Senate HSGAC Committee Amends and Adopts Bills – 09-26-18

Earlier this week the Senate Homeland Security and Governmental Affairs Committee held a business meeting at which a number of bills were considered, amended and ordered favorably reported. As is typical of the Senate committee operations, there are no public copies of the amendments provided before or after hearings. We will have to wait to see the reported version of the bill to see exactly what changes have been made.

S 3405 – CFATS Reauthorization

Sen. Johnson (R,WI) offered substitute language on the bill which was subsequently modified by two amendments by Sen. McCaskill (D,MO). All three amendments were adopted by voice votes as was the final bill.

There was some interesting back and forth between Johnson and McCaskill about this bill. McCaskill was concerned about the lack of bipartisan effort in the writing of this bill. She went so far as to complain about ‘industry being in driver’s seat’ in writing the bill [35:07 in the video]. She gave an example of this continuing during the substitute language development where whistleblower protections were added to last week’s draft of the language but were subsequently removed before this week’s hearing.

At the end of that discussion McCaskill made the comment that the bill “will not get my consent on the floor unless we get the whistleblower protections back in the bill” [39:26]. This referred back to an off-mike discussion between Johnson and the staff where he was apparently reminded that the bill will have to be considered on the Senate floor under the unanimous consent process rather than the ‘normal’ debate and amend process. This is due to the lack of time remaining in the session.

McCaskill had two amendments that were offered, considered, and adopted by voice vote. The first had to do with the recognition program. She noted that that changes were made to recognition program [40:04] and her first amendment would modify that language to authorize a DHS mechanism to recognize stewardship programs.

McCaskill’s second amendment to the bill had something to do with the revised explosive exemption language in the bill. Again, she thought [42:38] that either the original language or the revised language (it is not clear) went too far in bending to the desires of the explosives industry.

McCaskill did not have language ready to put whistleblower language back in the bill. As I noted above she vowed to object to the bill if it came to the floor for consideration without the language. We may see the material added to the bill between the time the report is published and the time that it comes to the floor for a vote.

Other Bills of Interest

There were a total of about 40 bills considered in the hearing this week. Most of them were considered en bloc near the end of the hearing, being passed with a single voice vote. These included:

S 278, the Support for Rapid Innovation Act of 2017 – Substitute language;

S 3085, the Federal Acquisition Supply Chain Security Act of 2018 – Substitute language and additional amendment; and

S 3309, the DHS Cyber Incident Response Teams Act of 2018 – Substitute language and additional amendment;

Commentary

Johnson made a point early in the hearing (in relation to a bill that did not end up being considered) about how the Committee works together in a ‘non-partisan’ manner. This is certainly the normal course of events in the Committee. This makes S 3405 very much an oddity in the process as it was written without the input of the Democrats on the Committee (or the Minority Staff). McCaskill’s displeasure with the process was evident in this week’s hearing, but she will go along with Johnson; as long as her party’s minimum requirements are met (whistleblower language). It is not clear that other Democrats in the Senate (not on the Committee; those McCaskill will almost certainly keep in line) will play along.

One Democrat that will have to be watched with respect to this bill is Sen. Markey (D,MA). With his recent attempts to frame himself as a cybersecurity expert, he might be expected to object to the removal of the cybersecurity risk-based performance standards from the CFATS program. Another senator with an interest in cybersecurity that also might object is Sen. Blumenthal (D,CT). That is, of course, if those provisions remain in the bill as amended.

S 3085 Introduced – Supply Chain Risk

Last month Sen. McCaskill (D,MO) introduced S 3085 [oops, added link 08:57 EDT 7-3-18], the Federal Acquisition Supply Chain Security Act of 2018. The bill would amend 41 USC to add a third Acquisition Council to the Office of Federal Procurement Policy. The new Federal Acquisition Security Council (FASC) would be responsible for assessing threats and vulnerabilities relating to supply chain risk posed by the acquisition of information technology.

The Council

The FASC would be led by a representative of the Office of Management and Budget and would consist of representatives from {new §1322(a)}:

• The General Services Administration;

• The Department of Homeland Security;

• The Office of the Director of National Intelligence;

• The Federal Bureau of Investigation;

• The Department of Defense; and

• The National Institute of Standards and Technology.

The FASC would be responsible for developing criteria and processes for {new §1323(a)(1)}:

• For assessing threats and vulnerabilities relating to supply chain risk posed by the acquisition of information technology to national security and the public interest; and

• For sharing information among executive agencies, including the intelligence community, and the private sector where appropriate, with respect to assessments of that risk.

FASC would also be tasked with {new §1323(a)}:

• Defining the responsibilities of executive agencies, consistent with existing law, for management of such assessments.

• Issuing guidance to executive agencies for incorporating information relating to supply chain risks and other relevant information into procurement decisions for the protection of national security and the public interest.

• Developing standards and measures for supply chain risk management, including assessments, evaluations, mitigation, and response that take into consideration national security and other factors relevant to the public interest.

• Consulting, as appropriate, with the private sector and other nongovernmental stakeholders on issues relating to the management of supply chain risks posed by the acquisition of information technology.

• Determining whether the exclusion of a source made by one executive agency should apply to all executive agencies; and

• Carrying out such other actions as are agreed upon by the Council.

Moving Forward

McCaskill is the Ranking Member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. Additionally, her cosponsor, Sen. Lankford (R,OK) is the Chair of the Subcommittee on Regulatory Affairs and Federal Management of that Committee. There is certainly enough influence available between the two of them to have this bill considered in Committee. Whether that influence is sufficient to see the bill make it to the floor of the Senate in the last 180 days of the session remains to be seen.

I do not see anything in the bill that would draw any serious objections to the bill in Committee or on the floor of the Senate.

Commentary

The one major problem with this bill, from my point of view, is that it relies on the IT-restrictive definition of ‘information technology’ from 44 USC 3502 (via 40 USC 11101). Thus, none of the control system technology acquisitions of the Federal government would be covered by the workings of the FASC. This is especially important considering that the Federal government is an important player in setting acquisition standards for electronic equipment, especially commercial off-the-shelf equipment.

Unfortunately, there is no current industrial control system inclusive definition of ‘information technology’ in the US Code. The closest that we see is the definition of ‘information system’ in 6 USC 1501. It would not be difficult to change each instance of ‘information technology’ in the bill to ‘information system’ and then use the §1501 definition.

Bills Introduced – 06-19-18

Yesterday with both the House and Senate in session there were 36 bills introduced. Of those there are three that may be of specific interest to readers of this blog:

HR 6147 Making appropriations for the Department of the Interior, environment, and related agencies for the fiscal year ending September 30, 2019, and for other purposes. Rep. Calvert, Ken [R-CA-42] 

S 3085 A bill to establish a Federal Acquisition Security Council and to provide executive agencies with authorities relating to mitigating supply chain risks in the procurement of information technology, and for other purposes. Sen. McCaskill, Claire [D-MO]

S 3088 A bill to amend the Energy Policy Act of 2005 to require the Secretary of Energy to establish a program to prepare veterans for careers in the energy industry, including the solar, wind, cybersecurity, and other low-carbon emissions sectors or zero-emissions sectors of the energy industry, and for other purposes. Sen. Duckworth, Tammy [D-IL]

HR 6147 is one of those spending bills that I expect will not receive any additional coverage here, but you never can tell what may be slipped into the Committee Report.

I will be watching S 3085 for the definitions it uses. Hopefully, someone on the staff realizes that the Federal government is a consumer of control systems in various guises.

Depending on the definitions used here for ‘cybersecurity’ I may be watching S 3088 for its effects on cybersecurity manpower development.