WASHINGTON – U.S. Sen. Mark R. Warner (D-VA), Vice Chairman of the Senate Intelligence Committee and co-founder of the Senate Cybersecurity Caucus, today raised concern with the U.S. Department of Health and Human Services (HHS)’s failure to act, following a mass exposure of sensitive medical images and information by health organizations. In a letter to the HHS Director of the Office for Civil Rights, Sen. Warner identified this exposure as damaging to individual and national security, as this kind of information can be used to target individuals and to spread malware across organizations.

“I am alarmed that this is happening and that your organization, with its responsibility to protect the sensitive personal medical information of the American people, has done nothing about it,” wrote Sen. Warner. “As your agency aggressively pushes to permit a wider range of parties (including those not covered by HIPAA) to have access to the sensitive health information of American patients without traditional privacy protections attaching to that information, HHS’s inattention to this particular incident becomes even more troubling.”

“These reports indicate egregious privacy violations and represent a serious national security issue -- the files may be altered, extracted, or used to spread malware across an organization,” he continued. “In their current unencrypted state, CT, MRI and other diagnostic scans on the internet could be downloaded, injected with malicious code, and re-uploaded into the medical organization’s system and, if capable of propagating, potentially spread laterally across the organization. Earlier this year, researchers demonstrated that a design flaw in the DICOM protocol could easily allow an adversary to insert malicious code into an image file like a CT scan, without being detected.”

On September 17^th, a report revealed that millions of Americans had their private medical images exposed online, due to unsecured picture archiving and communication servers (PACS) that utilize the Digital Imaging and Communications in medicine (DICOM) protocol. Along with the medical images, these PACS also exposed the names and social security numbers of those affected, leaving this information open to anyone with basic computer expertise, as these required no authentication to access or download.

This exposure was uncovered by German researchers, who contacted the German Federal Office for Information Security (BSI). BSI then alerted the United States Computer Emergency Readiness Team (US-CERT), who confirmed the exposure and reached out to HHS. However, if they received this information, HHS has failed to act on it, even failing to list TridentUSA Health Services – one of the main companies responsible for the exposure – on its breach portal website.

In his letter to Director Roger Severino, Sen. Warner also raised alarm with the fact that TridentUSA Health Services successfully completed an HHS Health Insurance Portability and Accountability Act (HIPAA) Security Rule compliance audit in March 2019, while patient images were actively accessible online.

Sen. Warner also posed the follow questions for HHS regarding the incident, and its current cybersecurity requirements and procedures:

1. Did HHS receive a notice from US-CERT regarding the open PACS ports available with diagnostic imaging available on the internet without any restrictions?

     a. If so, what actions were taken to address the issue?

2. What evidence do you require organizations to produce during a HIPAA Security Rule audit? Are organizations asked to turn over their audit logs? How does OCR review the logs?

      a. Does OCR have information security experts on staff or does it rely on external consultants as part of these audits?

3. What are the follow-up procedures if an organization’s log files reveal access to sensitive data from outside the United States, such as in this case?

4. Please describe your information security audit process.

5. Please describe your oversight of the DICOM protocol and PACS security. Do you require organizations to implement access controls? If so, what kind? Do you require full-disk encryption and authentication for PACS? Are the DICOM protocol implementations included in the audits?

Sen. Warner has been a champion for cybersecurity throughout his career, and has been an outspoken critic of poor cybersecurity practices that compromise Americans’ personal information. In September, Sen. Warner wrote to TridentUSA Health Services to inquire about the company’s data security practices, following reports that a company affiliate exposed medical data belonging to millions of Americans. Earlier that month, Sen. Warner demanded answers from U.S. Customs and Border Protection (CBP) and South Korean company Suprema HQ, following separate incidents that affected both entities and exposed the personal, permanently identifiable data of many Americans. Sen. Warner has introduced legislation to empower state and local government to counter cyberattacks, and to increase cybersecurity among public companies.

The letter text can be found below and a PDF is available here.

Mr. Roger Severino
Director, Office for Civil Rights
Department of Health and Human Services
200 Independence Ave SW
Washington, DC 20201

Dear Director Severino,

As the health care industry increasingly harnesses internet connectivity and software, including machine learning systems, to improve patient care, a long overdue focus on data privacy and information security has come into sharper focus. This is particularly evident in light of reports that sensitive medical records of potentially millions of Americans were recently exposed online – and that your agency has done little to address this issue. Prompting even greater concern, one of the companies that left the data exposed online also successfully completed one of your Health Insurance Portability and Accountability Act (HIPAA) Security Rule compliance audits in March. I am alarmed that this is happening and that your organization, with its responsibility to protect the sensitive personal medical information of the American people, has done nothing about it. As your agency aggressively pushes to permit a wider range of parties (including those not covered by HIPAA) to have access to the sensitive health information of American patients, without traditional privacy protections attaching to that information, HHS’s inattention to this particular incident becomes even more troubling.

On September 17^th ProPublica published a shocking report that the sensitive medical images of millions of American patients were exposed online through unsecured picture and archiving and communications servers (PACS) that utilize the Digital Imaging and Communications in medicine (DICOM), protocol. The publicly-accessible information that had been accessed from Germany included MRI’s, X-rays, and CT scans, as well as names and social security numbers of the patients. The 13.7 million images found on the internet required absolutely no authentication to access or download. As of writing this letter, there are 779 million image records attached to 21.6 million patient records, impacting an estimated 5 million patients in 22 states. The largest system accessed holds 61 million diagnostic images attached to 1.23 million exam records of American patients and remains available on the internet.

In late August, German researchers initiated an investigation to determine the global accessibility and remote access capabilities of PACS. On September 9^th, the researchers concluded their two week inquiry and submitted their findings to the German Federal Office for Information Security (BSI). By September 17^th, BSI had addressed the affected systems which were removed from the internet prior to the publishing of the ProPublica report.

After US-CERT was notified of the problem by BSI, US-CERT contacted the German researchers at Greenbone Networks, confirming they received the data on September 20^th. US-CERT stated the agency would convey the information to the U.S. Department of Health and Human Services (HHS). According to the researchers, however, there has been no further communication from US-CERT or HHS, even though data privacy authorities from other countries like France and the UK contacted Greenbone Networks following the publication of ProPublica’s report.

