Critical infrastructure cyber bill moves forward

The latest round of cybersecurity legislation is moving ahead in the House, with the Homeland Security Committee on Feb. 5 approving a bill by voice vote that seeks to protect critical infrastructure and codify information-sharing practices.

According to a summary of the bill, the measure would formalize numerous existing government cybersecurity efforts, such as information-sharing initiatives between the public and private sectors and assessments of the cyber workforce. It would also strengthen the National Cybersecurity and Communications Integration Center and prohibit new regulatory authorities at agencies, particularly the Department of Homeland Security.

The bill "aligns with the presidential executive order, which is the most comprehensive protection of critical infrastructure to date," said Rep. Bennie Thompson (D-Miss.), the panel’s ranking member. "The publication of [the forthcoming National Institute of Standards and Technology cybersecurity framework] has the potential to fundamentally alter how decisions about federal security networks get made."

Much of the deliberation during the session, however, focused on issues related to privacy and civil liberties. Debates sparked over amendments targeting transparency in the government's collection of individuals' information, particularly during border searches of personal electronic devices. One such amendment by Rep. Loretta Sanchez (D-Calif.) was set aside, and committee members said they would discuss it further behind closed doors.

Rep. Michael McCaul (R-Texas), chairman of the committee and the bill’s sponsor, was pleased with the outcome.

"This bill represents over a year of work and more than 300 meetings with experts and stakeholders, including the owners and operators of critical infrastructure, government agencies, academics and privacy advocates," he said. "We went through several drafts and countless hours of negotiations, but I'm proud to say the final product is, as our friends at the ACLU have called it, ‘both pro-security and pro-privacy.'"