Cybersecurity Legislation in the Lame Duck Session

Michelle Kincaid has an interesting outlook on cybersecurity legislation potential in the lame duck session in her cybersecurity blog post. While I don’t see anything in particular to disagree with, it is important to remember that political calculations change significantly in a lame duck session, making it much more difficult to successfully predict political outcomes.

While most people focus on legislators that are on their way out, who may (or may not) vote on principle instead of political motives now that they may never face the voters again, there is a new crop of Senators that are now starting into their two year election cycle; many of them will now begin paying more attention to political posturing than principle.

Legislation in the Senate

Most of the cybersecurity legislation attention is being focused on consideration of S3414. Sen. Reid (D,NV) that may bring this back to the floor for consideration this week and there is even a remote chance that it could pass in the Senate. The key stumbling block to its passage will be reaching an agreement with the Republicans on what amendments would be considered before a final vote on the bill. It is unlikely that, even if this bill does get passed in the Senate, that it will pass in the House where there is much more opposition to increasing government regulations.

Overlooked in most discussions of cybersecurity legislation is the fact that there are three bills that have already been passed in the House and are waiting for Senate action. They are

• HR 2096, Cybersecurity Enhancement Act of 2012;

• HR 3523, Cyber Intelligence Sharing and Protection Act; and

• HR 3834, Advancing America's Networking and Information Technology Research and Development Act of 2012

While the CISPA bill is more than a little controversial, the other two bills had strong bipartisan support in the House ( HR 2096 passed 395-10 and HR 3834 passed on a voice vote). While being far from comprehensive bills either of these could probably pass in the Senate if the leadership took the effort to bring them to a vote. These bills may provide Reid with a way of saying that the Senate dealt with cybersecurity legislation in this session.

Legislation in the House

With no Senate passed bills to consider, the House still has one cybersecurity bill that has been reported out of committee that could be considered on the floor with minimal effort; HR 3674, the PRECISE Act of 2012. This bill is actually the closest thing to a House counterpart to S 3414 in that it actually provides VERY limited authority for DHS to regulate cybersecurity in critical infrastructure. This could probably pass a House floor vote without any real problem, but it is too late for this to make it through the Senate as well.

If this bill had been passed in the regular session (and it was put on the house calendar back in July and then ignored) it would have provided a more useful discussion tool for Senate consideration of cybersecurity. It actually would form a pretty good basis for the executive order that is reportedly being worked on by the Administration.

If Rep. Lungren (R, CA) is returned for the 113^th Congress (the vote count has still not been certified and is trending against him) then I would expect to see this bill re-introduced in January.

HR 3523 Rule

NOTE: Links added in first paragraph 4-26-12 05:51 EDT.

Last night (Wednesday) the House Rules Committee adopted therule for the consideration of HR 3523, the Cyber Intelligence Sharing and Protection Act (CISPA) on Thursday and Friday of this week. This will be a structured rule providing for limited debate (one hour on the bill and 10 minutes for each amendment) and allows for consideration of 16 specificamendments.

The vast majority of the amendments that will be considered on the floor of the House will deal with privacy issues; nothing surprising there.

Still No Mention of Control System Security

None of the amendments addresses control system security. There is one amendment that could be construed (with some imagination) to kind of possibly extend some of the definitions of covered ‘systems or networks’ so that an aggressive regulation writer might be able to use to justify trying to expand this bill to include control systems (did I get enough waffle words in there?). Rep. Turner’s (R,NY) amendment (#14) would add ‘deny access to’ in various definition phrases {§1104(h)}; “efforts to degrade, disrupt, or destroy such system or network”.  A denial of service attack on a control system might then be covered. The other components of that definition would not really apply to a control system attack since that attack only uses a control system network to attack the controlled physical system.

