Committee Hearings – Week 5-20-24

This week, with both the House and Seante in session, there is a moderately heavy hearing schedule. The House is starting hearings on FY 2025 spending bills. The FY 2025 NDAA also gets a full committee hearing this week.

FY 2025 Spending Bills

	House
Mil Construction	Subcommittee
Legislative Branch	Subcommittee
Mil Construction	Full Committee

This is relatively early in the year to start marking up spending bills, but if there is any chance in getting any of these bills done before September 30^th, action is going to have to start now. Theoretically, these two are the least controversial bills. Probably the only matter of real contention between the House and Senate on these two bills will be the spending levels, with the House Republicans again poised to call for steep spending cuts (probably less steep on these two bills).

Commentary: It will be interesting to see if the House Republicans have the votes to pass a bill that will even come close to satisfying the fringe elements of the party. It is going to be a long summer.

FY 2025 NDAA

On Wednesday, the House Armed Forces Committee will hold their markup hearing for HR 8070, the Servicemember Quality of Life Improvement Act. This will also be the FY 2025 National Defense Authorization Act (NDAA). The hearing page provides links to the various subcommittee markups. Of interest here is the Subcommittee on Cyber, Information Technologies, and Innovation print. There are only two sections in that print that appears to be of specific interest here:

Section 221—Plan for Establishment of Secure Computing and Data Storage Environment for Testing of Artificial Intelligence Trained on Biological Data, and

Section 1511—Protective Measures for Mobile Devices within the Department of Defense

PIPES Act 2023 Markup – 12-6-23

This afternoon the House Transportation and Infrastructure Committee announced that they would hold a full Committee markup hear on Wednesday. Only three bills will be considered; of specific interest here will be HR 6494, the Promoting Innovation in Pipeline Efficiency and Safety (PIPES) Act of 2023. This bill is the periodic reauthorization of PHMSA’s pipeline safety program and regulations (PSR).

The GPO has not yet published the official version of the bill, but the today’s meeting notice includes a link to a committee print of the bill as well as an amendment in the nature of a substitute (ANS). I have not yet had a chance to do a detailed review of the two versions, but just looking at the Table of Contents for the two versions shows the same 32 section names in each, so any differences will be down in the weeds.

This is not quite a ‘must pass bill’, PHMSA’s pipeline program is not going to fold if this bill (or some version of an authorization bill) does not pass. But these PIPES bills provide a way for Congress to keep their collective thumbs on pipeline matters.

Interestingly, the other two bills (HR 6276 and HR 6278, both government-building management bills) have been the subject of a markup hearing on November 11^th, but consideration of the two bills was postponed at that time. This typically means that there are some significant disagreements about provisions of the bill that still need to be worked out. 

Committee Hearings – Week of 4-23-23

With both the House and Senate in Washington this week, we have a relatively normal hearing schedule, with budget issues predominating. There is one cybersecurity hearing of note.

BTW: Fourteen weeks left before the current authorization for the Chemical Security Anti-Terrorism Standards (CFATS) program runs out on July 27^th, 2023. No congressional hearings have been conducted or scheduled.

Cybersecurity

On Thursday, the Subcommittee on Cybersecurity and Infrastructure Protection of the House Homeland Security Committee will hold a hearing on: “CISA 2025: The State of American Cybersecurity from CISA’s Perspective”. The sole witness will be Jen Easterly, the CISA Director.

An interesting note from the Chair of that subcommittee, Rep Garbarino (R,NY): “However, as over 80 percent of critical infrastructure is privately owned and operated, it is crucial that CISA empowers and strengthens information sharing without becoming a bureaucratic regulatory agency [emphasis added] that undermines its vital relationship with the private sector. This Subcommittee looks forward to speaking with Director Easterly on ways we can increase our cyber resiliency and strengthen our nation’s risk advisor as it faces an increasingly complex cyber threat landscape.”

