Review - HR 2236 Introduced - Cyber Shield Act of 2021

Back in March Rep Lieu (D,CA) introduced HR 2236, the Cyber Shield Act of 2021. The bill would establish require the Department of Commerce to establish the Cyber Shield Program; a program for the voluntary certification and labeling of products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data. The bill is a companion bill to S 965 that was introduced in April by Sen Markey (D,MA).

In addition to the requirement to establish the standards necessary for obtaining the designation of a Cyber Shield product, DOC would also have to maintain a searchable web site that would provide information about the standards, a listing of all of the designated products, and a database with cybersecurity and program information about each of designated products.

Moving Forward

Lieu is not a member of the House Energy and Commerce Committee to which this bill is assigned for consideration. This means that it is unlikely that he has enough influence with that Committee to see this bill considered. Lieu will need to get a member of that Committee to cosponsor the bill for it to move forward.

Commentary

Congress is really enamored of ‘voluntary programs.’ If some manufacturer, who happens to be a ‘supporter’ of one or more congresscritters, objects to the requirement of the program, the automatic response is ‘its voluntary, you do not have to participate’. It keeps financial backers happy while allowing congress to look like it is doing something. Unfortunately, we have too many recent examples of voluntary programs that flat do not work.

And it really does not help a program to work when a bill specifically kills a main reason that a software/firmware/hardware vendor might have to want to participate in the program; to gain some measure of liability protection. The provision of §6 in this bill specifically disallows that protection. Instead of disallowing liability protections the crafters of this bill should have been providing some sort of limited liability protection like that provided in the Safety Act (Subtitle G of the Homeland Security Act of 2002, 6 USC 441 et seq) for vendors of qualified antiterrorism products.

For a more detailed review see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2236-introduced 

S 965 Introduced - Cyber Shield Act of 2021

Last month Sen Markey (D,MA) introduced S 965, the Cyber Shield Act of 2021. The bill would establish require the Department of Commerce to establish the Cyber Shield Program; a program for the voluntary certification and labeling of products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data. The bill is essentially identical to S 2664 that Markey introduced last session. No action was taken on that bill or its companion bill HR 4792.

The products referenced in the bill only apply to ‘consumer facing objects’ that {§2(3)}:

• Connect to the internet or other network; and

• Collect, send, or receive data; or

• Control the actions of a physical object or system

Moving Forward

Markey is a member of the Senate Commerce, Science and Transportation Committee to which this bill was assigned for consideration. This means that he should have enough influence to see the bill considered in Committee, but he also had that influence last session. I have to wonder if he is really interested in seeing this bill move forward.

There is likely to be some Republican opposition to this bill. Since the Cyber Shield Program would be voluntary, I suspect that there could be some bipartisan support, so this bill could be reported out favorably by the Committee.

This bill is not important enough to make it to the floor of the Senate under normal order with its time consuming debate and amendment process. The expected Republican opposition should be sufficient to ensure that it could not be considered under the unanimous consent process. There remains a possibility that Markey could offer the language as an amendment to a spending or authorization bill.

Commentary

The word ‘or’ between §2(3)(B)(i) and (ii) in the definition of ‘covered product’ could mean that the definition could be stretched to include industrial control systems as they ‘control the actions of a physical object or system’, but I think that was included to address automated transportation systems. Since DHS and specifically CISA were left out of the representation list for the Advisory Committee, there is no one to advocate for that stretching of the definition.

Of course, this bill is really intended to only apply to consumer products not industrial products, thus the ‘consumer-facing physical object’ phrase in the definition of a ‘covered product’. Perhaps we need a separate ‘Industrial Shield Program’.

Bills Introduced – 3-25-21

Yesterday with just the Senate in session, there were 116 bills introduced. Two of those bills will receive additional coverage in this blog:

S 965 A bill to establish a voluntary program to identify and promote internet-connected products that meet industry-leading cybersecurity and data security standards, guidelines, best practices, methodologies, procedures, and processes, and for other purposes.

S 1012 A bill to prohibit the Secretary of Transportation from prohibiting the transportation of liquefied natural gas by rail, and for other purposes.

S 965 sounds like the Cyber Shield bill that was mentioned in the news yesterday (here for instance). Similar legislation was introduced last session, but did not go anywhere.

S 1012 sounds like it may be a companion bill to HR 2100 that was introduced last week.

NOTE: There is some sort of (temporary?) glitch over at Congress.gov this morn ing that is not providing sponsor information on bills introduced yesterday.

Bills Introduced – 04-27-17

Yesterday with both the House and Senate in session there were 88 bills introduced. Of those, two may be of specific interest to readers of this blog:

HR 2184 To support meeting our Nation's growing cybersecurity workforce needs by expanding the cybersecurity education pipeline. Rep. McCaul, Michael T. [R-TX-10]

S 965 A bill to improve passenger vessel security and safety, and for other purposes. Sen. Blumenthal, Richard [D-CT]

HR 2184 looks like it will be one of a number of cybersecurity related bills being introduced by McCaul in the next month or so. As usual I will be watching for control system security related provisions, specifically ICS inclusive definitions.

S 965 is probably a companion bill to HR 2173 that was introduced earlier this week. I will be watching both bills for cybersecurity provisions.