0 THE SECRETARY OF DEFENSE in a 3' WASHINGTON THE DISTRICT OF COLUMBIA 5' Marc 991 a 434 etcDEC 1988 Honorable Richard L Thornburgh Attorney General Washington D C 20530 Dear Dick @724 Shortly after the Internet computer virus attack which was first detected on November 2 1988 we formed an executive after action assessment team within the Department of Defense The team met on November 14 1988 and reviewed the events and actions taken after detection of the virus on ARPANET and reviewed the report by the National Computer Security Center titled Proceedings of the Virus Post Mortem Meeting November 8 Enclosure l reviewed the DARPA report on the technical characteristics of the virus Enclosure and concluded with recommendations for improving the Department's responsiveness to future attacks As you will see from the team's report to me Enclosure 3 the two areas on which we need to focus are the development of a central national level coordination center and increased computer security awareness It became quickly evident during their analysis that the actions that need to be taken in the unclassified domain should be addressed jointly by the National Computer Security Center NCSC and the National Institute of Standards and Technology NIST with technical coordination from the Defense Advanced Research Projects Agency There will clearly be a need for significant involvement from Justice and the FBI in determining what investigative and legislative guidelines should be put in place with the coordination center I have requested that each of the Defense Components involved in the after action assessment support the recommendations on a priority basis I solicit your personal support for this effort so that we can move rapidly to improve our national posture to deal with potential computer security problems in the future Sincerely 7 Enclosures n10 As Stated This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu