Date: 2002-07-26
Speaker: TOM DAVIS (republican)
Chamber: H
State: Virginia

Mr. Chairman. I thank the gentleman for yielding me the time. First of all. just to correct a couple of things I keep hearing from the other side about a government contractor not being able to be sued if something goes wrong. nothing could be further from the truth. We do change traditional tort law in that punitive damages are capped and that we have comparative negligence and these kind of items. The reason we do this. of course. in the amendment is to try to hold down the liability and get contractors to be able to share some of their innovations with the government. Also. on the Argenbright debarment issue. debarment is traditionally done by professionals in the procurement offices in Federal agencies. not by the Congress. Whether it extends or not. I am certain that that will be extended at that level. I rise today in strong support of this language and the technical innovations language that is included in the gentleman from Texas en bloc amendment. This title is going to strengthen information security management for the Federal Government. and this is critical in the war against terrorism because if we are vulnerable anywhere it is in our critical infrastructures. This language goes a long way towards strengthening that. which seems to me would be a prime target for terrorists. Poor information security management has persisted in both the public and private sectors long before information technology became ubiquitous engine driving governmental. business and even home activities. As our reliance on technology and our desire for interconnectivity have grown over the past decade. intensifying with the advent of the Internet. our vulnerabilities to attack on Federal information systems has grown exponentially. The high degree of dependence between information systems. both internally and externally. exposes the Federal Governments computer networks to benign and destructive disruptions. Therefore. the Federal Information Security Management Act of 2002. which I introduced with the gentleman from California is included in this managers amendment. This requires the agencies utilize information security best practices that could help ensure the integrity. confidentiality and availability of Federal information services and doing a lot of other things as well. I also want to thank the gentleman from New York . the Committee on Science chairman and the gentleman from Louisiana . the Committee on Energy and Commerce chairman. for working on this language. In addition to this. we have technical innovation language in this legislation. that will allow the most uptodate innovations in technology to come forward quickly and be processed by the homeland security agency where they can start looking as they set their requirements and find out what are the latest innovations that we have in technology in this country that we can use to help fight terrorism. In February. we held a hearing on this. the challenges facing us. and one theme that was expressed unanimously by industry was the need for an organized. cohesive and comprehensive process within the government so we could evaluate private sector solutions to homeland security problems. We have a lot of contractors with great ideas running around. but there is no place to really take them at this point. This managers amendment now has a central clearinghouse f6r these. They are part of the solution. With the creation of the homeland security in the bill before us today the gentleman from Texas has included language in this legislation that closes the loop and provides a vehicle to get these solutions into the government and to the front lines in the war against terrorism as soon as possible. I urge adoption of the managers amendment. In ordinary times. primarily because of recent acquisition reforms. the current acquisition system will enable the new Department of Homeland Security to buy what it needs with reasonable efficiency. While we all hope that it will never be needed. we also know that in an emergency the new Department may have to quickly and efficiently acquire the high tech and sophisticated products and services needed for its critical mission. The carefully limited authorities contained in the Homeland Security Act on the floor today are based on the Davis/ Turner amendment. which was accepted and incorporated into the Govemment Reform Committees version of the Homeland Security bill. The bipartisan provisions would permit the .Department to quickly acquire the emergency goods and services it needs while maintaining safeguards against wasteful spending. The amendment builds on contracting authorities currently in place. in fact. the procedures appear in Part 13 of the Federal Acquisition Regulationand provides for an extension of these authorities only upon a determination of the Secretary of Homeland Security or one of his Senatorially confirmed officials that the terror fighting mission of the new Department would be seriously impaired without their use. The new authorities would sunset at the end of fiscal year 2007. The GAO would be required to report to the Committee on Government Reform assessing the extend to which the authorities contributed to the mission of the Department. the extent to which the prices paid reflect best value. and the effectiveness of the safeguards put in place to monitor the use of the new authorities. The current governmentwide procurement laws will govern the Departments "normal" purchases. Specifically. the provisions would raise the current micropurchase threshold from $2.500 to $5.000. It would raise the current $100.000 threshold to $175.000. and permit the application of the current streamlined commercial acquisition procedures and statutory waivers to noncommercial goods and services and increase the current $5.000.000 ceiling on the use of streamlined commercial procedures to $7.500.0.00 for these goods and services. How could these new authorities be used? Well. for example. the increase in the micropurchase threshold could be used in the event of a terror attack. to permit a Department of Homeland Security official at the scene to rent several floors of a nearby hotel to houserescue workers by simply presenting his Government credit card. The increase in the simplified acquisition threshold would permit a Department official to quickly