Cybersecurity Disclosure Act of 2019

Thank you for the recognition, Madam President.

Today I rise to call on this body to defend the Constitution, to protect the separation of powers, and to safeguard Congress's role as a coequal branch of government.

Today I am introducing a bipartisan resolution with my Senate colleagues to terminate the President's declaration of a national emergency to build his border wall.

My partners in this effort include Senator Collins, who is with me today. She will be here momentarily. Also partners are Senator Murkowski and Senator Shaheen.

I just want to say to Senator Collins that I commend her on her principled stance and on standing up for the Constitution.

The vote we will take on this resolution is historic. This is no longer about the President's wall. This is not about party. This is not about protecting the very heart of our American system. This is about protecting the very heart of our American system of governance.

Congress--and only Congress--holds the power of the purse. Article I, section 9 of the Constitution clearly states: ``No Money shall be drawn from the Treasury, but in Consequence of Appropriations made by Law.'' The Constitution is absolutely clear.

Congress's power to make spending decisions is very clear. There is no ambiguity. Deciding how to spend public funds is among our most fundamental powers and responsibilities under the Constitution. The Founders gave this power to the legislative body, not the executive, to ensure there is a broad support for how public funds are spent.

Consequential and far-reaching decisions about spending taxpayer money are not left to one person, not even the President.

This body has rejected the President's request to give him $5.7 billion for his wall along the southern border with Mexico. On February 14, not 2 weeks ago, we passed the Consolidated Appropriations Act of 2019 by a vote of 83 to 16. That compromise bill did not include the $5.7 billion the President wanted to build his wall.

Whether you believe Congress should fund the President's wall is not at issue. This is a question about the strength of the rule of law in this country and about the separation of powers, which forms the foundation of our American government.

The President's declaration of a national emergency is an end-run around Congress's power to appropriate--plain and simple. To quote Senator Collins, the President is ``usurping congressional authority.''

We are the representatives of the people. The people do not want to spend $5.7 billion on the President's wall, and we must protect their will.

Let's be clear. This emergency declaration has serious implications for States all across the country. To build this wall, the White House will raid $3.6 billion from the Department of Defense's military construction budget and $2.5 billion from that Department's drug interdiction program, but the White House apparently failed to realize there are only about $80 million in the drug interdiction account. So we should be prepared for a raid on other accounts or taking even more from military construction funding.

These are military construction funds that Congress already has appropriated for specific projects necessary to support the national security priorities of the United States. I am privileged to serve on the Appropriations Committee. I understand the hard and careful work that goes into these funding decisions.

From my home State of New Mexico, Congress allocated some $85 million to construct a formal training unit at Holloman Air Force Base in the south-central part of New Mexico for unmanned aerial vehicles. This investment in technology tracks terrorists

and protects our national security. We allocated $40 million to the White Sands Missile Range to build an information systems facility badly needed for next-generation research and development activities at the range. Both of these projects were vetted over several years and deemed important to our national security.

New Mexico is not alone. Many States' military bases and regional economies will be impacted. Colorado, for example, is at risk of losing almost $100 million for construction projects at Fort Carson near Colorado Springs. Ohio risks $61 million for the first installment for building at the National Air and Space Intelligence Center at Wright- Patterson Air Force Base.

Military construction projects totaling $210 million are at risk in Florida, $520 million in Texas, $81 million in Utah, and the list goes on and on. Projects in every corner of the country will be impacted.

According to the 1976 Senate report from the National Emergencies Act, the President's emergency power may ``be utilized only when actual emergencies exist.'' As a border Senator, I am here to tell you that there is no actual national security emergency at our southern border necessitating a massive wall along the southern border, as this body has already determined. This is a matter where the President and Congress have disagreed and the President is trying to overrule Congress by fiat.

A bipartisan group of 58 former national security officials are sounding the alarm. They write: ``Under no plausible assessment of the evidence is there a national emergency today that entitles the president to tap into funds appropriated for other purposes to build a wall at the southern border.''

The evidence speaks for itself. The number of border apprehensions has decreased dramatically. Since the early 2000s, southern border apprehensions have dropped 81 percent. The number of apprehensions at the end of fiscal year 2017 was the lowest it has been since 1971--a 46-year low. We have the lowest number of undocumented immigrants in our country that we have had in over a decade.

The Pew Research Center estimated recently that the total number of undocumented immigrants residing in the United States is far less than since 2004. That is a 14-year low. And more people emigrate to Mexico from the United States than immigrate from Mexico to here. That is right. We have a negative net migration rate with Mexico.

I am one of the four States that border Mexico--one of the four States that will be the most directly affected by a wall. I know for an absolute fact that there is no national security emergency along my State's border with Mexico. It is quite the opposite.

New Mexico's border communities are thriving. International commerce is thriving. Our multicultural communities are thriving. Crime rates are low.

A wall like the President wants would be disastrous for a State like New Mexico. It will seize away private property and carve up family ranches, farms, and homesteads. It will harm the beautiful but fragile environment there on the border.

Again, whether you support the President's wall is not at issue on this vote. As Senator Tillis put it in an op-ed in the Washington Post, ``I support President Trump's vision on border security. But I would vote against the emergency.''

Another Senate Republican Senator recently said, ``Congress has been ceding far too much power to the executive branch for decades. We should use this moment as an opportunity to start taking power back.''

Over 20 former Republican Senators and Representatives were compelled to pen a letter opposing the emergency declaration. They state: ``It has always been a Republican fundamental principle that no matter how strong our policy preferences, no matter how deep our loyalties to presidents and party leaders, in order to remain a constitutional republic we must act within the borders of the Constitution.''

The time to act is now. Litigation has been filed, but Congress should resolve the issue of our own constitutional authority and not wait for the courts.

Let me repeat. The vote we will take will be historic. It is imperative that all of us--Republican and Democrat--protect and defend our Constitution and that we protect and defend the checks and balances that unequivocally place the power of the purse with Congress and that we affirm our powers--powers that are separate from the President's.

Our oath is to uphold the Constitution, and the Constitution is clear. The Constitution does not empower the President to raid money by decree just because Congress has already said no.

I will vote to terminate the President's declaration of the national emergency to build his wall, and I will urge everyone in this Chamber to protect our constitutional prerogative and to do so as well.

Would the Senator yield?

I just want to say, because we have both been here for a bit talking on the floor about this, I want to thank Senator Collins for standing up for principle. I want to thank her for standing up for our Constitution. It is a real honor to join her in this resolution of disapproval.

I also, as she just did, thank the two other Senators who are joining us, Senator Murkowski and Senator Shaheen. I thank the Senator very much.

Mr. President, before the Presidents Day recess, I announced that I would introduce legislation if the tax extenders weren't included in the legislation that we passed at that time that would keep government open.

Today I am following through on that promise with a bill that I am introducing with Finance Committee ranking member Senator Wyden of Oregon.

It is fitting that I am taking this step in the same month as Groundhog Day, as the subject of my remarks is something that Congress has had to deal with too many times already.

Next to me is a depiction from the movie ``Groundhog Day,'' which is about a man named Phil who must relive the same day over and over until he gets everything right. While we still need to break the cycle of repetitive short-term extensions, the right thing to do right now is to extend these already-expired provisions for 2018 and 2019.

As I have said before, the tax extenders are a collection of temporary tax

incentives that have required extension on a very regular basis in order to keep them available to the taxpayers. Currently, there are 26 provisions. At one time there were as many as 50-some. We have done away with some of them and made some of those laws permanent, but these 26 provisions expired at the end of 2017. They need to be extended, as well as three others that expired at the end of last year.

Today we are in the middle of filing season for 2018 tax returns, and taxpayers affected by these expired provisions need a resolution so that they can file. I want to stress that I want to find a long-term resolution so that we don't have to have temporary tax policy, but it is critical we make it clear to the taxpayers that these provisions are available for the 2018 filing season and extending them for this year will give us room to take a needed long-term view of this temporary tax policy.

Many of the tax extenders are intended to be incentives, and to be successful, then, these incentives need to be in effect before decisions can be made. That is why we should provide extensions for at least 2 years, to maximize that incentive effect. But it is also important that we extend these provisions for 2018, even though the year has obviously already ended. We have developed a very bad policy and a very bad habit of extending these tax provisions year after year, and people and businesses have come to expect that the extension will happen.

As a result, decisions were made by various businesses in 2018 based upon the expectation of extension, and that is a reasonable expectation because we have done it over decades. In other words, people did what we wanted them to do in their business decisions when these provisions were created. We should not retroactively punish these businesspeople for Congress's inaction.

Today, a diverse group of organizations, including the National Biodiesel Board, the American Trucking Associations, and the National Corn Growers Association, among others, sent a letter to congressional leaders requesting that the expired provisions be extended through 2019 as quickly as possible. I want to quote a few sentences from that letter:

Providing taxpayers with a predictable planning outlook as

it pertains to tax rules is conducive to increased private

sector investment and economic activity. Accordingly, we

respectfully ask that you act to retroactively extend these

expired tax provisions through 2019 on the first appropriate

legislative vehicle.

Mr. President, I ask unanimous consent that the complete letter be printed in the Record.

Mr. President, another very important point I want to make has to do with the question about whether an extender package should be offset or not. Around here, the word ``offset'' means if you have tax provisions that might lose revenue, then do you have other revenue coming in to take its place? The House has decided that is what you should do--pay as you go, or PAYGO, as they might call it. It is a rule of the House.

I have a long record of promoting budget responsibility, and I am as concerned about the deficit and debt as anyone. However, we also have bipartisan precedent for treating the extension of temporary tax policy, like these extenders, just as we treat the extension of annual spending policy. In neither case do we need offset for such extensions. In other words, it is all right to spend more money or continue to spend the same amount of money after a program has expired, and you don't have to offset it when you have tax law that has been on the books for a couple of decades, and it is sunset. Why should you have to sunset that? There are a few people around here who think it is all right to spend money without offsets, but it is wrong to do tax policy unless you have offsets.

There are a few specific items in this legislation that I want to take time to mention. Significant work has already been done to provide long-term solutions on two extenders--the short line railroad tax credit and the biodiesel tax credit.

The bill I am introducing extends those credits at their current levels for 2018 and 2019. I want my colleagues to

know that I still remain committed to enacting the compromises that several of our colleagues and I worked with the stakeholders to achieve.

The bill also includes an extension of a proposal adopted last Congress that would extend the 7.5-percent floor for itemized deductions of medical expenses. Without this provision, the floor on deductions will be 10 percent for 2019. This means that without this provision, individuals with chronic illnesses and high medical expenses would have to pay more for healthcare before that excess can be deducted in the expenses on their 2019 tax returns.

This proposal is a very important priority for one of our best colleagues, Senator Collins. She deserves a lot of credit for getting what has turned into a bipartisan proposal to help many Americans facing catastrophic medical expenses.

Finally, the legislation includes provisions to assist Americans who have been affected by natural disasters in 2018. This package includes proposals that we have adopted in prior years to help Americans recover from natural disasters across our country. For example, the package would allow increased access to retirement funds and relax restrictions around charitable giving. I am sure everyone here would like to help people affected by these natural disasters as soon as we are able to.

I don't want my comments today to imply that each tax extender should be permanently extended, but the right thing to do now is to provide extensions for at least 2018 and 2019. In the long term, Congress needs to decide if these provisions should be allowed to expire or if they should be phased out or if they should be made permanent as current tax policy or modified in some way beyond expiring, phasing out, or being made permanent.

Those decisions need to be made after we resolve the short-term crisis caused by the current lapse. These provisions have support of Members on both sides of the aisle. For people who think that things around here get done only with Republicans fighting Democrats or vice versa, these provisions have wide bipartisan support.

There is a solid foundation for a long-term package consisting of many of these provisions in one form or another. We need to get past today so that we can chart the course for a reliable future for the tax extenders and give business some certainty.

Just as Phil wants to stop living the same day over and over again, I think all of us want to break the cycle of short-term extensions of, in many cases, very popular tax policy. The legislation I introduce today with the ranking member, Senator Wyden of Oregon, is a critical first step toward helping taxpayers complete their 2018 returns and helping us begin work on a long-term solution to temporary tax policy.

I have asked our majority leader to rule XIV this bill onto the calendar, and I urge the House to send us a tax bill to address the extenders without further delay.

Just this morning, I had discussions with Iowa Congressmen of both political parties about this issue to contact the leadership of the House and the leadership of the Ways and Means Committee on the importance of moving legislation since the Constitution doesn't allow the Senate to move tax legislation in the first place.

Mr. President, I rise today to speak on the resolution that I am joining Senator Udall in introducing. It would reverse the President's ill-advised decision to declare a national emergency and commandeer funding provided for other purposes by Congress and instead redirect it to construct a wall on our southern border.

I thank Senator Udall for his leadership and also recognize the support we have received from our cosponsors, Senator Murkowski and Senator Shaheen.

Let me be clear. The question before us is not whether to support or oppose the wall. It is not whether to support or oppose President Trump. Rather, it is this: Do we want the executive branch now or in the future to hold a power that the Founders deliberately entrusted to Congress?

It has been said that Congress's most precious power is the power of the purse set out in plain language in article I, section 9 of our Constitution. It reads as follows: ``No money shall be drawn from the Treasury but in consequence of Appropriations made by law.''

Alexander Hamilton, in Federalist 72, made clear the Founders' view that only the legislative branch commands this power, not the judiciary and not the executive. James Madison, in Federalist 58, called the power of the purse ``the most complete and effectual weapon with which any constitution can arm the [ . . . ] representatives of the people.''

Congress's power was jealously guarded in the early days of our Republic. No less an authority on our constitutional framework than Supreme Court Justice Joseph Story, in his famous ``Commentaries,'' explained that ``[i]f it were otherwise, the executive would possess an unbounded power over the public purse of the nation, and might apply all its monied resources at his pleasure.''

Throughout our history, the courts have consistently held that ``only Congress is empowered by the Constitution to adopt laws directing monies to be spent from the U.S. treasury.''

I strongly support protecting the institutional prerogatives of the U.S. Senate and the system of checks and balances that is central to the structure of our government.

I support funding for better border security, including physical barriers where they make sense. I understand the President is disappointed that the funding he requested did not pass, but the failure of Congress to pass funding in the amount the President prefers cannot become an excuse for the President to usurp the powers of the legislative branch.

This is not the first time I have made this argument against Executive overreach. In 2015, I authored the Immigration Rule of Law Act, legislation that would have provided a statutory basis for the Dreamer population, while rolling back President Obama's 2014 Executive orders expanding that program.

As I explained at the time, even though I supported comprehensive immigration reform and was disappointed that it had not passed, I rejected the notion that its failure could serve as the justification for President Obama to implement by Executive fiat that which Congress had refused to pass, regardless of the wisdom of Congress's decision.

I would now like to turn to a discussion of the National Emergencies Act. This act was passed in 1976 to standardize the process by which the President can invoke national emergency powers and Congress can terminate the declaration through a joint resolution such as the one we are introducing today.

The act is procedural in nature. It lays out the process the President must follow to declare a national emergency but does not provide the President with any additional powers. Instead, it requires the President to specify where, in existing law, he has been granted the authority for the powers he intends to exercise.

By itself, the National Emergencies Act does not give the President the power to repurpose billions of dollars to build a wall. The President must look elsewhere for that authority.

In his declaration, the President cites the authority provided by title 10, section 2808 of the U.S. Code, which relates to ``Construction authority in the event of a declaration of war or national emergency.'' But that authorization applies only to ``military construction projects'' that are ``necessary to support [the] use of the armed forces.'' I do not believe this provision can be fairly read to bootstrap the presence of troops along the southern border into the authority to build a wall as a military construction project.

The question isn't whether the President can act in an emergency but whether he can do so in a manner that would undermine the congressional power of the purse.

Here, I think we need a better understanding of what should qualify as an emergency. One place we could turn is to a five-part test originally developed by the Office of Management and Budget in 1991, under former President George Herbert Walker Bush, to determine whether requested funding merited an ``emergency spending'' designation under our budget rules.

Under that test, a spending request was designated as an ``emergency'' only if all five of the following conditions were met:

First, expenditures had to be necessary; second, the need had to be sudden, coming into being quickly, not building up over time; third, the need had to be urgent; fourth, the need had to be unforeseen; and fifth, the need could not be permanent.

I raise this test only by way of analogy, but it is fair to say that whether or not you agree with the President that more should be done to secure the southern border--and I do agree with the President's goal-- his decision to fund a border wall through a national emergency declaration would not pass this five-part test.

The President's declaration also has practical implications for the military construction appropriations process, as my colleague has pointed out.

Last year, in testimony before the Appropriations Committee, the Department of Defense said that the President's budget request for military construction funding was crucial to support our national defense, including construction projects to improve military readiness and increase the lethality of the force. This includes missile defense, improved facilities in Europe to deter Russian aggression, and infrastructure to operationalize the F-35 stealth fighter.

This also included several important efforts at the Portsmouth Naval Shipyard in Maine that are vital to the Navy conducting timely maintenance and refueling of our Nation's submarines. Shifting funding away from these vital projects is shortsighted and could have very real national security implications.

We must defend Congress's institutional powers, as the Founders hoped we would, even when doing so is inconvenient or goes against the outcome we might prefer.

The gridlock we have experienced on difficult issues like border security and immigration reform is not simply a failure to get our work done but a reflection of the fact that we have yet to reach a consensus.

The President's emergency declaration is ill-advised precisely because it attempts to shortcut the process of checks and balances by usurping Congress's authority. This resolution blocks that overreach, and I hope, regardless of our colleague's position on the construction of the border wall, that we will join together to assert Congress's constitutional authority in the appropriations process.

I urge our colleagues to support this important resolution.

I would be happy to.

Mr. President, I would thank the Senator for his gracious comments. As always, it has been a great pleasure to work with him, and I know he cares deeply about the constitutional principle that brings us to the floor today. Let us defend the Constitution.

Mr. President, today I am reintroducing the Cybersecurity Disclosure Act along with two members of the Select Committee on Intelligence, Senator Collins, and the ranking member, Senator Warner, in addition to Senator Kennedy and Senator Jones, who also serve with me on the Senate Banking Committee. In response to data breaches of various companies that exposed the personal information of millions of customers, our legislation asks each publicly traded company to include--in Securities and Exchange Commission, SEC, disclosures to investors--information on whether any member of the board of directors is a cybersecurity expert, and if not, why having this expertise on the board of directors is not necessary because of other cybersecurity steps taken by the publicly traded company. To be clear, the legislation does not require companies to take any actions other than to provide this disclosure to its investors.

In Deloitte's 11th Global Risk Management Survey of financial services institutions, published last month, ``sixty-seven percent of respondents named cybersecurity as one of the three risks that would increase the most in importance for their business over the next two years, far more than for any other risk. Yet, only about one-half of the respondents felt their institutions were extremely or very effective in managing this risk.'' According to the 2018-2019 National Association of Corporate Directors Public Company Governance Survey, only 52 percent of directors ``are confident that they sufficiently understand cyber risks to provide effective cyber-risk oversight,'' and 58 percent ``believe their boards collectively know enough about cyber risk to provide effective oversight.'' Indeed, Yahoo, in its 2016 annual report, disclosed, ``the Independent Committee found that failures in communication, management, inquiry and internal reporting contributed to the lack of proper comprehension and handling of the 2014 Security Incident. The Independent Committee also found that the Audit and Finance Committee and the full board were not adequately informed of the full severity, risks, and potential impacts of the 2014 Security Incident and related matters.'' The 2014 Security Incident here refers to the fact that ``a copy of certain user account information for approximately 500 million user accounts was stolen from Yahoo's network in late 2014.''

This is particularly troubling given that data breaches expose more and more records containing personally identifiable information. Indeed, according to the Identity Theft Resource Center, the number of these types of records exposed by data breaches in the business industry grew from 181,630,520 in 2017 to 415,233,143 in 2018 and in the medical and healthcare industry from 5,302,846 in 2017 to 9,927,798 last year. Across all industries, the number of records containing personally identifiable information exposed by data breaches rose 126 percent, from 197,612,748 in 2017 to 446,515,334 in 2018.

Investors and customers deserve a clear understanding of whether publicly traded companies are prioritizing cybersecurity and have the capacity to protect investors and customers from cyber related attacks. Our legislation aims to provide a better understanding of these issues through improved SEC disclosure.