No Requirement for Feds to Share

As I noted in an earlier blog posting about this bill, there are not any provisions in the current version of the bill that would direct or require DHS or the intelligence community to share threat information with the private sector. Rep. Richardson (D,CA) has offered an amendment that almost comes close to allowing federal agencies to share information with the private sector. Her amendment (#10) would make clear that nothing in the bill would “prohibit a department or agency of the Federal Government from providing cyber threat information to owners and operators of critical infrastructure” {§1104(g)(3)}. That’s a long way from requiring such sharing.

No Requirement for Private Sector to Participate

There was never a requirement for any private entity to participate in any sharing activity under this bill. Just in case this wasn’t clearly understood, Rep. Woodal (R,GA) has proposed an amendment (#12) that specifically states that there is no liability “for choosing not to engage in the voluntary activities authorized under this section” {§1104(g)(3)}. Some people just need to ensure that voluntary means uh voluntary.

Cybersecurity Week Update II

The witness list for today’s Iranian Cybersecurity Threat hearing is not available as is a list of proposed amendments to HR 3523.

Iranian Cybersecurity Threat

Today’s hearing about the ‘growing’ Iranian cybersecurity threat has some distinguished witnesses, but as with yesterday’s hearing, none are currently in the intelligence community. We should get some interesting theoretical and political insights into the potential for Iranian attacks on critical infrastructure cyber-systems (maybe even control systems, ala retaliation for Stuxnet), but there will be no hard information about specific or credible threats that anyone will be willing or able to act upon.

The witness include:

• Mr. Frank J. Cilluffo; Associate Vice President and Director; Homeland Security Policy Institute; The George Washington University

• Mr. Ilan Berman; Vice President; American Foreign Policy Council; and

• Mr. Roger Caslow; Executive Cyberconsultant; Suss Consulting

HR 3523 Amendments

Last night was the close of acceptance of amendments that might be considered later this week during the floor action on HR 3523, CISPA. The Rules Committee web page for the bill contains a brief summary of over 40 amendments that they will review in this afternoons hearing. Depending on the type of rule they decide upon, all or some (more likely about 10) of these amendments could come to the floor for their 10 minutes of debate.

Without being able to read the actual amendments (and those are not currently available) we only have the summaries to divine what will be included, but it doesn’t look like anyone is concerned with control system security. There is a nice spread of practical to ideological amendments for the Committee to consider.

Rep. Thompson (D,MS; Ranking Member of the Homeland Security Committee) has three amendments offered; including the expected privacy issue amendment that will probably be included in the short list going to the floor. Another of his amendments  may be of more practical effect:

“Would authorize existing activities of the Department of Homeland Security for securing Federal networks and supporting private sector cybersecurity efforts. Would also put in place a framework by which the Secretary would determine which infrastructure sectors are critical to our Nation, conduct risk assessments of those sectors, develop and disseminate best practices for mitigating cybersecurity risks, and work with existing regulatory agencies of critical infrastructure to incorporate best practices into existing regulations, where necessary.”

Depending on the wording of the actual amendment this could result in some interesting regulatory changes, particularly in MTSA and CFATS regulations where DHS would have the most control.

Cybersecurity Week Update

In my blog post on Sunday night I noted that this was going to be Cybersecurity Week in the House, but there were some holes in the details. I’d like to fill in some of those now. The witness list is now available for today’s ‘America is Under Cyber Attack’ hearing and the date has now been set for the Rules Committee hearing for HR 3523, CISPA.

Witness List

The witnesses scheduled to appear before the Subcommittee on Oversight, Investigations, and Management hearing today are:

• Mr. Shawn Henry; Former Executive Assistant Director; Criminal, Cyber, Response, and Services Branch; Federal Bureau of Investigation;

• Mr. James Lewis; Director and Senior Fellow; Technology and Public Policy Program; Center for Strategic and International Studies;

• Mr. Gregory C. Wilshusen; Director; Information Security Issues; Government Accountability Office;

• Mr. Stuart McClure; Chief Technology Officer: McAfee; and

• Dr. Stephen E. Flynn; Founding Co-Director; George J. Kostas Research Institute for Homeland Security; Northeastern University.

