The Strengthening American Cybersecurity Act, S. 3600, which the Senate passed on March 2, would require critical infrastructure companies to disclose cyberattacks and ransomware, as The Hill reports.
The required disclosures would be made to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
At a Senate hearing in September, as Politico reports, both CISA Director Jen Easterly and White House National Cyber Director Chris Inglis have vocally championed the legislative package. But after the measure’s passage in the Senate, Deputy Attorney General Lisa Monaco and FBI Director Christopher Wray have slammed the legislation, which doesn’t require reporting of hacks to their agencies. An FBI official reportedly warned that particular provisions might hobble the bureau’s ability to gather information from companies or stop cybercrime groups.
The White House has since maintained its support for the legislation, indicating it might be open to changes sought by the DOJ but not threatening that Biden would issue a veto without such changes. Homeland Security Chair Gary Peters (D-Mich.) and ranking member Rob Portman (R-Ohio) signaled no appetite for tweaking the package, which arose from months of congressional back-and-forth.
“It’s disappointing to see the FBI take a bureaucratic dispute public under the guise of a serious threat to public safety,” while Matthew Travis, a former deputy director of CISA, called the optics “awkward at best," Trey Herr, director of the Atlantic Council’s Cyber Statecraft Initiative, told Politico.
As CNN notes, the legislation would require operators of U.S. power plants, hospitals, ports and other infrastructure to notify CISA of cyber incidents within 72 hours and ransomware payments within 24 hours.
Following the criticisms, Easterly tweeted, “We have a terrific operational partnership w/our #FBI teammates & will continue to do so, to include always ensuring that cyber incident reporting received by @CISAgov is immediately shared with them.” She didn’t express support for amending legislation that she described as “a critical step forward in ensuring our nation’s security.”
The legislation was awaiting a vote in the House of Representatives.