Cybersecurity Legislation in the Lame Duck Session

Michelle Kincaid has an interesting outlook on cybersecurity legislation potential in the lame duck session in her cybersecurity blog post. While I don’t see anything in particular to disagree with, it is important to remember that political calculations change significantly in a lame duck session, making it much more difficult to successfully predict political outcomes.

While most people focus on legislators that are on their way out, who may (or may not) vote on principle instead of political motives now that they may never face the voters again, there is a new crop of Senators that are now starting into their two year election cycle; many of them will now begin paying more attention to political posturing than principle.

Legislation in the Senate

Most of the cybersecurity legislation attention is being focused on consideration of S3414. Sen. Reid (D,NV) that may bring this back to the floor for consideration this week and there is even a remote chance that it could pass in the Senate. The key stumbling block to its passage will be reaching an agreement with the Republicans on what amendments would be considered before a final vote on the bill. It is unlikely that, even if this bill does get passed in the Senate, that it will pass in the House where there is much more opposition to increasing government regulations.

Overlooked in most discussions of cybersecurity legislation is the fact that there are three bills that have already been passed in the House and are waiting for Senate action. They are

• HR 2096, Cybersecurity Enhancement Act of 2012;

• HR 3523, Cyber Intelligence Sharing and Protection Act; and

• HR 3834, Advancing America's Networking and Information Technology Research and Development Act of 2012

While the CISPA bill is more than a little controversial, the other two bills had strong bipartisan support in the House ( HR 2096 passed 395-10 and HR 3834 passed on a voice vote). While being far from comprehensive bills either of these could probably pass in the Senate if the leadership took the effort to bring them to a vote. These bills may provide Reid with a way of saying that the Senate dealt with cybersecurity legislation in this session.

Legislation in the House

With no Senate passed bills to consider, the House still has one cybersecurity bill that has been reported out of committee that could be considered on the floor with minimal effort; HR 3674, the PRECISE Act of 2012. This bill is actually the closest thing to a House counterpart to S 3414 in that it actually provides VERY limited authority for DHS to regulate cybersecurity in critical infrastructure. This could probably pass a House floor vote without any real problem, but it is too late for this to make it through the Senate as well.

If this bill had been passed in the regular session (and it was put on the house calendar back in July and then ignored) it would have provided a more useful discussion tool for Senate consideration of cybersecurity. It actually would form a pretty good basis for the executive order that is reportedly being worked on by the Administration.

If Rep. Lungren (R, CA) is returned for the 113^th Congress (the vote count has still not been certified and is trending against him) then I would expect to see this bill re-introduced in January.

Report Filed on HR 3674 – Cybersecurity

Yesterday the House Homeland Security Committee filed their report on HR 3674, the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (The PRECISE Act). That report is not yet available from the GPO so a review of the actual report will be delayed. We know what the approved amendments said, so there will be no surprises there, but these reports frequently contain miscellaneous information of interest.

There were a couple of other interesting developments announced yesterday with the filing of this report. The following committees were ‘discharged’ from further consideration of the bill:

• Government Oversight and Reform;

• Science Space and Technology;

• Judiciary; and

• Intelligence

The broad and ineffective scope of this bill meant that the above listed committees could have had jurisdictional issues with the bill. None of the committees held any hearings on the bill and apparently their chairmen had no objections to the bill as reported by the Homeland Security Committee. Discharging them from further consideration typically means that the bill is being moved forward towards floor consideration.

That does not appear to be the case here. At the same time as these committees were discharged from further consideration the House leadership sequentially referred this bill to the Energy and Commerce Committee and gave that committee until September 21^st to consider the bill. That date is interesting as, according to the House Calendar, it would only provide one week for the bill to be considered by the whole House, the week of October 1^st. In effect this has killed the bill for possible consideration until after the election in November and probably for the remainder of the Session.

Markup Results for HR 3674

Earlier this week the House Homeland Security Committee completed their markup of HR 3674, the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (The PRECISE Act) and reported the amended bill favorably by a party-line vote of 16-13. The Lungren amendment in the nature of a substitute (ANS) that I reported on earlier this week was agreed to on a voice vote as were five amendments to that language.

The Missing Amendments

If one were to just look at the mark-up hearing page for this bill on the Homeland Security Committee web site one could be forgiven for thinking that there had been no disagreements in this markup. The only amendments that are listed on that page are those amendments that were adopted. Three of the approved amendments had Republican authors.

