Last week, Rep Thompson (D,MS) introduced HR 6825, the Nonprofit Security Grant Program Improvement Act of 2022. The bill would amend 6 USC 609a, the Nonprofit Security Grant Program. The amendments include adding new allowed uses of the funds and requires FEMA to establish a program office to administer the grant program. The bill would increase the funding for the program and extends that funding through 2028.
The bill was approved yesterday by a voice vote in the House Homeland Security Committee after substitute language was approved. Among the changes made by the substitute is a provision that specifically includes the risk of “extremist attacks other than terrorist attacks and threats” in the coverage of the grant program.
Changes to §609a
Section 2(a)(1) would make changes to §609a(c) adding the following to the list of ‘permitted uses’ of the grant funds:
Facility security personnel costs, including costs associated with contracted security, and
Expenses directly related to the administration of the grant, except that such expenses may not exceed five percent of the amount of the grant.
Section 2(a)(2) would authorize States to retain up to 5% of the pass-through grant funds for “for expenses directly related to the administration of the grant.”
Section 2(a)(4) adds four new subsections to§609a covering:
Section 2(a)(5) would change the authorized funding for the Program. The existing $75 million funding for 2022 is maintained, but future funding through 2028 is increased to $500 million per year.
Substitute Language
Thompson proposed substitute language for the bill that was adopted by voice vote. The language makes a number of minor changes, but it does add a new subsection (k) to §609a:
“(k) TREATMENT.—Nonprofit organizations determined by the Secretary to be at risk of extremist attacks other than terrorist attacks and threats under subsection (a) are deemed to satisfy the conditions specified in subsection (b) if protecting such organizations against such other extremist attacks would help protect such organizations against such terrorist attacks and threats.”
Moving Forward
Passage by voice vote in Committee indicates that there is at least some measure of bipartisan support for this bill. There was an attempt by Rep Higgins (R,LA) to express some concerns with this bill, but there was no follow-up at the end of the hearing. I suspect that the legislation will be considered in the Full House under the suspension of the rules process. It will probably pass with bipartisan support.
Commentary
While §609a does currently allow for the use of grant funds for cybersecurity training {§609a(c)(2)} and ‘cybersecurity resilience activities’ {§609a(c)(2)}, that funding only extends to protection against terrorist attacks or threats of such attacks. The substitute language addition of ‘extremist attacks’ allows DHS to include threats from domestic groups without the political baggage of trying to identify domestic terrorist groups. This is almost certainly why there is no definition of the term ‘extremist attacks’.
Still, this does not address the expanding need for protection against non-terrorist (or even extremist) cyberattacks like ransomware attacks. This bill would have been an ideal place to include protection against ransomware attacks as an allowed use of grant funds. With this bill probably going to the Full House under the suspension of the rules process, the chances for amending the bill have essentially passed.
Perhaps it is time to change the definition of ‘terrorism’ to specifically include ransomware attacks.