S 278 Introduced – Cybersecurity Research

Earlier this month Sen. Daines (R,MT) introduced S 278, the Support for Rapid Innovation Act of 2017. The bill would require the DHS Science and Technology Directorate to support the research, development, testing, evaluation, and transition of cybersecurity technologies.

Cybersecurity Research

The bill would add a new §312, Cybersecurity Research and Development, to Title III of the Homeland Security Act of 2002 (6 USC 181 et seq). The new section outlines a number of areas of cybersecurity research, including {§321(b)}:

• Advancing the development and accelerating the deployment of more secure information systems;

• Improving and creating technologies for detecting and preventing attacks or intrusions;

• Improving and creating mitigation and recovery methodologies;

• Assisting the development and supporting infrastructure and tools to support cybersecurity research and development efforts;

• Assisting the development and support of technologies to reduce vulnerabilities in industrial control systems [emphasis added];

• Assisting the development and support cyber forensics and attack attribution capabilities;

• Assisting the development and accelerating the deployment of full information lifecycle security technologies to enhance protection, control, and privacy of information to detect and prevent cybersecurity risks and incidents;

• Assisting the development and accelerating the deployment of information security measures, in addition to perimeter-based protections;

• Assisting the development and accelerating the deployment of technologies to detect improper information access by authorized users;

• Assisting the development and accelerating the deployment of cryptographic technologies to protect information at rest, in transit, and in use;

• Assisting the development and accelerating the deployment of methods to promote greater software assurance;

• Assisting the development and accelerating the deployment of tools to securely and automatically update software and firmware; and

• Assisting in identifying and addressing unidentified or future cybersecurity threats.

The bill also specifies that no additional funding is provided to support these research efforts. It closes by noting that {§2(c)}: “Such requirements shall be carried out using amounts otherwise authorized.”

Moving Forward

Daines is a member of the Senate Homeland Security and Governmental Affairs Committee, the committee to which this bill was assigned for consideration. This means that there is at least the potential that the Committee will consider this bill. If the bill were considered, it is likely that it would be approved since there are no new regulations or spending authorized by the bill. Similarly, if the bill were to make it to the floor of the Senate, it would likely pass. It is too early to tell if there is the necessary political will to advance this bill.

Back on January 10^th the House passed HR 240 by a voice vote with limited debate. HR 240 is a companion bill to S 278 according to the introductory speech (pgs S 657-8) by Daines. There was no committee action on HR 240 in the House Homeland Security Committee.

Commentary

It is a good thing that industrial control systems are specifically mentioned in the bill since the bill relies on the IT limited definition of ‘information system’ both in the bill {new §312(e)(4)} and as a part of the support for the definition of the term ‘incident’ {new §312(e)(4)}. That information system definition is found in 44 USC 35002(8).

Given the funding limitation in this bill and the long list of cybersecurity research activities to be supported, it is extremely unlikely that the bill will result in any new significant cybersecurity research support. But passing the bill would make it look like Congress is doing something; appearances are everything.

House Accepts Senate Version of HR 240

Earlier today the House accepted the Senate version of HR 240 in an unusual bipartisan vote of 257-167; only 75 Republicans voted for the bill as did every voting Democrat. Before today’s debate on the bill could start the conservative Republicans lost a procedural move to stop the consideration of the bill by a vote of 140-278.

The bill will go to the President who has indicated that he will sign the bill, so the Homeland Security funding issue has been resolved for this fiscal year. It will be interesting to see if the FY 2016 budget and spending bill suffer the same sort of problems.

There will almost certainly be repercussions within the Republican caucus for the leadership’s failure to get cohesive action on a major bill of this sort. It is probably too early to see any changes in the leadership, but unless something happens to change things the likelihood of those changes happening is going to increase.

Senate Passes Amended HR 240 – House Disagrees

Earlier today the Senate adopted a clean version of HR 240 by a vote of 68 to 31; all 31 nay votes were from conservative Republicans. Just now the House voted (228 to 191) to disagree with the Senate amendment to HR 240 and to request a conference. It is unlikely that there will be a resolution to the disagreement on HR 240 today.

Meanwhile, the House debated HJ Res 35 and is now waiting for the leadership to call for a vote on that measure that would extend the current DHS funding until March 19^th. The Senate is currently in recess subject to the call of the Chair waiting to take up either HR 240 or HJ Res 35.

Committee Hearings – Week of 2-22-15

The House and Senate will both be back in town this week after spending some time in their districts. There will be a number of budget hearings, but only one of specific interest to readers of this blog; the Coast Guard budget. Cybersecurity will be an additional topic this week as will DHS performance and domestic terrorism.

Coast Guard Budget

The House Transportation Committee’s Subcommittee on Coast Guard and Maritime Transportation will be holding a hearing on Wednesday to look at the President’s budget proposal for Coast Guard spending in FY 2016. This will almost certainly be a ‘high-level’ review with little probability of chemical safety or security being mentioned, much less discussed in any detail.

Cybersecurity Information Sharing

On Wednesday the House Homeland Security Committee will be holding a hearing on “Examining the President’s Cybersecurity Information Sharing Proposal." Administration witness from DHS will be heard and there will be a report from the Congressional Research Service (CRS).

Watch the questioning at this hearing to see how close the two sides are achieving a consensus on the information sharing issue. Pay careful attention to see if Congress may take a wait and see response to the President’s actions as a way to avoid action on legislation this year.

DHS Oversight

The House Homeland Security Committee’s Subcommittee on Oversight and Management Efficiency will be holding a hearing on Thursday looking at “Assessing DHS’s Performance: Watchdog Recommendations to Improve Homeland Security.” No witness list has been published, but I suspect that it will be academics and think tanks.

There is a slight chance that the pending changes to the CFATS program will be mentioned, but, if it is, there won’t be many details discussed.

Domestic Terror Threat

Subcommittee on Crime, Terrorism, Homeland Security, and Investigations of the House Judiciary Committee will be holding a hearing on Thursday looking at “ISIL in America: Domestic Terror and Radicalization.” There is no witness list currently available.

There might be a passing mention of cybersecurity, but almost certainly nothing about chemical security.

On The Floor

The 800 lb gorilla this week is the Friday deadline to pass the FY 2015 spending bill for the Department of Homeland Security. The House passed HR 240 last month, but the Senate has not been able to overcome Democratic opposition to the immigration riders to actually be able to start debate on the measure. At least one more attempt will be made to get cloture on this bill this week.

There is an interesting indication that the House expects to see a revised version of HR 240 come back to the House for a vote this week. The Majority Leader’s web page mentions ‘possible consideration of HR 240’ later in the week. If the Senate can’t bring the bill to the floor in that body this week, there may be a short term continuing resolution coming out of the House.

There is always the possibility, however, that both sides will expect the other side to get the blame for a shutdown and thus let the whole matter slide past Friday. Most of DHS will continue working for ‘national security’ reasons, though it will be ‘without pay’ (back-pay for those that had to work would probably be included in the final bill that does eventually get worked out). The CFATS program would not, however, be covered under that provision.  Chemical security inspectors would not get paid, but they could spend the time with their families.

Committee Hearings – Week of 2-1-15

The number of hearings being conducted this week is on the increase, especially on the Senate side of the building. There are three hearings that may be of specific interest to the readers of this blog; one physical security and one cybersecurity.

Facility Access

The Transportation Security  Subcommittee of the House Homeland Security Committee will be holding a hearing on Tuesday on “A Review of Access Control Measures at Our Nation’s Airports.” The current witness list includes:

Mr. Mark Hatfield  - TSA, DHS

Mr. Gary D. Perdue - FBI

Ms. Sharon Pinkerton – Airlines for America

Mr. Miguel Southwell – Hartsfield-Jackson Atlanta International Airport

Airports share a common problem with large chemical facilities, how to control access through multiple gates in a very long perimeter. There will not be a lot of specifics about security measures discussed here, but the questioning may give some insight on how the new Congress will be looking at security issues.

Cybersecurity Issues

The Senate Commerce, Science and Transportation Committee will be holding two hearings this week on cybersecurity issues. The first hearing will be on Wednesday and it will look at “Building a More Secure Cyber Future: Examining Private Sector Experience with the NIST Framework”. The second hearing will be on Thursday on “Getting it Right on Data Breach and Notification Legislation in the 114th Congress”. There are no witness lists currently published for either hearing.

It will be interesting to see how the conflict between the Commerce Committee and the Senate Homeland Security and Governmental Affairs Committee will play out in the Republican controlled Senate. One of the problems in the last couple of sessions in the Senate that lead to very little actual action on cybersecurity issues was the differing outlooks of the two committees.

Neither of these hearings will specifically address control system issues. The big picture in Congress (for the immediate future at least) will be focused on IT issues and specifically those dealing with the compromise of personal information. Any legislative proposals will reflect that focus, though there may be minor, after-thought language expanding coverage to control systems. This may cause more problems than it solves for the control system security community, we will just have to wait and see.

On the Floor

As I mentioned in two earlier posts today, there are two bills coming to the floor of the House that may be of specific interest to readers of this blog: HR 361 and HR 623. Both will be considered on Monday under the suspension of the rules provisions. This means that the House leadership expects these bills to gain enough bipartisan support to sustain a 60% vote required for passage under these rules. I expect that the votes will be much closer to 90% in favor of these two bills.

The Senate is beginning to look at HR 240, the FY 2015 DHS spending bill that passed in the House last month. There will be a first cloture vote on Monday that could lead to the actual debate on the bill. Watching the recent action on S1, the Keystone pipeline bill, I expect that we will see vigorous debate with a number of amendments offered and voted upon. There is a February 27^th deadline to get a bill to the President and we may see a short term continuing resolution while the Senate works on amending HR 240 and the two houses of Congress work out their differences on that bill.

