Violence Against the Homeless Accountability Act of 2013

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 1163) to amend chapter 35 of title 44, United States Code, to revise requirements relating to Federal information security, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days within which to revise and extend their remarks and include extraneous materials on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Cybersecurity threats represent one of the most serious national security and economic challenges we face in our Nation. Whether it's criminal hackers, organized crime, terrorist networks, or nation- states, our Nation is under siege from dangerous cybersecurity threats that grow daily in frequency and sophistication.

It is critical that the Federal Government address cybersecurity threats in a manner that keeps pace with our Nation's growing dependence on technology, but current Federal law does not adequately address the nature of today's cybersecurity threats.

Since the enactment in 2002 of the Federal Information Security Management Act, or FISMA, it has become a ``check the box'' compliance activity that all too often has little to do with minimizing cyber threats. And yet the Government Accountability Office recently found that security incidents among 24 key agencies increased by 650 percent, or more than six-fold, in the last 5 years.

To address the rising challenge posed by cyber threats, Ranking Member Cummings and I introduced last Congress a bill to reauthorize FISMA. That

bill was adopted by the House unanimously.

Recently, Mr. Cummings and I reintroduced that legislation as H.R. 1163, the Federal Information Security Amendments Act of 2013. The bill was voted out of our committee by unanimous vote on March 20. This bill aims to harness the last decade of technological innovation in securing Federal information systems.

To enhance the current framework of securing Federal information technology systems, our bill calls for automated and continuous monitoring of government information systems--and I'm going to repeat-- automated and continuous monitoring of government information systems. And it ensures that continuous monitoring finally incorporates regular threat assessments, not just ``check the box.''

The bill also reaffirms the role of the Office of Management and Budget with respect to FISMA, recognizing that the budgetary leverage of the Executive Office of the President is necessary to ensure agencies are focused on effective security IT systems. Mr. Speaker, that's particularly significant because IT is the backbone of every single large and small agency of the government; and only with the power of the President through the Office of Management and Budget can you, in fact, ensure that the President has transparency and his authority is respected throughout all these agencies.

We can no longer afford the ``check the box'' that came out of the first piece of legislation. It wasn't its intent, and the six-fold increase in the last 5 years says it has failed us.

While our bill does not include new requirements, restrictions, or mandates on private, non-Federal computer systems, H.R. 1163 does highlight the need for stronger public-private partnership. Again, as we interface over the public Internet, it is critical that the weakest link be prevented. To that extent, this bill has received strong support from cybersecurity experts and industry, including TechAmerica, the Information Technology Industry Council, and the Business Software Alliance.

I'd like to personally thank Ranking Member Cummings for partnering, both personally and through his staff, to create a bill that is necessary, timely, and accurate to meet the growing threat of cybersecurity.

I encourage all Members to support this timely legislation, and I reserve the balance of my time.

Mr. Speaker, I yield myself 1\1/2\ minutes.

I want to associate myself with the ranking member's statements.

Mr. Cummings does make the great point that Homeland Security is, in fact, doing a great deal. And if there is an active activity through NSA and other agencies, we applaud that.

A great deal of what this bill reauthorization is intended to do, in working with the subcommittee ranking member Mr. Connolly, is to recognize that there needs to be a public-private partnership. We need our private entities to be as strong as they can be so they don't become conduits for espionage and for attacks. But also that, in fact, it's the smallest entity of government, the one that you don't think much of, the one that may not be high priority that, in fact, also has to be protected: commerce at our public parks; commerce occurring throughout the Federal Government; and, in fact, just the records that are so often collected and maintained in places like the Veterans Administration and so on.

Although they may not represent an immediate threat to national security, as a veteran, I must tell you the fact that those records sit there tells all of us, millions of veterans, that we want to have a robust maintenance of cybersecurity, something that under the current statute we believe the box is being checked, but not all that needs to be done is being done.

I reserve the balance of my time.

Mr. Chairman, I yield myself the balance of my time.

Mr. Speaker, H.R. 1163 has many authors: Mr. Cummings and myself, Mr. Connolly, Mr. Chaffetz, Mr. Tierney. It also has every committee chairman and every ranking member here in the House. And I would like to take a moment to thank all the committee chairmen of Homeland Security, Foreign Affairs, and House Administration, because staffs from all of those committees, particularly with the acquiescence of the chairmen and ranking members, have contributed to our fact-finding to try to produce a good bill here today.

I think often our committee is viewed as, what is your authority and so on. This is an odd situation in which, in order for us to bring the bill here today, we really needed all the agencies and all the personnel here to be brought to bear so that we could try to fashion a piece of legislation that would allow the Federal Government to work better, that would allow the executive branch to execute better on behalf of the American people.

Lastly, I would like to thank the outside groups, many of which I mentioned in my opening statement, but even more who responded when this bill was posted for comment. They responded with constructive suggestions.