Commentary: The Homeland Security Committee web site continues to run on press releases rather than web pages. The “Committee Activity” web page does not list any committee hearings, past or future, the ‘Issues’ subpage provides listings of press releases on various topics. Under the ‘Cybersecurity’ topic is a link to the ‘Media Advisory’ about this week’s hearing. Granted, congressional committees are at heart political animals, but they usually play the game and make a show of providing the public with a view of their deliberative process. The Homeland Security Committee has completely given up on that aspect of ‘information sharing’.

On the Floor

The House schedule for this week does not include anything of particular interest here in this blog. Having said that, I have to comment on one of the two bills that will be considered under a rule this week, HR____, the Limit, Save, Grow Act of 2023. This is the ‘debt limit’ bill that was being discussed over the weekend on most of the weekly political talk shows. It is the Republican’s official solution to the pending debt limit crisis. Actually, it is a 320-page political agenda bill that only addresses the debt limit in the last three pages.

Okay, the Republicans legitimately campaigned in 2022 on cutting federal spending, and this bill certainly addresses their issues. Good for them. They added their energy initiatives from HR 1 that was passed in the House last month, but will never be considered in the Senate. Again, this type of topic piling on in legislative ‘must pass’ bills has become a common ploy used by both parties. But the Republicans did promise to stop that practice….

Looking at the House Rules Committee web page for the consideration of this measure, there was no attempt to solicit amendments to this bill when its consideration was announced on Friday. And there are no amendments listed as having been submitted. So, the Republicans are going to bring their premier spending limitation bill to the floor of the House for consideration without allowing amendments to be offered or considered. So much for their vaunted efforts to make the legislative process more open for individual members.

The Republican leadership can talk the talk, but they cannot walk the walk. Granted McCarthy had to do some serious political tight walking and finger-crossed bargaining to get the Speakership. And he is going to have problems holding his very loose coalition together to get this passed. Adding an amendment process to the consideration of this bill would probably make that more difficult. But, if he is going to take the easy way out for reasons of political expediency, is he really changing the political process? Of course not. He and his ‘team’ are just continuing the decline of cooperative House politics that we have been watching over the last two decades.

And the House Republicans wonder why Biden is not willing to negotiate with them.

Committee Hearings – Week of 3-19-23

This week with both the House and Senate in Washington (House with a short week) there is a relatively full slate of hearings scheduled with budget hearings in full swing. There are five other hearings of potential interest here covering cybersecurity (3), Ohio derailment, and science and tech in DOD.

Budget Hearings  

Budget Hearings	House	Senate
FY 2024 Budget Request	Budget Committee
DOD	DOD Subcommittee
DOE	EWR Subcommittee
EPA		Environment Committee
DOT		THUD Subcommittee

‘Subcommittee’ hearings are for subcommittees of the respective Appropriations Committees.

Cybersecurity

On Thursday, the Senate Energy and Natural Resources Committee will hold a hearing to “Examine Cybersecurity Vulnerabilities to the United States' Energy Infrastructure”. The witness list includes:

• Puesh M. Kumar, CESER, DOE,

• Robert M. Lee, Dragos,

• Stephen L. Swick, American Electric Power

On Thursday, the Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will hold a hearing on “CISA 2025: The State of American Cybersecurity from a Stakeholder Perspective”. A witness list is not currently available.

On Thursday, the Cybersecurity, Information Technology, and Government Subcommittee of the House Oversight and Accountability Committee will hold a hearing on “Unpacking the White House National Cybersecurity Strategy”. A witness list is not currently available.

Ohio Derailment

On Wednesday, the Senate Commerce, Science and Technology Committee will hold a hearing on “Improving Rail Safety in Response to the East Palestine Derailment”. The witness list will include:

• Jennifer Homendy, National Transportation Safety Board

• David Comstock, Ohio Western Reserve Joint Fire District

• Clyde Whitaker, Ohio State SMART-TD

• Alan Shaw, Norfolk Southern

• Ian Jefferies, Association of American Railroads

DOD Tech

On Thursday, the Cyber, Information Technologies, and Innovation Subcommittee of the Senate Armed Forces Committee will hold a hearing on “Science, Technology, and Innovation at the Department of Defense”. The witness list includes:

• Heidi Shyu, DOD,

• William LaPlante, DOD

Committee Hearings – Week of 9-18-22

 

With both the House and Senate in Washington this week, we have a fairly light hearing schedule. This reflects a lot of behind-the-scenes meetings on a continuing resolution and other end-of-session priorities. There will be two hearing of peripheral interest here: federal building security and right-to-repair jurisdiction.

