Should Federal Agencies Take Steps to Prevent Cyberattacks Without Consulting Employees First? (H.R. 4361)

What is H.R. 4361?

(Updated November 15, 2017)

This bill would give the heads of federal agencies the authority to do anything to secure any information stored electronically by each agency. Basically, it gives the heads of federal agencies the ability to make changes to their agency’s cybersecurity without notifying anyone in advance.

The bill was amended before being sent to the floor of the House to include a provision which prevents the bill from modifying existing laws about federal cybersecurity. The bill specifically mentions the Cybersecurity Act of 2015, which deals with cybersecurity information sharing between the Departments of Homeland Security, Justice, and Defense.

However, the bill would overturn a decision by the Federal Labor Relations Authority from 2014 that prevents federal agencies from blocking employee access to e-mail.

Argument in favor

Federal agencies must be able to take whatever steps are necessary to protect their information from cyber-attacks, even if it means employees don’t know in advance.

Argument opposed

This bill gives federal agencies the power to randomly restrict what employees can do without consulting with anyone, all under the guise of preventing cyber-attacks.

Impact

People trying to compromise the cybersecurity of federal agencies; labor unions for federal employees; federal agencies and their employees.

Cost of H.R. 4361

The CBO estimates that the cost of implementing the bill would be negligible because the bill wouldn’t affect revenues or direct spending significantly.

Additional Info

In Depth: Sponsoring Rep. Gary Palmer (R-AL) explained in a press release that the bill would give federal agencies the ability to protect themselves from cyber-attacks:

“Agencies should not be required to collectively bargain in order to take steps to secure data protecting federal agencies information systems and the personal information of federal employees. The directors of federal agencies have a responsibility to protect their IT systems and they should be able to carry out that responsibility without unnecessary interference. This bill will enhance the security of Federal information systems, and help prevent cyber-attacks.”

Rep. Elijah Cummings (D-MD) explained in a statement opposing the bill that the bill gave agency leaders too much authority by allowing them to take “any action” necessary to secure information:

“No matter what you believe about blocking employee access to email, this bill goes so far beyond that it loses the point. Could 'any action' mean violating the Privacy Act? Could 'any action' mean an agency can avoid required reports to Congress on cybersecurity?”

Of Note: The idea for this bill was prompted by a recent event in which the Office of Personnel Management (OPM) was breached by a cyber-attack. After the attack, the OPM tried to tighten its cybersecurity by restricting employee use of Facebook, Gmail, and more websites. However, union representatives delayed the new policy from taking effect, citing a Federal Labor Relations Authority ruling from 2014.

Media:

• Sponsoring Rep. Gary Palmer (R-AL) Press Release
• Rep. Elijah Cummings (D-MD) Statement

• CBO Cost Estimate