Cybersecurity Policy Report, House Proposal Would Allow Foreign Officials to be Sued in U.S. for Hacking, (Jul 20, 2020)

By Tom Leithauser

Legislation that would allow U.S. courts to hear lawsuits against foreign governments accused of cyber attacks is one of several cyber-related amendments that House members will debate as they begin considering the House version of the fiscal year 2021 National Defense Authorization Act (HR 6395).

The House Rules Committee late Friday adopted a structured rule for consideration of HR 6395 that will permit the House to consider 407 amendments. The House adopted the rule today and began debate on the bill.

An amendment cosponsored by 52 House members would revise the Foreign Sovereign Immunities Act (FSIA), which generally limits the power of Americans to sue foreign governments, to allow lawsuits in U.S. courts against foreign governments accused of targeting Americans in cyberspace.

“A foreign state shall not be immune from the jurisdiction of the courts of the United States or of the states in any case . . . in which money damages are sought against a foreign state by a national of the United States for personal injury, harm to reputation, or damage to or loss of property resulting from . . . unauthorized access to or access exceeding authorization to a computer located in the United States; [or] unauthorized access to confidential, electronic stored information located in the United States,” the amendment says.

Lawsuits could also be filed against foreign governments that provide “material support or resources” for cyber attacks “including by an official, employee, or agent of such foreign state,” it says.

At CPR’s deadline, the House had not voted on the FSIA amendment or the other cyber amendments, some of which would implement the recommendations of the Cyberspace Solarium Commission (CSC), including one that would create a National Cyber Director position within the Executive Office of the President.

The cyber director would be Senate-confirmed and would coordinate the various cyber defense activities of civilian executive branch agencies. Stand-alone legislation to create the position was introduced in the House by Rep. Jim Langevin (D., R.I.), a member of the CSC (CPR, July 17). Lawmakers frequently offer bills as amendments to the NDAA because the defense bill offers a more certain path to adoption. Rep. Langevin is the lead sponsor of the bipartisan amendment, which has 17 cosponsors.

The Senate version of the NDAA (S 4049) would stop short of establishing the cyber director post and instead would seek an independent assessment of the feasibility of creating the post. Sen. Angus King (I., Maine), the CSC’s co-chair, has shown interest in amending S 4049 to require the creation of the position, but has not done so, he said, because of White House resistance.

Another bipartisan amendment offered by Rep. Langevin would give the Cybersecurity and Infrastructure Security Agency (CISA) subpoena power to help it warn critical infrastructure entities about potential cyber attacks. In rare cases, CISA might suspect that a critical infrastructure entity is about to be attacked, but it can’t identify the entity. Subpoena power would give it a legal tool to get information from Internet service providers that are reluctant to identify their customers. Stand-alone bills to give CISA subpoena power are pending in the House and Senate, and the CSC has recommended their passage.

Other CSC-inspired amendments to the NDAA include one that would direct the Department of Homeland Security to develop a strategy to spur U.S.-based e-mail providers to adopt the Domain-based Message Authentication, Reporting, and Conformance (DMARC) standard, which impedes hackers from using e-mail systems to launch phishing attacks by blocking suspicious e-mails.

DHS ordered federal agencies to implement DMARC technology in their e-mail systems, reports indicate the private sector has been slow to adopt the standard.

MainStory: DataSecurity FederalLegislation