More on Amendments to HR 624

Yesterday I noted that there had been a modification made to the amendment offered by Rep. Sanchez (D,CA), but from the information available at the time it was not clear what that amendment was. The Congressional Record for yesterday provides the expected details:

Insert ‘‘Security’’ after ‘‘Homeland’’ in the second instruction.

Two pages earlier in the Congressional Record (same link as above) there is also a notice that a 13^th Amendment had been added to the Rule for the consideration of HR 624. This new amendment, submitted by Chairman McCaul (Homeland Security) would make DHS and the Justice Department the action agencies for receiving shared information by amending §1104(b)(1)(A)(ii) and §1104(b)(1)(A)(ii) by replacing the words “Federal Government” with “entities of the Department of Homeland Security and the Department of Justice designated under paragraphs (1) and (2) of section 2(b) of the Cyber Intelligence Sharing and Protection Act”. This amendment also passed in a voice vote of 409 – 5.

This last change was made to mollify some of the critics of the bill that were afraid that NSA and the military would become the action agencies for receiving this information. It is not clear at this point if this change would overcome President Obama’s intention to veto the bill.

The bill will now move to the Senate where, if it is actually brought to the floor of the Senate by Sen. Reid (D,NV), there is a good chance that a similar bipartisan vote would send the bill to the President.

HR 624 Passes As Amended in House

Today the House passed HR 624, CISPA, by a largely bipartisan vote of 288 – 127 after passing a number of amendments to the bill. About half of the Democrats in the House voted in favor of the bill. It looks like all of the amendments considered yesterday and today were adopted by nearly unanimous votes. One amendment, #8 from Rep. Sanchez (D,CA), was modified in some manner, we won’t know specifically how until the Congressional Record is printed tomorrow.

House Rules Committee Adopts Rules for Debate on HR 624

This evening the House Rules Committee adopted H. Res 164, a structured rule for the consideration of HR 624, Cyber Intelligence Sharing and Protection Act (CISPA). The rule provides for limited debate and the consideration of 12 amendments. The Majority Leader’s web site says that the debate on HR 624 will begin tomorrow afternoon and continue through Thursday with a vote no later than 3:00 pm EDT.

The Committee considered over forty amendments that were submitted by various House members and pared it down to 12. Nothing in the bill or its proposed amendments specifically addresses control system security issues.

I expect that most of the cleared amendments will pass and the amended bill will almost certainly pass of a somewhat bipartisan vote. Whether the offered amendments will change the bill sufficiently to avoid a threatened Presidential veto remains to be seen. The point is almost moot because I doubt that the bill will make it to the floor of the Senate, the next required stop on the road to the President’s desk.

HR 624 Reported in House

Yesterday the House Intelligence Committee reported HR 624, the Cyber Intelligence Sharing and Protection Act, as amended. The report is not yet available from the Government Printing Office (GPO). This formality is a prerequisite to this week’s consideration of this bill by the House.

BTW: The reports for HR 756, Cybersecurity Enhancement Act of 2013 (H Rept 113-33), and HR 967, Advancing America's Networking and Information Technology Research and Development Act of 2013 (H Rept 113-34), are now available from the GPO. There is no new information in either report. Both bills will be considered today under suspension of the rules.

Committee Hearings – Week of 4-14-13

This week the House and the Senate will be hard at work in Washington and the President’s budget request will take up a lot of time in committees. There will also be a cybersecurity hearing and a look at Sequestration. Oh yes, it’s going to be Cybersecurity Week on the floor of the House.

Budget Hearings

There are too many to discuss in detail so here is a listing:

• United States Coast Guard Budget – House Appropriations

• Department of Defense Budget – House Appropriations

• Department of Transportation Budget – House Appropriations

• President’s Fiscal Year 2014 Budget Request for Coast Guard and Maritime Transportation Programs – House Transportation

• Fiscal Year 2014 National Defense Authorization Budget Request for Department of Defense (DOD) Science and Technology Programs – House Armed Services

• The President’s FY 2014 Budget Request for the Department of Homeland Security – House Homeland Security

• An Overview of the Fiscal Year 2014 Budget Proposal at the National Institute of Standards and Technology (NIST) House Science

• The Homeland Security Department's Budget Submission for Fiscal Year 2014 – Senate Homeland Security

• The National Guard and Reserve Fiscal Year 2014 Budget Request – Senate Appropriations

I’ve added the NIST budget to the ones that I’ll be following this year because of the Cybersecurity Framework under development by that agency.

