II 

116TH CONGRESS 

1ST SESSION S. 890 

To authorize the Sergeant at Arms to protect the personal technology devices 

and accounts of Senators and covered employees from cyber attacks 

and hostile information collection activities, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 27, 2019 

Mr. WYDEN (for himself and Mr. COTTON) introduced the following bill; which 

was read twice and referred to the Committee on Rules and Administration 

A BILL 

To authorize the Sergeant at Arms to protect the personal 

technology devices and accounts of Senators and covered 

employees from cyber attacks and hostile information 

collection activities, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Senate Cybersecurity 

5 Protection Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act— 


kjohnson on DSK79L0C42 with BILLS
2 

•S 890 IS

1 (1) the term ‘‘covered employing office’’ 

2 means— 

3 (A) the personal office of a Senator; 

4 (B) the office of a committee of the Sen5 ate; 

6 (C) any other office of the Senate not de7 scribed in subparagraph (A) or (B); or 

8 (D) the office of a joint committee or joint 

9 commission; 

10 (2) the term ‘‘covered employee’’ means an indi11 vidual— 

12 (A) who is employed or serving in a posi13 tion as— 

14 (i) an officer or employee of a covered 

15 employing office; 

16 (ii) a detailee in a covered employing 

17 office, without regard to whether the serv18 ice is on a reimbursable basis; or 

19 (iii) a fellow in a covered employing 

20 office, without regard to whether the posi21 tion is compensated or the source of the 

22 compensation; 

23 (B) who is not a Senate authorizer; and 

24 (C) whom the covered employing office has 

25 determined is highly vulnerable to cyber attacks 


kjohnson on DSK79L0C42 with BILLS
3 

•S 890 IS

1 and hostile information collection activities be2 cause of the position of the individual; 

3 (3) the term ‘‘personal account’’ means an ac4 count for online or telecommunications services (in5 cluding telephone, residential internet access, email, 

6 text and multimedia messaging, cloud computing, so7 cial media, health care, and financial services)— 

8 (A) used by a Senate authorizer or covered 

9 employee; 

10 (B) that is not administered or operated 

11 by the Sergeant at Arms; and 

12 (C) with respect to which the parties sign13 ing the security memorandum of understanding 

14 as described in paragraph (6)(A) jointly agree 

15 that the Sergeant at Arms will provide security, 

16 in accordance with this Act; 

17 (4) the term ‘‘personal technology device’’— 

18 (A) means a handheld communications de19 vice, laptop computer, desktop computer, or 

20 other internet-connected device— 

21 (i) used by a Senate authorizer or cov22 ered employee; 

23 (ii) that is not provided to the Senate 

24 authorizer or covered employee, or admin25 istered, by the Sergeant at Arms; and 


kjohnson on DSK79L0C42 with BILLS
4 

•S 890 IS

1 (iii) with respect to which the parties 

2 signing the security memorandum of un3 derstanding as described in paragraph 

4 (6)(A) jointly agree that the Sergeant at 

5 Arms will provide security, in accordance 

6 with this Act; and 

7 (B) may, if agreed to by the parties pursu8 ant to the security memorandum of under9 standing, include any computer network to 

10 which a computer or device described in sub11 paragraph (A) connects; 

12 (5) the term ‘‘provide security’’ means to pro13 vide training, advice, support, technical assistance, 

14 and other services to prevent, detect, and recover 

15 from cyber attacks and hostile information collection 

16 activities; 

17 (6) the term ‘‘security memorandum of under18 standing’’ means a written memorandum of under19 standing that— 

20 (A) is signed by— 

21 (i) the Sergeant at Arms; 

22 (ii) the Senate authorizer or covered 

23 employee for whom the security will be 

24 provided pursuant to the memorandum; 

25 and 


kjohnson on DSK79L0C42 with BILLS
5 

•S 890 IS

1 (iii) if the security is being provided 

2 for a covered employee, the applicable Sen3 ate authorizer for the covered employee; 

4 (B) specifies the personal accounts or per5 sonal technology devices, or categories of per6 sonal accounts or personal technology devices, 

7 for which the Sergeant at Arms will provide se8 curity; 

9 (C) describes the rights and responsibilities 

10 of each signing party relating to the provision 

11 of security and with respect to privacy; and 

12 (D) shall be effective for a period of not 

13 more than 1 year; 

