Eric Geller

Eric Geller @ericgeller

@ObsKenobs I remember this scene — PolitiTweet.org

Eric Geller @ericgeller

@KirklandDave That's not him — PolitiTweet.org

Eric Geller @ericgeller

In Rehoboth and just saw a pair of helicopters, so I think he's about to land. — PolitiTweet.org

Eric Geller @ericgeller

okay this was good — PolitiTweet.org

Eric Geller @ericgeller

BIF isn’t really a $1 trillion bill. It’s ~$550 billion in new spending plus reauthorizations of existing programs. Anyway, time to see whether moderates hold up their end of the bargain and pass BBB, which experts say will help mitigate existential and societal crises. — PolitiTweet.org

Eric Geller @ericgeller

@Grace_Segers 🎶 i've got the mooooves like schumer 🎶 — PolitiTweet.org

Eric Geller @ericgeller

@dceiver @fordm @Grace_Segers jason stay away from grace when it comes to nerd podcasts she's too busy sorry — PolitiTweet.org

Eric Geller @ericgeller

@AkilahObviously @darth FAUCI — PolitiTweet.org

Eric Geller @ericgeller

@Grace_Segers something something aggressive negotiations — PolitiTweet.org

Eric Geller @ericgeller

"The fact that the mayor has chosen to engage in performative political steps...rather than engage in serious police reform that community members have been calling for for years is why we’ve had to sue the District so many times..." https://t.co/LEPJ0mQElj — PolitiTweet.org

Eric Geller @ericgeller

just thinking about the fact that the producers of Jeopardy made this vile meathead a guest host — PolitiTweet.org

Eric Geller @ericgeller

the utter shamelessness https://t.co/lEAM88t5eI https://t.co/uuHyEW4Y2C — PolitiTweet.org

Eric Geller @ericgeller

Worth noting that these changes aren't just the result of the HSGAC/SSCI negotiations. A HSGAC aide tells me that they also reflect "additional feedback from the Administration and stakeholders." So some of these changes likely came from WH, CISA, and/or industry suggestions. — PolitiTweet.org

Eric Geller @ericgeller

The compromise bill also adds GAO reports on: * The security impacts of the exemptions to the reporting mandate, and the burdens on entities required to report * The effectiveness of the enforcement mechanisms (subpoenas and contractor debarment) — PolitiTweet.org

Eric Geller @ericgeller

Another change: The final bill now allows OMB, in consultation with NCD, to set a deadline below the legislative maximum of 24 hours for CISA to share incident reports with other appropriate agencies, especially sector risk management agencies. — PolitiTweet.org

Eric Geller @ericgeller

Another potentially notable change: Instead of CISA sharing subpoenaed info with DOJ or a regulator after determining that it merits enforcement action, DOJ and regulators now review the info and make that determination. https://t.co/IAr71oqVgA — PolitiTweet.org

Eric Geller @ericgeller

Here's an interesting new paragraph in the compromise bill: An exemption to the reporting mandate for "multi-stakeholder organizations" like @ICANN and @theiana that manage DNS functions. Anyone want to tell me why this is necessary? https://t.co/Onej8QvANg — PolitiTweet.org

Eric Geller @ericgeller

Other big changes: * Management of incident reporting program goes to CISA's NCCIC, instead of a new office * CISA has 1 year, instead of 90 days, to create the ransomware vulnerability warning program * New 4-year sunset for warning program — PolitiTweet.org

Eric Geller @ericgeller

And as for that final rule, the compromise bill gives CISA more time to issue it — 18 months instead of 12. These two changes could significantly push back how soon a cyber incident reporting mandate takes effect. HSGAC had given CISA only 270 days to do an IFR. — PolitiTweet.org

Eric Geller @ericgeller

Second, it changes CISA's initial action from an interim final rule (which can take effect immediately) to a notice of proposed rulemaking (which describes & seeks comments on a proposed regulation but does not implement it). This means nothing takes effect until the final rule. — PolitiTweet.org

Eric Geller @ericgeller

First, it eliminates the requirement that companies facing ransom demands conduct “due diligence reviews” before paying to determine if other data-recovery methods exist. This provision led to some industry grumbling when HSGAC included it in the ransomware section of its bill. — PolitiTweet.org

Eric Geller @ericgeller

So that's how the big inter-committee disagreements shook out. HSGAC mostly got what it wanted. Not surprising, given that it had the jurisdiction and the industry support. But the final measure differs from the latest HSGAC bill in other ways, some of them notable... — PolitiTweet.org

Eric Geller @ericgeller

On the upper limit for a CISA-determined reporting deadline, we have a true compromise. SSCI wanted 24 hours. HSGAC originally wanted 7 days. But as a result of negotiations, HSGAC later released a bill with 72 hours, and that's the upper limit in the final bill. — PolitiTweet.org

Eric Geller @ericgeller

First, where HSGAC won: * Only covers confirmed incidents, not potential ones * Doesn't require reporting by cyber service providers * Doesn't include fines Next, where SSCI won: * Requires reporting by all federal contractors — PolitiTweet.org

Eric Geller @ericgeller

Here's the text of the compromise cyber incident reporting measure, filed as an NDAA amendment: https://t.co/f1bpV6bJz1 In addition to resolving the big HSGAC/SSCI disagreements, the final bill also contains some other notable changes. 🧵 — PolitiTweet.org

Eric Geller @ericgeller

Good analysis by @Joseph_Marks_ of the increasing possibility that bipartisan legislating on cyber issues will break down over disputes about regulation. https://t.co/zEKiEzLpXu https://t.co/nRYAqXK5qd — PolitiTweet.org

Eric Geller @ericgeller

What a weird time — PolitiTweet.org

Eric Geller @ericgeller

It looks like a cyber incident reporting mandate will finally become law. Peters, Portman, Warner, and Collins seem to have resolved the differences b/w the HSGAC and SSCI bills. They're filing an NDAA amendment w/ a compromise measure, along with Peters' FISMA reform bill. https://t.co/MzdaHD2HI3 — PolitiTweet.org

Eric Geller @ericgeller

New: If you help the State Department identify or locate a leader of the DarkSide ransomware gang, you might get $10 million for your trouble. Help the U.S. arrest or convict a regular DarkSide member and you could get $5 million. https://t.co/keYbSn9XxX — PolitiTweet.org

Eric Geller @ericgeller

@thechrisharrod @snlyngaas @HowellONeill @selenalarson 😂 — PolitiTweet.org