On September 23^rd, I wrote to TridentUSA Health Services expressing my concern regarding the issues raised in the ProPublica report, and pointed out that MobilexUSA, a TridentUSA Health Services affiliate, was identified as controlling one of the unsecured PACS. On October 15^th, the German researchers demonstrated to my office a number of US-based PACS have open ports, supporting unencrypted communications protocols, exposing images to the internet like chest X-rays and mammograms, and identifying details like names and social security numbers. Those images and medical records continue to be accessible.

These reports indicate egregious privacy violations and represent a serious national security issue -- the files may be altered, extracted, or used to spread malware across an organization. Earlier this year, researchers demonstrated that a design flaw in the DICOM protocol could easily allow an adversary to insert malicious code into an image file like a CT scan, without being detected. The researchers who discovered the flaw in the DICOM protocol were able to use a polyglot file, which can contain more than one stream of data with different file formats, and hide the malicious code in the scan. In their current unencrypted state, CT, MRI and other diagnostic scans on the internet could be downloaded, injected with malicious code, and re-uploaded into the medical organization’s system and, if capable of propagating, potentially spread laterally across the organization.

In their response to my letter, TridentUSA Health Services noted that they successfully completed the Department of Health and Human Services audits, confirming compliance with the HIPAA Security Rule, the last of which concluded in March 2019, while patient images were accessible online.

While the information security lapses by the medical companies using the PACS are clear, it is unclear how your agency has addressed this issue. As of the writing of this letter, TridentUSA Health Services is not included on your breach portal website, and I have seen no evidence that, once contacted by US-CERT, you acted on that information in any meaningful way.

To understand how such an enormous oversight in your organization has allowed medical companies to leave insecure ports open to the internet and accessed repeatedly by a German IP address, I ask that you answer the following questions:

1. Did HHS receive a notice from US-CERT regarding the open PACS ports available with diagnostic imaging available on the internet without any restrictions?

     a. If so, what actions were taken to address the issue?

2. What evidence do you require organizations to produce during a HIPAA Security Rule audit? Are organizations asked to turn over their audit logs? How does OCR review the logs?

      a. Does OCR have information security experts on staff or does it rely on external consultants as part of these audits?

3. What are the follow-up procedures if an organization’s log files reveal access to sensitive data from outside the United States, such as in this case?

4. Please describe your information security audit process.

5. Please describe your oversight of the DICOM protocol and PACS security. Do you require organizations to implement access controls? If so, what kind? Do you require full-disk encryption and authentication for PACS? Are the DICOM protocol implementations included in the audits?

The American people deserve to have their sensitive private information protected and their government held accountable for enforcing the rules in place to keep that information private. I hope that you will share what immediate actions you are taking, along with answering the questions above. I look forward to hearing your response no later than November 18, 2019.

Sincerely,

###

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA), Vice Chairman of the Senate Intelligence Committee and co-founder of the Senate Cybersecurity Caucus, today raised concern with the U.S. Department of Health and Human Services (HHS)’s failure to act, following a mass exposure of sensitive medical images and information by health organizations. In a letter to the HHS Director of the Office for Civil Rights, Sen. Warner identified this exposure as damaging to individual and national security, as this kind of information can be used to target individuals and to spread malware across organizations.

“I am alarmed that this is happening and that your organization, with its responsibility to protect the sensitive personal medical information of the American people, has done nothing about it,” wrote Sen. Warner. “As your agency aggressively pushes to permit a wider range of parties (including those not covered by HIPAA) to have access to the sensitive health information of American patients without traditional privacy protections attaching to that information, HHS’s inattention to this particular incident becomes even more troubling.”

“These reports indicate egregious privacy violations and represent a serious national security issue -- the files may be altered, extracted, or used to spread malware across an organization,” he continued. “In their current unencrypted state, CT, MRI and other diagnostic scans on the internet could be downloaded, injected with malicious code, and re-uploaded into the medical organization’s system and, if capable of propagating, potentially spread laterally across the organization. Earlier this year, researchers demonstrated that a design flaw in the DICOM protocol could easily allow an adversary to insert malicious code into an image file like a CT scan, without being detected.”

On September 17^th, a report revealed that millions of Americans had their private medical images exposed online, due to unsecured picture archiving and communication servers (PACS) that utilize the Digital Imaging and Communications in medicine (DICOM) protocol. Along with the medical images, these PACS also exposed the names and social security numbers of those affected, leaving this information open to anyone with basic computer expertise, as these required no authentication to access or download.

This exposure was uncovered by German researchers, who contacted the German Federal Office for Information Security (BSI). BSI then alerted the United States Computer Emergency Readiness Team (US-CERT), who confirmed the exposure and reached out to HHS. However, if they received this information, HHS has failed to act on it, even failing to list TridentUSA Health Services – one of the main companies responsible for the exposure – on its breach portal website.

In his letter to Director Roger Severino, Sen. Warner also raised alarm with the fact that TridentUSA Health Services successfully completed an HHS Health Insurance Portability and Accountability Act (HIPAA) Security Rule compliance audit in March 2019, while patient images were actively accessible online.

Sen. Warner also posed the follow questions for HHS regarding the incident, and its current cybersecurity requirements and procedures:

1. Did HHS receive a notice from US-CERT regarding the open PACS ports available with diagnostic imaging available on the internet without any restrictions?
   1. If so, what actions were taken to address the issue?
2. What evidence do you require organizations to produce during a HIPAA Security Rule audit? Are organizations asked to turn over their audit logs? How does OCR review the logs?
   1. Does OCR have information security experts on staff or does it rely on external consultants as part of these audits? 
3. What are the follow-up procedures if an organization’s log files reveal access to sensitive data from outside the United States, such as in this case?
4. Please describe your information security audit process.
5. Please describe your oversight of the DICOM protocol and PACS security. Do you require organizations to implement access controls? If so, what kind? Do you require full-disk encryption and authentication for PACS? Are the DICOM protocol implementations included in the audits?

Sen. Warner has been a champion for cybersecurity throughout his career, and has been an outspoken critic of poor cybersecurity practices that compromise Americans’ personal information. In September, Sen. Warner wrote to TridentUSA Health Services to inquire about the company’s data security practices, following reports that a company affiliate exposed medical data belonging to millions of Americans. Earlier that month, Sen. Warner demanded answers from U.S. Customs and Border Protection (CBP) and South Korean company Suprema HQ, following separate incidents that affected both entities and exposed the personal, permanently identifiable data of many Americans. Sen. Warner has introduced legislation to empower state and local government to counter cyberattacks, and to increase cybersecurity among public companies.

The letter text can be found below and a PDF is available here.

Mr. Roger Severino                                                                

Director, Office for Civil Rights

Department of Health and Human Services

200 Independence Ave SW

Washington, DC 20201

Dear Director Severino,

As the health care industry increasingly harnesses internet connectivity and software, including machine learning systems, to improve patient care, a long overdue focus on data privacy and information security has come into sharper focus. This is particularly evident in light of reports that sensitive medical records of potentially millions of Americans were recently exposed online – and that your agency has done little to address this issue. Prompting even greater concern, one of the companies that left the data exposed online also successfully completed one of your Health Insurance Portability and Accountability Act (HIPAA) Security Rule compliance audits in March. I am alarmed that this is happening and that your organization, with its responsibility to protect the sensitive personal medical information of the American people, has done nothing about it. As your agency aggressively pushes to permit a wider range of parties (including those not covered by HIPAA) to have access to the sensitive health information of American patients, without traditional privacy protections attaching to that information, HHS’s inattention to this particular incident becomes even more troubling.

On September 17^th ProPublica published a shocking report that the sensitive medical images of millions of American patients were exposed online through unsecured picture and archiving and communications servers (PACS) that utilize the Digital Imaging and Communications in medicine (DICOM), protocol. The publicly-accessible information that had been accessed from Germany included MRI’s, X-rays, and CT scans, as well as names and social security numbers of the patients. The 13.7 million images found on the internet required absolutely no authentication to access or download. As of writing this letter, there are 779 million image records attached to 21.6 million patient records, impacting an estimated 5 million patients in 22 states. The largest system accessed holds 61 million diagnostic images attached to 1.23 million exam records of American patients and remains available on the internet.

In late August, German researchers initiated an investigation to determine the global accessibility and remote access capabilities of PACS. On September 9^th, the researchers concluded their two week inquiry and submitted their findings to the German Federal Office for Information Security (BSI). By September 17^th, BSI had addressed the affected systems which were removed from the internet prior to the publishing of the ProPublica report.

After US-CERT was notified of the problem by BSI, US-CERT contacted the German researchers at Greenbone Networks, confirming they received the data on September 20^th. US-CERT stated the agency would convey the information to the U.S. Department of Health and Human Services (HHS). According to the researchers, however, there has been no further communication from US-CERT or HHS, even though data privacy authorities from other countries like France and the UK contacted Greenbone Networks following the publication of ProPublica’s report.

On September 23^rd, I wrote to TridentUSA Health Services expressing my concern regarding the issues raised in the ProPublica report, and pointed out that MobilexUSA, a TridentUSA Health Services affiliate, was identified as controlling one of the unsecured PACS. On October 15^th, the German researchers demonstrated to my office a number of US-based PACS have open ports, supporting unencrypted communications protocols, exposing images to the internet like chest X-rays and mammograms, and identifying details like names and social security numbers. Those images and medical records continue to be accessible.

These reports indicate egregious privacy violations and represent a serious national security issue -- the files may be altered, extracted, or used to spread malware across an organization. Earlier this year, researchers demonstrated that a design flaw in the DICOM protocol could easily allow an adversary to insert malicious code into an image file like a CT scan, without being detected. The researchers who discovered the flaw in the DICOM protocol were able to use a polyglot file, which can contain more than one stream of data with different file formats, and hide the malicious code in the scan. In their current unencrypted state, CT, MRI and other diagnostic scans on the internet could be downloaded, injected with malicious code, and re-uploaded into the medical organization’s system and, if capable of propagating, potentially spread laterally across the organization.

In their response to my letter, TridentUSA Health Services noted that they successfully completed the Department of Health and Human Services audits, confirming compliance with the HIPAA Security Rule, the last of which concluded in March 2019, while patient images were accessible online.

While the information security lapses by the medical companies using the PACS are clear, it is unclear how your agency has addressed this issue. As of the writing of this letter, TridentUSA Health Services is not included on your breach portal website, and I have seen no evidence that, once contacted by US-CERT, you acted on that information in any meaningful way.

To understand how such an enormous oversight in your organization has allowed medical companies to leave insecure ports open to the internet and accessed repeatedly by a German IP address, I ask that you answer the following questions:

The American people deserve to have their sensitive private information protected and their government held accountable for enforcing the rules in place to keep that information private. I hope that you will share what immediate actions you are taking, along with answering the questions above. I look forward to hearing your response no later than November 18, 2019.

Sincerely,

###

WASHINGTON – Following years of efforts to try to safeguard benefits for mine workers, U.S. Sens. Mark R. Warner and Tim Kaine (both D-VA), today introduced bipartisan legislation along with Sens. Joe Manchin (D-WV), Mitch McConnell (R-KY), and Shelley Moore Capito (R-WV) to secure pensions for our nation’s retired miners. The legislation would shore up the 1974 United Mine Workers of America Pension Plan – which is currently headed for insolvency due to coal company bankruptcies and the 2008 financial crisis – ensuring that at-risk miners do not lose their healthcare due to the 2018 and 2019 coal company bankruptcies.

“After working for so long to get miners the benefits they deserve, this bipartisan legislation is an encouraging step in the right direction,” said the Senators. “Our mine workers have worked extremely hard to power our nation, often at great risk to themselves. The least we can do is make sure they are able to get their hard-earned benefits and pensions, and that once they retire, they can do so with peace of mind. We are proud to introduce this legislation along with our colleagues to help us keep our nation’s promise to miners in the Commonwealth and all across the country.”

The Bipartisan American Miners Act of 2019 will amend the Surface Mining Control and Reclamation Act of 1977 to transfer excess funds from the Abandoned Mine Land (AML) Fund to the 1974 Pension Plan to prevent its insolvency. It will also amend the Coal Act to include 2018 and 2019 bankruptcies in the miners’ healthcare fix that passed in 2017. These actions will secure the pensions of 92,000 coal miners and protect healthcare benefits for 13,000 miners.

Sens. Warner and Kaine have been longtime advocates for coal miners and their families. In August 2018, they introduced and passed into law legislation to improve early detection and treatment of black lung disease among coal miners.

The Bipartisan American Miners Act of 2019 is also co-sponsored by Senators Rob Portman (R-OH), Doug Jones (D-AL), Tammy Duckworth (D-IL), Sherrod Brown (D-OH), Bob Casey (D-PA), and Dick Durbin (D-IL), and Kyrsten Sinema (D-AZ).

A copy of the bill is available here.

###

WASHINGTON — Today, U.S. Sen. Mark R. Warner (D-VA) met with David Collins, the new Director of the Hampton VA Medical Center, at Sen. Warner’s office in Washington, D.C.

In the meeting, Sen. Warner and Director Collins discussed staffing challenges and shortages at the Hampton VA Medical Center and how these factors may have contributed to the problems raised last month by an Inspector General report related to managing and tracking supplies. Additionally, they spoke about suicide prevention efforts and strategies for reducing wait times for medical services, including primary care and mental health care. During the meeting, Sen. Warner also reiterated his commitment to increasing access for one of the fastest growing veterans populations in the nation and pushing for the completion of a new VA Community Based Outpatient Clinic in South Hampton Roads.

“Our veterans have sacrificed so much for the nation – the least we can do is to make sure they get top-notch medical care once they are back home,” said Sen. Warner. “I am committed to working with Director Collins to help mitigate the challenges at Hampton VA Medical Center. But the VA also needs more capacity in the Hampton region to meet the growing demands of our veteran population. While we may have cleared the last Congressional hurdle for approving the new clinic lease prospectus in South Hampton Roads, our work is not done until this clinic is fully-functional and serving our veterans.”

Sen. Warner has been a longtime advocate of improving care for veterans in the Commonwealth. In 2017, he successfully pushed for Congress to approve overdue medical leases on 28 major Veteran’s Affairs (VA) facilities, including one in Hampton Roads, which is projected to ease the workload at the Hampton VA Medical Center, and another in Fredericksburg. Since then, Sen. Warner has pushed to get these facilities up and running by pressuring the GSA and the VA to move these projects forward, pushing the Office of Management and Budget (OMB) to sign off on these clinics’ lease prospectuses, and successfully urging the Senate Committee on Environment and Public Works (EPW) to bring up the prospectuses for approval.

Sen. Warner has also long fought to reduce wait times for veterans in Hampton Roads. In 2015, confronted with wait times that were three times the national average, Sen. Warner successfully urged the VA to send down a team of experts to try to address the problem. He also succeeded in getting the Northern Virginia Technology Council to issue a free report, detailing how to reduce wait times.

Director Collins, who was appointed director of the Hampton VA Medical Center in August of 2019, is a 28-year Veteran of the Navy Medical Service Corps, whose recent appointments include service as the Executive Assistant to the Navy Surgeon General, Commanding Officer of the Jacksonville Naval Hospital, and Chief Operating Officer of the Naval Hospital in Bremerton, Washington. He also spent time as the Executive Officer for NATO’s Multinational Medical Unit in Afghanistan, demonstrating an ability to relate to other military Veterans with a similar background. He is a current resident of the Hampton and Chesapeake Community.

###

WASHINGTON – After ISIS terrorists in Syria escaped from detention facilities that had been run by America’s Kurdish partners in the Syrian Defense Forces (SDF) following the withdrawal of U.S. troops and subsequent incursion by Turkey, U.S. Sen. Mark R. Warner, Vice Chairman of the Senate Select Committee on Intelligence, and U.S. Sen. Susan Collins (R-ME), a senior member of the Committee, today requested that the Office of the Director of National Intelligence produce an unclassified assessment regarding the escape’s impact on the security of United States and our allies.

In a letter to the acting Director of National Intelligence Admiral Joseph Maguire, the Senators wrote, “The SDF has been holding more than 10,000 captured ISIS fighters, including 2,000 so-called ‘foreign fighters,’ committed jihadists who traveled from Europe, the Middle East, and elsewhere, to join ISIS. Many of these individuals are hard-core terrorists, with the kinds of expertise – bomb-making, leadership and propaganda – that had made ISIS such a threat to the United States and our allies. As the Kurds understandably shift their focus to defending themselves, their ability to securely detain these ISIS fighters will become increasingly uncertain. Already, press reports have indicated that senior U.S. officials say they have ‘no real idea’ how many fighters may have already escaped, and how many more are likely to do so.”

“If the past is any indication, it was escaped al-Qaeda in Iraq (AQI) prisoners that formed the core of what became known as ISIS, contributing to the group’s eventual takeover of Mosul and much of northern Iraq.  The subsequent influx of foreign fighters into Iraq and Syria increased the terrorist threat to the United States and Europe.  If left unchecked, the escape of ISIS detainees in Syria could lead to similar counterterrorism setbacks,” continued the Senators. “Therefore, please provide to the Senate Select Committee on Intelligence an assessment of the impact the escape of ISIS detainees in SDF custody could have on the security of United States and our allies, including the detainees who have escaped and those still residing in SDF custody.  In order to better inform the American public, the Congress, policymakers and America’s allies, this assessment should be unclassified to the extent possible, with a classified annex if needed.”

The Senators asked that ODNI provide a response to the request within two weeks, by November 19, 2019. The full text of today’s letter is below. A signed copy is available here.

November 5, 2019

The Honorable Joseph Maguire

Acting Director of National Intelligence

Office of the Director of National Intelligence

Washington, DC 20511

Dear Director Maguire:

We write to express our grave concern about the instability in Syria, and particularly about the escape of numerous Islamic State (ISIS) detainees from detention facilities that had been run by America’s Kurdish partners in the Syrian Defense Forces (SDF).

The SDF has been holding more than 10,000 captured ISIS fighters, including 2,000 so-called “foreign fighters,” committed jihadists who traveled from Europe, the Middle East, and elsewhere, to join ISIS. Many of these individuals are hard-core terrorists, with the kinds of expertise – bomb-making, leadership and propaganda – that had made ISIS such a threat to the United States and our allies.

As the Kurds understandably shift their focus to defending themselves, their ability to securely detain these ISIS fighters will become increasingly uncertain. Already, press reports have indicated that senior U.S. officials say they have “no real idea” how many fighters may have already escaped, and how many more are likely to do so.

If the past is any indication, it was escaped al-Qaeda in Iraq (AQI) prisoners that formed the core of what became known as ISIS, contributing to the group’s eventual takeover of Mosul and much of northern Iraq. The subsequent influx of foreign fighters into Iraq and Syria increased the terrorist threat to the United States and Europe. If left unchecked, the escape of ISIS detainees in Syria could lead to similar counterterrorism setbacks.

Therefore, please provide to the Senate Select Committee on Intelligence an assessment of the impact the escape of ISIS detainees in SDF custody could have on the security of United States and our allies, including the detainees who have escaped and those still residing in SDF custody. In order to better inform the American public, the Congress, policymakers and America’s allies, this assessment should be unclassified to the extent possible, with a classified annex if needed. Please provide a response to this request by November 19, 2019.

Sincerely,

Mark R. Warner

Vice Chairman

Susan M. Collins

United States Senator

CC: The Honorable Mark T. Esper, Secretary of Defense

###

WASHINGTON, D.C. – Congresswoman Eleanor Holmes Norton (D-DC) and Senators Mark Warner (D-VA), Ben Cardin (D-MD), Tim Kaine (D-VA), and Chris Van Hollen (D-MD) announced they will introduce a resolution honoring the Washington Nationals’ first World Series title in franchise history.  Beating the Houston Astros in Game 7 last night, the Nationals won all four away games to clinch the series.

“In one word – history!” Norton said.  “Congratulations to the Washington Nationals on this achievement and thank you to all the coaches, players, trainers, and especially fans who believed in our underdog team.  Whether it’s the Capitals, the Mystics, or the Nationals – or the historic momentum for D.C. statehood – the District has been on a roll lately and has established itself as a true big-time sports city.”

"The 2019 Washington Nationals fought with incredible heart and passion all season long to become World Champions,” Warner said.  “Coming back from their 19-31 start to win elimination game after elimination game, these Nationals refused to give in or give up. I want to congratulate every single member of the team, from Mad Max to Childish Bambino to Virginia's own original National, Ryan Zimmerman. Enjoy this well-deserved honor -- you made history. And if you figure out how to get Baby Shark to stop playing on repeat in your heads, please let me know."

"The Washington Nationals have shown the world what it means to never give up on yourself or your team,” Cardin said.  “Fans watched as the Nats put the fun back in baseball. Their shark-filled energy fueled a remarkable, record-breaking rise all the way to their first franchise world championship. Congratulations to Manager Dave Martinez and every team member who contributed to this win of all wins on the field and in the clubhouse. Thank you for setting such an incredible example for sport and for life.”

"At a time of so much division, the Washington Nationals gave everyone something to cheer for together,” Kaine said.  “Who could've predicted they would revive their season after such a dreary start? Who could have called Howie Kendrick hitting not one but multiple series-winning home runs? And who on earth could've imagined that Baby Shark would be their theme of the year? These Nats had fun, and we had fun watching them all year. This victory will be remembered and treasured for a long, long time."

"A huge congratulations to the Nationals, our 2019 World Champs! The Nats beat all the odds for this hard-fought win,” Van Hollen said.  “From the players, to the coaches, to the staff, we're proud of this victory and the effort you put in along the way. I also want to give a shout-out to the great fans across the entire DMV who poured their hearts and souls into this team. Today is a great day for our Nation's Capital, and I look forward to celebrating the win!"

###

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA) along Sens. Brian Schatz (D-HI), Ben Cardin (D-MD), Cindy Hyde-Smith (R-MS), John Thune (R-SD), and Roger Wicker (R-MS) have introduced bipartisan legislation to expand telehealth services through Medicare, improve health outcomes, make it easier for patients to connect with their doctors, and help cut costs for patients and providers. Companion legislation has been introduced in the House of Representatives by U.S. Reps. Mike Thompson (D-CA), Peter Welch (D-VT), David Schweikert (R-AZ), and Bill Johnson (R-OH).

“I’ve seen firsthand how hard it can be for Virginians to access health care in rural or underserved communities,” said Sen. Warner. “From my time as Governor through my years in the Senate, I’ve constantly pushed to use innovation to increase health care accessibility for Virginians. This legislation will allow more individuals across Virginia and our country to take advantage of telehealth services that require less travel time and provide affordable, quality care.”

 In studies, telehealth has been shown to improve care and patient satisfaction while reducing hospitalizations. The Creating Opportunities Now for Necessary and Effective Care Technologies (CONNECT) for Health Act of 2019 builds on the progress made in recent years to increase the use of telehealth through Medicare. Specifically, the legislation would:

• Provide the Secretary of Health and Human Services (HHS) the authority to waive telehealth restrictions when necessary;
• Remove geographic and originating site restrictions for services like mental health and emergency medical care;
• Allow rural health clinics and other community-based health care centers to provide telehealth services; and
• Require a study to explore more ways to expand telehealth services so that more people can access health care services in their own homes.

Sen. Warner, an original cosponsor of the 2016 CONNECT for Health Act, has been a longtime advocate for increased access to health care through telehealth. Last year, he successfully included a provision to expand telehealth services for substance abuse treatment in the Opioid Crisis Response Act of 2018. In 2003, then-Gov. Warner expanded Medicaid coverage for telemedicine statewide, including evaluation and management visits, a range of individual psychotherapies, the full range of consultations, and some clinical services, including in cardiology and obstetrics. Coverage was also expanded to include non-physician providers. Among other benefits, the telehealth expansion allowed individuals in medically underserved and remote areas of Virginia to access quality specialty care that isn’t always available at home.

The CONNECT for Health Act of 2019 has the support of more than 100 organizations including AARP, ACT | The App Association, Alliance for Connected Care, American College of Emergency Physicians, American Hospital Association, American Medical Association, American Medical Group Association, American Nurses Association, American Psychiatric Association, American Psychological Association, American Telemedicine Association, America’s Health Insurance Plans, Connected Health Initiative, Federation of American Hospitals, Health Innovation Alliance, Healthcare Information and Management Systems Society (HIMSS), National Alliance on Mental Illness, National Association of Community Health Centers, National Association of Rural Health Clinics, and the Personal Connected Health Alliance.

“By reducing geographic and originating site restrictions in Medicare, the CONNECT for Health Act of 2019 will bridge the miles between patients and care, mitigate workforce shortages, and most importantly improve outcomes at lower costs for our nation’s vulnerable populations. Coupled with our national priority of expanding broadband access, these efforts will enable all Americans to enjoy better health and health related prosperity,” said Dr. Karen Rheuban, Director of the UVA Center for Telehealth.

