Inside Cybersecurity: Pelosi appoints Langevin to Cyberspace Solarium Commission, as House passes four cyber-related bills

Inside Cybersecurity: Pelosi appoints Langevin to Cyberspace Solarium Commission, as House passes four cyber-related bills

By Maggie Miller

House Minority Leader Nancy Pelosi (D-CA) appointed Rep. James Langevin (D-RI) to the newly created Cyberspace Solarium Commission on Tuesday, while the House passed four cyber-related bills including one to create a vulnerability disclosure program at the Department of Homeland Security.

Pelosi named Langevin and former Rep. Patrick Murphy (D-PA) to the commission, created under the 2019 National Defense Authorization Act. The House minority leader is required to appoint two members of the Commission, one of whom must not be a current member of the House.

“Cyberspace is the future, and will grow even more important to driving American leadership and innovation in the years to come,” Pelosi said in a statement. “Guided by Rep. Langevin and former Rep. Murphy, this Commission will be a vital tool in keeping America safe, strong and free.”

Langevin, the co-founder and co-chair of the Congressional Cybersecurity Caucus, said in a statement he was “honored” to be appointed, and called for the commission to develop a “strategic framework” for international cyber “stability.”

“It is imperative that we use the opportunity afforded by the Solarium Commission to develop a strategic framework that encompasses these challenges and ensures the United States continues to benefit from global cyber stability,” Langevin said. “It is my expectation that such a strategy will encompass all elements of national power – economic, diplomatic and military – and help contextualize cyber in the broader national and economic security discussion.”

The Speaker of the House is designated to appoint three members, with the Senate majority leader to designate three, and the Senate minority leader to pick two members. Other members of the commission automatically include the FBI director, the deputy secretaries of the departments of Defense and Homeland Security, and the principal deputy director of National Intelligence.

The commission is charged with developing a “strategic approach” to defend the U.S. in cyberspace against “cyber attacks of significant consequences.”

Bills move in House

On Tuesday, the House approved four cybersecurity bills, including H.R. 6735, the Public-Private Cybersecurity Cooperation Act. The bill sponsored by House Majority Leader Kevin McCarthy (R-CA) directs the DHS secretary to establish a “vulnerability disclosure policy” for DHS internet sites within 90 days of the legislation being signed into law.

The House Homeland Security Committee approved the bill earlier this month, and Chairman Michael McCaul (R-TX) spoke on the floor in favor of passage, saying it would give a “legal avenue” to allow researchers from the private sector to identify cyber flaws in DHS’ systems.

“Between 2011 and 2013, Iranian hackers attacked dozens of American banks and even tried to shut down a dam in New York,” McCaul said. “In 2014, Chinese hackers stole over 22.5 million security clearances, including my own, from the Office of Personnel Management. In 2016, Russia meddled in our Presidential election, and because we use computer networks in our personal and professional lives, almost everyone is a target. With each passing day, cyber threats continue to grow. But the government cannot face these threats alone. We need help from the private sector.”

McCaul also spoke in favor of another bill passed Tuesday, H.R. 6620, the Protecting Critical Infrastructure Against Drones and Emerging Threats Act, sponsored by Homeland Security cyber subcommittee ranking member Cedric Richmond (D-LA). This bill would require DHS to prepare a threat assessment related to unmanned aircraft systems, and was previously approved by the House Homeland Security Committee.

“The threats we face from drones are constantly evolving as the technology becomes more accessible across the globe,” McCaul said on H.R. 6620. “We need to do more to confront these dangers.”

The House passed two more bills: H.R. 5433, the Hack Your State Department Act, sponsored by Rep. Ted Lieu (D-CA), to establish a “bug bounty” program at the State Department; and H.R. 6229, the National Institute of Standards and Technology Reauthorization Act, sponsored by Rep. Barbara Comstock (R-VA), which supports cyber programs at NIST.

