WASHINGTON, D.C.—U.S. Senators Mark Warner and Tim Kaine joined U.S. Senator Dianne Feinstein (D-CA) to introduce the Automatic Gun Fire Prevention Act, a bill to close a loophole that allows semi-automatic weapons to be easily modified to fire at the rate of automatic weapons, the sale of which have been significantly curtailed and strictly regulated for more than 30 years. This bill would ban the sale, transfer, importation, manufacture or possession of bump stocks, trigger cranks, and similar accessories that accelerate a semi-automatic rifle’s rate of fire.

“Fully automatic machine guns have been strictly regulated since 1986 under President Reagan. This bill will fix an egregious loophole that was exploited by the Las Vegas shooter to cause unspeakable mayhem, killing dozens and injuring hundreds of innocent civilians,” said Sen. Warner. “This measure sends the message that we can honor and respect the second amendment while also ensuring people don’t skirt our laws to turn legally obtained firearms into weapons of war.” 

“We continue to suffer horrific mass shootings like the one we saw in Las Vegas this week -- in Virginia we know the unbearable pain they cause -- but Congress has remained unwilling to do anything to help stop them from happening again and again,” Kaine said. “This bill would help curb deadly gun violence by closing a dangerous loophole that allows someone to make a semi-automatic weapon even more dangerous. We need to take long overdue action on gun safety and quickly pass this bill that can save lives.”

Under the National Firearms Act, the sale, manufacture, and transfer of automatic weapons are illegal. However, bump stocks, slide fire devices and other similar accessories are able to be attached to semi-automatic weapons, allowing them to reach fully-automatic rates of fire. Semi-automatic rifles typically have a rate of fire between 45 and 60 rounds per minute. A bump stock, or other similar device increases the semi-automatic rifle's rate of fire between 400 and 800 rounds per minute.

The bill also makes clear that its intent is to target only those accessories that increase a semi-automatic rifle’s rate of fire. Legitimate accessories used by hunters would be exempt. The bill also contains exceptions for lawful possession of these devices by law enforcement and the government.

Senators joining Warner, Kaine, and Feinstein include Senators Chuck Schumer (D-NY), Dick Durbin (D-IL), Richard Blumenthal (D-CT), Chris Murphy (D-CT), Patrick Leahy (D-VT), Chris Van Hollen (D-MD), Ed Markey (D-MA), Kirsten Gillibrand (D-NY), Amy Klobuchar (D-MN), Bob Casey (D-PA), Jack Reed (D-RI), Maggie Hassan (D-NH), Jeff Merkley (D-OR), Tom Carper (D-DE), Cory Booker (D-NJ), Kamala D. Harris (D-CA), Al Franken (D-MN), Sheldon Whitehouse (D-RI), Elizabeth Warren (D-MA), Mazie Hirono (D-HI), Ben Cardin (D-MD), Chris Coons (D-DE), Bernie Sanders (I-VT) and Maria Cantwell (D-WA).

Kaine, who was Governor of Virginia during the Virginia Tech mass shooting, and Warner have long supported improving mental health policy and passing commonsense measures to curb gun violence, including requiring background record checks prior to gun purchases and improving the number and accuracy of records submitted to the national background check system. 

###

WASHINGTON—Today, U.S. Sens. Mark R. Warner (D-VA) and Rob Portman (R-OH) introduced the bipartisan Commonsense Reporting Act of 2017 to streamline and modernize employer reporting requirements under the Patient Protection and Affordable Care Act (ACA). This legislation would strike a balance between ensuring the Treasury Department has the necessary data to determine availability of affordable coverage, while cutting down on unnecessary paperwork and administrative costs for businesses.

The ACA requires employers and insurers to report information about health insurance coverage to the Internal Revenue Service (IRS) at the end of the tax year. The legislation directs the Treasury Department to implement an alternative, prospective reporting system that is more workable and less burdensome for employers than current regulations.

“This legislation couples important data collection with the flexibility and efficiency employers need to continue implementing the law,” said Sen. Warner. “It’s time to find common ground with serious legislative efforts that provide more affordable, accessible, and quality health care to all Americans, regardless of where they purchase their coverage. Americans deserve better – hopefully this is the first step of many bipartisan solutions.” 

“I have heard from hundreds of employers in Ohio that have spent hundreds of administrative hours attempting to comply with the reporting requirements in the Affordable Care Act. This added time and resources has not improved the quality of health insurance employers offered but only further discouraged employers from offering health insurance and hiring more workers. This bipartisan bill will help streamline the reporting process by allowing employers to report information to the IRS prospectively, easing the burden for employers and employees,” said Sen. Portman.

The Commonsense Reporting Act streamlines this process by establishing a voluntarily system which would allow employers to report pertinent information before open enrollment begins, to minimize the administrative burden at the back-end, and limit the collection of unneeded information.

The Commonsense Reporting Act has been endorsed by the U.S. Chamber of Commerce, America’s Health Insurance Plans, Retail Industry Leaders Association, American Hotel and Lodging Association, American Rental Association, American Staffing Association, National Association of Convenience Stores, National Association of Health Underwriters, National Association of Home Builders, National Association of Wholesaler-Distributors, National Business Group on Health, National Federation of Independent Business, National Grocers Association, National Restaurant Association, National Retail Federation, NATSO for America’s Truck and Travel Stops.

A summary of this legislation can be found here. The full text is also available here. 

###

WASHINGTON— U.S. Sens. Mark R. Warner and Tim Kaine (both D-VA) announced today that Southwest Virginia will receive a total of $2,524,817 in federal funding from the Appalachian Regional Commission (ARC) to improve infrastructure and promote economic development.  

“The Appalachian Regional Commission is an engine for economic development in Southwest Virginia and these grants show the important role it plays in helping revitalize the region,” the Senators said.“These funds will support needed improvements to critical infrastructure and create jobs that will increase economic opportunities for these communities.”

Project descriptions and grant amounts are listed below:

• William King Museum of Art (Abingdon, Va.) - $500,000. This grant will help the William King Museum of Art will help fund Phase 1 of a larger cultural campus expansion project. The funds will go towards access improvements, additional parking and renovating a currently vacant facility that will become the new Center for Studio Art and Education. With the improvements at the campus, 10 artisans will take up residency at the facility, 2 jobs will be created and 2,500 new visitors are anticipated. In addition to ARC funds, local sources will provide $657,000, bringing the total project funding to $1,157,000. 
• Southwest Virginia Early Childhood Workforce Development (Abington, Va.) - $99,933. This grant will help United Way of Southwest Virginia assist 70 workers obtain child care credentials and improve child development services for 20 existing businesses in a 13-county area. In addition, the grantee will provide training and other assistance to individuals who wish to establish their own childcare programs in underserved areas, resulting in 10 new enterprises capable of serving 120 children. In addition to ARC funds, local sources will provide $61,783 in matching funds. 
• Project Discovery Program (Abingdon, Va.) - $75,844. This grant will help People Incorporated of Virginia expand its academic advancement and college attendance program to serve more low-income, first-generation college-bound high school students. The project will provide assistance to 60 students with college readiness skills and financial opportunities. The project will serve Dickenson, Buchanan, Russell, and Washington Counties. In additional to ARC funds, local sources will provide $39,391, bringing the total project funding to $113,235.
• Frog Level Phase II Water Project (Lee County) - $500,000. This grant will help provide reliable public water supply to Lee County as well as support economic development for the newly-established school of veterinary medicine. In addition to ARC funds, state sources will provide $948,680, and local sources will provide $108,652, bringing the total project funding to $1,557,332.
• Cool & Connected Pennington Gap Project (Pennington Gap, Va.) - $7,500. This grant will help the city of Pennington Gap fund the renovation of space and the creation of a community computer center at the basement of the Lee Theatre, purchase computer equipment, and provide Wi-Fi access in Leeman’s field. In addition to ARC funds, Sunset Digital Communications will provide $4,000, bringing the total project funding to $11,500.
• Cool & Connected Jonesville Project (Jonesville, Va.) - $7,500. This grant will help fund the renovation of a community computer center in Jonesville, Virginia at an existing town-owned building located in the town’s Cumberland Bowl Park. The minor renovations will include computer equipment and Wi-Fi access at the park. In addition to ARC funds, Sunset Digital Communications will provide $4,000, bringing the total project funding to $11,500.
• Tacoma Sewer Project (Wise County) - $500,000. The grant will help the Wise County Public Service Authority begin a project that will provide public sewer collection to a previously unserved community of 48 households and two businesses, and eliminate public and environmental health concerns related to improperly disposed raw sewage. In addition to ARC funds, state sources will provide $750,000, and local sources will provide $155,901, bringing the total project funding to $1,405,901.
• Lyric Theater Project (St. Paul, Va.) - $300,000. This grant will help the Town of St. Paul renovate and stabilize the interior and exterior of the Lyric Theater to stabilize the building. The renovation will equip the building to hold conferences, events and performing arts for visitor and tourists. The facility will be affiliated with The Crooked Road Music Heritage Trail. In addition to ARC funds, local sources will provide $135,000, bringing the total project funding to $435,000. 
• Spearhead Trails in SW Virginia Project (Coeburn, Va.) - $92,300. This grant will help the Southwest Regional Recreation Authority (SRRA) to fund a study that will examine existing and potential economic benefits of the Spearhead Trails on the surrounding region, identify priorities for future development, and help SRRA develop a sustainable organizational model. SRRA was chartered by the Commonwealth of Virginia in 2008 to support outdoor recreation and tourism investment in the Coalfields of Southwest Virginia. In addition to ARC funds, state sources will provide $30,000 and local sources will provide $7,700, bringing the total project funding to $130,000.
• Donnkenny, Breaks and Tivis Pump Stations Replacement Project (Dickenson County) - $441,740. This grant will help replace three deteriorating below-ground pump stations with above-ground facilities that meet current design standards. The new pump stations will provide water to 571 households and 10 businesses in distressed communities, as well as to nine tourism-related businesses in the Breaks Interstate Park, and will ensure that reliable infrastructure is in place to support future economic development, particularly that which is related to tourism. In addition to ARC funds, state sources will provide $150,000, and local sources will provide an additional $102,260, bringing the total project funding to $694,000.

Since its inception in 1965, ARC has generated over 300,000 jobs and $10 billion for the 25 million Americans living in Appalachia. ARC has provided funding and support for job-creating community projects across the 13 Appalachian states, producing an average of $204 million in annual earnings for a region often challenged by economic underdevelopment. President Trump’s budget proposes eliminating the program entirely.

In June, Warner and Kaine joined a group of six other U.S. Senators urging Senate appropriators to fully fund the Appalachian Regional Commission in 2018 at $152 million, and reject the Trump Administration’s proposal to end the state-federal partnership.

###

WASHINGTON — The U.S. Senate unanimously passed bipartisan legislation introduced by Sen. Mark R. Warner (D-VA), a member of the Senate Finance Committee, to improve health outcomes for Medicare beneficiaries living with chronic conditions. 

“There are a number of impressive innovations in the public and private sector to deliver better care to patients with multiple chronic conditions,” said Sen. Warner. “This Chronic Care Working Group deliberately worked with patients, advocacy groups, innovators, and other health care stakeholders to put together a set of bipartisan, cost-effective, and evidence-based policies that will better facilitate the delivery of high-quality and affordable care for our Medicare population. This bill takes the necessary steps to modernize Medicare to better meet the needs of today’s seniors and I am encouraged to see it move forward.”

The Creating High-Quality Results and Outcomes Necessary to Improve Chronic (CHRONIC) Care Act would:

• Permanently reauthorize and strengthen Medicare Advantage Special Needs plans to ensure that Medicare beneficiaries with chronic conditions or other significant health needs have continued access to quality care that is tailored to their personal needs;
• Expand telehealth services offered through different providers of care that will benefit seniors in rural areas and increase access to primary care services and telestroke care; and
• Extend the proven “independence at home” model that allows seniors to receive care from primary care teams. This provision aims to decrease hospital readmissions and to allow seniors with multiple chronic conditions to receive care in their own home.

Announced at a May 2015 hearing on chronic care, the Finance Committee formed the bipartisan Chronic Care Working Group led by Warner and Isakson to develop policy ideas to address Medicare spending on treating multiple chronic illnesses.

The CHRONIC Care Act was introduced in the last Congress and reintroduced earlier this year by Sen. Warner and Sen. Johnny Isakson (R-GA), along with Senate Finance Committee Chairman Orrin Hatch (R-UT) and Ranking Member Ron Wyden (D-OR). In May, the bill passed unanimously out of the Senate Finance Committee. 

A section-by-section summary of the CHRONIC Care Act of 2017 can be found here. A one-page summary of the CHRONIC Care Act of 2017 can be found here. The legislative text of theCHRONIC Care Act of 2017 can be found here.

###

WASHINGTON – This morning, in a hearing of the Senate Banking Committee with Securities and Exchange Commission (SEC) Chairman Jay Clayton, Sen. Mark R. Warner (D-VA) slammed the credit bureau Equifax for its cybersecurity failures and weak response in the wake of a data breach affecting the personal information of 143 million Americans. Sen. Warner, Ranking Member of the Subcommittee on Securities, Annuities, and Other Financial Investments, pressed the SEC Chairman to work with the Banking Committee to push for more transparency and accountability when a public company is breached and Americans’ personal information is exposed.

Said Warner of the Equifax breach, “We have no ability to opt-in to these systems. We are part of these systems whether we like it or not. I’m often asked in my job on the Intelligence Committee what I think the single greatest vulnerability our country faces is, and I believe it’s cybersecurity.” 

Added the Senator, “I think Equifax is a travesty. I think the resignation of the CEO is by no means enough… Number one, in terms of the sloppiness of their defenses. Two, in terms of the fact that this was clearly a knowable vulnerability – they had known for months, and if they had simply put a patch in place we might have precluded this. And to add insult to injury, Equifax, when it put up the site to direct consumers after the breach, that site was not properly domain-registered and was known to have vulnerabilities in the site itself. So if we don’t send a very, very strong message – now the market has already taken, I think, 25 percent off its market value – but I question whether Equifax has the right to even continue providing these services with the level of sloppiness and lack of attention to cybersecurity.”

Noting a number of significant data breaches in both the public and private sector have affected hundreds of millions of people in recent years, Warner pressed the SEC Chairman on whether he believes the publicly-traded companies regulated by the agency are being sufficiently forthcoming with shareholders and the public when their systems are breached by hackers.

The SEC Chairman told Sen. Warner, “I agree with you generally. I don’t think there’s been enough disclosure around the risk profile of companies with respect to cybersecurity. Where are the risks, what are the vulnerabilities, what do we know, not know. And then, if there are breaches, the disclosure of those specific breaches. I don’t think there’s been adequate disclosure in that regard.” 

Warner urged Chairman Clayton to work with the Banking Committee to strengthen those reporting standards through the SEC rulemaking process or by working with Senators to craft appropriate legislation that would improve disclosure and transparency for companies that suffer a data breach. A full transcript of their exchange is below.

In a September 13 letter, Sen. Warner also asked the Federal Trade Commission (FTC) to examine whether credit reporting agencies such as Equifax have adequate cybersecurity safeguards in place for “the enormous amounts of sensitive data they gather and commercialize.” In a response to Sen. Warner’s questions, dated September 21 and newly released today, the FTC disclosed that the agency is considering whether an existing FTC consent degree with Equifax for violations of the Fair Credit Reporting Act could allow the FTC to assess additional sanctions and civil penalties on Equifax for its failure to maintain acceptable data security practices. The FTC also agreed with Sen. Warner’s assessment that Equifax has not adopted sufficient security practices for consumers wishing to place a credit freeze on their accounts following the theft of their personal information.  

The FTC also recommended that Congress take up comprehensive data security legislation that would provide timely notification to consumers when there is a data breach – a cause Sen. Warner has championed for more than three years. 

The FTC’s full response to Sen. Warner is available here.   

Transcript:

WARNER: Let me first of all echo what Senator Kennedy has just said. The whole notion of the credit rating agencies, and the public’s ability – we have no ability to opt-in to these systems. We are part of these systems whether we like it or not. I’m often asked in my job on the Intelligence Committee what I think the single greatest vulnerability our country faces is, and I believe it’s cybersecurity. I believe we do not have a whole-of-government, or whole-of-society approach on cybersecurity. In recent times, we have seen Russia take unprecedented action attacking 21 of our states’ voting systems. We’ve seen our social media platforms being manipulated with false information and misinformation and disinformation campaigns that are at least indirectly related to cyber.

I appreciate you, Mr. Chairman, coming forward with the recognition of the EDGAR system breach. I wish it had been done quicker, though as has been pointed out, this is not in isolation. We’ve seen, as has been pointed out, OPM and a series of other governmental breaches. I think Equifax is a travesty. I think the resignation of the CEO is by no means enough. I would say, and I understand your reluctance to acknowledge whether there is an investigation, your colleagues at the FTC, who also have a process in place where they normally don’t reveal an ongoing investigation, felt that this was so serious that they acknowledged that there was an investigation going on.

And the Equifax breach is so egregious. Number one, in terms of the sloppiness of their defenses. Two, in terms of the fact that this was clearly a knowable vulnerability – they had known for months, and if they had simply put a patch in place we might have precluded this. And to add insult to injury, Equifax, when it put up the site to direct consumers after the breach, that site was not properly domain-registered and was known to have vulnerabilities in the site itself. So if we don’t send a very, very strong message – now the market has already taken, I think, 25 percent off its market value – but I question whether Equifax has the right to even continue providing these services with the level of sloppiness and lack of attention to cybersecurity. 

I’d also point out – and Senator Brown raised this question – this not the first time. I mean, Yahoo last year. 500 million user breach, and Yahoo did not believe that it was material enough to even report. One investigation has shown, with 9,000 public companies, we have less than 100 companies, since 2010, feel that any level of cyber incursion was significant enough to meet that materiality standard to notify the public. I find that absolutely unacceptable. 

I know Senator Brown asked that, but Mr. Clayton, do you want to make any further comment about what the SEC might be looking at in terms of reviewing these materiality standards as it relates to cybersecurity? 

CLAYTON: Yes, I do. I agree with you generally. I don’t think there’s been enough disclosure around the risk profile of companies with respect to cybersecurity. Where are the risks, what are the vulnerabilities, what do we know, not know. And then, if there are breaches, the disclosure of those specific breaches. I don’t think there’s been adequate disclosure in that regard.

WARNER: Well my hope would be that this would be something – I know I’m very interested in, and I think across both sides of the aisle, we’d like to work with you on – whether we need legislative actions, or whether we work with you as an entity. 

###

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA) joined Sen. Mazie K. Hirono (D-HI) and a group of Senators in calling on President Trump to fill the vacancies for U.S. Ambassador to South Korea, Assistant Secretary of State for East Asian and Pacific Affairs, and Assistant Secretary of Defense for Asian and Pacific Security Affairs. These key positions have gone unfilled in the over eight months of the Trump presidency. In the wake of North Korea’s actions, Senate-confirmed nominees for these positions would provide stable leadership and coordinate State and Defense Department efforts as our country works with our allies and partners to reach a diplomatic solution.

 “As North Korea continues its illegal nuclear weapons program, commits blatant violations of international law, and makes threats to our country and allies, the confirmation of a U.S. Ambassador to the Republic of Korea must be prioritized to send a concrete signal to reassure not only our ROK allies but also the American people,” the Senators wrote. “Just as our diplomatic mission to the ROK deserves leadership of an ambassador to represent our nation’s interests, our country’s diplomatic and military efforts in the Indo-Asia-Pacific region deserve permanent Assistant Secretaries of State and Defense to coordinate our diplomatic efforts on North Korea, other regional challenges as well as opportunities to advance U.S. interests.”

In addition to Sens. Warner and Hirono, the following Senators also signed the letter: Sens. Bob Casey (D-PA), Tammy Duckworth (D-IL), Richard Durbin (D-IL), Heidi Heitkamp (D-ND), Amy Klobuchar (D-MN), Edward Markey (D-MA), Elizabeth Warren (D-MA), and Chris Van Hollen (D-MD).

 Text of the letter is below and can also be found here. 

Dear Mr. President:

We write to you today to express our deep concern that a nominee to fill the vacancy of the U.S. ambassadorship to the Republic of Korea (ROK) in light of escalating tensions on the Korean Peninsula has yet to be announced eight months into your presidency. Given the importance of the Indo-Asia-Pacific region to U.S. national security interests, we urge you to swiftly send a nominee to the Senate for advice and consent along with your nominees to serve as Assistant Secretary of State for East Asian and Pacific Affairs and Assistant Secretary of Defense for Asian and Pacific Security Affairs which play key roles in coordinating U.S. diplomacy and defense policy on North Korea in addition to the wider region. We urge you to select highly qualified and competent nominees with extensive experience in the region including on North Korea issues.

