HR 5658 Passed in House – Cybersecurity Roles

Yesterday, the House took up introduced HR 5658, the DHS Roles and Responsibilities in Cyber Space Act. The bill was considered under the House suspension of the rules process. After minimal debate, with no dissenting voices heard, a recorded vote on the bill was requested. Later in the day, the House voted 313 to 105 to pass the bill. The bill is unlikely to be considered in the Senate.

The bill would require DHS to prepare “a report on the roles and responsibilities of the Department and its components relating to cyber incident response.” It would also specifically add CISA cross-sector responsibilities for enhancing control system cybersecurity.

Since there was no opposition voiced to the bill in yesterday’s debate, it is hard to see what caused the substantial bipartisan (32 Democrats and 73 Republicans voted Nay) opposition to this bill.

Once again, this is a relatively unimportant bill. It would be hard to justify the legislative time necessary to take up this bill in the Senate under regular order. The significant opposition to the bill seen in the House would mean that there would be little chance of this bill being passed under the unanimous consent process. Thus, the only way this bill could make it to the President’s desk would be for the language to be added to some other bill that was headed to the White House.

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5658-introduced - subscription required.

Committee Hearings – Week of 5-15-22

This week, with both the House and Senate in session, there is a very active hearing schedule on both sides of the Hill. FY 2023 budget hearing continue, including Member Day hearings (where congresscritters not on the Appropriations Committee have a chance to plead for their favorite projects). We also have two cybersecurity markups, a health and education cybersecurity hearing, and an emergency response hearing.

Cybersecurity Markups

On Tuesday, the House Science, Space, and Technology Committee will hold a business meeting to consider four pieces of legislation. It will include:

• HR 7569, the Energy Cybersecurity University Leadership Act of 2022.

On Wednesday, the Senate Small Business Committee, will hold a business meeting to consider five bills. It will include:

• S 1687, the Small Business Cyber Training Act of 2021

NOTE: I have not followed this bill closely because it deals with cybersecurity training for employees of Small Business Development Center, not small businesses.

Cybersecurity Hearings

On Wednesday the Senate Health, Education, Labor and Pensions Committee will hold a hearing on “Cybersecurity in the Health and Education Sectors”. The witness list includes:

• Denise Anderson, Health Information Sharing and Analysis Center,

• Joshua Corman, I Am the Cavalry,

• Amy McLaughlin, Consortium of School Networking, and

• Helen Norris, Chapman University

I do not think that there will be any in depth discussion about medical device cybersecurity issues, but I could be wrong with Corman as a witness.

Emergency Response

On Tuesday, the Emergency Preparedness, Response, and Recovery Subcommittee of the House Homeland Security Committee will hold a hearing on “Creating a More Resilient Nation: Stakeholder Perspectives”. The witness list will include:

• Chris Currie, GAO,

• Orlando Rolón, Chief of Police, City of Orlando, and

• George Dunlap, Mecklenburg County Commission

I do not think that there will be any specific discussion about response planning for chemical incidents.

On the Floor

There are five cybersecurity bills scheduled for consideration in the House this week under the suspension of the rules process. They include:

HR 5658 – DHS Roles and Responsibilities in Cyber Space Act, as amended,

HR 6824 – President’s Cup Cybersecurity Competition Act, as amended,

HR 6825 – Nonprofit Security Grant Program Improvement Act of 2022, as amended,

HR 6868 – Cybersecurity Grants for Schools Act of 2022, as amended, and

S 2520 – State and Local Government Cybersecurity Act of 2021,

HR 5658 Reported in House – Cybersecurity Roles

Earlier this month, the House Homeland Security Committee published their report for HR 5658, the DHS Roles and Responsibilities in Cyber Space Act. The Committee considered the bill in a mark-up hearing on October 26^th, 2021 where the bill was amended and adopted by a voice vote.

The revised language for the bill includes two new subsections {§2(9) and §2(12)} in the Congressional findings section of the bill. Both make references to requirements from the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (PL 116-283). Neither change affects the reporting requirements outlined in the bill.

