Yesterday the House Homeland Security Committee conducted a markup hearing for HR 3696, the National Cybersecurity and Critical Infrastructure Protection Act of 2013. An amendment in the form of a substitute was offered by Chairman McCaul (R,TX) and fourteen other amendments were offered by other committee members. The revised language and twelve of the amendments were adopted by voice votes. The two remaining amendments were withdrawn.
Most of the major changes made to the bill by yesterday’s committee action were structural instead of policy changes. The original §106 (Assessment of Cybersecurity Workforce) was removed when similar provisions were added in the new §301. The language in that section (Homeland Security Cybersecurity Boots-on-the-Ground Act) comes from the bill already reported by the Committee in HR 3107).
Section 107 was also moved to the new TITLE III (Homeland Security Cybersecurity Workforce) as §302 and §108 was renumbered §106.
A new §205 (Prohibition on Collection Activities to Track Individuals’ Personally Identifiable Information.) was added by the substitute language. Two other new sections were added (National Research Council Study on the Resilience and Reliability of the Nation’s Power Grid; and Cybersecurity Scholars) in the amendment process.
The bill revises the Definitions section of the Homeland Security Act of 2002 (6 USC 101) and yesterday’s actions modified some of those changes. Three of the originally proposed definitions were removed:
• The term ‘cybersecurity provider’
• The term ‘cybersecurity system’
• The term ‘protected private entity’
One new definition were added:
The term ‘cybersecurity mission’ means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to foster the security and stability of cyberspace.
And one definition was revised:
The term ‘private entity’ means any individual or any private or publically-traded company, public or private utility (including a utility that is a unit of a State or local government, or a political subdivision of a State government) [added], organization, or corporation, including an officer, employee, or agent thereof.
None of these changes really mean much to anyone beyond litigators.
As I mentioned in the initial blog post about this bill, §201 essentially codifies the cybersecurity framework portion of the President’s cybersecurity executive order (EO 13636). The substitute language made some interesting changes to §201. The new language now amends the Homeland Security Act of 2002 by adding §230 instead of §230B; that is an administrative change only.
The language, however, describing what is essentially the authoring language for the cybersecurity framework was removed from the proposed section §230 while remaining in §201 of the bill. The best I can assume is that this makes some obscure change in the legal status of the provisions of §201(a).
The revised language also adds a new sub-paragraph to §201(a):
“(a)(2) LIMITATION.—Information shared with or provided to the Director of the National Institute of Standards and Technology or the Secretary of Homeland Security for the purpose of the activities under paragraph (1) may not be used by any Federal, State, or local government department or agency to regulate the activity of any private entity.”
This is just another example of where this bill goes out of its way to make sure that the cybersecurity provisions it establishes are completely voluntary in nature.
The remaining changes to the bill are essentially inconsequential wording changes, some of which are made for purely political reasons.
A good example of an inconsequential change is the wholesale language substitution in Title I where the phrase “such a system or network” where the phrase “an information system or network of information systems” appears a second time in a sentence. This makes the wording sound better but it does not alter the intent of the bill.
This bill is certainly high on Chairman McCaul’s priority list and the broad support that it has within the Committee certainly indicates that it would have the votes necessary to pass on the floor of the House and the Senate. I expect that we will see the bill on the floor of the House within weeks instead of months. Then the question will be whether or not Sen. Reid (D,NV) will continue to ignore House cybersecurity bills while waiting on the Senate to come up with acceptable language for a comprehensive cybersecurity bill.
Since this bill does not address information breaches in the private sector, I have a feeling that the current pressure for a private sector breach notification bill will hold up Senate consideration of this bill. And that is a shame. This bill may not have any strong cybersecurity mandates, but it is the most comprehensive cybersecurity bill currently before Congress.