Committee Hearings – Week of 3-5-17

Both the House and Senate are in session this week. The Senate continues to work on Cabinet nominations and the House begins to get down to normal business. There will be three hearings this week that may be of specific interest to readers of this blog; one spending bill and two cybersecurity hearings.

DOD Spending Bill

As I mentioned in yesterday’s blog post the House will take up the first spending bill of this session; HR 1301, the DOD FY 2017 Appropriations bill. The House Rules Committee will hold a hearing this evening to formulate the rule for the consideration of the bill. It will likely be an open rule with a large number of proposed amendments from the floor. The House is scheduled to start consideration of the bill tomorrow.

Cybersecurity

The House Small Business Committee will hold a hearing on Wednesday on “Small Business Cybersecurity: Federal Resources and Coordination”. The witness list includes:

• Maureen K. Ohlhausen, Federal Trade Commission (FTC);

• Chuck Romine, National Institute of Standards and Technology (NIST);

• Charles Rowe, America’s Small Business Development Centers (SBDC);
• Jim Mooney, Chevron Federal Credit Union

The Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will be holding a hearing on Thursday on “The Current State of DHS Private Sector Engagement for Cybersecurity”. The witness list includes:

• Daniel Nutkis, HITRUST Alliance;

• Scott Montgomery, Intel Corporation;

• Jeffrey Greene, Symantec;

• Ryan M Gillis, Palo Alto Networks;

• Robyn Greene, New America’s Open Technology Institute

Neither hearing is really supposed to address control system security issues, but there is a VERY remote possibility that there might be mention of those issues in the question/answer portion of the hearing.

HR 1301 Introduced – FY 2017 DOD Spending

Last week Rep. Frelinghuysen (R,NJ) introduced HR 1301, the Department of Defense Appropriations Act, 2017. This bill provides continued funding for DOD for FY 2017 after the current funding expires on April 28^th, 2017. The House Rule Committee web site provides a link to the Explanatory Statement that serves as the Appropriations Committee Report on the bill. That statement is based upon H Rept 114-577 for HR 5293 and S Rept 114-263 for S 3000 from the last Congress; the provisions of those reports will continue to apply through the remainder of the Fiscal Year.

As usual there are no specific cybersecurity provisions outline in HR 1301, the bill just does not get down to that level of detail in the spending being appropriated for the remainder of the fiscal year. The Statement, however, does provide a wealth of detail about the cyber spending for DOD. Page 7 of the Statement provides an overview of the cyber spending for each of the DOD components. DOD requested $5.7 Billion and the bill provides $6.7 Billion.

There are a number of specific cyber activities outlined in the 350-page document. Some are increases and some are decreases, but it comes out to a $1 billion increase. No real details about the projects are provided, but here are some of the ones of potential interest:

• Air Force Training – Specialized skill training (pg 76) - Program increase - cybersecurity training – Increase $7.8 million;

• Army R&D Programs – Missile and rocket advanced technology (pg 214) - Cybersecurity and supply chain risk management research – Increase $10 million;

• Army R&D Programs – Major T&E investment (pg 216) - Cyber vulnerabilities research – Increase $12 million;

• Army R&D Programs – Amy technical test instrumentation and targets (pg 216) - Cybersecurity of space and missile defense assets – Increase $10 million;

• Navy R&D Programs – Advanced surface machinery systems (pg 229) - Cybersecurity boundary defense capability excess growth – Decrease $4 million;

• Navy R&D Programs – Cyber operations technology development (pg 232) - Excess growth – Decrease $2.5 million;

• Navy R&D Programs – Information systems security program (pg 234) - Excess growth – Decrease $5.2 million;

• Air Force R&D Programs – AF defensive cyberspace operations (pg 249) - Program Increase - $10 million;

• Air Force R&D Programs – Cyber intelligence - Eliminate program growth (pg 264) – Decrease $8 million.

The House Rules Committee will hold a meeting tomorrow to establish the rule for the consideration of HR 1301. The House is currently planning on taking up HR 1301 on Wednesday.

