HR 2670 Conference Report Agreed to in House – 2024 NDAA

After the Senate agreed to the conference report on HR 2670 yesterday by a vote of 87 to 13, today the House took up the Report under the suspension of the rules process. After about 50 minutes of debate, the House also agreed to the Report by a vote of 310 to 118. The Nay votes came from the outer fringes of both parties. The bill, with the revised language from the confernece report, now goes to the President for signature, he is expected to sign the bill, probably early next week.

At the end of the debate in the House, Rep Roy (R,TX) took one last effort to stop the bill by moving to adjourn. The vote on that motion failed by a vote of 27 to 307, with 103 people not voting. The move delayed the final vote on the bill by a little over 20 minutes.

While the vote was bipartisan (on both sides of the issue), the majority of the Yeas came from Democrats (163 to 147) and the majority of the Nay votes came from Republicans (73 to 45). The leadership could not have passed the bill under regular order because there would not have been enough Republican votes to adopt the rule for the consideration of the Report. It remains to be seen if there will be a price to be paid by Speaker Johnson for using Democrats to pass the bill. 

Committee Hearings – Week of 12-10-23

This week, with both the House and Senate in Washington (scheduled last week of the year for both), there is a relatively light hearing schedule as visions of sugarplums dance in congressional heads. Two oversight hearings of note here: Cyber Safety Review Board and BIS.

CSRB Oversight

On Thursday, the Senate Homeland Security and Government Oversight Committee will  hold a hearing on “The Cyber Safety Review Board: Expectations, Outcomes, and Enduring Questions”. No witness list is currently available. It will be interesting to see who gets questioned by the Committee. The CSRB members are a diverse group of government and private sector personnel, and I am sure that the Committee staff could find any manner of other commentators willing to discuss what the CSRB is and/or should be.

BIS Oversight

On Tuesday, the Subcommittee on Oversight and Accountability of the House Foreign Affairs Committee will hold a hearing on “Reviewing the Bureau of Industry and Security, Part II: U.S. Export Controls in an Era of Strategic Competition”. The witness list includes:

• Matthew S. Axelrod, DOC, and

• Thea D. Rozman Kendler, DOC

Interestingly, both of these witnesses are titled “Assistant Secretary for Export Enforcement” working at the Bureau of Industry and Security. For an agency that is supposedly understaffed and underfunded, this a heavy political-appointee load. Written testimony from both witnesses is already available (here and here). Nothing in either testimony discussing the cybersecurity export-controls issues that initially drew my attention to BIS, but BIS rulemakings are sure to have a continued impact on the cybersecurity and control system engineering communities.

On the Floor

The House is scheduled on Tuesday or Wednesday to take up the conference report on HR 2670, the FY 2024 National Defense Authorization Act. The Senate will probably do the same. In both bodies a small number of Republicans oppose the revised version of the bill for ideological reason, and passage is not guaranteed (though appears likely) in either body.

Neither body has any spending bills on the agenda for this week, the House still lacks five of the 12 spending bills and the Senate 9 of the 12. Lots of behind-the-scenes politicking going on, a lot like we see every year. Time constraints and politics may mean an omnibus bill even yet. The Republican fringe in both bodies will have a fit, but the problem is largely of their making due to their blocking of consideration of spending bills.

Review - Conference Report for HR 2670 Published – 2024 NDAA

Yesterday, the conference committee for HR 2670 published their report on HR 2670, the 2024 National Defense Authorization Act. The report includes a listing of sections from the House and Senate versions of the bill that were included (and excluded) in the final version of the bill. The 3000+ page Report also includes the actual text of the bill. In addition to the NDAA provisions the final version includes the State Department and Intelligence authorization bills.

Moving Forward

The Report is currently (tentatively) scheduled to be considered by the House next week. The House.gov website notes that the bill will be considered under the suspension of the rules process (limited debate, no floor amendments, and a super-majority would be required for passage).

Commentary

Typically (but certainly not always) conference reports are considered under a closed rule. This too limits debate, and prohibits consideration of miscellaneous amendments, but only requires a simple majority for passage. The reason for this is almost certainly to do with opposition to the revised version of the bill by some of the more fringe elements of the Republican caucus. First off, those folks hold an effective veto power (three votes per the deal that McCarthy made to become the Speaker last January) in the House Rules Committee, so they could potentially stop the approval a rule. Then, if a rule were approved, it would take only three Republicans voting against the rule on the floor of the House (the opposition party by tradition votes against rules) to stop the House from considering the Report.

The House (and Senate) leaderships expect that there will be sufficient bipartisan support for the bill to be passed in both bodies. This means that, once again, the Republican leadership is counting on support from Democrats to pass an important piece of legislation. While this bill is not as important to fringe elements of the party as spending bills, it is still likely to draw the ire of at least a segment of that fringe. What that means for future political operations in the House remains to be seen.

For more details about the cybersecurity provisions included (and excluded) in the final version of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/conference-report-for-hr-2670-published - subscription required.

Committee Hearings – Week of 11-27-23

This week the House and Senate return from their Thanksgiving recess. There is a relatively light hearing schedule, with only two hearings of potential interest here. First an NDAA conference committee hearing and second a cybersecurity hearing.

NDAA Hearing

Listed on the Senate hearing schedule page, the conference committee on HR 2670 will meet on Wednesday. No official listing of what is scheduled, but Wired.com is reporting:

“The House and Senate passed their own versions [HR 2670 and S 2226, both removed from paywall] of the NDAA this summer, and a conference of top lawmakers had been tasked with consolidating the two bills. Currently, however, only a few top lawmakers know what the bill’s final text will say. The remaining conferees expect to receive a copy of the NDAA as early as Wednesday, but may have less than a day to parse what is typically over 1,000 pages of text. Party leaders will expect at least half of the conference to sign off on the bill quickly and send it to the House and Senate floor for a vote.”

Cybersecurity

On Wednesday the Cybersecurity, Information Technology, and Government Innovation Subcommittee of the House Oversight and Accountability Committee will hold a hearing on “Safeguarding the Federal Software Supply Chain”. The witness list includes:

• Jamil Jaffer, George Mason University,

• James Lewis, Center for Strategic & International Studies, and

• Roger Waldron, The Coalition for Government Procurement

According to the Committee memo on the hearing, this will focus solely on IT cybersecurity supply chain issues.

Review - HR 5786 Introduced – NNSA Cybersecurity

Last month, Rep Carbajal (D,CA) introduced HR 5758, a bill to establish in the National Nuclear Security Administration (NNSA) a Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group. The bill would amend Subtitle A of title XXXII of the National Defense Authorization Act for Fiscal Year 2000 (PL 106–65) adding a new §3222, Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group. It would require the establishment of a Working Group to “prepare a comprehensive strategy for inventorying the range of National Nuclear Security Administration systems that are potentially at risk in the operational technology and nuclear weapons information technology environments, assessing the systems at risk, and implementing risk mitigation actions.” No new funding is authorized by the legislation.

Moving Forward

Carabajal and his two cosponsors {Rep Bacon (R,NE) and Rep Gallagher (R,WI)} are all members of the House Armed Services Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see this bill considered in Committee. I see nothing in this bill that would engender any organized opposition. I suspect that it would receive substantial bipartisan support in Committee, enough bipartisan support for the bill to move to the floor of the House under the suspension of the rules process. That would allow for limited debate and no floor amendments, but it would require a supermajority for passage.

Substantially the same language as is found in this bill was included as §3113 of HR 2670, the NDAA for 2024, as passed in the House, but it was not included in the version of the bill passed in the Senate. Carabajal apparently has concerns about the provisions being included in the version of the bill that will eventually be reported by the conference committee. In any case, I do not expect any action to be taken on this bill until HR 2670 comes back to the House.

 

For more details about the provisions of this legislation, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5786-introduced - subscription required.

Review - S 2153 Introduced – Cybersecurity Reserve Response

In June, Sen Peters (D,MI) introduced S 2153, the Defense Support for Cyber Emergencies Response Act. The bill would amend 10 USC 12304, to specifically allow DOD to recall “any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit, or any member of the Individual Ready Reserve” to respond to certain cyber incidents. No funding is authorized by the legislation.

Moving Forward

Peters is a member of the Senate Armed Services Committee to which this bill was assigned for consideration. This means that there should be sufficient influence to see this bill considered in Committee. Since the provisions of this bill have been include (§522) in the version of HR 2670, the FY 2024 NDAA, passed in the Senate, no further action is expected on this bill unless §522 does not make it into the final version of the bill approved out of conference.

 

For more details about the provisions of the legislation, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2153-introduced - subscription required.

