Statements on Introduced Bills and Joint Resolutions

Floor Speech

BREAK IN TRANSCRIPT

Mr. WYDEN. Mr. President, today I, along with my colleague Senator Cotton from Arkansas, am introducing the Senate Cybersecurity Protection Act to defend the integrity of American democracy by providing cybersecurity protection for the personal accounts and electronic devices of Senators and and key members of their staff.

In 2016, hackers working for the Russian government broke into a range of targets, including the network of the Democratic National Committee and the email account of Senator Hillary Clinton's presidential campaign manager, John Podesta. These widely publicized breaches are only the tip of the iceberg. These hacks are widely known today because the emails stolen from these accounts were subsequently weaponized and used as part of a campaign to influence the outcome of several elections--most publicly, the presidential race between Donald Trump and Hillary Clinton, but also U.S. House of Representatives races in Illinois, New Hampshire, New Mexico, North Carolina, Ohio, and Pennsylvania. Senator Lindsey Graham also reported that his campaign's email was successfully compromised.

While the Russian hacks in 2016 were a watershed moment, these are merely the most visible and disruptive examples of foreign intelligence services using offensive cyber capabilities to target those involved in our political process. Senior officials from the 2008 Obama and McCain presidential campaigns have publicly confirmed that both organizations were compromised by hackers. In 2017, the media reported that then- White House Chief of Staff John Kelly's personal cell phone had been compromised, possibly for as long as ten months before the malware was discovered. And in 2018, media reports revealed that the personal email accounts of senior congressional staffers had been targeted by the notorious Russian hacking group ``Fancy-Bear.'' These and other events clearly demonstrate the unique threats faced by Senators and their staff. Unfortunately, as I revealed in a letter to Senate leadership last year, the Sergeant At Arms (SAA), which is responsible for the Senate's cybersecurity, informed me that it currently lacks the authority to use official Senate resources to protect the personal devices and accounts of Senators and key Senate staff, even when those staff are being targeted by foreign governments.

Senators Cotton and I are not alone in recognizing the seriousness of this national security threat.

Last year, then-Director of the National Security Agency Admiral Michael Rogers acknowledged in a letter to me that personal devices and accounts of senior U.S. government officials ``remain prime targets for exploitation.'' Likewise, in written responses to post-hearing questions from the Senate Intelligence Committee last year, Director of National Intelligence Dan Coats wrote that ``[t]he personal accounts and devices of government officials can contain information that is useful for our adversaries to target, either directly or indirectly, these officials and the organizations with which they are affiliated.'' The Appropriations Committee also noted last year in its report accompanying the 2019 Legislative Branch Appropriations bill that it ``continues to be concerned that Senators are being targeted for hacking and cyber attacks, especially via their personal devices and accounts.''

Currently, Senators and staffers are expected to protect their own devices and accounts from foreign government hackers. This is absurd. Senators and the vast majority of their staff are not cybersecurity experts, and certainly do not have the training our resources to defend themselves from sophisticated foreign intelligence agencies. Eric Rosenbach, who was formerly Chief of Staff to Secretary of Defense Ash Carter, has endorsed the bill we are introducing today, observing that ``Senators and their staff should not be expected to go toe to toe with some of the most sophisticated adversaries in cyberspace; authorizing protection of personal accounts is a critical component of our cyber defense efforts.'' Likewise, Bruce Schreier, a noted cybersecurity expert has also endorsed the bill, stating that ``[i]t is ludicrous to expect individual senators and their staff to to defend themselves from spies and hackers. Hostile foreign intelligence services do not respect the arbitrary line between work and personal technology. As such, the U.S. government must extend its defensive cyber perimeter to include legislators' personal devices and accounts.''

Our bill would permit the SAA to provide voluntary, opt-in cybersecurity assistance to Senators and key Senate staff to secure their personal devices and accounts. Any Senate staffer would be eligible to receive assistance, provided that the Senator employing them determines that they are highly vulnerable to cyber attacks and information collection because of their position in the Senate.

There is precedent for extending cybersecurity protection to the personal devices of government officials. Section 1645 of the 2017 National Defense Authorization Act permits the Secretary of Defense to provide personal device cybersecurity assistance to officials whom the secretary ``determines to be highly vulnerable to cyber attacks and hostile information collection activities because of the positions occupied by such personnel in the Department.'' The Senate Cybersecurity Protection Act is also similar to provisions included in the intelligence authorization bill approved by the Senate Select Committee on Intelligence in 2018, which would permit the Director of National Intelligence to protect the personal devices and accounts of high-risk staff in the intelligence community.

Passage of this common sense, bipartisan legislation would provide Senators and their staff with much-needed protection for their personal accounts and devices, and with them, the integrity of American democracy. I thank my colleague Senator Cotton for his efforts on this bill, and hope the Senate will promptly pass this vital legislation. ______

By Mr. DURBIN (for himself, Mr. Blumenthal, Mr. Booker, Mr. Cardin, Mr. Coons, Ms. Duckworth, Ms. Harris, Mr. Kaine, Ms. Klobuchar, Mr. Markey, Mr. Whitehouse, Mr. Sanders, Mr. Schatz, and Mr. Reed):

S. 894. A bill to authorize dedicated domestic terrorism offices within the Department of Homeland Security, the Department of Justice, and the Federal Bureau of Investigation to analyze and monitor domestic terrorist activity and require the Federal Government to take steps to prevent domestic terrorism; to the Committee on the Judiciary.

BREAK IN TRANSCRIPT

Source