House Passes HR 5293 – FY 2017 DOD Spending

Yesterday the House amended and passed HR 5293, the FY 2017 DOD Spending bill. The lengthy amendment process included the adoption of the one cybersecurity related amendment as part of an en bloc amendment consideration. The final tally on the bill was a partially bipartisan vote of 282 to 138.

The Senate will likely substitute language from S 3000 when it takes up the bill later this month or early next month. A conference committee will not complete work on the bill before the summer recess in mid-July. There is a distinct possibility that work will not be completed on this bill (and at least some/most other spending bills) prior to the end of the fiscal year resulting in a continuing resolution to keep the government functioning until after the election.

HR 5293 Amendment Process - FY 2017 DOD Spending

The House Rules Committee completed work on their rule for the amendment process for HR 5293, the FY 2017 DOD spending bill. As expected the rule is a structured rule that will only allow for the consideration of 75 specific amendments. Only one of those amendments is cybersecurity related, providing funding for the Information Assurance Scholarship Program for DOD personnel.

Cybersecurity Provisions in Bill

There were no specific cybersecurity provisions in the actual bill and there was only a single limited mention of cybersecurity issues in the Committee Report supporting the bill. That two paragraph mention notes that the funding in the bill provide a $992 million increase in cybersecurity related spending throughout the bill over the FY 2016 spending. The second paragraph mentioned the Committee’s concerns about recruiting and retaining a trained and qualified cyber workforce.

Cybersecurity Amendment

The one cybersecurity amendment is # 54 proposed by Rep. Aguilar (D,CA). It would take $5 million dollars out of the $32 billion Operation and Maintenance, Defense-Wide, account to provide funding for the Information Assurance Scholarship Program. The funding for this program initiated in 2012 has been hit and miss.

Bills Introduced – 05-26-16

Yesterday with the House and Senate preparing to leave Washington for an extended Memorial Day Weekend there were 72 bills introduced. Three of those may be of specific interest to readers of this blog:

HR 5368 To direct the Department of Transportation to issue regulations to require enhanced security measures for shipments of security sensitive material, and for other purposes. Rep. Norton, Eleanor Holmes [D-DC-At Large]

S 3000 An original bill making appropriations for the Department of Defense for the fiscal year ending September 30, 2017, and for other purposes. Sen. Cochran, Thad [R-MS]

S 3001 An original bill making appropriations for the Department of Homeland Security for the fiscal year ending September 30, 2017, and for other purposes. Sen. Hoeven, John [R-ND]

Norton’s bill would seem to be bypassing the surface transportation folks at TSA to put the onus for security regulations back on DOT. One can sympathize, for while DOT is slow in the rule making game, the surface transportation folks at TSA move slower than a weekend security line at the Chicago airport.

These two spending bills will probably be considered in the Senate next month. After seeing the games played in the House with the THUD spending bill, I will be surprised to see either of these bills considered in the House. We are almost certainly looking at a continuing resolution and a post-election omnibus again this year, despite the best efforts of the Senate.

Bills Introduced – 04-19-16

With both the House and Senate in session yesterday there were fourteen bills introduced. Two of those may be of specific interest to readers of this blog:

S 2814 A bill to authorize appropriations for fiscal year 2017 for military activities of the Department of Defense and for military construction, to prescribe military personnel strengths for such fiscal year, and for other purposes. Sen. McCain, John [R-AZ]

S 2817 A bill to improve understanding and forecasting of space weather events, and for other purposes. Sen. Peters, Gary C. [D-MI]

As always I will be watching the DOD spending bill for cybersecurity provisions. Maybe this year we will actually see the Cyber Command broken out in the spending bill as a separate item. The appropriations committees have been talking about this for a couple of years now.

For those concerned with electromagnetic pulse (EMP) issues in grid security geomagnetic storms (or space weather) are a major thing. Understanding and being able to forecast geomagnetic storms really could be an important part of securing the electric grid. It will be interesting to see how this bill deals with this and how much money Peters thinks is necessary.