House Passes S 1917 – K-12 Cybersecurity

Yesterday the House took up S 1917, the K–12 Cybersecurity Act of 2021, under the suspension of the rules procedures. There was limited debate, with no one speaking in opposition to the bill. The bill was passed by a voice vote. The bill now goes to the President for signature.

Committee Hearings – Week of 9-27-21

This week with both the House and Senate in session, and the end of the fiscal year at week’s end, there is a full slate of hearings on both sides of the Capitol. Of interest here are oversight hearings for TSA, the CSB and DHS. Lots of important action on the floor of both the House and Senate. It will be a busy week.

Oversight Hearings

On Wednesday, the House Homeland Security Committee will hold a hearing on “20 Years After 9/11: The State of the Transportation Security Administration”. The witness list will include David Pekoske, the current TSA Administrator and three former Administrators. While this should be a wide ranging discussion, it will probably focus on air travel security as that has been the agency’s focus over its life, but pipeline security questions will be raised.

On Wednesday, the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee will hold a hearing on “Protecting Communities from Industrial Accidents: Revitalizing the Chemical Safety Board”. No witness list is currently available.

On Thursday, the Oversight, Management, and Accountability Subcommittee of the House Homeland Security Committee will hold a hearing on “20 Years After 9/11: Transforming DHS to Meet the Homeland Security Mission”. The witness list includes:

• Chris Currie, Government Accountability Office,

• Randolph “Tex” Alles, DHS,

• Angela Bailey, DHS

Looking at the witness list, I suspect that this hearing will concentrate on personnel issues. Cybersecurity workforce issues could be addressed.

On the Floor in the Senate

A cloture vote on HR 5305, the Extending Government Funding and Delivering Emergency Assistance Act (FY 2022 Spending continuing resolution plus debt limit extension), is scheduled for early this evening. If this gets the necessary 60 votes to continue debate (not likely) then the Senate will approve the bill later this week. If it fails, the ball would be tossed back to the House for a clean continuing resolution. Plenty of time before the continued government funding is required by Midnight Thursday.

On the Floor of the House

Last month, Speaker Pelosi promised the moderate Democrats a vote on the Senate version of HR 3684, the bipartisan infrastructure bill, today. Instead, it looks like all they are going to get today is a one-hour debate on the bill. The vote is apparently being slipped to Thursday to perhaps give the progressive wing of the Party a chance to vote on their expensive Build Back Better Act. HR 3684 needs to pass before Thursday Midnight as the authorization for most transportation programs expires at that time. This would not be as drastic as a government shutdown, critical programs would continue to operate (if a spending measure is in place), but regulatory enforcement efforts would face legal hurdles.

The final version of the Build Back Better Act is still not completed. The bill was marked up by the House Budget Committee on Saturday, but final changes will take place in the House Rules Committee. No hearing for that consideration is currently scheduled according to the Rules Committee website. Which indicates that horse trading is still going on behind closed doors. This bill is likely to come to the floor with limited debate and no amendments. The progressive Democrats want a floor vote on this bill before HR 3684 is considered.

According to Majority Leader Hoyer’s (D,MD) Weekly Leader site the House should take up two cyber security related bills (along with 10 other bills) under the suspension of the rules process. As I wrote last week, these were also potentially on the schedule last week, but were never taken up. The two bills are:

• HR 4611 – DHS Software Supply Chain Risk Management Act of 2021, and

• S 1917 – K-12 Cybersecurity Act of 2021

House to Consider 2 Cybersecurity Bills – 9-21-21

Majority Leader Hoyer (D,MD) announced last night that the House could be taking up five bills today under the suspension of the rules process that were not included in the weekly plan for House action this week. Those bills include two pieces of cybersecurity legislation covered here in this blog:

• HR 4611 – DHS Software Supply Chain Risk Management Act of 2021, and

• S 1917 – K-12 Cybersecurity Act of 2021

The suspension of the rules process in the House provides for limited debate, no floor amendments and requires a super-majority to pass. Bills are offered under this process when the House Leadership feels that there should be sufficient bipartisan support for a bill for it to achieve that supermajority approval.

There is a possibility that these bills will not be considered today as there is a bit of turmoil in the House. The House is also supposed to consider a continuing resolution, but the language of that bill has not yet been officially produced. That bill is supposed to be considered under a rule that was supposed to be developed yesterday, but as of this morning, the House Rules Committee web site did not have that rule published. These five bills may have been added as legislative filler material while backroom negotiations continue on the CR.

S 1917 Passed in Senate – K-12 Cybersecurity

Yesterday, the Senate took up and passed S 1917, the K-12 Cybersecurity Act of 2021, under the Senate’s unanimous consent process. There was no debate and no vote. The House will not take up the bill until sometime after it returns from their Summer Recess in September.

A version of this bill was introduced in the House (HR 4691), but there is also a competing bill (HR 4005). There has been no action on HR 4005, but HR 4691 has been adopted by the House Homeland Security Committee. The House leadership will determine if HR 4005 or S 1917 will be the bill considered by the House. In either case, the bill will almost certainly be considered under the suspension of the rules process.

