Review - House Considering S 1605 – New FY 2022 NDAA

This evening the House will be taking up S 1605, a bill to designate the National Pulse Memorial in Orlando, FL. Instead of the language adopted in the Senate, the House will consider substitute language making the bill the National Defense Authorization Act for Fiscal Year 2022. If, as expected, this bill passes tonight in the House, the Senate will take up the bill under the abbreviated processes (no further amendments) used to accept a House amendment to a Senate passed bill.

The bill was crafted in much the same way as a conference committee would do after the two houses of Congress passed separate versions of a bill. Instead of an appointed conference committee (which for an NDAA would be mainly the Armed Services Committees supplemented by committee representatives for significant non-defense matters included in the bill), this substitute language was crafted by essentially just the Armed Services Committees using the House passed version of HR 4350 and the Senate Amendment SA 3867 substitute language from the Senate. There has been a Joint Explanatory Statement published which explains how the bill was crafted.

As I write this, the House is actively debating HR 1605 with one hour set aside for this debate. Various procedural matters will follow. The House expects to vote on this bill later tonight. I expect that it will pass with some level of bipartisan support (and bipartisan opposition).

For more details about the cybersecurity provisions included in the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/house-considering-s-1605-new-fy-2022 - subscription required.

Committee Hearings – Week of 12-6-21

This week with the House and Senate both in Washington, there is a fairly normal hearing schedule. There is one hearing of potential interest here: a cybersecurity markup hearing.

Cybersecurity Markup

On Wednesday, the House Judiciary Committee will hold a markup hearing on Wednesday covering five bills. One of those bills (HR 4977, the Better Cybercrime Metrics Act) may be of interest here. I have not reported on this bill, but it is essentially a companion bill to S 2629, which was reported in the Senate last week. This bill does not affect (or require) private sector reporting of cyber-crimes. What it does do is try to get DOJ to standardize the way that cybercrime statistics are reported within the government.

On the Floor

None of the bills this week scheduled for consideration under suspension of the rules in the House are of particular interest here. That includes the 16 new bills to be considered this week and the 14 being carried over from last week awaiting floor votes.

The House Majority leader lists the following legislation for possible consideration this week:

• Consideration of the FY22 National Defense Authorization Act

• Possible Consideration of Legislation Related to the Debt Limit

• Possible Consideration of Legislation Related to End of the Year Healthcare Provisions

• Additional Legislative Items Are Possible

The odd thing is that the House already passed HR 4350, the FY2022 NDAA. That bill is still stalled in the Senate. When the Senate adjourned last Thursday, there was no mention of an agreement on resuming consideration of the bill this week. Apparently the leadership has about given up on trying to get an agreement on the amendments to be considered before the final vote on the substitute language on the bill.

An interesting article over on TheHill.com lays out a bizarre solution to the current stalemate. Typically the Senate takes up the House bill, substitutes the Senate language, amends it and then the two conference on how to combine the two bills. That conference language then goes back to the House and Senate for a final vote. What TheHill.com is reporting is taking out the ‘amends it’ step. Apparently the two Armed Services Committees are holding an unofficial conference to work out the differences between what the two committees want in the bill. That unofficial conference bill would then be taken up by the House under a closed rule (without amendments like a conference report is normally considered).

I am not sure how they would expect to get this past the bomb throwers in the Senate, but it is certainly out-of-the-box thinking. I would suspect that the House Armed Services Committee would try to keep most of the floor add-ins from HR 4350 in the reported bill. It would be interesting to see what ‘amendments’ the Senate would try to keep.

Senate Amendments to HR 4350 – 11-29-21

Yesterday, the Senate resumed their consideration of HR 4350, the FY 2022 National Defense Authorization Act (NDAA). There were 25 new amendments proposed for the Senate’s consideration, none were of particular interest here. The Senate held a cloture vote to close debate on the substitute language amendment (SA 3867), the vote failed by a vote of 45 to 51 (60 votes required for passage) with liberal Democrats joining most Republicans in voting against closing the debate.. The vote failed because of the lack of an agreement on what amendments to SA 3867 would be considered before the final vote on the substitute language was held. The Senate will continue consideration of HR 4350 today.

Note: Sen Schumer’s (D,NY) ‘nay’ vote was made after cloture failed and did not reflect opposition to the cloture move. It was made to allow him (under Senate rules) to request reconsideration of the cloture vote, which he did. No word yet on when that vote will occur.

Committee Hearings – Week of 11-28-21

This week, both the House and the Senate are back in Washington after their Thanksgiving recess. The hearing schedule is light, with the Senate committees concentrating on nomination considerations. There will be one cybersecurity hearing in the House. The Senate will continue debate of HR 4350, the FY 2022 NDAA. And, of course, midnight Friday is the deadline for passing a spending bill.

Cybersecurity Hearing

On Thursday the House Transportation and Infrastructure Committee will hold a hearing on “The Evolving Cybersecurity Landscape: Federal Perspectives on Securing the Nation's Infrastructure”. There is no witness list currently available for this hearing.

On the Floor

The Senate resumes consideration of HR 4350, the FY 2022 National Defense Authorization Act (NDAA). There has been no announcement of an agreement on what amendments may make it to the floor of the Senate.

The House schedule currently includes 24 bills to be considered under the suspension of the rules process. This includes three cyber related bills that I have not covered in this blog:

HR 2685 – Understanding Cybersecurity of Mobile Networks Act, as amended,

HR 4045 – FUTURE Networks Act, as amended, and

HR 4055 – American Cybersecurity Literacy Act, as amended.

The House schedule also includes a generic listing for “Consideration of Legislation Making Further Appropriations for FY22”, but it almost certainly does not refer to an actual spending bill. It will most likely be a continuing resolution of some length. The options being considered include before Christmas, January/February, or September 31^st, 2022. None of the options are ‘good’, all are politically fraught.

Senate Amendments to HR 4350 – 11-19-21

Yesterday, the Senate continued their consideration of HR 4350, the FY 2022 National Defense Authorization Act (NDAA). There was no action on the bill. Cloture was filed to stop the debate on the substitute language amendment and the vote on that could happen any time after 5:30 pm on November 29^th when the Senate returns from their Thanksgiving recess. One additional amendment was proposed, but it is of no particular interest here.

Senate Amendments to HR 4350 – 11-18-21

Yesterday, the Senate continued their consideration of HR 4350, the FY 2022 National Defense Authorization Act (NDAA). No agreement had been reached about what amendments would be considered, so yesterday’s consideration of the bill consisted of speeches. Additionally, there were 150 new amendments proposed. Many of these amendments were offered earlier, but there are minor differences in language to make the amendment more acceptable to various concerned parties. Six of the amendments offered yesterday may be of interest here:

SA 4784 - Sen King (I,ME): DIVISION E: Defense Of United States Infrastructure [pg S8456] Similar to S 2491,

SA 4785 - Sen Ossoff (D,GA): SEC. xx. Dr. David Satcher cybersecurity education grant program. [pg S8458] Similar to S 2305,

SA 4799 - Sen Peters (D,MI): DIVISION E: Federal Information Security Modernization Act of 2021 [pg S8469],

DIVISION F: Cyber Incident Reporting Act Of 2021 nd CISA Technical Corrections and Improvements Act of 2021 [pg S 8482],

TITLE LXI: Cyber incident reporting act of 2021 [pg S8482],

TITLE LXII—CISA technical corrections and improvements act of 2021 [pg S8487],

SA 4802 – Sen Ossoff: SEC. xx. Dr. David Satcher cybersecurity education grant program. [pg S8491]

SA 4813 - Sen Scott (R,FL): DIVISION E: Cyber Incident Reporting Act of 2021 and CISA Technical Corrections and Improvements Act of 2021 {pg S 8500],

TITLE LI: Cyber incident reporting act of 2021 [pg S8500],

TITLE LII—CISA technical corrections and improvements act of 2021 [pg S8505]

