Biden signs infrastructure bill that provides nearly $2 billion for cybersecurity

The big-ticket cyber item in the Infrastructure Investment and Jobs Act is $1 billion in state and local grants.

President Joe Biden signed a $1 trillion infrastructure bill into law on Monday that includes nearly $2 billion for cybersecurity and related provisions.

The biggest piece of digital security funding is a Federal Emergency Management Agency cyber grant program, administered in consultation with the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, that would distribute $1 billion over four years to state and local governments. An additional $21 million would go toward the Office of the National Cyber Director, which has been unable to make key hires since being established earlier this year due to funding shortages.

In all, the legislation — known as the Infrastructure Investment and Jobs Act — is “the largest investment in the resilience of physical and natural systems in American history,” the White House boasted, one that “makes our communities safer and our infrastructure more resilient to the impacts of climate change and cyber-attacks.”

Lawmakers have proven eager this year to advance funding for CISA, and more money for cybersecurity could be on the way soon through the Build Back Better Act that could clear Congress as soon as this week.

In the meantime, the state and local grant funding in the infrastructure bill isn’t the only DHS cyber money. The law devotes $100 million over four years to a pot set aside for when DHS declares a “significant incident” that would allow CISA to allocate aid to the public and private sector. DHS’s science and technology wing would receive nearly $158 million for research in cybersecurity and related areas, while CISA would get $35 million for sector risk management work.

At the Energy Department, the legislation establishes two $250 million programs, one for rural and municipal utility security and another for grid security research and development. At the Environmental Protection Agency, the law would re-up or create programs meant to address water cybersecurity threats.

Some of the legislation’s changes don’t provide additional funding, but rather make it an option to use existing grants on cyber. For instance, current Department of Transportation grant programs for highway projects would allow states to deploy those funds for cybersecurity. It also creates a Federal Highway Administration cyber coordinator position.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems