Yesterday with both the House and Senate meeting in pro forma sessions, there were 33 bills introduced. Two of those bills may receive additional coverage in this blog:
HR 6309 To impose sanctions with respect to designated critical cyber threat actors, and for other purposes. Pfluger, August [Rep.-R-TX-11]
HR 6315 To amend the Help America Vote Act of 2002 to require the Election Assistance Commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems. Valadao, David G. [Rep.-R-CA-22]
Cyber Sanctions
I can find no legislation in the 118th Congress that would look to be similar to HR 6309. I will be watching this bill for language and definitions that would specifically include threats against control systems in the scope of critical cyber threats that would justify sanctions.
Election System Cybersecurity
It looks like HR 6315 will be similar to HR 7447, the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, that was introduced by Rep Spanberger (D,VA) in February 2024. No further action was taken on that bill in the 118th Congress.
MIP Legislation
I would like to mention in passing one bill that will not receive additional coverage in this blog:
HR 6304 To codify a national strategy for artificial intelligence that promotes American leadership, removes regulatory barriers, and ensures data are free from security risks and ideological bias, and for other purposes. Kiggans, Jennifer A. [Rep.-R-VA-2]
US versus China in the race for AI leadership, another Republican apple pie and motherhood priority. Along with the expected removal of regulatory barriers (the be all and end all of their support for industry), this bill calls for ensuring that ‘data are free from security risks and ideological bias’. What is not clear here (but would be presumably clarified in the bill) is what data they are talking about, the data used to train the AI system, or the data included in the output of the system. In either case, how can you propose such ‘ensuring’ without adding regulatory controls?