Date: 2002-11-13
Speaker: TOM DAVIS (republican)
Chamber: H
State: Virginia

Mr. Speaker. I rise in strong support of this bill and to commend my good friend. Majority Leader ARMEY for his efforts in putting together this bipartisan package. This legislation will allow us to have a coordinated response to any future terrorist threat. H.R. 5710 includes many critical provisions I authored that will allow us to work closely with the private sector to deploy the latest technology solutions. address ongoing. information security weaknesses within the federal government. and facilitate necessary information sharing among our critical infrastructures. The events of September 11th and the ensuing war on terrorism have raised an unprecedented awareness of the vulnerabilities we face. This has naturally focused more attention on security issues. particularly with respect to information security. From my work in the Government Reform Committee. it is clear that the state of federal information security suffers from a tack of coordinated. uniform management. Federal information systems continue to be woefully unprotected from both malevolent attacks and benign interruptions. Poor information security management has persisted in both the public and private sectors long before IT became the ubiquitous engine driving governmental. business. and even home activities. As our reliance on technology and our desire for interconnectivity have grown. our vulnerability to attacks on Federal information systems has grown exponentially. The high degree of interdependence between information systems. both internally and externally. exposes the Federal governments computer networks to potentially serious disruptions. Title X of H.R. 5710. the Federal Information Security Management Act (FISMA). will require that agencies utilize information security best practices that will ensure the integrity. confidentiality. and availability of Federal information systems. It builds on the foundation laid by the Government Information Security Reform Act (GISRA). which requires every Federal agency to develop and implement security policies that include risk assessment. riskbased policies. security awareness training. and periodic reviews. FISMA will achieve several objectives vital to Federal information security. Specifically. it will: 1. Remove GISRAs sunset clause and permanently require a Federal agencywide riskbased approach to information security management with annual independent evaluations of agency information security practices. 2. Require all agencies to implement a riskbased management approach to developing and implementing information security measures for all information and information systems. 3. Streamline and make technical corrections to GISRA to clarify and simplity its requirements. 4. Strengthen the role of NIST in the standardssetting process. and 5. Require OMB to implement minimum and mandatory standards for Federal information and information systems. and to consult with the Department of Homeland Security regarding the promulgation of these standards. At a time when uncertainty threatens confidence in our nations preparedness. the Federal government must make information security \a priority. We demand that in our networked era. where technology is the driver. every Federal information system must be managed in a way that minimizes both the risk that breach or disruption will occur and the harm that would result should such a disruption take place. Chairman ARMEY understands this and has shown tremendous leadership by this including this critical language in this legislation. Additionally. the bill includes the Critical Infrastructure Protective Act. which I developed after reviewing Presidential Decision Directive (PDD) 63 that identified the ongoing statutory barriers to information sharing. This important bill includes a FOIA exemption for critical infrastructure information along with recognition for private sector information sharing organizations (ISOs). It also includes a use protection for information shared with the government and a process based on the Defense Production Act of 1959 to address potential antitrust concerns. In Presidential Decision Directive 63 issued by the previous Administration. concerns about the Freedom of Information Act. antitrust. and liability were identified as primary barriers to facilitating information sharing with the private sector. The critical infrastructure of the United States is largely owned and operated by the private sector. Critical infrastructures are those systems that are essential to the minimum operations of the economy and government. Traditionally. these sectors operated largely independently of one another and coordinated with government to protect themselves against threats posed by traditional warfare. Today. these sectors must learn how to protect themselves against unconventional threats such as terrorist attacks. and cyber intrusions. We must. as a nation. prepare both our public and private sectors to protect ourselves against such- efforts. As we discovered when we went to the caves in Afghanistan. the.At Qaeda groups had copies of GAO reports and other government information obtained through FOIA. While we work to protect our nations assets in this war against terrorism. we also need to ensure that we are not arming terrorists. Today. the private sector has established many information sharing organizations (ISOs) for the different sectors of our nations critical infrastructure. Information regarding potential physical or cyber vulnerabilities is now shared within some industries. but it is not shared with the government. and it is not shared across industries. The private sector stands ready to expand this model but has also expressed concerns about voluntarily sharing information with the government and the unintended consequences it could face for acting in good faith. Specifically. there has been concern that industry could potentially face antitrust violations for sharing information with other industry partners. have their shared information be subject to the Freedom of Information Act. or face potential liability concerns for information shared .in good faith. Additionally. this FOIA exemption extends the protection for FOIA to information shared at the state and local government level. Also. this bill gives the Secretary of Homeland Security the authority to share information protected under this FOIA exemption to share it with other impacted federal agencies while continuing to enjoy the protection. My language included in H.R. 5005 will address all three of these concerns. Additionally. consumers and operators will have the bonfidence they need to know that information will be handled accurately. confidentially. and reliably. The Critical Infrastructure Information Act procedures are closely modeled after the successful Year 2000 Information and Readiness Disclosure Act by providing a limited FOIA exemption. civil litigation protection for shared information. and a new process for resolving potential antitrust concerns for information. shared among private sector companies for the purpose of correcting. avoiding. communicatingor disclosing information about a critical infrastructure threat or vulnerability. This legislation will enable the private sector. including ISOs. to move forward without fear from government. so that government and industry may enjoy a mutually cooperative partnership. This will also allow us to get a timely and accurate assessment of the vulnerabilities of each sector to physical and cyber attacks and allow for the formulation of proposals to eliminate these vulnerabilities without increasing government regulation. or expanding unfunded federal mandates on the private sector. Also. H.R. 5710 includes language that I developed to allow for reaching out to new technology companies that may not being doing business with the government. We all know that the Federal. State and local governments will spend billions and billions of dollars to fight the war against terror. Contentious floor debates aside. we all support these efforts. But to me. the question isnt simply how much we spend. but how well we spend it. Since the tragic events of 9/11 the Government. in general. and the Office of Homeland Security. in particular has been overwhelmed by a flood of industry proposals offering various solutions to our homeland security challenges. Because of a lack of staffing expertise. many of these proposals have been sitting unevaluated. perhaps denying the government breakthrough technology. In February. I held a hearing in my Subcommittee on Technology and Procurement Policy on homeland security challenges facing the government. One theme that was expressed unanimously by industry was the need for an organized. cohesive. comprehensive process within the Government to evaluate privatesector solutions to homeland security problems. Now we have part of the solution. with the creation of the new Department of Homeland Security in the bill on the floor today. Section 313 of this bill will close the loop and provide a vehicle to get these solutions into government and to the front lines in the war against terror. Section 313 of the Homeland Security Act establishes within the Department a program to meet the current challenge faced by the Federal government. as well as by state and local entities. in leveraging private sector innovation in the fight against terror. The section would establish a focused effort by: Creating a centralized Federal clearinghouse in the new Department for information relating to terrorfighting technologies for dissemination to Federal. State. local and private sector entities and to issue announcements to industry seeking unique and innovative antiterror solutions. Establishing a technical assistance team to assist in screening proposals for terrorfighting technology to assess their feasibility. scientific and technical merit and cost. Providing for the new Department to offer guidance. recommendations and technical assistance to Federal. State. local and private efforts to evaluate and use antiterror technologies and provide information relating to Federal funding. regulation. or acquisition regarding these technologies. Since September 11. we have all been struggling to understand what changes will occur in our daily lives. in our economy. and within the Government. We now will establish a new Department of Homeland Security to focus and coordinate the war against terror. The new section 313 in this landmark legislation will give the new Department the framework it needs to examine and act on the best innovations the private sector has to offer. I am pleased to also have authored section 834 at the request of the Select Committee to allow federal agencies governmentwide to accept unsolicited proposals. The language directs the FAR Council to amend FAR Part 15 to ensure that a proposal has not been submitted in relation to a previously published proposal. This ensures that contracting officials are not improperly avoiding a full and open competition. Existing ambiguity in the FAR language made government contracting officials hesitant to review and accept unsolicited proposals. The change recognizes the longstanding procurement reform goal of allowing contracting officials to include "best value" factors when reviewing such a proposal. and adds "technical merit" as a new