Senate Agrees to Conference on HR 4521 – America COMPETES Act

On Thursday, the Senate considered the House message to go to conference on resolving their differences on HR 4521, the America COMPETES Act of 2022. By a final vote of 67 to 27, the Senate insisted on their amendments to the bill, agreed to a conference committee, and authorized the Chair to appoint the Senate representatives to that conference.

HR 4521 started off in the House last summer as the Bioeconomy Research and Development Act of 2021. The bill quickly morphed into a massive spending and authorization bill. When it finally passed in the House in February, it contained 19 Divisions that included everything from cybersecurity, to temporary duty suspensions and even a child care resource guide requirement.

When the bill arrived in the Senate, it looked for sure that the party-line vote in the House would prevent the bill from moving forward in the Senate. But the Leadership had a different idea, instead of considering the House version of the bill they quickly substituted language from S 1260, an equally bloated, but more bipartisan, spending and authorization bill that had passed in the Senate with a moderately bipartisan vote of 68 to 32 last June. With a few minor tweaks and amendments the substitute language was adopted in HR 4521 in a similar vote of 68 to 28 just a month ago.

With many similarities between the two bills, but even more differences, this will be an interesting backroom challenge to craft compromise language between the two massive versions. Fortunately, the one area that will see the most agreement will be in the area of cybersecurity, with most of the provisions in both bills probably making it into the final version.

HR 4521 Passed in Senate – COMPETES Act

Yesterday, the Senate completed their consideration of H.R. 4521, the America COMPETES Act. The Senate closed debate on the substitute language based on S 1260 and passed the bill by identical votes of 68 to 28. The bill goes back to the House for consideration of the Senate’s changes to the bill. The House is likely to insist on their language, which would send the bill to a conference committee to work out the differences.

Senate Continues Consideration of HR 4521 – COMPETES Act

Yesterday, the Senate continued their debate on HR 4521, the America COMPTES Act. A vote will be held this morning on proceeding to vote on amendments to the bill. To date, only one amendment has been offered, SA 5002. That amendment would provide substitute language for the bill that would essentially be substituting the language from S 1260 that had previously been adopted by the Senate, but not taken up by the House.

The Senate is likely to finish work on the bill late this week. The House would then have to decide if it would accept the revised Senate language or go to conference to work out the differences in the bill. I expect that the House will demand a conference, otherwise they would just have taken up S 1260. This could delay the completion of action on this bill for weeks.

Senate Votes to Proceed to Consideration of HR 4521 – COMPETES Act

Yesterday, the Senate voted to close debate on the motion to begin consideration of HR 4521, the America COMPETES Act of 2022. The vote was a moderately bipartisan 66 to 35. There have not yet been any amendments submitted for the bill.

The House passed the bill last month with a nearly party-line vote of vote of 222 to 210. This level of Republican opposition would normally mean that there would be little chance of a successful cloture vote in the Senate. Seventeen Republican votes in the Senate yesterday versus 1 Republican vote in the House would seem to show that there is a much larger appetite in the Senate to consider support for technology (this bill is touted as a biotechnology bill, but there is support for other technology as well, including cybersecurity) in the Senate than in the House. Of course, the Senate did pass a similar bill last year (S 1260), but that bill contained significant anti-China provisions that would be expected to draw support from Republicans.

It will be interesting to see if any amendments to this bill are considered. That would require the bill to go back to the House for further consideration or would require a conference committee to work out the differences. I had suspected that the Senate would substitute language from S 1260 for the House language in this bill, and that is still a possibility.

Senate Begins Consideration of HR 4521 – COMPETES Act

Yesterday, the Senate began consideration of HR 4521, the America COMPETES Act of 2022. A cloture vote was ordered for Monday evening on the motion to proceed to debate on the bill. There were no amendments offered which is typically a sign on bills like this that no one expects the debate to begin. The bill passed in the House on a very nearly party-line vote so there is unlikely to be 60 votes to begin debate.

This ‘biotechnology bill’ quickly morphed to a major technology spending/regulation package similar in scope to S 1260 that was passed in the Senate. It does contain some interesting cybersecurity provisions.

