Quantity vs. quality in cyber legislation

In December 2021, the Center for Strategic and International Studies (CSIS) published a compilation of Cybersecurity Legislation in the 117th Congress, which stated that 157 measures dealing with cybersecurity had been introduced to that point in the first session of this two-year Congress. And that doesn't even count the various cyber amendments offered to other measures (such as the annual defense authorization bill) or legislation that has been introduced in the nine months since then. 

But with only a few months to go in the 117th Congress, we have to ask -- is the number of bills that have been introduced, regardless of how few are actually enacted (much less have a meaningful impact) an accurate measure of interest in cybersecurity? Or, as a cynic might ask, is it a measure of how elected officials are seeking to show their constituents they are interested in this hot topic, even if nothing happens? Or, as yet another alternative, is it a reflection of the multitude of House and Senate committees and subcommittees who claim jurisdiction over some aspect of cybersecurity? 

The answer is that all are probably true to some degree. 

Yes, there is great interest in cybersecurity, and many bills are introduced with the best intentions of addressing the problems.  

And yes, the cynics will point out that some bills are introduced by legislators who see headlines and know that cybersecurity is something they want to be on the right side of – so sometimes they look for some low-hanging cyber fruit to sponsor. We saw some of that after the 2021 Colonial Pipeline hack and resultant gas shortages; legislators scrambled to show action even though the gas lines didn't last long. We've seen it in bills that would require reports on cybersecurity issues, or to boost certain cyber programs. Quite often, bills in Congress tell the executive branch how to better defend America in cyberspace, often by restructuring responsibility for certain cyber duties.  

But the last theory, while somewhat more wonkish, is a more enduring factor. That's because the problem of multiple, overlapping congressional jurisdictions has been around long before cybersecurity was a "thing," and it will never go away. Every single committee in Congress and probably every single subcommittee can stake claim to having jurisdiction over some aspect of cybersecurity. Unfortunately, many of those claims overlap.

The conflict that results from this overlapping jurisdiction manifests itself in two ways – legislation and oversight. A great example of both is that the Senate has one committee – Homeland Security and Governmental Affairs – to handle legislation and oversight involving the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security, as well as non-defense federal IT. However, the House has two committees – Homeland Security and Oversight and Reform – which compete to assert primacy on matters affecting CISA and federal IT. 

So, officials at CISA, the General Services Administration, the Office of Management and Budget and other agencies are constantly on the hook to be responsive to the separate demands of all three committees, as well as some of their subcommittees. That doesn't even begin to take into account all the appropriations subcommittees in both the House and Senate that claim oversight authority via the power of the purse – they control the funding of those agencies.

Every congressional committee has some kind of jurisdiction over executive branch departments and agencies (and the legislative branch and the judiciary), and all of those have something in common – technology. And with technology comes… wait for it… vulnerabilities. So, every committee has a claim to cybersecurity within whatever offices it oversees, and that can lead to conflicting demands for action.  

There's a final point regarding committees that crosses back over into the second theory espoused by cynics: elected officials are often inclined to sponsor legislation on issues within the jurisdiction of their committees. And they will tailor such legislation to ensure it is referred to their committee for them to then advocate on behalf of. Even if a bill only gets reported out of committee and never becomes law, skeptics will point out that it represents an opportunity for such officials to issue a press release to claim a major step forward in the battle to protect America in cyberspace.

Going back to the basic premise, is the sheer number of bills introduced on cybersecurity a measure of real interest? Not really. You have to look at the number of proposals that become law –especially the quality and impact of such measures – to gauge Congress' true interest in effectively legislating on cybersecurity.