With the recent publication of the engrossed version (passed in the Senate) of S 1260, the United States Innovation and Competition Act of 2021, I have now had a chance to go back and look at the cybersecurity related provisions that were included in the massive, 2375 pages, bill. In addition to the new sections added in the substitute language that I briefly mentioned earlier, there were a number of provisions added in passing that are worthy of mention. I will take a look at all of that in this post.
Minor Cyber Provisions
A search of the language of the bill for the term ‘cyber’ turns up a number of hits. Four deserve specific mention here.
Section 2005 (pg 79) of the bill establishes the list of ‘Key Technology Focus Area’ that are referenced in many places in Division B of the bill as areas where NSF and DOE research funding should targeted. Included in that list is:
“(H) Data storage, data management, distributed ledger technologies, and cybersecurity [emphasis added], including biometrics,”
In Section 2205 (pg 159) under modernizing references to STEM (Science, Technology, Engineering, and Manufacturing), the definition of the term ‘advanced technology’ in 42 USC 1862i(j) is revised to read:
“(1) the term advanced-technology includes technological fields such as advanced manufacturing, agricultural-, biological- and chemical-technologies, energy and environmental technologies, engineering technologies, information technologies, micro and nano-technologies, cybersecurity technologies [emphasis added], geospatial technologies, and new, emerging technology areas;’’
In Section 2403 (pg 325), which establishes a new expansion awards program under the Hollings Manufacturing Extension Partnership, one of the purposes for which an award may be issued is:
‘‘(2) To mitigate vulnerabilities to cyberattacks, including helping to offset the cost of cybersecurity projects for small manufacturers.”
Protecting research from cyber theft
Section 2305 amends 15 USC 272(e)(1)(A) by adding ‘institutions of higher education’ to the list of considerations NIST has to address in developing consensus-based cybersecurity standards. Additionally, §2305(b) requires NIST to “disseminate and make publicly available resources to help research institutions and institutions of higher education identify, protect the institution involved from, detect, respond to, and recover to manage the cybersecurity risk of the institution involved related to conducting research.”
Those resources would be required to be {§2305(b)(2)}:
Generally applicable and usable by a wide range of research institutions and institutions of higher education,
Vary with the nature and size of the implementing research institutions or institutions of higher education, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing research institutions or institutions of higher education;
Include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist research institutions or institutions of higher education in mitigating common cybersecurity risks,
Include case studies of practical application,
Technology-neutral and can be implemented using technologies that are commercial and off-the-shelf, and
To the extent practicable, are based on international standards.
NASA Cybersecurity
Section 2676 (pg 690) would amend 51 USC 20301 by adding a requirement for the NASA Administrator to “up-date and improve the cybersecurity of NASA space assets and supporting infrastructure” {new §20301(c)}. NASA would also be required to establish a Cyber Security Operations Center. Finally, it would authorize NASA to “implement a cyber threat hunt capability to proactively search NASA information systems for advanced cyber threats that otherwise evade existing security tools” {§2676(c)(1)}.
Digital Connectivity and Cybersecurity Partnership
Section 3122 would authorize the State Department to establish a Digital Connectivity and Cybersecurity Partnership Program. This program would be designed to help foreign countries {§3122(a)}:
Expand and increase secure Internet access and digital infrastructure in emerging markets,
Protect technological assets, including data,
Adopt policies and regulatory positions that foster and encourage open, interoperable, reliable, and secure internet, the free flow of data, multi-stakeholder models of internet governance, and pro-competitive and secure information and communications technology (ICT) policies and regulations,
Promote exports of United States ICT goods and services and increase United States company market share in target markets,
Promote the diversification of ICT goods and supply chain services to be less reliant on PRC imports; and
Build cybersecurity capacity, expand inter-operability, and promote best practices for a national approach to cybersecurity.
The section would authorize $100 million per year through 2026 for this Program.
Cyber Response and Recovery
Section 4252 (pg 1238) is the Cyber Response and Recovery Act. It is essentially the language of S 1316, which I have previously described in detail.
Federal Rotational Cyber Workforce Program
Division D of the bill includes Title II, Cyber and Artificial Intelligence. Subtitle B (pg 1257) of that Title is the Federal Rotational Cyber Workforce Program Act of 2021. It is essentially the language of S 1097 which the Senate Homeland Security and Governmental Affairs Committee ordered reported favorably last month.
It establishes a rotational cyber workforce program under which certain federal employees may be detailed among rotational cyber workforce positions at other agencies while allowing each agency to determine what workforce positions involving information technology, cybersecurity, or other cyber-related functions in that agency are eligible for the program. The program would remain in effect for five years.
Moving Forward
There are indications that the House may not be taking up S 1260. Instead, the House may try to incorporate substantial portions of the bill in HR 2225 that was recently approved in the House Science, Space, and Technology Committee. What provisions might make the final cut there would remain to be seen.
Commentary
Almost all of the cybersecurity provisions in this bill are limited to information technology because of the language or definitions involved. It is not clear that that was the intention of the crafters of this bill, but it is certainly the effect.
The one exception to this generality is the NASA cybersecurity section. The security operations center provision in §2676(b) are intended to “to identify and respond to cybersecurity threats to NASA information technology systems, including institutional systems and mission systems” {§2676(b)(1)}. That terminology is not defined either in this bill or 51 USC 10101, but I suspect that it includes operational technology systems on the ground and in space.
There remains a basic misunderstanding in Congress about the diversity of cybersecurity concerns in different types of cyber systems. Just like there cannot be people programs that treat every person in the country exactly the same, there cannot be cybersecurity programs that treat all systems the same. The sooner Congress realizes this, the sooner they can craft realistic cybersecurity legislation.