The chairman of the Senate Homeland Security and Governmental Affairs Committee on Wednesday threw his support behind a key recommendation of a cyber security panel that is calling for a Senate-confirmed position within the White House to be the president's top adviser on cyber security and coordinate cyber policy and strategies across the government.
But Sen. Ron Johnson (R-Wis.) also wants the Cyberspace Solarium Commission to help Congress with the details of how the National Cyber Director (NCD) and related Office of the National Cyber Director should be structured.
The hope is to get legislation for the NCD into this year's National Defense Authorization Act (NDAA) to "put somebody in charge" of overall cyber security policy and strategy but "Exactly how to set it up is complex." He spoke during a virtual hearing his committee held to review the commission's report.
Johnson said he signed up to a recent letter that Sen. Mike Rounds (R-S.D.), a member of the Senate Armed Services Committee, is planning to send to the commission asking for answers to a number of questions about the proposed position and related office. Johnson said the letter seeks answers to questions like in what part of the administration the director should be established so "that they can have the maximum positive impact."
In his opening statement released for the record, Johnson said the "outstanding" questions include how the NCD "would be involved in defensive cyber operations," budget reviews and thwarting the theft of intellectual property. On top of these, there needs to be consensus on the "scope of authorities and powers a National Cyber Director would need to be successful," he said, adding that the NCD needs to be able to "cut through the bureaucracy, not add to it."
Sen. Angus King (I-Maine), co-chair of the commission, told Johnson that he spoke with Rounds last week and said the "questions are good ones" and that the commission will provide answers "and try to flesh out some of the details of how this new office would work."
The commission in March reported its findings following a year-long effort after being stood up as part of the fiscal year 2019 NDAA. The recommendation for the NCD and related office highlights competition among different agencies and departments for cyber security "resources and power," adding of the new position that "More consolidated accountability for harmonizing the executive branch's policies, budgets, and responsibilities in cyberspace while it implements strategic guidance from the President and Congress is needed to achieve coherence in the planning, resourcing, and employing of government cyber resources."
In its report, the commission calls for the establishment of the NCD within the executive office of the president, for the position to report directly to the president, and to have oversight of cyber security budgets of executive branch agnencies. In addition, the NCD would be on the National Security Council for cyber security and related emerging technology issues.
Johnson also highlighted a recommendation by the commission for the Department of Homeland Security's Cybersecurity and Infrastructure Security (CISA) agency to have administrative subpoena authority to warn owners and operators of critical infrastructures of cyber vulnerabilities the agency has found on their systems. CISA is able to discover the vulnerabilities but isn't able to identify the owners and operators without help from internet service providers associated with an affected internet protocol address.
Johnson's committee and the House Homeland Security Committee this year both passed bills providing CISA with the subpoena power.
Rep. Mike Gallagher (R-Wis.), the commission's other co-chair, replied to a question from Johnson about the prospects in the House for the subpoena legislation that he can't assess them now but said the commission is leveraging the influence of Rep. Jim Langevin (D-R.I.), a "champion" of the bill, within the Democratic caucus. Langevin is behind the bill that passed the House Homeland Security Committee.
Johnson asked Gallagher to "spearhead" efforts in the House to ensure common language between the bills, saying his goal is to get it attached to the NDAA.