There were 15 other amendments that were dealt with at the hearing; one was withdrawn, one was ruled out of order and the other 13 were voted down along party lines. The sad part is that only one of those amendments, authored by Rep Jackson-Lee (D,TX) has been made publicly available on the Committee web site. For all of the remaining disapproved amendments we have only a brief, teasing summary of the purpose in the Summary of Committee Action.

Some of these amendments looked interesting. Ranking Member Thompson (D,MS) proposed to add a section requiring the identification of sector specific cybersecurity risks. After this was voted down by a party-line vote twice (I’m assuming that there was a minor variation in the language between the two versions) other Democrats on the Committee offered six similar amendments (oaky still an assumption on my part since I haven’t seen any of the actual proposed language) for identifying cybersecurity risks for six different critical infrastructure sectors; including:

• Transportation Systems Sector;

• Chemical Sector;

• Emergency Services Sector;

• Nuclear Reactors, Materials, and Waste Sector;

• Energy Sector; and

• Dams Sector

I suppose that it kind of made sense that these amendments were voted down. It would be hard to justify not requiring some sort of risk mitigation for the identified risks once they were identified. That just doesn’t fit with the requirement that any DHS directed efforts to actually prevent cybersecurity attacks can only be made at the request of the private sector entity who is then free to ignore any costly defense against the identified risk/attacks.

The failure to publish the defeated amendments is a very odd step for this Committee. They have had one of the better records for providing information to the public. It would be interesting to hear Chairman King explain why an exception to that policy was made for this bill.

Lungren Slips in a Ringer

I ran into an interesting thing when I was reviewing the details of the amendments that were offered to the Lungren ANS; the page and line numbers in the amendments did not match up with the page and line numbers in the copy of the ANS that I had downloaded from the  Homeland Security Committee web site on April 16^th; the version that I reported on in my earlier blog post.

There was one major change in the new version of the bill it removed §243, Cyber threat information sharing with the Federal Government. One other significant change was related to that deletion, the removal of the definition of ‘cybersecurity purpose’ from §249; a term used only in §243. The remaining changes were miscellaneous references to §243.

The removal of §243 guts the information sharing provisions of this bill. It removes the only mandate for the government to provide cyber-threat information to private sector owners of critical infrastructure in any of the bills currently under consideration in Congress. It also removes all protections of information that the private sector might provide to the DHS National Cybersecurity and Communications Integration Center (NCCIC).

With this change in place Subtitle E of this bill becomes a simple reauthorization of the NCCIC with the addition of a new Board of Advisors. It also removes any possibility of the bill being attacked by privacy and internet access activists. The bill gets much easier to pass in both the House and Senate, but doesn’t allow it to accomplish much.

The Approved Amendments

The first of two amendments by Rep. McCaul (R,TX) provides a more detailed description of the ‘cybersecurity operational activity’ authorized to be conducted by DHS. It also provides a definition for ‘countermeasure’ and outlines the Federal preemption status of this bill. All important details, but nothing of specific interest for the control system security community.

The second McCaul amendment does two interesting things at the same time. First it removes §6 which required the Secretary to prepare a report on cybersecurity training for fusion centers. Second it establishes the Cybersecurity Domestic Preparedness Consortium to develop and provide cybersecurity training for State and local first responders. Again a valuable idea, but it will have little or no effect on control system security.

Chairman King submitted an amendment that takes care of a simple housekeeping function, providing references to Title XI of National Security Act of 1947, as amended. This is one of those necessary functions that sometimes get lost in the legislation drafting process. Nothing to see here, keep moving.

Rep. Richmond (D,LA) proposed a very simple amendment it added a single word to the bill (one of my favorite words) ‘Chemical’. Passing this amendment will give the chemical sector a seat on the Board of Advisors of the NCCIC. Since I have been advocating this since the idea of the Board of Advisors was first introduced, I heartily endorse this amendment. Too bad the NCCIC can’t do anything.

Rep. Hahn (D,CA) managed to get a privacy related amendment added to the bill. It would require the DHS Privacy Officer to review the ‘cybersecurity policies, programs, and activities’ of the Department. It really isn’t that big a thing since that is already the job of the PO so this is a symbolic amendment; which is probably why it passed.

New Language for HR 3674

As I noted in yesterday’s blog post Rep. Lungren (R,CA), the chair of the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the House Homeland Security Committee is planning on introducing substitute language for HR 3674, Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (The PrECISE Act), during the full Committee markup of that bill. My earlier post provided just a general idea of the scale of changes included in the bill. I’ve now had a chance to do a more detailed review and this post looks at those areas that might be of interest to the control system security community.

Control System Security Ignored

HR 3674 has always been an information security bill, but earlier versions did include some brief mentions of control system security issues. This version of the bill removes all of those mentions. For example the wording in §226(a)(7), added in the substitute language submitted in the Subcommittee markup hearing that required the development of “guidelines for making critical infrastructure information systems and industrial control systems [emphasis added]  more secure at a fundamental level” has been removed in this latest version.

Even the wording in the original bill that addressed cybersecurity R&D efforts, requiring the “development and support of technologies to reduce vulnerabilities in process control systems” {§229(b)(5)} has been removed.

No Standards to be Set

It is apparent that the reason for the removal of any reference to control systems in this revised language is because of the full scale revision of the authority to be given to DHS to regulate cybersecurity in the private sector. Actually, ‘revision’ is hardly adequate; the regulatory scheme for this new bill is summed up nicely in §226 that is being added to the Homeland Security Act of 2002 in §2 of this bill. It requires the DHS Secretary to “perform necessary activities to help facilitate the protection of Federal systems and, solely upon the request of critical infrastructure owners and operators [emphasis added], assist such critical infrastructure owners and operators in protecting their critical infrastructure information systems” {§226(a)}.

The phrase ‘solely upon the request’ occurs in a number of places in the discussion in §226 of how the Secretary will go about ‘assisting in protecting’. It is specifically used to describe the conduct of risk assessments for critical infrastructure information systems and the providing of technical assistance to critical infrastructure owners and operators.

Careful reading of this section of the revised language for the bill allows one to understand why this bill does not intend to establish a regulatory regime for protecting cybersecurity in the private sector; there will not be enough resources made available to DHS to allow them to prepare rules and establish an enforcement capability to support such regulations. This is clearly seen in §226(e):

“The provision of assistance or information to critical infrastructure owners and operators, upon request of such critical infrastructure owners and operators, under this section shall be at the discretion of the Secretary and subject to the availability of resources. The provision of certain assistance or information to one critical infrastructure owner or and operator pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other critical infrastructure owner or and operator.”

Information Sharing

Lungren (and presumably the Committee Staff) is obviously trying to avoid the ire of various internet activists the way that the Roger’s information sharing bill (HR 3523) has increasingly done. Subtitle E of the bill would add a series of sections to the Homeland Security Act to address cybersecurity information sharing by DHS.

The first section of this subtitle clearly requires DHS to supply cyber-threat information to the private sector; something that has not been explicitly spelled out in any cybersecurity legislation to date. Section 241 requires the Secretary to make “information appropriately in the possession of the Department available to appropriate owners and operators of critical infrastructure on a timely basis”. Caveats are provided for details of protected information and classified information.

The bill establishes the National Cybersecurity and Communications Integration Center (NCCIC) as the agency within the Department responsible for carrying out the information sharing requirements of the Department. The sharing requirements for the NCCIC include cyber threat information and “exchanging technical assistance, advice, and support with appropriate entities” {§242(b)}. Unfortunately, the section that outlines the methodology and requirements for information sharing and protection is poorly written.

Section 243(a)(1) starts out explaining that that Federal agencies are required to provide cybersecurity threat information in their possession to the NCCIC; allowing them to place restrictions on what and how that information could be shared to protect the sources of that information. There is nothing really controversial here.

Section 243(a)(2) places additional and more specific restrictions on how information provided to the NCCIC can be shared. The wording implies, but never specifically states, that much of the information covered under this subparagraph would be information provided to DHS by the private sector. This can be seen in the use of the phrases “protected entity” and “self-protected entity” that have been proposed in other cybersecurity bills. Unfortunately they are not defined anywhere in this bill.

Information sharing protections listed in §243(a)(2)(C) and §243(a)(2)(D) include:

• Shall be exempt from disclosure under section 552 of title 5, United States Code;

• Shall be considered proprietary information and shall not be disclosed to an entity outside of the Federal Government except as authorized by the entity sharing such information;

• Shall not be used by the Federal Government for regulatory purposes;

• Shall be handled by the Federal Government consistent with the need to protect sources and methods and the national security of the United States; and

• Shall be exempt from disclosure under a State, local, or tribal law or regulation that requires public disclosure of information by a public or quasi-public entity.

Information Sharing Restrictions

Responding to specific privacy and domestic spying charges levied against HR 3523, Lungren has provided three separate restrictions on the use information shared with the Federal government (presumably, but not specified, by private sector entities). Actually this is another poorly written area as there is a repeated reference to ‘subsection (b)’ but there is no such subsection in §243.

