Senate Passes HR 1158 – Cyber Hunt Teams

Yesterday the Senate amended and then adopted HR 1158 , the DHS Cyber Hunt and Incident Response Teams Act, by unanimous consent. The amendment substituted the language from S 315 that was reported favorably by the Senate Homeland Security and Governmental Affairs Committee. The amendment restored provisions requiring an ‘entity requesting action by or technical assistance from’  the National Cybersecurity and Communications Integration Center (NCCIC) to approve the use of private sector cybersecurity specialists in the cyber hunt team providing assistance.

The bill authorizes the current US-CERT and ICSCERT action teams and provides for the use of private sector contractors on those teams.

The bill now goes back to the House for action on the amendment. I suspect that the House will agree to the slightly different wording, perhaps this week. The House passed the original version of the bill by a voice vote.

House Passes HR 1158 – Cyber Response Teams

Yesterday, the House passed HR 1158,, (corrected bill number, thanks to Toshio Miyachi for catching my error - see the comment below) the DHS Cyber Incident Response Teams Act of 2019, by a voice vote. There were no voices of dissent during the eight minutes of debate on the Floor of the House.

One common theme in the voices raised in support of the bill was the importance of the use of ‘private-sector capabilities’ to address these growing and evolving threats. Rep. McCaul (R,TX), the author of the bill, noted that it “really provides a force multiplier, and I think it is a very important step forward in the right direction” {pg H4368}.

A similar bill  (HR 5074) was passed in the 115^th Congress, but it was not taken up by the Senate. This year the Senate Homeland Security and Governmental Affairs Committee has favorably reported a similar Senate bill (S 315). It is no yet clear whether either version of the legislation will make it to the floor of the Senate for consideration. If one of the two bills is considered, it will almost certainly be done under the Senate’s unanimous consent process.

S 315 Reported in Senate – Cyber Hunt Teams

Last month the Senate Homeland Security and Governmental Affairs Committee published their report on S 315, the DHS Cyber Hunt and Incident Response Teams Act of 2019. The Committee marked up the bill on February 13^th, 2019; adopting substitute language for the bill.

Changes to the Bill

The first change was a rewrite of 6 USC 659(f)(2), expanding on the generic requirement to use ‘robust metrics’ to continually ‘assess and evaluate’ the newly authorized (but long existing ICS-CERT and US-CERT teams) ‘cyber hunt and incident response teams’. The new language uses slightly less generic language to require DHS to ‘define goals and desired outcomes’ and to develop metrics that are ‘quantifiable and actionable’.

The second change was to add a definition sub-paragraph to the congressional reporting requirements of §2(b) of the bill. The bill defines the following terms by reference to the existing definitions from 6 USC 659:

• Center (NCCIC);

• Cyber hunt and incident response team (as added by this bill); and

• Incident

Moving Forward

The bill as amended was approved by the Committee by a voice vote; indicating that there was substantial bipartisan support for the bill. While Sen. Johnson (R,WI) has been loath to act on any cybersecurity bills that call for regulation of industry, there was no objection to this bill as it merely codifies existing NCCIC operations and adds a congressional reporting requirement for those operations. But, allowing this bill to move forward out of Committee is not necessarily supporting the bill. Active support by Johnson will now be required to move the bill to the floor of the Senate.

If this bill is considered by the Senate, it will most likely be taken up under the Senate’s unanimous consent process. The problem with that process is that a single voice in the Senate can quash consideration of the bill; and that voice would not necessarily be against the language of the bill, but it could raised in opposition to something else that CISA or DHS is doing that is not under active consideration by the Senate.

The revised language in this bill could also be included in a DHS reauthorization bill that the House and Senate each periodically intend to pass. The Department has not been reauthorized since it was established; too many controversies to allow a reauthorization bill to make it through the legislative process.

Commentary

The newly added definitions, while not really important, rely on the IT restrictive definition of ‘information system’ from 6 USC 659(a). I am going to abbreviate my rant on the inadequacies of that definition when considering security of industrial control systems, transportation systems, medical devices, etc and simply refer the reader to my blog post on legislative cybersecurity definitions.

HR 1158 Introduced – Cyber Response Teams

Last month Rep. McCaul (R,TX) introduced HR 1158, the DHS Cyber Incident Response Teams Act of 2019. This bill is similar to S 315 that was introduced in January. The bill would provide authorization for the current US-CERT and ICS-CERT response teams in the DHS NCCIC.

Differences

The differences between the two bills are not drastic, but the subtle differences may have an effect on the operation of these teams.

The ‘new’ language added to HR 1158 is relatively inconsequencial. In the added paragraph (f)(1)(E) (this bill references the outdated ‘6 USC 148’ instead of ‘6 USC 659’), for instance substitutes “the Under Secretary appointed under section 103(a)(1)(H)” for the “Secretary” used in the Senate bill.

The language from S 315 that is removed is somewhat more interesting. The most common change is the frequent removal of the words ‘cyber hunt’ from the description of the response teams in the bill, but this is not universally removed so it should have no impact.

A significantly more important change is found in paragraph (f)(2) {which was (f)(4) in the Senate bill, a paragraph numbering change of no apparent importance}. The Senate bill reads:

“CYBERSECURITY SPECIALISTS.— After notice to, and with the approval of, the entity requesting action by or technical assistance from the Center, the Secretary may include cybersecurity specialists from the private sector on a cyber hunt and incident response team.”

The House bill completely deletes the opening phrase; removing any option for an affected party asking for NCCIC response assistance to decide if they want non-governmental personnel involved in the investigation process.

Moving Forward

McCaul is an influential member of the House Homeland Security Committee, the committee to which this bill was assigned consideration, so there is a good chance that this bill will be considered in committee. There is nothing in the bill that would draw any significant opposition so it should pass, both in committee and on the floor of the House, with significant bipartisan support.

S 315 Introduced – DHS Cyber Response Teams

Last month Sen. Hassan (D,NH) introduced S 315, the DHS Cyber Hunt and Incident Response Teams Act of 2019. The bill would authorize the current cyber incident response teams in the DHS NCCIC. The bill is very similar to HR 5074 from the 115^th Congress which passed in the House but was never taken up in the Senate.

The bill does not name the teams, but the description certainly refers to the incident investigation teams associated with US-CERT and ICS-CERT. The bill specifically mentions ‘control systems’ {6 USC 659(f)(1)(D)} but does not provide a definition for that term.

Hassan and her two cosponsors {Sen. Peters (D,MI) and Sen. Portman (R,OH)} are all influential members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This should mean that the bill has a good chance of being considered in that Committee. A recent article over on Politico.com pointed out, however, how hard it is to get cybersecurity legislation through that Committee. Since this bill does not contain any new authority for NCCIC nor does it approve any new funding, this bill may be able to avoid that cybersecurity trap.

NOTE: HR 1158 was recently introduced in the House with a similar sounding name, but the text has not yet been published. I suspect that it will be very similar to this bill.

Committee Hearings – Week of 02-10-19

Apparently due to the Federal Funding Fiasco, Congress has been slow to start its committee processes. Last week we saw a bunch of organizational meetings finally being held. This week we start to see a more ‘normal’ hearing schedule. There are two potential hearings of interest here dealing with cybersecurity issues.

Cybersecurity Markup Hearing?

On Wednesday the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting. The agenda on the Committee web site does not list any cybersecurity bills, but the Senate hearing web site lists the following cybersecurity bills as bills that would be considered:

• S.315, to authorize cyber hunt and incident response teams at the Department of Homeland Security,

• S.333, to authorize the Secretary of Homeland Security to work with cybersecurity consortia for training, and

• An original bill entitled, "Federal Rotational Cyber Workforce Program Act of 2019

This may be an old and out-of-date listing. The final bill listed above was introduced last week as S 406. None of these bills have been published yet, so I have not had a chance to review them.

Energy Cybersecurity

On Thursday the Senate Energy and Natural Resources Committee will hold a hearing on “To Consider the Status and Outlook for Cybersecurity Efforts in the Energy Industry”. The witness list includes:

• Neil Chatterjee, FERC;

• Karen Evans, CSER;

• William J. Keber, West Virginia National Guard Critical Infrastructure Protection Battalion

• James B. Robb, North American Electric Reliability Corporation; and

• David Edward Whitehead, Schweitzer Engineering Laboratories, Inc.

Bills Introduced – 01-31-19

Yesterday with the Senate in full session and the House meeting in pro forma session there were 49 bills introduced. Two of these bills will receive future mention in this blog:

S 300 A bill to require the Secretary of Energy to carry out a program relating to physical security and cybersecurity for pipelines and liquefied natural gas facilities. Sen. Cornyn, John [R-TX] 

S 315 A bill to authorize cyber hunt and incident response teams at the Department of Homeland Security, and for other purposes. Sen. Hassan, Margaret Wood [D-NH] 

It looks like both of these bills will be repeats from the previous session.