Cyber Vulnerability Disclosure Reporting Act

Mr. Chair, I thank the ranking member and the chairman of the Rules Committee for listening to both my concerns and the amendments that we have offered. We are very pleased to have at least 10 amendments to deal with this important legislation.

Mr. Chair, I rise to thank the chair and the ranking member of the Armed Services Committee for the en bloc amendments.

I would like to draw particular attention to a few Jackson Lee amendments as the Congress prepares to adjourn for Memorial Day. I want to thank the men and women who serve in the United States military.

The Jackson Lee amendment offered in this year's NDAA will provide oversight with information or guidance on efforts at K-12 schools on Federal military facilities to maintain safety and security from active shooters. Just coming from my district and in the neighboring area, the Santa Fe tragedy, of which I attended vigils over the weekend and listening to children talk about being fearful of guns and going to school, has been a very difficult set of circumstances.

So the Jackson Lee amendment would, in fact, seek an assessment from the Secretary of Defense of the strategies that may be used to reduce the security threats posed by active shooter incidences at public schools and secondary schools.

Today, the DOD operates 60 schools in seven States, 26,000 military connected students, and that is a process where I think the Pentagon and the Defense Department can be very, very helpful.

Jackson Lee amendment No. 91 seeks to have a report 180 days following enactment from the Secretary of Defense, which will include the Coast Guard, on maternity mortality rates among members of the Armed Forces and the Department.

For every 100,000 births in the United States in 2013, the Centers for Disease Control estimated that 17.3 percent of mothers died, the highest mortality rate of all industrialized countries by several times over.

I believe we can be very effective in having solutions.

My amendment No. 68 considers the vital role in the National Guard and reservist field when called to service. I work with the National Guard. Mr. Chair, I thank the Texas Guard and the National Guard. I have seen them in Iraq and Afghanistan, and I believe it is an important assessment to continue to remind us of the work that they do, civilian soldiers, of course.

Jackson Lee amendment No. 89 provides a report 220 days after enactment on the DOD's capacity to provide survivors of natural disasters--we are still

experiencing the suffering of Hurricane Harvey, and I believe this is a major important time.

It is important as well to deal with cybersecurity, and so I have an amendment that seeks an assessment that would consider what occurred in 1992 following Hurricane Andrew when the DOD stood up emergency housing, and to look at those options.

The same thing with dealing with cybersecurity: I believe that it is important for the DOD to deal with the feasibility of creating an apprentice program to address the agency's shortages of qualified cybersecurity persons.

Let me just simply say that this legislation will be helpful in defining how we answer a lot of hard questions.

I do want to take note of the fact that I would like to see in the State Department and the DOD that we work on better relationships with Pakistan and try to discern how we can weave through some of the difficult issues that we are addressing and develop that alliance again.

My other amendments deal with raising awareness among students traveling abroad; expanding the report required by the bill to include information on the opportunities dealing with artificial intelligence, dealing with cybersecurity, sharing of Navy desalinization technology for civilian applications.

Something that I have been working on for a number of years: I just was in a meeting dealing with the impact of Boko Haram and as well its far-reaching impact throughout Africa, north Africa, and the death that it has been engaged in. My amendment will be providing for DOD assistance to the Nigerian Government in developing a missing persons database to report on missing, exploited, and trafficked persons. The DOD has provided the kind of assistance that has been allowed by our laws, but it is a horrific circumstance.

Then finally, I have an amendment addressing dangers associated with man-made space debris in low Earth orbit to manned and unmanned missions.

Mr. Chair, I ask my colleagues to support our amendments. I thank those who have managed this legislation.

I think the important point I want to make sure is the active shooter; the mortality rates dealing with mothers, maternal mortality rates and the loss of mothers and the loss of children in the instance of child birth. I would ask that my amendments be accepted.

Mr. Chair, I rise to thank the Chair and Ranking Member of the Rules Committee for the inclusion of Jackson Lee Amendments in the Rules for H.R. 5515, the National Defense Authorization Act for FY 2019.

I also thank the Chair and Ranking Member of the Armed Services Committee, and their staffs for working with me and my staff to include Jackson Lee Amendments in the Amendment En Blocs for H.R. 5515, the National Defense Authorization Act for FY 2019.

As a Member of the House Budget Committee, I am keenly aware of the budget pressures caused by Sequestration and repeated government shutdowns that have plagued defense and non-defense agencies.

It is past time for the Congress to engage in an authentic bipartisan budget process that puts the national interest over party interest so that we can complete the annual appropriations process by September 30, 2018, and prevent any further government shutdowns.

I have several amendments to H.R. 5515, the National Defense Authorization Act for FY 2019, which will be addressed in my submitted statement.

I would like to draw particular attention to a few Jackson Lee Amendments because of their importance to the people whom I serve in the 18th Congressional District of Texas, or they are of significance to the people who rely upon the resources provided by the National Defense Authorization Act to defend our nation.

As the Congress prepares to adjourn for Memorial Day weekend, I want to thank the men and women of the Armed Services, and the dedicated civilian professionals of the Department of Defense and its branches for their sacrifice and service to our nation.

I hope that in some small measure that the passage of this bill will convey to them the heartfelt respect and appreciation this body has for what they do each day to keep our nation and its people safe from harm.

The Jackson Lee Amendments offered to this year's NDAA will provide oversight with information or guidance on:

1. Efforts at K-12 schools on federal military facilities to maintain safety and security from active shooter situations;

2. Reporting on maternity mortality rates among service women, and female dependents of all service members, including the Coast Guard;

3. Raising awareness among students traveling abroad about recruitment tactics used by foreign intelligence agencies seeking to snare them into spying against the United States;

4. Readiness of the National Guard and Reserve for disaster response;

5. Defense Department's capacity to provide emergency short-term housing to disaster survivors;

6. Development of a cybersecurity apprentice program to provide on the job training for certain cybersecurity positions and to support the acquisition of cybersecurity certifications;

7. Expanding a report required by the bill to include information on the opportunities and risks associated with advancements Artificial Intelligence and its sub-discipline of machine learning;

8. Reports on cybersecurity threats posed by the achievement of stable quantum computing;

9. Sharing of Navy desalinization technology for civilian applications;

10. Condemning Boko Haram; and providing for DoD assistance to the Nigerian government in developing a missing persons database to report on missing, exploited and trafficked persons; and

11. Addressing dangers associated with man-made space debris in low earth orbit to manned and unmanned missions.

The Jackson Lee Amendments that I would like to emphasize include:

Jackson Lee Amendment No. 159, which seeks an assessment, from the Secretary of Defense, of the strategies that may be used to reduce the security threats posed by active shooter incidents at public elementary schools and secondary schools located on the grounds of Federal military installations.

Our nation's military provides for the needs of military families including the education of their children.

Since 1816, a Military Service, the Department of War or the Department of Defense has operated schools on military installations.

Today, the DoD operates 60 schools in 7 states: Alabama, Georgia, Kentucky, North Carolina, New York, South Carolina and Virginia.

There are 26,000 military connected students attending Domestic Dependent Elementary and Secondary Schools, which are operated by Department of Defense Education Activity, which is located in the Office of the Secretary of Defense.

Local Education Agencies operate about 150 public schools on military installations throughout the United States, educating about 80,000 students.

As you already know, on Friday, May 18, 2018, the community of Santa Fe, Texas became the most recent school to experience an active shooter gun violence, which took the lives of eight students and two teachers.

No parent should have to endure the loss of a child.

Over the last year we have seen deadly active shooter attacks carried out by a lone gunman at K-12 schools, where the shooter was often a student.

The safety and wellbeing of children of our active duty personnel are our responsibility.

This Jackson Lee amendment seeks information on what is being done and what can be done to increase school security against activity shooters situations in K-12 schools on military installations.

Jackson Lee Amendment No. 91, which seeks a report 180 days following enactment from the Secretary of DoD, which will include the Coast Guard, on maternity mortality rates among members of the Armed Forces and the dependents of such members.

For every 100,000 births in the US in 2013 the Centers for Disease Control estimated that 17.3 mothers died, the highest maternal mortality rate of all industrialized countries--by several times over.

Between 1990 and 2015 it is reported that maternal mortality rates around the world fell by 30 percent while at the same time in the US, the ratio went up nearly 60 percent.

A 2012, Pentagon report states that mothers delivering at military hospitals are more likely to hemorrhage after childbirth than mothers at civilian hospitals.

More than 50,000 babies are born at military hospitals each year, and they are twice as likely to be injured during delivery as newborns nationwide.

This Jackson Lee Amendment would provide a clearer understanding of the mortality rates of mothers: who were pregnant, undergoing delivery, or had delivered a child less than 1 year before their deaths.

Jackson Lee amendments No. 68 and No. 89 provide additional attention to DoD disaster response.

Jackson Lee Amendment No. 68, considers the vital role the National Guard and Reservist's fill when called to service in disaster response.

I thank the Texas Guard, National Guard, and Reservists as well as the active duty military personnel, including the Coast Guard who

came to the aid of victims of Hurricane Harvey.

You saved thousands of lives and Texans will be forever grateful that you answered the call to serve our nation as members of the armed forces.

Hurricane Harvey's impact in Texas is still being felt nine months later.

The storm's footprint covered over 9,000 square miles, including the city of Houston, Texas.

Hurricane Harvey dropped over 52 inches of rain in the Houston area an over 60 inches were recorded elsewhere in the state.

At its peak on September 1, 2017, one-third of Houston, our nation's fourth largest city, was underwater leaving 34,575 evacuees in shelters across Texas.

Before the flood waters had receded in Houston two other monster hurricanes were bearing down on citizens living in the U.S. Virgin Islands and Puerto Rico.

The scope and magnitude of these dueling disasters tested the National Guard and Reservists in ways that were new.

Jackson Lee Amendment No. 68 requires a readiness report on the National Guard and Reservists to make sure they have what they need to assist communities in need of disaster assistance during the 2018 Hurricane Season which begins June 1st.

Many Texans are still recovering from Hurricane Harvey, and the same is true of Puerto Rico residents who are attempting to recover from Hurricane Maria.

Jackson Lee Amendment No. 68 improves the bill's ability to support the important mission of the National Guard and Reservists to engage in disaster response.

Jackson Lee Amendment No. 89 provides a report 220 days after enactment on the DoD's capacity to provide survivors of natural disasters with emergency short term housing.

Hurricane Harvey is the largest housing disaster to strike the U.S. in our nation's history.

During Hurricane Harvey over 300,000 structures flooded in southeastern Texas, where extreme rainfall hit many areas that are densely-populated.

At its peak on September 1, 2017, one-third of Houston, our nation's fourth largest city, was underwater with 34,575 evacuees in shelters across Texas.

The storm and resulting flooding damaged 203,000 homes, of which 12,700 were destroyed.

Port Arthur residents were living in tents, after 80 percent of the city's housing was flooded by Hurricane Harvey rains, which led to acute housing needs.

The city of Beaumont lost its fresh water supply leading to the closure of hospitals and evacuation of patients to hospitals in other cities.

There were significant delays in the provision of enough hotels for all of those impacted by the storm.

However, within weeks hotel rooms were sufficient to address most housing needs for those displaced by the storm.

Unfortunately, the number of hotel rooms in Jefferson County Texas was insufficient for the demand for housing, which left residents living in tents until housing options could be found.

This Jackson Lee amendment seeks an assessment that would consider, what occurred in 1992 following Hurricane Andrew, when the DoD stood up emergency housing in the State of Florida for thousands of Floridians who lost their homes to that storm.

Earlier this year, the House passed H.R. 3202, the Cyber Vulnerabilities Disclosure Act, which I introduced to address the need for effective and aggressive action to deal with the threat of Zero Day Events.

A Zero Day Event describes the situation that network security professionals may find themselves when a previously unknown error or flow in computing code is exploited by a cybercriminal or terrorist.

The term ``Zero Day Event'' simply means that there is zero time to prepare a defense against a cyberattack.

H.R. 3202 requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

I have previously introduced legislation to address the cybersecurity workforce shortage in the Federal government.

On that bill, H.R. 1981, Cyber Security Education and Federal Workforce Enhancement Act, establishes the process for looking outside of DHS and within its ranks to solve the shortage of cybersecurity professionals.

Jackson Lee Amendment No. 97 seeks an assessment from the DoD on the feasibility of creating an apprentice program to address the agency's shortages of qualified cybersecurity professionals for certain cybersecurity positions.

There is a growing shortage of cybersecurity professionals with over a quarter-million positions remaining unfilled in the U.S. alone and a predicted shortfall of 1.5 million cybersecurity professionals by 2019.

There are additional Jackson Lee Amendments included in this bill that provide reports to the authorizing committees on a range of security and safety issues related to technology and innovation, with an eye toward the future.

The world is on the verge of significant breakthroughs in computing, space exploration, medical advancements, and innovations in medicine, engineering, and know how.

At the same time we are seeing extreme weather events that are causing significant shifts in rainfall patterns in this country and around the world that require that we invest in water management and desalinization technology to assure reliable access to abundant fresh water.

Artificial intelligence (AI), and quantum computing are rapidly changing areas of computing science that will have direct and significant implications for our economy, national defense, and our nation's security.

I have two Jackson Lee Amendments that have been adopted in En Bloc Amendments that will provide additional scope to an existing report on AI, and another report on the implications for the security of computing networks should quantum computing innovation establish more stable systems.

The current stage of computing innovation is akin to the Age of Flight at the time of the Wright Brothers.

We are in the infancy of the Computing Age, the best is yet to come, but we should be mindful of the rewards as well as the risks.

We will have aggressive programs to meet the challenge of achieving stable quantum computing because if we are not on the bleeding edge of this innovation curve, there could be dire consequences for the security of defense, civilian, private sector, and academic computing networks, challenges to our leadership in computing advancements, and we run the risk of negative economic impacts.

At best we are the first to achieve these advancements in computing, and at worse we are in second place.

I thank the Committees for including Jackson Lee Amendments Nos. 126 and 193 in the Amendment En Blocs for H.R. 5515.

Jackson Lee Amendment No. 90 directs that the Secretary of DoD will provide a report 240 days from enactment of this bill on the risks posed by man-made space debris in low-earth orbit, including recommendations on remediation of such risks, and outlines of plans to reduce the incident of space debris.

Space debris encompasses both natural and artificial particles.

This Jackson Lee Amendment would address the risk of man-made space debris.

Man-made objects in Earth's orbit that may no longer serve a useful function can include nonfunctional spacecraft, abandoned launch vehicle stages, mission-related debris and fragmentation debris.

Space debris travels at speeds up to 17,500 miles per hour is fast enough a small piece of man-made debris to damage to a satellite or a spacecraft.

There are more than 20,000 pieces of debris larger than a softball or orbiting the Earth.

There are 500,000 pieces of debris the size of a marble or larger.

There are many millions of pieces of debris that are so small they can't be tracked.

NASA tracks more than 500,000 pieces of man-made space debris in Earth's orbit.

Jackson Lee Amendment seeks a report from the Secretary of Defense on the risks posed by man-made space debris, solutions for reducing risks and strategies for reducing the incidence of more man-made space debris being introduced into space.

