Last month Rep McCaul (R,TX) introduced HR 1251, the Cyber
Diplomacy Act of 2021. The bill would establish an international cyber policy “to
work internationally to promote an open, interoperable, reliable, unfettered,
and secure Internet governed by the multi-stakeholder model” {§4(a)}.
Definitions
Section 3 of the bill establishes the definitions for three
key terms used in the bill, the most important of which is ‘information and
communications technology’ (ICT). That term is defined as “hardware, software,
and other products or services primarily intended to fulfill or enable the
function of information processing and communication by electronic means,
including transmission and display, including via the Internet” {§3(2)}.
Policy Objectives
In implementing this policy, the bill requires the President
to pursue the following objectives {§4(b)}:
• Clarifying the applicability of
international laws and norms to the use of ICT.
• Reducing and limiting the risk of
escalation and retaliation in cyberspace, damage to critical infrastructure,
and other malicious cyber activity that impairs the use and operation of
critical infrastructure that provides services to the public,
• Cooperating with like-minded
democratic countries that share common values and cyberspace policies with the
United States, including respect for human rights, democracy, and the rule of
law, to advance such values and policies internationally,
• Encouraging the responsible
development of new, innovative technologies and ICT products that strengthen a
secure Internet architecture that is accessible to all,
• Securing and implementing
commitments on responsible country behavior in cyberspace based upon accepted
norms, and
• Advancing, encouraging, and
supporting the development and adoption of internationally recognized technical
standards and best practices.
Among the ‘accepted norms’ that the bill would require the
President to support would be {§4(b)(5)(C)}:
“Countries should not conduct or
knowingly support ICT activity that, contrary to international law,
intentionally damages or otherwise impairs the use and operation of critical
infrastructure providing services to the public, and should take appropriate
measures to protect their critical infrastructure from ICT threats.”
Moving Forward
This bill was considered by the House Foreign Affairs
Committee on February 25th, 2021. It was amended with substitute
language (not currently available) and approved by the Committee (as part of an
en bloc consideration) by voice vote. That would indicate wide bipartisan support
for the bill which should carry over to the floor of the House. It is likely
that the bill would be considered under the suspension of the rules process in
the House.
Commentary
This is primarily an information and communications
technology security bill. The new ICT terminology is an interesting expansion
of the information technology concept to specifically include the necessary communications
aspects that are really key to the efficacy of IT operations and security.
The one objective that seems to address industrial control
system security is the oddly worded:
“Reducing and limiting the risk of escalation and
retaliation in cyberspace, damage to critical infrastructure, and other
malicious cyber activity that impairs the use and operation of critical
infrastructure that provides services to the public,”
Parsing that out, there are two specifically operational technology
related provisions that would attempt to reduce and limit:
• Damage to critical
infrastructure, and
• Other malicious cyber activity
that that impairs the use and operation of critical infrastructure that
provides services to the public.
That, combined with the ‘accepted norm’ described above,
would seem to make it clear that preventing cyber attacks on critical
operational technology will be a key part of the foreign policy of the United
States. How the crafters of this bill expect the President and the State Department
to accomplish this by diplomatic means is unclear.
Posts
