The Rebirth of S 3414?

There’s an interesting article over on the NorwichBulletin.com (the site for a Connecticut newspaper) that describes Sen. Lieberman’s (I,CT) efforts to keep S 3414 alive. James Mosher, the article’s author, states that:

“Lieberman said he has asked the Chamber of Commerce to recommend amendment language, something the organization is working on.”

Now the bill is not officially dead. The failure of the cloture vote could just be a temporary measure. Sen. Reid (D,NV) was the last one to vote in the cloture vote and voted ‘No’ after it was apparent that there were not enough votes to close debate on the bill. This allowed him to submit a motion to reconsider the cloture vote. The vote on that motion could come at any time after the Senate reconvenes on September 10^th (or not at all if an agreement is not reached).

There has been lots of talk about behind the scenes negotiations on exactly what amendments could be brought to the floor in the final debate that would allow opponents to agree to a vote on the bill. Depending on the agreement reached the amendments might need a 60 vote margin to pass but allow a straight vote on the final bill.

There is a distinct possibility that the Administration’s talk of using an executive order to implement cybersecurity regulation of critical infrastructure is a serious play to encourage the opponents to take part in serious negotiations.  After all, in a vote in the Senate they have some say in the outcome; an executive order leaves them out of the picture completely.

If a deal is reached what happens? Well the first move will be a vote on Reid’s motion to reconsider the cloture vote and shortly thereafter a vote on the cloture motion. Then there will be a number of votes (depending on the agreement reached) on amendments and then a final vote on the bill. There’s no telling what will actually end up in the bill until we see the amendments, but we can be sure that it will not please the President since the base bill does not go far enough for the Administration in the realm of regulating cybersecurity in the private sector/critical infrastructure.

The House would still have to consider the bill before it would have a chance to go to President for signature. The probability that the House would consider the bill, particularly before the election, would go up in direct proportion to the President’s disapproval; the more Obama objects to the inadequacy of the bill the more likely the House is to consider it. Again the President’s threat of regulating through an executive order would also play into that approval process.

Now the election rears its ugly head and changes the whole political calculations. As the election approaches and it looks like Obama will not win (one possible outcome), then the threat of an executive order fades as a motive for the Republican controlled House to act on S 3414; no regulations could be put into place in the time remaining in the President’s term and the executive order could be overturned as soon as Romney is sworn in. If it looks like Obama will win then the possible (or even actual) executive order weighs more heavily in the move to get the Republican leadership to move S 3414 to the floor.

Based upon recent history, it is unlikely that it will be really clear who will win the election in the weeks leading up to the election recess. If that is the case and the Senate doesn’t go ‘far enough’ in removing regulatory provisions of S 3414 the House leadership is unlikely to try to take any action before the election; they have political cover in that they have already passed cybersecurity legislation. The results of the election will then guide what actions the House takes or fails to take.

So, in the final analysis there is a remote chance that the Congress might pass a cybersecurity bill in this session; not real likely and probably after the election. It is hard to tell what the final form that the bill might take, but it is almost certain that minimal regulatory requirements found in the current version of S 3414 would disappear. Whether or not there would be strictly voluntary provisions that cover industrial control systems remains to be seen.

Senate Consideration of Cybersecurity Bill

Yesterday theHill.com reported that Sen. Lieberman (I,CT) was saying that the Senate would consider a cybersecurity bill by the end of next week. The article notes that Lieberman was basing this prediction on a promise from Sen. Reid (D,NV). An as of yet not completed compromise version of S 2105 will be the bill to be considered.

The two ideas in the bill that have been holding up consideration have been the requirements for information sharing (privacy protection) and critical infrastructure protection (burdensome regulations of business). As I noted in my initial blog post on this bill, the critical infrastructure protection provisions would not have been particularly effective in regards to their protection of control systems. Further reducing that effectiveness to overcome objections of portions of the business community will make them practically useless in protecting the country from the potential effects of cyber-attacks on critical installations.

If the bill does come to the Senate floor (and Sen. Reid has been making these promises to bring a comprehensive cybersecurity bill to the Senate floor ‘next week’ for two years now) ‘by the end of next week’, it will certainly take some time to get it through the debate process. Let’s assume that it actually passes by July 27^th; that would only leave one week for consideration of the bill by the House before the summer recess begins on August 3^rd. That is not likely to happen.