I 

116TH CONGRESS 

1ST SESSION H. R. 3907 

To amend the Homeland Security Act of 2002 to establish the Insider 

Threat Program, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 23, 2019 

Mr. KING of New York (for himself, Mr. GREEN of Tennessee, and Mr. 

WALKER) introduced the following bill; which was referred to the Committee on Homeland Security 

A BILL 

To amend the Homeland Security Act of 2002 to establish 

the Insider Threat Program, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Home5 land Security Insider Threat and Mitigation Act of 2019’’. 

6 SEC. 2. ESTABLISHMENT OF INSIDER THREAT PROGRAM. 

7 (a) IN GENERAL.—Title I of the Homeland Security 

8 Act of 2002 (6 U.S.C. 111 et seq.) is amended by adding 

9 at the end the following new section: 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3907 IH

1 ‘‘SEC. 104. INSIDER THREAT PROGRAM. 

2 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab3 lish an Insider Threat Program within the Department. 

4 Such Program shall— 

5 ‘‘(1) provide training and education for Depart6 ment personnel to identify, prevent, mitigate, and re7 spond to insider threat risks to the Department’s 

8 critical assets; 

9 ‘‘(2) provide investigative support regarding po10 tential insider threats that may pose a risk to the 

11 Department’s critical assets; and 

12 ‘‘(3) conduct risk mitigation activities for in13 sider threats. 

14 ‘‘(b) STEERING COMMITTEE.— 

15 ‘‘(1) IN GENERAL.—The Secretary shall estab16 lish a Steering Committee within the Department. 

17 The Under Secretary for Intelligence and Analysis 

18 shall serve as the Chair of the Steering Committee. 

19 The Chief Security Officer shall serve as the Vice 

20 Chair. The Steering Committee shall be comprised 

21 of representatives of the Office of Intelligence and 

22 Analysis, the Office of the Chief Information Officer, 

23 the Office of the General Counsel, the Office for 

24 Civil Rights and Civil Liberties, the Privacy Office, 

25 the Office of the Chief Human Capital Officer, the 

26 Office of the Chief Financial Officer, the Federal 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 3907 IH

1 Protective Service, the Office of the Chief Procure2 ment Officer, the Science and Technology Direc3 torate, and other components or offices of the De4 partment as appropriate. Such representatives shall 

5 meet on a regular basis to discuss cases and issues 

6 related to insider threats to the Department’s crit7 ical assets, in accordance with subsection (a). 

8 ‘‘(2) RESPONSIBILITIES.—Not later than one 

9 year after the date of the enactment of this section, 

10 the Under Secretary for Intelligence and Analysis 

11 and the Chief Security Officer, in coordination with 

12 the Steering Committee established pursuant to 

13 paragraph (1), shall carry out the following: 

14 ‘‘(A) Develop a holistic strategy for De15 partment-wide efforts to identify, prevent, miti16 gate, and respond to insider threats to the De17 partment’s critical assets. 

18 ‘‘(B) Develop a plan to implement the in19 sider threat measures identified in the strategy 

20 developed under subparagraph (A) across the 

21 components and offices of the Department. 

22 ‘‘(C) Document insider threat policies and 

23 controls. 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 3907 IH

1 ‘‘(D) Conduct a baseline risk assessment of 

2 insider threats posed to the Department’s crit3 ical assets. 

4 ‘‘(E) Examine existing programmatic and 

5 technology best practices adopted by the Fed6 eral Government, industry, and research insti7 tutions to implement solutions that are vali8 dated and cost-effective. 

9 ‘‘(F) Develop a timeline for deploying 

10 workplace monitoring technologies, employee 

11 awareness campaigns, and education and train12 ing programs related to identifying, preventing, 

13 mitigating, and responding to potential insider 

14 threats to the Department’s critical assets. 

15 ‘‘(G) Require the Chair and Vice Chair of 

16 the Steering Committee to consult with the 

17 Under Secretary for Science and Technology 

18 and other appropriate stakeholders to ensure 

19 the Insider Threat Program is informed, on an 

20 ongoing basis, by current information regarding 

21 threats, beset practices, and available tech22 nology. 

23 ‘‘(H) Develop, collect, and report metrics 

24 on the effectiveness of the Department’s insider 

25 threat mitigation efforts. 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 3907 IH

1 ‘‘(c) DEFINITIONS.—In this section: 

2 ‘‘(1) CRITICAL ASSETS.—The term ‘critical as3 sets’ means the people, facilities, information, and 

4 technology required for the Department to fulfill its 

5 mission. 

6 ‘‘(2) INSIDER.—The term ‘insider’ means— 

7 ‘‘(A) any person who has access to classi8 fied national security information and is em9 ployed by, detailed to, or assigned to the De10 partment, including members of the Armed 

11 Forces, experts or consultants to the Depart12 ment, industrial or commercial contractors, li13 censees, certificate holders, or grantees of the 

14 Department, including all subcontractors, per15 sonal services contractors, or any other category 

16 of person who acts for or on behalf of the De17 partment, as determined by the Secretary; or 

18 ‘‘(B) State, local, Tribal, territorial, and 

19 private sector personnel who possess security 

20 clearances granted by the Department. 

21 ‘‘(3) INSIDER THREAT.—The term ‘insider 

22 threat’ means the threat that an insider will use his 

23 or her authorized access, wittingly or unwittingly, to 

24 do harm to the security of the United States, includ25 ing damage to the United States through espionage, 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 3907 IH

1 terrorism, the unauthorized disclosure of classified 

2 national security information, or through the loss or 

3 degradation of departmental resources or capabili4 ties.’’. 

5 (b) REPORTING.— 

6 (1) IN GENERAL.—Not later than two years 

7 after the date of the enactment of section 104 of the 

8 Homeland Security Act of 2002 (as added by sub9 section (a) of this section) and biennially thereafter 

10 for the next four years, the Secretary of Homeland 

11 Security shall submit to the Committee on Home12 land Security and the Permanent Select Committee 

13 on Intelligence of the House of Representatives and 

14 the Committee on Homeland Security and Govern15 mental Affairs and the Select Committee on Intel16 ligence of the Senate a report on how the Depart17 ment of Homeland Security and its components and 

18 offices have implemented the strategy developed pur19 suant to subsection (b)(2)(A) of such section 104, 

20 the status of the Department’s risk assessment of 

21 critical assets, the types of insider threat training 

22 conducted, the number of Department employees 

23 who have received such training, and information on 

24 the effectiveness of the Insider Threat Program (es25 tablished pursuant to subsection (a) of such section 


kjohnson on DSK79L0C42 with BILLS
7 

•HR 3907 IH

1 104), based on metrics developed, collected, and re2 ported pursuant to subsection (b)(2)(H) of such sec3 tion 104. 

4 (2) DEFINITIONS.—In this subsection, the 

5 terms ‘‘critical assets’’, ‘‘insider’’, and ‘‘insider 

6 threat’’ have the meanings given such terms in sec7 tion 104 of the Homeland Security Act of 2002 (as 

8 added by subsection (a) of this section). 

9 (c) CLERICAL AMENDMENT.—The table of contents 

10 in section 1(b) of the Homeland Security Act of 2002 is 

11 amended by inserting after the item relating to section 

12 103 the following new item: 

‘‘Sec. 104. Insider Threat Program.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS