When Congress returns this week from summer recess, legislative measures on cybersecurity have a chance to move. Yet, responding to Hurricane Harvey will be job one for lawmakers, along with several pressing budget matters.
Action is still possible this year on a long list of cyber priorities including: Upgrading the Department of Homeland Security's cyber functions, reauthorizing DHS for the first time, the PATCH Act on creating a process for disclosing vulnerabilities in software, modernizing the government's information technology, and adopting a national cybersecurity doctrine based on deterrence.
In addition, the Senate may consider a nominee to lead DHS if President Trump puts forward a candidate to succeed John Kelly, now White House chief of staff.
Bills on the cybersecurity workforce and the security of interconnected cars are also jockeying for space on the House and Senate fall agenda.
Congress is scheduled to be in session for about 12 weeks between now and the end of the year, although that could change as lawmakers deal with disaster relief, spending bills and the debt ceiling.
House Homeland Security Chairman Michael McCaul, R-Texas, last week toured the disaster areas just south of his Austin-based district and clearly will make the Harvey response and recovery a primery focus of his panel. His committee is among the panels with prime cyber jurisdiction.
Likewise, sources said, hurricane-related issues immediately climbed to the top of Senate Homeland Security and Governmental Affairs Chairman Ron Johnson's, R-Wis., priority list.
But a bill to reorganize and enhance DHS' cyber functions could move quickly when given a chance, according to sources.
"The bill has large bipartisan support as well as support from former officials in both the Obama and Bush administrations," commented Matthew Ballard of the Glen Echo Group consulting firm and a former House Homeland Security staffer. "This is an easy win for Congress."
The cyber reorganization bill has faced hurdles in the House due to conflicts among different committees with jurisdiction over DHS, but Ballard said a January memorandum of understanding among the panels should smooth the way for passage this fall. McCaul has said he expects a House vote in October.
The next question is when the bill will move in the Senate Homeland Security panel. The issue is on Johnson's priority list, according to sources, but the trick will be finding time amid the Harvey efforts and other issues such as possibly confirming a new DHS secretary.
Johnson also is a lead sponsor of the PATCH Act, which would spell out a process for getting information held by the government on software vulnerabilities into the hands of the private sector.
Johnson might also take up another House-passed bill, the Modernizing Government Technology Act, by Rep. Will Hurd, R-Texas, that could help shore up cyber defenses on the government side.
"I'd say many are watching what happens with the MGT Act in the Senate," said an industry source. "The bill is in Sen. Johnson's court. The chairman seems open to moving the bill, yet industry — and the administration — is awaiting a commitment from him to mark it up in the HSGAC on a specific date."
This source also pointed to the cyber deterrence elements in the Senate's defense authorization bill, calling that language "worth watching."
Senate Armed Services Chairman John McCain, R-Ariz., and Sen. Mike Rounds, R-S.D., made deterrence policy a priority for the annual defense bill now on the Senate floor.
Also, a House Homeland Security subcommittee holds a hearing this week on the cyber workforce, a topic of intense concern to business groups, while Senate Commerce Chairman John Thune, R-S.D., suggested before the break that his panel would move legislation addressing the cybersecurity of self-driving cars perhaps in September.
Charlie Mitchell is editor of InsideCybersecurity.com, an exclusive service covering cybersecurity policy from Inside Washington Publishers, and author of "Hacked: The Inside Story of America's Struggle to Secure Cyberspace," published by Rowman and Littlefield.