The bill is now cleared for consideration by the Full House. The bill is likely to be taken up under the House suspension of the rules process which limits debate, prohibits floor amendments and requires a super majority for passage. The bill will almost certainly pass with strong bipartisan support.

Review - HR 5658 Introduced – Cybersecurity Roles

Last week, Rep Bacon (R,NE) introduced HR 5658, the DHS Roles and Responsibilities in Cyber Space Act. The bill would require DHS to prepare “a report on the roles and responsibilities of the Department and its components relating to cyber incident response.” The bill was marked-up in Committee this week and was amended and ordered reported favorably.

Once the Committee Report on the bill is published, this bill is likely to move to the floor of the House under the suspension of the rules process and the bill will almost certainly be approved by a bipartisan majority.

For more details about the report, and the Committee markup of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5658-introduced - subscription required.

Committee Hearings – Week of 10-24-21

This week, with both the House and Senate in Washington, there will be a full slate of hearings in both bodies. There are two hearings of note here; a markup hearing and a hearing on transportation cybersecurity.

Markup Hearing

On Tuesday, the House Homeland Security Committee will hold a markup hearing looking at 12 pieces of legislation.

HR 5616, “DHS Basic Training Accreditation Improvement Act of 2021”,

HR 5658, “DHS Roles and Responsibilities in Cyber Space Act”, and

S 658, "National Cybersecurity Preparedness Consortium Act of 2021",

I have not yet published reviews of HR 5616 and HR 5658. While HR 5616 does not appear to affect chemical security inspector training, it could have future impact on cybersecurity law enforcement teams that could be developed within CISA or TSA. HR 5658 is a ‘report to Congress’ bill that may inform future cybersecurity legislative efforts. S 658 passed in the Senate in July and I do not expect any significant amendments in this week’s hearing.

Transportation Cybersecurity

On Tuesday the Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation of the House Homeland Security Committee will hold a hearing on “Transportation Cybersecurity: Protecting Planes, Trains, and Pipelines from Cyber Threats.” The witness list includes:

• Suzanne Spaulding, Center for Strategic & International Studies,

• Patricia F.S. Coswell, Guidehouse,

• Jeffrey L. Troy, Aviation Information Sharing and Analysis Center, and

• Scott Dickerson, Maritime Transportation System Information Sharing and Analysis Center

Commentary - It is disappointing to see this industry only panel without having the TSA Administrator providing some insight into what that agency is trying to do with the limited resources it currently has available.

On the Floor

According to the House Majority Leader’s web site, we may actually see a vote on HR 3684, the Infrastructure Investment and Jobs Act. There is a lot of new cybersecurity program language and funding tied up in that bill. This is still tied up in the negotiations over the Build Back Better bill, so do not hold your breath waiting on the vote.

As I noted yesterday, we may see the Senate take up HR 4350, the FY 2022 NDAA, this week. The amendment process for that bill may see additional cybersecurity language added.

Bills Introduced – 10-21-21

Yesterday, with both the House and Senate in session, there were 57 bills introduced. Four of those bills may receive additional coverage in this blog:

HR 5658 To require the Secretary of Homeland Security to submit a report on the cybersecurity roles and responsibilities of the Federal Government, and for other purposes.  Rep. Bacon, Don [R-NE-2]

S 3035 A bill to establish the Artificial Intelligence Hygiene Working Group, and for other purposes. Sen. Peters, Gary [D-MI]

S 3042 A bill making appropriations for the Departments of Commerce and Justice, Science, and Related Agencies for the fiscal year ending September 30, 2022, and for other purposes.

S 3045 A bill making appropriations for the Departments of Transportation, and Housing and Urban Development, and related agencies for the fiscal year ending September 30, 2022, and for other purposes.

I am not sure what to expect with S 3035. If you google ‘artificial intelligence hygiene’ you get references to the use of AI to modify/control hand washing in medical settings, but I do not think that that is the purpose of this bill. I suspect that it is cybersecurity related. If that is the case, I will be watching the bill for language and definitions that would include industrial control systems within its purview.

I will be covering the three remaining bills.