Bills Introduced – 9-30-21 – Senate

 Yesterday, with both the House and Senate in session (more about that see below), there were 28 bills introduced in the Senate. One of those bills may receive additional coverage in this blog:

S 2905 A bill to improve requirements relating to establishment of a consortium of universities to advise the Secretary of Defense on cybersecurity matters, and for other purposes. Sen. Rounds, Mike [R-SD] 

I will be watching this bill for language and definitions that would include industrial control systems within the coverage of this bill.

The House – The Congress.gov website has not published the listing of bills introduced in the House yesterday, because, by one of those neat political games that congressional leadership is allowed to play, the House is still in session on September 30^th. They have been in ‘recess’ since about 4:00 pm yesterday while the Democratic leadership tries to figure out how to get out of the box into which they backed themselves back in August, taking a vote on HR 3684 as amended by the Senate.

Speaker Pelosi promised the moderates in that mid-summer-recess session that they would get a chance to vote on that infrastructure bill on September 27^th. Meanwhile the progressive wing of the Democratic Party vowed to vote against HR 3684’s passage unless there was a ‘simultaneous’ vote on the more expensive Build Back Better bill (HR 5376). Well, since that bill is still not in a form that is capable of passing in the Senate (a whole nother separate political challenge) Pelosi cannot bring that bill to the floor because the moderates will not back it if they do not receive the political cover of final passage of the bill.

So, the September 30^th session of the House remains ‘in session’ while Pelosi brokers some sort of deal to move forward, or just finally gives up and admits that congressional politics can just be stupid at times.

BTW: Since HR 3684 was, in part at least, the FY 2022 surface transportation authorization bill, federal transportation programs were no longer authorized as of 00:01 this morning. Money will still flow to those programs because the House did approve the Senate version of HR 5305, the FY 2022 continuing resolution that keeps federal programs funded through December 3^rd. But authority to regulate (and operate in some cases) transportation functions has technically stopped. What that means in actual practice remains to be seen.

HR 5220 Introduced – Cyberwar

Last week Rep. Himes (D,CT) introduced HR 5220, the Cyber Act of War Act of 2016. This bill is very similar to S 2905 that was introduced earlier last week. A minor wording difference could result in significantly different consequences.

Differences

The only significant difference between the two bills is found in four words in §2(a)(1). The Senate bill requires the President to develop a policy for “determining when an action carried out in cyberspace constitutes an act of war against the United States”. The House version substitutes ‘a use of force’ for the words ‘an act of war’. The House version allows the US government much more leeway in how it would be expected to reply to the base cyberspace action by an adversary.

Moving Forward

Neither Himes, or his co-sponsor {Rep. Westmorland, (R,GA)} is a member of either the House Foreign Affairs Committee or the Armed Services Committee. Thus it is unlikely that either committee will take up consideration of the bill.

The House version of this bill would be more likely to be passed by Congress because it provides much more leeway in the expected response to serious cyber attacks. It is, however, unlikely that the bill would ever make it to a committee vote, much less a vote before either body.

Commentary

This version of the bill is a much less strident political message and seems to be less of an attempt to specifically make President Obama look bad. It appears to be a more reasonable attempt to address the place of cyber-attacks on the homeland within the conventional force response playbook of the United States military. The inclusion of the Armed Services Committee in the list of considering committees reflects this fact.

Still this bill is unnecessary as the current version of the Law of War Manual already adequately addresses this policy issue.

S 2905 Introduced – Cyberwar

Earlier this week Sen. Rounds (R,SD) introduced S 2905, the Cyber Act of War Act of 2016. The bill would require the development of a policy describing when an action in cyberspace constituted an act of war.

Policy Requirement

Section 2 of the bill would require the President to {§2(a)}:

• Develop a policy for determining when an action carried out in cyberspace constitutes an act of war against the United States; and

• Revise the Department of Defense Law of War Manual accordingly.

Moving Forward

Rounds is not a member of the Senate Foreign Relations Committee, the committee to which this bill was referred for consideration, so he is unlikely to have adequate influence to get the bill considered by that Committee.

The bill is written broadly enough that there really is nothing in the bill that should drive any significant objections to the bill. It would seem that the easiest way for this bill to be considered would be to include the bill as an amendment to either an appropriations or authorization bill.

Commentary

What constitutes an ‘act of war’ is an inherently political decision. Such a decision would be based on a totality of circumstances rather than a characteristic action. This may be why the current Law of War Manual does not include a discussion of what constitutes an ‘act of war’ nor does it actually mention the term ‘act of war’.

Drawing lines in the sand, and defining what constitutes an ‘act of war’ is probably the ultimate line in the sand, sets up an administration for all sorts of potential problems. It provides an adversary with an artificial construct that says that you can push to this line without risking a military response. This could actively encourage an adversary wishing to embarrass the United States to take actions just short of the ‘act of war’ standards to prove that it can act with impunity.

Similarly, a creative adversary could press pass the limits of the definition of an ‘act of war’, but do so in a manner that would make a military response incompatible with other US foreign or domestic policy. These types of actions would be similar to the continued use of chemical weapons by Syrian forces after the President drew a line in the sand about the continued use of chemical weapons, or the North Korean’s ignoring of international sanctions in its testing of nuclear weapons and long-range delivery means.

In this case it would appear that Rounds is deliberately trying to force the President to draw a line in the sand that would either force a military reaction against your cyber opponent of choice (Iran, North Korea, ISIS, China, Russia and so on) or embarrass the current administration by failing to react to an ‘act of war’. I say this because the 2015 version of the DOD Law of Warfare Manual already includes a relatively comprehensive discussion of how cyber operations relate to the law of warfare. A careful reading of Chapter 16 provides more than enough guidance on how to determine when an offensive cyber operation is the equivalent to a more conventional military operation.

Bills Introduced – 05-09-16

With just the Senate in session, the House returns today, there were a dozen bills introduced yesterday. Of those one may be of specific interest to readers of this blog:

S 2905 A bill to require the President to develop a policy for determining when an action carried out in cyberspace constitutes an act of war against the United States, and for other purposes. Sen. Rounds, Mike [R-SD]

This bill is almost certainly political grandstanding, but it is does have potentially serious cybersecurity implications if it does move forward. It will be interesting to see how the bill is actually worded.