Building Security

On Thursday, the Subcommittee on Oversight, Management, & Accountability of the House Homeland Security Committee will hold a hearing on “Federal Building Security: Examining the Risk Assessment Process”. The witness list includes:

• Richard “Kris” Cline, Federal Protective Service,

• Scott Breor, CISA,

• Catina Latham, GAO

Should be an interesting (if probably abbreviated) look at the physical security risk assessment process.

Right-to-Repair

On Wednesday, the Subcommittee on Legislative and Budget Process of the House Rules Committee will hold an original jurisdiction hearing on “Right to Repair: Legislative and Budgetary Solutions to Unfair Restrictions on Repair”. No witness list is provided at this time.

As I mentioned last week, there are a variety of congressional jurisdictional issues that must be addressed before any legislative work can move forward. This hearing is part of that determination process.

Congressional Hearings – Week of 1-26-20

With the House back from their MLK break and the Senate still sitting in their impeachment proceeding there are a limited number of committee hearings this week. There is one markup hearing of interest by the House Homeland Security Committee.

Markup Hearing

On Wednesday the House Homeland Security Committee will hold a markup hearing. The bills to be reviewed include HR 5667, the Cybersecurity Vulnerability Identification and Notification Act of 2019. This bill was introduced last Friday, and the official version has yet to be printed. I have briefly reviewed the committee print and it looks to be similar to S 3045 but there are some interesting definitions related to operational technology that I look forward to reviewing in depth.

Homeland Security Mark-up Hearing – 09-13-18

This morning the House Homeland Security Committee announced that it would be conducting a mark-up hearing for five pieces of legislation including:

• H.R 6620, Protecting Critical Infrastructure Against Drones and Emerging Threats Act;

• HR 6735, To direct the Secretary of Homeland Security to establish a vulnerability disclosure policy for Department of Homeland Security internet websites, and for other purposes; and

• S 1281, Hack the Department of Homeland Security Act of 2017

The official copy of HR 6620 just recently became available and I have just glanced through it at this point; hopefully I’ll get a chance to review it here before Thursday. The quick glance that I have done indicates that this is a ‘collect information and report to Congress’ type of bill, rather than something that will authorized any sort of action similar to S 2836.

The official copy of HR 6735 is not yet available, but a Committee Print is. There is not much in this bill of specific interest to readers of this blog beyond the fact that it uses the definition of ‘security vulnerability’ from 6 USC 1501 which is, in turn, based upon the ICS-inclusive definition of information system while the bill uses the IT-restrictive definition of ‘information system’ from 44 USC 3502.

Committee Hearings – Week of 09-09-18

In a much abbreviated week with both the House and Senate in Washington, there will only be a limited number of committee hearings. There will be two of potential interest to readers of this blog; one dealing with the national threat landscape (including cyber) and the other a look at the status of the implementation of positive train control (PTC) systems.

Threat Landscape

On Thursday the Senate Homeland Security and Governmental Affairs Committee will be holding a hearing looking at “Evolving Threats to the Homeland”. The witness list includes:

• Kevin Mandia, FireEye, Inc.;

• Cathy Lanier, National Football League;

• Scott McBride, Idaho National Laboratory; and

• Jennifer Bisceglie, lnteros Solutions, Inc.

It certainly looks like cybersecurity will be an issue at this hearing, just not the only one.

PTC Update

On Thursday the House Transportation and Infrastructure Committee will hold a hearing on “The State of Positive Train Control Implementation in the United States”. The witness list includes:

• Ronald L. Batory, Federal Railroad Administration;
• Robert Sumwalt, National Transportation Safety Board;

• Susan A. Fleming, Government Accountability Office;
• Scot Naparstek, Amtrak;
• Edward Hamberger, Association of American Railroads;
• Jeffrey D. Knueppel, Southeastern Pennsylvania Transportation Authority;

• Stacey Mortensen, Altamont Corridor Express

This hearing could get contentious with the relatively poor performance of the passenger rail lines in complying with the PTC requirements. The Committee Staff has prepared a detailed background document on the PTC program.

On the Floor

It is looking increasingly likely that the House could take up the Conference Report on HR 5895, the EWR spending bill. The Conference Committee completed their work yesterday, but a copy of the report has not yet been issued. This bill is likely to be taken up in at least the House this week. This is the first of the three mini-bus bills that has made it out of conference; HR 6147 and HR 6157 still remain to be addressed.

There is at least one news report that claims only two of the three mini-busses will be approved before the end of the month, meaning that the expected 3-department continuing resolution would have to be expanded to 6 departments. The article does not name the bill that will not make it out of conference, but I suspect that it is HR 6157. The conflict between the House and Senate there was the inclusion of the Health and Human Services spending in with the DOD bill; just too many controversies in the House version of the HHS spending.

Committee Hearings – Week of 05-20-18

This week the House and Senate are trying to get things done before heading home for an extended Memorial Day weekend. The priority this week is continued work on ‘must pass’ legislation like spending bills and the National Defense Authorization Act (NDAA). We also have an IOT bill being marked up.

Spending Bills

• Tuesday – House – Full Committee - FY 2019 Interior and Environment Appropriations Bill;

• Tuesday – Senate – Subcommittee - FY2019 Agriculture Appropriations Bill;

• Tuesday – Senate – Subcommittee - Energy & Water Development Appropriations Bill; and

• Wednesday – House – Full Committee - FY 2019 Transportation, Housing and Urban Development Appropriations Bill;

2019 NDAA

As I mentioned this weekend, the House Rules Committee will take up HR 5515 today and tomorrow in preparation for floor votes this week. There are lots (564) of amendments and many will be controversial.

On the Senate side we see the start of the markup process on an unpublished bill. This bill will also see a number of amendments on the floor next month. Then we will have the behind the scenes work of the conference committee to work out a final bill that will eventually get to the President.

• Tuesday – Senate – Subcommittee on Cybersecurity.  CLOSED;

• Tuesday – Senate – Subcommittee on Emerging Threats.  CLOSED;

• Wednesday – Senate – Full Committee. CLOSED; and

• Thursday – Senate – Full Committee. CLOSED

IOT Bill

The Digital Commerce and Consumer Protection Subcommittee of the House Energy and Commerce Committee will hold a mark-up hearing on Tuesday on an original (not yet introduced) bill, the State of Modern Application, Research, and Trends of (SMART) IoT Act. The bill would require the Department of Commerce to conduct a study on the state of the internet-connected devices industry.

Committee Hearings – Week of 05-13-18

With both the House and Senate in session this week we see both bodies working on must complete issues; spending and the National Defense Authorization Act (NDAA). We will also see a markup hearing dealing with our ICS cybersecurity bill.

Spending Bills

The House Appropriations Committee is fully into the spending bill markup process. The Full Committee will mark-up the FY 2019 Energy and Water and Agriculture, Rural Development, Food and Drug Administration, and Related Agencies Appropriations Bill on Wednesday. Subcommittee mark-ups of possible interest here this week include:

• FY 2019 Interior, Environment, and Related Agencies Appropriations Bill – Tuesday; and

• FY 2019 Transportation, and Housing and Urban Development (THUD), and Related Agencies Appropriations Bill – Wednesday

The Senate Appropriations Committee subcommittees are still looking at the details of the respective budget requests, so they are a tad bit behind the House on the bill writing schedule. That is not a significant problem as the House has to consider spending bills before the Senate can act on them. The Appropriations Committee will have language ready by the time the House bills make it to the Senate even if they do not have their own bill introduced.

NDAA

The House Armed Services Committee finished their mark-ups of HR 5515 last week and ordered the bill reported to the House. I expect to see an official version of the bill published this week. The House Rules Committee has announced that it is accepting proposed amendments to the bill through Thursday morning. This means that it will probably be considered on the floor of the House next week.

