| Members of a Congressional cybersecurity commission introduce legislation to establish a statutory cyber position in the White House after neither NDAA has this policy change. |
First things first, if you would like to receive my Technology Policy Update, email me. You can find some of these Updates from 2019 and 2020 here.
This week, the House Oversight and Reform Committee is holding a hearing to examine the “National Cyber Director Act” (H.R.7331), a bill to implement one of the Cyberspace Solarium Commission’s key recommendations.
When it became clear that neither FY 2021 National Defense Authorization Act (NDAA) would include a CSC to create a statutory position in the White House to coordinate United States’ (US) cyber policy, some CSC members and other key stakeholders introduced a bill to effectuate the recommendation that the US needs a National Cyber Director. This new position would be along the lines of a position created during the Obama Administration (i.e. White House Cybersecurity Coordinator) that was eliminated by former National Security Advisor John Bolton in 2018. However, this position would have a statutory basis and authority, which would institutionalize the position in this and future Administrations.
The bill was sponsored by CSC Member Representative James Langevin (D-RI) and cosponsored by CSC co-chair Representative Mike Gallagher (R-WI), House Oversight and Reform Committee Chairwoman Carolyn Maloney (D-NY), the Homeland Security Committee’s Cybersecurity, Infrastructure and Innovation Subcommittee Ranking Member John Katko (R-NY), and Representatives C. A. Dutch Ruppersberger (D-MD) and Will Hurd (R-TX). Langevin has been advocating for this concept for a decade, beginning with the introduction of “Executive Cyberspace Authorities Act of 2010” (H.R.5247) that would have created a National Cyberspace Office inside the Executive Office of the President.
In terms of strategy for enactment, the sponsors could try to offer the bill as an amendment to either NDAA during floor consideration, but, depending on the procedural approach to consideration in either chamber, they may not be able to actually get a vote. Moreover, the chairs and ranking members of the Armed Services Committees who typically manage the bills on the floor may successfully argue this is an idea that is premature and should be studied. This sort of argument is often persuasive since these Members are usually respected for their expertise. Alternatively, the sponsors may try to pass the bill as a standalone measure.
The “National Cyber Director Act” (H.R.7331) would establish an Office National Cyber Director (NCD) in the Executive Office of the President (EOP) headed by a Senate-confirmed NCD, much like some of the other offices in the EOP like the Office of Management and Budget and the Office of Science and Technology Policy. Immediately beneath the NCD would be two new officials: Deputy National Cyber Director for Strategy, Capabilities, and Budget and Deputy National Cyber Director for Plans and Operations whose responsibilities are presumably spelled out in their titles for the bill does not explain on their portfolios. The NCD would be added to the statute establishing the National Security Council (NSC), and would be specifically named as an adviser the President may or may not invite to participate in NSC meetings and deliberations.
In terms of duties, the NCD would serve “as the principal advisor to the President on cybersecurity strategy and policy” “[s]ubject to the authority, direction, and control of the President.” This new official would coordinate the drafting and implementation of the United States’ National Cyber Strategy in consultation with existing stakeholders like OMB, the Department of Homeland Security, Department of Defense, and others. The NCD would also be empowered to review agency budget submissions and be required to certify they are aligned with the National Cyber Strategy. The new Director would also be added to the stakeholders that address information security across federal agencies. The NCD would “lead joint interagency planning for the Federal Government’s integrated response to cyberattacks and cyber campaigns of significant consequence,” which would be defensive operations. It appears the NCD would not be the lead US official for offensive cyber-attacks, which appears to be the province of the head of Cyber Command, currently General Paul Nakasone. However, there are provisions that seem to suggest the National Cyber Director could be added to the inter-agency process of determining whether and when the US will launch cyber-attacks. However, the CSC envisioned the NCD not interfering with the current process for offensive operations: “The NCD will coordinate interagency efforts to defend against adversary cyber operations against domestic U.S. interests; this will not impinge on DoD responsibility for Title 10 activities, Office of the Director of National Intelligence (ODNI) responsibility for Title 50 activities, or the U.S. Department of Justice (DOJ) and Federal Bureau of Investigation (FBI) responsibility for counterintelligence activities, but the NCD would be kept fully apprised of those activities.”
The Senate’s “National Defense Authorization Act for Fiscal Year 2021“ (S.4049) would require “the Secretary of Defense, in coordination with the Secretary of Homeland Security, shall seek to enter into an agreement with an independent organization with relevant expertise in cyber policy and governmental organization to conduct and complete an assessment of the feasibility and advisability of establishing a National Cyber Director.” The text of the House’s NDAA released thus far does not address the CSC’s recommendation for the establishment of an NCD.
© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2020. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.
Image by cristianrodri17 from Pixabay
Michael Kans 