HR 1062 Introduced – Cybersecurity Consortium

Earlier this month Rep. Castro (D,TX) introduced HR 1062, the National Cybersecurity Preparedness Consortium Act of 2019. The bill would authorize the DHS NCCIC to work with a consortium of non-profit entities to “develop, update, and deliver cybersecurity training in support of homeland security” {§2(1)}. The bill is very similar to HR 1465 from the 115^th Congress and HR 4743 from the 114^th. No action was taken on HR 1465 but HR 4743 was passed in the House with bipartisan support.

Differences in the Bills

The current language is most closely a copy of the version of HR 1465 that was reported in the House. There are still a number of differences in the two versions of the bill; some of them minor and others with more significant.

The first noticeable change is the references to both the Homeland Security Act of 2002 and 6 USC. These changes are strictly editorial updates for changes made to that Act and the US Code (USC) by the CISA authorization bill that was passed last year. As usual I prefer to use the USC links. All references to 6 USC 659 in the current bill are the same as the old 6 USC 148 that I have made numerous references to in the past. Unfortunately, the GPO has yet to update the USC for last year’s modifications, so all links to 6 USC in this post will be to the congressional version of the US Code.

Next this bill removes almost all references to the phrase ‘including threats of terrorism and acts of terrorism’ that were included frequently in the earlier bills. This was used as a pretty constant modifier of the phrase ‘cybersecurity risks and incidents. The current bill only uses this phrase one time in §3(b)(3):

Provide technical assistance services to build and sustain capabilities in support of preparedness for and response to cybersecurity risks and incidents, including threats of terrorism and acts of terrorism, in accordance with such section 2209;

There are two paragraphs from the earlier bills that are completed removed in this latest version. Section 2(c) admonished the Secretary to “to prevent unnecessary duplication of existing programs or efforts of the Department of Homeland Security”. Section 2(g) terminated the authorization for the program in five years from the date of enactment. There is no similar language for either of these provisions in the current bill.

Finally, there are two additional sections found in this bill that were not included in the earlier versions. Section 2 provides definitions of important terms; those definitions were included in the text of various paragraphs in the reported version of HR 1465. Section 4 added an important rule of construction to the bill:

“Nothing in this Act may be construed to authorize a consortium to control or direct any law enforcement agency in the exercise of the duties of the law enforcement agency.”

Moving Forward

Neither Castro or any of his six bipartisan cosponsors are members of the House Homeland Security Committee to which this bill was assigned for consideration. HR 1465 had a similar problem last session which explains why it was not considered in Committee. If the bill were to be considered in Committee (possible if a new cosponsor who was on the Committee were added) it would probably be adopted by a bipartisan majority. There is nothing in the bill that should draw any significant opposition.

A similar sounding bill, S 333, was introduced in the Senate, but it looks to have a similar consideration problem; none of the four Senators currently associated with the bill are on the Senate Homeland Security and Governmental Affairs Committee.

Commentary

I did now write about HR 1465 last session because the definitions provided for ‘cybersecurity risk’ and ‘incident’ rely on the IT restrictive definition of information system used in §659. This means that there is no authorization for providing training for incident response or response planning for industrial control system incidents. As it becomes more and more apparent that the physical consequences of a potential attack on industrial control systems could be much more significant than a purely IT system attack, this restrictive definition becomes more and more problematic.

I have been complaining about this definitional problem for some time. As is usual I have offered a number of different possible suggestions for the problem. The most comprehensive can be found in my discussion of HR 2831 last session.

House Passes HR 4743 – Cybersecurity Consortia

Last night the House passed HR 4743, the National Cybersecurity Preparedness Consortium Act of 2016. After 13 minutes of debate the bill passed by a strongly bipartisan vote of 394 – 3. The three dissenting votes were cast by Republicans.

The bill would allow the Department of Homeland Security to coordinate with, and support with existing grant monies, an independent National Cybersecurity Preparedness Consortium to:

• Provide training to State and local first responders and officials;

• Develop and update a curriculum utilizing existing programs and models;

• Provide technical assistance services to build and sustain capabilities in support of preparedness for and response to cybersecurity risks and incidents;

• Conduct cross-sector cybersecurity training and simulation exercises for entities, including State and local governments, critical infrastructure owners and operators, and private industry;

• Help States and communities develop cybersecurity information sharing programs; and

• Help incorporate cybersecurity risk and incdent prevention and response (including related to threats of terrorism and acts of terrorism) into existing State and local emergency plans.

The bill now moves to the Senate where it will almost certainly be considered (if it makes it to the floor, that is not guaranteed by any stretch of the imagination) under the Senate’s unanimous consent procedure without debate or vote.

HR 4743 Reported in House – Cybersecurity Consortium

Yesterday the House Homeland Security Committee submitted their report on HR 4743, the National Cybersecurity Preparedness Consortium Act of 2016. The reported version of the bill reflects amendments made to the bill during a markup hearing by the Committee on April 28^th, 2016.

The revised version of the bill makes some technical changes to the relationship between the Department and the National Cybersecurity Preparedness Consortium. The original language would have had the Department establish the Consortium, where the new language allows the Secretary to work with an independently established Consortium. This relieves the Department from any potential responsibility for funding of Consortium activities beyond potentially providing grant monies to support specific actions.

The House is currently scheduled to take up this bill under suspension of the rules on Monday. This means that there will be limited debate on the floor and no additional amendments will be allowed to the bill. It also indicates that the leadership expects broad bipartisan support for the bill because these rules require a super-majority (2/3rds of members present) for passage.

Committee Hearings – Week of 04-24-16

Both the House and Senate are in Washington this week and there are an unusual number of markup hearings scheduled that may be of specific interest to readers of this blog. A number of cybersecurity related bills will be addressed as well as another pipeline safety bill.

Pipeline Safety

The House Energy and Commerce Committee will hold a two-day markup hearing starting Tuesday. Among the 22 bills to be considered is an as of yet un-introduced pipeline safety bill. This is not the same as last week’s HR 4937; that bill was the House Transportation and Infrastructure’s bill. I’ll have more details on the differences between the three bills now under consideration in a later post.

NOTE: This hearing will also take up HR 2031, the Anti-Swatting Act of 2015.

Cybersecurity

On Wednesday the House Armed Services Committee will hold a markup hearing of HR 4909, the National Defense Authorization Act (NDA) for FY 2017. While the original bill did not have any cybersecurity provisions, last week the Emerging Threats and Capabilities Subcommittee did add a number of new sections addressing cybersecurity issues; including:

• Section 221—Strategy for Assured Access to Trusted Microelectronics

• Section 806—Amendments Related to Detection and Avoidance of Counterfeit Electronic Parts

• Section 1631—Special Emergency Procurement Authority to Facilitate the Defense Against or Recovery from a Cyber Attack

• Section 1632—Change in Name of National Defense University's Information Resources Management College to College of Information and Cyberspace

• Section 1633—Requirement to Enter into Agreements Relating to Use of Cyber Opposition Forces

• Section 1634—Limitation on Availability of Funds for Cryptographic Systems and Key Management Infrastructure

On Wednesday the Senate Commerce, Science and Transportation Committee will hold a markup hearing addressing six bills; including the:

• S 2607, Developing Innovation and Growing the Internet of Things (DIGIT) Act; and

• S 2817, Space Weather Research and Forecasting Act (text still not available).

On Thursday the House Homeland Security Committee will hold a markup hearing on four bills; including HR 4743, the National Cybersecurity Preparedness Consortium Act of 2016. It will be interesting to see if they address the definition issue so that the bill would also address control system security issues.

On the Floor

The House will consider two bills under suspension of the rules this week that may be of specific interest to readers of this blog:

• HR 3583 – PREPARE Act, as amended

• HR 4240 – No Fly for Foreign Fighters Act

As usual these will be considered under limited debate and no amendments from the floor.

The Senate resumes consideration of the military construction spending bill. There is a possibility that another spending bill may come up for consideration late this week.

HR 4743 Introduced – Cybersecurity Consortium

Last week Rep. Castro (D,TX) introduced HR 4743, the National Cybersecurity Preparedness Consortium Act of 2016. The bill would establish a consortium to support efforts to address cybersecurity risks and incidents, including threats of terrorism and acts of terrorism.

The Consortium

Section 2 of the bill would require the DHS Secretary to establish the National Cybersecurity Preparedness Consortium. The Consortium would “consist of academic, nonprofit, industry, and government partners that develop, update, and deliver cybersecurity training in support of homeland security” {§2(e)}. The Consortium would be authorized to {§2(c)}:

• Provide training to State and local first responders and officials specifically for preparing for and responding to cybersecurity risks and incidents;

• Develop and update a curriculum utilizing existing programs and models;

• Provide technical assistance services to build and sustain capabilities in support of preparedness for and response to cybersecurity risks and incidents, including threats of terrorism and acts of terrorism;

• Conduct cross-sector cybersecurity training and simulation exercises for entities, including State and local governments, critical infrastructure owners and operators, and private industry;

• Coordinate with the national cybersecurity and communications integration center of the Department of Homeland Security to help States and communities develop cybersecurity information sharing programs;

• Coordinate with appropriate Department of Homeland Security cybersecurity and training officials to assist in the incorporation of cybersecurity risk and incident prevention and response (including related to threats of terrorism and acts of terrorism) into existing State and local emergency plans.

Moving Forward

Castro is not a member of the Homeland Security Committee to which the bill was referred for consideration. A number of his cosponsors, however, are influential members of that Committee including Rep. Smith (R,TX) and Rep. Richmond (D,LA). It would seem that there is enough interest in this bill to ensure that it would be considered in Committee. Whether that would translate into an ability to move it forward to the whole House remains to be seen.

If this were to reach the floor in either the House or Senate, there does not seem to be anything controversial enough to cause any significant opposition. I would suspect that it would be considered under suspension of the rules in the House and under unanimous consent in the Senate.

Commentary

Unfortunately, this bill uses a dated definition of ‘cybersecurity risks’ and ‘incident’ that does not include industrial control systems, so the efficacy of preventing cyber-based acts of terrorism is greatly reduced. The definition of both terms refer to ‘information system’ and that is defined in 44 USC 3502(8). That definition reads:

“(T)he term ‘‘information system’’ means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information”.

For the last year or so most cybersecurity legislation {for example see §102(9) of the Cybersecurity Information Sharing Act (CISA) of 2015 included in Division N of the Consolidated Appropriations Act, 2016} has been modifying that definition by adding language that specifically includes “industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers”. This has been done in recognition of the fact that successful attacks on such systems could have physical effects that would be much more devastating than attacks on purely information systems.

To truly be effective the definition of information system used in this bill will have to be changed to the CISA definition. It is also about time that someone in Congress should consider amending the definition in §3502 to bring it into a more inclusive status.

Bills Introduced – 03-15-16

With both the House and Senate in session yesterday there were 26 bills introduced. Three of those bills may be of specific interest to readers of this blog:

HR 4740 To direct the Attorney General to make grants to States and units of local government for the prevention, enforcement, and prosecution of cybercrimes against individuals, and for other purposes. Rep. Clark, Katherine M. [D-MA-5]

HR 4743 To authorize the Secretary of Homeland Security to establish a National Cybersecurity Preparedness Consortium, and for other purposes. Rep. Castro, Joaquin [D-TX-20]

S 2684 A bill to provide for the operation of unmanned aircraft systems by owners and operators of critical infrastructure. Sen. Inhofe, James M. [R-OK] 

The Clark and Castro bills probably have nothing to do with control system security. If so, they will not be mentioned again.

The Inhofe bill is an odd take on UAS and critical infrastructure in that it apparently does nothing to protect CI against drone intrusions. We will see.