The Senate Armed Services Committee is starting the mark-up process for their version of the NDAA (not yet introduced) this week with subcommittee mark-ups. The Subcommittees of potential interest here include:

• Subcommittee on Cybersecurity; and

• Subcommittee on Emerging Threats

Both will hold their mark-ups on Tuesday. Both will be closed hearings.

Cybersecurity Mark-Up

On Wednesday the House Homeland Security Committee will be holding a mark-up hearing to consider nine bills. HR 5733, the DHS Industrial Control Systems Capabilities Enhancement Act of 2018, is one of the bills being considered. No word yet on any possible amendments.

Committee Hearings – Week of 5-6-18

With both the House and Senate back in Washington after a week back in their districts/States the focus starts to get serious on FY 2019 spending bills. We also have two other hearings of potential interest to readers of this blog; the FY 2019 NDAA markup and a hearing on unmanned aircraft systems (UAS).

Spending Bills

The Senate Appropriations Committee is still looking at Trump’s budget requests. This week’s hearings of potential interest include:

• DHS – 5-8-18;

• DOD – 5-9-18;

The House Appropriations Committee is starting to markup actual spending bills. Mark-up hearings of potential interest include:

• Commerce, Science, and Justice – Subcommittee – 5-9-18;

FY 2019 NDAA

The House Armed Forces Committee will conduct a full committee markup of HR 5515, the FY 2019 National Defense Authorization Act on Wednesday. The week before last saw subcommittee markup completed. The Subcommittee on Emerging Threats and Capabilities added six sections to the bill concerning cybersecurity. They were:

• §1631—Amendments to Pilot Program Regarding Cyber Vulnerabilities of Department of Defense Critical Infrastructure

• §1632—Budget Display for Cyber Vulnerability Evaluations and Mitigation Activities for Major Weapon Systems of the Department of Defense

• §1633—Transfer of Responsibility for the Department of Defense Information Network to United States Cyber Command

• §1634—Pilot Program Authority to Enhance Cybersecurity and Resiliency of Critical Infrastructure

• §1635—Procedures and Reporting Requirement on Cybersecurity Breaches and Loss of Personally Identifiable Information

• §1636—Study and Report on Reserve Component Cyber Civil Support Teams

Section 1634 would allow DOD to detail up to 50 people per year to DHS to support cybersecurity operations of DHS (including NCCIC). Section 1636 would require a joint study to be conducted by DOD and DHS about establishing Reserve Component Cyber Civil Support Teams in each State.

UAS Hearing

On Tuesday the Senate Commerce, Science, and Transportation Committee will hold a hearing on “Keeping Pace with Innovation – Update on the Safe Integration of Unmanned Aircraft Systems into the Airspace”. The witness list includes:

• Earl Lawrence, Federal Aviation Administration;

• Brian Wynne, Association for Unmanned Vehicle Systems International;

• Matthew S. Zuccaro, Helicopter Association International;

• Todd Graetz, BNSF Railway Co.

I doubt that we will hear much of anything about protecting critical infrastructure from UAS based attacks on critical infrastructure, but I could be pleasantly surprised.

Committee Hearings – Week of 04-15-18

With both the House and Senate in session this week the budget process continues. We also have a confirmation hearing for the Coast Guard Commandant.

FY 2019 Budget

These are budget hearings, so they will not delve into policy matters in any great depth. We may see brief mentions of cybersecurity in either (or both) of these hearings.

4-17-18 House – Energy and Commerce Committee  - Oversight of the Federal Energy Regulatory Commission and the FY2019 Budget

4-17-18 House – Homeland Security Subcommittee - FY 2019 Budget - United States Coast Guard

Commandant Confirmation

On Thursday the Senate Commerce, Science, and Transportation Committee will hold a confirmation hearing on promoting Vice Admiral Karl L. Schultz to Admiral and Commandant of the Coast Guard.

We may hear mention of chemical transportation safety and security issues, but it would be in passing on a high-level policy discussion. Schultz will be in favor of safety and security; detials will come later.

