1. Short title
This Act may be cited as the “Senate Cybersecurity Protection Act”.
Senate Cybersecurity Protection Act
A BILL
To authorize the Sergeant at Arms to protect the personal technology devices and accounts of Senators and covered employees from cyber attacks and hostile information collection activities, and for other purposes.
2. Definitions
In this Act—
the term covered employing office means—
the personal office of a Senator;
the office of a committee of the Senate;
any other office of the Senate not described in subparagraph (A) or (B); or
the office of a joint committee or joint commission;
the term covered employee means an individual—
who is employed or serving in a position as—
an officer or employee of a covered employing office;
a detailee in a covered employing office, without regard to whether the service is on a reimbursable basis; or
a fellow in a covered employing office, without regard to whether the position is compensated or the source of the compensation;
who is not a Senate authorizer; and
whom the covered employing office has determined is highly vulnerable to cyber attacks and hostile information collection activities because of the position of the individual;
the term personal account means an account for online or telecommunications services (including telephone, residential internet access, email, text and multimedia messaging, cloud computing, social media, health care, and financial services)—
used by a Senate authorizer or covered employee;
that is not administered or operated by the Sergeant at Arms; and
with respect to which the parties signing the security memorandum of understanding as described in paragraph (6)(A) jointly agree that the Sergeant at Arms will provide security, in accordance with this Act;
the term personal technology device—
means a handheld communications device, laptop computer, desktop computer, or other internet-connected device—
used by a Senate authorizer or covered employee;
that is not provided to the Senate authorizer or covered employee, or administered, by the Sergeant at Arms; and
with respect to which the parties signing the security memorandum of understanding as described in paragraph (6)(A) jointly agree that the Sergeant at Arms will provide security, in accordance with this Act; and
may, if agreed to by the parties pursuant to the security memorandum of understanding, include any computer network to which a computer or device described in subparagraph (A) connects;
the term provide security means to provide training, advice, support, technical assistance, and other services to prevent, detect, and recover from cyber attacks and hostile information collection activities;
the term security memorandum of understanding means a written memorandum of understanding that—
is signed by—
the Sergeant at Arms;
the Senate authorizer or covered employee for whom the security will be provided pursuant to the memorandum; and
if the security is being provided for a covered employee, the applicable Senate authorizer for the covered employee;
specifies the personal accounts or personal technology devices, or categories of personal accounts or personal technology devices, for which the Sergeant at Arms will provide security;
describes the rights and responsibilities of each signing party relating to the provision of security and with respect to privacy; and
shall be effective for a period of not more than 1 year;
the term Senate authorizer—
means a Senator or the head of a Senate office described in paragraph (1)(C);
when used with respect to a covered employee not described in subparagraph (C), means the Senator or the head of a Senate office who has final authority to appoint, hire, discharge, and set the terms, conditions, or privileges of the employment of the covered employee; and
when used with respect to a covered employee of a joint committee or joint commission, the Senator from the majority party of the Senate who—
is a member of, or has authority over, the committee or commission; and
serves in the highest leadership role for a Senator in the committee or commission or, if there is no such leadership role, is the most senior Senator from the majority party of the committee or commission; and
the term Sergeant at Arms means the Sergeant at Arms and Doorkeeper of the Senate.
3. Cybersecurity assistance for personal technology devices and accounts
Authorization—
In general— Upon request by a Senate authorizer and upon the signing of a security memorandum of understanding by the parties described in section 2(6)(A), the Sergeant at Arms may use funds provided for official purposes in order to provide security for personal accounts and personal technology devices of the Senate authorizer or a covered employee of the Senate authorizer.
Annual renewal— A Senate authorizer or covered employee for whom the Sergeant at Arms is providing security for personal accounts and personal technology devices under a security memorandum of understanding may continue to receive such security services under this Act if the applicable signing parties described in section 2(6)(A) enter into a security memorandum of understanding each year.
Aggregate reporting— By the date that is 2 years after the date of enactment of this Act, and annually thereafter, the Sergeant at Arms shall prepare and submit to the Committee on Rules and Administration and the Select Committee on Intelligence of the Senate a report that includes aggregate statistics for the preceding fiscal year of the number of Senate authorizers and covered employees who entered into a security memorandum of understanding with the Sergeant at Arms and received security assistance for their personal accounts and personal technology devices.
Rule of construction— Nothing in this Act shall be construed to encourage any Senator or covered employee to conduct official Government business using a personal technology device.
4. Annual GAO reports on cybersecurity and surveillance threats
Annual reports—
In general— Beginning 180 days after the date of enactment of this Act, and annually thereafter, the Comptroller General of the United States shall prepare and submit, to the Committee on Rules and Administration and the Select Committee on Intelligence of the Senate, a report regarding cybersecurity and surveillance threats to the legislative branch.
Statistics— Each report required under paragraph (1) shall include statistics on cyber attacks, and other incidents of espionage or surveillance targeted against Senators or the immediate families or staff of the Senators, in which the non-public communications and other private information of such targeted individuals were lost, stolen, or otherwise subject to unauthorized access by criminals or a foreign government.
Consultation— In preparing the report required under subsection (a), the Comptroller General shall consult with the Director of National Intelligence and the Sergeant at Arms.