S 2987 Introduced – FY 2019 NDAA

Last week Sen. Inhofe (R,OK) introduced S 2987, the John S. McCain National Defense Authorization Act for Fiscal Year 2019. The bill contains one subtitle (Subtitle C of Title XVI) that specifically address cyber matters including cybersecurity for industrial control systems (ICS).

Subtitle C

Part 1 of Subtitle C deals with general cyber matters. The sections include:

§ 1621. Policy of the United States on cyberspace, cybersecurity, cyber warfare,

and cyber deterrence.

§1622. Affirming the authority of the Secretary of Defense to conduct military

activities and operations in cyberspace.

§1623. Active defense and surveillance against Russian Federation attacks

in cyberspace.

§1624. Reorganization and consolidation of certain cyber provisions.

§1625. Designation of official for matters relating to integrating cybersecurity and industrial control systems within the Department of Defense.

§1626. Assistance for small manufacturers in the defense industrial supply chain on matters relating to cybersecurity.

§1627. Modification of acquisition authority of the Commander of the United States Cyber Command.

§1628. Email and Internet website security and authentication.

§1629. Matters pertaining to the Sharkseer cybersecurity program.

§1630. Pilot program on modeling and simulation in support of military homeland defense operations in connection with cyber attacks on critical infrastructure.

§1631. Security product integration framework.

§1632. Report on enhancement of software security for critical systems.

§1633. Comply to connect and cybersecurity scorecard.

§1634. Cyberspace Solarium Commission.

§1635. Program to establish cyber institutes at institutions of higher learning.

§1636. Establishment of Cybersecurity for Defense Industrial Base Manufacturing

Part II of Subtitle C deals with the mitigation of risks posed by providers of information technology with obligations to foreign governments. This part uses an unusual definition of ‘information technology’ from 40 USC 11101 that specifically includes “imaging peripherals, input, output, and storage devices necessary for security and surveillance” {§11101(6)(B)}. The part also specifically refers to ‘industrial control system’ without providing a definition of the term.

The sections in Part II include:

§1637. Definitions.

§1638. Identification of countries of concern regarding cybersecurity.

§1639. Mitigation of risks to national security posed by providers of information technology products and services who have obligations to foreign governments.

§1640. Establishment of registry of disclosures.

ICS Cybersecurity

Section 1625 (on pgs 731-2) requires DOD to designate one official “to be responsible for matters relating to integrating cybersecurity and industrial control systems within the Department of Defense” {§1625(a)}. That official would be responsible for all ICS cybersecurity matters for all levels of command down to the “facility using industrial control systems, including developing Department-wide certification standards for integration of industrial control systems” {§1625(b)}.

Section l636 (on pgs 769-70) requires DOD “establish an activity to assess and strengthen the cybersecurity resiliency of the defense industrial base of the United States” {§1636(a)(1)}. It would be known as the ‘Cybersecurity for Defense Industrial Base Manufacturing Activity’. The purpose of the Activity would be “to explore ways to increase the

 cybersecurity resilience of the defense industrial supply chain” {§1636(b)} to include:

• Developing cybersecurity test capabilities to support identifying and reducing security vulnerabilities in defense industrial base manufacturing processes.

• Developing in-person and online training to help small defense industrial base manufacturers improve their cybersecurity.

• Ensuring that cybersecurity for defense industrial base manufacturing is included in Department of Defense research and development roadmaps and threat assessments.

• Aggregating, developing, and disseminating capabilities to address cybersecurity threats that can be provided to and adopted by defense industrial base manufacturers of all sizes.

The definition of ‘security vulnerability’ used by this section relies on the ICS-inclusive definition of ‘information system’ found in 6 USC 1501.

Foreign Government Influence

Section 1638 would require DOD to produce a “prioritized list of countries of concern regarding cybersecurity" {§1638(a)} based upon:

• A foreign government’s engagement in acts of violence against personnel of the United States or coalition forces.

• A foreign government’s willingness and record of providing financing, logistics, training or intelligence to other persons, countries or entities posing a force protection or cybersecurity risk to the personnel, financial systems, critical infrastructure, or information systems of the United States or coalition forces.

• A foreign government’s engagement in foreign intelligence activities against the United States.

• A foreign government’s direct or indirect participation in transnational organized crime or criminal activity.

• A foreign government’s ability and intent to conduct operations to affect the supply chain of the United States Government.

Section 1639 would prohibit DOD from using any “product, service, or system relating to information or operational technology, cybersecurity, an industrial control system, a weapons system, or computer antivirus” {§1639(a)} unless the provider discloses whether the provider has allowed:

A foreign government to review or access the code of a product, system, or service custom-developed for the Department, or is under any obligation to allow a foreign person or government to review or access the code of a product, system, or service custom-developed for the Department as a condition of entering into an agreement for sale or other transaction with a foreign government or with a foreign person on behalf of such a government.

A foreign government listed in section 1638(a) to review or access the source code of a product, system, or service that the Department is using or intends to use, or is under any obligation to allow a foreign person or government to review or access the source code of a product, system, or service that the Department is using or intends to use as a condition of entering into an agreement for sale or other transaction with a foreign government or with a foreign person on behalf of such a government.

DOD would have to evaluate if any of the disclosure required above would reveal “a risk to the national security infrastructure or data of the United States, or any national security system under the control of the Department” {§1636(c)(1)}. If such a risk were present DOD would be required to determine what actions would be necessary to mitigate such risks.

Moving Forward

This bill will not be considered on the floor of the Senate. It was offered as amendment SA 2282 as substitute language to HR 5515 that is currently being considered in the Senate. The S 2987 language was adopted in Committee by a strongly bipartisan vote of 25 to 2. This means that the base language will be relatively easy to bring to the floor of the Senate. In fact, the first cloture vote on HR 5515 was agreed to on a vote of 92 to 4 on Thursday. The Senate will begin actual consideration of HR 5515 on Monday.