HR 756 – Cybersecurity R&D

As I noted two weeks ago Rep. McCaul (R,TX) introduced HR 756, the Cybersecurity Enhancement Act of 2013. The GPO finally made a copy available so that we can see the actual language for the bill and it is, as I suspected, virtually identical to the version of HR 2096 adopted by the House in the last session in a bipartisan vote.  

Reauthorization

This is essentially a bill to reauthorize a number of cybersecurity R&D programs. It provides a three year authorization for spending on the following National Science Foundation (NSF) cybersecurity research and development programs:

• Computer and network security research grants, at $90,000/year {§105(b)};

• Computer and network security research centers, at $4,500,000/year {§105(c)};

• Computer and network security capacity building grants, at $19,000,000/ year {§105(d)};

• Scientific and advanced technology act grants, at $2,500,000/year {§105(e)}; and

• Graduate traineeships in computer and network security, $24,000,000/year {§105(f)};

International Standards

Title II of the bill takes on a new level of importance now that the President’s cybersecurity Executive Order has been published as it addresses coordination of federal agencies working on the development of international standards “related to information system security” {§202(a)(1)}. Since the EO emphasizes the adoption of consensus international standards where practical, the US government’s participation in the development of those standards becomes more important.

No Control System Research

While “critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, water supply, banking and finance, and emergency and government services” {§2 adds to 15 USC 7401(1)} is clearly mentioned in the congressional ‘findings’ that justify the bill, there is no mention of control systems anywhere within the bill. This bill is clearly focused on the larger portion of cybersecurity, information technology.

Moving Forward

HR 2096 passed easily in the House in the last session (most of the opposition came from anti-spending Republicans) and would have passed as easily in the Senate if Sen. Reid hadn’t been so focused on passing a comprehensive cybersecurity bill. With the EO in place to take the heat off in the Senate, this bill should pass as quickly as the leadership decides to bring it to the floor.

Cybersecurity Legislation in the Lame Duck Session

Michelle Kincaid has an interesting outlook on cybersecurity legislation potential in the lame duck session in her cybersecurity blog post. While I don’t see anything in particular to disagree with, it is important to remember that political calculations change significantly in a lame duck session, making it much more difficult to successfully predict political outcomes.

While most people focus on legislators that are on their way out, who may (or may not) vote on principle instead of political motives now that they may never face the voters again, there is a new crop of Senators that are now starting into their two year election cycle; many of them will now begin paying more attention to political posturing than principle.

Legislation in the Senate

Most of the cybersecurity legislation attention is being focused on consideration of S3414. Sen. Reid (D,NV) that may bring this back to the floor for consideration this week and there is even a remote chance that it could pass in the Senate. The key stumbling block to its passage will be reaching an agreement with the Republicans on what amendments would be considered before a final vote on the bill. It is unlikely that, even if this bill does get passed in the Senate, that it will pass in the House where there is much more opposition to increasing government regulations.

Overlooked in most discussions of cybersecurity legislation is the fact that there are three bills that have already been passed in the House and are waiting for Senate action. They are

• HR 2096, Cybersecurity Enhancement Act of 2012;

• HR 3523, Cyber Intelligence Sharing and Protection Act; and

• HR 3834, Advancing America's Networking and Information Technology Research and Development Act of 2012

While the CISPA bill is more than a little controversial, the other two bills had strong bipartisan support in the House ( HR 2096 passed 395-10 and HR 3834 passed on a voice vote). While being far from comprehensive bills either of these could probably pass in the Senate if the leadership took the effort to bring them to a vote. These bills may provide Reid with a way of saying that the Senate dealt with cybersecurity legislation in this session.

Legislation in the House

With no Senate passed bills to consider, the House still has one cybersecurity bill that has been reported out of committee that could be considered on the floor with minimal effort; HR 3674, the PRECISE Act of 2012. This bill is actually the closest thing to a House counterpart to S 3414 in that it actually provides VERY limited authority for DHS to regulate cybersecurity in critical infrastructure. This could probably pass a House floor vote without any real problem, but it is too late for this to make it through the Senate as well.

