April 2013

The House passed three bills aimed at updating the federal government's cybersecurity controls, and boosting research and education in information technology fields. None of the three bills were controversial, and all were easily approved under a suspension of House rules, which requires a two-thirds majority vote for passage.

1. In a 416-0 vote, members passed the Federal Information Security Amendments Act, H.R. 1163. That bill updates the Federal Information Security Management Act (FISMA) to require the government to more actively assess federal safeguards against cyberattacks.
2. The House also approved the Cybersecurity Enhancement Act, H.R. 756. That bill requires federal agencies to plan for cybersecurity R&D, boosts basic cyber research at the National Science Foundation, provides scholarships to help improve the federal workforce on cyber issues, and increases research at the National Institute of Standards and Technology. That bill passed 402-16.
3. The House approved a third bill aimed at coordinating cyber R&D in the federal government. The Advancing America's Networking and Information Technology Research and Development Act, H.R. 967, directs agencies to periodically assess funding levels for various programs and shift those funds around when needed. It was easily approved in a 406-11 vote.

[Commentary] Will this year be any different than last, with separate, smaller cybersecurity bills dealing with only some of the issues making it through the House only to get stuck in the Senate over issues relating to regulation and who should be in charge? Some factors are different this year and could change cyber reform’s fate. Here are a few:

• Senate Leadership Changes. Sens. Tom Carper (D-DE) and Tom Coburn (R-OK) took over this year as chair and ranking member, respectively, on the Homeland Security & Government Affairs Committee. They have not shown their hands yet but are working on a cybersecurity bill. They would like a bipartisan product that has wide support. This changing dynamic could make them more likely to move away from the issues that tanked the bill last Congress. Or not.
• The President’s Executive Order. The EO, issued in January, covers potential best practices, standards and the like for critical infrastructure, among other things. It may be just enough to give Senate leaders flexibility to not legislate on the issue that had the most opposition in the last Congress. Or it may cause opponents to want to push forward with something to counter it.
• Additional House Bills. In addition to the bills on the floor this week, media reports have indicated that the House Judiciary and Homeland Security Committees will have bills ready to go in the next month. These bills are seen as complements to those going this week and possibly will include cybercrime provisions, information sharing and Department of Homeland Securities authorities.
• The China threat. The debate is no longer about cyber 9-11s or Pearl Harbors lurking around the corner. This time around it is about the threat from China. Private sector security companies such as Mandiant have reportedly confirmed that the Chinese government is hacking into American systems and stealing information. The vulnerability of those systems -- including the possibility that systems hacked for information can also be hacked to be destroyed or damaged -- is a threat that many want to see addressed.
• Privacy. While privacy played a role in the debate last year, privacy groups and lawmakers concerned about the issue were not as vocal or as organized as they seem to be this year. All of the bills will be scrutinized to assure that the government is not overreaching in its efforts to protect networks and share information.

Eleven private organizations agreed to partner with the National Institute of Standards and Technology to share cybersecurity staff and best practices to help better combat cyber threats.

In a signing ceremony at NIST’s National Cybersecurity Center of Excellence, the 11 organizations agreed to collaborate with federal agencies as part of the new National Cybersecurity Excellence Partnerships program. Companies participating in the signing ceremony were: Intel, Hytrust, McAffee, Cisco, Splunk, RSA, Symantec, Hewlett-Packard, Microsoft, Vanguard and Venafi. As part of the agreement, the companies will provide physical infrastructure such as hardware and software components, intellectual knowledge including best practices and lessons learned, and/or physically or logically co-located personnel who will work side-by-side with federal staff. The partnerships will be established for a three-year period, with renewal subject to the requirements and interests of the company and NIST, according to a Federal Register notice published in October. The partnership program is part of the NCCoE program, which was established last year in an effort to develop and test security applications for workplace and personal computers.

Sen. Claire McCaskill (D-MO) dismissed the idea that allowing airline passengers to use electronic devices during takeoffs and landings could distract them from hearing safety announcements. After being pressured by Sen McCaskill and other lawmakers, the Federal Aviation Administration began studying easing its restrictions on electronic devices, which are currently banned completely when airplanes are below 10,000 feet. Sen McCaskill said that she doubted passengers would be less likely to pay attention to safety announcements if they had use of their electronics.