CRS Reports – Week of 2-1-25 – DOGE

This week the Congressional Research Service (CRS) published a report on “Department of Government Efficiency (DOGE) Executive Order: Early Implementation”. It provides a well anotated brief background of the history of the US Digital Service (USDS) formed under President Obama that President Trump has used as the legal framework for the operations of the DOGE. It discusses the three Executive Orders that direct how DOGE will operate and what the organizational objectives are.

There is not a great deal of information on the first two weeks of operation of DOGE, but it does provide a series of questions that Congress would probably want answered about the new agency.

A brief reminder, the CRS serves as a research agency designed to provide background information to members of Congress and their staffs to better inform congressional legislative and oversight efforts.

CRS Reports – Week of 10-19-24 – Typhoon Hacks

This week the Congressional Research Service (CRS) published a report on “Salt Typhoon Hacks of Telecommunications Companies and Federal Response Implications”. This report does not address the tools, techniques and tactics used by the apparently Chinese hacking groups behind the Volt, Flax, and Salt Typhoon attacks on communications sector target. Rather it briefly looks at the federal response to those attacks and then provides a discussion about activities that Congress might wish to consider to address the recent/current attacks and make future such attacks more difficult.

Specifically, it looks at issues related to:

• The Cyber Unified Coordination Group (Cyber UCG) that is (apparently) currently looking at the attacks,

• The Cyber Safety Review Board that has looked at similar large-scale attacks, and

• The cyber preparedness activities that CISA is supposed to undertake to prevent, protect, respond, and recover from such threats.

The first two activities are not specifically authorized (or funded) by Congress, but the report notes that Congress may wish to take actions to rectify that lack of official status.

CRS Reports – Week of 9-28-24 – Hurricane Rapid Intensification

This week the Congressional Research Service (CRS) published a report on “Hurricane Rapid Intensification: In Brief”. This report provides a brief introduction to the topic of apparent increase in the number of instances of rapid intensification of hurricanes as they approach coastal communities. In light of the recent hurricane Helene, this topic may be of increasing interest in the waning days of the 118^th Congress.

This report covers three major topics:

• Forecasting tropical cyclone intensity,

• Tropical cyclone intensities in the recent past, and

• Potential tropical cyclone intensities in the future.

The report concludes with four potential areas of consideration for Congress:

• How can federal agencies, such as NOAA, improve the public’s understanding and response to tropical cyclone watches and warnings, especially in cases where it is unclear whether a storm may rapidly intensify?

• Should federal support of coastal state, local, tribal, and territorial long-term planning, response, and building code adoption and enforcement change if RI is observed or projected to occur more frequently along the coast? If so, how?

• Evacuation orders are issued at the local level—what federal data and information would be most useful, and in what timeframe, to emergency managers deciding whether to issue a voluntary or mandatory evacuation with a tropical cyclone that may rapidly intensify right before landfall?

• What, if any, changes can be made to evacuation and shelter procedures and planning to account for increased tropical storm intensity by emergency managers and individuals, particularly those that may face particular risk during an intense tropical cyclone (e.g., individuals with disabilities, elderly individuals, children)? 

With the Republicans in control of the House (at least) through the end of the year, there is little likelihood that any effective legislation on this topic will move forward, since it would appear that the increased incidences of rapid intensification are related to climate change. What happens in the 119^th Congress will depend on what happens on November 5^th.

CRS Reports – Week of 9-14-24 – Counter Space Operations

This week the Congressional Research Service (CRS) published a report on “U.S. Counterspace Capabilities”. It provides a high-level overview of the topic, including providing a link to a 2021 Air Force Doctrine paper on the topic. It notes that while current treaty prohibitions prevent deployment of weapons in outer space, Space Force is “advocating for counterspace and SDA [space domain awareness] funding, as well as ways to increase space launches to support deployment of such capabilities.”

It concludes with an interesting discussion of considerations for Congress.

Congressional Reports – Week of 8-31-24 – DOD Counter UAS & NDAA

This week the Congressional Research Service (CRS) published a report on “FY2025 NDAA: Countering Uncrewed Aircraft Systems”. The report provides a brief overview of provisions in the House and Senate versions of the National Defense Authorization Act (NDAA) for FY 2025 and their related Committee Report requirements. With some very specific exceptions, DOD’s counter UAS (cUAS) authority is mainly restricted to combat zone outside of the United States.

