Ed Royce

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, first of all, I will include in the Record a letter signed by myself and Mr. Engel to the Secretary of State. House of Representatives, Committee on Foreign Affairs, Washington, DC, December 10, 2014. Hon. John F. Kerry, Secretary of State, Department of State, Washington, DC. Dear Mr. Secretary: Today the House of Representatives will pass and send to the President S. 1683, a bill that bolsters allies Taiwan and Mexico with the transfer of U.S. Navy frigates and makes other changes to the law to enhance our security assistance to foreign partners. As you may know, section 201 of this legislation would amend section 36 of the Arms Export Control Act to require the President to notify Congress 30 days before shipments of certain defense articles if jointly requested to do so by the Chairman and Ranking Member of the House Committee on Foreign Affairs or the Senate Committee on Foreign Relations. It is our understanding that the Department may be concerned that this new congressional notification requirement could pose an undue burden on the administration of United States arms transfers. However, given the comprehensive exchange of information between the Department and the Committee during the congressional review process on U.S. arms sales, we would expect to invoke section 201 only in rare circumstances. For example, a similar authority in section 36(b)(1), providing for a request by the same committees of additional and highly detailed information from the President on a pending Foreign Military Sale, has been used only once in the last seven years. Likewise, we expect that the current protocols governing the notification of arms sales, a process by which sensitive national security and foreign policy questions are addressed informally before a notification is formally submitted for congressional review, will remain the preeminent means by which the Committee conducts oversight over United States arms transfer policy. We look forward to continuing to work with you on these important matters in the 114th Congress. Sincerely, Edward R. Royce, Chairman. Eliot L. Engel, Ranking Member.

Mr. ROYCE. Mr. Speaker, I move to suspend the rules and pass the bill (S. 1683) to provide for the transfer of naval vessels to certain foreign recipients, and for other purposes.

Mr. ROYCE. Mr. Speaker, I would say likewise to Mr. Vargas for his service on the committee. Mr. Speaker, I yield back the balance of my time.

Mr. ROYCE. Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, earlier this year, the Foreign Affairs Committee held a hearing examining the promises that were made under the Taiwan Relations Act. That was signed 35 years ago, and there are few pieces of legislation related to foreign policy that have been as consequential as Congress stepping in with this act 35 years ago. It is the steadfast support of the United States Congress that has helped Taiwan become what it is today: a thriving, modern society that strongly respects human rights, the rule of law, and free markets. Passage of this act is a step towards keeping the promises that we made to Taiwan 35 years ago in that Taiwan Relations Act, and I urge my colleagues to support this important legislation. I reserve the balance of my time.

Mr. ROYCE. Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and to include extraneous materials on the bill under consideration.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I ask unanimous consent that the Committee on Foreign Affairs be discharged from further consideration of the bill (H.R. 5816) to extend the authorization for the United States Commission on International Religious Freedom, and ask for its immediate consideration in the House.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I ask unanimous consent that when the House adjourns today, it adjourn to meet at 9 a.m. tomorrow.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I rise today to introduce the Cyber Supply Chain Management and Transparency Act of 2014, which is designed to address part of the matrix of ongoing vulnerabilities in our nation's government and cyber-infrastructure. This elegant approach emulates proven industry supply chain methods to stimulate the greatest cyber security impact with the least cost or disruption. Mr. Speaker, with around ninety percent of a modern software application made up of open source components, the problem of deployed software containing open source components with known vulnerabilities is one of great concern. One report showed seventy-one percent of all software applications built today contain an open source component with at least one known, critical vulnerability--and some in the government contain hundreds. Exploits against vulnerable applications bypass firewalls in place. Worse, in most cases, exploiting them is as easy as pointing and clicking on a free, downloadable attack tool that does all the work for even unskilled adversaries. Mr. Speaker, the nation's economy needs open source software development and applications built with it. We could not survive in our modern economy without it. It is precisely because of the importance of open source components to modern software development, that we need to insure integrity in the open source supply chain, so vulnerabilities are not populated throughout the hundreds of thousands of software applications that use open source components. If a building contained a similar critical flaw, it could collapse, or if a car contained a known defective part, it could be lead to fatalities and need to be recalled. Given both widely known and less public (but quite damaging) open source supply chain attacks that have been in the news over the last year, it is essential that the U.S. government begin to protect its cyber infrastructure, the data, and safety of its citizens from defective open source code containing known vulnerabilities. Here is a short list of some of the recent cyber attacks based on open source vulnerabilities: In July of 2013, vulnerable open source Struts 2 components allowed most major U.S. banks to be breached. In addition to the highly publicized Heartbleed, 30 additional vulnerabilities in OpenSSL have been reported in 2014 alone. Several of these flawed components found their way into even critical infrastructure industrial controls (e.g. SIEMENS). The ``ShellShock''/``BashBug'' attacks against bash leveraged mistakes in ``bash'' not noticed for over two decades, but is now affecting applications and embedded devices--some incapable of being updated. In December 2013, 6,916 different organizations downloaded a version of httpclient with a broken ssl validation (CVE-2012-5783)--66,824 times, more than one year after the NIST NVD alert. Bouncy Castle is an open source cryptography library used for applications requiring encryption. In 2013, 4,000 organizations downloaded a version of Bouncy Castle with a CVSS level 10 vulnerability 20,000 times--despite a fix being available for the last seven years. Over the last year, the most often downloaded open source components with severity 10 (CVSS) NIST security defects, were downloaded by an average of 28 thousand organizations worldwide including all of the top ten Federal service providers (integrators). This means, these 28,000 downloaded components by the top ten U.S. government software contractors are now in software being run by the Federal government (and this does not even include commercial software also leveraging known vulnerable third party and open source components). Some of these defective components are as old as 7 years, but they are still being leveraged. The CVE's in question are: CVE-2007-4575, CVE-2007-6721, CVE-2008- 5518, CVE-2010-2272, CVE-2010-2276, CVE-2012-0391, CVE-2012-0392, CVE- 2012-0838, CVE-2012-2379, CVE-2013-1777, CVE-2013-1965, CVE-2013-1966, CVE-2013-2115, CVE-2013-2134, CVE-2013-2135, CVE-2013-2251, CVE-2013- 4316 and CVE-2014-1202. Even one of the first founders of the open source movement was quoted in Wired Magazine, in an article titled, ``The Internet is Broken,'' under a section subtitled ``The Lie of Many Eyes'' putting some historic and practical perspective on the assertion that ``many eyes'' of open source component construction prevents vulnerabilities being introduced: ``For Robert Graham, the CEO of consultancy Errata Security, Shellshock gives lie to a major tenet of open- source software: that open-source code permits ``many eyes'' to view and then fix bugs more quickly than proprietary software, where the code is kept out of view from most of the world. It's an idea known as Linus's Law. ``If many eyes had been looking at bash over the past 25 years, these bugs would've been found a long time ago,'' Graham wrote on his blog last week. Linus Torvalds--the guy that Linus's Law is named after and the guy who created the Linux operating system--says that the idea still stands. But the fallacy is the idea that all open- source projects have many eyes. ``[There's a lot of code that doesn't actually get very many eyes at all,'' he says. ``And a lot of open-source projects don't actually have all that many developers involved, even when they are fairly core.'' Mr. Speaker, the purpose of the Cyber Chain Integrity Act of 2014 is to help defend the U.S. government cyber infrastructure, and for DHS to carry out its mandate. On a going-forward basis we need all contractors of software, firmware or products to the U.S. Government to: 1) provide the procuring agency with a bill of materials of all third party and open source components used--along with their version numbers; 2) demonstrate that those component versions have no known vulnerabilities (NIST CVEs) for which less vulnerable alternatives are available and where exceptions are required, a written justification must be provided and risk accepted by the agency granting the exception; 3) provide secure update mechanisms affording a prompt and agile response when new vulnerabilities are discovered in those products; and, 4) supply said fixes and remediation updates within a reasonable specified time frame. Put plainly: Tell us the ingredients, they can't be known to be bad, and they need to be updateable (as they may prove to be vulnerable in the future). Further, the bill calls for each U.S. government agency to create an internal process for reducing exposure in existing infrastructure and to support operational security in DHS, to: 1) assess and inventory all third party and open source components (with version numbers) in any critical software, firmware or products now in use; 2) develop a risk based plan to remediate known vulnerabilities in third party and open source components now in use; 3) identify un-patchable products to provide compensating controls or migration to patchable replacements; 4) maintain and report lists of components and versions in use for inclusion in a centralized DHS inventory for the purposes of operational risk assessment and incident response: a) Tactical Uses: Such a resource can