enter into a $175.000 contract for specialized medical services for rescue workers responding to a terror attack. The application of streamlined commercial acquisition procedures would permit the Department to conduct a limited competition among high technology firms for a specialized advisory and assistance services contract valued at $7.500.000 to fight a cyberattack. Mr. Chairman. I also rise in strong support of Title Xl information security language and the technical innovations language included in Chairman Armeys en bloc amendment. This Title will strengthen the information security management infrastructure of the Federal Government. The events of September 11th and the ensuing war on terrorism have raised an unprecedented awareness of the vulnerabilities we face. This has naturally focused more attention on security issues. particularly with respect to information security. From my work in the Government Reform Committee. it is clear that the state of federal information security suffers from a lack of coordinated. uniform management. Federal information systems continue to be woefully unprotected from both malevolent attacks and benign interruptions. Poor information security management has persisted in both the public and private sectors long before IT became the ubiquitous engine driving govemmental. business. and even home activities. As our reliance on technology and our desire for interconnectivity have grown over the past decade. intensifying with the advent of the Internet. our vulnerability to attacks on Federal information systems has grown exponentially. The high degree of interdependence. between information systems. both internally and externally. exposes the Federal govemments computer networks to benign and destructive disruptions. Therefore. I introduced the Federal Information Security Management Act of 2002 (FISMA) with Congressman Stephen Hom. Chairman of the Government Efficiency. Financial Management and Intergovernmental Relations Subcommittee. FISMA is the basis for Title Xl in the Homeland Security bill we are considering today. FISMA will require that agencies utilize information security best practices that will ensure the integrity. confidentiality. and availability of Federal information systems. It builds on the foundation laid by the Government Information Security Reform Act (GISRA). which requires every Federal agency to develop and implement security policies that include risk assessment. riskbased policies. security awareness training. and periodic reviews. Our Subcommittees held joint legislative hearings on FISMA. and I worked closely with Chairman Horn. industry. and agencies to develop a bill that is satisfactory to all parties. FISMA will achieve several objectives vital to Federal information security. Specifically. it will: 1. Remove GISRAs sunset clause and permanently require a Federal agencywide riskbased approach to information security management with annual independent evaluations of agency information security practices. 2. Require that all agencies implement a riskbased management approach to developing and implementing information security measures for all information and information systems. 3. Streamline and make technical corrections to GISRA to clarify and simplify its requirements. 4. Strengthen the role of.NIST in the standardssetting process. and 5. Require OMB to implement minimum and mandatory standards for Federal information and information systems. and to consult with the Department of Homeland Security regarding the promulgation of these standards. At a time when uncertainty threatens confidence in our nations preparedness. the Federal government must make information security a priority. We demand that in our networked era. where technology is the driver. every Federal information system must be managed in a way that minimizes both the risk that a breach or disruption will occur and the harm that would result should such a disruption take place. Title Xl is vitally important to accomplishing our objective. Chairman ARMEY understands this and has shown tremendous leadership by this including this critical language in his en bloc amendment. I would like to take a moment to thank Science Committee Chairman SHERWOOD BOEHLERT and Energy and Commerce Chairman BILLY TAUZIN for working with the Committee on Government Reform to reach a substantive agreement on Tltle XI. And I would also like to thank Congresswoman CONNIE MORELLA. Congressman LAMAR SMITH. and Congressman ADAM SMITH for their strong support and invaluable efforts to promote Title Xl. Also. the En Bloc amendment includes language that I developed to allow for reaching out to new technology companies that may not being doing business with the government. We all know that the Federal. State and local governments will spend billions and billions of dollars to fight the war against terror. Contentious floor debates aside. we all support these efforts. But to me. the question isnt simply how much we spend. but how well we spend it. Since the tragic events of 9/11 the Government. in general. and the Office of Homeland Security. in particular has been overwhelmed by a flood of industry proposals offering various solutions to our homeland security challenges. Because of a lack of staffing expertise. many of these proposals have been sitting unevaluated. perhaps denying the government breakthrough technology. In February. I held a hearing in my Subcommittee on Technology and Procurement Policy on homeland security challenges facing the government. One theme that was expressed unanimously by industry was the need for an organized. cohesive. comprehensive process within the Government to evaluate privatesector solutions to homeland security problems. Now we have part of the solution. with the creation of the new Department of Homeland Security in the bill on the floor today. Chairman ARMEY at my request included language in a new Section 309 which is based on H.R. 4629. legislation I introduced in May. This language will close the loop and provide a vehicle to get these solutions into government and to the front lines in the war against terror. Chairman Armeys Managers amendment included a new section 309 in the Homeland Security Act to the establishment within the Department a program to meet the current challenge faced by the Federal government. as well as by state and local entities. in leveraging private sector innovation in the fight against terror. The amendment would establish a focused effort by: Creating a centralized Federal clearinghouse in the new Department for information relating to terrorfighting technologies for dissemination to Federal. State. local and private sector entities and to issue announcements to industry seeking unique and innovative antiterror solutions. Establishing a technical assistance team to assist in screening proposals for terrorfighting technology to assess their feasibility. scientific and technical merit and cost. Providing for the new Department to offer guidance. recommendations and technical assistance to Federal. State. local and private efforts to evaluate and use antiterror technologies and provide information relating to Federal funding. regulation. or acquisition regarding these technologies. Since September 11. we have all been struggling to understand what changes will occur in our daily lives. in our economy. and within the Government. We now will establish a new Department of Homeland Security to focus and coordinate the war against terror. The new section 309 in this landmark legislation will give the new Department the -framework it needs to examine and act on the best innovations the private sector has to offer. I would also like to offer my thanks to the staff of the Science and Energy and Commerce Committees who collaborated with my staffin crafting this consensus amendment. And finally. Mr. Chairman. I would also like to thank the Chairman for including my bipartisan legislation that I developed with Congressman JIM MORAN that will promote voluntary information sharing about our nations critical infrastructure assets. As many of you know. over ninety percent of our nations critical infrastructure as owned and operated. In Presidential Decision Directive 63 issued by the previous Administration. concerns about the Freedom of Information Act. antitrust. and liability were identified as primary barriers to facilitating information sharing with the private sector. The critical infrastructure of the United States is largely owned and operated by the private sector. Critical infrastructures are those systems that are essential to the minimum operations of the economy and govemment. Traditionally. these sectors operated largely independently of one another and coordinated with government to protect themselves against threats posed by traditional warfare. Today. these sectors must learn how to protect themselves against unconventional threats such as terrorist attacks. and cyber intrusions. We must. as a nation. prepare both our public and private sectors to protect ourselves against such efforts. As we discovered when we went to the caves in Afghanistan. the Al Qaeda groups had copies of GAO reports and other governrfient information obtained through FOIA. While we work toprotect our nations assets in this war against terrorism. we also need to ensure that we are not arming terrorists. Today. the private sector has established many information sharing organizations (ISOs) for the different sectors of our nations critical infrastructure. Information regarding potential physical or cyber vulnerabilities is now shared within some industries but it is not shared with the government and it is" not shared across industries. The private sector stands ready to expand this model but have also expressed concerns about voluntarily sharing information with the government and the unintended consequences they could face for acting in good faith. Specifically. there has been concern that industry could potentially face antitrust violations for sharing information with other industry partners. have their shared information be subject to the Freedom of Information Act. or face potential liability concerns for information shared in good faith. My language included in H.R. 5005 will address all three of these concerns. Additionally. consumers and operators will have the confidence they need to know that information will be handled accurately. confidentially. and reliably. The Critical Infrastructure Information Act procedures are closely modeled after the successful Year 2000 Information and Readiness Disclosure Actby providing a limited FOIA exemption. civil litigation protection for shared information. and a new process for resolving potential antitrust concerns for information shared among private sector companies for the purpose of correcting. avoiding. communicating or disclosing information about a critical infrastructure threat or vulnerability. This legislation will enable the private sector. including ISOs. to move forward without fear from government so that government and industry may enjoy a mutually cooperative partnership. This will also allow us to get a timely and accurate assessment of the vulnerabilities of each sector to physical and cyber attacks and allow for the formulation of proposals to eliminate these vulnerabilities without increasing government regulation. or expanding unfunded federal mandates on the private sector. I am disappointed that the final language contained in the bill is different than the Government Reform Committee mark that passedthe Committee 30 to 1. My FOIA language. passed the Committee by voice vote. However. the language included in the Managers Amendment only extends the protections to the Department of Homeland Security. My original language gave the Secretary the authority to designate other covered federal agencies to receive and share the information. While the Department would have remained the central repository for this information. it allowed other Departments and agencies involved in fighting the war on terrorism to also receive this voluntarily provided information. I will be offering an amendment later today that will make a technical correction to H.R. 5005 and allow the Secretary to again designate covered federal agencies. The amendment that I am offering today is supported by every critical infrastructure sector. It is also supported by the -Business Roundtable. the U.S. Chamber of Commerce. the Information Technology Association of America. the Financial Services Roundtale. the National Association of Manufacturers. the Edison Electric Institute. and the American Chemical Council. Industry wants to fulfill its responsibility to the American people. we need to give them the necessary tools to do so.