is limited to the northern part of germany. the eu has asked other countries to re

in terms of the demographic data, we are fortunate to have the 2010 census, the first round of data available in march. unfortunately, we do not have all the data available yet in terms of the details about specific numbers of children in each age group, neighborhood, and other demographics, but we do have some high level findings. our approach together -- gathering community perspectives was kind of a multiple tubes strategy. we had 19 community meetings. several different meetings with parents and use city-wide grooves, met with a variety of city wide service providers. we also have focus groups with harder to reach populations, and then conducted a series of surveys to gather input from community organizations, high- school students, and public school principals. our main findings, again from the 2010 census, the biggest finding is that the number of youth has declined. 5000 less since the 2010 census, where's the bureau had predicted that there would be a growth of about 10,000. again, we are anxious to get more detailed information to understand what each group -- what demographics were

we used the data we gathered through our survey. having said that, we did look at various external cost studies associated with issuer costs. there are various problems, including the cost accounting systems can differ allot across firms. and in addition, whether or not a firm outsources things to a third party may affect their ability to identify certain types of cost components. and finally we recognized as we were performing the incentive effects associated with reporting for respondants enganged in the exercise we were looking at. but when we did look at the external studies, performed by consultants and processors and payment card networks, the numbers they got were largely comparable to what we received from our su va. there are caveats associated with that in they didn't survey the same issuers we surveyed. the level of granularity, we don't know how well that compares. at least it's sort of an aggregate level. their estimates are largely comparable to what we got. which makes us think our numbers are not radically off or the

and doing something with that data. be computing, deep analyt analytics, any of the above. even if you go all the way back to the very beginnings of the ibm country, we're talking 1911 we were about that. we did time clocks. fast forward to the time data became a huge challenge was after the great depression. we developed the machines that did all of the counting and all of the account for, for instance, the rollout of social security. what would you do with 30 million people you had to keep track some of it's physically impossible without these machines that could sort the data. the ams of data are tens of millions of times more complex. if you have more data tens of millions of times you need to be able to work with it tens of millions of times more quickly or it's useless. we came up with the disk drive. the monster there, the large platter was part of the original disk drive. in the mid-1950s when we invented it, the unit that held five mega bits of data held ten tons. today's laptops if we did no further work would

we have very little data on when people exit drop. just over 50 people actually exited drop during that time. looking at the impact on the behavior compared to the time just before, we estimated a cost if the drop program more permanent at .25%. that is an initial estimate based on the data we have to date. if it was made permanent, that would have to go through the retirement board and would be updated periodically as we got further experience. the report gives ranges of cost to date. three years or four d two and half years or for people who actually entered drop -- the ranges are shown in the report. with that, i will take any questions you have. supervisor mirkarimi: thank you. i appreciate the information. i'm still trying to understand of the baseline comparisons based on the data that has been handed to us. on the city analysis cost for detail, it itemizes everything from the beginning paid to trainers to help savings arrive acosta $55,100. are you with me on that? >> yes. but we did not have anything to do with that calculatio

so that will allow us to search data, count data, and the great news about not having a data warehouse currently is that we are able to leapfrog ahead of other major cities, and the technology we are implementing is really tremendous. it will allow us to do searching on all kinds of different factors. i was reading this morning about the blue to the bandit who is pigeon towed -- pigeontoed and apparently did this on the east coast four or five years ago. we will be able to search on those kinds of key words and pull up all those incidents reports, the field interviews, in the incident report reported by a community member, and eventually, we will tie that in to bay area and nationwide incident reports. this is an important project. we are in the first phase. we have actually automated our current incident reports in san francisco. we are piloting it with a small group of investigators and getting really great results. additionally and again, subject of a different meeting, but we have a road map in place of where we would like to go with the

will not get better data to give as the decision. we still have to make changes to the program anyhow. i don't think it is a good idea for us to have a one-year extension. >> any additional discussion? what of we take a roll-call vote? the roll-call vote to amend the motion. [roll call vote] >> there is one aye and 10 no's. supervisor

do you ever heard a your data, and why you hang on to do -- net two you ever -- do you ever purge data, and why you hang onto data so long? >> exelon has a relationship with the consumer. what data we hold is determined by the client, and what we do with it in terms of sending out notices or any sorts of marketing messages is up to the client. >> the you advise them on when it would be a good time to purge data? >> it depends. there is an opt out data, because you have to contain -- maintain records of who has opted out. if you have opted out and have not had activity, that list would still be there. >> my time is expired. i will recognize mr. bader field for five minutes. >> thank you, madam chairman. mr. schaaff, let me start with you. i understand your internal investigation has not turned up any evidence suggesting information was taken from the network, but that does not necessarily suggesting data was not taken, that you have not turned up additional fingerprints that would allow you to know with certainty it was taken. how certain are you data was not taken? >> we have been invo