S 1544 Introduced – Cyber Coordination with Russia

Earlier this month Sen. Klobuchar (D,MN) introduced S 1544, the No Funds for Cyber Coordination with Russia Act of 2017. This is one of three bills (others: HR 3191 and HR 3259) written by Democrats in response to President Trump’s brief statement of support (and quickly withdrawn support) for a joint US-Russian cybersecurity unit.

Background Information

The bill includes a great deal of background information before it gets to the meat of the matter. It includes broadly written definitions of ‘cybersecurity’ and ‘cybersecurity unit’ that are, in turn based upon the following definition of ‘cyberspace’ {§2(4)}:

“The term ‘‘cyberspace’’ means the global domain within the information environment consisting of the interdependent network of information systems infrastructures (including the Internet, telecommunications networks, computer systems, and embedded processors and controllers).”

Section 3 of the bill sets forth the purpose of the bill:

“The purpose of this Act is to protect United States cybersecurity and critical infrastructure by preventing the President from establishing a cybersecurity unit in coordination with the Government of the Russian Federation, a known foreign adversary.”

Section 4 of the bill outlines a series of ‘findings of Congress’ that deal with the intelligence community’s assessment of Russian governmental involvement in a wide variety of cyber-attacks against the US, including their meddling in the 2016 US presidential election.

The Prohibition

Section 5 of the bill provides a very succinct statement of prohibition of funding, very similar to that found in the other two bills:

“No Federal funds may be used to establish a cybersecurity unit, or any variation thereof, in cooperation or connection with the Government of the Russian Federation.”

Section 7 of the bill even sets forth the conditions under which the provisions of this bill will no longer apply; the President certifies to Congress that the government of the Russian Federation has:

• Ceased ordering, controlling, or otherwise directing, supporting, or financing acts intended to undermine democracies around the world; and

• Submitted a written statement acknowledging interference in the 2016 United States Presidential election.

Moving Forward

While Klobuchar is not a member of the Senate Foreign Affairs Committee (to which this bill has been assigned for consideration), four of her 14 co-sponsors {Sen. Cardin (D,MD), Sen. Markey (D,MA), Sen. Shaheen (D,NH), and Sen. Merkley (D,OR)} are. This means that would normally be possible for the four to ensure that the bill was considered in Committee. With a bill as politically pointed as this one, however, there is little or no chance that the Republican leadership will allow the bill to be considered in Committee, and certainly not on the floor of the Senate.

Commentary

Of the three bills submitted to date on this topic, this one was the most professionally written. This one shows the type of legislative crafting one expects to see in a bill worthy of consideration (if not necessarily passage). While the prohibition in paragraph 5 is as broadly worded as the similar statements in the other two bills, the remainder of the bill would provide enough evidence of specific congressional intent that most judicial reviews of the provisions would have no difficulty in separating out purely police activities of a cyber nature that might involve Russian police cooperation from the more politically charged cybersecurity joint venture proposed by Trump.

Note that Klobuchar has submitted a proposed amendment to HR 2810 (SA 655) that would attempt to accomplish the same purpose, but it is missing the background information portions of this bill. That would bring it more in line with more crassly political standards set in the two bills that were introduced in the House.

HR 3191 Introduced – Russia Cybersecurity

Last week Rep. Boyle (D,PA) introduced HR 3191, the No Cyber Cooperation with Russia Act. The bill would disallow the expenditure of any federal funds for any joint US – Russian cybersecurity initiative. This is a response to the announcement by President Trump after he returned from the G20 Summit that he and Putin had discussed forming a joint cyber-security unit to protect against election hacking.

Section 2 of the bill says simply:

“No Federal funds may be used to establish, support, or otherwise promote, directly or indirectly, the formation of[,] or any United States participation in[,] a joint cybersecurity initiative involving the Government of Russia or any entity operating under the direction of the Government of Russia.”

There are no qualifying definitions or explanations.

Moving Forward

Boyle is a rather junior member of the House Foreign Affairs Committee to which this bill was assigned for consideration. Three of his 13 Democratic cosponsors are also members of that Committee. In normal circumstances, this could provide for the possibility of the bill being considered in Committee. In this case, party membership probably trumps committee membership, so there is very little possibility of this bill being considered in Committee.

Commentary

Even assuming that this is not a completely knee-jerk reaction to a “policy” announcement by Trump (as we frequently saw from Republicans during the Obama Administration) and that there are legitimate reasons to object to the specific policy proposal, the blunt wording of this proposal contains the seeds of many potential unintended consequences.

For example, if Interpol formed a task-force to take down criminal gangs operating botnets, and that unit included police from Russia (where at least some of these botnet operations are headquartered) then this bill would prohibit US participation in the effort. I highly doubt that that is what the crafters intended.

I suspect, however, that this bill (and the two others, HR 3259 and S 1544, that have not yet been printed by the GPO) was written to provide Democrats the opportunity to proclaim that they have introduced legislation opposing Trumps inopportune proposal. Even if the bill were to somehow be considered and approved by the House and Senate, it would certainly be vetoed by the President, if the unit had been a serious policy proposal in the first place (and that is an open question since the unit was proposed in a TWEET®).

Bills Introduced – 07-12-17

Yesterday with both the House and Senate in session there were 46 bills introduced. Of those, four may be of specific interest to readers of this blog:

HR 3191 To prohibit the use of Federal funds to establish, support, or otherwise promote a joint cybersecurity initiative with Russia, and for other purposes. Rep. Boyle, Brendan F. [D-PA-13]

HR 3198 To provide for Federal Aviation Administration research and development, and for other purposes. Rep. Knight, Stephen [R-CA-25]

HR 3202 To require the Secretary of Homeland Security to submit a report on cyber vulnerability disclosures, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

S 1544 A bill to prevent Federal funds from being used to establish a cybersecurity unit in cooperation with the Russian Federation.  Sen. Klobuchar, Amy [D-MN]

HR 3191 and S 1544 are almost certainly political statements rather than a serious attempt at legislating, but they will be followed here for their potential effects on cybersecurity programs of the US government.

HR 3198 will only be followed if it includes cybersecurity provisions.

I will be watching HR 3202 for possible specific language related to industrial control systems.