Senate HSGAC Approved 2 Cybersecurity Bills – 1-31-24

Today, the Senate Homeland Security and Governmental Affairs Committee held a business meeting (as I discussed on Monday). In addition to other actions, the Committee took up two cybersecurity related bills; S 3635, the Industrial Control Systems Cybersecurity Competition Act, and S 3594, the Source code Harmonization and Reuse in Information Technology (SHARE IT) Act.

According to the Committee Record for the meeting, both bills were amended with substitute language from Sen Peters (D,MI), the sponsor for both bills, which in both cases was further amended. The Committee does not include links to the substitute language or amendments in its Committee Record. We may have to wait until the Committee reports are published before we know what changes were made.

Both bills were approved to be reported favorably, S 3635 by a vote of 9 to 1 and S 3594 by a vote of 10 to 0. Sen Paul (R,KY) voted against S 3635, as did Sen Johnson (R,WI) whose nay vote was by proxy which does not officially count. Both senators are well known for using their right to object to unanimous consent  consideration of bills which they oppose. As I noted in my commentary on S 3635, this probably means that there is little chance of S 3635 to be taken up by the full Senate. Both Paul and Johnson supported S 3594 (Johnson again by proxy).

Review - S 3635 Introduced – President’s Cup Update

Last month, Sen Peters (D,MI) introduced S 3635, the Industrial Control Systems Cybersecurity Competition Act. The bill would amend 6 USC 665m(d), President’s Cup Cybersecurity Competition, to expand the competition to specifically include operational technology and industrial control systems. No new funding is authorized by the legislation.

Moving Forward

As I noted this morning, the Senate Homeland Security and Governmental Affairs Committee is scheduled to take up this bill on Wednesday. I suspect that there will be significant bipartisan support for this bill. Since this bill is not politically important enough to be considered by the Senate under regular order, the key person to watch in this hearing will be Ranking Member Paul (R,KY). Opposition will effectively kill further consideration of the bill as he would be expected to object to any unanimous consent motion to consider the bill. Unfortunately, his support would not be a guarantee that he would not object to future unanimous consent motions for other political reasons.

Commentary

While high profile competitions are a good way of publicizing cybersecurity vulnerabilities and threats and encouraging attention to proactive cybersecurity measures, in the great scheme of things they actually do little to stop cyberattacks. Politically, it would allow Congress to look like it is doing something, without spending any money or making any difficult political decisions. I guess we cannot expect much more out of the 118^th Congress.

 

For more information about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3635-introduced - subscription required.

Committee Hearings – Week of 1-28-24

This week, with both the House and Senate in Washington, there will be a nearly normal load of committee hearings. There will be two hearings of interest here; a markup hearing in the Senate and a cyber threat hearing in the House.

Markup Hearing

On Wednesday, the Senate Homeland Security and Governmental Affairs Committee will hold a business meeting. In addition to seven nominations and 12 postal naming bills being considered, the Committee will markup 12 bills. These will include:

• S 3635, Industrial Control Systems Cybersecurity Competition Act, and

• S 3594, Source code Harmonization and Reuse in Information Technology (SHARE IT) Act

The text of both bills just recently became available, I will try to get reviews up before Wednesday.

Cyber Threats

On Wednesday, the House Select Committee on the CCP will hold a hearing on “The CCP Cyber Threat to the American Homeland and National Security”. The witness list includes:

• Gen Paul Nakasone, United States Cyber Command,

• Jen Easterly, Cybersecurity and Infrastructure Security Agency,

• Christopher Wray, Director, Federal Bureau of Investigation, and

• Harry Coker, Jr., Office of the National Cyber Director

While this is an open hearing, so there will not be much in the way of details discussed, there should be some significant discussions about cyber threat to energy infrastructure from China.

On the Floor

We may see a bipartisan tax bill, HR 7024, considered in the House this week. While there is nothing of specific interest here, just seeing a significant tax bill being reported in a bipartisan manner out of the House Ways and Means Committee, is a news worthy event in the 118^th Congress.

Bills Introduced – 1-22-24

Yesterday, with the Senate in Washington and the House meeting in pro forma session, there were 25 bills introduced. Three of those bills will receive additional attention in this blog:

HR 7062 To direct the Secretary of Agriculture to periodically assess cybersecurity threats to, and vulnerabilities in, the agriculture and food critical infrastructure sector and to provide recommendations to enhance their security and resilience, to require the Secretary of Agriculture to conduct an annual cross-sector simulation exercise relating to a food-related emergency or disruption, and for other purposes. Finstad, Brad [Rep.-R-MN-1] 

HR 7073 To improve public-private partnerships and increase Federal research, development, and demonstration related to the evolution of next generation pipeline systems, and for other purposes. Weber, Randy K., Sr. [Rep.-R-TX-14]

S 3635 A bill to improve the President's Cup Cybersecurity Competitions. Peters, Gary C. [Sen.-D-MI]