S 2153 Introduced

Cybersecurity Reserve Response

In June, Sen Peters (D,MI) introduced S 2153, the Defense Support for Cyber Emergencies Response Act. The bill would amend 10 USC 12304, to specifically allow DOD to recall “any unit of the Selected Reserve or any member of the Selected Reserve not assigned to a unit organized to serve as a unit, or any member of the Individual Ready Reserve” to respond to certain cyber incidents. No funding is authorized by the legislation.

Section 12304 Background

The existing §12304 provides authority for the President to authorize DOD (and DHS for the Coast Guard) to call reservists to active duty for emergency purposes not related to war or national emergency for up to 365 days. Specifically, subsection (b) allows for this activation to provide assistance in responding to an emergency involving:

• A use or threatened use of a weapon of mass destruction; or

• A terrorist attack or threatened terrorist attack in the United States that results, or could result, in significant loss of life or property.

Subsection (c) limits the number of reservists that can be called to active duty at any one time to 200,000 (no more than 30,000 of which may be members of the IRR). It also specifically prohibits recalling personnel “to provide assistance to either the Federal Government or a State in time of a serious natural or manmade disaster, accident, or catastrophe.” Such assistance is covered under §12304(a).

Definitions

The bill adds a new definition to the list in the existing subsection (j) {being renumbered (k) by this bill}. That new term is ‘covered incident’. It includes:

• A cyber incident involving a Department of Defense information system, or a breach of a Department of Defense system that involves personally identifiable information, that the Secretary of Defense determines is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the people of the United States;

• A cyber incident or collection of related cyber incidents that the President determines is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States; or

• A significant incident declared pursuant to section 6 USC. 677b. NOTE: the definition of the term ‘significant incident’ is found at 6 USC 677a(8).

Other Changes

Section 2 of the bill inserts a new subsection (c):

“(c) Support For Covered Cyber Incidents.—The Secretary of Defense may, without the consent of the member affected, order any unit, and any member not assigned to a unit organized to serve as a unit, of the Selected Reserve or Individual Ready Reserve to active duty for a continuous period of not more than 365 days when the Secretary of Defense determines it is necessary to augment the active forces for a Department of Defense response to a covered incident.”

Moving Forward

Peters is a member of the Senate Armed Services Committee to which this bill was assigned for consideration. This means that there should be sufficient influence to see this bill considered in Committee. Since the provisions of this bill have been include (§522) in the version of HR 2670, the FY 2024 NDAA, passed in the Senate, no further action is expected on this bill unless §522 does not make it into the final version of the bill approved out of conference.