Committee Hearings – Week of 07-08-18

With both the House and Senate in session this week we start to see movement on other things than just spending bills. We have two cybersecurity hearings of potential interest and HR 6237, the FY 2018/19 intel authorization bill.

Spending Bills

• Wednesday – House – Committee - Labor, Health and Human Services, Education, and Related Agencies

• Wednesday – House – Rules Committee – HR 6147 (LHHE)  Amendment Deadline

Cybersecurity

On Wednesday the House Homeland Security Committee will be holding a hearing on “DHS’s Progress In Securing Election Systems And Other Critical Infrastructure”. The witness list includes:

• Christopher Krebs, DHS; and

• Nellie Gorbea, State of Rhode Island

While securing the election process is certainly important it is generally outside of the scope of this blog. I am mentioning this hearing though because of the following statement on the hearing web site:

“The hearing will also provide Members an opportunity to hear about DHS’s role working across all 16 critical infrastructure sectors because a cyber threat to elections may pose a similar threat to other critical infrastructure sectors.”

It will be interesting to hear what questions the Committee has for Krebs.

On Wednesday the Senate Commerce, Science, and Transportation will hold a hearing on “Complex Cybersecurity Vulnerabilities: Lessons Learned from Spectre and Meltdown”. The witness list includes:

• Donna Dodson, NIST;

• José-Marie Griffiths, Dakota State University;

• Joyce Kim, ARM;

• Art Manion, Carnegie Mellon University; and

• Sri Sridharan, University of South Florida

This is potentially too complex a topic for a congressional hearing. I hope the witnesses take this into account and concentrate on policy type issues instead of the technical details. It will be interesting to see what questions are posed by the Senators; this will reflect on the quality of the technical support the committee has.

Intelligence Authorization Act

On Wednesday the House Rules Committee will hold a hearing to set the rule for the consideration of HR 6237, the Matthew Young Pollard Intelligence Authorization Act for Fiscal Years 2018 and 2019. Thirty-seven amendments have been submitted to the Committee for consideration for inclusion in the debate on HR 6237. None of those amendments should be of specific interest to readers of this blog.

Last year’s version of the bill, HR 3180, finally passed the House under a closed rule (limited debate, no amendments), but was never considered in the Senate. It will be interesting to see how the Committee deals with this bill this year. The bill is scheduled to come to the floor on Thursday.

On the Floor

In addition to HR 3180, the House will also take up HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. That bill will be considered tomorrow under the suspension of the rules process; limited debate, no amendments, and a super-majority to pass. The bill will almost certainly pass with wide bipartisan support.

As I noted in my post on S 3094, the companion bill to HR 5729, from reading the Committee Report on the bill it is clear that the impetus for proposing this bill was to ‘punish’ DHS and the Coast Guard for ignoring the dictates of Congress. That will not, however, be the basis for the wide spread support for the bill. It provides a wide variety of congress critters a chance to vote against the TWIC program (for an equally wide variety of reasons) without taking any real action to affect the program. They get a show vote for certain constituencies without having to negatively effect a security program. You cannot get a better bill for politicians.

HR 6237 Introduced – Intel Authorization

Last month Rep. Nunes (R,CA) introduced HR 6237, the Matthew Young Pollard Intelligence Authorization Act for Fiscal Years 2018 and 2019. The bill contains the two Divisions reflecting authorizations for both fiscal years. There are two reports of interest and a requirement to establish an Energy Infrastructure Security Center mentioned in the unclassified portion of the bill. Additionally, the Committee Report discusses a topic with a potential for impact on cybersecurity information sharing.

Reports

Section 1506 of the bill requires the Director of National Intelligence (DNI) to submit a report to Congress on “the potential establishment of a fully voluntary exchange program between elements of the intelligence community and private technology companies” {§1501(a)}. The report would address intelligence community (IC) to private sector and private sector to IC sharing of cybersecurity qualified personnel.

Section 1510 of the bill would require the DNI to prepare a report to Congress on how each element of the IC implements the Vulnerabilities Equities Policy and Process. The report would address who at each agency is responsible for determining whether “a vulnerability must be submitted for review under the Vulnerabilities Equities Process” {§1510(a)(1)(A)(i)} and the process used for making that determination. A subsequent report would be required when changes are made at an agency. The required report would be unclassified (but generally unavailable to the public) but, could potentially include classified annexes. Additionally, the section would require an annual classified report to congress on {§1510(b)(1)}:

• The number of vulnerabilities submitted for review under the Vulnerabilities Equities Process;

• The number of vulnerabilities described in subparagraph (A) disclosed to each vendor responsible for correcting the vulnerability, or to the public, pursuant to the Vulnerabilities Equities Process; and

• The aggregate number, by category, of the vulnerabilities excluded from review under the Vulnerabilities Equities Process, as described in paragraph 5.4 of the Vulnerabilities Equities Policy and Process document

Energy Infrastructure Security Center

Section 2422 amends 42 USC 7144b by inserting a new paragraph (d) which requires the Secretary to establish the Energy Infrastructure Security Center within the DOE’s Office of Intelligence and Counterintelligence (the old Office of Counterintelligence as revised by this bill). The EISC will coordinate and disseminate intelligence relating to the security of the energy infrastructure of the United States. This mission will include {new §7144b(d)(2)}:

• Establishing a primary organization within the United States Government for analyzing and integrating all intelligence possessed or acquired by the United States pertaining to the security of the energy infrastructure of the United States;

• Ensuring that appropriate departments and agencies have full access to and receive intelligence support needed to execute the plans or activities of the agencies, and perform independent, alternative analyses;

• Establishing a central repository on known and suspected foreign threats to the energy infrastructure of the United States, including with respect to any individuals, groups, or entities engaged in activities targeting such infrastructure, and the goals, strategies, capabilities, and networks of such individuals, groups, or entities; and

• Disseminating intelligence information relating to the security of the energy infrastructure of the United States, including threats and analyses, to the President, to the appropriate departments and agencies, and to the appropriate committees of Congress.

