DHS tells Congress not to waste cybersecurity legislation bills with inaction

The Department of Homeland Security has been clear in sending a message to Congress: We are doing what we can, but we need your help.

The US Senate and House of Representatives have moved on several bills designed to address privacy issues and the cybersecurity of critical infrastructure, but no legislation has yet moved along to be signed into law before Congress adjourns for mid-term elections.

DHS Secretary Jeh C. Johnson said department has “reached a point that requires the help of Congress.”

“Within the federal government existing statutory authorities are unclear, and worse, do not adequately reflect the department’s role and responsibility for protecting the .gov network,” Johnson wrote in an op-ed to The Hill.

Johnson said Congress made progress on legislation, and then stalled, and “risks adjourning before their good work is signed into law.”

“All the bipartisan progress and hard work invested in cybersecurity legislation in the Congress should not go to waste,” he said.

Meanwhile, Suzanne Spaulding, DHS undersecretary for the National Protection and Programs Directorate told the Senate Committee on Homeland Security and Governmental Affairs that “carefully updating laws to facilitate cybersecurity information sharing is one of several legislative changes essential to improve the nation’s cybersecurity.”

“There is a continued need to increase the volume and speed of cyber threat information sharing between the government and the private sector—and among private-sector entities—with sacrificing the trust of the American people,” she said while also calling on lawmakers to pass legislation to define clearly define DHS’ role and give the department and law enforcement tools to fight cyber crime.

Spaulding told the Senate committee that the DHS’ National Cybersecurity and Communications Integration Center—which responds and coordinates national response to cyber incidents—has processed 612,000 cyber incidents and issued more than 10,000 alerts to public and private partners. She said NCCIC was given information by the US Secret Service on malware noticed in point-of-sale breaches. Working with the Financial Services Information Sharing and Analysis Center (FS-ISAC), detailed findings were published for US businesses to be able to identify and stop cyber breaches, mitigating potential losses.

NCCIC has detected more than 55,000 vulnerabilities and sent teams for technical assistance to 78 sites, Spaulding said.