more immediately answer ``Am I affected?'' and ``Where is remediation required?'' b) Strategic Uses: A central inventory would also support actionable metrics about projects & suppliers with regards to project & supplier integrity, defect rates, Mean Time To Remediate (MTTR), etc. to support future acquisition and supply chain choices. Mr. Speaker, physical building codes require a certain quality of steel be used for support beams, and dictate other requirements to ensure substandard building materials are not used in new construction. Similarly, cars must be recalled if they have defective parts (e.g. airbags). Restaurants must pass health code standards, and have specific hygiene and produce requirements so they do not make their customers sick. This bill requires suppliers to provide a confidential bill of materials (to the procuring agency) of open source components used in their products--just like an ingredients list on the food we buy at the grocery store (not the secret recipes). This bill does not ask for the source code or how the open source components work together, merely that the bill of materials be supplied to the agency procuring the products, and just like we demand of our cars, that these open source components contain no known defects or vulnerabilities to hackers. The bill also takes into account future discoveries of open source components with vulnerabilities, like the infamous ``Heartbleed'' vulnerability, and mandates that software applications be patchable, that is, these vulnerable components can be replaced with non- vulnerable components. Just like when you find out your car's brake lines need to be replaced, when an open source components are found to have a vulnerability or defect, it needs to be replaced. This bill will allow those patches to be applied. Unfortunately, the Heartbleed vulnerability revealed that many uses were not patchable in embedded devices (e.g.). Mr. Speaker, the scale of the number of open source components being downloaded and used in software applications has grown at an exponential rate. This year, it is expected that open source components will be downloaded more than 21 billion times, for use in software applications. Half a dozen years ago, roughly one billion were downloaded. The scope of the issue of open source component supply chain integrity is becoming more important as open source component use in software development explodes. Here is a quick summary of what the Cyber Supply Chain Management and Transparency Act of 2014 does: Ingredients: Anything sold to the federal government must provide a Bill of Materials of 3rd Party and Open Source Components (along with their versions) to the procuring agency. Hygiene & Avoidable Risk: Software cannot use vulnerable components for which a less vulnerable component is available (without a written and compelling justification accepted by procuring agency). Remediation: Software must be patchable/updateable--as new vulnerabilities will inevitably be revealed. Mr. Speaker, I look forward to working with my colleagues on the committees of jurisdiction and leadership to move forward on this proposal.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I rise in strong support of S. 2673, the U.S.-Israel Strategic Partnership Act. I'd like to note that the groundwork for this legislation was laid when the House-passed H.R. 938 by a vote of 410-1 in March. I would like to recognize the Gentlewoman from Florida, Ms. Ros-Lehtinen, and the Gentleman from Florida, Mr. Deutch, for their leadership in authoring that important measure. With passage of this legislation today, this bill now goes to the President's desk for his signature. I also want to thank the Ranking Member of the Committee, the Gentleman from New York, Mr. Engel, for his assistance in bringing this legislation to the floor and for his longstanding support for the State of Israel. Over the past two years, Mr. Engel and I have had the chance to travel twice to Israel together as Chair and Ranking Member, showing bipartisan support for the relationship. We witnessed together the many factors that drive our relationship. Israel is a pluralistic democracy which includes the freedoms we cherish: freedom of speech, freedom of religion, freedom of association, freedom of the press, and government by the consent of the governed. Our militaries hold combined exercises where they constantly learn from each other. A key collaboration here has been in missile defense. Jointly developed and produced by the U.S. and Israeli militaries, the Arrow defense system, Iron Dome, and David's Sling system--which is currently under development--will soon be combined to create the world's most sophisticated missile shields. And given the threats Israel faces, this is needed now more than ever. This summer, once again we saw how the Iron Dome helped save innocent Israeli lives, giving its leaders breathing room and preventing more bloodshed. Congress can be proud of its role in backing the Iron Dome. But we must always be working to ensure that our support for Israel keeps apace with the threats proliferating against the country--from Iran to Hamas. That is why today's legislation is important. Once signed into law, it will expedite the provision of critical security assistance to Israel by ushering in an expedited licensing regime and increasing the U.S. war reserves stockpile, for Israel to access, if needed. It will also require more frequent and detailed reporting on Israel's Qualitative Military edge--a provision which is the direct result of Mr. Collins' good efforts--so I thank the gentleman from Georgia for his contribution. Finally, the legislation will expand our cooperation with Israel on energy research and development. I urge all Members to support this legislation.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I want to recognize the efforts of the Transportation and Infrastructure Committee. Its leadership should be commended for this bipartisan effort to strengthen the Coast Guard in a time of heightened security threats to the United States. The Foreign Affairs Committee has been working in a bipartisan way to reform international food assistance, so I particularly appreciate the fact that this legislation does not include a provision that would have raised the cargo preference requirements for these programs from 50 percent to 75 percent. A provision like this would cost U.S. taxpayers millions more and slow lifesaving assistance by months. Lives are at stake, and I appreciate that the committee heard our view, and I also appreciate the assurances provided by the Transportation Committee that nothing in section 321 will drastically alter the existing consultation requirements for enforcement of cargo preference. I also understand that nothing in the bill will have the effect of raising cargo preference above an annual global threshold of 50 percent, particularly for the Food for Peace program. Again, congratulations to Chairman Hunter and his colleagues for crafting this important legislation and also Mr. Coble and Mr. Rahall for their work.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, Mr. Eliot Engel did something especially impactful. He quoted from the speech before the United Nations last year of Malala, in her own words. I thought I would just close by making her closing argument, which was: The extremists are afraid of books and pens. The power of education frightens them. They are afraid of women. The power of the voice of women frightens them. That is why they are blasting schools every day. Because they were and they are afraid of change, afraid of the equality that we will bring into our society. I ask for an ``aye'' vote. Mr. Speaker, I yield back the balance of my time.

