Last month Sen Rubio (R,FL) introduced S 2666, the Sanction and Stop Ransomware Act of 2021. While the bill title emphasizes ransomware defense, this bill covers a wide range of cybersecurity actions. The bill includes a $1.5 billion fund for critical infrastructure cybersecurity support, with a very vague purpose and few congressionally mandated controls. It also addresses:
Cybersecurity standards for critical infrastructure,
Regulation of cryptocurrency exchanges,
Designation of state sponsors of ransomware and reporting requirements,
Deeming ransomware threats to critical infrastructure as a national intelligence priority,
Ransomware operation reporting capabilities,
Duties of the cybersecurity and infrastructure security agency,
Cybersecurity Standards
Section 2 of the bill amends the Homeland Security Act of 2002 by adding a new Subtitle C, Cybersecurity Standards for Critical Infrastructure. Section 2231 in that subtitle provides the definition of the term ‘critical infrastructure entity’ to be used in the subtitle. The term is defined as an owner or operator of critical infrastructure. The term ‘critical infrastructure is not defined for this Subtitle or Title XXII (6 USC 651 provides definitions for this Title) in which this new subtitle would reside.
The new §2232 in the Subtitle would require DHS, with consultation with CISA, to “develop and promulgate mandatory cybersecurity standards for critical infrastructure entities.” DHS would also be required to “assess the compliance of each critical infrastructure entity with the cybersecurity standards developed”.
Ransomware as a National Security Threat
Section 5 of the bill would require the Director of National Intelligence to “deem ransomware threats to critical infrastructure a national intelligence priority component to the National Intelligence Priorities Framework [link added].” The DNI would be required to provide a report to Congress on the implications of the ransomware threat to United States national security. That report would include:
Identification of individuals, groups, and entities who pose the most significant threat, including attribution to individual ransomware attacks whenever possible,
Locations from where individuals, groups, and entities conduct ransomware attacks,
The infrastructure, tactics, and techniques ransomware actors commonly use,
Any relationships between the individuals, groups, and entities that conduct ransomware attacks and their governments or countries of origin that could impede the ability to counter ransomware threats,
Intelligence gaps that have, or currently are, impeding the ability to counter ransomware threats.
Ransomware Operation Reporting Capabilities
Section 6 of the bill would amend the Homeland Security Act of 2002 by adding another Subtitle to Title XXII; Subtitle D, Ransomware Operation Reporting Capabilities. A new §2241 would provide thirteen different definitions for the Subtitle. Critical definitions include:
The new §2242 would designate CISA as the federal agency to receive ransomware operation notifications from other Federal agencies and covered entities in accordance with the new subtitle. CISA is required to establish a reporting system (System) to “facilitate the submission of timely, secure, and confidential ransomware notifications by Federal agencies and covered entities”.
The new §2243 would require federal agencies and covered entities to submit a ransomware notification to the System within “24 hours after the discovery of a ransomware operation that compromises, is reasonably likely to compromise, or otherwise materially affects the performance of a critical function by a Federal agency or covered entity”.
Covered entities that fail to submit the required reports under this section “shall be subject to penalties determined by the Administrator of the General Services Administration, which may include removal from the Federal Contracting Schedules.”
Duties of the Cybersecurity and Infrastructure Security Agency
In addition to making some technical corrections to the section numbering in Title XXII of the Homeland Security Act of 2002, §7 of the bill adds three new sections to Subtitle A of Title XXII of the Homeland Security Act of 2002. The new sections deal with:
Information system and network security fund,
Public awareness of cybersecurity offerings, and
Dark web analysis.
The new §2220A establishes the Information System and Network Security Fund. The bill authorizes a one-time deposit of $1.5 billion into the fund. The money in the fund will remain available for ten years, at which time any monies remaining would be returned to the Treasury. Funds will be distributed in a manner to be established by CISA “for a specific network security purpose, including to enable network recovery from an event affecting the network cybersecurity of the eligible entity.”
This section uses the definition of ‘covered entity’ (from §2241 discussed above) to define the term ‘eligible entity’, but that definition specifically excludes any entity that is not in compliance with the cybersecurity standards developed under §2232(a).
Moving Forward
Neither Rubio or his sole cosponsor {Sen Feinstein (D,CA)} are members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This makes it unlikely that the bill will be considered by that Committee. If the bill were to be considered it is unlikely that the Committee would recommend the bill to the full Senate without significant changes being made; there are just too many undefined terms and processes for the business community to accept and the $1.5 billion authorization for the cybersecurity slush fund is just too large for fiscal conservatives.