Review - S 2226 Introduced in Senate – FY 2024 NDAA

Last week Sen Reed (D,RI) introduced S 2226, the National Defense Authorization Act for Fiscal Year 2024. This is the Senate version of the annual ‘must past’ defense authorization bill. The Senate Appropriations Committee published their report on the bill. Most cyber issues in the bill relate specifically to military missions, but there are cybersecurity provisions that may have wider impact, both in the bill and in the Report.

Moving Forward

The Senate is scheduled to begin consideration of the bill today. A large number of amendments have been proposed, but it is too early to determine which amendments will actually be considered in the Senate. I will be looking at those amendments in separate posts.

The House passed their version of the legislation (HR 2670) last week. This bill is substantially different from that version, and it will be further amended in the Senate this week (and possibly next). A conference committee will be formed to iron out the multiple differences between the two bills, producing a consensus version that hopefully could pass in both bodies sometime after the summer recess (and hopefully before the end of the calendar year).

 

For more details about the cybersecurity provisions in the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2226-introduced-in-senate - subscription required.

HR 2670 Passed in House – FY 2024 NDAA

Earlier today, the House completed action on H 2670, the FY 2024 National Defense Authorization Act by a near party-line vote of 219 to 210. The action was taken after a number of additional amendments were considered. Four Democrats voted for the bill and four Republicans voted against it.

While there has been mention in the press (see here for instance) that some of the more radical provisions added to the bill in the amendment process would make the bill harder to pass. There was never any doubt that Democrats would not be supporting the bill, but many people apparently thought that there would be some sort of moderat Republican groundswell against the bill. That never made any sense since the votes of those same moderates were necessary to pass each of the amendments that many commentors found objectionable.

There were a number of instances where moderate Republicans did join with Democrats to reject some of the more radical amendments. For example (votes from yesterday):

• An amendment, offered by Rep Greene (R,GA) (#48 printed on page 83 of H Rept 118-142) to prohibit cluster munitions or cluster munitions technology be sold or transferred to Ukraine. Failed by recorded vote: 147 - 276, 2 Present.

• An amendment, offered by Rep Gaetz (R,FL) (#52 printed on page 87 of the Report) to prohibit federal funds for training on diversity, equity, and inclusion. Failed by recorded vote: 210 – 221.

• An amendment, offered by Rep Biggs (R,AZ) (#55 printed on page 91 of the Report) to exempt defense related activities from the Endangered Species Act. Failed by recorded vote: 193 – 237.

The Senate will take up S 2226, the Senate version of the NDAA, next week. Even ignoring some of the more controversial amendments passed yesterday, the Senate version will be significantly different than the version of HR 2670 passed today. The differences between the two bills will be ironed out later this summer (hopefully) in a conference committee, the idea being that the revised NDAA produced in conference would be passable in both the House and Senate.

BTW: The Colorado Gazette is reporting that Rep Greene is going to be appointed to the conference committee for the NDAA. They note: “Greene said McCarthy offered her this spot in exchange for her vote on the NDAA.”

HR 2670 Considered in the House – 7-13-23 – FY 2024 NDAA

Yesterday the House continued their consideration of HR 2670, the FY 2024 National Defense Authorization Act. The consensus actions of the previous day were done, with the House grinding through Amendment 62 (of the 80 amendments approved by the House Rules Committee). While most of the amendments passed or failed by near party-line votes, there were a number of instances where minorities of either party switched their support for amendments.

The House adjourned at 11:32 pm EDT and will resume consideration today.

The Senate is preparing to consider S 2226, their version of the NDAA with a large number of amendments already introduced. The two versions of the bill will be significantly different and will have to be resolved in conference. Most of the more radical amendments agreed to yesterday in the House will almost certainly be stripped from the version reported out of conference. The House will need significant Democratic support for the reported bill to be able to be passed.

NOTE: Corrected date in Title to reflect date of actions in the House - 2154 EDT 7-14-23

HR 2670 Considered in House – 7-12-13 – FY 2024 NDAA

Yesterday, the House began consideration of HR 2670, the FY 2024 National Defense Authorization Act. With one exception, the House considered each of the 290 amendments approved for consideration by the House Rules Committee in a series of five en bloc debates and votes. All except the amendments in en block #5 were adopted by voice votes. A recorded vote on the fifth block of amendments was requested and postponed until today.

