Public-Private Cybersecurity Cooperation Act

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 7327) to require the Secretary of Homeland Security to establish a security vulnerability disclosure policy, to establish a bug bounty program for the Department of Homeland Security, to amend title 41, United States Code, to provide for Federal acquisition supply chain security, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 days in which to revise and extend their remarks and include extraneous material on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in support of the SECURE Technology Act. This is a bill that I introduced with the majority leader, Kevin McCarthy, and Representatives Ratcliffe, Lieu, Vela, and Langevin.

This bill includes two bipartisan proposals to strengthen Homeland Security. First, it requires a vulnerability disclosure policy and establishes a bug bounty program at the Department of Homeland Security. Second, it establishes requirements for supply chain security in products purchased by the Federal Government.

Title I of the bill incorporates H.R. 6735, which is the Public- Private Cybersecurity Cooperation Act, which was introduced by Leader McCarthy and passed by a voice vote by this House in September. It is cosponsored by myself and Representatives Ratcliffe, Langevin, and Khanna.

Senator Portman introduced the Senate companion to this bill, S. 3707, with Senator Hassan.

This title seeks to protect the information systems of the Department of Homeland Security by establishing a program to report security vulnerabilities discovered on these systems. This program allows DHS to learn about security risks from private-sector experts and requires DHS to fix these at-risk systems.

DHS operates many of the systems and services other agencies use to protect their networks, so DHS should set the example for securing its own information systems.

Title I also includes S. 1281, the Hack the Department of Homeland Security Act of 2018, which was introduced by Senator Hassan with Senators Portman, McCaskill, Harris, and Gardner.

Representative Lieu introduced the House companion to this bill, H.R. 2774, with Representative Taylor. It is cosponsored by Representatives Meehan, Khanna, Jayapal, Kilmer, Kelly, and Evans. The bill authorizes DHS to create a bug bounty pilot program to compensate people who report security vulnerabilities to DHS.

Bug bounties are widely seen as an effective and inexpensive way to identify vulnerabilities in IT systems.

Title II of this bill incorporates S. 3085, the Federal Acquisition Supply Chain Security Act of 2018, which was introduced by Senator McCaskill and cosponsored by Senators Lankford and Johnson.

This bill passed the Senate by unanimous consent last night. This title helps ensure the integrity of information technology and communications equipment purchased by the Federal Government by addressing supply chain risks that are government-wide.

The bill sets up an interagency council to identify products that pose unacceptable risk to these systems and to set policy on information sharing and risk mitigation in Federal IT systems.

The bill recognizes the need to move away from an ad hoc approach to dealing with unacceptable products offered to the Federal Government by companies such as Kaspersky, ZTE, and Huawei. It also authorizes exclusion and removal orders for products found to pose an unacceptable risk to these Federal IT systems.

This legislation provides for due process, including judicial review, and certainty about how lawsuits will be handled in the future.

Mr. Speaker, I want to thank the numerous Members in the House and Senate who worked tirelessly on these two pieces of legislation, especially Leader McCarthy, members of the House Committee on Oversight and Government Reform and Committee on Homeland Security, and members of the Senate Homeland Security and Governmental Affairs Committee.

Mr. Speaker, I want to urge my colleagues to support the SECURE Technology Act, and I reserve the balance of my time.

Mr. Speaker, I make my friend, the gentlewoman from the District of Columbia, whom I always take every opportunity to work with, aware that I have no further speakers, and I am prepared to close.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, this is another example of how we can actually get things done up here in Washington, D.C., if we work together. This is a piece of legislation that is going to help secure our networks, make sure we are protecting the American people, and I urge the adoption of this bill.

Mr. Speaker, I yield back the balance of my time.

Mr. Speaker, I yield myself as much time as I may consume.

Mr. Speaker, I rise in support of H.R. 6735, the Public-Private Cybersecurity Cooperation Act.

Mr. Speaker, protecting our Federal information systems is an enormous task.

As ranking member of the Cybersecurity and Infrastructure Protection Subcommittee, I hear more often than I would like about the challenges of recruiting and maintaining the Federal cyber workforce. That is true even at the Department of Homeland Security.

As DHS works to address ongoing workforce challenges, we have to think creatively and leverage untapped resources of talent.

Across the country, there are white hat hackers who want to apply their considerable cyber skills to report vulnerabilities found on government information systems to Federal authorities. But today, these ethical hackers cannot research and report bugs on DHS' systems without being in violation of the Computer Fraud and Abuse Act.

In 2016, the Department of Defense piloted Hack the Pentagon, which gave white hat hackers 24 days to find unique vulnerabilities in certain DOD information systems and report them for a reward.

The program was so successful, DOD established a permanent vulnerability disclosure program to allow ethical hackers to search for and report bugs on DOD information systems without violating the law.

That program has enjoyed similar success to Hack the Pentagon.

Members of the Homeland Security Committee have been urging DHS to establish a vulnerability disclosure program for several years.

At a hearing with Secretary Nielsen in April, my colleague on the Cybersecurity Subcommittee, Mr. Langevin, asked the Secretary whether the Department had in place a mechanism for vulnerabilities to be reported. Secretary Nielsen testified that the Department had no clear process in place to accept information about bugs in DHS information systems and agreed to work with the committee to establish one.

Five months have passed, and the Department is not any closer to establishing a vulnerability disclosure program of its own.

Vulnerability disclosure programs are an emerging industry best practice and are recommended by the updated NIST Cybersecurity Framework.

White hat hackers are an enormous pool of talent that the Federal Government has largely failed to leverage. DHS can no longer afford to leave that kind of talent on the table.

H.R. 6735 would push DHS in the right direction by requiring it to put in place policies to ensure that civic-minded hackers can research and report bugs found on certain information systems without breaking the law.

Before I close, I would like to express my disappointment that S. 1281, the Hack DHS Act, is not being considered on the floor today.

S. 1281, which would create a bug bounty pilot program at DHS, was approved by voice vote in the committee and is consistent with the objectives of H.R. 6735, which I support.

It is unclear why S. 1281 is not being considered today. I urge House leadership to bring S. 1281 to the floor later this fall.

Mr. Speaker, I urge my colleagues to support H.R. 6735. In the current security environment, vulnerability disclosure policies have emerged as a critical component of cybersecurity without any organization. DHS is the lead Federal Department charged with securing government civilian networks.

DHS should be leading by example, not playing catchup. Today, the Department of Defense and the GSA have vulnerability disclosure programs in operation. It is time for DHS to join them.

Mr. Speaker, I urge my colleagues to support H.R. 6735, and I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 6735) to direct the Secretary of Homeland Security to establish a vulnerability disclosure policy for Department of Homeland Security internet websites, and for other purposes, as amended.

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days within which to revise and extend their remarks and include any extraneous materials on the bill under consideration.

Mr. Speaker, I yield myself as much time as I may consume.

Mr. Speaker, I rise today in support of the Public-Private Cybersecurity Cooperation Act.

Strengthening our cybersecurity must be a top national priority. International hackers and nation-states are waging a war against us in cyberspace.

These threats are aimed at our economic, political, and national security institutions.

Between 2011 and 2013, Iranian hackers attacked dozens of American banks and even tried to shut down a dam in New York.

In 2014, Chinese hackers stole over 22.5 million security clearances, including my own, from the Office of Personnel Management.

In 2016, Russia meddled in our presidential election.

Because we use computer networks in our personal and professional lives, almost everyone is a target.

With each passing day, cyber threats continue to grow, but the government cannot face these threats alone. We need help from the private sector.

Today's legislation will direct the Department of Homeland Security Secretary to develop and implement a vulnerability disclosure program that will allow threat researchers from the private sectors to identify and report cybersecurity flaws found in the Department's information systems.

Currently, there is no legal avenue that allows them to do so. This legislation solves that problem.

Mr. Speaker, I would like to thank Leader McCarthy for his years of commitment to innovation and cybersecurity, and for his work on this bill in particular.

He truly understands the nature of this threat and why it is so important to have a strong cyber partnership between the public and private sectors.

Mr. Speaker, I believe that this bipartisan legislation will help DHS better protect its vital networks, and I urge my colleagues to support it.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield myself the balance of my time.

Mr. Speaker, I once again urge my colleagues to support this bill. It is at a time when there is a lot of partisanship going on. I think it is healthy to see a truly bipartisan bill on such an important issue regarding our national security.

I think, as the gentleman from Louisiana pointed out, this is modeled after a program that the Department of Defense successfully deployed, and I am proud of the record my committee has had on passing, I think, close to 110 bills now, and almost all of them are bipartisan.

Mr. Speaker, I urge my Senate colleagues to at least take up some of them and do the same, and I yield back the balance of my time.

Mr. Speaker, I object to the vote on the ground that a quorum is not present and make the point of order that a quorum is not present.

Mr. Speaker, the following cost estimate for H.R. 6742, the Secure Border Communications Act prepared by the Congressional Budget Office was not available to the Committee at the time of filing of the legislative report.

Department of Homeland Security Legislation

As passed by the House of Representatives on September 25, 2018

On September 25, the House of Representatives passed the

following three pieces of legislation:

H.R. 6620, the Protecting Critical Infrastructure Against

Drones and Emerging Threats Act, which would require the

Department of Homeland Security (DHS) to prepare assessments

of the threats presented by unmanned aircraft systems (often

called drones) and other emerging threats associated with

such new technologies;

H.R. 6735, the Public-Private Cybersecurity Cooperation

Act, which would require DHS to establish procedures for

people or organizations to report vulnerabilities in the

department's information systems; and

H.R. 6740, the Border Tunnel Task Force Act, which would

direct DHS to establish task forces to combat threats from

cross-border tunnels; the task forces could include personnel

from federal, state, local, and tribal agencies.

CBO estimates that enacting the legislation would not

significantly affect spending by DHS in any fiscal year

because the department could largely implement each act with

existing personnel.

Enacting the legislation would not affect direct spending

or revenues; therefore, pay-as-you-go procedures do not

apply.

CBO estimates that enacting the legislation would not

increase net direct spending or on-budget deficits in any of

the four consecutive 10-year periods beginning in 2029.

None of the acts contain intergovernmental or private-

sector mandates as defined in the Unfunded Mandates Reform

Act.

The CBO staff contact for this estimate is Mark Grabowicz.

The estimate was reviewed by H. Samuel Papenfuss, Deputy

Assistant Director for Budget Analysis.

U.S. Congress,

Congressional Budget Office,

Washington, DC, September 27, 2018.

Hon. Michael McCaul,

Chairman, Committee on Homeland Security,

House of Representatives, Washington, DC.

Dear Mr. Chairman: The Congressional Budget Office has

prepared the enclosed cost estimate for H.R. 6620, H.R. 6735,

and H.R. 6740, three bills concerning the Department of

Homeland Security that were ordered reported by the Committee

on Homeland Security on September 13, 2018.

If you wish further details on this estimate, we will be

pleased to provide them. The CBO staff contact is Mark

Grabowicz.

Sincerely,

Keith Hall.

Enclosure.

Mr. Speaker, I yield myself such time as I may consume

Mr. Speaker, I thank my good friend, Representative Hurd, for his leadership in introducing this commonsense legislation. The bill before us today includes a number of different measures.

The bill includes a measure originally introduced by Senator McCaskill to deal with information technology threats to the Federal acquisition supply chain. The bill would address the serious cybersecurity risks that recently came to light after the discovery of Kaspersky products had been installed on many government computers.

The bill would establish the Federal Acquisition Security Council to facilitate information sharing among Federal agencies regarding supply chain risks when purchasing information technology products and create procedures for evaluating such risks.

The bill would give agencies the authority to mitigate supply chain IT risks and authorizes the Council to recommend excluding suppliers, if warranted.

The bill also would establish a judicial review process and reporting requirements to ensure fairness and accountability if companies are excluded in the future.

In addition, the bill includes several provisions to improve cybersecurity at the Department of Homeland Security, one which was originally authored by Senator Hassan of New Hampshire. It would create a pilot program through which the Department would be authorized to provide a financial reward to those who legitimately come forward to report vulnerabilities on DHS websites and software to prevent exploitation by cyber terrorists, State actors, and criminal organizations.

So-called white hat hackers are an enormous pool of talent that the Federal Government has largely failed to leverage. The bill would also require DHS to put in place policies to ensure that civic-minded hackers can identify and report bugs found on the Department's information systems without breaking the law.

I ask my colleagues to join me in supporting the SECURE Technology Act, and I reserve the balance of my time.

Mr. Speaker, I thank my good friend especially for his work on this bill and for his friendship and for our continuing work together.

Mr. Speaker, I have no further speakers, and I yield back the balance of my time.