CRS Reports – Week of 8-3-24 – Small Business Cybersecurity

This week the Congressional Research Service published a report on “The Cybersecurity for Small Business Pilot Program”. This program was started in 2022 and was designed to provide grants to States to help deliver cybersecurity assistance to nascent and start-up business owners. It has distributed $9 million in grant fund to date. An additional $3 million in grants is slated to be issued later this year.

This report looks at the history of the program and briefly lists other federal programs to help small businesses with cybersecurity issues. It concludes with an ‘issues for Congress’ section that looks at options available to Congress to continue, modify, or redirect the program.

CRS Reports – Week of 7-20-24 – CrowdStrike

This week, the Congressional Research Service (CRS) published two reports dealing with the July 19^th, CrowdStrike outage. The two reports are:

IT Outage from CrowdStrike’s Update: Impacts to Certain Public Safety Systems and Considerations for Congress, and

IT Disruptions from CrowdStrike’s Update: Frequently Asked Questions

One major question that was not asked: How did the incident affect operational technology and cyber-physical systems?

 

For a more detailed discussion about the reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/crs-reports-week-of-7-20-24-crowdstrike - subscription required.

CRS Reports – Week of 7-13-24 – Automotive Right-to-Repair

This week the Congressional Research Service (CRS) published a report on “Access to Motor Vehicle Software and Data”. This report is a relatively lengthy discussion of the issues related to the ownership and use of data produced by and stored in modern motor vehicles. It includes an analysis of HR 906 (has not been covered here), the Right to Equitable and Professional Auto Industry Repair (REPAIR) Act, which addresses those issues.

Sections of the report addresses: 

• Motor Vehicle and Aftermarket Industries,

• Software-Defined Vehicles (SDVs),

• Potential Direct OEM-Consumer Relationship and Bypass of Dealers,

• Executive Branch Oversight of Aftermarket,

• Copyright Laws Related to the SDV Aftermarket,

• State Laws and Reactions: 2012-2024, and

• Options for Congress

In the discussion about copyright laws (particularly 17 USC §1201), there is a detailed (and thoroughly footnoted) review of the proposed extension of the Library of Congress’ current exemption “{§1201(a)(1)} allowing a person may circumvent access controls on computer programs when doing so is a necessary step for diagnosing, maintaining, or repairing a motorized land vehicle, such as a personal automobile or commercial vehicle. The current exemption expires on October 27^th, 2024.

CRS Reports – Week of 6-22-24 – Use of Force in Cyberspace

This last week, the Congressional Research Service (CRS) published an updated version of their report “Use of Force in Cyberspace”. I last discussed this report in December 2023. There have been a number of small changes to the language of the report (adding the abbreviation ‘LOAC’ for the term ‘law of armed conflict’ used throughout the report). The changes do not make any significant change to the author’s points about how cyber operations fit into the concept of LOAC. Still, this short, 2-page report is one that periodically needs to be reviewed by Congress and the Executive Branch, as well as anyone concerned about cyberphysical operations by State actors.

CRS Reports – Week of 6-8-24 – Reading Spending Bills

This week the Congressional Research Service published a report on “Understanding the Contents of an Appropriations Bill”. As we begin the appropriations process in earnest (in the House at least) this infographic provides a one-page introduction into what the formulistic contents of a spending bill mean. The CRS also provides a page that tracks the spending bill process for FY 2025.

CRS Reports – Week of 6-1-24 – Trump Conviction Implications

This week the Congressional Research Service (CRS) published a report on “Federal Legal Implications of Former President Donald Trump’s Conviction in New York State Court: Frequently Asked Questions”. Regardless of where you stand on the political spectrum, the reality is that Donald Trump has, once again, done something that no other politician of his standing has done. Understanding the legal implications of his conviction will be important going forward.

This report addresses the following frequently asked questions:

• Can former President Trump be a candidate for President as a convicted felon?

• Can former President Trump serve as President if he is incarcerated as of Inauguration Day?

• Could the Supreme Court’s pending decision on presidential immunity in Trump v. United States impact the New York conviction?

• Could former President Trump be pardoned, or pardon himself if reelected, for the state conviction?

• Is former President Trump still entitled to Secret Service protection as a convicted felon?

• Can former President Trump, as a convicted felon, vote in the 2024 federal elections?

• Are there any other criminal cases pending against former President Trump?

There is an interesting omission in the report. While these responses seem to reflect current statutes (remember, I am not a lawyer) this is a historically unique situation. There are likely to be a number of court cases designed to question or limit actions on a number of these topics. The law is not settled until it has been adjudicated in court.

CRS Reports – Week of 5-18-24 – Botnet Takedowns

This week the Congressional Research Service (CRS) published a report on “Disrupting Botnets: An Overview of Seizure Warrants and Other Legal Tools”. The introduction notes that “this Legal Sidebar provides an overview of several legal authorities relevant to combatting botnets, focusing primarily on search and seizure warrants under the Federal Rules of Criminal Procedure and also discussing legal authorities governing stored communications, pen-trap devices, and injunctive relief against fraud.”

It also discusses a number of other legal tools that can be used to disrupt botnets, including:

• Asset forfeiture,

• Injunctive relief,

• Stored Communications Act,

• Pen-trap devices, and

• Private actions.

The second paragraph of the report starts by reminding readers of the purpose of the CRS, by noting that:

“Botnets may be of interest to Congress in light of the dangers they pose, and Congress may have several options at its disposal to remediate them.”

The report concludes by discussing the actions that Congress could take to “modify or supplant one or more of the legal authorities currently employed by federal law enforcement to disrupt botnets.” It then goes on to discuss two bills introduced in the last congress:

S 2139 – the International Cyber­crime Prevention Act and

S 1245 – the Combating Chinese Purloining of Trade Secrets Act

No action was taken on either bill.

CRS Reports – Week of 4-27-24 – FY 2024 DHS Spending

This week the Congressional Research Service (CRS) published a report on “Comparing DHS Component Funding, FY2024: In Brief”. This report provides a high-level overview of the FY 2024 spending for the component agencies of the Department of Homeland Security, with some comparison to FY 2023 spending.

Information at this level is mainly of interest to policy wonks. There is one interesting graphic in the report though (pg 11, see below). It shows the comparative budgetary authority of DHS components discussed in the report. The agency with the smallest funding is CISA.

CRS Reports – Week of 4-20-24 – Change Healthcare Attack

This week, the Congressional Research Service (CRS) published a report on “The Change Healthcare Cyberattack and Response Considerations for Policymakers”. After providing a brief overview of the ransomware attack on Change Healthcare and a discussion about the consequences and federal response to the incident, the report identifies three ‘information parity issues’:

• Coordination of offensive and defensive actions,

• Knowledge of conditions in decision making, and

• Information Sharing Reach.

Presumably, given the mission of the CRS, these issues were identified to aid Congress in any response development efforts that members may be interested in initiating.

CRS Reports – Week of 4-13-24 – Congressional Disapproval

This week, the Congressional Research Service (CRS) published a report on “The Congressional Review Act: Defining a “Rule” and Overturning a Rule an Agency Did Not Submit to Congress”. The 118^th Congress has been fairly active in submitting and passing bills to overturn agency actions. This report outlines the processes under the Congressional Review Act (5 USC 801 thru 808) for overturing agency actions, specifically it discusses the process for congressional action in the small number of cases where the agency does not pre-submit a copy of a rule to Congress.

CRS Reports – Week of 3-23-24 – Key Bridge Collapse

This week the Congressional Research Service (CRS) published a report on “Baltimore Bridge Collapse: Frequently Asked Questions (FAQ)”. The report provides a brief factual look at the circumstances that surround the incident and its aftermath, but it does not directly address issues related to the cause of the accident.

The FAQ questions addressed include:

Who Owns and Controls the Ship?

How Do Ships Navigate Through Harbors?

How Will Port Traffic Be Affected?

How Will Road Traffic Be Affected?

Has Anything Like This Happened Before?

What Immediate Actions Can the Federal Government Take?

What Is the Federal Government’s Role in Rebuilding the Bridge?

Interestingly, there is no ‘Issues for Congress’ section in this report.

CRS Reports – Week of 3-9-24 – Change Healthcare

This week the Congressional Research Service (CRS) published a report on “The Change Healthcare Cyberattack and Response Considerations for Policymakers”. The report provides a brief look at the BlackCat ransomware attack on Change Healthcare and the wide spread consequences of that attack. It concludes by introducing a new term to cybersecurity considerations: ‘information parity’.