Review - HR 4521 Passed in House – COMPETES Act

Earlier this month the House passed HR 4521, the America COMPETES Act of 2022. While billed as a ‘bioeconomy’ bill, this legislation is another huge (3610 pages) legislative conglomeration that addresses a large number of disparate issues. It includes 10 distinct sections addressing cybersecurity issues, funding for a cybersecurity training program and 12 separate mentions in passing of cybersecurity provisions in loosely related requirements.

Spending for Cybersecurity Training

Section 10303 authorizes spending for a variety of programs through the National Science Foundation. This includes money for the Cybercorps Scholarship for Service Program:

FY 2022 - $70,000,000,

FY 2023 - $72,000,000,

FY 2024 - $78,000,000,

FY 2025 - $84,000,000, and

FY 2026 - $90,000,000

Cybersecurity Sections

The bill contains ten sections that deal specifically with cybersecurity issues. Many of these sections are essentially the same as standalone legislative proposals that have already been offered in the House and/or Senate. Most of those earlier bills have little chance of making it through the legislative process on their own. The ten cybersecurity sections are:

§10223. NIST authority for cybersecurity and privacy activities

§10224. Software security and authentication.

§20102. Understanding cybersecurity of mobile networks. [HR 2685]

§20106. NTIA policy and cybersecurity coordination [HR 4046]

§20107. American cybersecurity literacy [HR 4055]

§30127. Digital connectivity and cybersecurity partnership.

§40101. Federal Rotational Cyber Workforce Program [HR 3599 or S 1097]

§50107. Improving cybersecurity of small entities [HR 6541]

§50108. Critical Technology Security Centers.

§90601. Dr. David Satcher cybersecurity education grant program. [S 2305]

Moving Forward

The bill passed in the House by a nearly (1 Democrat and 1 Republican voted the other way) straight party-line vote of 222 to 210. This would indicate that the bill would never pass the cloture process for consideration in the Senate. Nor is it a given that if it did make it to a vote in the Senate, that there would be enough votes for it to be sent to the President.

There is one potential route forward for this bill. If the House were to vote to amend S 1260, the Endless Frontiers Act (a similar conglomeration bill) with the language from this bill, then the Senate would insist on their language and the two versions of the bill would go to conference to work out the differences. A conference version would pass in the House on a party-line vote and may make it through the Senate (with judicious paring and reduced spending).

For more details about the cybersecurity provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4521-passed-in-house - subscription required.

HR 3599 Introduced - Federal Rotational Cyber Workforce Program

I will not be covering HR 3599, the Federal Rotational Cyber Workforce Program Act of 2021. As introduced, the bill (like S 1097) is a purely federal level IT workforce development tool. It does not contain any language or definitions that would indicate that it would apply to control system staff positions. Similar language was included in the version of S 1260, the United States Innovation and Competition Act of 2021, that was passed in the Senate last month.

HR 2225 Passed in House - the National Science Foundation for the Future Act

Yesterday the House considered HR 2225, the National Science Foundation for the Future Act, under the suspension of the rules process. The bill passed by a bipartisan vote of 345 to 67. Even though 67 Republicans voted against the bill, there was no negative comment uttered on the floor of the House during the debate on the bill.

It is unlikely that the Senate will take up the version of this bill that was passed in the House. The Senate passed S 1260 earlier this month and that bill also provided authorization for the National Science Foundation, and much more. Even where the two bills do the same thing, authorizing funding for the NSF for instance (see HR 2225, §4 and S 1260, §2116) there are significant differences between the two bills.

What the Senate is likely to do (if) when they consider this bill is to substitute the language from S 1260 for the House version and then pass the bill. The House would be unlikely to accept the Senate language. This would lead to a conference committee working out the many differences between the two bills. I expect that we will receive the combined language sometime this fall. It will be interesting to see what cybersecurity language comes out in that bill.

Review - S 1260 and Cybersecurity

With the recent publication of the engrossed version (passed in the Senate) of S 1260, the United States Innovation and Competition Act of 2021, I have now had a chance to go back and look at the cybersecurity related provisions that were included in the massive, 2375 pages, bill. In addition to the new sections added in the substitute language that I briefly mentioned earlier, there were a number of provisions added in passing that are worthy of mention.