MeriTalk: Langevin, Murphy Added to Cyberspace Solarium Commission

MeriTalk: Langevin, Murphy Added to Cyberspace Solarium Commission

By MeriTalk

House Democratic Leader Nancy Pelosi, D-Calif., has appointed Rep. Jim Langevin, D-R.I., and former Rep. Patrick Murphy, D-Pa., to the recently created Cyberspace Solarium Commission, a 14-member public-private panel charged with developing consensus and actionable strategy to protect and defend the U.S. in cyberspace. Legislation creating the commission was approved as part of the FY 2019 National Defense Authorization Act (NDAA). Rep. Langevin is a co-chair of the Congressional Cybersecurity Caucus and ranking member of the House Armed Services Committee’s Emerging Threats and Capabilities Subcommittee. Murphy was a congressman from 2007 to 2011, and is a former under Secretary of the Army.

PVA: Paralyzed Veterans of America Lauds House and Senate Committee Leaders’ Agreement on Long-Term FAA Bill

PVA: Paralyzed Veterans of America Lauds House and Senate Committee Leaders’ Agreement on Long-Term FAA Bill

Source: Paralyzed Veterans of America

WASHINGTON, D.C. —Paralyzed Veterans of America (PVA) today lauded House and Senate transportation committee leaders for coming to an agreement on a long-term Federal Aviation Administration (FAA) bill.

“We are extremely pleased that the FAA Reauthorization Act of 2018 (H.R. 302) includes multiple provisions that specifically target the air travel experience of passengers with disabilities,” said PVA National President David Zurfluh.

The FAA Reauthorization Act of 2018 includes some crucial provisions such as an Airline Passengers with Disabilities Bill of Rights; an Advisory Committee on the Air Travel Needs of Passengers with Disabilities; a study on in-cabin wheelchair restraint systems; increased civil penalties for damage to a passenger with a disability or his or her mobility aid; and a requirement for the Department of Transportation (DOT) to move forward in implementing the reporting requirement for large domestic airlines to report on the number of wheelchairs and scooters enplaned and subsequently damaged.

H.R. 302 also includes a revision of training requirements for Transportation Security Agency (TSA) officers in screening people with disabilities in consultation with disability and veterans organizations and increased reporting requirements.

“We greatly appreciate the efforts of the leaders of the Senate Commerce, Science, and Transportation and House Transportation and Infrastructure and Committees who listened to the concerns of paralyzed veterans and all people with disabilities to ensure that this FAA Reauthorization Bill begins to address the difficulties people with disabilities encounter in air travel and in transiting airport security,” stated Zurfluh.

Zurfluh also thanked Chairman John Thune (R-SD), Ranking Member Bill Nelson (D-FL), Chairman Bill Shuster (R-PA), and Ranking Member Peter DeFazio (D-OR) for their efforts on this bill.

“We applaud Senator Tammy Baldwin (D-WI) and Congressman Jim Langevin (D-RI) for introducing the Air Carrier Access Amendments Act (S. 1318/H.R. 5004), which helped inform many of the disability-related provisions related to improving access to air travel,” said Zurfluh. “We would also like to thank Ranking Member Nelson for including improvements to the airport security process for all people with disabilities.”

NY Times: Trump Loosens Secretive Restraints on Ordering Cyberattacks

NY Times: Trump Loosens Secretive Restraints on Ordering Cyberattacks

By David E. Sanger

WASHINGTON, D.C — President Trump has authorized new, classified orders for the Pentagon’s cyberwarriors to conduct offensive attacks against adversaries more freely and frequently, the White House said on Thursday, wiping away Obama-era restrictions that his advisers viewed as too slow and cumbersome.

“Our hands are not as tied as they were in the Obama administration,” John R. Bolton, the national security adviser, told reporters in announcing a new cyberstrategy.

Mr. Bolton rewrote a draft of the strategy after joining the administration in April. Many of his remarks on Thursday focused on a secret order — which Mr. Trump signed in August but which has never been publicly described — that appears to give far more latitude for the newly elevated United States Cyber Command to act with minimal consultation from a number of other government agencies.

The order essentially delegates more power to Gen. Paul M. Nakasone, who took over this year as the director of the National Security Agency and the commander of United States Cyber Command. During his Senate confirmation hearing in March, General Nakasone complained that America’s online adversaries attacked with little concern about retaliation.

“I would say right now they do not think that much will happen to them,” said General Nakasone, who previously oversaw the Army’s cybercommand. “They don’t fear us.”

But this month, General Nakasone said he was more comfortable with the new guidance issued by the White House, even though the administration has not made any of it public.