HR 4691 Introduced - K–12 Cybersecurity

Last month, Rep Langevin introduced HR 4691, the K–12 Cybersecurity Act of 2021. The bill would require CISA to conduct a study on the specific cybersecurity risks facing K–12 educational institutions and develop an online cybersecurity training toolkit designed for officials at K–12 educational institutions. The bill is nearly identical to S 1917. No funding is authorized in the bill.

The only difference between the two bills (besides the bill numbers, of course) is that this version of the bill does not capitalize the word “congressional” the second time that it is used in §2(b)(2). This is a more appropriate usage than the capitalized version used in S 1917.

HR 4691 was considered by the House Homeland Security Committee on July 28^th, 2021. It was adopted without amendment as part of an en bloc approval of eight bills by a voice vote. This strong bipartisan support should allow the bill to be taken up by the whole House under the suspension of the rules process. This would allow for limited debate, no floor amendments and would require a super majority for passage.

As I noted in my article about S 1917 at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-1917-introduced - (subscription required), this bill utilizes the IT restrictive definition of the term ‘information systems’, thus limiting CISA support to administrative and instructional cybersecurity while ignoring the security of control systems used in the physical plant and security systems.

Committee Hearings – Week of 7-26-21

With both the House and Senate in Washington and looking forward to the summer recess, there is a full slate of hearings this week. They include two Rules Committee hearings of spending bills, NDAA markups, two other mark-up hearings, CSB Nominations, and five cybersecurity related hearings.

Spending Bill Rules

In order to get the spending bills passed in the House before the summer recess, the House is, once again, combining spending bills into minibus bills. The House Rules Committee will be meeting twice this week to formulate the rules for consideration of the first two minibus bills.

Monday – HR 4452 First Minibus (LHHS, ARD, EW, FSG, IER, MC, VA, THUD), and

Tuesday – HR 4336 2^nd Minibus ( Leg, State, CJS)

NDAA Markups

The various subcommittees of the House Armed Services Committee will be meeting this week to mark-up their respective portions of HR 4350, the National Defense Authorization Act for Fiscal Year 2022. The full Committee mark-up is currently scheduled for September 1^st, 2021. The one subcommittee hearing of note here will be the Wednesday mark-up hearing of the Subcommittee on Cyber, Innovative Technologies, and Information Systems.

Other Mark-Up Hearings

On Tuesday the House Science, Space, and Technology Committee will be holding a mark-up hearing considering five bills. One of the bills may be (I have not seen the language yet) of interest here: HR 4609, the National Institute of Standards and Technology for the Future Act of 2021.

On Wednesday the House Homeland Security Committee will be holding a mark-up hearing considering ten bills. Two of those bills will be of interest here (based upon the committee prints available on the hearing web site):

HR 4611, The “DHS Software Supply Chain Risk Management Act of 2021

HR ____, The “K-12 Cybersecurity Act"

HR 4611 is a software bill-of-materials bill. I will try to review this in more detail before Wednesday. The K-12 cybersecurity bill will probably be introduced today. The committee print shows that it is very similar to S 1917 not the previously introduced house bill, HR 4005.

CSB Nominations

On Thursday, the Senate Environment and Public Works Committee will be holding a confirmation hearing for the three nominees for Board membership on the U.S. Chemical Safety and Hazard Investigations Board.

Cybersecurity Hearings

On Tuesday the Subcommittee on National Security of the House Oversight and Reform Committee will hold a hearing on “Defending the U.S. Electric Grid Against Cyber Threats”. The witness list includes:

• Eric Goldstein, CISA,

• Puesh M. Kumar, CESER,

• Joseph H. McClelland, FERC

On Tuesday the Senate Judiciary Committee will be holding a hearing on “America Under Cyber Siege: Preventing and Responding to Ransomware Attacks”. The witness list includes:

• Richard Downing, DOJ,

• Bryan Vorndran, FBI,

• Eric Goldstein, CISA,

• Jeremy Sheridan, Secret Service

On Tuesday the Senate Homeland Security and Governmental Affairs Committee will be holding a hearing on “Resources and Authorities Needed to Protect and Secure the Homeland”. The sole witness will be Secretary Alejandro N. Mayorkas.

On Tuesday the Senate Commerce, Science, and Transportation Committee will be holding a hearing on “Pipeline Cybersecurity: Protecting Critical Infrastructure”. The witness list includes:

• David Pekoske, TSA,

• Polly Trottenberg, DOT,

• Leslie Gordon, GAO

On Thursday the Cybersecurity, Infrastructure Protection, & Innovation Subcommittee of the House Homeland Security Committee will be holding a hearing on “The Cyber Talent Pipeline: Educating a Workforce to Match Today’s Threats”. The witness list includes:

• Kevin Nolten, CYBER.ORG,

• Ralph Ley, Idaho National Laboratory,

• Tony Coulson, California State University, San Bernardino

Review - HR 4005 Introduced - Enhancing K–12 Cybersecurity

Last month, Rep Matsui (D,CA) introduced HR 4005, the Enhancing K–12 Cybersecurity Act. The bill would require CISA to establish a school cybersecurity information exchange, a cybersecurity incident registry, and a K–12 cybersecurity technology improvement program. The bill would authorize $10 million per year through 2023 to fund such programs. This bill is not related to S 1917, K–12 Cybersecurity Act of 2021, in anyway.