Cybersecurity

CISPA (HR 624) will be coming to the floor this week so there will be a House Rules Committee hearing on Tuesday afternoon to develop the rule for the consideration of the bill. The only question is if it will be an open rule with amendments from the floor (my guess – not) or a lengthy list of amendments included in the rule (probably). At least a couple of the amendments rejected in Committee last week may be considered by the Committee of the Whole House.

Sequestration

The Subcommittee on National Security of the House Oversight and Government Reform Committee will be holding a hearing on Thursday looking at Sequestration Oversight: Prioritizing Security over Administrative Costs at TSA. There is no witness list yet so we really have no idea if surface transportation security will be addressed, but based upon past history, I doubt it. Congress has a tendency to forget security of trains, trucks and busses.

Cybersecurity Week

As I mentioned earlier, CISPA will be coming to the floor of the House this week as will a number of other cybersecurity bills. At this point CISPA is the only one that will be covered by a Rule; the others will be debated under suspension of the rules.

On Tuesday three bills will be covered under suspension of the rules. This means no more than an hour of debate, no amendments and the leadership considers these bills a slam-dunk for passage since it takes a 3/5^th majority to pass bills this way. The bills that will be considered are:

• H.R. 1163 - Federal Information Security Amendments Act of 2013 

• H.R. 756 - Cybersecurity Enhancement Act of 2013 

• H.R. 967 - Advancing America’s Networking and Information Technology Research and Development Act of 2012 

HR 756 does contain some control system language as does HR 967 though neither are going to have a significant impact on ICS security issues. HR 1163 is a federal IT security measure that I am quite frankly ignoring.

The current plans for CISPA, according to the Majority Leader’s web site, is for debate to start on Wednesday with a final vote before 3:00 pm EDT on Thursday.

HR 624 Amended and Recommend in House Intel Committee

Yesterday the House Intelligence Committee held a mark-up hearing on HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA). After 10 amendments were considered the bill was adopted on a bipartisan 17-2 vote. Six of the amendments were adopted by voice votes; the remaining amendments were defeated in identical 4-16 votes.

As expected all of the amendments were relatively minor tweaks to the language of the bill attempting to address privacy concerns with the information sharing provisions of the bill. Nothing was added (or attempted to be added) to the bill that would address control system security issues; this remains a pretty purely information technology security measure.

The bill will move to the floor of the House probably next week. There will almost certainly be an open rule for its consideration with a number of privacy amendments offered. The bill will, as it did last session, pass with a substantial bipartisan majority.  And just as likely, it will not be taken up by the Senate.

CISPA Hearing Scheduled – 04-10-13

The House Intelligence Committee web site now says that there will be a markup hearing on HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA), on Wednesday on April 10^th. A second page notes that the hearing will be open but it will be held in a House meeting room (HVC-304) that is normally used for closed meetings. I haven’t been there, but I would assume that this means that public seating will be limited. There is no word on either page about whether or not the hearing will be televised or web cast.

Congressional Hearings – Week of 04-07-13

The House and Senate come back to Washington this week refreshed from their two week Easter Recess. There are a large number of hearings that will be conducted this week. Part of that is driven by the fact that the President releases his FY 2014 budget request tomorrow; a bunch of people are going to the Hill to explain what the President wants and why. Budget hearings will be in the news for the next couple of weeks while the two authorization committees get to work on their FY 2014 spending plans.

Budget Hearings

There will be four separate budget hearings of potential interest to readers of this blog, three of them for their potential coverage of cybersecurity issues and the fourth will potentially address cybersecurity, chemical security and safety, port and transportation security and emergency response. Actually, I don’t expect detailed mention of any of the above, but we will probably here some general policy statements. I am including the Commerce hearing because of the NIST role in the the Presidents cybersecurity EO. The four hearings are

The Fiscal Year 2014 National Defense Authorization Budget Request from the Department of Defense; House Committee on Armed Services; Thursday, April 11, 2013 (10:00 AM - 1:00 PM)

Department of Homeland Security Budget; Subcommittee on Homeland Security (House Committee on Appropriations); Thursday, April 11, 2013 (10:00 AM)

