Review - S 3758 Introduced – DETECT Act

Last month, Sen Warner (D,VA) introduced S 3758, the Drone Evaluation To Eliminate Cyber Threats (DETECT) Act. The bill would require NIST to establish guidelines for federal agencies for managing cybersecurity risks associated with unmanned aircraft systems (UAS) operated by those agencies. It would also require OMB to publish guidance for vulnerability disclosure programs (VDP) for security vulnerabilities relating to an unmanned aircraft system owned or controlled by an agency. No new funding is authorized by this legislation.

Moving Forward

While Warner is not a member of the Senate Commerce, Science, and Transportation Committee to which this bill was assigned for consideration, his sole cosponsor {Sen Thune (R,SD)} is a member. This means that there may be sufficient influence to see this bill considered in Committee. I see nothing in the bill that would engender any organized opposition. I suspect that it would receive substantial bipartisan support were the bill considered. Unfortunately, this bill is not politically important enough for it to be considered under regular order on the floor of the Senate. I do suspect that there would be possibly one or two Senators that would be expected to object to the bill being considered under the Senate’ unanimous consent process. That would mean that the provisions would have to be included in a larger, must-pass bill for them to become law.

Commentary

This bill has a problem with conflicting definitions that we have seen too often in cybersecurity language. To resolve this conflict dealing with the coverage of UAS control systems in the provisions of the bill I would propose to change the definition of the term ‘information systems’ in §2(4) to read:

“INFORMATION SYSTEM.—The term “information system” has the meaning given the term in section 3502 of title 44, United States Code 6 U.S.C. 650”

For more information on the provisions of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3758-introduced - subscription required.