Committee Hearings – Week of 4-7-18

Both the House and Senate are coming back to Washington this week after their two-week Easter Recess. There are no hearings of specific interest to readers of this blog in the strictest sense, but there are two categories of hearings that may be of general interest. They deal with (non-ICS) cybersecurity and money.

Cyber Hearings

April 10^th, Senate Judiciary, “Facebook, Social Media Privacy, and the Use and Abuse of Data”;

April 11^th, House Energy and Commerce, “Facebook: Transparency and Use of Consumer Data”;

April 11^th, House Armed Services, “Cyber Operations Today: Preparing for 21st Century Challenges in an Information-Enabled Society”;

April 11^th, Emerging Threats and Capabilities Subcommittee (House Armed Services), “A Review and Assessment of the Department of Defense Budget, Strategy, Policy, and Programs for Cyber Operations and U.S. Cyber Command for Fiscal Year 2019”;

Zuckerberg gets a chance to respond to Congressional critics and the military will talk about cyber operations.

Budget and Spending Hearings

April 11^th, Homeland Security Subcommittee (House Appropriations), “FY 2019 Department of Homeland Security”;

April 12^th, Transportation and Protective Security Subcommittee (House Transportation), “Examining the President’s FY 2019 Budget Request for the Transportation Security Administration”;

We are still too early in the FY 2019 process for any particular details to begin to emerge but, listening to the questions asked at these hearings can give a picture of what may be coming down the road.

Committee Hearings – Week of 03-18-18

There are a significant number of hearings scheduled this week with both the House and Senate in session. Budget hearings predominate, but none that are of specific interest to readers of this blog. In fact, I do not see any hearings of specific interest here this week. There are, however, two bills that will make it to the floor of the House this week that I am watching and, of course, there is a spending bill deadline approaching at the end of the week.

On the Floor of the House

There are a number of bills that are scheduled to come to the floor on Monday under the suspension of the rules provisions of the House. These provisions limit debate, prohibit floor amendments, and require a super-majority to pass. Bills of potential interest include:

• HR 5074, the DHS Cyber Incident Response Teams Act of 2018;

• HR 5089, Strengthening Local Transportation Security Capabilities Act of 2018;

Interestingly, both of these bills are listed in the Majority Leader’s schedule as being considered “as amended”. The Homeland Security Committee mark-up hearing for both of these bill resulted in an order for each bill that the bill be “reported to the House with a favorable recommendation, without amendment”. No report has been published for either bill (will probably be submitted today and published later this week), so I cannot tell if Chairman McCaul (R,TX) subsequently ordered some revisions be made to the bill. It would not be too unusual for minor technical revisions to be made after mark-up, but substantial revisions are seldom made.

FY 2018 Spending Bill

The current continuing resolution (CR, HR 1892) will expire on Friday night. The hope has been that the House and Senate will consider and pass an omnibus spending bill this week that would include all of the non-DOD operations of the government (DOD spending was included in the last CR). News reports (see here for example) would seem to indicate that there is still some hard negotiating to be done on this bill.

Is there a chance that there will be another CR? It increasingly seems that there is always a chance. One remote possibility is that a CR for the rest of the fiscal year could be passed, keeping the current funding levels. While the inclusion of DOD spending in HR 1892 would seem to make that possibility easier, it would violate the agreement to increase spending levels in non-DOD areas that allowed HR 1892 to eventually be passed.

Committee Hearings – Week of 12-17-17

This week with both the House and Senate trying to get things ‘cleaned-up’ so that they can head home for Christmas and New Years, there will only be one hearing of potential specific interest to readers of this blog; another continuing resolution.

Tomorrow the House Rules Committee will hold a hearing to formulate the rule for the consideration of HR 1370, which will be used as the vessel to move forward with a continuing resolution. It will be based on HJ Res 124 which would extend the current spending authorization until January 18^th, 2018 and provide for full funding of DOD through the end of the fiscal year.

Note: I can find no specific mention of any cybersecurity provisions in HJ Res 124.

The bill will probably be considered on the floor of the House on Wednesday or Thursday and then in the Senate later the same day. No debate and no amendments in either house.