Jackson Lee Amendment No. 61 on the Rule for H.R. 5515, directs the following Secretary of Navy to submit reports to Congress on the feasibility of applying desalinization technologies to provide drought relief in areas impacted by sharp declines in water availability for both military as well as civilian purposes. (listed as No. 482 on the Rules Committee Roster)

In 2010, the United States consumed about 355,000 million gallons of water per day.

Worldwide, some 700 million people do not have access to enough clean water.

In 10 years the number is expected to more than double to 1.8 billion.

Two-thirds of the Earth's surface is water, but in fact less than 1 percent it is available for human use.

The rest of the water on our planet is either salt water found in oceans, fresh water frozen in the polar ice caps, or too inaccessible for practical usage.

While population and demand on freshwater resources are increasing, supply will always remain constant.

And although the water cycle continuously returns water to Earth, it is not always returned to the same place, or in the same quantity and quality.

This is why I offered this Jackson Lee Amendment No. 61.

It is time to plan for the future water needs of our country.

There are serious water shortages in some regions of the country and the prospects that sustained water shortages due to regional growth and climate factors may make it necessary to develop alternative sources for water intended for human and agricultural uses.

If we can harness the technology to convert ocean water into fresh water the future of cities and rural communities that depend on water can be much brighter.

Jackson Lee Amendment No. 88 on the Rule for H.R. 5515, Requires the Secretary of Defense to report to Congress programs and procedures employed to ensure students studying abroad through Department of Defense National Security Education Programs are trained to recognize, resist, and report against recruitment efforts by agents of foreign governments.

The number of U.S. students studying abroad for credit during the 2015-2016 academic year totaled 325,339 students.

This represents just over 1.6 percent of all U.S. students enrolled at institutions of higher education in the United States and about 10 percent of U.S. graduates.

Study abroad provides opportunities to students and helps nation's economies.

A recent survey found that almost 40 percent of companies surveyed missed international business opportunities because of a lack of internationally-co competent personnel.

However, the opportunities to study in another country come with some risks.

In 2014, the FBI released a 28-minute spy film called ``Game of Pawns, '' which was based in part on the real life story of Glenn Shriver, who in 2004 was a 22-year-old studying in Shanghai.

The Michigan native found a seemingly innocent job online--writing papers on U.S.-China relations.

Over time, the job description changed.

Glenn Shriver accepted $70,000 from Chinese operatives and agreed to apply for U.S. government jobs in order to gain access to classified information. By then, the FBI was on to him.

He was arrested in 2010 and pleaded guilty to one count of attempting to spy.

He was sentenced to serve a four-year prison sentence.

At the time FBI did not say how many students had been turned into spies but said they are increasingly being targeted.

Destinations for U.S. students studying abroad include: Africa; Asia; Europe; Latin America; Middle East; and Oceania.

When 95 percent of consumers live outside of the United States, we cannot afford to ignore this essential aspect of higher education.

Jackson Lee Amendment No. 88 will provide the tools and education needed to U.S. students studying abroad to help them protect themselves from attempts the recruitment tactics of foreign agents.

Thank you to the Committee for the inclusion of these Jackson Lee Amendments in the final bill.

Mr. Speaker, I yield myself such time as I may consume, and I thank the manager for his kind words.

Mr. Speaker, I rise in support of H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act. I very much want

to thank the committee for bringing the Jackson Lee bill to the floor and the work that we did on it in committee.

I wish to speak specifically to the work that is done on the Homeland Security Committee as I discuss this legislation. I think it is very important to take note of the fact that the ranking member works very hard to generate very positive legislation and that we have been able to see a large number of bills, some that I have been able to sponsor, come to the floor of the House.

Mr. Speaker, therefore, I thank the chairman, Mr. McCaul, and the ranking member for making the Homeland Security Committee so productive in generating important legislation to ensure the security of this Nation. I thank them for their leadership in putting the security of our Nation's cyber assets first, whether they are computing resources used in voting technology, or industrial control systems that support the delivery of electricity, oil and gas, or management of transportation systems that are vital to our Nation's economic health.

Mr. Speaker, I was chairman of the Transportation Security and Infrastructure Protection Subcommittee some few sessions ago. This was when infrastructure was included in the transportation and security domain. I can tell you that, even then, we began to acknowledge the crucialness of protecting the cyber system and how far-reaching cyber systems can go, as far away as water systems, to bridges, to dams, and in between, and to note that a lot of our cyber system, 80 percent of it was in the private sector, probably more at this point.

H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act, which I introduced, requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cybersecurity vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

The report may also contain a description of how the Secretary of Homeland Security is working with other Federal entities and critical infrastructure owners and operators to prevent, detect, and mitigate cyber vulnerabilities.

It is important to restate that our cyber system is largely in the private sector. It does not alleviate or eliminate the role that the Federal Government should play. This legislation squarely places with the Federal Government the responsibilities of dealing with those critical infrastructure owners and operators to prevent, detect, and mitigate cyber vulnerabilities.

The reason that I have worked to bring this bill before the full House for consideration is a problem often referred to as a zero-day event. A zero-day event describes a situation that network security professionals may find themselves in when a previously unknown error or flaw in computing code is exploited by a cybercriminal or terrorist.

The term ``zero-day event'' simply means that there is zero time to prepare a defense against a cyber attack. That is not the place that we would like to find ourselves.

When a defect in software is discovered, their network engineers and software companies can work to develop a patch to fix the problem before it can be exploited by those who may seek to do us harm.

We have evidence that the cyber world is a good world, but it can be a dangerous world and impact the life and quality and democracy and freedom of Americans. We want to be prepared and never have to face, in this most powerful country in the world, something called a zero-day event.

H.R. 3202 seeks a report on the ongoing Department of Homeland Security's policies and procedures for coordinating cyber vulnerability disclosures, such as zero-day events, with private sector partners. Because vulnerabilities can be used by adversaries, it is important that this sensitive information be managed securely so details are not routinely made available, neither to the public nor to Congress.

H.R. 3202 provides the Congress with the opportunity to understand the process and procedures used by the Department of Homeland Security and the benefit these disclosures may have for private sector entities participating in programs in support of cybersecurity.

Mr. Speaker, I thank Lillie Coney of my district and Jean de Pruneda, a fellow on the Committee on Homeland Security, for their work on this important legislation.

I urge Members of the House to vote in favor of H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act.

Mr. Speaker, I want to emphasize again a point that I made earlier. Because vulnerabilities can be used by adversaries, it is important that this sensitive information be managed securely so details are not routinely made available, neither to the public nor to Congress.

It is important to take note of the fact that the work we have to do is ongoing and continuing.

H.R. 3202 will give this body important information on our governmentwide efforts to secure civilian agency networks and the collaborative ongoing work to provide information to private sector partners on computing vulnerabilities. There is no security in keeping zero-day events secure from disclosure and not working on solutions.

Cybersecurity is found in finding the zero-day events, creating solutions to defend against them, and sharing the solutions broadly so that they can be deployed. Once solutions are in place, the zero-day event should be disclosed to the public so that scholars and researchers can learn from the experience.

In essence, what we are saying is that we want to make sure that we are in the driver's seat, that we know the vulnerabilities, that we can confront the zero-day events, and that we can do that, meaning the Federal Government, in working with the private sector to ensure that we do protect this Nation.

Before I close, since we are dealing with Homeland Security Committee issues, I think it is important to take note of the fact of the crucialness and the importance of having a DACA fix and working together, as we have been doing, to ensure that the thousands and thousands of young people located across the Nation, who came here through no fault of their own, have a serious pathway of protection, in particular, the 140,000 that are in the State of Texas.

If we can stand here as bipartisan Members, I know that we can continue to work on that crucial and important issue, which I stand with those young people to ensure to get that done.

Mr. Speaker, I include in the Record an article by Morgan Chalfant, ``Lawmakers approve `cyber vulnerability' bill,'' written in The Hill.

[From the Hill, July 26, 2017]

Lawmakers Approve `Cyber Vulnerability' Bill

(By Morgan Chalfant)

A House panel advanced legislation on Wednesday requiring

the Department of Homeland Security (DHS) to give lawmakers

more information on how it discloses cyber vulnerabilities to

the private sector.

The legislation was sponsored by Rep. Sheila Jackson Lee

(D-Texas) and received broad support from members of the

House Homeland Security Committee, including Chairman Michael

McCaul (R-Texas).

The bill would require Homeland Security Secretary John

Kelly to send a report to relevant congressional committees

describing policies and procedures used by the DHS to

coordinate the disclosure of what are called ``zero days''--

cyber vulnerabilities that are unknown to a product's

manufacturer and for which no patch exists.

The federal government decides whether to disclose zero

days to the private sector through the vulnerabilities

equities process (VEP), which was first acknowledged by the

Obama administration in 2014 but is still shrouded in

secrecy. While the government is said to err on the side of

disclosure, the VEP has proven controversial because so

little is known about it.

The process has attracted increased scrutiny in the wake of

the outbreak of the ``Wanna Cry'' ransomware, which is

believed to be based on a hacking tool developed by the

National Security Agency.

Lawmakers in both chambers have sought to boost

transparency of the VEP.

On Wednesday, Jackson Lee touted the legislation as

providing an opportunity for Congress to better understand

the process by which the DHS shares threat information

with private companies and how that information benefits the

private sector.

``Because vulnerabilities can be used by adversaries, it is

important that the sensitive information is managed securely

and the details are guarded against premature disclosure,''

Jackson Lee said during a committee markup.

``There's no security in keeping zero day events secure and

not working on solutions,'' she said. ``The protection is in

finding the zero day events, creating solutions, sharing the

solutions broadly, then disclosing the vulnerabilities to the

public.''

The report mandated by the legislation would include an

annex of information on specific instances when the DHS

disclosed vulnerabilities to private sector companies in the

previous year and information on how industry acted on the

information. It could also contain information about how the

DHS is working with other federal agencies and departments,

as well as owners of critical infrastructure, to mitigate the

threat of these vulnerabilities.

Kelly would be required to submit the report, which would

be unclassified but could have a classified annex, within 240

days of the enactment of the legislation.

The committee approved the legislation in a voice vote with

no amendments, sending it to the full House for a vote.

Mr. Speaker, I encourage my colleagues to support H.R. 3202, and I thank my manager as well.

Mr. Speaker, I rise to speak in support of H.R. 3202, the Cyber Vulnerabilities Disclosure Reporting Act.

I thank Chairman McCaul and Ranking Member Thompson for their leadership on putting the security of our nation's cyber assets first whether they are computing resources used in voting technology or industrial control systems that support the delivery of electricity, oil and gas, or management of transportation systems all are vital to our nation.

H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act, which I introduced, requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cyber security vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems that or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

The report may also contain a description of how the Secretary of Homeland Security is working with other Federal entities and critical infrastructure owners and operators to prevent, detect, and mitigate cyber vulnerabilities.

The reason that I worked to bring this bill before the Full House for consideration is the problem often referred to as a ``Zero Day Event.''

Zero Day Events are vulnerabilities in software or firmware that have gone undetected or undisclosed, but if exploited by terrorists could cause great harm to computer networks, data, or complex computing dependent systems.

Our nation's electric power grid; industrial control systems that operate bridges, dams, water treatment facilities or food processing plants are all vulnerable to the potential harm that could be caused if a weakness in software or firmware goes undetected.

Critical infrastructure must be secured against terrorist attacks that may use Zero Day Event vulnerabilities to attack critical infrastructure or civilian government agency computing assets.

Zero Day Events discovered in commercial software applications such as the ``Heartbleed'' and OpenSSL cryptographic software library vulnerability.

Proactive and coordinated efforts are necessary to strengthen and maintain secure critical infrastructure including assets that are vital to public confidence in the cyber nation's safety.

This bill supports the ongoing work of the Department of Homeland Security in security civilian agency and coordinating with private sector computing network owners and operators.

The nation's critical infrastructure is diverse, complex, and interdependent.

The overwhelming majority of critical infrastructure is privately owned or managed.

Critical Infrastructure owners and operators are uniquely positioned to manage risk to their operations and assets.

What is needed is a better understanding of how vulnerability discoveries lead to better protection for computing networks.

Zero Day Events require a coordinated approach to assignment of responsibility for developing patches or solutions, and a means of effectively distributing the solution without alerting potential terrorist or cyber criminals.

H.R. 3202 provides the Congress with the opportunity to understand the process and procedures used by the Department of Homeland Security and the benefit these disclosures may have for private sector entities participating in programs in support of cybersecurity.

I thank Lillie Coney of my staff and Jean de Pruneda a Fellow on the Committee on Homeland Security for their work on this important legislation.

I ask my colleagues to vote for H.R. 3202.

Mr. Speaker, I rise in support of 3202, The ``Cyber Disclosure Reporting Act.''

I thank Chairman McCaul and Ranking Member Thompson for their leadership on putting the security of our nation's cyber assets first whether they are computing resources used in voting technology or industrial control systems that support the delivery of electricity, oil and gas, or management of transportation systems that are vital to our nation economic health.

H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act, which I introduced, requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cyber security vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems that or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

The report may also contain a description of how the Secretary of Homeland Security is working with other Federal entities and critical infrastructure owners and operators to prevent, detect, and mitigate cyber vulnerabilities.

The reason that I worked to bring this bill before the Full House for consideration is the problem often referred to as a ``Zero Day Event.''

A Zero Day Event describes the situation that network security professionals may find themselves when a previously unknown error or flaw in computing code is exploited by a cybercriminal or terrorist.

The term ``Zero Day Event'' simply means that there is zero time to prepare a defense against a cyberattack.

When a defect in software is discovered then network engineers and software companies can work to develop a ``patch'' to fix the problem before it can be exploited by those who may seek to do harm.

H.R. 3202 seeks a report on the ongoing Department of Homeland Security's policies and procedures for coordinating cyber vulnerability disclosures such as Zero Day Events with private sector partners.

Because vulnerabilities can be used by adversaries it is important that this sensitive information be managed securely so details are not routinely made available neither to the public nor to Congress.

H.R. 3202 provides the Congress with the opportunity to understand the process and procedures used by the Department of Homeland Security and the benefit these disclosures may have for private sector entities participating in programs in support of cybersecurity.

I thank Lillie Coney of my staff and Jean de Pruneda a Fellow on the Committee on Homeland Security for their work on this important legislation.

I urge members of the House to vote in favor of H.R. 3202, the Cyber Vulnerabilities Disclosure Act.

Mr. Speaker, H.R. 3202 will give this body important information on our government wide efforts to secure civilian agency networks and the collaborative ongoing work to provide information to private sector partners on computing vulnerabilities.

There's no security in keeping zero day events secure from disclosure and not working on solutions.

Cyber security is found in finding the zero day events, creating solutions to defend against them, and sharing the solutions broadly so that they can be deployed.

Once solutions are in place the Zero Day Event should be disclosed to the public so that scholars and researchers can learn from the experience.

With that, I encourage my colleagues to support H.R. 3202.

Mr. Speaker, I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 5074) to authorize cyber incident response teams at the Department of Homeland Security, and for other purposes, as amended.

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days within which to revise and extend their remarks and include any extraneous material on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in strong support of the DHS Cyber Incident Response Teams Act.

Before I discuss the bill, however, I would like to say a few words about the recent bombings in my hometown of Austin. In the past month, there have been a total of four bombings that have killed two people and injured four others. These are heinous, hateful acts on innocent Americans, and they will not be tolerated.

