Proposed bill would make DOD tell Congress when 'special cyber operations' are taking place

A bipartisan group of lawmakers from the House Armed Services Committee wants to codify a process that is currently done only as a courtesy.

There’s an oversight bill in the works that would compel the Defense Department to notify Congress when the military is engaged in sensitive cyber operations.

The bipartisan legislation, as it’s currently written, would require congressional notification when the Defense Department takes action in cyberspace under U.S. Code Title 10, which supervises operations led by Army, Navy, Air Force, Marine Corps, and Coast Guard, as well as the Reserves. Title 10 is unrelated to the U.S. government’s intelligence gathering mission set, which is led by federal organizations like the National Security Agency.

Sponsored by top House Armed Services Committee Reps. Elise Stefanik, R-N.Y., Mac Thornberry, R-Texas, Jim Langevin, D-R.I., and Adam Smith, D-Wash., the bill does not provide Congress with any additional authorization authority, but rather codifies an informal disclosure process that exists between the Defense Department and relevant congressional committees. There is no mention of a public disclosure element in the legislation, as much of the information discussed in these briefings would be presumably classified.

U.S. defense officials already notify lawmakers about such operations, but do so at their own discretion as there is no specific law currently in place to guide these private discussions.

Individuals with knowledge of the legislation say the bill’s introduction is motivated by the realization that conventional warfare is continuously changing and shifting to incorporate computer network operators. In addition, the expected elevation of U.S. Cyber Command, a nascent but growing force currently attached to the NSA, is prompting a response by lawmakers who look to streamline future communications and collaboration.

Stefanik first mentioned her intention to introduce this legislation during an opening statement at a House Armed Service Committee hearing Tuesday that hosted NSA Director Adm. Mike Rogers. The hearing was focused on U.S. Cyber Command’s 2018 budget request.

Architects of the bill plan to work directly with both U.S. Cyber Command and the Pentagon to finalize the legislation, “to ensure such notifications are responsive to our needs, but without adding undue reporting burdens on the Department of Defense,” Stefanik said Tuesday.

A timeline for the bill’s introduction remains unknown.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure