HR 4792 (S 2664) Introduced – Cyber Shield Program

Last week Rep. Lieu (D,CA) introduced HR 4792, the Cyber Shield Act of 2019. The bill {and its companion bill, S 2664; introduced by Sen Markey (D,MA)} would establish require the Department of Commerce to establish the Cyber Shield Program; a program for the voluntary certification and labeling of products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data.

The products referenced in the bill only apply to ‘consumer facing objects’ that {§2(3)}:

• Connect to the internet or other network; and

• Collect, send, or receive data; or

• Control the actions of a physical object or system

Commentary

Presumably the ‘consumer facing’ portion of the definition excludes industrial control systems but may apply to certain medical devices. Unfortunately, the FDA is not specifically mentioned as one of the federal agencies to be consulted with on establishing standards in this program. Nor is the Cybersecurity and Infrastructure Security Agency (CISA) mentioned; surprising in that they would certainly have an interest in cybersecurity certifications of consumer products used by federal agencies.

In general, these bills are weak on definitions; no definition of the key term ‘cybersecurity’ for instance. They also fail to address the issue of coordination of vulnerability reporting or even take into account the fact that independent researchers are the most common source for reporting vulnerabilities.

The basic premise is helpful, but this implementation is weak to say the least. This is surprising since Lieu and Markey have both tried to position themselves as cybersecurity gurus in Congress.

Bills Introduced – 10-22-19

Yesterday with both the House and Senate in session there were 45 bills introduced. Three of those bills may see further coverage in this blog:

HR 4792 To establish a voluntary program to identify and promote internet-connected products that meet industry-leading cybersecurity and data security standards, guidelines, best practices, methodologies, procedures, and processes, and for other purposes. Rep. Lieu, Ted [D-CA-33] 

S 2656 A bill to disclose access to election infrastructure by foreign nationals. Sen. Kennedy, John [R-LA] 

S 2664 A bill to establish a voluntary program to identify and promote internet-connected products that meet industry-leading cybersecurity and data security standards, guidelines, best practices, methodologies, procedures, and processes, and for other purposes. Sen. Markey, Edward J. [D-MA] 

It looks like HR 4792 and S 2664 may be companion bills. See this article here about these bills. As always definitions and other details will be important.

It will be interesting to see how S 2656 deals with the complex attribution issue. I expect a simplistic approach.