S 1324 Introduced - Civilian Cyber Security Reserve Act
Earlier this month Sen Rosen (D,NV) introduced S 1324, the Civilian Cyber Security Reserve Act. The bill would authorize DOD and DHS to each establish a separate Civilian Cyber Security Reserve pilot project “to address the cyber security needs of the United States with respect to national security”. The pilot project authorization would end seven years after they were established. Such sums as may be necessary for these projects would be authorized by this bill.
Members
DOD and DHS would set the criteria for membership in their CCSR. That would include the criteria for eligibility in the respective CCSR and the application process for personnel that were interested in joining that CCSR. The bill does only sets two minimum requirements:
Previous employment by the Federal Government or within the uniformed services, and
Cybersecurity expertise.
The bill would prohibit members of the Selected Reserve (10 USC 10143) from becoming member of either of the two CCSR. Essentially this means that members serving in a reserve unit would not be eligible to participate in the CCSR.
DOD and DHS would be authorized by the bill to establish two separate components of their CCSR. One would consist of personnel who agreed to be obligated to respond when called into activation. The others would not be obligated. DHS and DOD would be authorized to provide different benefits to the members of the two components.
Personnel in either CCSR would have the same employment protections that reservists have when called to active duty under 43 USC Chapter 43, Employment and reemployment rights of members of the uniformed services. The bill tasks the Department of Labor with prescribing such regulations as necessary to ensure the reemployment, continuation of benefits, and non-discrimination in reemployment of individuals activated in either of the CCSRs.
When members of either CCSR are activated, they would be given a noncompetitive appointment to temporary positions in the competitive or excepted service. Those appointments would be for no more than six months. While in those temporary positions, they would be considered Federal civil service employee under 5 USC 2105.
Moving Forward
Rosen is a member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This means that she could have enough influence to see this bill considered in Committee. I suspect that there would be some level of bipartisan support for the bill. If considered, I would expect to see it favorably reported.
This bill is not important enough to make it to the floor of the Senate for consideration. The time necessary to go through the debate and amendment process means that a bill only comes to the floor when it is important enough in the eyes of the Senate leadership to consume those limited resources. I would suspect that there would be enough opposition to the bill to prevent it from being considered under the unanimous consent process.
There is another way this bill could make its way into law. It could be offered as an amendment to some other bill that comes to the floor of the Senate. Even then, Rosen would have to convince the Leadership that this bill was necessary and important enough to move ahead of all of the other amendments offered for it to come to a vote on the floor.
At this point I am not sure that Rosen is sufficiently committed to this bill to make the necessary efforts to convince the leadership to consider this bill as a potential amendment. If she were, I would have expected to see the language offered as an amendment to the Endless Frontier Act which is currently being debated in the Senate. She has offered another cybersecurity amendment to that bill (SA 1768, pg S3231), perhaps she thinks that one is more important.
Commentary
There is an ongoing problem in the government (and of course in industry as well) of finding enough people with cybersecurity expertise to fill all of the positions necessary to maintain an adequate level of cybersecurity knowledge to be able to respond to the daily grind of protecting the governments cyber systems. This bill is not really designed to address that general issue.
What Rosen and her sole cosponsor {Sen Blackburn (R,TN)} are attempting to do with this bill is to provide some level of surge capacity at DOD and DHS to deal with large scale incidents like the SolarWind attacks or the Microsoft email server problems. Having trained and experienced personnel available to be called up on short notice would certainly make that kind of incident response much easier.
While there is certainly some substantial movement of civilian cybersecurity personnel out of government service, I suspect that the staff that crafted this legislation is expecting to see most of the people signing up for service in these two CCSR will be coming from people exiting military service. While there will be a certain percentage of those exiting personnel with military cybersecurity expertise moving into the military reserve ranks, I suspect that there would be a larger portion that would be more willing to a civil service reserve program like that outlined here, so that they could avoid some of the more unpleasant aspects of military service.
There are certainly cost advantages to setting up this CCSR program over relying on attempting to expand the number and size of cybersecurity related units of the Selected Reserve. First and foremost, DOD would be able to avoid the overhead cost of operating and equipping the additional reserve forces. Congress also tries to keep fairly close control on the size of the reserves as they are trying to limit the future medical and retirement costs of the inevitable increase in retirees. Finally, DHS has only very limited access to support from those units.
There is one point that the crafters of this legislation did miss. While they did prohibit members of the Selected Reserve from becoming members of these two CCSR projects, they did not prohibit members of the Individual Ready Reserve. Those IRR individuals are not assigned to reserve units and typically are not subject to drill and annual training requirements. A number of people take that option (I did when I got out after 15 years) as a way to maintain a limited military connection and possibly earn retirement pay at some point. This bill could have taken a relatively easy step to attract those personnel by specifically equating time in one of these temporary civil service appointments as time on active duty.