Bipartisan cyber bill now the center of partisan turf war

An attempt to move comprehensive cybersecurity legislation through the Senate with broad support has quickly turned into a partisan turf battle as a band of senior Republican senators announced plans to oppose the bill and offer an alternative of their own.

The Cybersecurity Act of 2012, introduced by Sen. Joseph Lieberman (I-Conn.) on Feb. 14, is a reworking of bills that have been around in various forms since 2009 but has failed to move to the Senate floor. Lieberman called the current bill a product of collaboration across party and committee lines, and one that includes hundreds of changes from earlier bills.

 “We think finally we’ve struck the right balance,” Lieberman said during a Feb. 16 hearing of the Homeland Security and Governmental Affairs Committee, which he chairs. “I don’t think anybody is going to rush this through.” His goal is to “get it done as quickly as we can get it right.”

Related coverage:

Compromise cybersecurity bill still draws GOP fire

McCain: Senate GOP plans its own cybersecurity bill

But the bill has been put on the Senate calendar before consideration by committees, which has angered a group of seven ranking Republican members of committees also claiming jurisdiction over cybersecurity issues, including Sen. John McCain of Arizona, who told the committee, “That is wrong.”

Under the bill, the Homeland Security Department would have the lead in protecting civilian government systems as well as overseeing the security of privately owned systems. DHS would establish security performance requirements for systems designated as critical infrastructure. System owners would be able to self-certify compliance with the requirements and the department could seek civil penalties for failures.

The bill also would reform the Federal Information Security Management Act to “focus on continuous monitoring of agency information systems and streamlined reporting requirements rather than overly prescriptive manual reporting.”

The bill has the support of current Homeland Security Secretary Janet Napolitano, who said her department needed legal authorities commensurate with its cybersecurity responsibilities.

“We are performing our mission under an amalgam of authorities that have failed to keep up with the responsibilities with which we are charged,” she said. “Now is not the time for half measures.”

But the bill was condemned by former DHS Secretary Tom Ridge, who said it would impose an unfair regulatory burden on business.

“Instead of adding to the regulatory burden, Congress should work to reduce the fragmented and often conflicting burdens that these different rules and bureaucracies place on industry,” said Ridge, speaking on behalf of the U.S. Chamber of Commerce.

Ridge said the private sector already is doing its part in securing critical infrastructure. “Businesses are heavily focused on guarding their operations from interruption, preventing the loss of capital or intellectual property, and protecting public safety,” he said. “Business owners and operators understand it is imperative that information infrastructure be well protected and resilient.”

But Stewart A. Baker, a partner at Steptoe & Johnson and a visiting fellow at Stanford University’s Hoover Institute, supported the bill, saying the nation can’t rely on the business sector to defend itself. “They’re the guys who got us into this fix,” he said.

Some testifying before the committee felt the bill does not go far enough.

“As currently drafted, this bill includes significant loopholes that would keep our nation at risk,” said James A. Lewis of the Center for Strategic and International Studies. He said too many concessions have been made to industry and DHS needs to have clear authority to require companies to mitigate identified vulnerabilities.

McCain, ranking Republican on the Armed Services Committee, condemned both the contents of the bill and the process by which it is being moved through the Senate.

“To suggest that this bill should move directly to the Senate Floor because it has ‘been around’ since 2009 is outrageous,” McCain said. He also said the bill gives too much regulatory authority to DHS at the expense of the Defense Department and the National Security Agency, which he feels should have the lead in securing the information infrastructure.

“If the legislation before us today were enacted into law, unelected bureaucrats at the DHS could promulgate prescriptive regulations on American businesses,” and would create a “regulatory leviathan” that would stymie job creation, McCain said.

“Because of provisions like these and the threat of a hurried process,” McCain said he and other senior Republicans “are left with no choice but to introduce an alternative cybersecurity bill in the coming days. Our bill, which will be introduced when we return from the President’s Day recess, will provide a common-sense path forward to improve our nation’s cybersecurity defenses.”

In addition to McCain, the Senators who plan to introduce the competing legislation are Kay Bailey Hutchison of Texas, on the Commerce, Science and Transportation Committee; Chuck Grassley of Iowa, Judiciary; Saxby Chambliss of Georgia, Select Committee on Intelligence; Lisa Murkowski of Arkansas, Energy and Natural Resources; Jeff Sessions of Alabama, Budget; and Mike Enzi of Wyoming, Health, Education, Labor and Pensions.