Cybersecurity Legislation Watch – 5-14-21

I received two emails from Congress.gov this morning about the publication of text for two cybersecurity bills. Anyone can sign up for this service for tracking changes in the files for individual pieces of legislation on that site. It has been especially valuable to me this session because of the large number of bills being introduced and the problems the Government Printing Office is having publishing text of those bills in a timely manner.

Anyway, back to the two bills. The two cybersecurity bills are:

HR 2980, the Cybersecurity Vulnerability Remediation Act, and

HR 3138, the State and Local Cybersecurity Improvement Act

Generally speaking, the GPO tries to publish the text of bills in the order that they were introduced. This keeps them out of problems with congresscritters screaming favoritism when someone else’s bill is published first. These two bills, however, are being published well outside of that sequence. This typically means that the leadership has notified the GPO of their particular interest in seeing these bills published early in the que.

Now I have not had time yet to do a detailed comparison, but it looks like each of these bills is substantially the same as bills introduced in the 116^th Congress:

• HR 2980 – HR 3710, which passed in the House on September 26^th, 2019, and

• HR 3138 – HR 5823, which passed in the House on September 30^th, 2020

I suspect that later this afternoon when the House Majority Leader’s ‘The Weekly Leader’ is published outlining what will be happening in the House next week, we will see both of these bill on the list of bills that will be considered under the suspension of the rules process. Bills are not typically seen on the floor before they are considered in committee, but with the current attention on cybersecurity and the fact that both bills went through the committee process last session, this would not be a very unusual process.

There are two other cybersecurity bills that could also be considered on the floor next week, as they have both been considered in committee:

HR 1833, the DHS ICS Capabilities Enhancement Act, and

HR 1850, the Supporting Research and Development for First Responders Act

Homeland Security Markups – 3-18-21

On Thursday the House Homeland Security Committee held a markup hearing on seven bills. All of the bills were passed by unanimous consent after three of the bills were amended. The four bills that I have covered here in this blog included:

HR 1833 – Amended and passed,

HR 1850 – Passed,

HR 1871 – Passed

HR 1833 – DHS ICS Capabilities Enhancement Act

There were two amendments adopted for this bill. The first was proposed by Rep Langevin (D,RI). It inserted the words ‘Sector Risk Management Agencies’ in three places in the bill, indicating the need for NCCIC-ICS to coordinate their ICS security tasks in coordination with these agencies. This brings the bill more in-line with HR 5733 that was introduced in 2018.

The second amendment was proposed by Rep Torres (D,NY). It added a requirement for a GAO report within 2 years of the passage of this bill. GAO would be specifically tasked to address {new §2(c)}:

•Any interagency coordination challenges to the ability of the Director of the CISA to lead Federal efforts to identify and mitigate cybersecurity threats to industrial control systems,

• The degree to which the Agency has adequate capacity, expertise, and resources to carry out threat hunting and incident response capabilities to mitigate cybersecurity threats to industrial control systems, as well as additional resources that would be needed to close any operational gaps in such capabilities.

• The extent to which industrial control system stakeholders sought cybersecurity technical assistance from the Agency, and the utility and effectiveness of such technical assistance.

• The degree to which the Agency works with security researchers and other industrial control systems stakeholders to provide vulnerability information to the industrial control systems community.

Moving Forward

The unanimous consent passage of these measures indicates that there is wide spread, bipartisan support for all of these bills. I expect that all these bills will move to the floor of the House under the suspension of the rules process. Typically bills will not be considered by the Full House until reports are published, but that is not a requirement. I would not be surprised to see HR 1833 move to the floor when the House returns to session after the Easter break on April 13^th.

HR 1850 Introduced - Supporting Research and Development for First Responders Act

Last week Rep Rice (D,NY) introduced HR 1850 (GPO version not available, link to Committee Print), the Supporting Research and Development for First Responders Act. The bill would authorize DHS S&T to establish the current National Urban Security Technology Laboratory (NUSTL) “to test and evaluate emerging technologies and conduct research and development to assist emergency response providers in preparing for, and protecting against, threats of terrorism” { new §322(a)}.

NUSTL

This bill amends the Homeland Security Act of 2002 by adding a new section 322 to Title III of the Act. It provides for the establishment of the NUSTL and mandates that the laboratory will {new §322(b)(2)}:

• Conduct tests, evaluations, and assessments of current and emerging technologies, including, as appropriate, the cybersecurity of such technologies that can connect to the internet, for emergency response providers,

• Act as a technical advisor to emergency response providers, and

• Carry out other such activities as the Secretary determines appropriate.

Moving Forward

The House Homeland Security Committee is taking up this bill today. I expect that it will receive substantial bipartisan support. It will move to the floor of the House, where it will be considered under the suspension of the rules process. That will limit debate, prevent amendments from the floor, and require a supermajority for passage. The bill will pass in the House with substantial bipartisan support.

Commentary

This bill is a housekeeping measure. The NUSTL already exits and has been funded for sometime. The housekeeping nature is further evidenced by the fact that there is no authorization (MONEY) language in the bill, it is already a line-item in the S&T budget.

But, housekeeping also means straightening up things, and there is one item that should be addressed in the bill. Since the language specifically addresses cybersecurity research, I think that it is only proper that it should specifically include language establishing a cybersecurity information sharing requirement. So I would like to propose two subparagraphs being inserted in the §322(c):

“(3) act as a clearing house for first responder information on cybersecurity issues related to discovered and reported vulnerabilities and indicators of compromise on technologies used by first responders that can connect to the internet,

“(4) coordinate vulnerability reporting with vendors and developers for vulnerabilities identified by research at the Lab and by those vulnerabilities reported to the Lab by independent cybersecurity researchers,”

Additional Markup Hearing Announced – 3-15-21

This afternoon the House Homeland Security Committee announced that it would hold a markup hearing on Thursday for seven recently introduced bills. The bills include:

HR 1833, the “DHS Industrial Control Systems Capabilities Enhancement Act of 2021”,

HR 1850, the “Supporting Research and Development for First Responders Act”,

HR 1871, the “Transportation Security Transparency Improvement Act”.

All three of these bills were introduced last week and the official, GPO, copies of these have not yet been published (probably will not be for about a month). The hearing website provides links to ‘committee prints’ of each of the bills listed and those are the links I have included above.

HR 1850

I did not announce the introduction of HR 1850 last week, because the bill description did not indicate anything of interest. Looking at the committee print, there is one subparagraph in the bill describing the activities of the National Urban Security Technology Laboratory (NUSTL) that has caused me to reevaluate that decision {new 6 USC 322(c)(1)}:

“(1) conduct tests, evaluations, and assessments of current and emerging technologies, including, as appropriate, the cybersecurity of such technologies that can connect to the internet [emphasis added], for emergency response providers;”

HR 1833 and HR 1871

I will be doing separate reviews of each of these bills before the markup hearing.