Taking Action on Cyber Enforcement: Assessing US Legislative Progress in the 116th Congress

Despite dealing with a global pandemic, the 116th Congress introduced 40% more cybersecurity legislation than the 115th Congress.

The COVID-19 pandemic exacerbated an already rising cybercrime wave in the United States that impacts all Americans. The Federal Bureau of Investigations (FBI) saw a 400% increase in the daily cybercrime incidents reported in April 2020 compared to their typical complaint rates.² Ransomware, too, increased 148% globally since February 2020, locking up and holding the data of US hospitals, schools, and small businesses for ransom in the midst of this global crisis.³ Yet, the human actors behind these crimes are rarely punished. Our research shows that only three out of every 1,000 cyber incidents reported to the FBI result in an enforcement action.⁴

Before and during this crisis, Members of the 116^th Congress demonstrated an increased focus on the cyber threats facing our nation through their legislative action. In part, this is due to Congress’ introduction and approval of 26 of its over 60 recommendations made in the final report of the US Cyberspace Solarium Commission, which it authorized in the 115^th Congress.⁵ During the 116^th Congress (January 3, 2019 – January 3, 2021), Members introduced 316 bills that either primarily or tangentially focused on cybersecurity.⁶ To put this into context, Members introduced 13,481 bills in total, meaning that cyber-related legislation amounted to less than 3% of all introduced legislation.⁷ However, the 116^th Congress outpaced their predecessor, introducing 40% more cybersecurity bills than the 115^th Congress.⁸ Of these 316 bills, 93 were previously introduced in the 115^th Congress, and five were signed into law. The increase in introduced cybersecurity legislation may be due to several reasons, such as an increased focus on the need to protect the 2020 elections from foreign interference, secure 5G and other supply chains from vulnerabilities, and counter the cyber threat posed by American adversaries.

The onset of COVID-19 also spurred legislation to protect user data that mobile applications for contact tracing may collect, such as the “COVID-19 Consumer Data Protection Act” (S.3663).⁹ In fact, Members of Congress introduced at least 11 cyber-related bills in response to COVID-19, including some that would have imposed consequences on actors, like the “Defend COVID Research from Hackers Act” (S.4793).¹⁰

The House passed more cyber-related bills than their Senate colleagues, repeating a trend seen in the 115^th Congress. The House passed 40 bills that the Senate did not pass, while the Senate passed eight bills that the House did not consider. This was par for the course compared to the 115^th Congress, where the House passed 42 bills, and the Senate passed six.¹¹ Luckily, cybersecurity continued to be a bipartisan issue, with 55% of all legislation and 85% of all bills signed into law having bipartisan co-sponsors. This mirrored the bipartisanship seen in the 115^th congressional session, where roughly 60% of all introduced bills had bipartisan cosponsors.

Of the 316 bills introduced, Congress passed 14 pieces of legislation into law. 65% of the bills signed into law were related to appropriations or authorizing an agency.¹² The table below details the name of these bills, their policy areas, and their sponsor.

As the pandemic continues to rage and malicious cyber actors target vulnerable sectors, such as schools and hospitals, Members of Congress must continue introducing legislation that focuses on a range of cyber-related issues.

Most congressional cyber legislation focused on defending critical infrastructure, protecting consumer data, and advancing foreign policy priorities.

Examining the 316 bills introduced in the 116^th Congress shows the various cybersecurity issues Congress must contend with, ranging from protecting critical infrastructure to protecting consumer data held by third parties.  

Half of the cyber-related bills introduced in the 116^th Congress dealt with defending critical infrastructure, protecting consumer data, and advancing foreign policy priorities—mirroring the 115^th’s top categories. The graph below compares the cyber-related legislation introduced by the two congressional sessions based on 11 thematic areas.

