House Homeland Security Committee Chairman Michael McCaul (R-Texas) said on Thursday he plans to soon resurrect legislation aimed at reorganizing and strengthening the cyber security efforts within the Department of Homeland Security (DHS) to help combat growing cyber threats.
McCaul said he is proposing a “major reorganization and consolidation of our domestic civilian cyber defense efforts into a single strong cyber security agency at the Department of Homeland Security. This will be my highest cyber security priority in the next year.”
Photo: U.S. House of Representatives.
Last summer, McCaul’s committee approved a DHS backed bill to restructure the current National Protection and Programs Directorate (NPPD) into the Cybersecurity and Infrastructure Protection Agency, a change that would recognize the operational nature of much of the work that NPPD is the cyber realm. However, that bill died before even getting a vote in the House.
McCaul said last November that the Cybersecurity and Infrastructure Protection Agency Act (H.R. 5390) couldn’t get through the competing committee jurisdictions that all have oversight of DHS, arguing that his Homeland Security Committee needs to have comprehensive oversight of the department.
“A 19th century bureaucracy cannot protect us from 21st century threats,” McCaul said on Thursday at a press conference to roll out a new report on cyber security recommendations for the incoming administration of President-elect Donald Trump. McCaul and Sen. Sheldon Whitehouse (D-R.I.) co-chaired the Cyber Policy Task Force, which is sponsored by the Center for Strategic and International Studies and released the report on Wednesday (Defense Daily, Jan. 5).
The forthcoming bill will redefine the new agency’s mission so that cyber security is the main focus, McCaul said. Currently, it is not the “priority and main focus within the department,” he said.
McCaul said he plans to leverage the recommendations of the Task Force to strengthen the nation’s civil cyber defense posture. The report suggests two key principles to guide Trump as president, one being that there need to be consequences for foreign entities that attack United States networks and that there needs to be incentives for U.S. entities to better secure their networks.
“The United States should respond to cyber attacks in a way adversaries think twice about doing it again,” McCaul said. “At the same time we’ve got to get serious about playing defense.”
Congress and the Obama administration worked together in 2015 on legislation that was ultimately approved to incentivize information sharing between the government and private sector about cyber threats. The main thrust of the Cybersecurity Information Sharing Act is to improve awareness within the government and the private sector of cyber threat indicators so that they can be ferreted out more quickly and not reused on other attack vectors.
McCaul said he’s “optimistic” about information sharing but added “quite frankly it hasn’t gone as well as it could.” He said consolidating the cyber security responsibilities of DHS into a new agency could improve this.
Within the DHS NPPD is the Office of Cybersecurity and Communications, which leads efforts to protect federal civilian computer networks. The office includes the around-the-clock cyber watch center called the National Cybersecurity and Communications Integration Center, which works with the federal government and private sector to mitigate and prevent cyber attacks.
At the press conference Whitehouse called for an independent roving inspector general for cyber security capable of doing audits, red teaming, and white hat penetration testing of federal networks. He said most department and agency IGs don’t have the resources and expertise to conduct adequate audits of cyber security matters across the federal civilian government.
Whitehouse also said the Government Accountability Office should have an entity focused solely on cyber security audits.
McCaul said that later this month he is looking forward to working with Trump to “lay out a cyber security strategy.” He added that “anyone can plainly see that a silent war is being waged against us in cyber space.”
Trump has been aggressively skeptical of an assessment by the U.S. intelligence community that the Russian government was behind an effort to meddle in the presidential election by compromising Democratic National Committee computer networks and providing their email traffic to Wikileaks and other digital groups.