As North Korea continues its illegal nuclear weapons program, commits blatant violations of international law, and makes threats to our country and allies, the confirmation of a U.S. Ambassador to the Republic of Korea must be prioritized to send a concrete signal to reassure not only our ROK allies but also the American people, that one of our most important diplomatic relationships will be appropriately represented at the ambassadorial level. The United States has diplomatic relations with over 190 nations but none are as extensive and instrumental to our national security as those with our treaty allies such as the ROK. The U.S.-ROK alliance was strengthened by the bonds forged between U.S. and ROK troops during the Korean War and it continues to be strengthened by the Korean-American community, our economic ties and our mutual defense treaty commitments. We look forward to hearing your nominee’s testimony before the Senate Foreign Relations Committee on your administration’s North Korea strategy and how the U.S.-ROK alliance can be further strengthened to meet the challenges and opportunities in our bilateral relationship.

 Just as our diplomatic mission to the ROK deserves leadership of an ambassador to represent our nation’s interests, our country’s diplomatic and military efforts in the Indo-Asia-Pacific region deserve permanent Assistant Secretaries of State and Defense to coordinate our diplomatic efforts on North Korea, other regional challenges as well as opportunities to advance U.S. interests. As head of the Bureau of East Asian and Pacific Affairs within the State Department, the Assistant Secretary of State for East Asian and Pacific Affairs manages our diplomatic activities and serves as a key advisor to the Secretary of State and the Under Secretary for Political Affairs on regional matters. Its Defense Department counterpart serves a similar role for oversight of security cooperation not only with our five treaty allies in the region but a growing number of partners key to our national security interests. The recent enactment of additional sanctions on North Korea from Congress and the United Nations Security Council warrant these posts to be filled on a non-acting basis to lead efforts to ensure close coordination with our allies and partners as implementation proceeds and dialogue continues on our response to North Korea’s continued provocations. 

 To date, the Senate has confirmed 20 ambassadorial nominees including six to close allied nations. It is critical now for our government to affirmatively convey to our ROK allies that our relationship is valued in the same manner as these nations, and as senators we stand ready to consider your nominees for U.S. ambassador to the ROK as well as Assistant Secretary of State for East Asian and Pacific Affairs and Assistant Secretary of Defense for Asian and Pacific Security Affairs. Thank you for your consideration and we look forward to your response.

Sincerely,

###

WASHINGTON— U.S. Sen. Mark R. Warner (D-VA) issued this statement on the passing of Dr. Ron Carrier, former longtime president of James Madison University:

"It is hard to overstate Ron's tremendous impact on JMU's history, its growth and the reputation it enjoys today. At the same time, Ron provided principled and strong leadership throughout the Valley and indeed across Virginia. 

# # #

WASHINGTON – U.S. Sens. Mark R. Warner and Tim Kaine (both D-VA) issued this joint statement following an announcement by Anthem that it will re-enter 63 counties or cities in Virginia where consumers  otherwise would be left without any insurance options in the 2018 Affordable Care Act exchanges. Both senators were engaged in efforts to resolve this challenge prior to today’s deadline for notifying the Bureau of Insurance at the State Corporation Commission.    

“We are glad Anthem is re-entering the Virginia individual health care exchange to provide thousands of Virginia consumers with coverage in places where they might have had none. This is welcome news for Virginians in rural communities, who have been hit particularly hard by health care uncertainty. It's time for the Trump Administration to stop their efforts to sabotage and destabilize the markets, which resulted in fewer choices and higher premiums for 2018.  We will continue to work in Congress with colleagues regardless of party to fix the existing Affordable Care Act to ensure a stable market, lower costs, and improve coverage.”

 The Senate HELP Committee has been holding bipartisan hearings this month on measures to stabilize the health insurance market, including proposals like Kaine’s bill to help stabilize the individual health care marketplace and lower premiums through reinsurance. On Thursday, he called on insurers like Anthem to stop depriving people in rural Virginia of opportunities by limiting coverage options or pulling out of the individual markets. State health insurance commissioners and health care experts have expressed support for reinsurance as a way to increase certainty in the marketplace.

Senator Warner sits on the Senate Finance Committee, which is holding hearings on expanding consumer options and making health care coverage more affordable for American families. Senator Warner has offered several commonsense proposals to increase competition in the health care marketplace, lower health care costs, and make the Affordable Care Act work better for more Virginians.

###

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA), a member of the Banking, Budget and Finance committees and cofounder of the bipartisan Senate Cybersecurity Caucus, today asked the Federal Trade Commission to examine the recent cyber hack of credit reporting agency Equifax. Last week, Equifax publically disclosed a breach which exposed sensitive personal information of 143 million Americans.