I know the people of Austin very well, and they will not be intimidated. I urge everyone back home to take caution and heed the warnings of local law enforcement. We will find whoever is responsible for these bombings and bring them to justice.

Mr. Speaker, I would like to now address the bill I have introduced and the threats confronting our cybersecurity.

As technology advances, more and more people are relying on their computers, iPads, and smartphones for both personal and professional use. In short, Mr. Speaker, everyone is a target.

But our enemies do not just attack individuals and their devices. They also put America's critical infrastructure sectors in their crosshairs, endangering all aspects of civilian life. These sectors include our financial services, healthcare systems, dams, and our energy production, among others. All of them play a vital role in making America work, and each one is vulnerable to an attack.

Last week, the FBI and DHS reported that Russian hackers had engineered a series of cyber attacks against American and European nuclear power plants and electric systems. Crippling or shutting down our power plants would have catastrophic effects.

We also know that Russia tried to undermine the credibility of our democratic system in the 2016 elections and are likely to try again in 2018. Strengthening our cyber election security needs to be a bipartisan priority.

Russia is not the only perpetrator of these kinds of attacks. Between 2011 and 2013, Iranian hackers attacked dozens of U.S. banks and even tried to shut down a dam in New York.

In 2015, we learned that Chinese hackers gained access to the private information of 80 million members and employees of Anthem healthcare. The Chinese also stole 22 million security clearances, including my own, from OPM. This attack allowed them to obtain highly sensitive personal data, including fingerprints and Social Security numbers. These continual onslaughts are part of a greater cyber war being carried out against the United States, even as I stand here and speak.

Unfortunately, it doesn't stop there. Our adversaries have weaponized technology and are using it to engage in espionage and to steal our intellectual property. This costs our economy hundreds of billions of dollars each year. In fact, former NSA Director, General Keith Alexander, described this theft as the ``greatest transfer of wealth in history.''

We must do more to stop these attacks. That is why I have prioritized the cybersecurity mission of DHS as chairman of the Homeland Security Committee. Through CISA, the previous bill which passed the House in December, we are elevating and making operational the Department's cybersecurity and infrastructure protection missions.

As part of the landmark DHS reauthorization, which passed the House in July, the Department will be required to provide volunteer assistance to State and local election officials upon request. These were important bipartisan steps, but we need to do more.

The legislation before us today codifies and enhances the cyber incident response times at DHS. These teams shall provide, upon request, assistance to asset owners and operators following cyber incidents, including with election infrastructure.

These teams may also include cybersecurity specialists from the private sector to provide outside expertise, which is a new, innovative breakthrough. By fostering this new collaboration between government and private sector, we can harness our talent and maximize our efforts to stay one step ahead of our enemies.

This innovative approach serves as a force multiplier to enhance our cybersecurity workforce. Being able to utilize a great number of experts will strengthen our efforts to protect our cyber networks. My bill provides DHS with that necessary capability.

The American people deserve to know that we are making every effort to strengthen our cybersecurity. This bill helps us achieve that goal, and I urge my colleagues to support it.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, this is a hugely important issue. I think cyber often gets overlooked when we look at kinetic threats of nuclear missiles coming out of North Korea, which is obviously a huge threat to the United States and its allies. But in cyberspace, we are at war, as well, with countries like Russia and China and Iran and North Korea, the Russian meddling in the elections. We can't sit idly by and let that happen again in 2018.

I think this is, as Mr. Thompson stated, a very bipartisan issue that we need to work together on against our foreign adversaries that every day are trying to undermine us, stealing intellectual property, espionage, or bringing down things in a cyber warfare attack. It is not the future of warfare; it is warfare here and now.

Mr. Speaker, I urge my colleagues to support this bill, and I yield back the balance of my time.

Mr. Speaker, I rise today in support of H.R. 6443, the ``Advancing Cybersecurity Diagnostics and Mitigation Act'' which codifies the Continuous Diagnostics and Mitigation (CDM) Program administered by the Department of Homeland Security.

At a time when the computer networks of our government are under constant attack, and have suffered serious breaches in recent years, we must take action to ensure that the information of our citizens and the ability of federal agencies to carry out their duties are resilient.

As a long-time advocate of a government that works efficiently for the people, it is clear that current information security practices of federal agencies are neither sufficient nor consistent.

Without an honest effort to even get to obtain a view of the security state of federal networks, users, and devices, we will continue to be increasingly vulnerable.

To that end, H.R. 6443 recognizes the importance of a dynamic approach that will help secure federal networks and data, as well as provide improved information on vulnerabilities and security practices across the various agencies.

In particular, this measure codifies the Continuous Diagnostics and Mitigation (CDM) Program to which:

1. Deploys DHS sensors which perform ongoing scans for vulnerabilities and known flaws; and

2. Feed the collected data to an enterprise dashboard to provide increased insight into the information security posture of federal agencies.

Without codifying this concrete measure to fortify federal networks and devices, federal agencies will remain vulnerable.

While codifying the DHS CDM Program will harden the security posture of the federal government, we are still suffering from a shortage of workers with the requisite skills in this area.