Protecting research from cyber theft

Section 2305 amends 15 USC 272(e)(1)(A) by adding ‘institutions of higher education’ to the list of considerations NIST has to address in developing consensus-based cybersecurity standards. Additionally, §2305(b) requires NIST to “disseminate and make publicly available resources to help research institutions and institutions of higher education identify, protect the institution involved from, detect, respond to, and recover to manage the cybersecurity risk of the institution involved related to conducting research.”

NASA Cybersecurity

Section 2676 (pg 690) would amend 51 USC 20301 by adding a requirement for the NASA Administrator to “up-date and improve the cybersecurity of NASA space assets and supporting infrastructure” {new §20301(c)}. NASA would also be required to establish a Cyber Security Operations Center. Finally, it would authorize NASA to “implement a cyber threat hunt capability to proactively search NASA information systems for advanced cyber threats that otherwise evade existing security tools” {§2676(c)(1)}.

Cyber Response and Recovery

Section 4252 (pg 1238) is the Cyber Response and Recovery Act. It is essentially the language of S 1316, which I have previously described in detail.

Federal Rotational Cyber Workforce Program

Division D of the bill includes Title II, Cyber and Artificial Intelligence. Subtitle B (pg 1257) of that Title is the Federal Rotational Cyber Workforce Program Act of 2021. It is essentially the language of S 1097 which the Senate Homeland Security and Governmental Affairs Committee ordered reported favorably last month.

Commentary

Almost all of the cybersecurity provisions in this bill are limited to information technology because of the language or definitions involved. It is not clear that that was the intention of the crafters of this bill, but it is certainly the effect.

For a more detailed look at the cyber provisions of S 1260, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-1260-and-cybersecurity (subscription required).

S 1260 Passed in Senate – Endless Frontiers Act

Yesterday the Senate completed their debate on S 1260, the Endless Frontiers Act, and passed the bill by a moderately bipartisan vote of 68 to 32. The Schumer substitute language was adopted earlier by a similar vote. No additional amendments were adopted yesterday. With the adoption of the Schumer amendment the title of the bill was changed to the “United States Innovation and Competition Act”.

I will have a more detailed analysis of the cybersecurity provisions of the bill when the engrossed version of the bill is published.

Committee Hearings – Week of 6-6-21

This week, with the Senate in Washington and the House holding hearings, there is a full slate of hearings scheduled on both sides of Capitol Hill. We have two different hearing on the Colonial Pipeline ransomware attack and there is a confirmation hearing on two high ranking cybersecurity personnel in the Administration. Then there are two iffy hearings that I will be watching for.

Colonial Pipeline

On Tuesday the Senate Homeland Security and Governmental Affairs committee will hold a hearing on “Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyber Attack”. The sole witness currently scheduled is Joseph A. Blount, JR., CEO of Colonial Pipeline.

On Wednesday the House Homeland Security Committee will hold a hearing on “Cyber Threats in the Pipeline: Using Lessons from the Colonial Ransomware Attack to Defend Critical Infrastructure”. Blount will also be a witness at this hearing. Additionally, the CTO of FireEye/Mandiant, Charles Carmaka, will be a witness.

Confirmation Hearing

On Thursday the Senate Homeland Security and Governmental Affairs Committee will hold a confirmation hearing for three individuals, including Jen Easterly to be Director, Cybersecurity and Infrastructure Security Agency, DHS; and Chris Inglis to be National Cyber Director. These are two key cybersecurity positions and there is more than a little pressure to move these nominations forward quickly.

Iffy Hearings

The Senate Homeland Security and Governmental Affairs Committee is scheduled to hold a business meeting on Wednesday. There is currently no agenda available. This is probably going to be a markup hearing, but it could include votes on confirmations related to earlier hearings. I will be watching the website for the agenda.

The second iffy hearing is supposed to be a full committee markup hearing of HR 3684, the FY 2022 surface transportation authorization act bill. I have seen one news report describing the hearing in passing, but there is nothing on the Committee web site or the House.gov web site about the hearing. I will probably do a quick review of the lengthy bill later today, just to be on the safe side.

On the Floor

While there will be House hearings this week, the body will only meet in pro forma sessions on Tuesday and Friday, so nothing is scheduled there.

The Senate will resume consideration of S 1260, the Endless Frontier Act, today with a final vote probably on Wednesday. The vote has been pushed back a number of times already on this bill, so I would not be surprised to see happen again. There are a lot of games yet to be played on this bill.

