combat those ways. It is similar to somebody changing an entry in a book, if it is a bookkeeping system. You have to find ways of detecting when that happens, and it is easier to detect it on a computer if there have been alterations of records, because everything is checked all of the way.

You also have to protect your means of access to the system, the terminals that can change any data in the system, and verify who is using those terminals and verify their authority to use them, and so on. All of this adds somewhat to the cost of the system but is all necessary.

I think that the worries about tampering with the system are justified, but I think the techniques for combating it are reasonably well developed and are reasonably secure.

Mr. PAINTER. How about the question of public confidence? I recall the chairman the other day mentioning his dismay that we brought up the topic of credit cards, and I must say that I share his misgivings when it comes to some of the credit card arrangements, because I think all of us have had an unfortunate experience with credit cards at one time or another.

What about public confidence in this whole concept of having everything fed into a computer and the computer possibly coming out with bizarre results? You hear stories of checks being printed for $1 million and that kind of thing. How are we going to get the confidence of the American public in this system?

Mr. NOYES. Two things have to be done at least. One is to develop a system that deserves that confidence. The problems that you bring out are problems, because the system did fail. Sufficient effort, for a system of this importance, must be expended to make sure that it has the adequate checks and balances and reliability so that it deserves the public's confidence.

Mr. PAINTER. Would you say that the system should provide an option for the average citizen? If he wants a certificate. he ought to be able to get it. Maybe he will have to pay an extra charge of some sort. Let us suppose, for example, that I don't believe in the system that you have designed. It has still been implemented, and yet I, as a shareholder, say I am not going to go along with this system; I want my stock certificate. Do you think the system we come out with should have some method whereby a minority of people who want their stock certificates will be able to get them?

Mr. NOYES. We have suggested this in our reports and recommended that. I see no reason why, if an individual wants a certificate and he is willing to pay what it costs to get it to him, his fair share of the cost, that he should not have it.

Mr. PAINTER. Pushing it one step further. do you think it really ought to cost him anything to get the certificate? Won't it be reasonable for him to say, "Well, now, under the old system, I didn't have to pay to get a certificate: I was legally entitled to it. And now you are making me pay to get a certificate. Is that fair to me?"

Mr. NOYES. I think so. He is really paying for it now. It is a question of how he pays for it-through less dividends from his company or higher brokerage fees or however it gets into the system. There is a tradeoff point. At one extreme there is the individual who is very active in trading and changing his account all of the time, and it is

impractical for him to retain the certificates. In many cases, he doesn't. He keeps them on deposit with his brokerage firm.

At the opposite extreme is the individual who buys some securities, 100 shares, and keeps them for perhaps many, many years. In that case, it may be better, from a systems point of view, to let them have the certificates or at least let them have their record of ownership directly with the transfer agent rather than going through the system. And I think that the matter of establishing fees or the fee structure should be brought into relationship with the costs. There is a certain amount of cost involved with maintaining an account. It may be fairly low, but I think a fee could be established for this, a few cents a month perhaps. There is also a cost associated with the printing of a certificate and engraving a certificate and issuing it, and maybe that is a few dollars.

So there is a reasonable balance point. The system can be designed so that for those who are going to keep their securities a long time, it is cheaper for them to get a certificate. Those that are trading don't get the certificate.

Mr. SPORKIN. Mr. Painter, I think the objective would be to do away with the certificate in respect to major companies. I remember years. ago when you went to your bank you used to have a passbook. You would make an entry in your book, and if you withdrew some money you would take it out. Now, as I understand, most of your savings banks are going to a monthly statement: so that, sure, the public, some people, felt it was important to have the little passbook. It is a matter of education.

I think if you have a system whereby you are still going to have certificates floating around, it is going to be difficult. That doesn't mean that you couldn't have a substitute of a certificate. In other words, if a person wants to show or exhibit his evidence of ownership, they could send him a facsimile of a certificate or he would obviously have to have some sort of document which would show his ownership, but that would not be something that would be passed through and around the system. It would be something that he would be able to keep to be able to evidence his ownership.

