Senate HSGAC Approved 2 Cybersecurity Bills – 1-31-24

Today, the Senate Homeland Security and Governmental Affairs Committee held a business meeting (as I discussed on Monday). In addition to other actions, the Committee took up two cybersecurity related bills; S 3635, the Industrial Control Systems Cybersecurity Competition Act, and S 3594, the Source code Harmonization and Reuse in Information Technology (SHARE IT) Act.

According to the Committee Record for the meeting, both bills were amended with substitute language from Sen Peters (D,MI), the sponsor for both bills, which in both cases was further amended. The Committee does not include links to the substitute language or amendments in its Committee Record. We may have to wait until the Committee reports are published before we know what changes were made.

Both bills were approved to be reported favorably, S 3635 by a vote of 9 to 1 and S 3594 by a vote of 10 to 0. Sen Paul (R,KY) voted against S 3635, as did Sen Johnson (R,WI) whose nay vote was by proxy which does not officially count. Both senators are well known for using their right to object to unanimous consent  consideration of bills which they oppose. As I noted in my commentary on S 3635, this probably means that there is little chance of S 3635 to be taken up by the full Senate. Both Paul and Johnson supported S 3594 (Johnson again by proxy).

Review - S 3594 Introduced – Federal Code Sharing

Earlier this month, Sen Cruz (R,TX) introduced S 3594, the Source code Harmonization and Reuse in Information Technology (SHARE IT) Act. The bill would require the federal government to “maximize efficiency, minimize duplication, and enhance security and innovation across Federal agencies by requiring the sharing of custom-developed code between agencies”. The bill specifically prohibits the authorization of new funding to support the program.

Moving Forward

As I mentioned yesterday, this bill will be considered by the Senate Homeland Security and Governmental Affairs Committee tomorrow. There is one aspect of the bill that could engender opposition (see my Commentary below), but it could easily be revised in tomorrows markup. With that change, I suspect that there would be substantial bipartisan support for the bill. Since the bill is not politically important enough to be considered under the Senate’s time-consuming regular order, it will be important to watch tomorrow's hearing to see if Sen Paul (R,KY) supports the bill. If he opposes the bill, he would be likely to oppose consideration of the bill in the full Senate under the unanimous consent process. With his position as Ranking Member, he could effectively veto adding the provisions of the bill to other bills via the floor amendment process. Even if he supports the bill in Committee, he could still object to consideration of the bill under that process for unrelated political leverage.

Commentary

The biggest problem this bill is going to face moving forward is industry objections to the provisions of §4(a)(2):

“(2) all software and other key technical components, including documentation, data models, schemas, metadata, and architecture designs, are owned by the agency.”

This paragraph would require that all contracts for software (not restricted to ‘custom code’) going forward would provide for the government ownership of the software, not licensing for use by the vendor. This would be a major change that would be resisted by most (if not all) major software companies. I suspect that if were accepted by vendors (the federal government is a big customer after all) it would come with increased costs and a whole series of legal caveats that are currently covered by licensing agreements and ‘terms of use’ restrictions.

This problem could be solved by substituting the phrase used multiple times in this bill, ‘custom-developed code’ for the opening ‘all software’ in the paragraph. That is, after all, the overall intent of the bill. While there are arguments to be made for changing the ownership structure of software, that is a much larger issue than the relatively minor sharing of custom code in the federal government.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3594-introduced - subscription required.

Committee Hearings – Week of 1-28-24

This week, with both the House and Senate in Washington, there will be a nearly normal load of committee hearings. There will be two hearings of interest here; a markup hearing in the Senate and a cyber threat hearing in the House.

Markup Hearing

On Wednesday, the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting. In addition to seven nominations and 12 postal naming bills being considered, the Committee will markup 12 bills. These will include:

• S 3635, Industrial Control Systems Cybersecurity Competition Act, and

• S 3594, Source code Harmonization and Reuse in Information Technology (SHARE IT) Act

The text of both bills just recently became available, I will try to get reviews up before Wednesday.

Cyber Threats

On Wednesday, the House Select Committee on the CCP will hold a hearing on “The CCP Cyber Threat to the American Homeland and National Security”. The witness list includes:

• Gen Paul Nakasone, United States Cyber Command,

• Jen Easterly, Cybersecurity and Infrastructure Security Agency,

• Christopher Wray, Director, Federal Bureau of Investigation, and

• Harry Coker, Jr., Office of the National Cyber Director

While this is an open hearing, so there will not be much in the way of details discussed, there should be some significant discussions about cyber threat to energy infrastructure from China.

On the Floor

We may see a bipartisan tax bill, HR 7024, considered in the House this week. While there is nothing of specific interest here, just seeing a significant tax bill being reported in a bipartisan manner out of the House Ways and Means Committee, is a news worthy event in the 118^th Congress.

Bills Introduced – 1-16-24

Yesterday, with both the House and Senate in Washington, there were 18 bills introduced. Of those bills, two may receive additional coverage in this blog:

HR 6995 Making continuing appropriations for the Armed Forces and certain Federal civilian personnel in the event of a Government shutdown during fiscal year 2024, and for other purposes. Biggs, Andy [Rep.-R-AZ-5]

S 3594 A bill to require Governmentwide source code sharing, and for other purposes. Cruz, Ted [Sen.-R-TX] 

I will be watching HR 6995 as it looks like this may be an attempt to alleviate concerns amongst some Republicans about the potential effects of a government shutdown on the military. I really doubt that this bill will go anywhere, but movement could be an indicator of more radical actions on overall spending.

I am not sure what to make of S 3594. I will be watching this bill for indications that the motivation for the required sharing is increasing security of government software. As a side note: Sen Peters (D,MI), Chair of the Senate Homeland Security and Governmental Affairs Committee, is a cosponsor for the bill, so this may be a serious attempt at getting something done.This one should be interesting.

Mention in Passing

There are two bills introduced yesterday that I would like to mention in passing:

H Res 967 Amending the Rules of the House of Representatives to permit Members to vote by proxy in certain cases, and for other purposes. Luna, Anna Paulina [Rep.-R-FL-13] 

S 3591 A bill making appropriations to improve border security, imposing new reporting requirements relating to border security, and enhancing criminal penalties for destroying or evading border controls. Casey, Robert P., Jr. [Sen.-D-PA]

Proxy voting in the 117^th Congress, a pandemic response move, was an anathema for Republicans. Interesting that Luna, who is on the right fringe of the party establishment, is proposing this, but with the Republican majority so slim, legitimate absences could put the Democrats in the majority on any given day in the session.

The description of S 3591 could have been written by Republicans for a border control bill, but this is an all-Democrat (six Dems cosponsoring) bill. I will be surprised if this has any more chance of getting to the floor than does HR 2, the conservative border diatribe passed early last year in the House. But this could be a sign of potential movement on border issues with the liberal response be staked out.