In testimony given to the Senate Banking Committee last June, Harvard Law Professor John Coates, who also practiced securities law as a partner at Wachtell, Lipton, Rosen & Katz, expressed support for our legislation by stating that ``[the Cybersecurity Disclosure Act] is well designed. It does not attempt to second-guess SEC guidance and rules regarding disclosures generally, or even as to cyber-risk overall. The bill simply asks publicly traded companies to disclose whether a cybersecurity expert is on the board of directors, and if not, why one is not necessary. To be clear, the bill does not require every publicly traded company to have a cybersecurity expert on its board. Publicly traded companies will still decide for themselves how to tailor their resources to their cybersecurity needs and disclose what they have decided. Some companies may choose to hire outside cyber consultants. Some may choose to boost cybersecurity expertise on staff. And some may decide to have a cybersecurity expert on the board of directors. The disclosure required would typically amount to a sentence or two.''

While this legislation is a matter for consideration by the Banking Committee, of which I am a member, this bill is also informed by my service on the Armed Services Committee and the Select Committee on Intelligence. Through this Banking-Armed Services-Intelligence perspective, I see that our economic security is indeed a matter of our national security, and this is particularly the case as our economy becomes ever more dependent on technology and the internet.

Indeed, General Darren W. McDew, the former commander of U.S. Transportation Command, which is charged with moving our military assets to meet our national security objectives in partnership with the private sector, offered several sobering assessments during an April 10, 2018 hearing before the Senate Armed Services Committee. He stated that ``cyber is the number one threat to U.S. Transportation Command, but I believe it is the number one threat to the nation . . . in our headquarters, cyber is the commander's business, but not everywhere across our country is cyber a CEO's business . . . in our cyber roundtables, which is one of the things we are doing to raise our level of awareness, some of the CEO's chief security officers cannot even get to the see the board, they cannot even . . . see the CEO. So that is a problem.''

In my view, this is a real problem because, if we are attacked, the first strike will likely not be a physical one against the military but a cyber strike against the infrastructure of movement, logistics, and other critical assets in the civilian space.

With growing cyber threats, we all need to be more proactive in ensuring our Nation's cybersecurity before there are additional serious breaches. This legislation seeks to take one step towards that goal by encouraging publicly traded companies to be more transparent to their investors and customers on whether and how their boards of directors and senior management are prioritizing cybersecurity.

I thank the bill's supporters, including the North American Securities Administrators Association, the Council of Institutional Investors, the National Association of State Treasurers, the California Public Employees' Retirement System, the Bipartisan Policy Center, MIT Professor Simon Johnson, Columbia Law Professor Jack Coffee, Harvard Law Professor John Coates, K&L Gates LLP, and the Consumer Federation of America, and I urge my colleagues to join Senator Collins, Senator Warner, Senator Kennedy, Senator Jones, and me in supporting this legislation.

Mr. President, today I am reintroducing the Cybersecurity Disclosure Act along with two members of the Select Committee on Intelligence, Senator Collins, and the ranking member, Senator Warner, in addition to Senator Kennedy and Senator Jones, who also serve with me on the Senate Banking Committee. In response to data breaches of various companies that exposed the personal information of millions of customers, our legislation asks each publicly traded company to include--in Securities and Exchange Commission, SEC, disclosures to investors--information on whether any member of the board of directors is a cybersecurity expert, and if not, why having this expertise on the board of directors is not necessary because of other cybersecurity steps taken by the publicly traded company. To be clear, the legislation does not require companies to take any actions other than to provide this disclosure to its investors.

In Deloitte's 11th Global Risk Management Survey of financial services institutions, published last month, ``sixty-seven percent of respondents named cybersecurity as one of the three risks that would increase the most in importance for their business over the next two years, far more than for any other risk. Yet, only about one-half of the respondents felt their institutions were extremely or very effective in managing this risk.'' According to the 2018-2019 National Association of Corporate Directors Public Company Governance Survey, only 52 percent of directors ``are confident that they sufficiently understand cyber risks to provide effective cyber-risk oversight,'' and 58 percent ``believe their boards collectively know enough about cyber risk to provide effective oversight.'' Indeed, Yahoo, in its 2016 annual report, disclosed, ``the Independent Committee found that failures in communication, management, inquiry and internal reporting contributed to the lack of proper comprehension and handling of the 2014 Security Incident. The Independent Committee also found that the Audit and Finance Committee and the full board were not adequately informed of the full severity, risks, and potential impacts of the 2014 Security Incident and related matters.'' The 2014 Security Incident here refers to the fact that ``a copy of certain user account information for approximately 500 million user accounts was stolen from Yahoo's network in late 2014.''

This is particularly troubling given that data breaches expose more and more records containing personally identifiable information. Indeed, according to the Identity Theft Resource Center, the number of these types of records exposed by data breaches in the business industry grew from 181,630,520 in 2017 to 415,233,143 in 2018 and in the medical and healthcare industry from 5,302,846 in 2017 to 9,927,798 last year. Across all industries, the number of records containing personally identifiable information exposed by data breaches rose 126 percent, from 197,612,748 in 2017 to 446,515,334 in 2018.

Investors and customers deserve a clear understanding of whether publicly traded companies are prioritizing cybersecurity and have the capacity to protect investors and customers from cyber related attacks. Our legislation aims to provide a better understanding of these issues through improved SEC disclosure.

In testimony given to the Senate Banking Committee last June, Harvard Law Professor John Coates, who also practiced securities law as a partner at Wachtell, Lipton, Rosen & Katz, expressed support for our legislation by stating that ``[the Cybersecurity Disclosure Act] is well designed. It does not attempt to second-guess SEC guidance and rules regarding disclosures generally, or even as to cyber-risk overall. The bill simply asks publicly traded companies to disclose whether a cybersecurity expert is on the board of directors, and if not, why one is not necessary. To be clear, the bill does not require every publicly traded company to have a cybersecurity expert on its board. Publicly traded companies will still decide for themselves how to tailor their resources to their cybersecurity needs and disclose what they have decided. Some companies may choose to hire outside cyber consultants. Some may choose to boost cybersecurity expertise on staff. And some may decide to have a cybersecurity expert on the board of directors. The disclosure required would typically amount to a sentence or two.''

While this legislation is a matter for consideration by the Banking Committee, of which I am a member, this bill is also informed by my service on the Armed Services Committee and the Select Committee on Intelligence. Through this Banking-Armed Services-Intelligence perspective, I see that our economic security is indeed a matter of our national security, and this is particularly the case as our economy becomes ever more dependent on technology and the internet.

Indeed, General Darren W. McDew, the former commander of U.S. Transportation Command, which is charged with moving our military assets to meet our national security objectives in partnership with the private sector, offered several sobering assessments during an April 10, 2018 hearing before the Senate Armed Services Committee. He stated that ``cyber is the number one threat to U.S. Transportation Command, but I believe it is the number one threat to the nation . . . in our headquarters, cyber is the commander's business, but not everywhere across our country is cyber a CEO's business . . . in our cyber roundtables, which is one of the things we are doing to raise our level of awareness, some of the CEO's chief security officers cannot even get to the see the board, they cannot even . . . see the CEO. So that is a problem.''

In my view, this is a real problem because, if we are attacked, the first strike will likely not be a physical one against the military but a cyber strike against the infrastructure of movement, logistics, and other critical assets in the civilian space.

With growing cyber threats, we all need to be more proactive in ensuring our Nation's cybersecurity before there are additional serious breaches. This legislation seeks to take one step towards that goal by encouraging publicly traded companies to be more transparent to their investors and customers on whether and how their boards of directors and senior management are prioritizing cybersecurity.

I thank the bill's supporters, including the North American Securities Administrators Association, the Council of Institutional Investors, the National Association of State Treasurers, the California Public Employees' Retirement System, the Bipartisan Policy Center, MIT Professor Simon Johnson, Columbia Law Professor Jack Coffee, Harvard Law Professor John Coates, K&L Gates LLP, and the Consumer Federation of America, and I urge my colleagues to join Senator Collins, Senator Warner, Senator Kennedy, Senator Jones, and me in supporting this legislation.