The one exception was amendment #60. That amendment would have expanded the parole in place provisions of 8 USC 1182 (as amended by §1758(c) of the 2020 NDAA, PL 116-92) to include honorably discharged members of the armed forces. The action prohibiting consideration of this amendment was taken during the debate of H Res 582, the Rule for consideration of HR 2670. The vote on that action was approved on a party-line vote of 215 to 201.

The move to delay a vote on en bloc #5 was a procedural move to allow the House Rules Committee to meet to consider a second rule for the continued consideration of HR 2670 today. That meeting ended early this morning with a new rule that will be introduced today. That rule would make in order an additional 80 amendments including many controversial amendments that would not generally be amenable to en bloc consideration.

There is one amendment in the new batch that is of specific interest here, Amendment #74 which would establish a National Digital Reserve Corps in the General Services Administration. This is similar to the provisions of HR 4818.

Amendments for Consideration of HR 2670 – FY 2024 NDAA

Yesterday, the House Rules Committee met to prepare the Rule for the consideration of HR 2670, the FY 2024 National Defense Authorization Act. They formulated a structured rule with one hour of general debate and specified which of the 1556 amendments that has been proposed to the Committee could be offered during the consideration of the bill. Amendments are allocated 10 minutes for debate, except when amendments are offered en bloc, then 40 minutes is allocated for all the amendments in that block. There are going to be late nights in the House.

In addition to the change in debate limits, this rule changes the way amendments are listed. Typically they are listed in a table with links to separate amendment documents. For this bill the amendments printed in toto in four separate report documents:

Part I – Amendments 1 thru 48,

Part II – Amendments 49 thru 120,

Part III – Amendments 120 thru 208,

Part IV – Amendments 209 thru 290

Interestingly, these four documents are not searchable with my PDF reader, so I will not be able to provide a list of the cybersecurity related amendments.

Review - HR 2670 Reported in House – FY 2024 NDAA

Last month the House Armed Services Committee completed their work on HR 2670, the National Defense Authorization Act for FY 2024. The amended version of the bill was ordered reported favorably by a strongly bipartisan vote of 58 to 1. The Committee also published their Report on the bill. Cyber warfare provisions abound in the bill (in Title XV, Cyberspace-Related Matters, in particular), but there are five cybersecurity related sections, and four cybersecurity mentions in passing in the bill. Additional cybersecurity discussions are found in the Committee Report.

Moving Forward

This is one of the ‘must pass’ bills that Congress takes up every year. Even in this highly polarized session, the House Armed Services Committee has managed to produce a bipartisan consensus around this bill and report. There is only one relatively minor issue raised in the ‘Additional Views’ (pg 632) portion of the Report.

It looks like the House will take up this bill sometime next week. The House Rules Committee called for proposed amendments for this bill with a deadline of June 30^th. No meeting date is currently listed, but I expect that the meeting will most likely take place on Tuesday, July 11^th, the first day the House is back in session. To date 1426 amendments have been proposed by members and I expect more to slide in this week. Seventeen of those current amendments deal with cyber issues, but we will have to wait and see which ones make to the floor for consideration.

 

For more details about the cybersecurity provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2670-reported-in-house-fy-2024 - subscription required.

Bills Introduced – 4-18-23

Yesterday, with both the House and Senate in session, there were 66 bills introduced. One of those bills will receive additional attention in this blog:

HR 2670 National Defense Authorization Act (NDAA) for Fiscal Year 2024 Rogers, Mike D. [Rep.-R-AL-3]

While the ‘text’ of this bill is currently available, it is just the vaguest outline of the final bill with just the opening section of three Titles provided. The House Armed Services Committee and its various subcommittees will be fleshing out the details of the bill in hearings over the coming weeks. Only when that process is complete will we know what the final version of the bill will be that will come to the floor of the House for consideration. And then the amendment process will begin. The NDAA process is probably the most inclusive (from a member’s perspective) process for a major piece of legislation in the House. And this makes it one of the most bloated pieces of legislation outside of the spending bills that Congress routinely passes every year.

If the Republicans are going to fulfill their promise of limiting bills to a single purpose this bill will be a main target for their efforts. It will not change, there are just too many options for adding boondoggles, both funding and policy, in this process. Having said that, I expect there to be some major Republican infighting over this fattening up process between now and when this bill comes to the floor of the House. And they may have problems passing an NDAA this year.