The revised language provides the ‘limitation on use’ provisions that only allow Federal agencies to share the information only if “at least one significant purpose of the use” {§243(a)(3)(A)(ii)} is for cybersecurity purposes or protection of national security. Similar language is found in HR 3523.

Lungren has added language {§243(a)(3)(B)} that specifically prohibits searching such information provided to the Federal Government (again presumably by the private sector) except for national security or cybersecurity purposes. It also specifically prohibits {§243(a)(3)(C)} the Federal Government from requiring “a private sector entity to share information with the Federal Government”.

It is not clear that these efforts will mollify privacy and internet freedom advocates concerns about the effects of these security provisions on their privacy and freedom of expression rights. But an effort has been made.

The Markup Hearing

The full Homeland Security Committee will meet in a markup hearing on Wednesday, April 17^th, 2012. It is likely that there will be a number of additional amendments made to this language. I’ll cover those results later this week.

Markup of HR 3674 – Cybersecurity

The House Homeland Security Committee web page today announced that the full Committee would be conducting a markup hearing for HR 3674, Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (The PrECISE Act). As with the subcommittee markup hearing in February, the sponsor of the bill (and Sub-Committee Chair), Rep. Lungren (R,CA), will be offering an amendment in the form of a substitute.

The copy of the potential amendment provided on the hearing notice web page shows an extensive re-write of the legislation. A quick review of the changes show no real changes as far as control system security goes, but there is a complete change of focus of Subtitle E being added to the Homeland Security Act of 2002. The change in the title of Subtitle E provides a preview of the changes to the information sharing provisions of the bill:

• Original Version - National Information Sharing Organization

• New Version - Department of Homeland Security Cybersecurity Information Sharing

I’ll be taking a closer look at the specific provisions before the hearing on Wednesday.

Results of Subcommittee Markup of HR 3674

Yesterday the Committee on Homeland Security’s Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies met to markup HR 3674, the  Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness (PrECISE) Act of 2011, as I reported they would last weekend. Several amendments were adopted and the Subcommittee adopted the revised bill by a voice vote, a certain mark of the bipartisan support for the bill. The HR 3674 could move to a full Committee markup as early as next week.

As was expected none of the amendments to Chairman Lungren’s (R,CA) substitute language made any specific mention of industrial control systems, but there were two amendments that might impact security programs for those systems. These amendments affect the sharing of cybersecurity information and providing for civil actions against anyone inappropriately disclosing cybersecurity information provided by the private sector.

Information Sharing

Rep. Long (R,MO) introduced an amendment (which was adopted by unanimous consent) that would extend the information sharing requirements for the Secretary of Homeland Security of §228(b) by adding, among others, “appropriate private sector entities that provide cybersecurity or information security products”. The wording ‘cybersecurity or [emphasis added] information security’ could certainly include control system security products. Of course, the weasel wording of ‘appropriate [emphasis added] private sector entities’ greatly weakens this requirement.

Civil Actions

Rep. Keating (D,MA) introduced an amendment (which was adopted by voice vote) that enhanced the §250 penalties for disclosure of information by government employees, contractors or members of the National Information Sharing Organization (NISO). The §250 language provided criminal penalties (fines, up to one year in jail, and removal from office). The new §251 makes such disclosure actionable in civil court allowing for recovery of actual costs, profits of the discloser, punitive damages, and legal fees. The inclusion of profits of the discloser {§251(a)(1)} and punitive damages {§251(a)(2)} make this a potentially very serious sanction against potential disclosures.

More Reports

A couple of the other amendments will increase the report workload on DHS without significant benefit to the cybersecurity community. A McCaul (R,TX) amendment requires a report on foreign entities that pose the “the greatest cybersecurity threats to the critical infrastructure of the United States”.  Another Long amendment would require an annual status report from the Board of NISO.

New Version of HR 3674, ‘the’ House Cybersecurity Bill

As I noted in my blog post Saturday, there will be a subcommittee markup hearing for HR 3674, the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (PRECISE) Act of 2011. As is usual with markups of bills like this, the hearing will start off with the Chairman, Rep Lungren (R,CA) introducing his revised language for the bill and the subsequent proposed amendments will be made to that new language. So let’s take a look at the new version of his bill.

Overview

First off nothing has been removed from the bill at this point (that could change later this week); so everything I wrote about this bill (then a draft of this bill) still pertains to this revised language.

Most of the changes have been technical wording changes that will be mainly of interest to lawyers and judges if this bill ends up being signed by the President. There were, however a couple of new sections that were added at the end of the bill. They include:

§ 4. Report on Support for Regional Cybersecurity Cooperatives;

§ 5. Pilot Program on Cybersecurity Training for Fusion Centers; and

§ 6. Assessment of Sector by Sector Cybersecurity Preparedness.