“This legislation would benefit patients by removing antiquated restrictions in the Medicare program that prevent physicians from using widely available medical technology that has become commonplace in the past decade. Increased access to telehealth is urgently needed to help meet the health needs of the swiftly changing demographics of our senior population. The CONNECT for Health Act’s expansion of telehealth coverage in the Medicare program also will spur increased investment and innovation in delivery redesign to benefit all patients,” said Patrice A. Harris, M.D., M.A., President of the American Medical Association. “The AMA strongly supports the CONNECT for Health Act of 2019 and applauds Senators Schatz, Wicker, Cardin, Thune, Warner, and Hyde-Smith for their continued leadership on telehealth issues, and we look forward to seeing this vital bill advance in Congress.”

###

WASHINGTON – Frustrated by repeated delays and inaction by the Department of Justice (DOJ), U.S. Sen. Mark R. Warner (D-VA) successfully pushed for the inclusion of an amendment to the FY2020 Commerce, Justice, Science, and Related Agencies (CJS) Appropriations Act that would force the DOJ to report to Congress a date for the full implementation of the Ashanti Alert.

“Every day that the Department of Justice delays in getting this alert system up and running, we fail in providing our law enforcement the tools they need to help save lives,” said Sen. Warner. “Frankly, there is no excuse for the DOJ’s failure to follow through on implementing the Ashanti Alert system or even provide a timeline for when it will be operational. With the inclusion of this amendment, the DOJ will finally have to provide some answers for the Billie family and those who’ve pushed for this lifesaving alert.”

The amendment will be included as part of the “minibus II” funding package that funds several federal agencies, including the DOJ. It forces the DOJ to provide Congress with a progress report of the Ashanti Alert implementation 30 days immediately after the bill is signed into law. Additionally, the amendment requires that the DOJ establish a deadline for full implementation of the Ashanti Alert Act no later than 90 days after the enactment of this bill. Following today’s Senate passage, Sen. Warner will continue to push the provision forward as the House of Representatives and Congress work through the spending bill process.

Sen. Warner’s amendment was also cosponsored by Sens. Tim Kaine (D-VA), Richard Blumenthal (D-CT), and Chris Van Hollen (D-MD). Sen. Warner, who secured unanimous passage of this bill through the Senate on December 6, 2018, has been a leader in the fight to implement the Ashanti Alert. In August, he reiterated the need for the alert’s swift implementation, following a meeting with Principal Deputy Assistant Attorney General Sullivan. He has also previously demanded in-person meetings with the DOJ, repeatedly pressed the DOJ for implementation updates, and urged congressional appropriators to provide full funding for the timely implementation of the Ashanti Alert.

The amendment language can be found here.

###

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA) is pressing Facebook CEO Mark Zuckerberg to reverse a policy allowing politicians and elected officials to run demonstrably false advertisements on the platform. 

“The public nature of broadcast television, radio, print, cable, and satellite ensured a level of accountability for traditional political advertisements. In addition to being broadly accessible to the electorate, these communications are accessible to the press, fact-checkers, and political opponents through media monitoring services that track broadcast content across television and radio markets. As a result, strong disincentives exist for a candidate to disseminate materially false, inflammatory, or contradictory messages to the public,” the Senator wrote in a letter to Zuckerberg, sent late last evening. “By contrast, social media platforms tout their ability to target portions of the electorate with direct, ephemeral advertisements—often on the basis of private information the platform has on individual users, facilitating political advertisements that are contradictory, racially or socially inflammatory, or materially false, without the same constraints as more traditional communications mediums, and without affording opposing candidates an equal opportunity to respond directly in front of the same targeted audience.”

“In making strides not to continue contributing to the coarsening of our political debate, and the undermining of our public institutions, at a minimum, Facebook should at least adhere to the same norms of other traditional media companies when it comes to political advertising. In defending its refusal to remove false political advertisements by candidates, Facebook has pointed to provisions of the Communications Act that prohibit broadcast licensees from rejecting or modifying candidate ads, regardless of their accuracy. This comparison is inapt. Broadcast licensees face legal requirements to run these ads – in addition to a range of other obligations – as a condition of holding federal spectrum licenses. The prohibition to reject or modify the ad accompanies a statutory obligation to air ads of qualified federal candidates in the first place,” Sen. Warner concluded. “A more appropriate comparison for a platform like Facebook would be cable networks, which (like Facebook) face no such prohibition on rejecting demonstrably false advertisements from political candidates – nor are they bound by related obligations such as rules on advertising rates and reasonable access requirements. Therefore, the industry norms Facebook should heed would more aptly be those followed by not by local broadcasters, but by cable networks. Notably, CNN refused to air the same demonstrably false ad Facebook allowed the Trump campaign to run. To the extent Facebook takes inspiration from the norms of local broadcasters, it should likewise require that candidates provide documentation of claims made in their advertisements.” 

Sen. Warner also posed a series of questions seeking to clarify and define the Facebook policy, including: 

• Under this policy, how is Facebook defining “politician”? What steps have you taken to prevent abuse of this definition?

• Mr. Nick Clegg, Facebook’s VP of Global Affairs, has noted that this policy has exceptions for speech which “can lead to real-world violence and harm” or “endangers people.” How is Facebook defining these terms? 

• Unlike online intermediaries like Facebook, traditional media outlets can be sued for defamation for the advertisements they run. Because of this, traditional media outlets have generally adopted norms of refusing to run advertisements with clear falsehoods, and of taking down ads where an opposing campaign or fact-checking organization has shown an ad to be false. Would a regulatory regime establishing greater parity in liability between Facebook and traditional media outlets serve to simplify Facebook’s policies in this sphere?

• Will you commit to provide ad targeting information, as required under the Honest Ads Act, to better allow opposing campaigns to “correct the record” in responding to potentially misleading ads?

