S 3905 Introduced – FY 2021 Intel Authorization

Last week Sen Rubio (R,FL) introduced S 3905, the Intelligence Authorization Act for Fiscal Year 2021. This ‘must pass’ bill would set priorities, funding and authorization for the intelligence community. There are no specific cybersecurity measures in the bill, but there is a requirement for reports about the Cyberspace Solarium Commission Report.

Reporting on Commission’s Recommendations

Section 504 of the bill would establish reporting requirements for various federal agencies about the recommendations made by the Cyberspace Solarium Commission. The Commission was charged by the §1652 of the 2019 NDAA (PL 115-232) to make recommendations for opportunities for the private and public sectors to implement critical changes that could harden United States defenses against cyber-attacks. The five federal agencies included in the reporting requirement are {§504(c)}:

• Office of the Director of National Intelligence,

• Department of Homeland Security (Under Secretary of Homeland Security for Intelligence and Analysis),

• Department of Energy (Director of Intelligence and Counterintelligence),

• Department of Commerce, and

• Department of Defense

The reports, required within 180 days of the adoption of the bill, would be required to include {§504(d)}:

• An evaluation of the recommendations in the report described in subsection (b) that pertain to the agency, and

• A description of the actions taken, or the actions that the head of the agency expects to take, to implement any of the recommendations included in such report.

Moving Forward

Rubio is currently the Acting Chair of the Senate Select Committee on Intelligence. The bill was ordered reported by the Committee (without report) on June 8^th, 2020. This bill will be taken up by the full Senate at some point in time and it (or some other version of it) will be amended and ultimately passed by the Senate and the House. That ‘some other version’ caveat has become increasingly necessary for this ‘must pass’ legislation in the last couple of years. Some version of the FY 2021 Intel Authorization Act will ultimately reach the President’s desk.

Commentary

I have not discussed the Cyberspace Solarium Commission Report, mainly because the recommendations are too vague to mean anything besides a call to action. That is why the staff of the Senate Select Committee on Intelligence included §504 in the bill. Unfortunately, they missed an important requirement, making recommendations to Congress on what congressional action would be required to fully implement the Commission’s proposals. A third sub-paragraph needs to be added to §504(d):

“(3) A list of congressional actions that would need to be taken to allow the full implementation of the Commission’s recommendations for the agency.”