If this bill had been passed in the regular session (and it was put on the house calendar back in July and then ignored) it would have provided a more useful discussion tool for Senate consideration of cybersecurity. It actually would form a pretty good basis for the executive order that is reportedly being worked on by the Administration.

If Rep. Lungren (R, CA) is returned for the 113^th Congress (the vote count has still not been certified and is trending against him) then I would expect to see this bill re-introduced in January.

S 3414 May Still Be Alive - Cybersecurity

Two different news organizations (TheHill.com and RollCall.com) are reporting that Sen. Reid (D,NV) is planning on bringing cybersecurity legislation back to the floor of the Senate when the body returns for their lame-duck session after the election. As I noted in August, Reid can call for reconsideration of the cloture vote on the bill at any time that he feels that he has the votes.

Legislation vs Executive Order

Both articles tie the Reed statement to the recent speech by the Secretary of Defense warning of a cyber Pearl Harbor attack. That statement follows recent news reports that the Administration was consulting with Congress and the business community on possible provisions for an executive order on cybersecurity for critical infrastructure. It seems likely that all of these events are tied together in a plan to provide the government the authority to regulate cybersecurity.

The politics of cybersecurity legislation are complicated. First, the regulatory authority that the Administration claims is necessary to protect this country against cyber-attacks by nation-states, terrorists, or even criminal organizations can only be provided by legislation. An executive order would provide only limited authority to expand regulations in only a few industrial sectors; other sector regulations would have to be based upon voluntary compliance.

Election Calculus

Cybersecurity legislation is clearly not a presidential election issue; neither side has made any attempt to make significant political capital taking a stand on the issue. President Obama is hardly likely to publish an executive order before the election for fear of offending some of his ‘civil liberties’ supporters who object to information sharing provisions supported by the Administration.

The Administration has a slim majority of support in the Senate for S 3414, but not enough as currently crafted to be able to get past a cloture vote. An agreement on allowing votes on some key amendments may change enough votes may provide a 60 vote margin to bring the bill to a vote; a vote that would probably lead to passage of the bill in the Senate. Passage of the bill in the House, as currently written, is almost impossible; the House cybersecurity legislation religiously avoids regulating industry beyond enabling some limited information sharing provisions that require nothing of industry.

The election next month may change the calculus in both bodies of Congress. If Democrats get closer to a supermajority (a clear supermajority does not currently seem to be a possibility) in the Senate, current opposition to S 3414 may be reduced by some departing members wishing to have at least some influence on cybersecurity legislation. If the Republicans, on the other hand gain seats (especially if they break the 50 vote barrier) in the election, the Democrats will have to surrender a lot of their desires to get S 3414 passed. The agreement would have to be for more than just votes on amendments; some of the mandatory provisions would have to be changed to voluntary. Which provisions would have to be changed would depend on the number of new Republicans reporting in January and which Democrats won’t return.

The House is much more complicated. Just about the only thing that will cause a wholesale change in the approach of the Republican leadership is if they lose control of the House in the election. Any other election outcome ensures that the current leadership will at the very least have a veto power over any cybersecurity legislation that heads towards the President. Any lame-duck Senate bill will have to take this into account.

Executive Order

Any effective executive order by President Obama will have to be proceeded by an election win. A President Romney would simply sign an executive order vacating one issued by Obama long before any effective action could be taken under such an order.

An Obama win would still not ensure that an executive order would have much of an effect on cybersecurity. To be effective the administration has to write regulations that have to go through the publish and comment process. This Administration has a poor record of writing regulations, particularly in the homeland security realm. A two-year old executive order harmonizing controlled unclassified information (CUI;  Executive Order 13556) has yet to produce any regulations changing the handling of such information. That regulation would only really affect executive branch politics, not business operations; that should make it an easier sell politically.

