Cyber Hunt Team Provisions in HR 1865

When the Senate passed (by a vote of 71 to 23) HR 1865, the second half of the two-part FY 2020 spending bill, last week and the President signed the bill into law, Title L (pg 556), the DHS Cyber Hunt and Incident Response Teams, was included in that bill. The provisions were the same language that had been adopted by the Senate in their consideration of the original version of HR 1158, a bill of the same name as Title L.

Title L authorizes the current US-CERT and ICSCERT action teams and provides for the use of private sector contractors on those teams. No additional funding was authorized in the Title L and no specific funding (too small to be listed) was provided in the general increase in the  Cybersecurity and Infrastructure Security Agency (CISA) funding provisions in Division F of HR 1158, the first half of the two-part FY 2020 spending bill.

FY 2020 Spending Bills Passed in the House

This afternoon the House took up HR 1158 and HR 1865 the two FY 2020 spending bills. HR 1158, the DOD, CJS, FS and DHS spending bill passed by a bipartisan vote of 280 to 138; 150 Democrats and 130 Republicans voted for the bill; 75 Democrats, 62 Democrats and 1 Independent voted against. The final vote for HR 1865, the remaining spending bills lumped into one bill, was a more partisan vote of 297 to 120; 218 Democrats and 79 Republicans voting Aye; 7 Democrats, 112 Republicans and 1 Independent voting Nay.

Two big questions remain. Will the bills come to a vote in the Senate? Current betting is yes. Will the President sign the two bills? White House indicates yes, but the President’s spending decisions have been a tad bit fickle over the last three years. We will have to wait and see.

Two FY 2020 Spending Bills to be Considered Today in House

Last night the House Rules Committee adopted a rule for the consideration of two bill that had previously passed in the House and were subsequently amended and passed in the Senate and turned them into two separate FY 2020 Spending bills.

HR 1158, the Consolidated Appropriations Act, 2020, will be the spending bill for:

• Department of Defense (Division A);

• Commerce, Justice, Science, and Related Agencies (Division B);

• Financial Services And General Government (Division C); and

• Department of Homeland Security (Division D)

HR 1865, the Further Consolidated Appropriations Act, 2020, will be the spending bill for:

• Departments of Labor, Health and Human Services, and Education, and Related Agencies (Division A);

•Agriculture, Rural Development, Food and Drug Administration, and Related Agencies (Division B);

• Energy and Water Development and Related Agencies (Division C);

• Department of The Interior, Environment, and Related Agencies (Division D);

• Legislative Branch (Division E);

• Military Construction, Veterans Affairs, and Related Agencies (Division F);

• Department of State, Foreign Operations, and Related Programs (Division G); and

• Transportation, Housing and Urban Development, and Related Agencies (Division H);

HR 1865 also includes a number of added measures including:

• Terrorism Risk Insurance Program Extension (Division I, Title V); and

• DHS Cyber Hunt and Incident Response Teams (Division L)

As with all spending bills the details of interest (beyond the $) will be found in the explanatory statements for each of the spending bills. I will be looking at those throughout the day.

Both bills are scheduled to be considered today. The Rule developed last night provides for limited debate on both bills (1 hour each) without amendments. Each bill will then be voted upon with a simple majority being required for passage. HR 1158 will be considered first and HR 1856 second.

It is interesting that the spending is being broken up into two bills. It looks like there may be some concern about HR 1158 passing in either the House or Senate. Keeping the controversial DOD and DHS spending in one bill would limit a potential shut down if enough votes are not available to pass these more controversial bills. And there would still technically be time for a CR to be passed to keep those agencies open.

Senate Passes HR 1158 – Cyber Hunt Teams

Yesterday the Senate amended and then adopted HR 1158 , the DHS Cyber Hunt and Incident Response Teams Act, by unanimous consent. The amendment substituted the language from S 315 that was reported favorably by the Senate Homeland Security and Governmental Affairs Committee. The amendment restored provisions requiring an ‘entity requesting action by or technical assistance from’  the National Cybersecurity and Communications Integration Center (NCCIC) to approve the use of private sector cybersecurity specialists in the cyber hunt team providing assistance.

The bill authorizes the current US-CERT and ICSCERT action teams and provides for the use of private sector contractors on those teams.

The bill now goes back to the House for action on the amendment. I suspect that the House will agree to the slightly different wording, perhaps this week. The House passed the original version of the bill by a voice vote.

Committee Hearings – Week of 06-09-19

This week with both the House and Senate in session spending bills start to move to the Floor of the House and the FY 2020 NDAA finally finishes up.

FY 2020 Spending Bills

• Tuesday, House, Full Committee, DHS;

• Tuesday, House, Full Committee, Financial Services;

This afternoon and tomorrow the House Rules Committee will hold hearing on the rule to consider HR 2740, the first FY 2020 spending minibus. As I mentioned on Saturday, this bill includes the original HR 2740 (LHHE), HR 2729 (Legislative Branch), HR 2968 (DOD), HR 2839 (State), and HR 2960 (EW). The two meetings will set which amendments will be considered during the Floor debate which will begin on Tuesday or Wednesday.

HR 2500 – FY 2020 NDAA

With the subcommittee work finally finishing up last week, the full House Armed Services Committee is set to take up HR 2500, the FY2020 National Defense Authorization Act (NDAA) Wednesday. We should see a report and final version of the bill this week.

