More on Amendments to HR 624

Yesterday I noted that there had been a modification made to the amendment offered by Rep. Sanchez (D,CA), but from the information available at the time it was not clear what that amendment was. The Congressional Record for yesterday provides the expected details:

Insert ‘‘Security’’ after ‘‘Homeland’’ in the second instruction.

Two pages earlier in the Congressional Record (same link as above) there is also a notice that a 13^th Amendment had been added to the Rule for the consideration of HR 624. This new amendment, submitted by Chairman McCaul (Homeland Security) would make DHS and the Justice Department the action agencies for receiving shared information by amending §1104(b)(1)(A)(ii) and §1104(b)(1)(A)(ii) by replacing the words “Federal Government” with “entities of the Department of Homeland Security and the Department of Justice designated under paragraphs (1) and (2) of section 2(b) of the Cyber Intelligence Sharing and Protection Act”. This amendment also passed in a voice vote of 409 – 5.

This last change was made to mollify some of the critics of the bill that were afraid that NSA and the military would become the action agencies for receiving this information. It is not clear at this point if this change would overcome President Obama’s intention to veto the bill.

The bill will now move to the Senate where, if it is actually brought to the floor of the Senate by Sen. Reid (D,NV), there is a good chance that a similar bipartisan vote would send the bill to the President.

HR 624 Passes As Amended in House

Today the House passed HR 624, CISPA, by a largely bipartisan vote of 288 – 127 after passing a number of amendments to the bill. About half of the Democrats in the House voted in favor of the bill. It looks like all of the amendments considered yesterday and today were adopted by nearly unanimous votes. One amendment, #8 from Rep. Sanchez (D,CA), was modified in some manner, we won’t know specifically how until the Congressional Record is printed tomorrow.

House Rules Committee Adopts Rules for Debate on HR 624

This evening the House Rules Committee adopted H. Res 164, a structured rule for the consideration of HR 624, Cyber Intelligence Sharing and Protection Act (CISPA). The rule provides for limited debate and the consideration of 12 amendments. The Majority Leader’s web site says that the debate on HR 624 will begin tomorrow afternoon and continue through Thursday with a vote no later than 3:00 pm EDT.

The Committee considered over forty amendments that were submitted by various House members and pared it down to 12. Nothing in the bill or its proposed amendments specifically addresses control system security issues.

I expect that most of the cleared amendments will pass and the amended bill will almost certainly pass of a somewhat bipartisan vote. Whether the offered amendments will change the bill sufficiently to avoid a threatened Presidential veto remains to be seen. The point is almost moot because I doubt that the bill will make it to the floor of the Senate, the next required stop on the road to the President’s desk.

HR 624 Reported in House

Yesterday the House Intelligence Committee reported HR 624, the Cyber Intelligence Sharing and Protection Act, as amended. The report is not yet available from the Government Printing Office (GPO). This formality is a prerequisite to this week’s consideration of this bill by the House.

BTW: The reports for HR 756, Cybersecurity Enhancement Act of 2013 (H Rept 113-33), and HR 967, Advancing America's Networking and Information Technology Research and Development Act of 2013 (H Rept 113-34), are now available from the GPO. There is no new information in either report. Both bills will be considered today under suspension of the rules.

HR 624 Amended and Recommend in House Intel Committee

Yesterday the House Intelligence Committee held a mark-up hearing on HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA). After 10 amendments were considered the bill was adopted on a bipartisan 17-2 vote. Six of the amendments were adopted by voice votes; the remaining amendments were defeated in identical 4-16 votes.

As expected all of the amendments were relatively minor tweaks to the language of the bill attempting to address privacy concerns with the information sharing provisions of the bill. Nothing was added (or attempted to be added) to the bill that would address control system security issues; this remains a pretty purely information technology security measure.

The bill will move to the floor of the House probably next week. There will almost certainly be an open rule for its consideration with a number of privacy amendments offered. The bill will, as it did last session, pass with a substantial bipartisan majority.  And just as likely, it will not be taken up by the Senate.

CISPA Hearing Scheduled – 04-10-13

The House Intelligence Committee web site now says that there will be a markup hearing on HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA), on Wednesday on April 10^th. A second page notes that the hearing will be open but it will be held in a House meeting room (HVC-304) that is normally used for closed meetings. I haven’t been there, but I would assume that this means that public seating will be limited. There is no word on either page about whether or not the hearing will be televised or web cast.

New CISPA Bill Identical to Version Passed in House

As I promised, since the GPO was finally able to make a copy of HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA), available yesterday, I have done a detailed review of the bill and it is virtually identical (two small, inconsequential wording changes) to the version of HR 3523 that was passed in the House last session, including the privacy provisions added during the House floor debate.

While this bill is being actively opposed by privacy advocates with a zeal that approaches paranoia, I really don’t see their concern. The bill has been watered down to the point where there are really no requirements to share information with the federal government about cyber-attacks and no real authority for the federal government to share information with the private sector.

This bill will make its way back to the floor of the House and will pass once again. The Senate will ignore the bill and we will be left with the information sharing provisions of the President’s EO without any legal protections to actually allow the information sharing to really proceed.

Cybersecurity Week Update II

The witness list for today’s Iranian Cybersecurity Threat hearing is not available as is a list of proposed amendments to HR 3523.

Iranian Cybersecurity Threat

Today’s hearing about the ‘growing’ Iranian cybersecurity threat has some distinguished witnesses, but as with yesterday’s hearing, none are currently in the intelligence community. We should get some interesting theoretical and political insights into the potential for Iranian attacks on critical infrastructure cyber-systems (maybe even control systems, ala retaliation for Stuxnet), but there will be no hard information about specific or credible threats that anyone will be willing or able to act upon.

The witness include:

• Mr. Frank J. Cilluffo; Associate Vice President and Director; Homeland Security Policy Institute; The George Washington University

• Mr. Ilan Berman; Vice President; American Foreign Policy Council; and

• Mr. Roger Caslow; Executive Cyberconsultant; Suss Consulting

HR 3523 Amendments

Last night was the close of acceptance of amendments that might be considered later this week during the floor action on HR 3523, CISPA. The Rules Committee web page for the bill contains a brief summary of over 40 amendments that they will review in this afternoons hearing. Depending on the type of rule they decide upon, all or some (more likely about 10) of these amendments could come to the floor for their 10 minutes of debate.

Without being able to read the actual amendments (and those are not currently available) we only have the summaries to divine what will be included, but it doesn’t look like anyone is concerned with control system security. There is a nice spread of practical to ideological amendments for the Committee to consider.

Rep. Thompson (D,MS; Ranking Member of the Homeland Security Committee) has three amendments offered; including the expected privacy issue amendment that will probably be included in the short list going to the floor. Another of his amendments  may be of more practical effect:

“Would authorize existing activities of the Department of Homeland Security for securing Federal networks and supporting private sector cybersecurity efforts. Would also put in place a framework by which the Secretary would determine which infrastructure sectors are critical to our Nation, conduct risk assessments of those sectors, develop and disseminate best practices for mitigating cybersecurity risks, and work with existing regulatory agencies of critical infrastructure to incorporate best practices into existing regulations, where necessary.”

Depending on the wording of the actual amendment this could result in some interesting regulatory changes, particularly in MTSA and CFATS regulations where DHS would have the most control.

HR 3523 Reported in House

Yesterday the House Committee on Intelligence submitted their report on HR 3523, the Cyber Intelligence Sharing and Protection Act (CISPA) of 2011. The publication of HRept 112-445 cleared the bill for action on the floor of the House. It is not clear that the Republican leadership intends to bring this bill to the floor in its current form, particularly since it has attracted so much adverse attention from privacy and internet access activists. And President Obama’s recent concerns about the bill mark a move away from the bipartisan support that had been expressed earlier.

I haven’t had a chance to read the report yet. I’ll get to it tonight and see if there is anything interesting or unusual that isn’t covered in the actual language of the bill.