To address this, I have introduced the Cyber Security Education and Federal Workforce Enhancement Act (H.R. 1981), which would address our cyber workforce shortage by establishing an Office of Cybersecurity Education and Awareness within DHS which will focus on:

1. Recruiting information assurance, cybersecurity, and computer security professionals;

2. Providing grants, training programs, and other support for kindergarten through grade 12, secondary, and post-secondary computer security education programs;

3. Supporting guest lecturer programs in which professional computer security experts lecture computer science students at institutions of higher education;

4. Identifying youth training programs for students to work in part- time or summer positions at federal agencies; and

5. Developing programs to support underrepresented minorities in computer security fields with programs at minority-serving institutions, including Historically Black Colleges and Universities, Hispanic-serving institutions, Native American colleges, Asian-American institutions, and rural colleges and universities.

Mr. Speaker, government agencies and the private sector alike continue to struggle to identify the motivations and methods behind a cyber-attack and, in many cases, lack timely information on tactics and techniques hackers are using.

Despite this, the White House has eliminated the position of Cybersecurity Coordinator from the National Security Council.

This occurred even after Federal Risk Determination Reports found that communication of threat information within agencies is also inconsistent, with only 59 percent of agencies reporting a capability to share threat information to all employees within an enterprise so they have the knowledge necessary to block attacks.

Federal agencies are not taking advantage of all available information such as threat intelligence, incident data, and network traffic flow to improve situational awareness regarding systems at risk and to prioritize investments.

For this reason, earlier this Congress, I introduced H.R. 3202, the ``Cyber Vulnerability Disclosure Reporting Act'', which was passed by the full House and is now in the Senate.

H.R. 3202 requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cyber security vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

I would also like to recognize the University of Houston, which has been recognized by the Department of Homeland Security and the National Security Agency as a Center of Academic Excellence for the programs in cybersecurity and cyber defense.

In closing, Mr. Speaker, I urge all members to join me in voting to pass H.R. 6433, the ``Advancing Cybersecurity Diagnostics and Mitigation Act''.

Mr. Speaker, I rise in strong support of H.R. 5074, the DHS Cyber Incident Response Teams Act of 2018.

The ``DHS Cyber Incident Response Teams Act of 2018,'' codifies DHS' National Cybersecurity and Communications Coordination Center (NCCIC) hunt and incident response teams which the Department currently deploys to provide intrusion analysis, identify malicious actors, analyze malicious tools, and provide mitigation assistance to entities requesting assistance after a cybersecurity incident.

The DHS' Hunt and Incident Response Teams play an integral role in improving the cybersecurity posture of critical infrastructure owners and operators, from energy and nuclear power firms to state and local governments administering elections.

The bill requires the NCCIC to submit information to Congress regarding metrics for the teams, at the conclusion of the first four years after enactment.

In 2016, Russian actors targeted U.S. election infrastructure, hackers escalated efforts to

breach the domestic energy sector, and WannaCry and NotPetya ransomware wreaked havoc on public and private infrastructure around the world.

According to Symantec, a leading provider of cybersecurity solutions, said that ``The world of cyber espionage experienced a notable shift towards more overt activity, designed to destabilize and disrupt targeted organizations and countries.''

These threats to cyber security are not new.

In June 2015, it was reported that the Office of Personnel Management lost personal information on 21.5 million current and former federal employees and their families.

In 2017, the following were reported attacks and breaches:

WannaCry ransomware that infected millions of networks worldwide; and the

Equifax hack exposed millions of American's credit information to cyber-thieves;

Our nation's critical infrastructure and civilian government agencies depend on the cybersecurity talent and resources that the Department of Homeland Security can provide on the frontline to defend against attacks.

As cyber threats continue to evolve and become more sophisticated, so must U.S. efforts to confront them.

The Department of Homeland Security plays a central role in the federal government's cybersecurity apparatus and in coordinating federal efforts to secure critical infrastructure.

DHS is charged with coordinating agency efforts to secure the (dot).gov Domain, while also serving as the hub for cybersecurity information sharing between and among the private sector and federal government.

Earlier this Congress, I introduced H.R. 3202, the Cyber Vulnerability Disclosure Reporting Act, which was passed by the full House and is now in the Senate.

H.R. 3202 requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cyber security vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems that or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

The reason that I worked to bring this bill before the committee is the problem often referred to as a ``Zero Day Event,'' which describes the situation that network security professionals may find themselves when a previously unknown error in computing code is exploited by a cybercriminal or terrorist.

As with other threats that this nation has faced and overcome, we must create the resources and the institutional responses to protect our nation against cyber threats while preserving our liberties and freedoms.

We cannot accomplish this task without the full cooperation and support of the private sector, computing research community and academia.

This level of engagement requires the trust and confidence of the American people that this new cyber threat center will be used for the purpose it was created and that the collaboration of others in this effort to better protect computing networks will be used only for protection and defense.

There are people with skills and those with the potential to develop skills that would be of benefit to our nation's efforts to develop an effective cybersecurity defense and deterrence posture.

It is my hope that as we move forward the Committee on Homeland Security will continue in a bipartisan manner to seek out the best ways to bring the brightest and most qualified people into the government as cybersecurity professionals.

With this policy objective in mind, I look forward to working with the Committee on H.R. 1981, the Cyber Security Education and Federal Workforce Enhancement Act.

I urge my Colleagues in the House to join me in voting for H.R. 5074.