I just think once you get to a point where you are going to have both types of systems working, you are not much further along the line than we are now. I think the ultimate objective would be to do away with the certificate, at least with respect to the type of companies we are talking about, the major trading corporations.

Mr. PAINTER. Still, aren't you going to have certificates that are in safe deposit boxes now and that will remain there for many, many years? How are we going to get the certificates out of those safe deposit boxes? You see the point I am getting at? In other words, it is going to take years and years to really get to a completely certificateless society in that sense.

Mr. SPORKIN. It may or may not. It may not be that you have to dislodge the certificates, since there are registered owners. You would advise the person that this has been substituted for that certificate. Of ourse, he would still have it; I don't know what the technology there requires, but I still think you could do it as soon as you determine that You are going to go for that system. But I don't think you want to

have two systems running at the same time, because I think you are going to destroy some of the fantastic benefits that are desired to be achieved.

Mr. WEINBERG. I think that if we go the route of establishing, through Federal legislation, the means to develop and install a system which would eliminate certificates, that we should probably try to do that as quickly as we could. I don't think we would ever want to ask people to send in their certificates. We have referred to this as either lock them up or burn them. I don't think that is necessary.

But I do believe that in a new system we should not provide a means to send out any new certificates. We should try to really take them out of circulation as quickly as we can, and we have to keep in mind, in doing that, we are giving the buyer or seller substantial benefits.

We have talked, for example, about reducing his commission charge by as much as 40 or 50 percent. On an average trade, that may be $20 he is saving. We have talked of moving settlement days down to next-day or same-day settlement from the present 4 or 5 days. That is a substantial improvement in the service that the investor is receiving. In doing that, I think we should be able to get the benefit of not having to send him a stock certificate, and I would feel strongly we should try to take that position. We are certainly giving more than we are asking the investor to give up. In fact, there are other examples that have been cited of how adaptable people are. Because there doesn't exist the necessary legislation, the mutual fund industry has gone the route of the optional certificate where you don't get a certificate unless you request it, and they found that within a relatively short period of time almost no customer requests a certificate. I think they found in less than a 10-year period that perhaps 90 percent of the people accept the idea of not getting stock certificates.

Mr. MALLER. I would like to go back to this question that Mr. Painter originally brought up, and that is the reliabilty of a system. In the first place, the computer hardware today is substantially more reliable than any time in the past.

Recognizing, however, that there can be problems with this, the system that I envision would include first, a dual network; and, in the second instance, it would have dual computers.

Now, to protect computers against vandalism and against unauthorized access is not very difficult. The computer data center that we have at the trust company is encased in a wall called a "Rayproof wall. No rays now known can penetrate this wall. All lines going into it go through filters which take out and block out anything that could be no detrimental to the tape or to the discs.

Access to the room is very, very limited. Our president and chairman of the board, for instance, do not have access to the room without one of the authorized people taking them into the room, and the way that you get into the room is with a little card that a few people have that have special coded numbers and a picture, and you turn in one that you have to a guard and he gives you another one back, and the one that he gives you is the one that goes into the machine that opens the door If the number or the magnetic coding on that card is inaccurate for one reason or another, the card is destroyed, so you cannot have access to a card that is not a valid card.

When it comes to unauthorized access to a terminal, there are means of buffering data. We use it in our business regularly. The data goes into a buffer, it is edit-checked, checked for certain things, before it is allowed access, even through the filters, into the data center itself. These are completely possible. You can prevent unauthorized access through terminals without special systems identification and individuals who do not have special systems identification, so that, again, this can be protected against.

Finally, when it comes to the question of breakdowns, be they electric, labor disturbance, or atomic attack, I visualize the location of the equipment in different places within the country so that there is always this system backup, there is always a check, a daily check of data between the systems, between the two systems that would be running, in addition to normal backup which would also be necessary. All of these things which are concerns can be protected against.

As far as the accuracy, as Mr. Noyes pointed out, a system that is well thought out, good logic, well designed, completely tested, with good users, good employees who are making the entries into it, will not have the same kinds of problems that are existent today with some systems in various sectors of our society. I am sure all of you have heard the expression that with a computer, "Garbage in is garbage out." This can be, to a great degree, prevented today.