The author makes the point that following the FBI takedown of the BlackCat infrastructure, the ransomware organization re-grouped and encouraged its affiliates to attack hospitals and other healthcare organizations. While a number of hospitals were successfully attacked, the victim that caused the most disruption and political notice was the attack on Change Healthcare. Almost certainly, that disruption was because the immediate response to the attack was to shut down all cyber systems to stop the potential spread of the ransomware. As the report notes there is a similarity here to the attack on Colonial Pipeline: “Both attacks began with ransomware, led the victim to disconnect systems thereby causing operational disruptions, which resulted in physical consequences.” The physical consequences here were to interfere with the delivery of prescriptions to many people across the country.

In addition to a discussion about policy issued revealed by this attack, the report looks at three information parity (in this case government agencies having access to the same level of details about the situation in making agency decisions) problems raised by this incident:

• Coordination of offensive and defensive actions,

• Knowledge of conditions in decision making, and

• Information sharing reach.

CRS Reports – Week of 2-3-24 – Freight Rail Safety Legislation

This week the Congressional Research Service (CRS) updated a report on “Freight Rail Safety Legislation in the 118th Congress”. This report looks at legislation that has been introduced this session and the issues being addressed by that legislation.

The covered bills include:

• S 576)/H.R. 1674, Railway Safety Act of 2023

• HR 1633, Reducing Accidents In Locomotives (RAIL) Act of 2023

• HR 1238, Decreasing Emergency Railroad Accident Instances Locally (DERAIL) Act of 2023

• S 1044, Railway Accountability Act of 2023

• HR 1347, Don’t Block Our Communities (D-BLOC) Act of 2023

• HR 5871, Rail Worker and Community Safety Act of 2023

The following issues are discussed:

 •  Hazardous Materials Transportation by Rail:

⸰ High-Hazard Flammable Trains,

⸰ Tank Car Crashworthiness,

⸰ Train Braking, and

⸰ Emergency Response Training,

• Prevention of Train Derailments:

⸰ Wayside Defect Detectors,

⸰ Railcar Inspections and Inspector Qualifications,

⸰ Civil Penalties, and

⸰ Train Length,

• Other Issues and Legislative Proposals:

⸰ Blocked Crossings,

⸰ Crew Size, and

⸰ Confidential Close Call Reporting System.

CRS Reports – Week of 2-27-24 – Water System Cybersecurity

On last Monday, the Congressional Research Service (CRS) published a report on “Safe Drinking Water Act (SDWA) Cybersecurity Provisions”. It provides a brief look at the history of the SDWA and the provisions of that legislation (with subsequent amendments) that deal with cybersecurity issues for public drinking water systems. Interestingly, this report does not contain the frequently seen ‘Considerations for Congress’ section that discusses legislative issues that may face members in the near future.

CRS Reports – Week of 12-23-23 - Agency Nonacquiescence

This week the Congressional Research Service (CRS) published a report on “Agency Nonacquiescence: An Overview of Constitutional and Practical Considerations”. The report looks at the various ways that federal agencies have or may respond to adversarial judgments in Federal Courts. The report provides (pg 4) a hypothetical situation that provides a broad look at the scope of the issue:

“Imagine that a federal agency promulgates a new regulation that establishes a uniform process for adjudicating certain federal benefits. The U.S. Court of Appeals for the Eleventh Circuit, which has jurisdiction over three U.S. states, invalidates a benefits decision under that regulation, holding that the agency must use a different process. Now, the agency faces some choices: Should it avoid using its new adjudication process altogether, even in the other 47 states? Should it continue to use its new process in other states and defend that process in different courts? Can it apply that process to other benefits claimants in the Eleventh Circuit who may not have been a party to the original case?”

As always with a CRS report, it is important to remember that these reports are targeted at members of Congress with a view to informing potential congressional action. This report notes (pg 25):

“Congress has the authority to limit or bar agencies from engaging in nonacquiescence of any kind. Under its constitutional power to define the powers and authority of administrative agencies, Congress can define in what situations (if any) nonacquiescence is permissible. Agencies are “creatures of statutes,” and, accordingly, Congress retains the power to limit or prohibit agencies engaging in nonacquiescence regardless of the inapplicability of collateral estoppel [prevents a party from re-litigating an issue that was already decided in another legal action] to the federal government and regardless of the lack of intercircuit stare decisis [a legal principle that requires courts to follow previous judgments when resolving cases with similar facts] across the federal court system.”