Senate Amendments to HR 2810 (FY 2018 NDAA) – 9-13-17

Yesterday the Senate actually began consideration of HR 2810, the FY 2018 National Defense Authorization Act (NDAA). Meanwhile, more amendments continue to be proposed. In addition to the previously proposed amendments (see here, here, here and here) a large number of possible amendments to HR 2180 were proposed in the Senate yesterday; including five that may be of specific interest to readers of this blog:

• SA 1003. Mr. MCCAIN - National Defense Authorization Act for Fiscal Year 2018 substitute language (pgs S5487-671);

• SA 1009. Mr. SASSE - cyberspace solarium commission (pgs S5674-6);

• SA 1019. Ms. HARRIS - pilot program on integrating into the department of defense workforce individuals with cybersecurity skills and technical expertise whose services are supported by private persons (pg S5678);

• SA 1025. Mr. WHITEHOUSE - botnet prevention (pgs S5680-1); and

• SA 1055. Mr. PORTMAN - report on cyber applications of blockchain technology (pg S5701-2)

Substitute Language

The substitute language (SA 1003) from Sen. McCain (R,AZ), and the staff of the Senate Armed Services Committee, is arguably the most important amendment to be offered to date, as it will form the working basis for the language that will be considered on the floor of the Senate. This language is based (as expected) on S 1519, the original Senate NDAA bill and it includes each of the cybersecurity related sections that I identified in S 1519.

Cyberspace Solarium Commission

SA 1009 would require DOD to establish the Cyberspace Solarium Commission with a mandate to “develop a consensus on a strategic approach to protecting the crucial advantages of the United States in cyberspace against the attempts of adversaries to erode such advantages” {SA 1009(a)}. The name harkens back to Eisenhower’s 1953 National Security Council’s Solarium Special Committee that was used to help formulate Eisenhower’s containment strategy vis-à-vis the Soviet Union.

The Commission would be tasked with {SA 1009(f)}:

• Weighing the costs and benefits of various strategic options to reach the goal of protecting the US cyberspace advantage;

• Reviewing adversarial strategies and intentions, current programs for the protection of the US cyberspace advantage, and the capabilities of the Federal Government to understand if and how adversaries are currently being deterred or thwarted in their aims and ambitions; and

• Evaluating the current allocation of resources for understanding adversarial strategies and intentions and protecting the US cyberspace advantage.

Botnet Prevention

This proposed amendment from Sen. Whitehouse (D,RI) and Sen. Graham (R,SC) is very similar to S 2931 that was introduced in the 114^th Congress by Graham and Whitehouse. This amendment does not deal with DOD issues, but the Senate rules do allow for the consideration of extraneous amendments.

Moving Forward

The Senate held a cloture vote today on the McCain substitute language amendment and it passed with a bipartisan vote of 84 to 9. When the Congressional Record for today is published tomorrow I expect that we will see that some amendments were dealt with today, but at this point I have no idea which ones.

S 1519 Introduced – FY 2018 NDAA

Earlier this week Sen. McCain (R,AZ) introduced S 1519, the National Defense Authorization Act for Fiscal Year 2018. The bill has already been marked up in the Senate Armed Services Committee. The House version of this bill is currently being considered on the floor of the House. The bill includes a number of cyber provisions.

Those provisions include:

§510. Service credit for cyberspace experience or advanced education upon original appointment as a commissioned officer.

§1042. Department of Defense integration of information operations and cyber-enabled information operations.

§1621. Policy of the United States on cyberspace, cybersecurity, and cyber warfare.

§1622. Cyber posture review.

§1623. Modification and clarification of requirements and authorities relating to establishment of unified combatant command for cyber operations.

§1624. Annual assessment of cyber resiliency of nuclear command and control system.

§1625. Strategic Cybersecurity Program.

§1626. Evaluation of agile acquisition of cyber tools and applications.

§1627. Report on cost implications of terminating dual-hat arrangement for Commander of United States Cyber Command.

§1628. Modification of Information Assurance Scholarship Program.

§1629. Measuring compliance of components of Department of Defense with cybersecurity requirements for securing industrial control systems.

§1630. Exercise on assessing cybersecurity support to election systems of States.

§1630A. Report on various approaches to cyber deterrence.

§1630B. Prohibition on use of software platforms developed by Kaspersky Lab.

Only one of these provisions (§1629) specifically addresses industrial control system operations.

ICS Compliance

Section 1629 requires DOD to modify its Cyber Scorecard (part of the DOD Cybersecurity Discipline Implementation Plan) to specifically address securing “the industrial control systems of the Department against cyber threats, including supervisory control and data acquisition systems (SCADA), distributed control systems (DCS), programmable logic controllers (PLC), and platform information technology (PIT)” {§1629(a)}.

Kaspersky Lab

Section 1630B is the much-publicized prohibition of DOD use or continued use products from the Kaspersky Lab. There is nothing in the language of §1630B (or in the Committee Report on the bill) that explains the reason for the prohibition.

Moving Forward

This bill is one of the ‘required’ bills that will be passed each year. The bill will be taken up by the Senate, probably before the summer recess starts in August. The process will include a substantial number of amendments to be considered. Once the bill passes in the Senate, a conference committee will take up the differences between the House version (HR 2810) and this bill.

Commentary

If the §1629 provisions make it into the final bill, DOD will have to substantially re-write their Cybersecurity Discipline Implementation Plan. The current document is IT-centric with no mention of control systems or their unique security issues.

The Kaspersky provision is pure political theater; anti-Russian posturing at its worst. Interestingly, the ‘immediately’ provisions of the section do not become effective until October 1^st, 2018 {§1630B(c)}, theoretically one year after this bill becomes effective. I suspect that this unusual provision was added to allow calmer heads to remove this requirement after the political capital is harvested.