You’ll note that none of these witnesses are active members of the intelligence community so there is almost no chance that we are going to hear any information about any actual recent attacks on critical infrastructure. To be fair even if there were cybersecurity analysts from NSA, CIA and the FBI testifying such information would not be disclosed in an open hearing; that information is all classified.

No, this will be a ‘the house is on fire we have to do something’ hearing filled with anecdotal evidence or vague descriptions of not so recent attacks. I do suspect that we will hear at least one report about attacks on the electrical grid, which will be kind of silly because none of the bills to be considered this week address any control system security issues.

A real hearing on this issue; one attempting to understand the real nature of the threat; would have to be conducted behind closed doors. It certainly would not provide any real publicity for the passage the cybersecurity bills to be voted upon later this week. While legally unlikely, it would be nice, just once, to hear a witness, a CIO or cybersecurity officer from a private company, testify about a recent actual attack on their system and what it actually cost them in terms of time, money and reputation.

HR 3523 Rule Hearing

The House Rules Committee has set Wednesday afternoon at 3:00 pm EDT as the time for their hearing to approve the rule for the consideration of HR 3523, Cyber Intelligence Sharing and Protection Act. As I mentioned in Sunday’s blog post, amendments to be considered at the hearing will need to be submitted by this afternoon.

Two proposed amendments are already listed on the Committee web site. They are:

• Rep. Paulsen (R,MN), Would encourage international cooperation on cyber security where feasible; and

• Rep. Sanchez (D,CA), Would provide guidelines for any department or agency in the Federal government who are charged with border search and seizure of electronic devices.

I expect that we will see at least one amendment proposed by Rep. Thompson (D,MS) regarding protections of civil liberties. A large number of other amendments to this controversial yet popular bill are inevitable.

Congressional Hearings – Week of 4-23-12

This is going to be an interesting week with Cybersecurity Week finally coming to the House, unfortunately ICS security is not on the agenda. The Lungren bill (HR 3674) is not currently scheduled to be considered, but if the report is filed in time, it may still make it to the floor this week. Two budget hearings round out the offerings that might be of interest to the chemical-security and cyber-security communities.

Cybersecurity Week

The first day of the House week (Tuesday) cyber-week will start off with a hearing before the House Homeland Security Committee’s Subcommittee on Oversight, Investigations and Management entitled; “America is Under Cyber Attack: Why Urgent Action is Needed”. It certainly sounds appropriate if just a tad bit ironic as we have been waiting for congressional action for some time.

Interestingly, this hearing is just two days away and there are still not any witnesses listed on the Committee web site. Dale Peterson took advantage of that fact last week to do an interesting piece on DigitalBond about the types of witnesses he would like to see appear before this panel. I added my two cents worth, but both Dale and I know (and so do most other observers) that we will just see the typical witnesses that we always see and that doesn’t include anyone from the industrial control system trenches.

While the House gets ready on Thursday to start actual consideration of cybersecurity legislation there is one last cyber-threat hearing with an interesting twist. The the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the House Homeland Security Committee will be holding a hearing on the Iranian Cyber Threat to the U.S. Homeland. I must have missed the one about the Russian mafia cyber-threat and the Chinese cyber-threat.

Oh, yes. No witness list for this hearing either.

The main point of Cybersecurity Week is, of course, to pass cybersecurity legislation. Starting on Thursday this week the full House will consider:

H.R. 2096 - Cybersecurity Enhancement Act of 2011, as amended
H.R. 3834 - Advancing America's Networking and Information Technology Research and Development Act of 2012
H.R. 4257 - Federal Information Security Amendments Act of 2012

H.R. 3523 - Cyber Intelligence Sharing and Protection Act, Rules Committee Print

The first three will be considered ‘under suspension of the rules’. This is an abbreviated debate process to be used on bills that the leadership is sure will pass. It takes a 60% vote to pass a bill under this procedure so it isn’t a process taken lightly by the leadership.

