Michael McCaul

Mr. McCAUL

Mr. McCAUL. The gentleman from New York is correct regarding the nature of the threat. However, the activities he has discussed were authorized by Congress last Congress with a bill that I sponsored. In addition, the bill currently before the House strengthens those provisions. This bipartisan bill passed out of committee unanimously. This motion is nothing more than an eleventh hour attempt to bring down the bill that we worked so hard on to get to this point where we are today. Mr. Speaker, people always ask me what keeps me up at night. In addition to the kinetic threats posed by al Qaeda and ISIS, it is a cyber attack against our Nation that concerns me the most. This legislation is necessary to protect Americans. Every day, America is under attack. Our offensive capabilities are strong, but our defensive capabilities are weak. The attacks on Target and Home Depot stole the personal information and credit cards of millions of Americans. The cyber breach at Anthem compromised the healthcare accounts of 80 million individuals, impacting one out of every four Americans in the most private way. North Korea's destructive attack on Sony attempted to chill our freedom of speech. Russia and China continue to steal our intellectual property and conduct espionage against our Nation. General Alexander described this as ``the greatest transfer of wealth in history.'' At the same time, Iran attacks our financial sector on a daily basis in response to the sanctions. We also face a growing threat from cyberterrorists, like the ISIS sympathizers who hacked into USCENTCOM's social media account. Terrorists and state sponsors of terror, like Iran, want nothing more than to carry out a destructive cyber attack to bring things down in the United States, including our power grids. This bill protects our Nation's networks, both public and private, by removing legal barriers to the sharing of threat information. The bill is voluntary. It is both proprivacy and prosecurity and has widespread support from industry. It allows us to obtain the keys for information sharing, to lock the door, and to keep these nation-states and criminals out. We cannot send a signal of weakness to our adversaries. Many, Mr. Speaker, refer to the threat of a cyber Pearl Harbor. My father, part of the Greatest Generation, was a bombardier in a B-17 during World War II. He participated in the air campaign in advance of the D-day invasion against the Nazis. Today a new generation faces different threats to our national security, and we must protect America in this new frontier. We now live in a new threat environment where digital bombs can go undetected and cause massive devastation. This bill will defend America from these attacks. Inaction today, Mr. Speaker, would be nothing short of reckless. It is urgent that we pass this bill today, for if Congress fails to act and the United States is attacked, then Congress will have that on its hands. I urge my colleagues to vote against the motion to recommit and support this bill. I yield back the balance of my time.

Mr. McCAUL. Mr. Speaker, I demand a recorded vote.

Mr. McCAUL. Will the gentleman yield?

Mr. McCAUL. Mr. Chairman, I support this amendment, which will modify the Information Sharing Structure and Processes section of the bill relating to the National Cybersecurity and Communications Integration Center's, or NCCIC's, Industrial Control System. The Cyber Emergency Response Team, ICS-CERT. This amendment directs the ICS-CERT to remain current on ICS innovation, industry adoption of new technologies, and industry best practices. This amendment directs the ICS-CERT to keep abreast of new, innovative technologies. This will enable the ICS-CERT to respond, when requested, with the latest and most current technologies and practices. It is a good amendment. I thank the gentlewoman for bringing it. I urge my colleagues to support this amendment, and I yield back the balance of my time.

Mr. McCAUL. Mr. Chairman, I support this bipartisan language that will help clarify language in both the Homeland Security Act and this bill by narrowing the definition of the word ``incident'' to ensure that a cybersecurity incident is limited to actions taken against an information system or information stored on that system. This amendment ensures that information shared with the NCCIC or other private entities is limited to threats to and actions against information systems and information stored on that system. I also want to thank the gentleman from California (Mr. McClintock) for being a leader on this issue and for calling this loophole, if you will, to the attention of the committee to make this a stronger bill on this floor.

Mr. McCAUL. Will the gentleman yield?

Mr. McCAUL. I thank the gentleman for yielding. I would just like to highlight for all my colleagues the great work that we do in the Cybersecurity Caucus with my good friend and colleague from Rhode Island. The briefings we host every few weeks bring some of the brightest minds in both government and the private sector to the Hill to educate Members and staff on this national security issue. When we first started the caucus in 2008, cyber was a topic very few Members knew anything about. It wasn't really cool to know about cybersecurity. We have made great progress, I believe, the gentleman and I, since that time in raising the level of debate, engagement, awareness, and education with the Members on this critical subject. I hope that the Members and the staff will continue to take advantage of the opportunities afforded by our caucus as our lives become even more interconnected in cyberspace. I think this issue has never been more relevant and more of a threat, quite frankly, than it is today.

Mr. McCAUL. Mr. Chairman, I yield back the balance of my time.

Mr. McCAUL. Mr. Chairman, I ask unanimous consent to claim the time in opposition, though I am not opposed to the amendment.

Mr. McCAUL. Mr. Chairman, I yield 5 minutes to the gentleman from Georgia (Mr. Loudermilk), a member of the Committee on Homeland Security.

Mr. McCAUL. I yield the gentleman an additional 30 seconds.

Mr. McCAUL. Mr. Chairman, I have no further requests for time. I am prepared to close if the gentleman from Mississippi is prepared to close. I reserve the balance of my time.

Mr. McCAUL. Mr. Chairman, I yield myself such time as I may consume. Mr. Chairman, we are at a pivotal moment today and face a stark reality. The cyber threats to America have gone from bad to severe, and in many ways, we are flying blind. The current level of cyber threat information sharing won't cut it. In the same way that we failed to stop terrorist attacks in the past, we are not connecting the dots well enough to prevent digital assaults against our Nation's networks. The information we need to stop destructive breaches is held in silos, rather than being shared, preventing us from mounting an aggressive defense. In fact, the majority of cyber intrusions go unreported, leaving our networks vulnerable to the same attacks. When sharing does happen, it is often too little and too late. If we don't pass this legislation to enhance cyber threat information sharing, we will be failing the American people and ceding more ground to our adversaries. I hope, today, that we have the momentum to reverse the tide and to do what the American people expect of us, pass prosecurity, proprivacy legislation to better safeguard our public and private networks. Our inaction would be a permission slip for criminals, hacktivists, terrorists, and nation-states to continue to steal our data and to do our people harm. I appreciate the collaboration from Members across the aisle and from other committees in developing this legislation. I would like to specifically commend, again, subcommittee Chairman Ratcliffe for his work on this bill, as well as our minority counterparts, including Ranking Member Thompson and subcommittee Ranking Member Richmond for their joint work on this bill. Mr. Chairman, I urge my colleagues to pass H.R. 1731. I yield back the balance of my time.

Mr. McCAUL. Mr. Chairman, I yield myself such time as I may consume. The manager's amendment to H.R. 1731 further clarifies the intent of several important provisions of the bill. These modifications were made in consultation with privacy groups, industry leaders, and both the House Intelligence Committee and House Judiciary Committee. Among the more notable changes made are: the expansion of protections for personally identifiable information to include the ``exclusion'' of information and not just the ``removal'' of information, a modification to clarify that the use of cyber threat indicators and defensive measures is limited to the purposes authorized in the bill only, and clarifying language to say that identifying the origin of a cybersecurity threat is a valid ``cybersecurity purpose.'' Each of these changes, along with the others made in the manager's amendment, strengthen the bill and further support the committee's mission to help protect America's networks and systems from cyber attacks while, at the same time, ensuring that an individual's private information enjoys robust protection as well. Mr. Chairman, I yield back the balance of my time.

Mr. McCAUL. Mr. Chairman, I ask unanimous consent to claim the time in opposition, though I am not opposed to the amendment.

Mr. McCAUL. Mr. Chairman, I support this amendment, which would clarify that the term ``cybersecurity risk'' does not apply to actions solely involving violations of consumer terms of service or consumer licensing agreements. This amendment will protect consumers from having information shared with the government due to a minor or unwitting violation of the terms of service, such as a violation of one's Apple iTunes agreement, which my teenage daughters would appreciate. This amendment and this bill are meant to enhance the sharing of cybersecurity information within the government and the public. In order to promote voluntary sharing, the public needs to feel confident that the sole act of violating a terms of service or licensing agreement won't be shared with the NCCIC and that this bill is not a tool to enforce violations regarding terms of service or licensing agreements. These violations have robust legal remedies in place and should be handled through those channels. I think this strengthens the bill, and I appreciate the gentleman's amendment to do so. I support this amendment. I reserve the balance of my time.

Mr. McCAUL. Mr. Chairman, I ask unanimous consent to claim the time in opposition, though I am not opposed to the amendment.

Mr. McCAUL. Mr. Chairman, I ask unanimous consent to claim the time in opposition, although I am not opposed to the amendment.