Committee Hearings – Week of 12-03-17

With the end of year holidays fast approaching the Congressional hearing calendar is getting light. There are two hearings this week that may be of specific interest to readers of this blog; the Continuing Resolution and a cybersecurity hearing.

CR

The House Rules Committee Hearing that I mentioned yesterday has been postponed until today with the House leadership trying to work out the political bugs in its consideration. This would lead to a vote in the House tomorrow and the Senate on Friday. Any further slippage could cause some problems since the current funding runs out at midnight on Friday.

This CR (HJ Res 123) will only kick the can down the road a piece. The leadership still needs to come up with a deal to fund the government for the rest of the year. Speaker Ryan’s problem is that he is trying to find a Republican-only-bill that can make it past the Democrat’s filibuster in the Senate.

Grid Cybersecurity

On Friday the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee will be holding a hearing on “Examining the Role of the Department of Energy in Energy Sector Cybersecurity”. Only one witness is scheduled; Bruce J. Walker, Assistant Secretary, Office of Electricity Delivery and Energy Reliability, Department of Energy. This is going to be more of a policy type discussion rather than addressing the nuts and bolts of cybersecurity issues.

Committee Hearings – Week of 11-12-17

Both the House and Senate will be in session again this week ahead of their Thanksgiving recess. 2018 spending bill, budget and 2018 NDAA take up most of the attention on the Hill. There will be one hearing this week of specific interest to readers of this blog, a cybersecurity hearing.

Cybersecurity Information Sharing

The Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will be holding a hearing on “Maximizing the Value of Cyber Threat Information Sharing”. No witness list is currently available. A Committee Report on the topic will certainly be a feature of this hearing.

Committee Hearings – Week of 10-15-17

With just the Senate in session this week most of the congressional hearings concern nominations. There is one cybersecurity hearing that may be of interest to readers of this blog.

The Senate Armed Services Committee will be holding a hearing on Thursday looking at “Roles and Responsibilities for Defending the Nation from Cyber Attack”. This is an open hearing, but there may be a closed (classified) session at the end. The witness list includes:

• Rob Joyce, National Security Council

• Kenneth P. Rapuano, Department of Defense

• Scott Smith, Federal Bureau Of Investigation

• Christopher C. Krebs, Department Of Homeland Security

There is a distinct possibility that control systems security issues associated with the electric grid may be discussed at this hearing, but at a policy level not a technical discussion given the participants.

Committee Hearings – Week of 10-01-17

This week with the House and Senate both in session in the first day of the new fiscal year, the lawmakers’ focus expands. We have four hearings of potential interest, two markup hearings and two cybersecurity hearings.

Markup Hearings

As I mentioned earlier, the Senate Commerce, Science, and Transportation Committee will hold their markup hearing on Wednesday. In addition to the markup of S 1885, the Committee will also take-up S 1872 [note: this is a link to the committee draft], the TSA Modernization Act. I mentioned this briefly when it was introduced last week, but I will not really cover this bill since it has little to do with surface transportation security. I will note that it is attempting to finally reword the current DOT referenced authorization of the TSA {49 USC 114} to move it to where it actually resides in DHS.

Also on Wednesday, the Senate Homeland Security and Governmental Affairs Committee will hold a markup hearing that will cover a number of bills (many that have yet to have been introduced). It will specifically include S 1281, the HACK DHS Act of 2017. I would like to note that in my post on the bill, I made the statement that Sen. Hassan (D,NH) was not a member of the Homeland Security Committee, but she is currently a member.

Cybersecurity Hearings

The Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will hold a hearing on Tuesday on “Examining DHS’s Cybersecurity Mission”. The witness list includes:

• Patricia Hoffman, DOE;
• Christopher Krebs, DHS; and

• Jeanette Manfra, DHS

It will be interesting to see if this hearing addresses the reorganization of DHS cyber activities that includes the move of ICS-CERT to NCCIC.