The controversial cybersecurity bill, HR 3523, is planned to come to the floor starting Thursday with a probable vote on Friday. This bill will be considered under a rule that will allow for at least some floor amendments. The Rules Committee has not yet set the date and time for the hearing where the rule will be developed but they have set the deadline for submitting amendments for Tuesday afternoon.

Budget Hearings

Two different hearings this week will look at different versions of the FY13 Energy and Water Development Appropriations Bill.  On Tuesday the Senate Appropriations Committee’s Labor, Health and Human Services, and Education, and Related Agencies Subcommittee will be doing their markup of the as of yet unnumbered Senate bill. The House Appropriations Committee is a little further along in the process with their bill; they will be holding a full Committee markup on Wednesday.

Changes to HR 3523 - CISPA

Earlier this week I noted that the Intelligence Committee report on HR 3523 had been filed and that it was available for action before the full House. On Friday both the House Rules Committee and the Majority Leader’s web sites noted that HR 3523 will probably be considered by the House starting on Thursday under a rule. The rule hearing has yet to be scheduled, but will probably be held on Tuesday night.

The House Rules Committee site provides a link to a House Rules Committee Print of HR 3523. The site notes that:

“Rules Committee Print 112-20, showing the text of the bill as reported with additional changes recommended by the Chair and Ranking Minority Member of the Permanent Select Committee on Intelligence”

Since the markup hearing for the bill was not webcast and the Intelligence Committee did not provide any details on the web site about the amendments that were adopted in the hearing we had been waiting on the Committee report to see what language would be considered by the House. Now we need to look at the version further amended by the two leaders of the Committee (more appropriately by the Committee Staff with the approval of the two leaders). I’ll try to do both here.

Committee Intent

One of the important purposes of committee reports is that it provides Congress with a chance to provide written evidence of their intent in writing the laws. Appellate Courts frequently use Congressional intent in deciding what laws actually mean or were intended to mean.

In this case the Intelligence Committee report provides a pretty succinct summary of why this bill was developed:

“The Committee determined that these issues are best resolved in the first instance by providing clear, positive authority to permit the monitoring—by the private sector—of privately-owned and operated networks and systems for the purpose of detecting cybersecurity threats and to permit the voluntary sharing of information about those threats and vulnerabilities with others, including entities within the private sector and with the federal government.”

Now there are certainly those who object to the phrase ‘positive authority to permit monitoring’, even if it is being given to the private sector rather than the government. That sums up the opposition that this bill faces and may end up killing the bill when it gets to the Senate. But that has little to do control system security.

This is another bill that never specifically mentions control systems. The closest that the committee report comes to addressing control systems issues (and it’s not very close at all) is when it talks about protecting R&D:

“The Committee believes that immediate and serious action is necessary to staunch the bleeding of American corporate research and development information and to better protect our national security.”

Not much to pin our hopes on for sharing information about control system threats, but it’s the best we have.

Changes to the Bill

Looking at the original bill, the revised text in the Committee Report, and the House Rules Committee Print there have been a number of changes made to this bill. Interestingly most of them have been made in the latest version as Rogers (R,MI) and Ruppersberger (D,MD) try to craft a version of HR 3523 that will mitigate the privacy and access controversy that could kill the bill.

One small, but important, change is the addition of two words early in the bill. In §1104(a) that is being added to the National Security Act of 1947 the words “and utilities” in the general heading section, leaving it to read:

“The Director of National Intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with private-sector entities and utilities [emphasis added] and to encourage the sharing of such intelligence.” {§1104(a)(1)}

Similar supporting changes are made throughout the newest version of the bill. All of these changes were made in the Rules Committee version. It allows the bill’s provisions to cover some utilities that are neither truly private sector or purely government agencies.

Most of the changes made to the bill are designed to restrict sharing of information to some extent. They were obviously added to respond to a number of criticisms that have been making the rounds of the social networking sites. The changes include the addition of:

§1104(a)(5) – Restriction on Disclosure of Cyber Threat Intelligence.