Senior officials have said it eliminates a lengthy process of consensus-building across the government — the Departments of Commerce, Treasury and Homeland Security among them — before the United States conducts an offensive action.

It is not clear whether Mr. Trump must still approve every major offensive online operation, as Presidents George W. Bush and Barack Obama did.

Mr. Bolton did not shed much light. “Our presidential directive effectively reversed those restraints, effectively enabling offensive cyberoperations through the relevant departments,” he said.

He said that since Mr. Trump took office, the administration has “authorized cyberoperations” against rivals, though he gave no details.

Much of the strategy that was made public on Thursday strongly echoes similar documents issued by Mr. Obama and Mr. Bush. They focus on improving digital defenses for the United States government, bettering training, working with private industry to share information about vulnerabilities and working with allies.

While the words in the strategy differ from the past, the impetus is the same. It did, however, identify specific countries as adversaries.

“Russia, Iran and North Korea conducted reckless cyberattacks that harmed American and international businesses and our allies and partners without paying costs likely to deter future cyberaggression,” the strategy read. “China engaged in cyberenabled economic espionage and trillions of dollars of intellectual property theft.”

But the classified directive appears to be significantly different, as Mr. Bolton said on Thursday.

His indictment of the previous administration omitted the fact that Mr. Obama continued or initiated three of the most aggressive cyberoperations in American history: one to disable Iran’s nuclear fuel production, another to attack North Korea’s missile programs and a third against online recruitment and communications by the Islamic State.

The first, code-named Olympic Games, was judged successful at destroying about 1,000 nuclear centrifuges for a year. The Korea operation had only mixed results at best, and Mr. Obama’s own defense secretary later wrote that the operation against the Islamic State proved largely ineffective.

But Mr. Obama hesitated to strike back at Russia in 2016 after revelations of its breach into the Democratic National Committee, and acted only after the presidential election.

And, as Mr. Bolton noted, the United States declined to name other attackers, including the Chinese, for stealing roughly 22 million files on Americans with security clearances from the Office of Personnel Management. He noted that those files, “my own included, maybe yours, found a new residence in Beijing.”

Mr. Bolton became the first American official to formally acknowledge what was widely known: that the Chinese government was behind that intrusion.

Additionally, the Trump administration accused North Korea of mounting the WannaCry attack that brought down the British health care system, and Russia of initiating the NotPetya attack that was aimed at Ukraine and cost hundreds of millions of dollars in damage, including to shipping companies like Maersk.

But Mr. Bolton, whose concepts of deterrence were formed in the Cold War, is likely to discover what his predecessors learned: Almost every strategy that worked in deterring nuclear attacks does not fit the digital era, and even figuring out where an attack originated can be a challenge.

The government has grown more skilled at attributing the source of a cyberattack, but the process remains lengthy. By the time a conclusion is reached, it is often too late to mount a successful counterstrike.

Mr. Trump has particularly muddied the waters in assigning blame for attacks, repeatedly expressing doubts that Russia was behind the hacking of the Democratic National Committee and members of Hillary Clinton’s 2016 presidential campaign. The Justice Department has indicted officers of Russia’s military intelligence unit, once known as the G.R.U., and the Internet Research Agency, in those attacks.

Part of the strategy calls for the United States to develop what it describes as an international cyberdeterrence initiative, which sounds similar to efforts to develop a theory of nuclear deterrence. The document provides few details, but says the Trump administration will build “a coalition and develop tailored strategies to ensure adversaries understand the consequences of their malicious cyberbehavior.”

Some of those efforts have already begun: The American accusations against North Korea and Russia last year were immediately echoed by Britain and other Western powers.

Representative Jim Langevin, Democrat of Rhode Island who has been active in developing new cyberstrategies, said that the White House approach was focused “in starkly offensive terms.”

“I agree that our adversaries need to know that we can — and will — challenge them in cyberspace,” Mr. Langevin said. “But as the country with the most innovative economy in the world, we must also acknowledge the abiding interest of the United States in encouraging stability in this domain.”

Nextgov: Senate-Passed Bill to Hack DHS Heads to House Floor

Nextgov: Senate-Passed Bill to Hack DHS Heads to House Floor

By Joseph Marks

The House Homeland Security Committee forwarded two bills Thursday to make it easier for ethical hackers to share computer vulnerabilities they find in Homeland Security Department websites.