Committee Report

On page 48 of the Committee Report the Committee notes that “businesses without ownership of a Sensitive Compartmented Information Facility (SCIF), which includes many small businesses, find it very difficult to perform classified work”. They go on to note that “Construction and accreditation of SCIF spaces may be cost-prohibitive for small business and non-traditional government contractors.”

After briefly discussing the apparently unrelated idea of innovation hubs, the Committee suggests that such hubs might be a model to solve the problem of providing small businesses access to SCIFs. They then call for a report to Congress that addresses:

• Potential approaches to allow for SCIF spaces to be certified and accredited outside of a traditional contractual arrangement;

• Options for classified co-use and shared workspace environments such as: innovation, incubation, catalyst, and accelerator environments;

• Pros and cons for public, private, government, or combination owned classified neutral facilities; and

• Any other opportunities to support companies with appropriately cleared personnel but without ownership of a SCIF effective access to a neutral SCIF.

Moving Forward

This bill was approved by a unanimous vote of the Committee. That would normally mean that bipartisan support for the bill could be expected when the bill gets to the floor in the coming weeks. Unfortunately, as we saw with HR 3180 (the FY 2018 version of this bill) that is not necessarily true. That bill was finally passed in the House by a near party-line vote and was thus not able to receive consideration in the Senate.

This bill also contains a number of provisions (see the ‘Minority Views’ section of the Report starting on page 164) that might draw opposition from Democrats, especially in an election year. We will have to wait and see how this bill fairs on the House floor before we can predict its chance of final passage.

Commentary

The establishment of the EISC is certainly a measure of the congressional recognition of the potential foreign threats to the energy infrastructure in this country. I am concerned, however, with bill’s failure to address the need for sharing the intelligence information produced by the EISC with private sector entities responsible for the operation of that infrastructure. I suppose it could be argued that the Federal Energy Regulatory Commission (FERC) would be the appropriate agency through which that information might be expected to flow, but I still would have expected to see specific private sector information sharing requirements in the EISC language.

Of course, congressional intent to share intelligence information with appropriate private sector entities is not always successful as we have seen with the DHS automated information sharing (AIS) program. Part of that is the failure of the intelligence community to prepare unclassified briefs on intelligence information, but that is not always possible to do. The larger problem is the inability of many private sector organizations to handle classified information. This is where the Report’s attention to SCIFs may end up being more important than the Committee intended.

They were specifically looking at expanding the access to classified information to small contractors, but the larger use of non-traditional SCIFs may be for the sharing and processing of classified information by organizations that cannot justify the cost of establishing their own SCIF so that they may be able to process classified intelligence reports that may or may not be made available to them.

HR 3180 Revived – FY 2018 Intel Authorization

Last night the House Rules Committee met to establish a rule for the consideration of HR 3180 under regular order after it was rejected under the suspension of the rules process. The Committee voted on party lines to bring HR 3180 back to the floor of the House under a closed rule with a longer debate period but no opportunities to amend the bill.

This means that there was nothing done to try to change the votes of the Democrats who opposed the bill so we can expect a similar party line vote. What will be different this time is that only a simple majority will be needed for passage; the bill will almost certainly pass.

The bill will most likely be considered this afternoon.

The bill will be unlikely to be considered in the Senate under its present form. 

HR 3180 Fails in House – FY 2018 Intel Authorization

Today the House failed to pass HR 3180, the FY 2018 Intel authorization bill. It failed on a vote of 241 to 163 with a 2/3 vote (290 Ayes) being required for passage. It was a nearly party-line vote with 10 Republicans voting Nay and 30 Democrats voting Aye. The House Intelligence Committee will have to go back to the drawing board and try to craft a bill that can garner more support from the Democrats if the leadership continues to rely on passing the bill under suspension of the rules.

The other point to remember, however, is that if the bill could not garner the 2/3 vote required under the suspension of the rules process, then it likely would not be able to make it to the floor of the Senate due to the cloture vote requirement (3/5ths vote).

There were no cybersecurity provisions in this bill that would have been of specific interest to readers of this blog.

Bills Introduced – 07-11-17

Yesterday with both the House and Senate in session there were 31 bills introduced. Of those, one may be of specific interest to readers of this blog:

HR 3180 To authorize appropriations for fiscal year 2018 for intelligence and intelligence-related activities of the United States Government, the Community Management Account, and the Central Intelligence Agency Retirement and Disability System, and for other purposes.  Rep. Nunes, Devin [R-CA-22] 

As always, I will be watching this bill for cybersecurity provisions.