Members introduced 68 bills that focused on protecting the federal government’s networks or private critical infrastructure—the most of all 11 categories. These provisions included assisting state and local governments in defending their public networks, partnering with utility companies, and bolstering the Cybersecurity and Infrastructure Security Agency’s (CISA) ability to defend federal networks. The “Secure 5G and Beyond Act of 2020” (P.L.116-129) was the only critical infrastructure bill signed into law., which requires the president to develop a strategy for securing and protecting US 5G infrastructure.¹³ However, other bills, such as the “Cybersecurity Vulnerability Identification and Notification Act of 2020” (S.3045) which grants subpoena authority to CISA to notify private companies about a vulnerability, were included in larger appropriation and authorization legislation.¹⁴

The 116^th Congress also introduced 130 bills related to US foreign policy, breach notification/consumer protection, and appropriations, with Members introducing over 40 bills in each category. In terms of the latter, appropriation and authorization bills primarily focused on funding government agencies to protect their information technology systems or support their cybersecurity program areas. Yet, Members used these bills as vehicles to attach at least 45 cyber-related bills. In fact, the two National Defense Authorization Acts (NDAA) passed by the 116^th Congress included 32 separate cyber-related bills.

Members of Congress introduced 48 cyber-related bills to advance foreign policy priorities, illustrating the international nature of cybersecurity and the need to strengthen global partnerships to address it. The 48 bills touched on various issues, such as bolstering countries’ cybersecurity defenses and countering and imposing consequences on China, Russia, Iran, and North Korea’s malicious cyber activities. In terms of the latter, Members introduced over 10 bills directed at the threat posed by China and Russia. For example, the “Advancing Competitiveness, Transparency, and Security in the Americas Act” (H.R.8716) sought to strengthen Latin American and Caribbean countries’ criminal justice institutions to fight cybercrime in the region.¹⁵

The continued focus on consumer protection—tied for the third-highest category with appropriations—may be associated with Congress’ interest in technology companies’ roles and responsibilities in securing user’s data from unauthorized disclosures.. For instance, the “Own Your Own Data Act” (S.806), the “Data Broker Accountability and Transparency Act of 2019” (S.2577), and the “Social Media Privacy Protection and Consumer Rights Act of 2019” (S.189), would have created security standards and limitations on the social media companies and data brokers that maintain user data.¹⁶ Congress only passed one bill related to consumer protection, the “Taxpayer First Act” (P.L.116-25), enabling the Internal Revenue Service to work with private and public partners to protect taxpayers from identity theft fraud related to tax returns and strengthen other identity theft protection.¹⁷

Election security continued to be a top priority as well, with Members introducing 37 bills to bolster the cybersecurity of election infrastructure and combat online misinformation and disinformation. These bills included the “Bots Research Act” (H.R.2860), which would have directed the government to study the effects of automated accounts (i.e., bots) on social media, and the “ALERTS Act” (H.R.3529), which would have required the government to notify election officials of a breach into an election system.¹⁸ But Congress only passed one election security bill -  the “Defending the Integrity of Voting Systems Act” (P.L.116-179), which was one of the few bills that imposed consequences on malicious actors by making it a felony to hack a voting system.¹⁹

As technology becomes further engrained in everyday activities—from driverless cars to telehealth—the 117^th Congress will continue introducing and passing bills that touch on a wide range of issues.

Despite Congress’ increased attention on cyber-related actions, a concerning gap remains in the legislative focus on cyber enforcement — identifying, stopping, and imposing consequences on malicious cyber actors.

Although the 116^th Congress was highly active in introducing and passing cyber-related legislation, these provisions did little to impose consequences on the actors behind cyber incidents, such as cybercrime. While defending and protecting critical infrastructure and data remains important, Americans want to see their government reduce the rise of cybercrime. As mentioned earlier, only 3 in 1,000 cyber incidents reported to the FBI lead to an enforcement action. Yet, in a 2018 Statista poll, 72% of respondents worried that hackers would steal their personal, credit card, or financial information, placing this concern higher than having their car stolen or their home burglarized.²⁰ Further, 92% of respondents in a 2019 poll said that it was important for the next US president to make reducing cybercrime a top priority.²¹ 

Yet, only 36 of the 316 bills introduced and three of the bills signed into law dealt with imposing consequences on malicious actors, both nation-state and lone actors, who conducted malicious cyber activity, such as deploying ransomware—a form of cybercrime—against hospitals and schools. These bills included imposing sanctions, creating cyber enforcement strategies, improving criminal statutes, and providing resources to countries to apprehend the actor behind a cyber incident, such as cybercrime.

