Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, I rise in support of H.R. 5733, the DHS Industrial Control Systems Capabilities Enhancement Act. H.R. 5733 would codify the Department of Homeland Security's role in…
Mr. Speaker, I yield myself such time as I may consume.
Mr. Speaker, I rise in support of H.R. 5733, the DHS Industrial Control Systems Capabilities Enhancement Act. H.R. 5733 would codify the Department of Homeland Security's role in leading Federal efforts to secure industrial control systems.
I want to commend the gentleman from Nebraska (Mr. Bacon) for his hard work on this legislation. I have enjoyed collaborating with him on it, and I am grateful for his support and his support of the amendment that I offered in committee to make the act, I think, even better.
Mr. Speaker, we depend on control systems to deliver basic necessities like clean water, a steady energy supply, reliable transportation systems, and medical care.
This is not a new role for DHS, which has been working on control system security since 2004. However, enactment of H.R. 5733 will help provide clarity to DHS and its Federal partners at a critical moment in our Nation's history.
Cyber threats, Mr. Speaker, to critical infrastructure have never been greater, yet leadership from the White House is dangerously lacking. Over the past few months, we have seen top cyber officials at the White House leave, resign, or, in the case of the Cybersecurity Coordinator, have the position eliminated altogether.
What is more, the President appears to be making major foreign policy decisions with little, if any, regard for cybersecurity. The President ignored warnings from the intelligence community about Chinese telecom company ZTE when, in May, he directed the Commerce Department, by tweet, to save this habitual sanctions offender. The same month, the news broke that the Chinese Government had hacked into the networks of a U.S. Navy contractor and syphoned off sensitive military data.
This month, DHS officials reported that the North Korean Government is ramping up its cyber intrusions on critical infrastructure in the U.S. and around the world.
With respect to Russia, we know that the Kremlin has the capability to turn off the lights with a cyber intrusion, as it has done in Ukraine. We also know that Russia has been able to successfully infiltrate the networks of a wide range of U.S. critical infrastructure operators, including power plants.
DHS, through the National Cybersecurity and Communications Integration Center, or the NCCIC, provides critical infrastructure owners and operators with valuable cyber assistance and resources to help secure their systems. The NCCIC, and specifically the Industrial Control Systems Computer Emergency Response Team, or ICS-CERT, has longstanding relationships with critical infrastructure stakeholders and the expertise to help owners and operators harden their defenses.
Expertise in operational technology, or OT, cybersecurity is even harder to come by than the more traditional information and communications technology, or ICT, space, and all of my colleagues know how much of a workforce challenge we are facing there.
Congress is wise to recognize the amazing resource we have in ICS- CERT by formally authorizing it with Mr. Bacon's bill. Security solutions in the ICT space do not always map well onto operational technology, and being conversant in the nuances is essential if we are to protect the systems that we so heavily rely on.
During the committee consideration, I was also proud to offer an amendment to codify ICS-CERT's coordinated vulnerability disclosure program that ensures ICS vulnerabilities can be reported securely, promptly, and responsibly. Through this program, manufacturers are assured of a chance to patch
vulnerabilities before they are publicly announced, and security researchers are assured that their voices will be heard.
ICS-CERT is to be commended for running a progressive program that recognizes that most security researchers want to help make the internet and the scary devices that connect to it a safer place. The coordinated vulnerability program does just that by helping critical infrastructure owners and operators who receive notices from ICS-CERT about discovered vulnerabilities and effective patches before malicious actors have a chance to exploit any flaws. Mr. Speaker, this bill would empower ICS-CERT to carry out this mission fully and effectively.
Mr. Speaker, I want to again commend the gentleman for his work on this important piece of legislation. I urge my colleagues to support the measure.
Mr. Speaker, I reserve the balance of my time.
Mr. Speaker, I yield myself the balance of my time.
Mr. Speaker, there is no question that industrial control systems are a high-value target for our adversaries. Critical infrastructure owners and operators use these systems to deliver the services that underpin our day-to-day lives, and destruction to one of those systems could have tremendous economic ramifications or could even be the difference between life and death.
We know that our adversaries--most notably Russia, China, Iran, and North Korea--have all targeted U.S. critical infrastructure and the operational technology employed across these sectors. Mr. Speaker, it is important that we solidify DHS' longstanding leadership role in securing critical infrastructure, particularly with respect to industrial control systems.
It has been a pleasure working with my colleague Mr. Bacon, the gentleman from Nebraska, on this bill. I deeply appreciate both his service to the country as well as his contributions both on the Armed Services Committee and on the Homeland Security Committee. Likewise, it has been a pleasure working with him over these years.
Mr. Speaker, I encourage my colleagues to support H.R. 5733, and I yield back the balance of my time.