Mr. SPORKIN. Let me ask a question, Mr. Chairman. We talk about forgeries or counterfeit certificates. Is it possible for someone who is a computer expert to pilfer or steal one of these plates that holds these tapes, take it out and then substitute a plate? Let us assume that I find out where the plate is for the list of shareholders in the United States Steel and I go and I get that plate and, if there is a backup system, I steal two plates and I take them back to my place, and I am a computer expert and I have the same type of machinery, because you can duplicate machinery.

Then I put in that the owner is a Swiss bank, and then I take that tape and get it back into the mainstream and then, of course, give an order through the broker saying to transfer or sell these Swiss securities. Is that a possibility with the computers because you don't have the type of thing that you have in the counterfeit area?

Mr. NOYES. That particular case is relatively easy to protect against, I think, by total system checks on it. I think we could probably find other sneaky ways of doing things that would be less easy to protect against. I don't know offhand just what they are.

I think we ought to consider that no matter what happens, a system will fail occasionally. Parts of the system will fail, and very clever people will try to find ways of using the system to their advantage. And it is going to be a continual battle, no matter what kind of system we have, certificates or certificateless, to combat this kind of thing. Mr. Moss. As a matter of fact, we had a very dramatic failure of the certificate society and many who for many months-in fact, there are many today-who wonder where their certificates are.

So we have to examine the alternatives against the background of the existing system and, if it is a significant improvement, then seek to improve it as we go along.

Mr. Ware.

#7-228 - 72 pt. 3 21

Mr. WARE. If I may make a comment, I suppose if I were attempting to do something of the order Mr. Sporkin referred to, I would employ "Mission Impossible" people; but, maybe more importantly, would not the principal problems arising in a certificateless procedure stem from the fact that we still have human errors?

I know my own experience has been that my name isn't spelled correctly even though it is a fairly simple name, or the middle initial is wrong or something of that sort. The address is incorrect. Someone apparently makes a mistake when the confirmation or instruction of transfer agents is typed. Those things do occur and I would suspect they will continue to occur because the information has to originate through some individual or groups of individuals.

Mr. NOYES. That will continue to be a problem, and you can limit it only to a degree. When it does happen, you have to have something built into the system to correct it. There is always going to be the guy who intends to sell and he pushes the "buy" button instead and now he has bought, or someone who is keying in his name and misspells it or leaves out his middle initial.

It is just a problem that is always going to be there as long as you have people, and the system has to have ways of detecting as much of this as possible, correcting what it can and rejecting what it can't; and then there will be errors that get into the system that will have to be taken care of as they get in.

Mr. Moss. Mr. Weinberg.

Mr. WEINBERG. Although this is clearly an area for concern, the kinds of systems we are talking about are not entirely without precedent. There are other systems equally critical in nature which do exist. The Defense Department system, the NASA system, in terms of missions they accomplished, were critical, the Federal Reserve book entry system, which transfers billions of dollars, insurance companies have billions of dollars of policyholder accounts, and many countries have fully integrated banking systems that transfer substantial sums of money and are much more dependent upon computers than we are. It is a problem that can be solved. It is an area the accounting profession spent a great deal of time studying. We, in all cases, feel that there are adequate means to provide against defalcation and other kinds of fraudulent transactions. It is a consideration, but it should not be an insurmountable obstacle in this case.

Mr. Moss. Mr. Ware.

Mr. WARE. I didn't want to infer they were insurmountable. I merely wanted to suggest they are going to continue. I think, as a matte of fact, within recent weeks, according to something I read in a news paper, the Federal Reserve sent one of the New York banks something like several millions of dollars they weren't entitled to receive.

Mr. WEINBERG. Those are the ones we catch. The problem, of course is always the undetected errors, but they show up eventually, we hope Mr. Moss. Mr. O'Connor.

Mr. O'CONNOR. Mr. Chairman, after listening to the systems ped ple in relation to automated society for the trading process, I woul like to point out, as I think we point out in our position paper, the re tention of the stock certificate until the utopian stage is reached is a extremely vital ingredient. Once you have the certificate, you don