I know there is a lot of trepidation any time the government is, in fact, looking at data passing through the system, but this and other legislation is a balancing act. We cannot have the economy that we enjoy today if these systems are shut down by attacks. At the same time, I know I join with the ranking member and all of the authors of this legislation in that we are committed to making sure we maintain the personal freedom and the privacy that goes with what we are entrusted to here in the government.

So, in closing, Mr. Speaker, this is an update. It is not the last time we will have to update cybersecurity. It is not the last time we will be here concerned about America's economy so dependent on the Internet, but it is a good bill. It is ready.

I urge its approval, and I yield back the balance of my time.

Committee on Homeland Security,

House of Representatives,

Washington, DC, April 11, 2013.

Hon. Darrell E. Issa,

Chairman, Committee on Oversight and Government Reform,

Rayburn House Office Building, Washington, DC.

Dear Chairman Issa: On March 20, 2013, the Committee on

Oversight and Government Reform ordered H.R. 1163, the

``Federal Information Security Amendments Act of 2013'',

reported favorably to the House with certain provisions in

the legislation that fall within the Rule X jurisdiction of

the Committee on Homeland Security. Specifically, this

legislation would require the Department of Homeland Security

to share cyber threat information with an information

security center, delegate the authority and primary

responsibility of information security to a Chief Information

Security Officer responsible for overseeing a Department-wide

information security program, and recognize the existence of

a Federal information security incident center, which in

practice, is currently the National Cybersecurity and

Communications Integration Center at the Department of

Homeland Security.

The Office of Management and Budget (OMB) issued Memorandum

M-10-28 on July 6, 2010, transferring many of OMB's Federal

information security and responsibilities to the Department

of Homeland Security. Since Memorandum M-10-28 was issued,

the Department of Homeland Security has conducted the

operational aspects of Federal information security through

the functions of the National Cybersecurity and

Communications Integration Center and the United States

Computer Emergency Readiness Team. This legislation, through

its accompanied report, preserves the operational

capabilities of DHS pertaining to Federal information

security while reaffirming OMB's supervisory role with

respect to FISMA.

I understand the importance of advancing this legislation

to the House floor in an expeditious manner. Therefore, the

Committee on Homeland Security will not seek a sequential

referral over provisions within our jurisdiction. This action

is conditional on our mutual understanding and agreement that

doing so will in no way diminish or alter the jurisdiction of

the Committee on Homeland Security over the subject matter

included in this or similar legislation. In addition, I would

like to thank you for working

with me on modifying the report that accompanies H.R. 1163 to

ensure the operational role the Department of Homeland

Security plays in the protection of the Nation's Federal

information systems is in no way diminished. I request that

you urge the Speaker to appoint Members of this Committee to

any conference committee for consideration of any provisions

that fall within the jurisdiction of the Committee on

Homeland Security in the House-Senate conference on this or

similar legislation.

I also request that this letter and your response be

included in the committee report on H.R. 1163 and into the

Congressional Record during consideration of this measure on

the House floor. Thank you for your consideration of this

matter.

Sincerely,

Michael T. McCaul,

Chairman.

Mr. Speaker, on that I demand the yeas and nays.

Mr. Speaker, I yield myself such time as I may consume.

I want to begin by thanking Chairman Issa for sponsoring this legislation and for making this a truly bipartisan effort. I am pleased to join the chairman in sponsoring this bill again this Congress.

Also, I thank the other cosponsors of the bill, including the chairman and the ranking member of the Subcommittee on Government Operations, Representatives John Mica and Gerry Connolly, and the chairman and the ranking member of the Subcommittee on National Security, Representatives Jason Chaffetz and John Tierney.

Last month, the Director of National Intelligence, James Clapper, placed cyber attacks at the top of his list of national security threats. This bill is an important step in Congress' response to the cyber threat. This legislation would ensure that Federal agencies use a risk-based approach to defend against cyber attacks and protect government information from being compromised by our adversaries.

It is important that the Federal Government set the example by ensuring that its own information is protected. The Department of Energy was hacked in January, and personal data for hundreds of employees was compromised. We are better than that, Mr. Speaker, and we can do better.

Personal data for more than 100,000 accounts in the Thrift Savings Plan was compromised last year when a contractor's computer was hacked. This bill would shift the Federal Government to a system of continuous monitoring of information systems. And just this morning, the chairman said in a hearing that we have to do more with less and we have to figure out ways to use technology so that we can efficiently and effectively do the things that we need to do.

This bill goes right in that direction, which is so important. It would also streamline reporting requirements and ensure that agencies take a smart, risk-based approach to securing networks.

This bill would continue to authorize the Office of Management and Budget to set Federal policy for information security. This is important because we need to hold all the agencies accountable for developing appropriate standards and living up to those very standards. OMB is the appropriate entity to be responsible for ensuring that that happens.