The first bill, sponsored by House Majority Leader Kevin McCarthy, R-Calif., would direct Homeland Security officials to create a vulnerability disclosure policy. That policy would describe which department websites, hackers can legally probe for vulnerabilities, how they can alert the department about those vulnerabilities and when and how the department will respond to and remediate the vulnerabilities.

Homeland Security Sec. Kirstjen Nielsen told lawmakers in April that the department already plans to adopt such a policy, but the department has not made progress since then, Rep. Jim Langevin, D-R.I., said during Thursday’s markup.

The second bill, which has already been passed by the full Senate, would go a step further, requiring Homeland Security to create a formal program, known as a bug bounty, that would solicit vulnerability reports from hackers and pay them for vulnerabilities that checked out.

The Hack the Department of Homeland Security bill, sponsored by Sen. Maggie Hassan, D-N.H. in the Senate, is partly modeled on numerous successful bug bounty programs at the Pentagon and military services.

The bill would mark the first departmentwide bug bounty in the civilian government. The General Services Administration’s Technology Transformation Service also runs an ongoing a bug bounty.

Those Defense Department bug bounties required a lot of time and money, however, and some bug bounty organizers have warned that a full bug bounty may not be a good investment for civilian agencies—especially if they lacks the resources to investigate and patch all the bugs ethical hackers uncover.

Homeland Security’s top cybersecurity and infrastructure security official Chris Krebs initially expressed skepticism about a department bug bounty, worrying it could steal resources from other parts of the department’s cyber mission. He later endorsed the plan, however, during his confirmation hearing.

ProJo: Our Turn: Jim Langevin and Glenn ‘GT’ Thompson: Closing the skills gap is bipartisan affair

ProJo: Our Turn: Jim Langevin and Glenn ‘GT’ Thompson: Closing the skills gap is bipartisan affair

By Congressman Jim Langevin (D-RI) and Congressman Glenn “GT” Thompson (R-PA)

Bipartisanship isn’t dead. In fact, it just experienced a significant victory.

Though we come from opposite sides of the aisle, we successfully worked together as co-chairs of the bipartisan Congressional Career and Technical Education Caucus to overhaul the law responsible for much of our nation’s career and technical education system.

The Perkins Act, which is the primary federal funding source for career and technical education programs, had not been reauthorized in over a decade, and it was clear there was a strong need to better align what is taught in the classroom with the skills businesses need today.

This long-overdue reauthorization bill, the Strengthening Career and Technical Education for the 21st Century Act, passed Congress unanimously and was signed into law by President Trump on Aug. 1. It ensures businesses have more input in classroom curricula so students are learning in-demand skills for the workplace. It also expands student access to apprenticeships, while increasing career and technical education investment by $100 million over the next five years.

Career and technical education was once known as “vocational education,” which, for many people, evokes memories of shop classes for students who weren’t “cut out” for college. The vocational education of yesteryear was regarded by many as a plan B for students. But that is not the career and technical education of today, which is not a fallback option, but a pathway that appeals to students of all abilities.

Today’s programs prepare students for college and high-skill, high-paying careers. They teach core academic and job-specific technical skills while incorporating the use of communication, teamwork, problem solving and other “soft skills” that are highly valued by employers and lead to better outcomes when students enter the workforce.

In addition to classroom instruction, career and technical education provides hands-on learning using advanced equipment like 3D printers and medical simulators, and it creates opportunities to participate in on-the-job training in leading local businesses. Nearly 12 million students were enrolled in high school and postsecondary classes in the 2016-2017 school year, and this number is growing.

We need to be rid of the stigma that surrounded vocational education once and for all and embrace today’s career and technical education programs. These programs engage students, allow them to explore different career paths, and prepare them for today’s workplace. They also fill a dire economic need: they build a skilled workforce.

When we travel across Rhode Island and Pennsylvania, we hear the same thing from businesses — they can’t find qualified workers to fill open positions. Nationally, 46 percent of employers cite difficulty finding skilled talent, and more than 80 percent of manufacturers report that worker shortages impact their ability to meet customer demand.

Career and technical education helps close this skills gap, driving economic growth and yielding big returns on investment for state economies. But this can only happen when students are learning relevant skills for in-demand jobs, when education and industry are aligned through partnerships across secondary and postsecondary schools.

Our bill puts these partnerships front and center, bringing stakeholders from local businesses and schools to the table. It ensures career and technical education programs are adequately preparing students not only for college, but also for career success and providing them with work-based learning opportunities. It strengthens federal investment in career and technical education programs, allowing students and businesses to thrive.

Our colleagues in Congress agreed this was an important bill. Despite our ideological differences, we found common ground on the necessity of modernizing these programs, on updating an old law to create new pathways of success for our constituents.

Yes, political rhetoric can be nasty at times, but we can work together when we put our minds to it; we did it with career and technical education, and we were proud to lead that effort.

Now it’s time to implement the law, and even more importantly, it’s time to move this spirit of bipartisanship forward — to find other policy areas where we can work together to expand opportunities for the American people.

Jim Langevin is a Democratic U.S. representative from Rhode Island. Glenn “GT” Thompson is a Republican U.S. representative from Pennsylvania.

ProJo: $2M grant to establish Zero Suicide initiative in Southern R.I.

ProJo: $2M grant to establish Zero Suicide initiative in Southern R.I.

By G. Wayne Miller

RICHMOND, R.I. — Already a leader in mental-health awareness and services, the South County Healthy Bodies, Healthy Minds collaborative has received $2 million in federal funding aimed at reducing suicides. The funding was announced Monday at Harvest Acres Farm, whose owners, Cindy and John Duncan, lost their teenage daughter to suicide.

The funding will enable the collaborative to establish its “Zero Suicide in Washington County” initiative, described by the state Department of Health and three members of Rhode Island’s congressional delegation in a joint statement as a “wide-ranging program for health care providers across the region to screen for the warning signs of suicide and provide vital services to further assess and care for those at risk of suicide.”

Dr. Robert Harrison, director of the project, described it as “both a system and a culture change [and] also the most effective program proven to drastically reduce suicides in health care systems for the initiative. Yale New Haven Health/Westerly Hospital is proud to collaborate with South County Health and every other major health care organization in the region to prevent the most preventable death — suicide — in Washington County.”

Among other significant efforts, South County Healthy Bodies, Healthy Minds has joined the international Mental Health First Aid effort, which now includes the University of Rhode Island, whose provost, Donald H. DeHayes, sits on the collaborative’s board.

“We can mount this program in South County because of the strength of South County Healthy Bodies, Healthy Minds, a collaboration of healthcare providers, the school systems, URI, our community action agency, business partners and many other social service agencies,” said South County Health president and CEO Lou Giancola.

The $2 million in funding will flow from the Substance Abuse and Mental Health Services Administration.

“This initiative is a comprehensive approach that has brought in advocates and family members who have been impacted by suicide to bring help, hope, and light to those in need who are going through a dark time,” said Senator Jack Reed.

Said Senator Sheldon Whitehouse: “Making sure health care professionals have the training and resources to lend care and support to those fighting depression and thoughts of suicide will go a long way toward getting us to zero suicides.”

Added U.S. Rep. Jim Langevin, whose district includes South County, “Suicide is preventable, and we need to do all we can to save these lives.”

While providing direct services and raising funds for mental-health causes and awareness, Harvest Acres Farm also memorializes Cassie Duncan, who lost her life to suicide during the Christmas 2005 holidays. Fourteen years old and an artist, Cassie had not shared what she was experiencing.

“It’s absolutely incredible how far we have come,” Cindy said in May, as Harvest Acres marked yet another expansion of its programming. “It’s a true blessing. Cassie and God are smiling and I couldn’t be happier.”

South County now joins a growing movement to reduce suicide. In May, Butler Hospital announced its own Zero Suicide initiative.

Cyber Scoop: House passes deterrence bill that would call out nation-state hackers

Cyber Scoop: House passes deterrence bill that would call out nation-state hackers

By Sean Lyngaas

The House of Representatives on Wednesday passed a bipartisan bill aimed at deterring foreign governments from conducting hacking operations against U.S. critical infrastructure.