critria. which allows officials to review a proposal for potential future benefit. This language is critical as federal agencies attempt to update their information technology systems to better integrate information and serve the taxpayer. This is another step forward in moving the Federal government to a more commercial acquisition environment. This change in the FAR will allow federal agencies to rapidly acquire new products and services to assist them in winning the war on terrorism. In ordinary times. primarily because of recent acquisition reforms. the current acquisition system will enable the new Department of Homeland Security to buy what it needs with reasonable efficiency. While we all hope that it will never be needed. we also know that in an emergency the new Department may have to quickly and efficiently acquire the high tech and sophisticated products and services needed for its critical mission. The provisions in H.R. 5710 would permit the Department to quickly acquire the emergency goods and services it needs while maintaining safeguards against wasteful spending. This authority is easily accessed by Department of Homeland Security officials through a written determination. The acquisition provisions build on contracting authorities currently place. in fact. the procedures appear in Part 13 of the Federal Acquisition Regulation and provide for an extension of these authorities only upon a determination of the Secretary of Homeland Security or one of his Senatorially confirmed officials that the terror fighting mission of the new Department would be seriously impaired without their use. The new authorities would sunset at the end of fiscal year 2007. The GAO would be required to report to the Committee on Government Reform assessing the extent to which the authorities contributed to the mission of the Department. the extent to which the prices paid reflect best value. and the effectiveness of the safeguards put in place to monitor the use of the new authorities.-The current governmentwide procurement laws will govern the Departments "normal" purchases. Specifically. the provisions would raise the current micropurchase threshold from $2.500 to $7.500. It would raise the current $100.000 threshold for simplified acquisition procedures to $200.000 for use within the United States and $300.000 for overseas missions. and permit the application of the current streamlined commercial acquisition procedures and statutory waivers to noncommercial goods and services and increase the current $5.000.000 ceiling on the use of streamlined commercial procedures to $7.500.000 for these goods and services. How could these new authorities be used? Well. for example. the increase in the micropurchase threshold could be used in the event of a terror attack. to permit a Department of Homeland Security official at the scene to rent several floors of a nearby hotel to house rescue workers by simply presenting his Government credit card. The increase in the simplified acquisition threshold would permit a Department official to quickly enter into a $200.000 contract for specialized medical services for rescue workers responding to a terror attack. The application of streamlined commercial acquisition procedures would permit the Department to conduct a limited competition among high technology firms for a specialized advisory and assistance services contract valued at $7.500.000 to fight a cyberattack. Moreover. I am pleased that the House accepted the Senate Federal Emergency Procurement Flexibility Act. This basically extends the same emergency procedures given to the new Department to all Federal agencies to use to prepare for. or in response to a nuclear. biological. chemical. or radiological attack or an act of terrorism for the next fiscal year. This is based on legislation that I had introduced with my colleague and Chairman. DAN BURTON and with Senators JOHN WARNER and FRED THOMPSON at the request of Governor Tom Ridge. While this authority is not as accessible as it is for the Department of Homeland Security. it will certainly go a long way to giving all federal agencies additional help in winning the war on terrorism. H.R. 5710 gives the Administration the necessary management flexibilities it will need to set up the new Department while maintaining longstanding statutory protections for the American taxpayer and for federal employees. In the civil service area. we struck the proper balance between needed flexibility and important employee protections. Dedicated federal employees. by virtue of the bills new 30day mediation period. have received the assurances they asked for. while the American people will have the benefit of a flexible. modernday workforce that can respond to everevolving threats. I worked hard to make sure aspects.of Senator VOINOVICHS human capital management legislation were included in the legislation. for example. having Human Capital Officers within each agency ensures that the Departments employees will be given the tools they need to prosper and develop professionally. And the demonstration project authority. which includes a payforperformance component. is a critical step that will help give the new department the ability to attract and retain the very best employees. Finally. Mr. Speaker. I would again like to thank Majority Leader ARMEY for his outstanding leadership on this vital piece of legislation. Today. we are giving President Bush legislation that he has deemed critical to winning the war on terrorism. Majority Leader ARMEY and his talented staff worked tirelessly to ensure that we would get this legislation done this year. I am proud to have worked with my House .colleagues and the Select Committee on H.R. 5710.