Senate Amendments to HR 4350 – 11-1-21

While the Senate still has not officially started the consideration of HR 4350, the FY 2022 NDAA, there were 91 amendments proposed yesterday. Three of those amendments may be of interest here:

SA 4156 – Sen Wyden (D,OR): SEC. xxx. Federal Cybersecurity Requirements. [pg 7621].

SA 4181 - Sen Gillibrand (D,NY): SEC. 1601. Matters Concerning Cyber Personnel Requirements. [pg S7645] Similar to SA 3903.

SA 4189 - Sen Whitehouse (D,RI): SEC. xxx. Preventing International Cybercrime [pg S7654] Similar to S 2139.

Review - S 2139 Introduced - International Cybercrime Prevention

Last month Sen Whitehouse (D,RI) introduced S 2139, the International Cybercrime Prevention Act. The bill would make several changes to 18 USC to provide additional legal tools to combat international cybercrime. It includes adding a new 18 USC 1030A, Aggravated Damage to a Critical Infrastructure Computer. A nearly identical bill (S 3288) was introduced by Sen Graham in the 115^th Congress with no action taken.

Whitehouse is a subcommittee chair in the Senate Judiciary Committee to which this bill was assigned for consideration and his three cosponsors {Sen Graham (R,SC), Sen Tillis (R,NC), Sen Blumenthal (D,CT)} are also members of the Committee. This should mean that there is adequate influence to see this bill considered in Committee. It is hard to predict what sort of opposition this bill would draw. I would expect that this would draw some opposition from folks that oppose the current wording of §1030 as it expands rather than restricts the types of offenses under that section.

Graham introduced similar bills in the 115^th, and 114^th Congresses. Neither saw any action taken in the Judiciary Committee. It would be easy to assume that similar inaction would be expected in this Congress, but the leadership has changed and Whitehouse introducing the bill could mean a significant political change in the prospects for the bill. We will just have to wait and see.

The title of this bill is very misleading. There is nothing here that would target international cyber crime and the only prevention activity is the prosecution of individuals used as a deterrent, a fairly ineffective prevention activity.

For a more detailed look at the provisions of the bill and what they could mean for crimes against industrial control systems, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2139-introduced - subscription required.

Bills Introduced – 6-21-21

Yesterday, with the Senate in Washington and the House meeting in pro forma session (they will be in town today), there were 21 bills introduced. One of those bills will see additional coverage in this blog:

S 2139 A bill to amend title 18, United States Code, to prevent international cybercrime, and for other purposes. Sen. Whitehouse, Sheldon [D-RI]

There has been lots of attention in the press to new proposed legislation to address cyber security issues. This bill, for example, was mentioned Friday in an article on TheHill.com:

“In a separate effort, Sens. (R-S.C.), (D-R.I.), Richard Blumenthal (D-Conn.), and (R-N.C.) on Thursday reintroduced legislation originally rolled out in 2018 that would crack down on cyber criminals.

“Their bill, the International Cybercrime Prevention Act [link added for original version of bill], would tighten consequences for hacking a critical infrastructure organization, such as a dam or a hospital, along with expanding the Justice Department’s ability to go after botnet groups.”

We will see how serious the four sponsors of this bill are by how fast this gets considered in Committee. The same goes for the other bills mentioned in Friday’s article, none of which have actually been introduced yet, maybe today?