Mr. ROYCE. Mr. Speaker, I yield such time as she may consume to the gentlewoman from Florida (Ms. Ros-Lehtinen), the chairwoman of the Foreign Affairs Subcommittee on the Middle East and North Africa, the author of this measure, but also, herself, a former educator who understands only too well the importance of this bill.

Mr. ROYCE. Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, I rise in strong support of the Malala Yousafzai Scholarship Act. I really want to thank the chairman emeritus of the Foreign Affairs Committee, Ms. Ros-Lehtinen. She authored this bill along with the gentlewoman from Texas (Ms. Granger) and our colleague from New York (Mrs. Lowey). Earlier this year, the Foreign Affairs Committee held a hearing on women's education which underscored the point at the heart of the bill: a modest investment in educating women and girls in the developing world, particularly in areas beset by poverty and radicalism, can pay long-term dividends that help stabilize societies, promote market-based economic growth, and advance U.S. national security objectives. I have for years expressed concern about the appalling state of education in places like Afghanistan and Pakistan and the subsequent rise of madrasas, those that prey upon the disenfranchised and breed radicalism. And what I am speaking of now are the Deobandi schools, not the other madrasa, but the Deobandi ones in particular. The situation for women in areas where access to education is actively suppressed is particularly grim. In Pakistan's northwest frontier province and in Balochistan, for example, literacy among women is between 3 and 8 percent--under 8 percent. I visited all-girl schools in Pakistan up in the northwest frontier only to learn later, when I came back for another visit, that they had been destroyed and it was no longer possible to visit that site. It is therefore fitting that this bill was named after Malala Yousafzai, who at the age of 15 dared to defy the Taliban and survived a brutal assassination attempt, and ultimately inspired a generation of women and girls to demand their fundamental right to be educated. She is known today for leading that effort. Just last month, Malala became the corecipient of this year's Nobel Peace Prize for her struggle, in her words, for the right of all children to education. This legislation requires that USAID award at least half of the scholarships made available through its existing Merit and Needs-Based Scholarship Program in Pakistan to women. It adds no new money to the program, but it provides support and policy guidance to make sure that these scholarships are now going half to women. The bill also emphasizes the importance of working with the Pakistani diaspora, those communities in the United States who already are doing so much back in Pakistan relating to education and to the medical colleges and universities. Tapping into this vast pool of expertise and resources will prove invaluable to our long-term commitment to promote educational opportunity for girls in Pakistan and elsewhere. Mr. Speaker, again, I want to thank my colleague from Florida (Ms. Ros-Lehtinen) for her leadership on this issue, and I reserve the balance of my time.