However, nothing in this bill will prevent the Department of Homeland Security from continuing the great work it is doing to protect our Nation against potential cyber attacks. The Department has expanded its cybersecurity workforce and is working with agencies to establish continuous monitoring. This bill supports that work by making clear that agencies must take action to protect their networks, rather than just doing routine ``check the box'' reports, as Chairman Issa just talked about.

Today, we have a bipartisan effort. It is truly a bipartisan effort to address a problem that affects every single American and business, every entity of our Nation. That's why it's so good that we had all of our subcommittee rankings and chairmen working together and Mr. Issa making sure that this legislation got out. As it is so very important, I urge my colleagues to vote in favor of this legislation.

With that, I reserve the balance of my time.

It gives me great pleasure, Mr. Speaker, to yield 3 minutes to a gentleman who has worked very hard on this issue night and day, and it's been at the forefront of his efforts, the gentleman from Virginia (Mr. Connolly).

I yield the gentleman an additional 1\1/2\ minutes.

I yield myself such time as I may consume.

As we have no other speakers, Mr. Speaker, I just want to make it clear that I think yesterday's incident in Boston should remind us of how fragile our society is and that there are so many people who want to do us harm.

A lot of times we concentrate on those kinds of attacks and don't spend the kind of time we really need to on the cyber attacks, which can be just as harmful, just as damaging. These cyber attacks can literally bring our country and our economy to a halt. That's why we are urging all Members to vote in favor of this.

And it is my hope, Mr. Speaker, that as we are addressing this issue today, that it will send the word out to the Nation that once again our committee and this Congress is putting a microscope on this issue and doing everything in our power to make sure that our efforts are effective and efficient because the threats are there, and they are real.

It is up to us. It is our watch. It is our watch, just like a watchman watching over a fort or watching over a city. We are the watchmen right now, and it's our watch, and we have to make sure we do everything in our power to make sure that we protect against this very clear threat.

With that, I urge all Members to vote in favor of this legislation, and I yield back the balance of my time and.

Mr. Speaker, I thank the distinguished ranking member, my friend from Maryland, and I also thank the distinguished chairman of the Oversight and Government Reform Committee.

I proudly join them in cosponsoring this legislation and rising in strong support of H.R. 1136, the Federal Information Security Amendments Act of 2013. The chairman and ranking member of the full committee have worked in a bipartisan fashion to advance this bill to the floor today, and they deserve great credit.

H.R. 1163 is desperately needed to address a looming and critical threat to our Nation's economic and national security. As the Government Accountability Office testified before our committee in its 2013 High Risk Report, the number of cyber incidents has grown exponentially among Federal agencies and, for that matter, in the private sector.

Specifically, in the year 2006, they reported 5,503 cyber incidents to the U.S. Computer Emergency Readiness Team.

Six years later, that same number was 48,562, which is an astounding 782 percent increase in just 6 years.

According to the Government Accountability Office, cyber attacks involving Federal systems and critical infrastructure, Mr. Speaker, could be devastating to the country. Yet, its audits have consistently revealed information security deficiencies in public and private, financial and nonfinancial systems.

More troubling, despite producing hundreds of recommendations over the past 2 fiscal years that would address security-control deficiencies, the majority of GAO's recommendations have, in fact, not been fully implemented. Unfortunately, vital Federal assets and missions will remain at high risk for fraud, misuse, and disruption unless agencies fully implement the literally hundreds of recommendations made by the GAO and various offices of the inspectors general aimed at strengthening the security of critical information systems.

The sophisticated and rapidly involving cybersecurity threat has outpaced the security framework established by the former Federal Information Security Management Act of 2002. FISMA's static, compliance-based framework, as noted by both the ranking member and the distinguished chairman of the committee, must be enhanced. It can't be used as a substitute for developing strategies to counter this threat.

I believe this bipartisan legislation will accomplish that goal by enhancing FISMA to promote a more dynamic, risk-based approach that leverages current technology to implement continuous monitoring of networks and systems.

Specifically, the Federal Information Security Amendments Act will direct agencies to test and evaluate information security controls and techniques and conduct threat assessments by monitoring information systems and identifying potential system vulnerabilities.

It will conduct vulnerability assessments and penetration tests commensurate with the risk posed to agency information systems and collaborate with OMB and appropriate public- and private-sector security operations centers on security incidents that extend beyond the control of the agency to require that security incidents be reported through an automated and continuous monitoring capability to the Federal Information Security Incident Center, appropriate security operations centers, and respective agency Offices of Inspector General.

Mr. Speaker, I join the distinguished chairman and ranking member of the Oversight and Government Reform Committee in urging all Members to support this critical bipartisan cybersecurity legislation that is urgently needed to provide Federal agencies with the necessary tools to effectively secure our Federal information systems.

With that, I thank them both for their leadership on this critical matter.