Last month, Sen Peters (D,MI) introduced S 3635, the Industrial Control Systems Cybersecurity Competition Act. The bill would amend 6 USC 665m(d), President’s Cup Cybersecurity Competition, to expand the competition to specifically include operational technology and industrial control systems. No new funding is authorized by the legislation.
OT-ICS Coverage
The new language incorporates definitions of two key terms from other statutes:
Operational Technology - 15 USC 278g–3a, and
Industrial Control System - 6 U.S.C. 665i
After deleting the existing paragraph (3) and changing the remaining paragraphs to subparagraphs of a revised paragraph (1), the bill would add a new paragraph (2), Biennial Requirements. That new paragraph would require the President’s cup to, at least every-other-year, to include competitions “demonstrating offensive and defensive cyber operations involving” operational technology and industrial control systems.
Moving Forward
As I noted this morning, the Senate Homeland Security and Governmental Affairs Committee is scheduled to take up this bill on Wednesday. I suspect that there will be significant bipartisan support for this bill. Since this bill is not politically important enough to be considered by the Senate under regular order, the key person to watch in this hearing will be Ranking Member Paul (R,KY). Opposition will effectively kill further consideration of the bill as he would be expected to object to any unanimous consent motion to consider the bill. Unfortunately, his support would not be a guarantee that he would not object to future unanimous consent motions for other political reasons.
Commentary
While high profile competitions are a good way of publicizing cybersecurity vulnerabilities and threats and encouraging attention to proactive cybersecurity measures, in the great scheme of things they actually do little to stop cyberattacks. Politically, it would allow Congress to look like it is doing something, without spending any money or making any difficult political decisions. I guess we cannot expect much more out of the 118th Congress.