Mr. ROYCE. Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and include extraneous material.

Mr. ROYCE. Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 3583) to expand the number of scholarships available to Pakistani women under the Merit and Needs-Based Scholarship Program, as amended.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I yield 3 minutes to the gentleman from Florida (Mr. Clawson), a member of the Committee on Foreign Affairs and the Committee on Homeland Security.

Mr. ROYCE. Mr. Speaker, I yield the gentleman an additional 30 seconds.

Mr. ROYCE. Mr. Speaker, I yield myself 2 minutes to respond. One of the reasons the timing on this is important is because this is the timing that the Iranian regime has chosen to pass legislation that would protect those young men in the Basij who carry out these acid attacks against women. One of the reasons I am bringing this bill to the floor is because I am concerned about what it tells us about a regime that, rather than come to the defense of these women who admittedly were in violation of the dress code in terms of their facial, in terms of their mode of dress, to allow individuals in a theocratic country to make the decisions that they are the arbitrator of what is shari'a law and then to exonerate them by saying it is the right of the individual to step in against another and enforce shari'a law rather than have the state do it, this is a theocratic state that is taking a principle against the individual, against individual freedom, and especially against rights of women to an extra step that is so injurious to human liberty, but also the fact that they would do this now and that they would be so unconcerned that we might not even respond to this or that the international community would have a reaction to this, I think it demands a reaction. Because if we do not, in the court of international opinion, hold them to account for these kinds of acts in their Parliament, what is the message that is given to those who are encouraged to further violate women's rights and minority rights in Iran? That is why I am pushing this bill today. Mr. Speaker, I had a conversation a little over a week ago with a group of Iranian American women about their experiences in Iran and their reaction to this parliamentary act and their reaction to the acid attacks which are increasing in number to a truly alarming percentage. There have been over a dozen of these now. So that is why the timing of the legislation. It is in response to this. In the process, it catalogs the other abuses that the regime recently has undertaken under President Rouhani at a time when we thought they might put a different foot forward to the international community. Mr. Speaker, I reserve the balance of my time to close.

