Congress' role in IT security debated