HR 480 Introduced – DHS Threat Assessment

A bit over a week ago Rep. Rogers (R,AL) introduced HR 480, the Homeland Threat Assessment Act. The bill would require DHS to conduct an annual “assessment of the terrorist threat to the homeland” {§2(a)}.

The Assessment

The bill would require the annual assessment to include {§2(b)}:

• Empirical data assessing terrorist activities and incidents over time in the United States:

• An evaluation of current terrorist tactics, as well as ongoing and possible future changes in terrorist tactics;

• An assessment of criminal activity encountered or observed by officers or employees of components in the field which is suspected of financing terrorist activity;

• Detailed information on all individuals denied entry to or removed from the United States as a result of material support provided to a foreign terrorist organization;

• The efficacy and spread of foreign terrorist organization propaganda, messaging, or recruitment;

• An assessment of threats, including cyber threats, to the homeland, including to critical infrastructure and Federal civilian networks;

• An assessment of current and potential terrorism and criminal threats posed by individuals and organized groups seeking to unlawfully enter the United States; and

• An assessment of threats to the transportation sector, including surface and aviation transportation systems.

The bill would require the assessment to be presented to congress in a classified form with unclassified summaries and, potentially, unclassified annexes.

Moving Forward

Rogers is the Ranking Member of the House Homeland Security Committee and Rep. Thompson (D,MS), the single cosponsor, is the Chair. This means that this bill will almost certainly be considered in Committee in the not too distant future. There is nothing in the bill that would cause and serious opposition and it would almost certainly receive strong bipartisan support, both in Committee and on the Floor of the House.

Commentary

Now this bill is clearly about a ‘terrorist’ threat assessment, but the language in two of the sub-paragraphs in §2(b) very carefully do not contain the word ‘terrorist’ when all of the remaining sub-paragraphs do contain that word (or variations there on). This would lead me to suspect that Rogers (or the Committee Staff who actually crafted the legislation) intended the cybersecurity and transportation assessments to include threats other than just those posed by terrorists.

So far, the only terrorist cyber threat that we have seen in actual practice have been a variety of doxing attacks (publication of private personal information) against various members of the armed forces and their families. There is nothing that would stop various terrorist groups (or radicalized individuals) from conducting more serious cyber-attacks, but nation-state actors are currently much more of a cyberthreat than terrorists.

While the wording of this sub-paragraph {§2(b)(6)} does not specifically call for reporting on nation-state level cybersecurity threats, the wording is vague enough to invite DHS to do so. If that is actually the intent of the wording, it would appear that it was done with the intention of avoiding stepping on the toes of the House Intelligence Committee or specifically involving the US Cybercommand/NSA in the assessment (an action outside the purview of the Homeland Security Committee).

The intent of the similarly vague wording in §2(b)(8) regarding transportation threats is less clear until you think to include energy transportation (specifically gas and oil pipelines). There again we have seen indications of a potential nation-state level cyber-threat that the crafters of this bill might want to have included in this DHS threat assessment.