Two of the three bills signed into law were the annual NDAAs, which further outlined the DoD’s “defend forward” mission to monitor adversaries’ networks and preemptively launch attacks to deter their malicious cyber activity. The third bill signed into law, “Defending the Integrity of Voting Systems Act” (P.L.116-179), makes it a felony to hack into an election system.²² Several bills that were not signed into law would have taken significant steps to impose consequences on malicious actors but never gained traction. For example, the “Cyber Diplomacy Act of 2019” (H.R.739) would have established an ambassador for Cybersecurity and an elevated cyber office at the State Department but Congress did not approve it.²³ The “Technology in Criminal Justice Act of 2019” (H.R.5227), too, would have assisted state and local law enforcement close their cyber enforcement gap by providing grants to improve their ability to analyze digital evidence left at the scene of a cybercrime.²⁴

Improving critical infrastructure resilience to cyber attacks is highly important, but the ability to impose consequences against malicious actors and hold them accountable for their actions is also needed to deter malicious cyber activity. As the 117^th congressional session begins and after the wake of SolarWinds, the largest modern espionage attack on private and government systems, Members must consider legislation that deters these activities.

The 117^th Congress can build off the bills introduced in the 116^th congressional session to impose consequences and hold malicious cyber actors accountable.

As cyber actors continue to operate with near-impunity, they will continue to conduct cyber operations that impact everyday Americans, but the 117^th Congress can work to increase consequences on them for their actions. Members of Congress should focus their legislative effort on three key areas to hold malicious cyber actors accountable:

1. Strengthening Ties with the Private Sector: Since the private sector owns and operates the networks that malicious cyber actors abuse to perpetrate their attacks, the US government must continue collaborating with private partners to disrupt these actors’ cyber networks and launch investigations into their actions. To this end, Congress should work with the newly authorized National Cyber Director to develop legislation that improves timely and actionable information sharing with private partners.²⁵
2. Fostering Global Cybercrime Cooperation: As perpetrators of cyberattacks and crime are often located overseas, the US government must have the resources and authority to engage international partners to bring malicious actors to justice. We recommended in “A Roadmap to Strengthen US Cyber Enforcement,” that Congress should prioritize reintroducing and passing the “Cyber Diplomacy Act of 2019” (H.R.739) to elevate a State Department cyber office in a chain-of-command that allows it to have cross-cutting authority. Congress must also provide funding to expand and evaluate bilateral and multilateral cyber capacity-building efforts around the globe.²⁶
3. Improving State and Local Cyber Enforcement: Not every incident and crime will rise to the level that requires a federal response, and, like other crimes, state and local law enforcement will be called upon to respond in the absence of a federal response. Yet, the 18,000 law enforcement agencies in the United States lack the resources, tools, and personnel to respond effectively to cybercrime. Members of Congress should consider reintroducing the “Technology in Criminal Justice Act of 2019” (H.R.5227) and look to include additional provisions, such as those within the “Violence Against Women Reauthorization Act of 2019” (H.R.1585), to improve these agencies’ capacities to fight cybercrime.²⁷

Conclusion

The 117^th Congress can build off the work of the 116^th session’s work and look to the 316 bills that were introduced for policy ideas, while also improving upon the 14 bills that were signed into law. Members should also focus on areas underrepresented in the 116^th  Congress, specifically measures that impose consequences on malicious cyber actors, while filling gaps in areas that received significant attention, like critical infrastructure resilience. Members of the 117^th Congress will have a strong partner in President Biden—who has shown a willingness to work on bipartisan issues—to advance legislation that will close the cyber enforcement gap by strengthening relationships with private, local, and international partners.