SA 4831 - Sen Scott: DIVISION E: Federal Information Security Modernization Act of 2021 [pg S8516],

DIVISION F: Cyber Incident Reporting Act Of 2021 and CISA Technical Corrections and Improvements Act off 2021 [pg S8529],

TITLE LXI: Cyber incident reporting act of 2021 [pg S8529],

TITLE LXII: CISA technical corrections and improvements act of 2021 [pg S8534]

NOTE: Corrected Date in Title and added link for the list of amendments 11-20-21 13:50 EST

Senate Amendments to HR 4350 – 11-16-21

With the Senate starting the process for the consideration of HR 4350, the FY 2022 NDAA on Monday the first cloture vote will probably be held this afternoon. That vote will start the actual amendment consideration process. Meanwhile, yesterday there were 72 amendments proposed yesterday. Seven of those amendments were of potential interest here

 

SA 4662 - Sen King (I,ME): SEC. 1064. Report on cybersecurity certifications and labeling [pgs S8246-7],

SA 4673 – Sen Peters (D,MI): DIVISION E: Cyber Incident Reporting Act Of 2021 and CISA Technical Corrections and Improvements Act of 2021 [pgs S8251-2];

TITLE LI: Cyber incident reporting act of 2021 [pg S8252], Similar to S 2785,

TITLE LII: CISA technical corrections and improvements act of 2021 [pg S8257], Similar to S 2740,

SA 4674 - Sen Peters: DIVISION E: Federal Information Security Modernization Act of 2021 [pg S8260], Similar to S 2274,

SA 4676 - Sen Klobuchar (D,MN): SEC. xxx. Veterans cybersecurity and digital literacy grant program. [pg S8272],

SA 4724 – Sen King: SEC. 1064. Report on cybersecurity certifications and labeling. [pg S8297],

SA 4726 – Sen King: DIVISION E: Defense of United States Infrastructure [pg S8298], Similar to S 2491, and

SA 4732 – Sen Reed (D,RI): SEC. xxx. Cybersecurity transparency [pg S8314], Similar to S 808,

Senate Amendments to HR 4350 – 11-15-21

With the Senate starting the process for the consideration of HR 4350, the FY 2022 NDAA, there were 108 new amendments to that bill proposed in the Senate yesterday. Nine of those amendments made reference to cybersecurity issues:

SA 4560 - Sen King (I,ME): SEC. xx. Secure foundational internet protocols. [pg S8091],

SA 4561 - Sen King: DIVISION E: Defense of United States Infrastructure [pg S8091] Similar to S 2491,

SA 4580 - Sen Gillibrand (D,NY): SEC. 1601. Matters concerning cyber personnel requirements. [pg S8100] SA 3903 and SA 4181,

SA 4581 - Sen Gillibrand: SEC. xxx. Matters concerning cyber personnel education requirements. [pg S8101] SA 3903 and SA 4181,

SA 4598 - Sen Hassan (D,NV): DIVISION E: Federal Cybersecurity Workforce Expansion Act [pg S809] Similar to S 2274,

SA 4616 - Sen Warner (D,VA): DIVISION xx: Intelligence Authorization Act for Fiscal Year 2022 [pg S8128] Similar to S 2610,

SA 4624 - Sen Warner: SEC. xxx. Educational assistance for pursuit of programs of education in cybersecurity. [pg S8149],

SA 4637 - Sen Risch (R,ID): SEC. 1064. Think tank cybersecurity standards. [pg S8158], and

SA 4647 - Sen Peters (D,MI): DIVISION E: Federal Information Security Modernization Act of 2021 [pg S8179] Similar to S 2902.

Committee Hearings – Week of 11-14-21

With both the House and Senate back in Washington for a week between holidays, we have a nearly full slate of congressional hearings. Of interest here will be two ransomware hearings and markup of a cybersecurity bill.