Mr. McCAUL

Mr. McCAUL. Mr. Chairman, I yield myself such time as I may consume. I am pleased to bring to the floor H.R. 1731, the National Cybersecurity Protection Advancement Act, a proprivacy, prosecurity bill that we desperately need to safeguard our digital networks. I would like to commend the subcommittee chairman, Mr. Ratcliffe, for his work on this bill as well as our minority counterparts, including Ranking Member Thompson and subcommittee Ranking Member Richmond for their joint work on this bill. This has been a noteworthy, bipartisan effort. I would also like to thank House Permanent Select Committee on Intelligence Chairman Devin Nunes and Ranking Member Adam Schiff for their input and collaboration. Lastly, I would like to thank Committee on the Judiciary Chairman Goodlatte and Ranking Member Conyers for their contribution. Make no mistake, we are in the middle of a silent crisis. At this very moment, our Nation's businesses are being robbed, and sensitive government information is being stolen. We are under siege by a faceless enemy whose tracks are covered in cyberspace. Sophisticated breaches at companies like Anthem, Target, Neiman Marcus, Home Depot, and JPMorgan have compromised the personal information of millions of private citizens. Nation-states like Iran and North Korea have launched digital bombs to get revenge at U.S.- based companies, while others like China are stealing intellectual property. We recently witnessed brazen cyber assaults against the White House and the State Department, which put sensitive government information at risk. In the meantime, our adversaries have been developing the tools to shut down everything from power grids to water systems so they can cripple our economy and weaken our ability to defend the United States. This bill will allow us to turn the tide against our enemies and ramp up our defenses by allowing for greater cyber threat information sharing. This bill will strengthen the Department of Homeland Security's National Cybersecurity and Communications Integration Center, or NCCIC. The NCCIC is a primary civilian interface for exchanging cyber threat information, and for good reason. It is not a cyber regulator. It is not looking to prosecute anyone, and it is not military or a spy agency. Its sole purpose, Mr. Chairman, is to prevent and respond to cyber attacks against our public and private networks while aggressively protecting Americans' privacy. Right now we are in a pre-9/11 moment in cyberspace. In the same way legal barriers and turf wars kept us from connecting the dots before 9/ 11, the lack of cyber threat information sharing makes us vulnerable to an attack. Companies are afraid to share because they do not feel they have the adequate legal protection to do so. H.R. 1731 removes those legal barriers and creates a safe harbor, which will encourage companies to voluntarily exchange information about attacks against their networks. This will allow both the government and private sector to spot digital attacks earlier and keep malicious actors outside of our networks and away from information that Americans expect to be defended. This bill also puts privacy and civil liberties first. It requires that personal information of our citizens be protected before it changes hands--whether it is provided to the government or exchanged between companies--so private citizens do not have their sensitive data exposed. Significantly, both industry and privacy groups have announced their support for this legislation because they recognize that we need to work together urgently to combat the cyber threat to this country. Today, we have a dangerously incomplete picture of the online war being waged against us, and it is costing Americans their time, money, and jobs. It is time for us to safeguard our digital frontier. This legislation is a necessary and vital step to do exactly that. Mr. Chairman, before I reserve the balance of my time, I would like to enter into the Record an exchange of letters between the chairman of the Committee on the Judiciary, Mr. Goodlatte, and myself, recognizing the jurisdictional interest of the Committee on the Judiciary in H.R. 1731. U.S. House of Representatives, Committee on the Judiciary, Washington, DC, April 21, 2015. Hon. Michael McCaul, Chairman, Committee on Homeland Security, Washington, DC. Dear Chairman McCaul: I am writing with respect to H.R. 1731, the ``National Cybersecurity Protection Advancement Act of 2015.'' As a result of your having consulted with us on provisions in H.R. 1731 that fall within the Rule X jurisdiction of the Committee on the Judiciary, I agree to waive consideration of this bill so that it may proceed expeditiously to the House floor for consideration. The Judiciary Committee takes this action with our mutual understanding that by foregoing consideration of H.R. 1731 at this time, we do not waive any jurisdiction over the subject matter contained in this or similar legislation, and that our Committee will be appropriately consulted and involved as the bill or similar legislation moves forward so that we may address any remaining issues in our jurisdiction. Our Committee also reserves the right to seek appointment of an appropriate number of conferees to any House-Senate conference involving this or similar legislation, and asks that you support any such request. I would appreciate a response to this letter confirming this understanding, and would ask that a copy of our exchange of letters on this matter be included in the Congressional Record during Floor consideration of H.R. 1731. Sincerely, Bob Goodlatte, Chairman.

Mr. McCAUL. Mr. Chairman, I yield such time as she may consume to the gentlewoman from Michigan (Mrs. Miller), the vice chairman of the Homeland Security Committee.

Mr. McCAUL. Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days within which to revise and extend their remarks and include extraneous materials on the bill, H.R. 1731.

Mr. McCAUL. With that, I urge my colleagues to support this important legislation. I reserve the balance of my time.

Mr. McCAUL. Will the gentleman yield?

Mr. McCAUL. Mr. Chair, I thank the gentleman from Mississippi for his question and would say that I do not completely share your view of that clause. I assure you that incentivizing companies to do nothing with timely threat information is certainly not the intent of this provision, as the author of this bill. On the contrary, I believe it is important that we provide companies with legal safe harbors to encourage sharing of cyber threat information and also believe that every company that participates in this information-sharing process, especially small- and medium-sized businesses, cannot be required to act upon every piece of cyber threat information they receive. As such, I support looking for ways to clarify that point with you, Mr. Thompson. I commit to working with you as this bill moves forward to look for ways to refine the language to ensure that it is consistent with our shared policy goal of getting timely information into the hands of businesses so that they can protect their networks and their data.

Mr. McCAUL. Mr. Chairman, I now yield 5 minutes to the gentleman from Texas (Mr. Ratcliffe), the chairman of the Subcommittee on Cybersecurity, my close ally and colleague on this legislation.