Last week Sen Rubio (R,FL) introduced S 3905, the Intelligence
Authorization Act for Fiscal Year 2021. This ‘must pass’ bill would set
priorities, funding and authorization for the intelligence community. There are
no specific cybersecurity measures in the bill, but there is a requirement for
reports about the Cyberspace Solarium Commission Report.
Reporting on Commission’s Recommendations
Section 504 of the bill would establish reporting requirements
for various federal agencies about the recommendations made by the Cyberspace
Solarium Commission. The Commission was charged by the §1652 of the 2019 NDAA (PL
115-232) to make recommendations for opportunities for the private and
public sectors to implement critical changes that could harden United States
defenses against cyber-attacks. The five federal agencies included in the
reporting requirement are {§504(c)}:
• Office of the Director of
National Intelligence,
• Department of Homeland Security (Under
Secretary of Homeland Security for Intelligence and Analysis),
• Department of Energy (Director of
Intelligence and Counterintelligence),
• Department of Commerce, and
• Department of Defense
The reports, required within 180 days of the adoption of the
bill, would be required to include {§504(d)}:
• An evaluation of the
recommendations in the report described in subsection (b) that pertain to the
agency, and
• A description of the actions
taken, or the actions that the head of the agency expects to take, to implement
any of the recommendations included in such report.
Moving Forward
Rubio is currently the Acting Chair of the Senate Select
Committee on Intelligence. The bill was ordered reported by the Committee
(without report) on June 8th, 2020. This bill will be taken up by
the full Senate at some point in time and it (or some other version of it) will
be amended and ultimately passed by the Senate and the House. That ‘some other
version’ caveat has become increasingly necessary for this ‘must pass’
legislation in the last couple of years. Some version of the FY 2021 Intel
Authorization Act will ultimately reach the President’s desk.
Commentary
I have not discussed the Cyberspace
Solarium Commission Report, mainly because the recommendations are too
vague to mean anything besides a call to action. That is why the staff of the
Senate Select Committee on Intelligence included §504 in the bill.
Unfortunately, they missed an important requirement, making recommendations to
Congress on what congressional action would be required to fully implement the Commission’s
proposals. A third sub-paragraph needs to be added to §504(d):
“(3) A list of congressional
actions that would need to be taken to allow the full implementation of the
Commission’s recommendations for the agency.”
Posts