Ransomware Hearings

On  Tuesday, the House Oversight and Reform Committee will hold a hearing on “Cracking Down on Ransomware: Strategies for Disrupting Criminal Hackers and Building Resilience Against Cyber Threats”. The witness list includes:

• Jen Easterly, CISA,

• Chris Inglis, National Cyber Director, and

• Bryan Vorndran, FBI

On Wednesday, two subcommittees of the House Homeland Security Committee will hold a joint hearing on “A Whole-of-Government Approach to Combatting Ransomware: Examining DHS’s Role”. The witness list includes:

• Rob Silvers, DHS,

• Jeremy Sheridan, Secret Service, and

• Brandon Wales, CISA

Neither hearing is expected to do more than mention controls system security in passing.

Cybersecurity Markup

On Thursday, the Senate Judiciary Committee is holding a business meeting. In addition to a number of nominations, it will take-up S 2629, the Better Cybercrime Metrics Act. This bill would add law enforcement cybercrime reporting requirements, but does not address private sector reporting cybercrimes to law enforcement or federal agencies.

On the Floor

This week the House is scheduled to take up HR 5376, the Build Back Better Act. I have not yet reviewed the most likely version of the bill to appear before the House, I have been awaiting last minute changes.

The Senate will likely take up HR 4350, the FY 2022 National Defense Authorization Act. The Senate will ignore the House language, taking up instead substitute language based upon S 2972. Readers will have seen my posts about the large number of amendments that have been proposed. More will likely be coming this week. It will be interesting to see which amendments actually make it to the floor for consideration. This will not be quick and the final vote may be delayed until after the Thanksgiving recess.

 

Senate Amendments to HR 4350 – 11-4-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 273 amendments proposed. Ten of those amendments may be of interest here:

SA 4291 – Sen Portman (R,OH): DIVISION E—Securing America’s Future [pg S7823]

SA 4292 – Sen Portman: DIVISION E—Securing America’s Future [pg S7840]

SA 4299 – Sen Blumenthal (D,CT): SEC. xx. Posse Comitatus. [pg S7855]

SA 4368 – Sen Rubio (R,FL): SEC. xx. Sanctioning And Stopping Ransomware. [pg S7889]

SA 4420 – Sen Rosen (D,NV): SEC. 1109. Civilian Cybersecurity Reserves Pilot Project [pg S7929]

SA 4423 – Sen Inhofe (R,OK): SEC. xxx. Modification Of Position Of Principal Cyber Advisor. [pg S7933]

SA 4426 – Sen Manchin (D,WV): SEC. 31xx. Defense Critical Electric Infrastructure Security. [pg S7933]

SA 4460 – Sen Cornyn (R,TX): Subtitle xx—National Cybersecurity Preparedness Consortium Act [pg S7949]

SA 4461 – Sen Warner (D,VA): DIVISION xx—Intelligence Authorization Act for Fiscal Year 2022 [pg S7949]

SA 4516 – Sen Peters (D,MI): DIVISION E—Federal Information Security Modernization Act of 2021 [pg S8022] includes:

Senate Amendments to HR 4350 – 11-3-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 51 amendments proposed yesterday. Four of those amendments may be of interest:

SA 4227 - Sen Risch (R,ID): SEC. xxx. Securing Energy Infrastructure. [pg S7730]

SA 4241 - Sen Menendez (D,NJ): Subtitle H—Combating International Cybercrime [pg S7740]

SA 4255 - Sen Hassan (D,NH): SEC. xxx. Support And Services for Critical Infrastructure. [pg S7748]

SA 4273 – Sen Ossoff (D,GA): SEC. xx. Dr. David Satcher Cybersecurity Education Grant Program. [pg S7757] Similar to S 2305.

Senate Amendments to HR 4350 – 11-1-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 91 amendments proposed yesterday. Three of those amendments may be of interest here:

SA 4156 – Sen Wyden (D,OR): SEC. xxx. Federal Cybersecurity Requirements. [pg 7621].

SA 4181 - Sen Gillibrand (D,NY): SEC. 1601. Matters Concerning Cyber Personnel Requirements. [pg S7645] Similar to SA 3903.

SA 4189 - Sen Whitehouse (D,RI): SEC. xxx. Preventing International Cybercrime [pg S7654] Similar to S 2139.

Senate Amendments to HR 4350 – 11-1-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 63 amendments proposed yesterday. One of those amendments may be of interest here:

SA 4112 – Sen King (I,ME): DIVISION E—Defense Of United States Infrastructure [pg S7557] Similar to S 2491.

Senate Amendments to HR 4350 – 10-28-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 126 amendments proposed yesterday. Six of those amendments may be of interest here:

SA 3943 – Sen Heinrich (D,NM): SEC. 906. Chief digital recruiting officer. [pg S7469]

SA 3954 – Sen Blackburn (R,TN): SEC. xxxx. Study on national laboratory consortium for cyber resilience. [pg S7472]

SA 4028 – Sen Bennet (D,CO):  SEC. xxx. National Digital Reserve Corps. [pg S7505] Similar to HR 4813

SA 4042 – Sen Rosen (D,NV): SEC. xx. National Cyber Exercise Program. [pg S7513] Similar to S 2993.

SA 4062 – Sen Ossoff (D,GA): SEC. xx. Dr. David Satcher Cybersecurity Education Grant Program. [pg S7518] Similar to S 2305.

SA 4067 – Sen Ossoff:  SEC. xxx. Report on cyber education diversity initiative. [pg S7520]

Senate Amendments to HR 4350 – 10-27-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 26 amendments proposed yesterday. One of those amendments may be of interest here:

SA 3935 - Sen Rosen (D,NV) - §1064. United States-Israel cybersecurity cooperation enhancement [pg S7429]

This amendment is essentially S 1193 that was introduced by Rosen in May. There has been no action on the bill since it was introduced and referred to the Senate Foreign Relations Committee.

Senate Amendments to HR 4350 – 10-26-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 36 amendments proposed in the Senate yesterday. One of those amendments may be of interest here:

SA 3903 – Sen Warnock - SEC. 1601. Matters concerning cyber personnel requirements. [pg S7385]

The amendment requires DOD to look at the education and training requirements for ‘cyber operation, information operation, and software engineering military personnel’ and prepare a report to Congress on those requirements. The amendment specifically includes a requirement to determine if a graduate level education program on the lines of the current war colleges run by the three services is necessary.

Committee Hearings – Week of 10-24-21

This week, with both the House and Senate in Washington, there will be a full slate of hearings in both bodies. There are two hearings of note here; a markup hearing and a hearing on transportation cybersecurity.

Markup Hearing

On Tuesday, the House Homeland Security Committee will hold a markup hearing looking at 12 pieces of legislation.

HR 5616, “DHS Basic Training Accreditation Improvement Act of 2021”,

HR 5658, “DHS Roles and Responsibilities in Cyber Space Act”, and

S 658, "National Cybersecurity Preparedness Consortium Act of 2021",

I have not yet published reviews of HR 5616 and HR 5658. While HR 5616 does not appear to affect chemical security inspector training, it could have future impact on cybersecurity law enforcement teams that could be developed within CISA or TSA. HR 5658 is a ‘report to Congress’ bill that may inform future cybersecurity legislative efforts. S 658 passed in the Senate in July and I do not expect any significant amendments in this week’s hearing.

Transportation Cybersecurity

On Tuesday the Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation of the House Homeland Security Committee will hold a hearing on “Transportation Cybersecurity: Protecting Planes, Trains, and Pipelines from Cyber Threats.” The witness list includes:

• Suzanne Spaulding, Center for Strategic & International Studies,

• Patricia F.S. Coswell, Guidehouse,

• Jeffrey L. Troy, Aviation Information Sharing and Analysis Center, and

• Scott Dickerson, Maritime Transportation System Information Sharing and Analysis Center

Commentary - It is disappointing to see this industry only panel without having the TSA Administrator providing some insight into what that agency is trying to do with the limited resources it currently has available.