Please note that §5 provides for training fusion center personnel in IT security practices to protect their information systems, not about cyber security threat assessment. It would have been nice to see a training requirement here for instance that would direct fusion center analysts to ICS-CERT for assistance in evaluating potential control system threats or attacks.

The bulk of the remaining changes can be found in Subtitle E, National Information Sharing Organization (NISO). Most of these changes have apparently been made to ensure that the NISO is not a ‘threat’ to civil liberties or legitimate information sharing activities.

ICS Coverage?

This bill remains at heart an information system protection bill not an ICS protection bill. The new version does include an additional mention of ‘industrial control systems’. In §226(a)(7) the bill would require the Secretary of DHS to:

“establish, in coordination with the Director of the National Institute of Standards and Technology, the heads of other appropriate agencies, and appropriate elements of the private sector, guidelines for making critical infrastructure information systems and industrial control systems [emphasis added]  more secure at a fundamental level, including through automation, interoperability, and privacy-enhancing authentication”.

There continue to be a number of sections of the bill that do not contain the explicit language “critical infrastructure information systems” and these may imply coverage of control systems. These are generally reporting requirements or information sharing requirements and they do not provide any regulatory authority.

For example the new §4 of the bill requires the Secretary to report on:

“the Secretary’s plan to provide support to regional, State, and local grassroots cyber cooperatives designed to decrease cyber disruptions to critical infrastructure, increase cyber workforce training efforts, increase community awareness of cybersecurity, organize community cyber-emergency preparedness efforts, build resiliency of regional, State, and local critical services, and coordinate academic technical and policy research effort”.

There is mention of potential grant program supporting these ‘cyber cooperatives’ (and that term is never defined), but there is no spending authority for such grants. This means that the grant money would have to come out of some existing grant program.

National Information Sharing Organization

The most controversial area of this bill continues to be the establishment of the National Information Sharing Organization which is also the section of the bill that sets up the conflict between this bill and HR 3523 (the bill sponsored by the House Intelligence Committee). Most changes to the NISO sections of this bill address privacy concerns.

For example §244(9) sets for the requirements for the protections of ‘privacy and civil liberties’. The new version of this bill adds subparagraphs (B) and (C) that specify that only ‘cyber threat information’ may be shared within NISO and that all “personally identifiable information not necessary to describe a cyber threat” be removed from information shared by and through NISO.

I noted in my earlier blog on this bill that the private sector board members of NISO did not include anyone from the water, chemical or transportation critical infrastructure key resources (CIKR) sectors. The revised version changes that somewhat in that it adds the water sector to those represented on the Board. The continued lack of chemical or transportation sector representation effective shuts those sectors out of NISO participation.

The new version of this bill also financially guts NISO after FY 2015. Federal funding up until then consists of $20 million each fiscal year (and that comes out of the existing DHS S&T budget, no new money). After FY 2015 the only federal money going to NISO will be the Federal membership fee for NISO. Even that will be limited by §253(b) to no more than “the fee collected from the largest private sector member of the National Information Sharing Organization”.

Since §253(a) prohibits Federal appropriations supporting NISO, that fee will have to come out of the budget of DHS or three other “Federal agencies with significant responsibility for cybersecurity” {§243(b)}. Since none of the four is required to pay the Federal governments ‘fair share’ fee I bet this gets lost in the annual budget shuffle.

There are two new terms specifically defined in the NISO sections of this bill that might increase the applicability of NISO to control system security information sharing (but don’t hold your breath); ‘cyber attack’ and ‘cyber security criminal act’. The inclusive language for ‘cyber attack’ includes the phrase “causes or attempts to cause damage and loss” {§248(f)(1)(B)}. For ‘cyber security criminal act’ the phrase is “efforts to degrade, disrupt or destroy a cybersecurity system or network” {§248(f)(2)(A)}. Neither constitutes a resounding commitment to ICS security information sharing.

Further Amendments

The subcommittee markup hearing that starts on Wednesday (and may become a multi-day hearing) will undoubtedly include many changes to the wording of this bill. Watching the hearing itself will be little help in identifying those changes as the exact wording of the changes is rarely included in the live proceedings. Usually we just get the interpretations of what the various congress critters think the language means.

We will have to wait until the actual amendment language is posted to the House Homeland Security Committee web site. The staff of that Committee usually does a pretty good job of getting that information up quickly. After that we will have the full committee markup (maybe as early as next week). Then we will have to wait for four other committees to act (or more likely fail to act) on the bill.