Sen. Warner requested an FTC investigation into the lapse in Equifax cybersecurity practices, and questioned the company’s widely-panned response to consumers potentially impacted by the breach. His letter asks the FTC to examine whether credit reporting agencies such as Equifax have adequate cybersecurity safeguards in place for “the enormous amounts of sensitive data they gather and commercialize.” 

Sen. Warner has been a leader in calling for better consumer protections from data theft. In the aftermath of the Target breach that exposed the debit and credit card information of 40 million customers, Sen. Warner in 2014 chaired the first congressional hearing on protecting consumer data from the threat posed by hackers targeting retailers’ online systems. Sen. Warner also partnered with the National Retail Federation to establish an information sharing platform that allows the industry to better protect consumer financial information from data breaches.

Sen. Warner has been working to develop bipartisan legislation to create a comprehensive, nationwide and uniform data breach standard requiring timely consumer notification for breaches of financial data and other sensitive information. 

The text of the letter is below and can be found here. 

September 13, 2017

The Honorable Maureen K. Ohlhausen

Acting Chairwoman

Federal Trade Commission

600 Pennsylvania Avenue, NW

Washington, D.C. 20580

Dear Acting Chairwoman Ohlhausen,

I write you in the wake of reports that one of the nation’s three major credit reporting agencies has suffered one of the largest, and potentially most impactful, breaches in recent history. According to reports, Equifax in May of this year experienced a breach affecting as many as 143 million consumers, with highly sensitive information such as Social Security numbers, driver’s license records, birthdates, addresses, and credit histories potentially at risk. This information – critical to opening a new bank account or taking out a loan – will expose Americans to identity theft, tax fraud, extortion, and other risks.

By streamlining and routinizing the collection of consumer reports and credit history, the Fair Credit Reporting Act in part enshrined the nation’s major credit reporting agencies’ role as arbiters of Americans’ access to credit, and even employment and residential opportunities. At the same time, Congress sought to ensure that these firms “exercise their grave responsibilities” with a “respect for the consumer’s right to privacy,” including through “reasonable procedures…with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information[.]”  And Congress directed the Federal Trade Commission (“Commission” or “FTC”) to enforce key aspects of the law, including by treating violations of the FCRA as unfair or deceptive practices under the Commission’s Section 5 authority. 

Today’s digital economy, in which data increasingly represents a key input, has only amplified the reach of these firms, and provided them with incentives to collect and centralize ever-growing amounts of sensitive personal information, and to commercialize this data in opaque ways. The volume and sensitivity of the data potentially involved in this breach raises serious questions about whether firms like Equifax adequately protect the enormous amounts of sensitive data they gather and commercialize. 

As someone who has worked for several years with stakeholders and a bipartisan group of lawmakers on legislation to establish a comprehensive, nationwide and uniform data breach standard, I recognize Congress’s unfinished work in this area. I am hopeful that this recent development will help galvanize action among my colleagues in Congress to safeguard American consumers and our nation’s economic security.

At the same time, aspects of this breach raise questions about the data security practices of Equifax that implicate the Federal Trade Commission’s existing authority. In particular, press reports and cybersecurity experts have identified a number of security lapses, including in the days following Equifax’s disclosure of the breach, that potentially indicate a pattern of security failings.

While the precise details of the “website application vulnerability” exploited in the Equifax breach are not yet known, experts have pointed to a wide range of other lapses by Equifax – including in the wake of the breach – that indicate exceptionally poor cybersecurity practices. For instance, experts have pointed to an exceedingly broad attack surface, with thousands of domains and subdomains managed by Equifax across hundreds of network hosts. And security experts have identified a range of antiquated, unpatched, or otherwise vulnerable systems maintained by Equifax.

Equifax’s post-breach actions also raise serious concerns about the company’s data security practices. For instance, Equifax chose to register a new domain, Equifaxsecurity2017.com – but not in its own name. Reports also catalogued a litany of security mistakes, including use of potentially insecure content management software and improperly configured web encryption.  These, and other lapses, resulted in a range of popular web browsers flagging Equifax’s site as a potential phishing or scam site. 