Sen. Warner has written and introduced a series of bipartisan bills designed to protect consumers and reduce the power of giant social media platforms like Facebook. The Designing Accounting Safeguards to Help Broaden Oversight And Regulations on Data (DASHBOARD) Act, bipartisan legislation with Sen. Josh Hawley (R-MO), will require data harvesting companies such as social media platforms to tell consumers and financial regulators exactly what data they are collecting from consumers, and how it is being leveraged by the platform for profit.? The Deceptive Experiences To Online Users Reduction (DETOUR) Act,? bipartisan legislation with Sen. Deb Fischer (R-NE), will prohibit large online platforms from using deceptive user interfaces, known as “dark patterns” to trick consumers into handing over their personal data. The Honest Ads Act, bipartisan legislation with Sens. Amy Klobuchar (D-MN) and Lindsey Graham (R-SC) will help prevent foreign interference in future elections and improve the transparency of online political advertisements. The Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act, bipartisan legislation with Sen. Hawley and Sen. Richard Blumenthal (D-CT), will encourage market-based competition to dominant social media platforms by requiring the largest companies to make user data portable – and their services interoperable – with other platforms, and to allow users to designate a trusted third-party service to manage their privacy and account settings, if they so choose. 

The full text of Sen. Warner’s letter to Zuckerberg appears below. A copy of the letter is available here. 

Mr. Mark Zuckerberg

Chief Executive Officer

Facebook, Inc.

1 Hacker Way

Menlo Park, CA 94025

Dear Mr. Zuckerberg,

I write you in the context of an ongoing debate about the impact of social media on our public institutions and on our political discourse. In the last two weeks, one facet of this debate has been the extent to which platforms like Facebook allow politicians to spread deliberate falsehoods through paid political advertising. While Facebook’s advertising rules have long prohibited ads with “deceptive, false, or misleading content” – relying on its “third-party fact-checkers” to identify violations of these policies – Facebook subsequently revised these rules to exempt political ads run by politicians through a policy that withholds such ads from third-party fact-checker review.

The consequence of these policies came into sharp focus early this month, after a series of ads purchased by the Trump 2020 campaign containing falsehoods about former Vice President Biden were found in Facebook’s political ad archive. I appreciate that these ads were discovered only as a result of Facebook’s decision to voluntarily implement some of the Honest Ads Act, bipartisan legislation I drafted with Senator Klobuchar and the late Senator John McCain, which has allowed researchers, opposing campaigns, and journalists to track political advertising on Facebook. However, Facebook’s refusal to provide targeting information used for political ads, and widely-reported defects in the API preventing large-scale data analysis, underscore that piecemeal, optional steps by individual companies are insufficient to protect our democracy from bad actors exploiting social media; I will continue to press to pass the Honest Ads Act into law and press your company to fully comply with the provisions in the Act. 

Transparency, however, is but one value undergirding our nation’s political discourse. A whole host of norms and laws have structured the public sphere – the space within civil society in which we debate important political, social, and cultural issues. The public sphere has been shaped by a mix of legal rules (traditionally based in communications and campaign finance laws) and norms that have worked to promote transparency, public deliberation and debate, openness, diversity of opinion, and accountability.

Undeniably, these norms have come under major strain in recent years, from a variety of different directions. Among political actors, norms of decency and probity – strained in the best of times – have been routinely flouted. This is particularly evident in today’s digital age. As an avid user of digital media (and shrewd practitioner of how to exploit it), President Trump has in many ways helped to undermine these norms – and other candidates have chosen to follow suit.  

But it is also true that these norms have been undermined at least in part because of the nature, architecture, policies, and operation of platforms like Facebook. The public nature of broadcast television, radio, print, cable, and satellite ensured a level of accountability for traditional political advertisements. In addition to being broadly accessible to the electorate, these communications are accessible to the press, fact-checkers, and political opponents through media monitoring services that track broadcast content across television and radio markets. As a result, strong disincentives exist for a candidate to disseminate materially false, inflammatory, or contradictory messages to the public. By contrast, social media platforms tout their ability to target portions of the electorate with direct, ephemeral advertisements—often on the basis of private information the platform has on individual users, facilitating political advertisements that are contradictory, racially or socially inflammatory, or materially false, without the same constraints as more traditional communications mediums, and without affording opposing candidates an equal opportunity to respond directly in front of the same targeted audience. 

The consequences of Facebook’s decision not to apply the same standards to political advertisements on its platform are potentially enormous: Today, 79 percent of online Americans – 68 percent of all Americans – are Facebook users. Over 160 million Americans use Facebook on a daily basis, spending an average of 35 minutes on the site each day. By contrast, the most-watched television broadcast in U.S. history – Super Bowl XLIX – was viewed by 114 million Americans. In the 2016 election, spending on digital advertising reached $1.4 billion, a 789 percent increase from the $159 million spent in 2012. The use of social media – and the internet more broadly – to inform the decisions of the electorate only heightens the need for scrutiny of the ads placed on those sites.

In making strides not to continue contributing to the coarsening of our political debate, and the undermining of our public institutions, at a minimum, Facebook should at least adhere to the same norms of other traditional media companies when it comes to political advertising. In defending its refusal to remove false political advertisements by candidates, Facebook has pointed to provisions of the Communications Act that prohibit broadcast licensees from rejecting or modifying candidate ads, regardless of their accuracy. This comparison is inapt. Broadcast licensees face legal requirements to run these ads – in addition to a range of other obligations – as a condition of holding federal spectrum licenses. The prohibition to reject or modify the ad accompanies a statutory obligation to air ads of qualified federal candidates in the first place.

A more appropriate comparison for a platform like Facebook would be cable networks, which (like Facebook) face no such prohibition on rejecting demonstrably false advertisements from political candidates – nor are they bound by related obligations such as rules on advertising rates and reasonable access requirements. Therefore, the industry norms Facebook should heed would more aptly be those followed by not by local broadcasters, but by cable networks. Notably, CNN refused to air the same demonstrably false ad Facebook allowed the Trump campaign to run. To the extent Facebook takes inspiration from the norms of local broadcasters, it should likewise require that candidates provide documentation of claims made in their advertisements.

Facebook’s apparent lack of foresight or concern for the possible damages caused by this policy concerns me. Thus, I am asking for a response from the company regarding the details of this policy and efforts to avert these negative effects: 

• Under this policy, how is Facebook defining “politician”? What steps have you taken to prevent abuse of this definition?

• Mr. Nick Clegg, Facebook’s VP of Global Affairs, has noted that this policy has exceptions for speech which “can lead to real-world violence and harm” or “endangers people.” How is Facebook defining these terms? 

