HR 1324 Introduced – Communications Cybersecurity

Last week Rep. McNerney (D,CA) introduced HR 1324, the Securing the Internet of Things (IOT) Act of 2017. The bill would require the Federal Communications Commission (FCC) to establish cybersecurity standards for radio frequency equipment regulated by the FCC.

Cybersecurity Standards

Section 2 of the bill would amend 47 USC 303; adding a new paragraph (cc). It would require the FCC to establish cybersecurity standards for radio frequency equipment regulated under 47 CFR Part 2, Subpart J. Those standards would apply “throughout the lifecycle of the equipment, including design, installation, and retirement”.

The bill would require the FCC to establish the regulations implementing these cybersecurity requirements within 180 days of the adoption of the bill. The standards would apply “to radio frequency equipment for which an application for certification is submitted after the date that is 1 year after the date of the enactment of this Act” {§2(c)}.

Moving Forward

McNerney is a member of the House Energy and Commerce Committee two which this bill was referred. He is a relatively low ranking Democrat on the Committee, so it is possible that he may have enough influence to have the bill considered by the Committee.

The bill is likely to engender a great deal of opposition from a wide variety of manufacturers. This would ensure that there was extensive Republican (and at least some Democratic) opposition to the bill. This bill is unlikely to be considered in the 115^th Congress.

Commentary

While the title of the bill would seem to indicate that McNerney intended this to address IOT security issues, it is written with a much larger brush. Any piece of equipment that has radio frequency emissions would be subject to the cybersecurity standards required by this bill.

The lack of any definitions in the bill and the short rulemaking deadline make establishing any effective cybersecurity standards extremely unlikely. Without limiting definitions, the FCC would be required to either come up with some very generic standards that applied to all RF emitting equipment, or attempt to establish workable subcategories of cyber vulnerable equipment for which reasonable standards could be written. The first option would be totally ineffective, but would still require costly compliance activities. The second option would be very time consuming for the FCC (completely missing the 180-day deadline) and would require a very large expansion of cybersecurity engineering professionals to meet the compliance requirements.

The most interesting portion of the legislation is the requirement to include cybersecurity requirements through the retirement of devices. I would assume that this is an attempt to ensure the privacy protection of information stored on a device after it is retired from service. While trying to define ‘retirement’ could prove problematic, the process standard could be something as simple as providing an effective erase mechanism for any information storage device. How that final erasure would be initiated (and protected from inadvertent activation) could prove to be an expensive engineering problem.

Bills Introduced – 03-02-17

With both the House and Senate preparing to leave for a long weekend there were 120 bills introduced yesterday. Of those six may be of specific interest to readers of this blog:

HR 1301 Making appropriations for the Department of Defense for the fiscal year ending September 30, 2017, and for other purposes. Rep. Frelinghuysen, Rodney P. [R-NJ-11]

HR 1309 To streamline the office and term of the Administrator of the Transportation Security Administration, and for other purposes. Rep. Katko, John [R-NY-24]

HR 1324 To amend the Communications Act of 1934 to provide for the establishment of cybersecurity standards for certain radio frequency equipment. Rep. McNerney, Jerry [D-CA-9]

HR 1335 To direct the Federal Communications Commission to issue rules to secure communications networks against cyber risks, and for other purposes. Rep. Clarke, Yvette D. [D-NY-9]

HR 1344 To provide grants to assist States in developing and implementing plans to address cybersecurity threats or vulnerabilities, and for other purposes. Rep. Kilmer, Derek [D-WA-6]

S 516 A bill to provide grants to assist States in developing and implementing plans to address cybersecurity threats or vulnerabilities, and for other purposes. Sen. Warner, Mark R. [D-VA]

Readers may remember that late last session Congress passed HR 2028 that provided temporary spending authority for FY 2017 until April 28^th. It looks like HR 1301 may be the first in a series of bills extending that spending authority until the end of this fiscal year. I had kind of expected an omnibus spending bill and we still may see one for a number of the agencies with only a limited number of department specific bills such as this one.

I will only be covering HR 1309 if it contains specific provisions related to the surface transportation of hazardous chemicals.

It is interesting to see two bills addressing cybersecurity in communications. It is unclear how much of an overlap there will be with HR 1324 and HR 1335.

I would suspect that HR 1344 and S 516 are companion bills; identical bills that provide for parallel processing in both houses of congress to speed up the deliberative process. I suspect that these bills will extend grant eligibility but not expand the amount of grant moneys available.