HR 240 Details

Today the House Rules Committee published the Explanatory Statement for HR 240 provided by the House Appropriations Committee. This document is the legislative equivalent of the Conference Committee Report. It provides details on the FY 2015 DHS spending bill that are not typically found in the actual bill. It is also the document that the Congress uses to provide additional direction on how the Executive Branch is expected to spend the money that Congress allocates.

CFATS Spending

The CFATS program is too small to be directly mentioned in the DHS spending bill. It is politically sensitive enough, however, to be mentioned in the Explanatory Statement. There it rates two paragraphs on page 46. The first describes the various reports that Congress expects to receive about the progress made in this program. Interestingly, these reports are not consistent with those required under the provisions of HR 4007 (which are much more detailed). It seems as if the House Appropriations Committee Staff ignored the effects of HR 4007 when they crafted this portion of their report.

The second paragraph discusses the actual funding for the CFATS program. It explains:

“As described in the House [HR 4093; link added] and Senate [S 2534; link added] reports, NPPD's excessive use of administratively uncontrollable overtime (AUO) was inappropriate. As a result, the President's budget request for Infrastructure Security Compliance has been reduced [from $86,976,000 to $85,027]. NPPD shall brief the Committees on implementation of its new overtime policies and on overtime year-to-date and anticipated expenditures, not later than May I, 2015.”

Interestingly the original version of HR 4007 introduced in the House called for a CFATS authorization of $87,436,000 {§2110} but the authorization section was removed in Senate version.

Cybersecurity

Cybersecurity spending is spelled out in more detail in the Explanatory Statement. The table below shows the expenditures authorized on page 45 for the cybersecurity spending details for Infrastructure Protection and Information Security portion of the NPPD spending. With a single exception, this bill would reduce cybersecurity spending.

NPPD Cybersecurity Programs	Budget Request	Spending
Cybersecurity Coordination	$4,330,000	$4,311,000
US CERT Operations	$98,794,000	$98,573,000
Federal Network Security	$171,500,000	$171,000,000
Network Security Deployment	$377,690,000	$377,000,000
Global Cybersecurity Management	$17,613,000	$25,873,000
Critical Infrastructure Cyber Protection and Awareness	$70,963,000	$70,919,000
Business Operations	$5,554,000	$5,524,000
Total	$746,444,000	$753,200,000

The ‘Global Cybersecurity Management’ category is a workforce development program. The majority of the money in this category ($15,810,000) is going into spending for cybersecurity education; presumably for DHS personnel.

Office of Health Affairs

One of the other areas of DHS spending that I kind of keep an eye on is the Office of Health Affairs. This office keeps track of two interesting security related activities; BioWatch and the Chemical Defense Program. In keeping with the Congressional almost irrational fear of bio-attacks the spending on BioWatch is more than 100 times as much as is spent on the Chemical Defense Program ($86,891,000 vs $824,000). This is a truly ludicrous mismatching of funds to potential threats as it takes very little technical expertise to effect an attack on industrial chemical storage or transportation.

Bills Introduced – 01-09-15

Yesterday there were only 44 bills introduced in the House and Senate; a relatively low number for the first week of the session. There was only one that will be of specific interest to readers of this blog:

HR 240 Making appropriations for the Department of Homeland Security for the fiscal year ending September 30, 2015, and for other purposes. Rep. Rogers, Harold [R-KY-5]

As I mentioned last night the Rules Committee is meeting on this bill Monday evening and I expect that it will make its way to the floor this week. The bill will likely be on the President’s desk well before the February 27^th deadline.

Rules Committee Announces Hearing on DHS Funding Bill

This evening the House Rules Committee announced that it would hold a hearing on Monday, January 12^th to formulate the rule for the consideration of HR 240, Department of Homeland Security Appropriations Act, 2015. As expected it looks like there will be floor amendments that will be offered to counter the President’s immigration initiatives, but the bill as introduced looks quite a bit like HR 4903 from the last session.

There have been some increases in proposed funding, but in general the bill seems to be very similar to what was introduced previously. I have scanned quickly through the portions of the bill that I typically watch. The table below shows how some of the programs that might be expected to be of specific interest to readers of this blog will fare under this bill.

	HR 4903 – 113th	HR 240 – 114th
Surface Trans Security	$121,303,000	$123,749,000
Infrastructure Protection	$1,139,499,000	$1,188,679,000
BioWatch	$86,891,000	$86,891,000
Port Security Grants	$100,000,000	$100,000,000

From my point of view, of course, what is important about this bill is what is missing. For the first time in a number of years there is not a provision in the bill that will extend the current CFATS program until the end of this funding period. This is, of course, because Congress finally took the CFATS program out of this annual budget dance by passing HR 4007 last month.