Mr. ROYCE. Mr. Speaker, there were observers that were tempted to believe that Iran's President Rouhani would usher in a more tolerant attitude at home. I think many of us suspected that might be the case because he did occasionally offer less antagonistic rhetoric than his predecessor, even if he had had the history he did have in the security services. But it turns out that was wrong. That assumption was wrong. In a new report, the U.N. Special Rapporteur has documented an alarming increase in the number of executions, including political prisoners, juveniles, and religious minorities, such as the peaceful Baha'i, since President Rouhani took office in August of 2013. The motif of this regime is becoming a religious dissident swinging by the neck from a crane, if you watch the news coming out of Iran. I won't again articulate my concerns about these acid attacks that are going on, but this comes, I think, at a time when millions of Iranians yearn for basic freedoms--basic freedoms--that we in the West take for granted. Mr. Speaker, I think it is incumbent upon all of us, as the House is doing today, to stand with the people of Iran who suffer under this theocracy and to speak out. I yield back the balance of my time.

Mr. ROYCE. Mr. Speaker, I yield 3 minutes to the gentleman from Pennsylvania (Mr. Perry), a member of the Foreign Affairs, Homeland Security, and Transportation Committees.

Mr. ROYCE. Mr. Speaker, I yield 3 minutes to the gentleman from New Jersey (Mr. Smith), the chairman of the Foreign Affairs Subcommittee on Africa, Global Health, Global Human Rights, and International Organizations.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I yield such time as he may consume to the gentleman from Ohio (Mr. Chabot), chairman of the Foreign Affairs Subcommittee on Asia and the Pacific, and the author of this particular bill.

Mr. ROYCE. Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and also to include any extraneous material for the Record on the bill.

Mr. ROYCE. Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, I rise today in strong support of this measure. It is called the Girls Count Act, and I do want to thank Mr. Chabot of Ohio for his work on this important piece of legislation. Now, what this does is it aims to increase birth registration rates in developing countries. And usually the births which are not being registered are infant females. Nearly one-third of all children around the world have never had their births registered by their country's civil registries. Almost hard for us to recognize here--one-third. A child whose birth is not recorded has no birth certificate to prove her age or his age or parentage or citizenship, making these children especially vulnerable to violations of their basic rights. The lack of a birth certificate usually prevents individuals from acquiring essential pieces of identification that you are going to need in life--like a driver's license, like a passport--and can also impede any financial transaction you are going to make--taking out a loan, taking out a mortgage. Basically, these girls, tragically, don't count. For girls in particular, this lack of documentation can undercut existing legal protections against girls being trafficked or made child brides. And as they grow up, girls without an official identity face high barriers to work, high barriers to education or political participation, and all of this in places where we need women and girls to be actively shaping their country's future, to improve prospects for development, to oppose extremism in their communities. That is why I am pleased that the House is acting on H.R. 3398, because this bill supports efforts to increase birth registration by encouraging the State Department and USAID to work with countries on improving their civil registries. The bill promotes the development of laws and policies to prevent discrimination against girls and improve property and inheritance rights for women. And lastly, the legislation requires the State Department and USAID to provide more relevant breakdowns of foreign assistance whenever possible so that we can be sure women and girls are from benefiting from our efforts. So this bill complements other work that the House has done this Congress, particularly our efforts to combat child trafficking and to promote safe international adoptions. Ensuring that every boy and girl is counted can prevent children from being trafficked or prevent them from being exploited or denied a loving home. I am proud of the House's work thus far to address this critical issue. I believe that this bill in particular is another step in advancing this agenda, and that is why I would just like to recognize Mr. Chabot for all of the work he put into it and, as well, of course, to recognize Mr. Engel's contribution. Mr. Speaker, I reserve the balance of my time.

Mr. ROYCE

Mr. ROYCE. Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 5681) to provide for the approval of the Amendment to the Agreement Between the Government of the United States of America and the Government of the United Kingdom of Great Britain and Northern Ireland for Cooperation on the Uses of Atomic Energy for Mutual Defense Purposes.