The Administration would also have to take into consideration that any regulations that have a substantial effect on business operations would certainly face litigation on the grounds of overstepping federal authority. Even just increasing cybersecurity controls over already regulated industries would certainly face such law suits. Extending such regulations to currently unregulated industries would be a non-starter just because of the threat of law suits. It has been made clear that even information sharing rules are likely to be opposed on privacy and free speech grounds.

Way Forward

There is a possibility that the Obama Administration could craft, with the help of the Republican leadership in the House a minimalist cybersecurity bill modeled on the House passed HR 2096. The House might acquiesce to limited cybersecurity regulations on the electric industry; the one industry that almost everyone has been mentioning as being at risk (shows how ‘everyone’s’ imagination is so limited). If they can get the House Republicans onboard, then they can probably convince the Senate.

One thing that all of the politicians have just about missed in their discussions is that there is a significant difference between IT and ICS cybersecurity. Any bill that really tries to address critical infrastructure cybersecurity must clearly differentiate between the two and write specific requirements for both types of security programs.

Cybersecurity Week Votes – Friday

The House closed out their Cybersecurity Week Friday by passing two more cybersecurity bills. Both dealt with research issues and one may actually have a minimal impact on control system security issues. HR 2096, the Cybersecurity Enhancement Act of 2011, passed by a vote of 395-10; certainly a bipartisan vote, especially since all of the ‘Nays’ were Republican. HR 3834, the Advancing America’s Networking and Information Technology Research and Development Act of 2012, passed by a voice vote.

Cyber-Physical Systems

HR 3834 introduces the term ‘cyber-physical systems’ to describe a wide range of control and monitoring systems. These systems are added to the list of research topics addressed in amends the High-Performance Computing Act of 1991. Unfortunately this act does not provide any specific funding for these research priorities so the money has to come out of existing priorities.

Oh well, control systems are now at least considered in a piece of cybersecurity legislation.

Moving Forward

As I mentioned yesterday, neither of these bills is in any way controversial, they don’t cost any real money, so they can be expected to be passed relatively easily in the Senate. They will also allow everyone to point to them as proof that the Congress takes cybersecurity seriously and has actually done something about it.

Having accomplished so much this week both the House and Senate will take a previously scheduled two-week recess.

Congressional Hearings – Week of 4-23-12

This is going to be an interesting week with Cybersecurity Week finally coming to the House, unfortunately ICS security is not on the agenda. The Lungren bill (HR 3674) is not currently scheduled to be considered, but if the report is filed in time, it may still make it to the floor this week. Two budget hearings round out the offerings that might be of interest to the chemical-security and cyber-security communities.

Cybersecurity Week

The first day of the House week (Tuesday) cyber-week will start off with a hearing before the House Homeland Security Committee’s Subcommittee on Oversight, Investigations and Management entitled; “America is Under Cyber Attack: Why Urgent Action is Needed”. It certainly sounds appropriate if just a tad bit ironic as we have been waiting for congressional action for some time.

Interestingly, this hearing is just two days away and there are still not any witnesses listed on the Committee web site. Dale Peterson took advantage of that fact last week to do an interesting piece on DigitalBond about the types of witnesses he would like to see appear before this panel. I added my two cents worth, but both Dale and I know (and so do most other observers) that we will just see the typical witnesses that we always see and that doesn’t include anyone from the industrial control system trenches.

While the House gets ready on Thursday to start actual consideration of cybersecurity legislation there is one last cyber-threat hearing with an interesting twist. The the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the House Homeland Security Committee will be holding a hearing on the Iranian Cyber Threat to the U.S. Homeland. I must have missed the one about the Russian mafia cyber-threat and the Chinese cyber-threat.

Oh, yes. No witness list for this hearing either.

The main point of Cybersecurity Week is, of course, to pass cybersecurity legislation. Starting on Thursday this week the full House will consider:

H.R. 2096 - Cybersecurity Enhancement Act of 2011, as amended
H.R. 3834 - Advancing America's Networking and Information Technology Research and Development Act of 2012
H.R. 4257 - Federal Information Security Amendments Act of 2012

H.R. 3523 - Cyber Intelligence Sharing and Protection Act, Rules Committee Print

The first three will be considered ‘under suspension of the rules’. This is an abbreviated debate process to be used on bills that the leadership is sure will pass. It takes a 60% vote to pass a bill under this procedure so it isn’t a process taken lightly by the leadership.

The controversial cybersecurity bill, HR 3523, is planned to come to the floor starting Thursday with a probable vote on Friday. This bill will be considered under a rule that will allow for at least some floor amendments. The Rules Committee has not yet set the date and time for the hearing where the rule will be developed but they have set the deadline for submitting amendments for Tuesday afternoon.

Budget Hearings

Two different hearings this week will look at different versions of the FY13 Energy and Water Development Appropriations Bill.  On Tuesday the Senate Appropriations Committee’s Labor, Health and Human Services, and Education, and Related Agencies Subcommittee will be doing their markup of the as of yet unnumbered Senate bill. The House Appropriations Committee is a little further along in the process with their bill; they will be holding a full Committee markup on Wednesday.

HR 2096 Reported in the House – Cybersecurity

The House Science, Space and Technology Committee report on HR 2096, the Cybersecurity Enhancement Act of 2011, was published by the GPO late last week. The actual markup was conducted back in July, but the bill was not formally reported until October 31^st. The bill is now available for action by the House.

This bill is essentially a funding authorization bill for a number of research related programs to enhance information security. In many cases it authorizes programs that expired in 2007; some at higher funding levels but some at much lower levels.

As I noted in my blog post about the introduction of this bill there is a brief mention in §102(1) of critical infrastructure, but there is not a single mention of control systems in the bill. Oh well, it is a cybersecurity bill, just not one that will be of much help to the control system security community.

Cybersecurity Markup – HR 2096

Well, it really did have to happen sooner or later, a congressional committee is actually going to take some action on a cyber security bill. According to the Science, Space and Technology Committee web site, there will be a full committee markup of HR 2096, the Cybersecurity Enhancement Act of 2011 on Thursday, July 21st.

This will probably be a real yawner for control system security personnel. As I noted in my earlier blog about the introduction of this bill:

“While the findings section of this bill specifically mentions “critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, [and] water supply” {§102(1)} there is not a single mention of control systems in the bill. The clear focus of this bill’s studies, research programs and grant programs remains the conventional cyber security areas of information technology, information and identity assurance, and networking systems.”

I suppose that we can always hope.

S 1152 Introduced – Cybersecurity R&D

Last week Sen. Menendez (D, NJ) introduced S 1152, the Cybersecurity Enhancement Act of 2011. This is a companion bill to HR 2096 that I discussed in an earlier blog. This means that it identical to HR 2096 and theoretically allows for simultaneous consideration of the bill in both the Senate and the House, allowing for earlier passage of one of the two bills.

NOTE: The delay in this post is due to the fact that the GPO just published a copy of S 1152 today.

HR 2096 Introduced – Cyber Security R&D

Last week Rep. McCaul (R, TX) introduced HR 2096, the Cybersecurity Enhancement Act of 2011. The bill would amend the existing provisions of High-Performance Computing Act of 1991 (15 U.S.C. 5511) and the Cyber Security Research and Development Act (15 U.S.C. 7401) to advance cybersecurity research, development, and technical standards.

While the findings section of this bill specifically mentions “critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, [and] water supply” {§102(1)} there is not a single mention of control systems in the bill. The clear focus of this bill’s studies, research programs and grant programs remains the conventional cyber security areas of information technology, information and identity assurance, and networking systems.