§1104(b)(2) – Sharing with the Federal Government.

§1104(c) – Federal Government Use of Information.

§1104(d) – Federal Government Liability for Violations of Restrictions on the Disclosure, Use, and Protection of Voluntarily Shared Information.

§1104(g)(2) - Limitation on Military and Intelligence Community Involvement in Private and Public Sector Cybersecurity Efforts.

§1104(g)(3) - Information Sharing Relationships.

NOTE: All of the above changes only showed up in the Rules Committee Print.

Unfortunately for the audience of this blog none of the changes is worded in a manner that would ensure that the information sharing requirements (and that is a loosely used word with respect to this bill) would apply to control system threat information. Of course, neither is there any indication that the US intelligence apparatus has the knowledge base to develop control system threat intelligence.

HR 3523 Reported in House

Yesterday the House Committee on Intelligence submitted their report on HR 3523, the Cyber Intelligence Sharing and Protection Act (CISPA) of 2011. The publication of HRept 112-445 cleared the bill for action on the floor of the House. It is not clear that the Republican leadership intends to bring this bill to the floor in its current form, particularly since it has attracted so much adverse attention from privacy and internet access activists. And President Obama’s recent concerns about the bill mark a move away from the bipartisan support that had been expressed earlier.

I haven’t had a chance to read the report yet. I’ll get to it tonight and see if there is anything interesting or unusual that isn’t covered in the actual language of the bill.

HR 3523 Amendments

The results of last week’s markup of HR 3523, the Cyber Intelligence Sharing and Protection Act of 2011 [NOTE: the GPO print is now available] were finally posted on the Intelligence Committee web site this weekend. I suppose since most of their hearings are classified they don’t get a lot of practice putting up ridiculously small amounts of information on their web page.

There were two amendments, neither of which made any substantive changes in the information shared by the government. To keep the industry happy about providing information to the government about security issues, they further restricted the use that the intelligence community can make of the information provided. And the second amendment requires yet another report to Congress about the success of this program.

Reporting Protections

The amendment from the Chairman and Ranking Member prohibits the federal government from using the information provided unless “at least one significant purpose of the use of the information is” cybersecurity or protection of the national security of the United States {§1104(c)(1)(B)}. Furthermore, the government is prohibited from even searching the information for a purpose other than those two; can’t have the government searching for how many bogus reports came from a single source now.

Such attention to paranoia is amazing. The bill already prohibited the government from using the material for regulatory purposes, releasing it under the Freedom of Information Act, sharing it with other entities without permission and prohibits courts from using it in liability cases based upon the reporting, or failing to report, cybersecurity information in ‘good faith’. This is much better treatment (from the point of view of the black-helicopter league) than the average citizen gets under the ‘See Something Say Something’ program.

Of course, since neither ‘cybersecurity’ nor ‘protection of the national security of the United States’ is defined in the bill, these provisions are practically speaking unenforceable. Oh well, at least the Congressmen can point to the words in the bill; as if any government words will make the black-helicopter crowd happy.

IG Report

The second amendment by Rep. Thompson, (R, CA) requires the Inspector General of the Intelligence Community (that would be an interesting job), to prepare a report to Congress on the use made of intelligence provided by the private sector. The wording of the amendment makes it clear that, once again, the main concern of the Committee is that the information provided by the private sector will not be misused by the Government.

While I certainly don’t want any God-Fearing American Citizen’s privacy or civil liberties being abused by the intelligence community, I am much more concerned about ensuring that the government intelligence community proactively shares threat information with the private sector. How about a report on the number of intelligence reports that get down to the potential targets so that they can properly protect themselves against cyber-attacks? That is what I would like to see tracked by the IG.

