Hack Your State Department Act

Madam Speaker, due to a scheduled medical procedure, I was physically absent from the House of Representatives from January 10, 2019 to February 5, 2019. During that time, I missed 44 recorded votes. Had I been present for those votes, I would have voted: on Roll Call No. 22 on the Republican Motion to Recommit on H.R. 267, I would have voted ``Yea;'' on Roll Call No. 23 on the Passage of H.R. 267, I would have voted ``Nay;'' on Roll Call No. 24 on the Republican Motion to Recommit on H.R. 265, I would have voted ``Yea;'' on Roll Call No. 25 on the Passage of H.R. 265, I would have voted ``Nay;'' on Roll Call No. 26 on the Republican Motion to Recommit on H.R. 266, I would have voted ``Yea;'' on Roll Call No. 27 on the Passage of H.R. 266, I would have voted ``Nay;'' on Roll Call No. 28 on the Passage of S. 24, I would have voted ``Yea;'' on Roll Call No. 29 on the Passage of H.R. 221, I would have voted ``Yea;'' on Roll Call No. 30 on the Passage of H.R. 116, I would have voted ``Yea;'' on Roll Call No. 31 on the Passage of H.J. Res. 27, I would have voted ``Nay;'' on Roll Call No. 32 on the Passage of H. Res. 41, I would have voted ``Yea;'' on Roll Call No. 33 on the Passage of H.R. 135, I would have voted ``Yea;'' on Roll Call No. 34 on Ordering the Previous Question on H. Res. 43, I would have voted ``Nay;'' on Roll Call No. 35 on the Adoption of H. Res. 43, I would have voted ``Nay;'' on Roll Call No. 36 on the Passage of H.R. 190, I would have voted ``Yea;'' on Roll Call No. 37 on the Passage of Amendment No. 2 offered by Mr. McGovern (D- MA), I would have voted ``Nay;'' on Roll Call No. 38 on Ordering the Republican Motion to Recommit, I would have voted ``Yea;'' on Roll Call No. 39 on the Passage of H.R. 268, I would have voted ``Nay;'' on Roll Call No. 40 on the Adoption of H. Res. 52, I would have voted ``Nay;'' on Roll Call No. 41 on the Passage of H.R. 150, I would have voted ``Yea;'' on Roll Call No. 42 on the Passage of H.J. Res. 30, I would have voted ``Yea;'' on Roll Call No. 43 on Republican Motion to Recommit, I would have voted ``Yea;'' on Roll Call No. 44 on the Passage of H.R. 676, I would have voted ``Yea;'' on Roll Call No. 45 on the Passage of H.R. 328, I would have voted ``Yea;'' on Roll Call No. 46 on the Passage of H.J. Res 28, I would have voted ``Nay;'' on Roll Call No. 47 on the Passage of H. Res. 61, I would have voted ``Nay;'' on Roll Call No. 48 on the Republican Motion to Recommit, I would have voted ``Yea;'' on Roll Call No. 49 on the Passage of H.R. 648, I would have voted ``Nay;'' on Roll Call No. 50 on the Republican Motion to Recommit, I would have voted ``Yea;'' on Roll Call No. 51 on the Passage of H.J. Res. 31, I would have voted ``Nay;'' on Roll Call No. 52 on the Passage of H.R. 624, I would have voted ``Yea;'' on Roll Call No. 53 on the Passage of H.R. 502, I would have voted ``Yea;'' on Roll Call No. 54 on Approving of the Speaker's Journal, I would have voted ``Yea;'' on Roll Call No. 55 on the Motion to Adjourn, I would have voted ``Nay;'' on Roll Call No. 56 on the Passage of H.R. 428, I would have voted ``Yea;'' on Roll Call No. 57 on the Passage of H.R. 449, I would have voted ``Yea;'' on Roll Call No. 58 on the Passage of H.R. 769, I would have voted ``Yea;'' on Roll Call No. 59 on the Motion to Table the Motion to Reconsider H. Res. 77, I would have voted ``Nay;'' on Roll Call No. 60 on Ordering the Previous Question on H. Res. 87, I would have voted ``Nay;'' on Roll Call No. 61 on the Passage of H. Res. 87, I would have voted ``Yea;'' on Roll Call No. 62 on the Passage of Amendment No. 3 offered by Mrs. Trahan (D-MA), I would have voted ``Nay;'' on Roll Call No. 63 on the Republican Motion to Recommit, I would have voted ``Yea;'' on Roll Call No. 64 on the Passage of H.R. 790, I would have voted ``Nay;'' and on Roll Call No. 65 on the Passage of H. Res. 79, I would have voted ``Nay.''

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 328) to require the Secretary of State to design and establish a Vulnerability Disclosure Process (VDP) to improve Department of State cybersecurity and a bug bounty program to identify and report vulnerabilities of internet-facing information technology of the Department of State, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days in which to revise and extend their remarks and include extraneous material on H.R. 328, the Hack Your State Department Act.

Mr. Speaker, I yield myself such time as I might consume.

Mr. Speaker, let me start by thanking Representative Lieu, a valued member of the Committee on Foreign Affairs, for his hard work on this bill and on everything else.

This important legislation passed the House in the last Congress with strong bipartisan support, and I certainly support passing it again.

Mr. Speaker, it is critical that we modernize our government to better deal with 21st century challenges. The State Department is under the constant threat of cyberattack from foreign actors bent on stealing our secrets, disrupting our foreign policy, and undermining our security.

Mr. Lieu's bill will help shore up the State Department against this sort of intrusion.

First, it requires the Secretary of State to get out ahead of this problem. Instead of waiting for the next attack to happen, this bill would mandate a plan for researchers to actively seek out and report vulnerabilities.

Secondly, this bill launches a new initiative, the so-called ``bug bounty program.'' This seeks to tap the expertise of everyday Americans by rewarding citizens who uncover and report security risks in the Department's computer system. It will allow security researchers and friendly hackers to find the cracks in the system so that the Department can patch them.

This effort is modeled after a successful program at the Defense Department, which got off the ground in 2016. Since then, 1,400 people have registered to participate, and they have found roughly 140 vulnerabilities.

Our Federal agencies should learn from one another. It is just common sense to put this tested practice to work at the State Department and elsewhere.

Mr. Speaker, I am very glad to support this bill, and I reserve the balance of my time.

Mr. Speaker, I yield 4 minutes to the gentleman from California (Mr. Ted Lieu), the author of this bill and a very honored member of the Foreign Affairs Committee.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I again want to thank Mr. Lieu for this important piece of legislation.

It seems to me, Mr. Speaker, that we have been caught flat-footed before a range of new threats, including cyberattacks. Our agencies haven't done enough to root out vulnerabilities, and, frankly, Congress hasn't done enough to make sure that our government agencies have the tools they need to tackle these challenges.

As we head into the 116th Congress, I will be leading the Foreign Affairs Committee in focusing on this. We will be taking a comprehensive look at cyber threats to make sure the State Department and all our departments and agencies are properly equipped to handle this challenge. For now, this bill is an important step in the right direction.

Mr. Speaker, I urge all Members to support the measure before us, and I yield back the balance of my time.

Mr. Speaker, on that I demand the yeas and nays.

Mr. Speaker, I thank Ranking Member

McCaul for his support of this legislation and I thank Chairman Engel for his leadership of the House Foreign Affairs Committee.

Mr. Speaker, I rise in support of my legislation, H.R. 328, which will strengthen cybersecurity at the State Department. This legislation is known as the Hack Your State Department Act. It is introduced with my colleague, Ted Yoho of Florida, and has received strong bipartisan support, and that is because there is no such thing as Republican cybersecurity or Democratic cybersecurity; it is just cybersecurity, and we are behind.

American institutions are under constant attack from criminals, from foreign intelligence services, and from everyday hackers. That is why last term, I was very honored to have introduced legislation known as the Hack DHS Act, along with Senators Maggie Hassan, Rob Portman, Kamala Harris, and Congressman Scott Taylor. That legislation was signed into law last month.

This legislation focuses on the State Department. It is something that we need to do, because we know that the State Department over the years has faced mounting cybersecurity threats from both criminal enterprises and state-sponsored hackers.

In 2014, for instance, the Department was infiltrated by Russian hackers and had to temporarily shut down its email system.

Last year, the State Department suffered another breach of its email system, exposing the personal information of a number of its employees.

As a recovering computer science major, I recognize there are improvement tools at our disposal to improve cybersecurity that the State Department has not yet adopted, and one such tool is exactly what this bill will do.

This bill does primarily two things. The first is to establish what is called a vulnerability disclosure process, which sets clear rules of the road so, when people outside the Department discover vulnerabilities on Department systems, they can report it in a safe, secure, and legal manner, with the confidence that the State Department will actually fix the problems. We cannot afford to allow vulnerabilities discovered in the wild remain known to hackers but unknown to the Department. This should be an easy fix.

The second step is to actually pay vetted, white hat hackers to find vulnerabilities. The Department of Defense proved the success of the bug bounty program back in 2016. Over a 24-day period, the Pentagon learned of and fixed over 138 vulnerabilities in its systems. The DHS is now also going to start this very same program. Hopefully, the State Department will be able to do this, as well, when this legislation is signed into law.

Let me conclude by saying that, today, with H.R. 328, the House of Representatives is taking these recommendations to heart and helping to improve cybersecurity at the Department of State.

Mr. Speaker, I yield myself as much time as I may consume.

Mr. Speaker, I rise in support of the Hack Your State Department Act, which will help address lingering cybersecurity gaps at the Department of State.

The massive breach of the State Department's unclassified computer network in 2014 exposed grave weaknesses.

In the years since that attack, problems have continued to mount. The Department's cybersecurity response program received a ``D'' rating, the lowest of any agency, on its Federal Information Security Management Act report card in 2017.

Last September, the Department revealed that it recently suffered a breach of its unclassified email system, which exposed the personal information of some of its employees.

The Department needs cost-effective solutions to these IT security challenges.

Today's legislation directs the Secretary of State to develop and implement a vulnerability disclosure process that will allow threat researchers from the private sector to identify and report cybersecurity flaws.

Currently, there is no legal avenue that allows them to do so. This bill fixes that problem.

The bill will establish a ``bug bounty'' pilot program to reward ethical hackers for discovering and reporting vulnerabilities at the Department.

These programs have been used successfully by the Defense Department and numerous private companies to improve their cyber defenses at minimal cost. In fact, I remember introducing a similar bill for the Department of Homeland Security.

As a national security agency, the State Department must do more to secure its networks. The Hack Your State Department Act is a small but important step towards cost-effective solutions.

Mr. Speaker, I want to thank the author, Mr. Lieu, for putting his computer science background to work here in the Congress, and he understands, I believe, the nature of the threats that we face in the cyber realm and the importance of a strong cybersecurity partnership between the public and the private sectors.

Mr. Speaker, I urge support, and I reserve the balance of my time.

Mr. Speaker, I yield myself such time as I may consume.

In closing, I want to again thank the author, Mr. Lieu, and his primary sponsor, Mr. Yoho, for this creative effort to harness private- sector know-how to improve cyber defenses at the Department of State.

As the gentleman, Mr. Lieu, indicated, I moved this very same legislation when I was chairman of the Homeland Security Committee for the Department of Homeland Security, and I believe it is working very effectively. The Department of Defense has done the same thing. Now it is time for the Department of State to take on this challenge as well.

Mr. Speaker, I support this bill, and I yield back the balance of my time.

Madam Speaker, I had an unavoidable family commitment and so I missed Roll Call vote number 44 regarding the ``NATO Support Act (H.R. 676).'' Had I been present, I would have voted ``yes.''

I missed Roll Call vote number 45 regarding the ``Hack Your State Department Act (H.R. 328).'' Had I been present, I would have voted ``yes.''

I missed Roll Call vote number 46 regarding the ``Making further continuing appropriations for fiscal year 2019, and for other purposes (H.J. Res. 28).'' Had I been present, I would have voted ``yes.''

I missed Roll Call vote number 47 regarding the ``Rule Provided for Consideration of H.R. 648 Consolidated Appropriations Act, 2019 and H.J. Res. 31 Making further Continuing Appropriations for the Department of Homeland Security for Fiscal Year 2019 (H. Res. 61).'' Had I been present, I would have voted ``yes.''

I missed Roll Call vote number 48 regarding the ``Motion to Recommit on H. R. 648 Consolidated Appropriations Act, 2019, I would have voted ``no.''

I missed Roll Call vote number 49 regarding the ``Consolidated Appropriations Act, 2019 (H.R. 648).'' Had I been present, I would have voted ``yes.''