Review - S 1425 Introduced – Satellite Cybersecurity

Earlier this month, Sen Peters (D,MI) introduced S 1425, the Satellite Cybersecurity Act. The bill would require the GAO to publish a report on government actions to support cybersecurity of commercial satellite systems. It also outlines new responsibilities for CISA on satellite cybersecurity. No new funding is authorized by this legislation.

This bill is very similar to S 3511 introduced in the last session by Peters. That bill passed (removed from paywall) in Committee but was not taken up by the Senate.

Moving Forward

As I mentioned earlier, the Senate Homeland Security and Governmental Affairs Committee will take up S 1425 (along with 14 other bills) in a business meeting on Wednesday. This typically means that there is at least some bipartisan support for the measure, though amendments may be offered to improve the bill. I suspect that there will be substantial bipartisan support for the bill.

It is unlikely that the bill would be considered in the Senate under regular order, that process is just too time consuming. There is a chance that it could be considered under the unanimous consent process, but that is just too fraught with potential for unrelated political concerns to interfere with the process. I suspect that this is a prime candidate to be included in some must pass spending or authorization bill.

 

For more details about the provisions of the bill, including a commentary about the importance of legislative definitions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-1425-introduced - subscription required.

Review - S 3511 Reported in Senate – Satellite Cybersecurity

Last month, the Senate Homeland Security and Governmental Affairs Committee published their Report for S 3511, Satellite Cybersecurity Act. The Committee met on March 30^th, 2022 and adopted substitute language and one additional amendment before ordering the bill reported favorably. The new version of the bill modifies some of the reporting requirements and makes changes to the satellite cybersecurity recommendations process. Subsequent technical changes were made to the bill “by mutual agreement of the Chairman and Ranking Member” (Committee Report, pg 4).

Moving Forward

While there was (not unexpectedly) strong bipartisan support for this bill in Committee for this bill, the bill is not likely to be considered by the Senate leadership to be important enough to be considered under regular order on the floor of the Senate. The time and effort to go through the debate and amendment process would interfere with the agenda of the Senate as we go into the last four months of the session. There is a remote chance that the bill could be considered under the unanimous consent process, but that has a high potential for being blocked for political reasons having nothing to do with the bill. This bill is much more likely to be added to a major bill (such as the upcoming NDAA) as part of the substitute language or as a floor amendment.

For more details about the changes made to the language of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3511-reported-in-senate - subscription required. 

Senate HSGA Committee Amends and Approves 2 Cybersecurity Bills

Yesterday, the Senate Homeland Security and Governmental Affairs Committee held a business meeting looking at eight nominations, eleven postal naming bills, and eleven other bills. Two of those ‘other bills’ dealt with cybersecurity issues:

S 3511, Satellite Cybersecurity Act, and

S 3904, Healthcare Cybersecurity Act of 2022.

Sen Peters (D,MI) offered substitute language for the S 3511. That substitute language was subsequently modified and Sen Ossoff offered another amendment that was also adopted.

Similar actions were taken with respect to S 3904. The substitute language, subsequent modification, and new amendment were all proposed by Sen Rosen (D,NV).

All of the above actions were approved by an en bloc voice vote. Unfortunately, the Committee does not provide copies of substitute language or amendments, so we have no way of knowing what changes were actually made. We will have to wait for the Committee Report.

Committee Hearings – Week of 3-27-22

This week with both the House and Senate in session, there is a nearly normal hearing schedule. The FY 2023 spending process starts with the presentation of the President’s budget. There will be one markup hearing that includes cybersecurity legislation. There will also be two hearings of interest here, one on critical infrastructure cybersecurity and one on DHS counter-drone operations.

FY 2023 Budget Hearings

• Tuesday – House Budget Committee

• Wednesday – Senate Budget Committee

Cybersecurity Markup

On Wednesday, the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting. In addition to eight nominations to consider, the Committee will take up eleven postal naming bills and eleven ‘normal’ pieces of legislation. One of the later is S 3511, the Satellite Cybersecurity Act. Do not expect much discussion, whatever issues exist in this Committee are normally dealt with behind closed doors, but amendments are possible.

Cyber Threat Hearing

On Wednesday, The House Homeland Security Committee will hold a hearing on “Mobilizing Our Cyber Defenses: Securing Critical Infrastructure Against Russian Cyber Threats”. The witness list includes:

• Adam Meyers, Crowdstrike,

• Mr. Steve Silberstein, CEO, Financial Services-ISAC 

• Kevin Morley, American Water Works Association

It will be interesting to here the private sector point of view on this topic after all of the warnings from various Federal agencies over the last couple of weeks.

Counter-Drone Operations

On Thursday, there will be a joint hearing of two Subcommittees of the House Homeland Security Committee looking at “Assessing the Department of Homeland Security's Efforts to Counter Unmanned Aircraft Systems”. The witness list includes:

• Samantha Vinograd, Office of Strategy, Policy, and Plans,

• Rear Admiral Scott W. Clendenin, USCG,

• Austin Gould, TSA,

• Dennis J. Michelini, U.S. Customs and Border Protection

The last witness was added by the Republicans. They will be using Michelini’s testimony to attack the President’s ‘lack of action on the Southern Border’. Just a reminder, DHS has very limited authority to conduct counter-drone operations.

On the Floor

The major bill in the House this week will be HR 3617, the Marijuana Opportunity Reinvestment and Expungement (MORE) Act. It will come to the floor later in the week, so the House will have time to consider a total of 17 bills under their suspension of the rules process. Those bills include:

S 2629 – the Better Cybercrime Metrics Act, and

HR 6865 – the Don Young Coast Guard Authorization Act of 2022,

The Senate is scheduled to finish up action on HR 4521 this evening. While many things could happen to delay the final vote, I suspect that the Senate will adopt the substitute language this evening. Then the conference process will begin to iron out the major differences in the two bills. The final bill will be larger than either of the two alternatives and will almost certainly contain both sets of cybersecurity provisions.

Review - S 3511 Introduced – Satellite Cybersecurity

Earlier this month, Sen Peters (D,MI) introduced S 3511, the Satellite Cybersecurity Act. The bill would require CISA to establish a commercial satellite system cybersecurity clearinghouse and to develop voluntary cybersecurity recommendations designed to assist in the development, maintenance, and operation of commercial satellite systems. No funding is authorized by this bill.

Peters is the Chair of the Senate Homeland Security and Governmental Affairs Committee the committee to which this bill was assigned for consideration. This should ensure that there is adequate influence to see this bill considered in Committee. Since the bill only requires the development of ‘voluntary’ security measures, I do not see any significant organized objections interfering with the consideration of this bill. I suspect that the bill will pass out of Committee with at least some level of bipartisan support.

Commentary

We continue to see problems with the definition used by congressional staff in the crafting of cybersecurity legislation that affects operational technology or control systems that directly affect physical systems. In this case, the two cybersecurity terms defined in §2 are IT restrictive definitions. The term ‘cybersecurity risk’ for 6 USC 659 is based upon the IT restricted definition of ‘information system’. Even the term ‘cybersecurity threat’, while based upon the control system inclusive definition of ‘information systems from 6 USC 1501, refers to actions that “adversely impact the security, availability, confidentiality, or integrity of an information system”.

These definitions would suffice if the legislation were only concerned with the information transiting commercial satellites, but the required cybersecurity recommendations from CISA are specifically required to address protecting ‘vital commercial satellite system functions’ and the ‘satellite system’s command, control, and telemetry receiver systems’. Again, the definitions just do not match the requirements.

For more information on what changes to cybersecurity definitions need to be made to adequately reflect control system and operational technology cybersecurity needs, please see my post from February 2019.

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3511-introduced - subscription required.

Bills Introduced – 11-13-22

Yesterday, with both the House and Senate in session, there were 41 bills introduced. One of those bills will receive additional attention in this blog:

S 3511 A bill to require a report on Federal support to the cybersecurity of commercial satellite systems, and for other purposes. Sen. Peters, Gary C. [D-MI]