14 (7) the term ‘‘Senate authorizer’’— 

15 (A) means a Senator or the head of a Sen16 ate office described in paragraph (1)(C); 

17 (B) when used with respect to a covered 

18 employee not described in subparagraph (C), 

19 means the Senator or the head of a Senate of20 fice who has final authority to appoint, hire, 

21 discharge, and set the terms, conditions, or 

22 privileges of the employment of the covered em23 ployee; and 

24 (C) when used with respect to a covered 

25 employee of a joint committee or joint commisVerDate Sep 11 2014 03:10 Apr 04, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S890.IS S890

kjohnson on DSK79L0C42 with BILLS
6 

•S 890 IS

1 sion, the Senator from the majority party of the 

2 Senate who— 

3 (i) is a member of, or has authority 

4 over, the committee or commission; and 

5 (ii) serves in the highest leadership 

6 role for a Senator in the committee or 

7 commission or, if there is no such leader8 ship role, is the most senior Senator from 

9 the majority party of the committee or 

10 commission; and 

11 (8) the term ‘‘Sergeant at Arms’’ means the 

12 Sergeant at Arms and Doorkeeper of the Senate. 

13 SEC. 3. CYBERSECURITY ASSISTANCE FOR PERSONAL 

14 TECHNOLOGY DEVICES AND ACCOUNTS. 

15 (a) AUTHORIZATION.— 

16 (1) IN GENERAL.—Upon request by a Senate 

17 authorizer and upon the signing of a security memo18 randum of understanding by the parties described in 

19 section 2(6)(A), the Sergeant at Arms may use 

20 funds provided for official purposes in order to pro21 vide security for personal accounts and personal 

22 technology devices of the Senate authorizer or a cov23 ered employee of the Senate authorizer. 

24 (2) ANNUAL RENEWAL.—A Senate authorizer 

25 or covered employee for whom the Sergeant at Arms 


kjohnson on DSK79L0C42 with BILLS
7 

•S 890 IS

1 is providing security for personal accounts and per2 sonal technology devices under a security memo3 randum of understanding may continue to receive 

4 such security services under this Act if the applica5 ble signing parties described in section 2(6)(A) enter 

6 into a security memorandum of understanding each 

7 year. 

8 (b) AGGREGATE REPORTING.—By the date that is 2 

9 years after the date of enactment of this Act, and annually 

10 thereafter, the Sergeant at Arms shall prepare and submit 

11 to the Committee on Rules and Administration and the 

12 Select Committee on Intelligence of the Senate a report 

13 that includes aggregate statistics for the preceding fiscal 

14 year of the number of Senate authorizers and covered em15 ployees who entered into a security memorandum of un16 derstanding with the Sergeant at Arms and received secu17 rity assistance for their personal accounts and personal 

18 technology devices. 

19 (c) RULE OF CONSTRUCTION.—Nothing in this Act 

20 shall be construed to encourage any Senator or covered 

21 employee to conduct official Government business using 

22 a personal technology device. 

23 SEC. 4. ANNUAL GAO REPORTS ON CYBERSECURITY AND 

24 SURVEILLANCE THREATS. 

25 (a) ANNUAL REPORTS.— 


kjohnson on DSK79L0C42 with BILLS
8 

•S 890 IS

1 (1) IN GENERAL.—Beginning 180 days after 

2 the date of enactment of this Act, and annually 

3 thereafter, the Comptroller General of the United 

4 States shall prepare and submit, to the Committee 

5 on Rules and Administration and the Select Com6 mittee on Intelligence of the Senate, a report regard7 ing cybersecurity and surveillance threats to the leg8 islative branch. 

9 (2) STATISTICS.—Each report required under 

10 paragraph (1) shall include statistics on cyber at11 tacks, and other incidents of espionage or surveil12 lance targeted against Senators or the immediate 

13 families or staff of the Senators, in which the non14 public communications and other private information 

15 of such targeted individuals were lost, stolen, or oth16 erwise subject to unauthorized access by criminals or 

17 a foreign government. 

18 (b) CONSULTATION.—In preparing the report re19 quired under subsection (a), the Comptroller General shall 

20 consult with the Director of National Intelligence and the 

21 Sergeant at Arms. 

Æ 


kjohnson on DSK79L0C42 with BILLS