Matsui is not a member of either the House Homeland Security Committee or the Education and Labor Committee to which this bill was assigned for consideration. Four of her cosponsors {Rep Katko (R,NY), Rep Langevin (D,RI), Rep Garbarino (R,NY), Rep McCaul (R,TX)} are members of the Homeland Security Committee (and Katko is the Ranking Member) so there is probably sufficient influence available to see this bill considered in Committee. I see nothing in this bill that would draw organized opposition.

I suspect that there would be sufficient bipartisan support for this bill in Committee that the House leadership would move this bill to the floor of the House under the suspension of the rules process.

For a more detailed analysis of the bill and my suggestions for its improvement, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4005-introduced - subscription required.

Committee Hearings – Week of 7-11-21

This week the Senate is meeting in Washington and the House will be conducting remote hearings. We will see a number of markups of FY 2022 spending bills, two cybersecurity related markup hearings and two DHS oversight hearings.

Spending Bills

7-12-21 Energy and Water Development, and Related Agencies - Subcommittee

7-12-21 Commerce, Justice, Science, and Related Agencies - Full Committee

7-12-21 Transportation, Housing and Urban Development and Related Agencies Subcommittee

7-13-21 Homeland and Defense - Subcommittee

7-16-21 Energy and Water Development, and Related Agencies, and Transportation, Housing and Urban Development, and Related Agencies – Full Committee

Cybersecurity Markups

On Wednesday the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting. They will consider 15 pieces of legislation including the following cybersecurity related bills.

• S 1917, K-12 Cybersecurity Act of 2021, and

• S 1324, Civilian Cyber Security Reserve Act,

On Wednesday the Senate Energy and Natural Resources Committee will hold a business meeting on a new bill, the Energy Infrastructure Act, to invest in the energy and outdoor infrastructure of the United States to deploy new and innovative technologies, update existing infrastructure to be reliable and resilient, and secure energy infrastructure against physical and cyber threats, and for other purposes. I will try to complete at least a brief review of that bill before the hearing.

DHS Oversight

On Thursday the House Homeland Security Committee will hold a hearing on “Securing the Homeland: Reforming DHS to Meet Today's Threats”. This hearing is related to the recent introduction of HR 4357. The witness list includes:

• Tom Warrick, Atlantic Council,

• Carrie Cordero, Center for a New American Security, and

• Katrina Mulligan, Center for American Progress

On Friday the  Emergency Preparedness, Response, & Recovery Subcommittee of the House Homeland Security Committee will hold a hearing on “Examining the U.S. Department of Homeland Security Countering Weapons of Mass Destruction Office”. The witness list includes:

• Gary Rasicot, DHS, and

• Christopher P. Currie, GAO

Review - S 1917 Introduced - K–12 Cybersecurity Act of 2021

Last month Sen Peters (D,MI) introduced S 1917, the K–12 Cybersecurity Act of 2021. The bill would require CISA to conduct a study on the specific cybersecurity risks facing K–12 educational institutions and develop an online cybersecurity training toolkit designed for officials at K–12 educational institutions. No funding is authorized by this bill.

Within 120 days of the passage of this bill, CISA would be required to “conduct a study on the specific cybersecurity risks facing K–12 educational institutions”. A report to Congress would be required on the results of the study. Additionally, CISA would be required to develop recommendations that include voluntary cybersecurity guidelines designed to assist K–12 educational institutions in facing the cybersecurity risks identified.

Section 3(d) of the bill would require CISA, within 120 days of completing the recommendations described above, to “develop an online training toolkit designed for officials at K–12 educational institutions”.

Peters, and two of his three cosponsors {Sen Scott (R,FL) and Sen Rosen (D,NV)}, are members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. Since Peters is the Chair of that Committee, he certainly has the influence to see this bill considered in Committee. I see nothing in this bill that would engender any specific opposition. I suspect that this bill would receive substantial bipartisan support in Committee.

For a more detailed look at the requirements of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-1917-introduced - subscription required.

Bills Introduced – 5-27-21

Yesterday with just the Senate in session, there were 95 bills introduced. One of those bills may receive additional coverage in this blog:

S 1917 A bill to establish a K-12 education cybersecurity initiative, and for other purposes. Sen. Peters, Gary C. [D-MI]

Okay, it is highly unlikely that this bill will contain language or definitions relating to control system cybersecurity, but I am probably going to keep an eye on this bill, particularly if it authorizes significant funding, because elementary (in both senses of the word) cybersecurity education is going to be a long-term need for this country.