Equally alarming have been Equifax’s procedures for handling customer inquiries. In order for a concerned consumer to determine if they may have been impacted, Equifax requires the consumer to submit their last name and six digits of their Social Security number. The security of this procedure is as questionable as its efficacy: researchers noted that entering the last name “Test” and the Social Security numbers “123456” returned a confirmed breach.

Similarly alarming, when concerned consumers elect to place a credit freeze with Equifax – something the Commission encourages them to do – the PIN that Equifax assigns to that consumer is a simple, non-unique timestamp (formatted as, for instance, “0910170930” for a user that submitted a request at 9:30AM on the 10th of September). Separately, experts have noted that Equifax’s central website, where American consumers go to set up credit account monitoring, features cross-site scripting vulnerabilities that would enable an attacker to execute malicious code to, for instance, redirect submitted form data (such as the Social Security number the Equifax site requests) to an attacker. 

Taken as a whole, and given past breaches by other major credit bureaus, these lapses may potentially represent a systemic failure by firms currently incentivized to collect and store highly sensitive identification and financial data for Americans. The volume and sensitivity of the data involved – information critical to identity management and access to consumer credit – distinguishes this breach from many other breaches of consumer data. And in contrast to other breaches, where consumers might respond to the perceived lack of data security by taking their business elsewhere, those affected by last week’s breach in most cases do not have a direct consumer relationship with Equifax.

The implications of a breach of this magnitude are sobering, as this identifying data forms the basis for consumer credit and other financial transactions. Congress foresaw this threat in 1970, noting that failures of this industry could “undermine the public confidence which is essential to the continued functioning of the banking system.”  In ways similar to the financial service industry’s systemic risk designation, I fear that firms like Equifax may illustrate a set of institutions whose activities, left unchecked, can significantly threaten the economic security of Americans.

I respectfully request that you respond to the following questions:

1. 1.      Equifax is currently under a consent decree with the Commission for violations of the Fair Credit Reporting Act related to improper handling of consumer information.  Does that consent decree provide the Commission with additional remedies in the context of Equifax’s data security practices? 

1. 2.      Given the current inability of consumers to cease doing business with a credit reporting agency which displays an arguably cavalier attitude toward cybersecurity, should the Fair Credit Reporting Act be amended to provide the Commission authority to issue rules requiring credit reporting agencies to establish a way for consumers to “opt out” of having their information stored by a particular credit reporting agency? 

1. 3.      In many cases, Equifax collects and maintains sensitive information about consumers as a service to other businesses. Under state data breach notification statutes, a breached service provider need only inform the business it provides service to about the breaches it suffers, and has no obligation to provide public notice that it incurred the breach. In recent breach incidents involving third-party service providers, some companies (e.g., Heartland, Experian, Anthem, etc.) have provided public notice that their breach affected consumers. Would the FTC support legislation that requires all entities suffering a breach of security that creates a significant risk of financial harm, to make public notice of that breach in order to ensure a more timely and effective form of notice? 

1. 4.      Do you interpret the Fair Credit Reporting Act to include heightened data security standards and/or requirements, given Congress’s unique concern about the “confidentiality, accuracy…and proper utilization” of this highly sensitive data? 

1. 5.      The Commission has suggested that consumers place a credit freeze with the three major credit bureaus.  Does the Commission consider a timestamp to be a sufficiently strong PIN for unfreezing a consumer’s account?

1. a.      Has the Commission issued guidance to credit reporting agencies on adequate security and data protection measures associated with credit freezes? 
2. b.      Should this guidance be updated in light of security concerns with the site Equifax maintains to process credit monitoring and freeze requests?

1. 6.      Should Congress limit the ability of credit reporting agencies to sell data outside specific contexts, such as credit, banking, and employment inquiries?

1. 7.      Does the Commission hold lapses in data security practices in response to a breach to a higher standard than data security practices related to the breach itself?

1. 8.      Do adequate incentives to use reasonable data security practices, or penalties to deter unreasonable data security practices, exist to counter-balance the profit incentives to collect, centralize, and maintain large quantities of highly sensitive personal information of American consumers?

The American people deserve to know that their government is serious about learning from and responding to this truly concerning incident, and that it is taking all appropriate steps to help ensure it cannot happen again. Your response will be critical to this process, and I look forward to receiving that within the next two weeks. If you should have any questions or concerns, please contact my office.

As always, I appreciate your service in this important role. Thank you for your timely consideration of this matter.

Sincerely,

MARK R. WARNER

United States Senator 

###