On the Floor

This afternoon the House will take up seven homeland security related bills under the suspension of the rules process. This will include HR 1158 – DHS Cyber Incident Response Teams Act of 2019. This bill is expected to receive strong bipartisan support; it will certainly pass.

Committee Hearings – Week of 5-12-19

This week with both the House and Senate in session work starts to begin in the House on spending bills. Both Homeland Security Committee are holding markup hearings that include cybersecurity bills.

FY 2020 Spending Bills

These subcommittee hearings are all closed, but we may see their final drafts of the spending bills after the hearings are completed. Full Committee work has yet to be announced.

• House – Wednesday – DOD – Subcommittee

• House – Wednesday- Energy and Water - Subcommittee

• House – Wednesday – Interior, Environment and Related Agencies – Subcommittee

Cybersecurity Markups

On Wednesday the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting that will include the markup of 17 separate bills, including S 1388, Supply Chain Counterintelligence Training Act of 2019. This bill has yet to be published; we may see it before the hearing on Wednesday. Markups in this Committee are carefully choreographed and little information on the bill or changes made will be gleaned from watching this hearing.

On Wednesday the House Homeland Security Committee will hold a markup hearing for 10 bills, including HR 1158, the DHS Cyber Incident Response Team Act. The House Committee is more forthcoming in what they publish about amendments proposed to bill, so we will have a good sense of what changes (if any) are made to HR 1158 during this markup.

HR 1158 Introduced – Cyber Response Teams

Last month Rep. McCaul (R,TX) introduced HR 1158, the DHS Cyber Incident Response Teams Act of 2019. This bill is similar to S 315 that was introduced in January. The bill would provide authorization for the current US-CERT and ICS-CERT response teams in the DHS NCCIC.

Differences

The differences between the two bills are not drastic, but the subtle differences may have an effect on the operation of these teams.

The ‘new’ language added to HR 1158 is relatively inconsequencial. In the added paragraph (f)(1)(E) (this bill references the outdated ‘6 USC 148’ instead of ‘6 USC 659’), for instance substitutes “the Under Secretary appointed under section 103(a)(1)(H)” for the “Secretary” used in the Senate bill.

The language from S 315 that is removed is somewhat more interesting. The most common change is the frequent removal of the words ‘cyber hunt’ from the description of the response teams in the bill, but this is not universally removed so it should have no impact.

A significantly more important change is found in paragraph (f)(2) {which was (f)(4) in the Senate bill, a paragraph numbering change of no apparent importance}. The Senate bill reads:

“CYBERSECURITY SPECIALISTS.— After notice to, and with the approval of, the entity requesting action by or technical assistance from the Center, the Secretary may include cybersecurity specialists from the private sector on a cyber hunt and incident response team.”

The House bill completely deletes the opening phrase; removing any option for an affected party asking for NCCIC response assistance to decide if they want non-governmental personnel involved in the investigation process.

Moving Forward

McCaul is an influential member of the House Homeland Security Committee, the committee to which this bill was assigned consideration, so there is a good chance that this bill will be considered in committee. There is nothing in the bill that would draw any significant opposition so it should pass, both in committee and on the floor of the House, with significant bipartisan support.

S 315 Introduced – DHS Cyber Response Teams

Last month Sen. Hassan (D,NH) introduced S 315, the DHS Cyber Hunt and Incident Response Teams Act of 2019. The bill would authorize the current cyber incident response teams in the DHS NCCIC. The bill is very similar to HR 5074 from the 115^th Congress which passed in the House but was never taken up in the Senate.

The bill does not name the teams, but the description certainly refers to the incident investigation teams associated with US-CERT and ICS-CERT. The bill specifically mentions ‘control systems’ {6 USC 659(f)(1)(D)} but does not provide a definition for that term.

Hassan and her two cosponsors {Sen. Peters (D,MI) and Sen. Portman (R,OH)} are all influential members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This should mean that the bill has a good chance of being considered in that Committee. A recent article over on Politico.com pointed out, however, how hard it is to get cybersecurity legislation through that Committee. Since this bill does not contain any new authority for NCCIC nor does it approve any new funding, this bill may be able to avoid that cybersecurity trap.

NOTE: HR 1158 was recently introduced in the House with a similar sounding name, but the text has not yet been published. I suspect that it will be very similar to this bill.

Bills Introduced – 02-13-19

Yesterday with both the House and Senate in session there were 98 bills introduced. Three of those bills may receive additional coverage in this blog:

HR 1158 To authorize cyber incident response teams at the Department of Homeland Security, and for other purposes. Rep. McCaul, Michael T. [R-TX-10] 

HJ Res 45 Making further continuing appropriations for fiscal year 2019, and for other purposes. Rep. Biggs, Andy [R-AZ-5]

S 482 A bill to strengthen the North Atlantic Treaty Organization, to combat international cybercrime, and to impose additional sanctions with respect to the Russian Federation, and for other purposes.  Sen. Graham, Lindsey [R-SC] 

I will be watching S 482 for language that would include attacks on industrial control systems in the definition of ‘cybercrime’, but I am not holding my breath.

There was one other oddly named bill that I will personally be watching (but will probably not be writing about here), S 483. Introduced by Sen. Roberts (R,KS) it is titled: “A bill to enact into law a bill by reference.” Odd.