[Congressional Record Volume 165, Number 53 (Wednesday, March 27, 2019)]
[Senate]
[Pages S2045-S2046]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. WYDEN (for himself and Mr. Cotton):
  S. 890. A bill to authorize the Sergeant at Arms to protect the 
personal technology devices and accounts of Senators and covered 
employees from cyber attacks and hostile information collection 
activities, and for other purposes; to the Committee on Rules and 
Administration.
  Mr. WYDEN. Mr. President, today I, along with my colleague Senator 
Cotton from Arkansas, am introducing the Senate Cybersecurity 
Protection Act to defend the integrity of American democracy by 
providing cybersecurity protection for the personal accounts and 
electronic devices of Senators and and key members of their staff.
  In 2016, hackers working for the Russian government broke into a 
range of targets, including the network of the Democratic National 
Committee and the email account of Senator Hillary Clinton's 
presidential campaign manager, John Podesta. These widely publicized 
breaches are only the tip of the iceberg. These hacks are widely known 
today because the emails stolen from these accounts were subsequently 
weaponized and used as part of a campaign to influence the outcome of 
several elections--most publicly, the presidential race between Donald 
Trump and Hillary Clinton, but also U.S. House of Representatives races 
in Illinois, New Hampshire, New Mexico, North Carolina, Ohio, and 
Pennsylvania. Senator Lindsey Graham also reported that his campaign's 
email was successfully compromised.
  While the Russian hacks in 2016 were a watershed moment, these are 
merely the most visible and disruptive examples of foreign intelligence 
services

[[Page S2046]]

using offensive cyber capabilities to target those involved in our 
political process. Senior officials from the 2008 Obama and McCain 
presidential campaigns have publicly confirmed that both organizations 
were compromised by hackers. In 2017, the media reported that then-
White House Chief of Staff John Kelly's personal cell phone had been 
compromised, possibly for as long as ten months before the malware was 
discovered. And in 2018, media reports revealed that the personal email 
accounts of senior congressional staffers had been targeted by the 
notorious Russian hacking group ``Fancy-Bear.'' These and other events 
clearly demonstrate the unique threats faced by Senators and their 
staff. Unfortunately, as I revealed in a letter to Senate leadership 
last year, the Sergeant At Arms (SAA), which is responsible for the 
Senate's cybersecurity, informed me that it currently lacks the 
authority to use official Senate resources to protect the personal 
devices and accounts of Senators and key Senate staff, even when those 
staff are being targeted by foreign governments.
  Senators Cotton and I are not alone in recognizing the seriousness of 
this national security threat.
  Last year, then-Director of the National Security Agency Admiral 
Michael Rogers acknowledged in a letter to me that personal devices and 
accounts of senior U.S. government officials ``remain prime targets for 
exploitation.'' Likewise, in written responses to post-hearing 
questions from the Senate Intelligence Committee last year, Director of 
National Intelligence Dan Coats wrote that ``[t]he personal accounts 
and devices of government officials can contain information that is 
useful for our adversaries to target, either directly or indirectly, 
these officials and the organizations with which they are affiliated.'' 
The Appropriations Committee also noted last year in its report 
accompanying the 2019 Legislative Branch Appropriations bill that it 
``continues to be concerned that Senators are being targeted for 
hacking and cyber attacks, especially via their personal devices and 
accounts.''
  Currently, Senators and staffers are expected to protect their own 
devices and accounts from foreign government hackers. This is absurd. 
Senators and the vast majority of their staff are not cybersecurity 
experts, and certainly do not have the training our resources to defend 
themselves from sophisticated foreign intelligence agencies. Eric 
Rosenbach, who was formerly Chief of Staff to Secretary of Defense Ash 
Carter, has endorsed the bill we are introducing today, observing that 
``Senators and their staff should not be expected to go toe to toe with 
some of the most sophisticated adversaries in cyberspace; authorizing 
protection of personal accounts is a critical component of our cyber 
defense efforts.'' Likewise, Bruce Schreier, a noted cybersecurity 
expert has also endorsed the bill, stating that ``[i]t is ludicrous to 
expect individual senators and their staff to to defend themselves from 
spies and hackers. Hostile foreign intelligence services do not respect 
the arbitrary line between work and personal technology. As such, the 
U.S. government must extend its defensive cyber perimeter to include 
legislators' personal devices and accounts.''
  Our bill would permit the SAA to provide voluntary, opt-in 
cybersecurity assistance to Senators and key Senate staff to secure 
their personal devices and accounts. Any Senate staffer would be 
eligible to receive assistance, provided that the Senator employing 
them determines that they are highly vulnerable to cyber attacks and 
information collection because of their position in the Senate.
  There is precedent for extending cybersecurity protection to the 
personal devices of government officials. Section 1645 of the 2017 
National Defense Authorization Act permits the Secretary of Defense to 
provide personal device cybersecurity assistance to officials whom the 
secretary ``determines to be highly vulnerable to cyber attacks and 
hostile information collection activities because of the positions 
occupied by such personnel in the Department.'' The Senate 
Cybersecurity Protection Act is also similar to provisions included in 
the intelligence authorization bill approved by the Senate Select 
Committee on Intelligence in 2018, which would permit the Director of 
National Intelligence to protect the personal devices and accounts of 
high-risk staff in the intelligence community.
  Passage of this common sense, bipartisan legislation would provide 
Senators and their staff with much-needed protection for their personal 
accounts and devices, and with them, the integrity of American 
democracy. I thank my colleague Senator Cotton for his efforts on this 
bill, and hope the Senate will promptly pass this vital legislation.
                                 ______