Bills Introduced – 12-19-18

Yesterday with both the House and Senate in session, there were 60 bills introduced. I will be watching the following:

HR 7327 To require the Secretary of Homeland Security to establish a security vulnerability disclosure policy, to establish a bug bounty program for the Department of Homeland Security, to amend title 41, United States Code, to provide for Federal acquisition supply chain security, and for other purposes. Rep. Hurd, Will [R-TX-23] 

HR 7328 To reauthorize certain programs under the Public Health Service Act and the Federal Food, Drug, and Cosmetic Act with respect to public health security and all-hazards preparedness and response, to clarify the regulatory framework with respect to certain nonprescription drugs that are marketed without an approved drug application, and for other purposes. Rep. Brooks, Susan W. [R-IN-5] 

HR 7327

HR 7327 was actually passed yesterday in the House by a vote of 362 to 1 (69 representatives – almost evenly from both parties – not voting and likely not present) even without an official text of the bill available from the GPO.

A quick look at a draft posted on the shows IT-centric cybersecurity measures requiring DHS to establish: a researcher vulnerability reporting system for public facing DHS software and systems, a cyber-supply chain security program and a bug bounty program. It also includes vague language requiring DHS to establish a policy of publicly reporting such vulnerabilities. Oddly enough, the ‘other provisions’ includes a Title II, Border Patrol Agent Pay Reform.

None of this is new, but it was combined into one package for a last minute passage in the House under suspension of the rules. There is a chance that the Senate could take this bill up today or tomorrow (if they are still in session) under the unanimous consent process, but the border patrol pay language may prevent that.

HR 7328

No action was taken yesterday on HR 7328, but it was published by the GPO. Some interesting (for emergency response planning) provisions but it does include a somewhat odd cybersecurity provision. Section 703 of the bill would require the Secretary of Health and Human Services to submit to Congress a “strategy for public health preparedness and response to address cybersecurity threats (as defined in section 102 of Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501) [link added]) that present a threat to national health security.” Sharp eyed readers will recall that that definition is based upon a control system inclusive definition of ‘information system’ {§1501(9)}.

The language of §703 is rather vague about what specific types of cyber incidents that strategy should address. It is likely that Brooks (who will not return to Congress next month) was concerned about attacks on medical information systems and perhaps medical devices, but the language is broadly enough crafted to include incidents like those I have recently been addressing in my Future ICS Security News blog (see here for instance).

There is an outside chance that this bill could be considered in the House today or tomorrow (again if they are in session tomorrow), but it is extremely unlikely to go past consideration there. It is not clear if there would be enough bipartisan support for this bill to pass in the House (as it would require a super-majority- 2/3rds vote) if considered under suspension of the rules.

House Passes Three Homeland Security Bills

Yesterday the House took up 17 homeland security related bills under the suspension of rules process and passed all of them. Of these, three are probably of interest to readers of this blog:

• HR 437, the Medical Preparedness Allowable Use Act;

• HR 612, the United States-Israel Cybersecurity Cooperation Enhancement Act of 2017; and

• HR 677, the CBRN Intelligence and Information Sharing Act of 2017.

HR 437 passed by a voice vote after less than 10 minutes of ‘debate’; no one spoke in opposition to the bill.

HR 612 passed by a voice vote after about 16 minutes of ‘debate’; no one spoke in opposition to the bill.

HR 677 passed by a voice vote after about 5 minutes of ‘debate’; no one spoke in opposition to the bill.

All three of these bills would almost certainly pass in the Senate if they make it to the floor for consideration. Since earlier versions of all three of these bills passed in the House in the 114^th Congress, but were not taken up by the Senate, it is obvious that consideration by the Senate is not a given.

With these bills being passed in the first 30-days of the 115^th Congress, time constraints will not be a factor in whether or not they make it to the floor. What matters is whether or not there is a champion in the Senate with enough political influence with the leadership to bring them to the floor. If any of these bills are considered, they will most likely be considered under the Senate’s unanimous consent procedure with no debate and no actual vote. A single Senator can block a bill under this procedure.

Homeland Security Mark-up Hearing Results

Yesterday the House Homeland Security Committee held their markup hearing looking at six different bills including (of potential interest here) HR 1204, HR 1791, HR 2952, and HR 3107. All six bills were ordered to be reported favorably; some with amendments (including HR 1204, HR 2952, and HR 3107).

The Committee provides a nice summary of the amendments, but none of them were significant. The closest to being a meaningful change was the amendment from Rep. Horsford (D,NV) that changed one of the subcommittee names of the new Aviation Security Advisory Committee from the “Perimeter Security Subcommittee” to the “Perimeter Security, Exit Lane Security , and Access Control Subcommittee”.

Actually ‘access control’ was already one of the topics that this subcommittee was to cover, so it only added ‘Exit Lane Security’. This topic is already a big deal in the airport security community so this just gave ‘Exit Lane Security’ a specific home.

Of course, any time a House Committee can do the markup of six bills in a single hearing, we know that there are not going to be any controversial or substantive changes made to any of the bills.

Bills Introduced 02-07-13

Yesterday, with only the Senate in session (the House was only in town for a short week) there were 38 pieces of legislation introduced. One of those was of potential interest to readers of this blog; S 242, bill to reauthorize certain programs under the Public Health Service Act and the Federal Food, Drug, and Cosmetic Act with respect to public health security and all-hazards preparedness and response, and for other purposes. This bill was introduced by Sen. Burr (R,NC).

This bill looks like it may be similar to HR 307, the Pandemic and All-Hazards Preparedness Reauthorization Act of 2013, that was passed last month in the House.  It would make little sense to introduce a companion bill when the House bill has already been referred to the Senate, so this may include some alternative language. Still that could have been handled with an amendment to the House bill, so we will have to wait and see what the bill actually says when it is published by the GPO.

Again, I would like to see it include a requirement for high-risk chemical facilities to notify local health agencies and hospitals of significant quantities of toxic inhalation chemicals used at those facilities so that there medical response community could be properly prepared for a mass casualty event if there were a large release of such materials either due to an accidental release or a terrorist attack.