On Tuesday the Information Technology Subcommittee of the House Oversight and Government Reform Committee will hold a hearing on “Cybersecurity of the Internet of Things”. This hearing was originally scheduled for 09-27-17. The witness list includes:

• Matthew J. Eggers, US Chamber of Commerce;

• Josh Corman, Atlantic Council;

• Tommy Ross, The Software Alliance (BSA); and

• Ray O’Farrell, VMware

According to the hearing website the purpose of the hearing is:

• To examine the use of devices that comprise the Internet of Things (IoT) and their current and potential uses in federal government.

• To explore potential cyber threats posed by the use of IoT devices.

• To review private sector recommendations for securing the IoT, and explore potential legislative solutions. 

Committee Hearings – Week of 7-23-27

This week, with both the House and Senate in session we start to see action on spending bills in the Senate while House spending bills start to move to the floor of the House. Additionally, there is two cybersecurity hearing scheduled this week one on insurance and the other a markup hearing.

Spending Bills (Senate Appropriations Committee)

7-25-17 (Subcommittee) FY2018 Transportation, Housing and Urban Development (THUD), & Related Agencies Appropriations Act;

7-26-17 (Subcommittee) FY2018 Commerce, Justice, Science (CJS) & Related Agencies Appropriations Act

7-27-17 (Full Committee) CJS, THUD, and Legislative Branch Appropriations Bills for FY2018

DOD Spending Bill

The House Rules Committee will hold a hearing to formulate the rule for HR 3219 tonight. What was the DOD FY 2018 spending bill is now the Make America Secure Appropriations Act, 2018; a mash-up of four spending bills {HR 3219 (DOD), HR 3162 (Legislative Branch), HR 2998 (Military Construction/VA), and HR 3266 (Energy and Water Development)}.

None of those bills currently have any provisions of specific interest here. The amendment process could certainly change that.

Proposed amendments are supposed to be submitted by later this morning. There were 28 amendments already submitted by 8:00 am EDT. There is only one cyber related amendment (cyber scholarship spending) currently on the list, but that will probably change.

The bill is currently scheduled to come to the floor later this week (Wednesday?).

Cybersecurity Insurance

On Wednesday the House Small Business Committee will be holding a hearing on “Protecting Small Businesses from Cyber Attacks: The Cybersecurity Insurance Option”. The witness list includes:

• Robert Luft, SureFire Innovations;
• Erica Davis, Zurich Insurance;
• Eric Cernak, Munich Re US;
• Daimon Geopfert, Security and Privacy ConsultingRisk Advisory Services

I will be very surprised if control system security issues are even mentioned in passing, but I am certainly open to surprises.

Cybersecurity Markup

The House Homeland Security Committee will be holding a mark-up hearing on Wednesday. Two of the bills may be of specific interest to readers of this blog. The first is HR 3202, Cyber Vulnerability Disclosure Reporting Act, the bill I reviewed yesterday. I certainly hope the Committee adds provisions requiring public posting of the unclassified report.

The second is a new (not yet introduced) bill by Chairman McCaul (R,TX) that would establish the Cybersecurity and Infrastructure Security Agency to replace the current National Protection and Programs Directorate. A committee print of the bill is available and a quick review of the provisions shows that it still relies on the IT-centric definition of ‘cybersecurity risk’ found in 6 USC 148(a). I would really like to see this bill change that definition to one based on the ‘information system’ definition found in 6 USC 1501(9). More on this bill later.

On the Floor of the House

In addition to HR 3219 mentioned above there are two other bills of potential interest currently on the schedule for consideration on the floor of the House. The first is HR 3180, the Intelligence Authorization Act for Fiscal Year 2018. While there are some cyber related provisions in the unclassified portion of the bill, none are of specific interest to readers of this blog. The bill will be considered today under the suspension of the rules, so no amendments will be possible.

The second is an as of yet unintroduced “Russia, Iran, and North Korea Sanctions Act”. It will be considered tomorrow, so it will be introduced today. A very quick review of the committee draft of bill does show mention of cybersecurity related sanctions. I’ll review those in more detail later. Interestingly, this bill is also being considered under the suspension of the rules provisions indicating that the leadership thinks this bill will receive substantial bipartisan support to meet the 2/3 majority vote required for passage.