HR 118 Introduced – Vulnerability Disclosure Reporting

Earlier this month Rep Jackson-Lee introduced HR 118, the Cyber Vulnerability Disclosure Reporting Act. The bill would require DHS to prepare “a report that contains a description of the policies and procedures developed for coordinating cyber vulnerability disclosures” {§2(a)}. This is the same language that Ms Jackson-Lee introduced as HR 43 in the 116^th Congress. No action was taken on HR 43.

The Report

The unclassified report would be submitted to Congress within 240 days of the date of enactment. The requirement for establishing the policies and procedures is found in 6 USC 659(m). That subsection provides that:

“The Secretary, in coordination with industry and other stakeholders, may develop and adhere to Department policies and procedures for coordinating vulnerability disclosures.”

The bill would require an annex to the report that would contain information on {§2(a)}:

• Instances in which such policies and procedures were used to disclose cyber vulnerabilities in the prior year; and

• The degree to which such information was acted upon by industry and other stakeholders.

Moving Forward

Jackson-Lee is (as of yesterday) a member of the House Homeland Security Committee to which this bill was assigned for consideration. She should have enough influence in the Committee to ensure that this bill could be considered if she is willing to exert that influence. There is nothing in this bill that cause any organized opposition to the bill. The bill would very likely receive strong bipartisan support (as an earlier version, HR 3202  did in the 115^th Congress) both in Committee and on the floor of the House.

Commentary

It is odd that this bill was being introduced this year when there was no action taken on the bill in the previous session. Jackson-Lee did not use her significant influence in Committee last year to have the bill considered.

On the other hand, with the current concern about cybersecurity, there is a good chance that this bill will move forward early in this session, either as a standalone measure or included in some larger cybersecurity legislation.

One last item, the bill probably should have been updated to require CISA to prepare the report not DHS.

HR 43 Introduced – Cyber Vulnerability Disclosure Coordination

Last week Rep. Jackson-Lee (D,TX) introduced HR 43, the Cyber Vulnerability Disclosure Reporting Act. The bill would require a report to Congress on the DHS policies and procedures for coordinating cyber vulnerability disclosures. This is essentially the same bill as HR 3202 that Jackson-Lee introduced in the 115^th Congress. That bill was passed in the House on a voice vote but was never taken up by the Senate.

The unclassified report would be submitted to Congress within 240 days of the date of enactment. The requirement for establishing the policies and procedures is found in 6 USC 148(m) {or 6 USC 659(m) in the yet to be published 2018 version of the USC; modified by last year’s CISA authorization bill}.

The bill would require an annex to the report that would contain information on {§2(a)}:

• Instances in which such policies and procedures were used to disclose cyber vulnerabilities in the prior year; and

• The degree to which such information was acted upon by industry and other stakeholders.

Moving Forward

Committee assignments have not yet been completed, but I suspect that Ms. Jackson-Lee will return to the House Homeland Security Committee (the committee to which this bill was assigned for consideration) and will probably be a Subcommittee Chair. If that comes to pass, this bill will receive quick attention from the Committee and will probably be considered by the full House under suspension of the rules. It would be expected to receive wide bipartisan support once again. Whether or not it will be taken up by the Senate is a completely different question.

Bills Introduced – 01-03-19

Yesterday, the first day of the 116^th Congress, with both the House and Senate in Washington there were 302 bills introduced. Of those, seven will probably receive further coverage on this blog:

HR 21 Making appropriations for the fiscal year ending September 30, 2019, and for other purposes. Rep. Lowey, Nita M. [D-NY-17]

HR 43 To require the Secretary of Homeland Security to submit a report on cyber vulnerability disclosures, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

HR 52 To require a report and assessment regarding Department of Homeland Security responses to terrorist threats to Federal elections, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18] 

HR 57 To require the Secretary of Homeland Security to conduct a study on the feasibility of establishing a Civilian Cyber Defense National Resource in the Department of Homeland Security. Rep. Jackson Lee, Sheila [D-TX-18] 

HR 70 To abolish the Agency for Toxic Substances and Disease Registry, and for other purposes. Rep. Biggs, Andy [R-AZ-5]

HJ Res 1 Making further continuing appropriations for the Department of Homeland Security for fiscal year 2019, and for other purposes. Rep. Lowey, Nita M. [D-NY-17]

S 21 A bill making continuing appropriations for Coast Guard pay in the event an appropriations act expires prior to the enactment of a new appropriations act. Sen. Thune, John [R-SD]

NOTE: All bills introduced in the 115^th Congress are now dead. A bunch of them will be reintroduced in the coming days as the authors try to get work completed on the bills, but most of them will die a silent death. There may be some action in the House on bills that were introduced by Democrats last session, but few of those will be taken up by the Senate if they are passed in the House.

FY 2019 Spending

The House passed the two of these bills yesterday, HR 21 and HJ Res 1, that would, if passed by Senate and signed by the President, would take care of the current funding issue that has about a quarter of the government either shutdown or working on the hope for funding.

HR 21 would provide funding for Interior, Financial Services, Agriculture, Transportation, HUD, Commerce, Justice, Science and State through the end of the fiscal year. Details of that funding are not currently available as the House passed the bill on a near party-line vote (241-190) without any text of the bill being available.

HJ Res 1 is a continuing resolution providing for short-term spending for the Department of Homeland Security. Again, this was passed by a near party-line vote (239-192) without any text of the bill being available. So, we do not currently know how long the extension would be for (sometime in February?) or if the DHS CR will provide a program extension for the Chemical Facility Anti-Terrorism Standards (CFATS) (probably with the same date as the CR).

It looks like the new Democratic House Leadership decided to split the spending issue into two parts to get most of the funding moving while leaving the most contentious issues (the ‘wall’ and immigration reform) to be resolved separately. According to news reports that does not appear to be a successful move, but we will have to wait and see.

CFATS Program Extension

I was surprised to not see a CFATS bill introduced in either House. I expected Sen. Johnson (R,WI) to reintroduce S 3405 given the fuss he made about the bill last November. On the House side I did (do) not expect to see HR 6992 introduced as it had no support from anyone of consequence in the House Homeland Security Committee from either party.

Depending on the wording of any CFATS extension in HR 21 (low probability of mention) or HJ Res 1 (probably short term) I would expect to see a bill similar to HR 7188 that would formally extend the CFATS program for a year to give the new leadership at Homeland Security and the Energy and Commerce Committees to craft a longer term extension of the bill. If Democrats continue to form on CFATS, that would include formal whistleblower protections, worker involvement language, emergency response planning requirements and possibly some sort of inherently safer technology language. All of these would cause problems with Johnson and the Republicans in the Senate. Because of these conflicts I suspect that we will return to year-by-year extensions until one of the two parties gains controls of both houses of Congress.