Breach notification window, accountability are focus of coming fight on cyber legislation in Congress

Industry groups favor a House bill over a stricter Senate proposal.

Battle lines are drawn in Congress over legislation that would require companies to report some cyber incidents to the federal government, with industry groups lining up to support a House of Representatives bill poised to create fewer challenges for business leaders than a similar proposal in the Senate.

The debate involves questions about how quickly companies would have to report attacks, what kinds of specific intrusions would trigger notification and whether failure to comply with the rules would lead to financial penalties. The idea of breach notification legislation gained momentum following last year’s discovery of the SolarWinds hack that compromised nine federal agencies and some 100 companies, as well as the Colonial Pipeline ransomware attack in May.

At issue are such questions as whether companies have 24 or 72 hours to report an incident, along with who would be on the hook outside of critical infrastructure owners and operators, if anyone.

That industry groups prefer legislation that would create less of a burden on businesses is unsurprising. The hearing Wednesday, however, made clear the gulf between the two chambers’ leading proposals and the hurdles to passage despite the early momentum.

Banking, energy, information technology and telecommunications industry organizations told the House Homeland Security Committee’s cybersecurity subpanel that they largely favored provisions in draft legislation sponsored by New York Reps. Yvette Clarke, the Democrat who chairs that subcommittee, and John Katko, the top Republican on the full panel.

That House bill would give the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency the authority to determine when critical infrastructure business owners and operators must report breaches to CISA. The bill would forbid CISA from writing rules requiring that they do so within 72 hours.

A comparable Senate bill, sponsored by Intelligence Committee Chairman Mark Warner, D-Va. and bipartisan members of his panel, imposes reporting requirements on additional companies, such as incident response firms and government contractors. It would set a 24-hour deadline.

The 72-hour window is “feasible,” said John Miller, senior vice president and general counsel of the Information Technology Industry Council.

“Requiring an entity to report an incident on a shorter timeline may be insufficient for companies to determine the nature of the issue — is it a cyberattack or is it merely a network outage?” he said in written testimony.

A Senate aide countered that waiting 72 hours or longer could mean the incident had already spread and done major damage.

Ronald Bushar, vice president and government chief technology officer for FireEye Mandiant, told Clarke that he didn’t believe incident response firms — like his company — should be required to report clients’ incidents.

“You are in a situation of high trust with your clients,” Bushar said. “It puts us … in a real challenging position of betraying one trust to provide information to another partner.”

The differences go deeper, however.

The bill under discussion in the House would provide companies that share breach data protections against lawsuits, and specifies no punishments for not complying. The Senate bill authorizes financial penalties tied to a company’s gross revenue. Naturally, the private sector prefers not to face penalties, according to the Senate aide.

And while the Senate legislation leaves it to CISA to define what kinds of “cybersecurity incidents” trigger notification requirements, the House legislation defines them as those “likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.” Further, the Senate version requires reporting of confirmed and potential intrusions, while the House bill only applies to confirmed intrusions.

Mandates on reporting potential intrusions could do more harm than good, said Heather Hogsett, senior vice president for technology and risk strategy for BITS, the technology policy division of Bank Policy Institute.

“You’re going to wind up with a situation where CISA is deluged with information that’s not helpful to them, it’s not useful, and they also get bogged down with information that isn’t really the actual threats and the highest risks we want them and everyone else to focus on,” she said.

Whether reporting only confirmed incidents would provide sufficient protection remains unclear in an era defined by large, spiraling attacks, said Rep. Jim Langevin, D-R.I.

“I’m a bit concerned about the gap I see between the amount of information CISA needs to meaningfully improve the cybersecurity of our critical infrastructure sector, and the amount of data CISA would receive if it were only notified of confirmed cyber incidents,” he said.

A spokesperson for Warner said “We’ve had many productive meetings with stakeholders about the bill and continue to work through their feedback.”

Industry’s message on CIRCIA: Please ask us fewer questions about cyberattacks

The administration set a target date of September for CISA to finalize the rule, but where the agency is headed remains a mystery to some.

Open-source security is posing challenges governments can’t easily solve

Congress looks to revive critical cyber program for rural electric utilities

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure