House Amends and Passes HR 2596

This afternoon the House finished the amendment process on HR 2596, the FY 2016 intel authorization bill, and passed the bill on a mixed vote of 247 to 178. There were 25 Republicans that voted ‘No’ and 31 Democrats votes ‘Aye’.

All five of the cybersecurity related amendments that I reported on yesterday were adopted by voice votes.

Rules Committee Approves Rule for HR 2596

This evening the House Rules Committee met to develop the rule for the floor consideration of HR 2596, the FY 2016 intelligence authorization bill. As expected the bill will be considered under a structured rule with only 16 amendments allowed to be offered on the House floor tomorrow.

Five of the amendments may be of specific interest to readers of this blog:

#2 Rep. Israel (D,NY) - Requires the Director of National Intelligence to provide report to the congressional intelligence and defense committees on the cyber threat trends identified by the Cyber Threat Intelligence Integration Center, an assessment of collaborative efforts between federal agencies, and recommendations to improve those collaborative efforts.

#5 Rep. Keating (D,MA) - Restores reporting requirement on the progress of the Federal Bureau of Investigation in implementing information-sharing principles.

#7 Rep. Rooney (R,FL) - Requires a report detailing the Intelligence Community's utilization of the National Science Foundation's CyberCorps Scholarship for Service program.

#8 Rep. Moulton (D,MA) - Requires a report and briefing regarding the impacts on the intelligence community (IC) of the recently disclosed cyber breach at OPM.

#13 Rep. Wilson (R,SC) - Directs the Director of National Intelligence to study how we measure cyber attacks and report to the relevant committees in both a classified and unclassified format.

Sharp eyed readers will note the similarity of amendment #13 to HR 2708 that I reported on earlier today. Apparently the Rules Committee did not share my opinion on the inappropriateness of this measure.

HR 2596 Introduced – FY 2016 Intel Authorization Bill

Last week Rep. Nunes (R,CA) introduced HR 2596, the Intelligence Authorization Act for Fiscal Year 2016. Normally I don’t pay much attention to these intel bills because the good stuff is kept in the classified annex and classified report, but a reader urged me to take a look and sure enough there is a cybersecurity provision in the bill.

Cyber Threat Intelligence Integration Center

Section 307 of the bill amends Title I of the National Security Act of 1947 (50 USC 3021 et seq) by adding a new section 119B to formally establish the Cyber Threat Intelligence Integration Center within the office of the Director of National Intelligence. The function of the CTIIC would be to {new §119B(c)}:

∙ Serve as the primary organization within the Federal Government for analyzing and integrating all intelligence possessed or acquired by the United States pertaining to cyber threats;

∙ Ensure that appropriate departments and agencies of the Federal Government have full access to and receive all-source intelligence support needed to execute the cyber threat intelligence activities of such agencies and to perform independent, alternative analyses;

∙ Disseminate cyber threat analysis to the President, the appropriate departments and agencies of the Federal Government, and the appropriate committees of Congress;

∙ Coordinate cyber threat intelligence activities of the departments and agencies of the Federal Government; and

∙ Conduct strategic cyber threat intelligence planning for the Federal Government.

The bill would limit the CTIIC staff to 50 people and it would have to be ‘housed’ in a facility already owned by the Intel Community.

Moving Forward

The House Rules Committee will meet tomorrow to formulate the rule for this bill. It will almost certainly allow for only limited amendments. Twenty-four proposed amendments are currently listed on the Committee web site. There are a number of cyber related amendments listed but none that would have any real effect on civilian cybersecurity activities.

Commentary

While it might seem odd that the CTIIC has no language about sharing threat intelligence with the private sector, this function would be undertaken by elements within DHS. Similarly, DOD would be responsible for sharing the cyber threat intelligence information with the Defense Industrial Base.