S 1260 Debate Continues – Endless Frontiers Act – 5-28-21

Yesterday the Senate continued their debate of S 1260, the Endless Frontiers Act. No action was taken on any amendments and no new amendments were introduced. When the Senate returns to Washington after their Memorial Day recess, the Senate is scheduled to take-up SA 1858 (pg S3279). Once action is complete with that amendment the Senate will consider the substitute language without having to complete a cloture vote.

Vote on the final bill is currently being scheduled for June 8^th and will not (under the current agreement) require a cloture vote, but it will require a 60-vote supermajority to pass. As currently crafted the bill will only contain the cybersecurity provisions added in the substitute language.

Before the substitute language is voted upon, there is a chance that there will be a unanimous consent motion to consider a bundle of amendments. The exact composition of that bundle is still subject to negotiation, but there is a possibility that one or more of the cybersecurity amendments offered by this point may be included.

S 1260 Debate Continues – Endless Frontiers Act – 5-27-21

Yesterday the Senate continued their debate of S 1260, the Endless Frontiers Act. One of the amendments was adopted by a strongly bipartisan vote of 91 to 4. It was a very large tariff amendment that had nothing to do with cybersecurity. One other amendment was defeated by a recorded vote.

There were 84 new amendments offered yesterday (but not all were for this bill). One of the amendments (SA 2105, pg S3910) for this bill was a cybersecurity bill from Sen. Ossoff (D,GA) dealing with cybersecurity education. It was similar to S 2013 that Ossoff offered on Tuesday. It is not unusual for Senators to make minor changes to a submitted amendment in order to get it approved for consideration on the floor.

The bill was considered today (more on that after today’s Congressional Record is published tomorrow), but the vote on the bill was postponed until after the Memorial Day Holiday (a week long holiday in Congress).

S 1260 Debate Continues – Endless Frontiers Act – 5-26-21

Yesterday the Senate continued their debate of S 1260, the Endless Frontiers Act. Three amendments were adopted by, one by unanimous consent and five were rejected by recorded votes (all failing to achieve the agreed upon 60 votes for passage). None of the amendments yesterday dealt with cybersecurity issues.

Yesterday there were an additional 56 amendments submitted. They included one hazardous material amendment and two cybersecurity amendments. The amendments were:

• SA 2037 - Sen Portman (R,OH) - At the appropriate place in title V of division B, insert the following:

SEC. 25XX. Regulation of foreign manufacturers of cylinders used in Transporting hazardous materials. Pgs S3513

• SA 2070 - Sen Bennet (D,CO) - At the appropriate place, insert the following:

SEC. XXX. Establishment of national reserve digital corps Pg S3529

• SA 2075 - Sen Hassan (D, NH) - At the appropriate place, insert the following:

SEC. XXX. Cybersecurity and infrastructure security apprenticeship program. Pg S 3532

The filing deadline for further amendments was set for today at 2:30 EDT.

S 1260 Debate Continues – Endless Frontiers Act – 5-24-21

Yesterday the Senate continued their debate of S 1260, the Endless Frontiers Act. No votes were held yesterday on amendments to this bill. There were 53 new amendments submitted including four related to cybersecurity issues. Debate will continue tomorrow.

The new cybersecurity related amendments were:

• SA 1932 - Sen INHOFE (R,OK) - At the end of title III of division F, add the following:

SEC. 6302. Addressing threats to national security with respect to wireless communications research and development. Pg S3349

• SA 1946 - Sen GRAHAM (R,SC) - At the end, add the following:

DIVISION G—Combating Chinese theft of trade secrets Pg S3355

NOTE: Includes: TITLE III—Combating cybercrime Pg S3357

• SA 1950 - Sen HAWLEY (R,MI) At the appropriate place, insert the following:

SEC. XXX. Imposing data security requirements and strengthening review of foreign investments with respect to certain technology companies from foreign countries of concern. Pg S3364

• SA 1954 - Sen HAWLEY - At the appropriate place, insert the following:

SEC. XXX. Requirement that certain providers of systems to department of defense disclose the source of printed circuit boards when sourced from certain countries. Pg S 3367

S 1260 Debate Continues – Endless Frontiers Act – 5-20-21

Yesterday the Senate continued their debate of S 1260, the Endless Frontiers Act. Two votes were held on amendments to the substitute language, both failed along partisan lines. Neither amendment were on topics of interest in this blog. Debate will continue Monday.

There were 125 amendments to the bill submitted yesterday. Three of those amendments concerned cybersecurity issues. Those amendments were:

• SA 1768, Sen Rosen (D,NV) - At the appropriate place, insert the following:

SEC. XXX. United States-Israel cybersecurity cooperation. Pg 3231

• SA 1793, Sen Daines (R,MT) - At the appropriate place, insert the following:

SEC.XX. Study relating to consequences and benefits of amending the CFAA. S3245

• SA 1831, Sen Hassan (D,NH) - At the appropriate place, insert the following:

SEC. XX. Cybersecurity and infrastructure security apprenticeship program. Pg S3261

S 1260 Debate Continues – Endless Frontiers Act – 5-19-21

Yesterday the Senate continued their debate on S 1260, the Endless Frontiers Act. As I noted yesterday, the substitute language being considered for this bill includes a number of new cybersecurity provisions. There were votes on two amendments yesterday, neither of particular interest. There were 180 new amendments submitted, including one UAS protection amendment and four cybersecurity amendments. Debate was expected to continue today.

The UAS amendment was SA 1680, Sen Lee (R,UT) - Strike section 4411 and insert the following:

SEC. 4411. Authority to enter into contracts to protect facilities from unmanned aircraft. Pg 3167

The cybersecurity amendments were:

• SA 1534, Sen Barrasso (R,WY) - At the end of subtitle C of title I of division C, add the following:

SEC. 3124. Prohibition on importation of power inverters from countries from which cyberattacks on United States critical energy infrastructure originate. Pg S2793

• SA 1552, Sen Risch (R,ID) -  At the appropriate place, insert the following:

SEC. XXX. Strengthening and enhancing cybersecurity usage to reach small businesses. Pg S2800

• SA 1581, Sen Manchin (D,WV) - Strike section 4252(a) and insert the following:

(a) IN GENERAL.—Title XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is amended by adding at the end the following:

Subtitle C—Declaration of a Significant Incident. PG S3111

• SA 1614, Sen Scott (R,FL) - At the appropriate place in title III of division F, insert the following:

SEC. 63XX. Securing the bulk-power system. Pg S3135

Two amendments, SA 1523 and SA 1518, were scheduled for votes today. Neither of these amendments address issues that I cover in this blog.

Senate Begins Debate on S 1260 – Endless Frontier Act

Yesterday the Senate began considering S 1260, the Endless Frontier Act. As is typical for such bills, the Senate has scrapped both the introduced and reported language for the bill, and is instead considering substitute language (Schumer Amendment, SA 1501) offered by Sen Grassley (R,IA). While the original bill did not have any significant cybersecurity language, the substitute language adds a number of cybersecurity provisions.

New Cybersecurity Provisions

Looking at the table of contents of SA 1501, these are the new cybersecurity provisions:

DIVISION B - ENDLESS FRONTIER ACT

TITLE II - NSF Research, Stem, and Geographic Diversity Initiatives

Sec. 2305. Protecting research from cyber theft

TITLE VI - SPACE MATTERS

PART VIII - Miscellaneous Provisions

Sec. 2676. Cybersecurity.

DIVISION D - Homeland Security and Governmental Affairs Committee Provisions

TITLE II—Cyber and Artificial Intelligence

Subtitle B—Cyber Response and Recovery

Sec. 4251. Short title.

Sec. 4252. Declaration of a significant incident

TITTLE III – Personnel

Subtitle B—Federal Rotational Cyber Workforce Program

Sec. 4351. Short title.

Sec. 4352. Definitions.

Sec. 4353. Rotational cyber workforce positions.

Sec. 4354. Rotational cyber workforce program.

Sec. 4355. Reporting by GAO.

Sec. 4356. Sunset.

Sections 4251 and 4252 are probably derived from S 1316, the Cyber Response and Recovery Act. Sections 4351 thru 4356 are probably derived from S 1097.

Other Amendments

There were 23 amendments submitted yesterday for S 1260. In addition to SA 1501 there was an additional cybersecurity amendment, SA 1516 (pg S2741). That amendment would add a section to the bill addressing “United States-Israel Cybersecurity Cooperation”. There is currently no indication if that amendment will be considered on the floor of the Senate.