Department of Homeland Security Insider Threat and Mitigation Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 3907 To amend the Homeland Security Act of 2002 to establish the Insider Threat Program, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 23, 2019 Mr. KING of New York (for himself, Mr. GREEN of Tennessee, and Mr. WALKER) introduced the following bill; which was referred to the Com- mittee on Homeland Security A BILL To amend the Homeland Security Act of 2002 to establish the Insider Threat Program, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Department of Home- 4 land Security Insider Threat and Mitigation Act of 2019’’. 5 SEC. 2. ESTABLISHMENT OF INSIDER THREAT PROGRAM. 6 (a) IN GENERAL.—Title I of the Homeland Security 7 Act of 2002 (6 U.S.C. 111 et seq.) is amended by adding 8 at the end the following new section: 9 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 2 •HR 3907 IH ‘‘SEC. 104. INSIDER THREAT PROGRAM. 1 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab- 2 lish an Insider Threat Program within the Department. 3 Such Program shall— 4 ‘‘(1) provide training and education for Depart- 5 ment personnel to identify, prevent, mitigate, and re- 6 spond to insider threat risks to the Department’s 7 critical assets; 8 ‘‘(2) provide investigative support regarding po- 9 tential insider threats that may pose a risk to the 10 Department’s critical assets; and 11 ‘‘(3) conduct risk mitigation activities for in- 12 sider threats. 13 ‘‘(b) STEERING COMMITTEE.— 14 ‘‘(1) IN GENERAL.—The Secretary shall estab- 15 lish a Steering Committee within the Department. 16 The Under Secretary for Intelligence and Analysis 17 shall serve as the Chair of the Steering Committee. 18 The Chief Security Officer shall serve as the Vice 19 Chair. The Steering Committee shall be comprised 20 of representatives of the Office of Intelligence and 21 Analysis, the Office of the Chief Information Officer, 22 the Office of the General Counsel, the Office for 23 Civil Rights and Civil Liberties, the Privacy Office, 24 the Office of the Chief Human Capital Officer, the 25 Office of the Chief Financial Officer, the Federal 26 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 3 •HR 3907 IH Protective Service, the Office of the Chief Procure- 1 ment Officer, the Science and Technology Direc- 2 torate, and other components or offices of the De- 3 partment as appropriate. Such representatives shall 4 meet on a regular basis to discuss cases and issues 5 related to insider threats to the Department’s crit- 6 ical assets, in accordance with subsection (a). 7 ‘‘(2) RESPONSIBILITIES.—Not later than one 8 year after the date of the enactment of this section, 9 the Under Secretary for Intelligence and Analysis 10 and the Chief Security Officer, in coordination with 11 the Steering Committee established pursuant to 12 paragraph (1), shall carry out the following: 13 ‘‘(A) Develop a holistic strategy for De- 14 partment-wide efforts to identify, prevent, miti- 15 gate, and respond to insider threats to the De- 16 partment’s critical assets. 17 ‘‘(B) Develop a plan to implement the in- 18 sider threat measures identified in the strategy 19 developed under subparagraph (A) across the 20 components and offices of the Department. 21 ‘‘(C) Document insider threat policies and 22 controls. 23 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 4 •HR 3907 IH ‘‘(D) Conduct a baseline risk assessment of 1 insider threats posed to the Department’s crit- 2 ical assets. 3 ‘‘(E) Examine existing programmatic and 4 technology best practices adopted by the Fed- 5 eral Government, industry, and research insti- 6 tutions to implement solutions that are vali- 7 dated and cost-effective. 8 ‘‘(F) Develop a timeline for deploying 9 workplace monitoring technologies, employee 10 awareness campaigns, and education and train- 11 ing programs related to identifying, preventing, 12 mitigating, and responding to potential insider 13 threats to the Department’s critical assets. 14 ‘‘(G) Require the Chair and Vice Chair of 15 the Steering Committee to consult with the 16 Under Secretary for Science and Technology 17 and other appropriate stakeholders to ensure 18 the Insider Threat Program is informed, on an 19 ongoing basis, by current information regarding 20 threats, beset practices, and available tech- 21 nology. 22 ‘‘(H) Develop, collect, and report metrics 23 on the effectiveness of the Department’s insider 24 threat mitigation efforts. 25 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 5 •HR 3907 IH ‘‘(c) DEFINITIONS.—In this section: 1 ‘‘(1) CRITICAL ASSETS.—The term ‘critical as- 2 sets’ means the people, facilities, information, and 3 technology required for the Department to fulfill its 4 mission. 5 ‘‘(2) INSIDER.—The term ‘insider’ means— 6 ‘‘(A) any person who has access to classi- 7 fied national security information and is em- 8 ployed by, detailed to, or assigned to the De- 9 partment, including members of the Armed 10 Forces, experts or consultants to the Depart- 11 ment, industrial or commercial contractors, li- 12 censees, certificate holders, or grantees of the 13 Department, including all subcontractors, per- 14 sonal services contractors, or any other category 15 of person who acts for or on behalf of the De- 16 partment, as determined by the Secretary; or 17 ‘‘(B) State, local, Tribal, territorial, and 18 private sector personnel who possess security 19 clearances granted by the Department. 20 ‘‘(3) INSIDER THREAT.—The term ‘insider 21 threat’ means the threat that an insider will use his 22 or her authorized access, wittingly or unwittingly, to 23 do harm to the security of the United States, includ- 24 ing damage to the United States through espionage, 25 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 6 •HR 3907 IH terrorism, the unauthorized disclosure of classified 1 national security information, or through the loss or 2 degradation of departmental resources or capabili- 3 ties.’’. 4 (b) REPORTING.— 5 (1) IN GENERAL.—Not later than two years 6 after the date of the enactment of section 104 of the 7 Homeland Security Act of 2002 (as added by sub- 8 section (a) of this section) and biennially thereafter 9 for the next four years, the Secretary of Homeland 10 Security shall submit to the Committee on Home- 11 land Security and the Permanent Select Committee 12 on Intelligence of the House of Representatives and 13 the Committee on Homeland Security and Govern- 14 mental Affairs and the Select Committee on Intel- 15 ligence of the Senate a report on how the Depart- 16 ment of Homeland Security and its components and 17 offices have implemented the strategy developed pur- 18 suant to subsection (b)(2)(A) of such section 104, 19 the status of the Department’s risk assessment of 20 critical assets, the types of insider threat training 21 conducted, the number of Department employees 22 who have received such training, and information on 23 the effectiveness of the Insider Threat Program (es- 24 tablished pursuant to subsection (a) of such section 25 VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS 7 •HR 3907 IH 104), based on metrics developed, collected, and re- 1 ported pursuant to subsection (b)(2)(H) of such sec- 2 tion 104. 3 (2) DEFINITIONS.—In this subsection, the 4 terms ‘‘critical assets’’, ‘‘insider’’, and ‘‘insider 5 threat’’ have the meanings given such terms in sec- 6 tion 104 of the Homeland Security Act of 2002 (as 7 added by subsection (a) of this section). 8 (c) CLERICAL AMENDMENT.—The table of contents 9 in section 1(b) of the Homeland Security Act of 2002 is 10 amended by inserting after the item relating to section 11 103 the following new item: 12 ‘‘Sec. 104. Insider Threat Program.’’. Æ VerDate Sep 11 2014 21:35 Jul 30, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6301 E:\BILLS\H3907.IH H3907 kjohnson on DSK79L0C42 with BILLS