The Cyber Deterrence and Response Act put forth by Rep. Ted Yoho, R-Fla., calls on the president to identify individuals and organizations engaged in state-sponsored hacking that significantly threatens U.S. interests, and then to impose one or more of a slew of sanctions on them.

That “naming and shaming” approach is an effort to ward off future cyberattacks from China, Russia, Iran, and North Korea — four countries that U.S. officials routinely label as top adversaries in cyberspace.

The bill, which passed the House by voice vote, also calls for a uniform list of foreign hacking groups to be published on the Federal Register. Sen. Cory Gardner, R-Colo., last month introduced companion legislation in the Senate.

“Our foreign adversaries have developed sophisticated cyber capabilities that disrupt our networks, threaten our critical infrastructure, harm our economy, and undermine our elections,” Yoho said in a statement. “Collectively, we must do more to combat this digital menace.”

Rep. Jim Langevin, D-R.I., co-founder of the Congressional Cybersecurity Caucus, said the bill is an “important step forward in recognizing that cyberthreats are the new weapon of choice for states who seek to sow discord and engage in conflict below the threshold of war.”

Lawmakers have long urged the executive branch to delineate a cyber deterrence strategy after high-profile breaches of the Office of Personnel Management in 2015 and the Democratic National Committee in 2016.

In response to the demand for a deterrence strategy, the State Department in May recommended that the U.S. government develop a broader set of consequences that can be imposed on adversaries to deter cyberattacks.

Washington should work with allies to inflict “swift, costly, and transparent consequences” on foreign governments that use “significant” malicious cyber activity to harm U.S. interests, the unclassified version of the State Department report says.

Officials such as Vice President Mike Pence and Homeland Secretary Kirstjen Nielsen have touted the administration’s efforts to crack down on foreign hackers. “[T]his administration is replacing complacency with consequences, replacing nations’ deniability with accountability,” Nielsen said in a speech Wednesday.

Inside Cybersecurity: Rep. Langevin: Restructuring cyber oversight a top priority for Democrats

Inside Cybersecurity: Rep. Langevin: Restructuring cyber oversight a top priority for Democrats

By Charlie Mitchell

Streamlining congressional oversight of cybersecurity policy, creating a high-level “cyber director” role at the White House and — of course — closer scrutiny of Trump administration cyber efforts will top the priority list if Democrats take the House in November, according to one key Democratic lawmaker.

“We haven’t moved the ball enough on [cyber] oversight,” Rep. James Langevin (D-RI) told Inside Cybersecurity. “It needs to happen faster and more comprehensively.”

Langevin is the co-founder of the bipartisan Congressional Cybersecurity Caucus and a senior member of the Armed Services and Homeland Security committees.

He is in line to chair Armed Services’ cyber-focused emerging threats subcommittee if the Democrats get the net 24-seat pickup they need on Election Day to secure a House majority. Nonpartisan analyses and the latest polling aggregations show the Democrats poised to make the necessary gains.

But within the House’s current committee structure, Langevin said, “oversight of cybersecurity is too stove-piped — the jurisdictional issue is a problem and we need to streamline.”

What’s the problem? “Jurisdiction, jurisdiction, jurisdiction,” Langevin said. “It’s a major roadblock to legislation and oversight.”

With eighty-plus committees and subcommittees exercising authority over myriad cyber issues, “we need more agility in oversight,” Langevin said. “That takes strong leadership at the speaker and minority leader level. I hope we’re in the majority and can streamline oversight. That will be one of my top priorities.”

Otherwise, the ninth-term lawmaker said, “the only thing that moves the needle on cyber is a crisis.”

On other issues, Langevin cited the upcoming one-year anniversary of the Equifax hack in calling for action on data security and breach notice legislation, such as the bill he has introduced that would require notification to consumers within 30 days of detecting a breach and give the Federal Trade Commission statutory authority for “coordinating responses” to cyber attacks.

“There hasn’t been enough done to prevent future Equifaxes from happening or to notify consumers” of breaches, he said.

Langevin said that he will also push for a “Senate-confirmed cyber director role with budget authority, at the White House.”

“There needs to be one person who is responsible and accountable for what the policy is and what the metrics are for success.”

Such a position would have significantly more authority than the White House cyber coordinator role that President Trump eliminated earlier this year — and that was a creation of the Obama administration that lacked statutory authority.