The Department of Commerce’s Fiscal Year 2014 Budget Request; Commerce, Justice, Science Subcommittee (Senate Appropriations Committee); Thursday, April 11, 2013, 10:00 a.m.,

Counterterrorism and WMD

The Counterterrorism and Intelligence Subcommittee of the House Homeland Security Committee will be holding a hearing on Thursday on Counterterrorism Efforts to Combat a Chemical, Biological, Radiological, and Nuclear (CBRN) Attack on the Homeland. No witness list is yet available. This is not currently being billed as a hearing on a specific bill, but I suspect that we will see the perennial introduction of a “WMD Prevention and Preparedness Act” this week and this will serve as the opening round of hearings to support that bill.

TSA and Risk-Based Security

The Transportation Security Subcommittee of the House Homeland Security Committee will be holding a hearing on Thursday on TSA’s Efforts to Advance Risk-Based Security: Stakeholder Perspectives. No witness list is available. As with most TSA hearings I suspect that this will concentrate on passenger security, but cargo security just might get mentioned.

Sequestration

I almost included this in the budget hearing section of this post, but this is probably even more political theater than those hearings so I’m keeping it separate. The Oversight and Management Efficiency Subcommittee of the House Homeland Security Committee will be holding a hearing on Friday on The Impact of Sequestration on Homeland Security: Scare Tactics or Possible Threat? No witness list is currently available. There is no telling what part of homeland security might get discussed here.

CISPA Markup

There has been a lot of talk in the press over the last week or so about a markup hearing on the CISPA bill (HR 624, the Cyber Intelligence Sharing and Protection Act) being held behind closed doors this coming week. There is nothing on the House Intelligence Committee web site that would indicate that there is a markup scheduled on this bill.

Now, I would not be surprised to hear that there were unofficial meetings about the amendments that will be proposed for this bill when it comes to a markup. This is one of those committees that tries to form a bipartisan consensus on important legislation and if CISPA is going to have any chances of reaching the President, it will have to have lots of bipartisan support. Given the controversial nature of the bill, the only way that this is going to be achieved is if there is some serious deal making on the provisions of the bill. That deal making always happens behind closed doors.

There seems to be a consensus that this bill will make it to the floor of the House this month. That means that there will need to be a committee markup sometime this week or next.

New CISPA Bill Identical to Version Passed in House

As I promised, since the GPO was finally able to make a copy of HR 624, the Cyber Intelligence Sharing and Protection Act (CISPA), available yesterday, I have done a detailed review of the bill and it is virtually identical (two small, inconsequential wording changes) to the version of HR 3523 that was passed in the House last session, including the privacy provisions added during the House floor debate.

While this bill is being actively opposed by privacy advocates with a zeal that approaches paranoia, I really don’t see their concern. The bill has been watered down to the point where there are really no requirements to share information with the federal government about cyber-attacks and no real authority for the federal government to share information with the private sector.

This bill will make its way back to the floor of the House and will pass once again. The Senate will ignore the bill and we will be left with the information sharing provisions of the President’s EO without any legal protections to actually allow the information sharing to really proceed.

Bills Introduced – 02-13-13

Yesterday there were two bills introduced in the House that may be of specific interest to readers of this blog. They were:

H.R.624: To provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes. Sponsor: Rep Rogers (R,MI)

H.R.654: To amend the Safe Drinking Water Act to reauthorize technical assistance to small public water systems, and for other purposes. Sponsor: Rep Harper (R,MS)

CISPA

HR 624 is the Cyber Intelligence Sharing and Protection Act of 2013. A quick look at the Committee Draft of the bill (the GPO version is not yet available) does not reveal any major differences from the version (HR 3523) passed in the House last session. I’ll take a closer look at the provisions of the bill when the GPO version comes out.

I did see at least one press report yesterday that claimed that this bill would prohibit the implementation of the President’s Cybersecurity Executive Order. I clearly do not see any such provision in the Committee Draft of this bill.

Drinking Water Security

According to a press release from Rep. Harper, HR 654 would “reauthorize and modernize much needed technical assistance and compliance training for small water districts to meet federal compliance for an additional five years” under the Safe Drinking Water Act. Since this act contains the only current drinking water system security requirements (minimal though they are), this bill may have some impact on drinking water security. We will have to see the details of the bill when it is made available by the GPO.