• Unlike online intermediaries like Facebook, traditional media outlets can be sued for defamation for the advertisements they run. Because of this, traditional media outlets have generally adopted norms of refusing to run advertisements with clear falsehoods, and of taking down ads where an opposing campaign or fact-checking organization has shown an ad to be false. Would a regulatory regime establishing greater parity in liability between Facebook and traditional media outlets serve to simplify Facebook’s policies in this sphere?

• Will you commit to provide ad targeting information, as required under the Honest Ads Act, to better allow opposing campaigns to “correct the record” in responding to potentially misleading ads?

 Thank you for your time and I look forward to receiving your responses within the next two weeks.

Sincerely,

Mark R. Warner

U.S. Senator

###

WASHINGTON – Senate Democratic Leader Chuck Schumer (D-NY) and Senator Mark Warner (D-VA), along with Senate Committee on Health, Education, and Labor Ranking Member Patty Murray (D-WA), and Senate Committee on Finance Ranking Member Ron Wyden (D-OR), today announced that Senate Democrats will use their authority under the Congressional Review Act to force a vote on the Senate floor this week, as early as Wednesday, on a resolution to that would roll back the Trump administration’s rule on 1332 waivers, which the Trump Administration is using to sabotage Americans’ health care and undermine the critical pre-existing condition protections that more than 130 million Americans rely on. The Trump administration’s rule, if left in place, allows states to greenlight junk insurance plans that don’t fully protect people with pre-existing conditions, don’t cover essential health benefits like prescription drugs and maternity care, and raise out-of-pocket costs on many American families. The rule also lets states promote junk plans that can charge people more if they have a pre-existing condition or refuse to offer coverage for specific benefits. These plans would destabilize our insurance markets and could limit insurance access and raise costs for millions of Americans.

The vote on the resolution to overturn the Trump administration’s rule, which Democrats will force under the Congressional Review Act,  is one of the most significant policy changes the Senate will consider in Majority Leader McConnell’s legislative graveyard. Leader McConnell – long before the House impeachment inquiry – turned the Senate into a legislative graveyard for the priorities of the American people.

“Earlier this year, I was proud to lead the effort to introduce a CRA resolution to overturn the Trump Administration’s latest attempt to undermine our healthcare system,” said Senator Warner. “Today, I’m glad to announce that as a result of this effort, we’ll be able to give every Senator the opportunity to stand up for folks with pre-existing conditions. Many of my colleagues on the other side of the aisle have said that they support the Affordable Care Act protections that so many folks count on. Well, this vote is an opportunity for them to prove it. I urge my colleagues to stand with the millions of Americans with pre-existing conditions by voting to reverse this harmful effort by the Trump Administration.”

“This week, the Senate will hold one of the most significant votes of the year: we will finally see where Republicans stand on the Trump administration’s efforts to sabotage the health care of millions of Americans with pre-existing conditions. It is preposterous that the Trump administration claims to care about preserving pre-existing condition protections for millions of Americans while simultaneously peddling shoddy, substandard junk plans that undermine and weaken those very protections,” said Leader Schumer.  “I say to my Republican colleagues: stand up to the sabotage or stop swindling the American people with your empty promises of support for protections for Americans with pre-existing conditions. With this vote, the Senate Republicans who say they care about preserving pre-existing condition protections will have a chance to prove it to the American people. I urge my colleagues to step up to the plate and join Senate Democrats in supporting this critical resolution.”

“Democrats are putting an end to Republicans’ transparent health care charade and forcing every Senator to go on the record once and for all about whether they will fight for families’ health care and stand up for patients with pre-existing conditions—even if it means standing up to President Trump,” said Senator Murray. “Families and patients across the country are going to be watching very carefully and taking note of who votes to protect their health care, and who sides with President Trump and big insurance companies by voting to uphold his rule promoting junk plans and undermining protections for pre-existing conditions.”

“Americans want to know where their elected officials stand on protecting those with pre-existing conditions. This week they will have an answer,” said Senator Wyden. “The Senate will be voting on a Trump rule that throws the door open to discrimination, leaving those who need health care most at the mercy of unscrupulous insurance companies. I urge my colleagues to join Democrats and end this perversion of the law – people with pre-existing conditions are counting on it.”

###

WASHINGTON — U.S. Sen. Mark R. Warner (D-VA), Co-Chair of the Senate Aerospace Caucus, met with Clayton Turner, Director of the NASA Langley Research Center in Hampton, Virginia, at Sen. Warner’s office in Washington, D.C.

In the meeting, Sen. Warner and Director Turner discussed NASA Langley’s FY20 budget as well as NASA’s work in unmanned systems. Additionally, they spoke about importance of educating and inspiring the next generation to continue NASA’s work, and Director Turner provided an update on the Artemis program – a mission to land the first woman and next man on the Moon by 2024, using innovative technologies to explore more of the lunar surface than ever before.

“From the earliest days of the Space Program, NASA Langley has played a crucial role supporting NASA’s mission,” said Sen. Warner. “Director Turner and I agree that Congress must continue to support the important work that’s happening at the facility, as well as the business ecosystem of innovative aerospace companies that’s developed in Virginia, and I’m committed to fighting for those priorities in the Senate.”

This meeting follows the September approval of the FY2020 Commerce, Justice, Science, and Related Agencies (CJS) Appropriations Act by the Senate Committee on Appropriations. This legislation would determine NASA Langley’s budget for the next fiscal year, and would authorize funding for several NASA priorities, including the Climate Absolute Radiance and Refractivity Observatory Pathfinder Mission (CLARREO-PF) – a climate change monitoring technology that is scheduled to launch to the International Space Station in 2023.

Sen. Warner has advocated for policies that invest in long-term research and development in aeronautics. Last year, he and Sen. Jerry Moran (R-KS) introduced the Aeronautics Innovation Act to help boost innovation, research, and development in the aeronautics industry by providing a five-year funding commitment to supplement research and advance innovation in the field.

Turner was appointed Director of NASA Langley in September 2019. As center director, he leads a diverse group of about 3,400 civil servant and contractor scientists, researchers, engineers and support staff, who work to make revolutionary improvements to aviation, expand understanding of Earth’s atmosphere, and develop technology for space exploration. From 2015 until his appointment as director, Turner served as Langley’s deputy center director. He is the first African-American to lead NASA Langley in the center’s history.

###