Bipartisan Support

The press release announcing the results of the mark-up of this bill notes that it was passed on a “decisive vote of 17-1”; though there is no word on how the two amendments were adopted. A 17 to 1 vote (even with two committee members not voting) can be assumed to be a show of bipartisan support for the bill and there is no reason that this bill couldn’t achieve the same sort of support on the floor.

I would not be surprised, however, if this bill gets rolled into whatever general cyber-security bill makes it to the floor of the House in January.

Markup of HR 3523

Yesterday the House Permanent Select Committee on Intelligence held a markup hearing for HR 3523, the Cyber Intelligence Sharing and Protection Act of 2011 (NOTE: GPO copy is now available). It wasn’t a closed hearing, but there is no record of what was done, nor is a copy of the video of the hearing available on their web site; just a listing of the hearing. I noted that this would probably happen in yesterday’s blog on the introduction of this bill. Well, we’ll just have to wait until the Committee report is published; assuming of course that the bill was approved in yesterday’s meeting (almost certainly).

HR 3523 Introduced – Cybersecurity Intelligence Sharing

Yesterday Rep. Rogers (R,MI) introduced HR 3523, the Cyber Intelligence Sharing and Protection Act of 2011 (Note: the text of the bill is not yet available on the GPO site, but it is available on Thomos.LOC.gov but there are no permanent links on that site) [Here is the link to the bill text - http://t.co/EodFJriz; Thanks to Chris Jager for info on how to get permanent link on Thomas.loc.com; Updated 07:57 CST]. The bill would require the Director of National Intelligence (DNI) to “establish procedures to allow elements of the intelligence community to share cyber threat intelligence with private-sector entities and to encourage the sharing of such intelligence” {§1104(a)(1)}.

New Class of Disclosure

Current law already allows sharing of intelligence information, at the discretion of the intel community, with people in the private sector with the appropriate Need-To-Know and the proper security clearance. This bill would expand that discretion and allow for sharing with ‘certified entities’ even if they currently have no security clearances. It still would require the protection of the shared “cyber threat intelligence from unauthorized disclosure” {§1104(a)(2)(C)}

A ‘certified entity’ is a cybersecurity provider, protected entity (someone who has hired a cybersecurity provider to provide protect their system), or a self-protected entity (someone who has cybersecurity providers in-house). There are two important caveats to this definition; the certified entity {§1104(f)(1)}:

“[P]ossesses or is eligible to obtain a security clearance, as determined by the Director of National Intelligence; and

“[I]s able to demonstrate to the Director of National Intelligence that such provider or such entity can appropriately protect classified cyber threat intelligence.”

The difference between ‘possesses’ and ‘is eligible to obtain’ is an important quibble. There are long delays in getting security clearances approved and they are not handed out to the private sector unless there is a need for them. This would allow an intel agency to disclose actionable intelligence to a cyber-target with a minimal security check.

Would Cover ICS

The definition of cybersecurity system included in this bill is very broad and contains none of the code words that would restrict it to information systems. Theft or misappropriation of information is included as one of things to be protected against, but only after “efforts to degrade, disrupt or destroy” {§1104(f)(5)(A)} the system is listed.

Sharing is a Two-Way Street

This bill recognizes that sharing information would also include cybersecurity intelligence information flowing back to the intelligence community. It specifically includes three very important protections for covered entities that provide that intelligence; the information shall {§1104(b)(2)(C)}:

“[B]e exempt from disclosure under section 552 of title 5, United States Code [Freedom of Information Act];

“[B]e considered proprietary information and shall not be disclosed to an entity outside of the Federal Government except as authorized by the entity sharing such information; and

“[N]ot be used by the Federal Government for regulatory purposes.”

It does not, however, include such disclosures in any of the recognized categories of protected information. Specifically, it does not protect the information under classified information rules or any one of a number of Sensitive But Unclassified categories that are currently undergoing review. This would potentially leave the shared information open to disclosure in court cases, for instance.

The bill was referred to the House Select Committee on Intelligence for consideration and review; that likely means that at least some Committee hearings on this bill would take place behind closed doors.