Langevin likened the position he envisions — and has detailed in legislation introduced in the past two Congresses — to the Director of National Intelligence or the Director of National Drug Control Policy.

Langevin also discussed the new National Risk Management Center that the Department of Homeland Security has launched, calling it “a positive step forward” and saying he is “looking forward to hearing from them.”

“We need to make sure they have the tools they need and that the [National Cybersecurity and Communications Integration Center] is more operational in real time. But the risk management center could have real value,” he said.

Still, Langevin said, “we need to get better at assuring interagency coordination. The primacy of DHS is important, which is why enactment of NPPD reorganization is essential.”

Bipartisan legislation has cleared the House that would transform NPPD into a cybersecurity agency, but it remains stalled in the Senate, a source of bipartisan frustration among House members.

“Organizing and making clear the mission of NPPD is important, but we also need to know who is coordinating the whole-of-government strategy,” Langevin said, underscoring the need for a high-level policy director.

The lawmaker also expressed concerns that not enough has been done to secure state elections systems amid ongoing hostile action from Russia.

“We’re going into the elections with just a Band-Aid,” he said. “Time is short now but I’m concerned about DHS having enough resources to deal with states an localities, and to protect other critical infrastructure.”

With concerns lingering about proper state and federal role son election security, he added: “I encourage states to reach out for assistance — the federal government is never going to take over the electoral process.”

Cyber Scoop: DHS supply chain and CDM bills pass the House

Cyber Scoop: DHS supply chain and CDM bills pass the House

By Zaid Shoorbajee

The House passed two bills Tuesday that aim to bolster the Department of Homeland Security’s cybersecurity efforts as they relate to securing the agency’s own vendor supply chain as well as securing other federal agencies’ networks.

Both bills now head to the Senate. One of them, the Securing the Homeland Security Supply Chain Act of 2018, would give the secretary of Homeland Security authority to block IT vendors deemed to pose a supply chain risk from contracting with the agency.

“There is no question that nation-states and criminal actors are constantly trying to exploit U.S. government and private sector systems to steal information or insert potentially harmful hardware or software,” said the bill’s sponsor, Rep. Peter King, R-N.Y., on the House floor before a voice vote.

King cited recent and ongoing U.S. government scrutiny of Russian cybersecurity company Kaspersky Lab and Chinese telecommunications companies Huawei and ZTE as justification for giving DHS this new authority. Those efforts “underscore the threats posed to the federal supply chain and the urgency in developing stronger mechanisms to secure it,” King said.

The bill as passed would only allow DHS to make these decisions for its own contracts.

“I am hopeful, this bill moves through the process, that we will also have an opportunity to consider legislation that provides similar authority to ensure national security vetting is incorporated into the wider government procurement process,” King said.

The other bill, the Advancing Cybersecurity Diagnostics and Mitigation Act, would codify into law DHS’s existing Continuous Diagnostics and Mitigation (CDM) program, which provides other federal agencies with monitoring and threat detection on their networks.

“We need to know what we have before we can try to defend it,” said Rep. John Ratcliffe, R-Texas, who introduced the bill. “[CDM] not only allows the ability to combat our enemies in cyberspace, but also to help federal CIOs manage information technology.”

DHS has been awarding billions of dollars worth of contracts to keep CDM’s various phases going. The bill passed Tuesday would make the program statutorily part of DHS.

Rep. Jim Langevin, D-R.I., also spoke in support of the CDM bill on the House floor, but expressed concern that the bill does not incentivize agencies to actually take advantage of the DHS program.

“This is a good bill, and I urge my colleagues to support its passage. However, I must take this opportunity to mention this bill’s major omission. It does not address the incentive structure at other agencies to actually adopt CDM offerings,” Langevin said.

Langevin lamented that CDM full potential is being hindered by the fact that there are many congressional committees and federal agencies that compete over jurisdiction of cybersecurity issues.

“During hearings and roundtables on the program, we often heard from government stakeholders that internal dynamics at DHS’s sister agencies were actually the biggest obstacle to the program’s success,” Langevin said. “I urge my colleagues to consider the wisdom of having so many committees involved with cybersecurity jurisdiction often to the detriment of making real progress.”