On the Floor

According to the House Majority Leader’s web site, we may actually see a vote on HR 3684, the Infrastructure Investment and Jobs Act. There is a lot of new cybersecurity program language and funding tied up in that bill. This is still tied up in the negotiations over the Build Back Better bill, so do not hold your breath waiting on the vote.

As I noted yesterday, we may see the Senate take up HR 4350, the FY 2022 NDAA, this week. The amendment process for that bill may see additional cybersecurity language added.

Senate to Begin Consideration of HR 4350 – FY 2022 NDAA

While there is no official word that the Senate will be considering HR 4350, the FY 2022 NDAA, this week, the first amendment to that bill was offered on Thursday, the last day that the Senate was in session this week. As expected, that amendment is essentially the language from S 2972, the version of the NDAA from the Senate Armed Services Committee. While I have not done a page-by-page review of SA 3867, the list of sections in the amendment is the same as in S 2972.

I expect that the Senate will formally begin consideration of HR 4350 late this week. The amendment submission process is likely to begin a day or two before that.

Interestingly, there have been 21 amendments submitted to S 2792 since September 27^th. None of those amendments are of particular interest here and it does not look like any of them have been incorporated into SA 3867. It is likely that most of those amendments will be resubmitted as amendments to the substitute language for HR 4350.

Review - HR 5281 Introduced – NTIB Report Update

Last month, Rep Neguse (D,CO) introduced HR 5281, the Securing Technology Against Climate Impacts Act. The bill amends 10 USC 2504 and adding a new requirement for the annual report to Congress on the national technology and industrial base (NTIB) to include an analysis of climate impacts and cyberattacks to the NTIB assessment. This is very similar to the language found in §2881 of HR 4350, the FY 2022 NDAA. No funding is authorized by this bill.

Neguse is not a member of the House Armed Services Committee to which this bill was assigned for consideration. Thus, there is probably not enough influence in Committee to see this bill considered. I see nothing in the bill that would engender any specific opposition. I suspect that the bill would receive significant bipartisan support if it were considered in Committee.

This bill will not be considered as long as the §2881 language remains in the version of HR 4350 that ends up on the President’s desk.

Commentary

Adding this reporting requirement to §2504 does not make much sense when DOD is not required to include those conditions in the underlying assessment that would underpin that report. I would suggest that the bill include adding language to make the following amendment to §2505(b)(5):

(5) identify technological and industrial capabilities and processes for which there is potential for the national industrial and technology base not to be able to support the achievement of national security objectives, this identification will specifically include consideration of:

(A) current and projected impacts of climate change, and

(B) potential disruptions due to cyberattacks or ransomware attacks; and

For more details about the provisions of this bill and the 10 USC provisions involved, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5281-introduced - subscription required.

Review - S 2792 Introduced – FY 2022 NDAA

Earlier this week, Sen Reed (D,RI) introduced S 2792, the National Defense Authorization Act (NDAA) for Fiscal Year 2022. This is the version of the NDAA reported by the Senate Armed Forces Committee that will probably be substituted for the House language of HR 4350 when it is considered in the Senate. As with the House bill, S 2792 has a Title on cyber operations, including a report on DOD support for CISA. It also includes authorization language for a civilian cybersecurity reserve pilot and a brief discussion about technical debt.

As I mentioned above, when the Senate begins consideration of HR 4350, the version of the NDAA that passed this week in the House, there is typically an amendment in the form of a substitute that is offered for the Senate’s consideration. This bill will form the base for that amendment. There will be a vigorous floor amendment process, though it will not include nearly as many amendments as did the House debate.

Once the Senate passes that amended version, it will go back to the House for consideration of the new language. I would expect that the House will ‘insist’ on its version and the bill will then go to conference to work out the compromise version that will get to the President for signature. I expect that most of the House cybersecurity amendments will remain in that version.

For more details about the cybersecurity provisions of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2792-introduced - subscription required.