Department of Homeland Security Insider Threat and Mitigation Act of 2016

Bill: 114-hr-3361
Sponsor: Rep. King, Peter T. [R-NY-2]
Introduced: 2015-07-29 in the House
Policy area: Emergency Management
Subjects: Computer security and identity theft
Computers and information technology
Congressional oversight
Department of Homeland Security
Espionage and treason
Executive agency funding and structure
Government employee pay, benefits, personnel management
Government studies and investigations
Intelligence activities, surveillance, classified information
Performance measurement
Public contracts and procurement
Technology assessment
Terrorism

Summary:
action_date: 2015-07-29
text: 

Department of Homeland Security Insider Threat and Mitigation Act of 2015

 
This bill amends the Homeland Security Act of 2002 to direct the Department of Homeland Security (DHS) to establish an Insider Threat Program, which shall: (1) provide training and education for DHS personnel to identify, prevent, mitigate, and respond to insider threat risks to DHS's critical assets; (2) provide investigative support regarding such threats; and (3) conduct risk mitigation activities for such threats.
 
DHS shall establish a Steering Committee. The Under Secretary for Intelligence and Analysis shall serve as the Chair and the Chief Security Officer as the Vice Chair of the Committee. 
 
The Under Secretary and the Chief Security Officer, in coordination with the Steering Committee, shall:
 
 
develop a holistic strategy for DHS-wide efforts to identify, prevent, mitigate, and respond to insider threats to DHS's critical assets; 
 
 develop a plan to implement the strategy across DHS components and offices; 
 
 document insider threat policies and controls; 
 
 conduct a baseline risk assessment of such threats; 
 
 examine existing programmatic and technology best practices adopted by the federal government, industry, and research institutions; 
 
 develop a timeline for deploying workplace monitoring technologies, employee awareness campaigns, and education and training programs related to potential insider threats; 
 
 consult with the the Under Secretary for Science and Technology and other stakeholders to ensure that the Insider Threat Program is informed by current information regarding threats, best practices, and available technology; and 
 
 develop, collect, and report metrics on the effectiveness of DHS's insider threat mitigation efforts.
 

action_date: 2015-11-02
text: 

Department of Homeland Security Insider Threat and Mitigation Act of 2015

 
(Sec. 2) This bill amends the Homeland Security Act of 2002 to direct the Department of Homeland Security (DHS) to establish an Insider Threat Program, which shall: (1) provide training and education for DHS personnel to identify, prevent, mitigate, and respond to insider threat risks to DHS's critical assets; (2) provide investigative support regarding such threats; and (3) conduct risk mitigation activities for such threats.
 
DHS shall establish a Steering Committee. The Under Secretary for Intelligence and Analysis shall serve as the Chair and the Chief Security Officer as the Vice Chair of the Committee. 
 
The Under Secretary and the Chief Security Officer, in coordination with the Steering Committee, shall:
 
 
develop a holistic strategy for DHS-wide efforts to identify, prevent, mitigate, and respond to insider threats to DHS's critical assets; 
 
 develop a plan to implement the strategy across DHS components and offices; 
 
 document insider threat policies and controls; 
 
 conduct a baseline risk assessment of such threats; 
 
 examine existing programmatic and technology best practices adopted by the federal government, industry, and research institutions; 
 
 develop a timeline for deploying workplace monitoring technologies, employee awareness campaigns, and education and training programs related to potential insider threats; 
 
 consult with the the Under Secretary for Science and Technology and other stakeholders to ensure that the Insider Threat Program is informed by current information regarding threats, best practices, and available technology; and 
 
 develop, collect, and report metrics on the effectiveness of DHS's insider threat mitigation efforts.
 
 
DHS must submit to specified congressional committees biennial reports over the next six years on:
 
 
 how DHS and its components and offices have implemented such strategy;
 
 the status of DHS's risk assessment of critical assets;
 
 the types of insider threat training conducted;
 
 the number of DHS employees who have received such training; and 
 
information on the effectiveness of the Insider Threat Program, based on such metrics.
 

action_date: 2016-07-12
text: 

Department of Homeland Security Insider Threat and Mitigation Act of 2016

 
(Sec. 2) This bill amends the Homeland Security Act of 2002 (HSA) to direct the Department of Homeland Security (DHS) to establish an Insider Threat Program, which shall: (1) provide training and education for DHS employees to identify, prevent, mitigate, and respond to insider threat risks to DHS's critical assets; (2) provide investigative support regarding such threats; and (3) conduct risk mitigation activities for such threats.
 
DHS shall establish a Steering Committee. The Under Secretary for Intelligence and Analysis, who shall serve as the Chair of the Committee, and the Chief Security Officer, who shall serve as the Vice Chair, shall, in coordination with the Committee:
 
 
develop a holistic strategy for DHS-wide efforts to identify, prevent, mitigate, and respond to insider threats to DHS's critical assets; 
 
develop a plan to implement the strategy across DHS components and offices; 
 
document insider threat policies and controls; 
 
conduct a baseline risk assessment of such threats; 
 
examine programmatic and technology best practices adopted by the federal government, industry, and research institutions; 
 
develop a timeline for deploying workplace monitoring technologies, employee awareness campaigns, and education and training programs related to potential insider threats; 
 
consult with the the Under Secretary for Science and Technology and other stakeholders to ensure that the program is informed by current information regarding threats, best practices, and available technology; and 
 
develop, collect, and report metrics on the effectiveness of DHS's insider threat mitigation efforts. 

 
An agency employing a person who has access to classified national security information (insider employee) shall propose: (1) removing such employee whom an appropriate entity determines knowingly or recklessly engaged in insider misconduct, and (2) taking an adverse action of at least a 12-day suspension of such employee for the first instance of negligently engaging in insider misconduct and removal for any subsequent instance.
 
An insider employee who is notified that he or she is the subject of a proposed adverse action is entitled to 14 days to answer and furnish evidence in support of such answer. If such employee does not furnish such evidence or if the agency determines that such evidence is not sufficient for reversal, such agency shall carry out the adverse action. An agency that carries out an adverse action against an insider employee for insider misconduct under another provision of law may carry out an additional adverse action under the Insider Threat Program based on the same insider misconduct.
 
DHS must submit to specified congressional committees a biennial report on:
 
 
how DHS and its components and offices have implemented such strategy,
 
the status of DHS's risk assessment of critical assets,
 
the types of insider threat training conducted,
 
the number of DHS employees who have received such training, and 
 
information on the effectiveness of the Insider Threat Program. 

 
The Steering Committee shall not seek to, and the authorities provided under this bill shall not be used to, deter, detect, or mitigate disclosures of information by government employees or contractors that are lawful under and protected by any whistleblower statute, regulation, or policy. Any activity carried out under the bill shall be subject to provisions of the Whistleblower Protection Enhancement Act of 2012, and any activity to implement or enforce any insider threat or authority of this bill or Executive Order 13587 shall include a statement required by such Act that preserves rights under whistleblower laws and provisions protecting communications with Congress.


Legislative actions:
action_date: 2016-07-12
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 553.
action_date: 2016-07-12
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Johnson with an amendment in the nature of a substitute. With written report No. 114-297.
action_date: 2016-07-12
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Johnson with an amendment in the nature of a substitute. With written report No. 114-297.
action_date: 2016-02-10
text: Committee on Homeland Security and Governmental Affairs. Ordered to be reported with an amendment in the nature of a substitute favorably.
action_date: 2015-11-03
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
action_date: 2015-11-02
text: Motion to reconsider laid on the table Agreed to without objection.
action_date: 2015-11-02
text: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H7351-7352)
action_date: 2015-11-02
text: Passed/agreed to in House: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote.(text: CR H7351-7352)
action_date: 2015-11-02
text: DEBATE - The House proceeded with forty minutes of debate on H.R. 3361.
action_date: 2015-11-02
text: Considered under suspension of the rules. (consideration: CR H7351-7353)
action_date: 2015-11-02
text: Mr. King (NY) moved to suspend the rules and pass the bill, as amended.
action_date: 2015-11-02
text: Placed on the Union Calendar, Calendar No. 244.
action_date: 2015-11-02
text: Reported (Amended) by the Committee on Homeland Security. H. Rept. 114-321.
action_date: 2015-11-02
text: Reported (Amended) by the Committee on Homeland Security. H. Rept. 114-321.
action_date: 2015-09-30
text: Ordered to be Reported (Amended) by Voice Vote.
action_date: 2015-09-30
text: Committee Consideration and Mark-up Session Held.
action_date: 2015-09-17
text: Forwarded by Subcommittee to Full Committee (Amended) by Voice Vote .
action_date: 2015-09-17
text: Subcommittee Consideration and Mark-up Session Held.
action_date: 2015-08-11
text: Referred to the Subcommittee on Counterterrorism and Intelligence.
action_date: 2015-07-29
text: Referred to the House Committee on Homeland Security.
action_date: 2015-07-29
text: Introduced in House
action_date: 2015-07-29
text: Introduced in House