The U.S. House Homeland Security Committee has introduced new legislation aimed at strengthening the nation’s cybersecurity defences against threats from China. This bill establishes an interagency task force to assess the risks by state-sponsored cyber actors, including groups like Volt Typhoon, linked to the Chinese government.
A United Front Against Cyber Threats
On September 24, 2024, Representative Laurel Lee introduced the “Strengthening Cyber Resilience Against State-Sponsored Threats Act” to counter the cyber threats from state-sponsored actors from the People’s Republic of China (PRC). The bill proposes the creation of an interagency task force led by the Cybersecurity and Infrastructure Security Agency (CISA) in collaboration with the FBI. This task force will focus on coordinating federal efforts to counter threats (APTs) from Chinese cyber groups, such as Volt Typhoon. The legislation mandates that the task force assess the risks to U.S. infrastructure, including sectors like energy, water, transportation, and communications. Volt Typhoon, one of key actors, has reportedly targeted these areas, gaining access to systems and remaining undetected for extended periods. “A siloed approach to cybersecurity will only give our adversaries the upper hand,” Representative Lee stated.
Components of the Bill
The proposed bill outlines several measures aimed at improving the cybersecurity of the United States. It mandates the task force to submit annual reports to Congress detailing the findings and progress in countering cyber threats. These reports will include:
- The task force will analyze the tactics, techniques, and procedures (TTPs) used by Chinese cyber actors like Volt Typhoon, focusing on risks that could impact U.S. infrastructure, as part of their assessments of state-sponsored cyber tactics.
- Emphasizing resource and authority recommendations, the bill looks to identify the support federal agencies need to improve their capability to detect, analyze, and counteract cyber threats from state-sponsored actors. This may involve improving technical expertise and tools for U.S. agencies.
- The task force will deliver evaluations to assess national security threats, concentrating on the damage to U.S. critical infrastructure in a crisis involving the U.S. and China. The focus will also include the actors’ ability to impede the movement and deployment of U.S. armed forces.
Representative Lee and her co-sponsors, including Homeland Security Chairman Mark E. Green and Select Committee on the Chinese Communist Party Chairman John Moolenaar, stressed the importance of confronting this threat. “While individual agencies have worked to address the threats posed by malign cyber actors, a siloed approach will not suffice in combating these escalating cyber intrusions,” Green stated.
Cybersecurity Challenges
The Chinese government’s continued investment in cyber capabilities and espionage has been shown by recent activity from groups like Volt Typhoon and Flax Typhoon. These groups have infiltrated sectors of U.S. infrastructure, such as transportation and energy, to disrupt services. “Volt Typhoon remained undetected and undeterred in our networks for too long,” warned Chairman Green. Cybersecurity experts have noted that China’s actions could lead to long disruptions if geopolitical tensions escalate in the Indo-Pacific region. A cyber attack on U.S. infrastructure could cripple transportation or energy systems, impairing military operations.
A Coordinated Federal Response
To address the threat, the task force will include representatives from various federal agencies, all of whom will be subject matter experts with knowledge of cybersecurity and threat intelligence. The task force’s objective is to unite CISA, the FBI, and sector-specific agencies in a collective effort to lessen state-sponsored cyber threats. The task force will also launch awareness campaigns targeting critical infrastructure operators, educating them on federal support and resources available to combat these cybersecurity risks. These campaigns will be necessary in ensuring that private sector partners are equipped to handle the advanced tactics employed by Chinese actors.
The introduction of the “Strengthening Cyber Resilience Against State-Sponsored Threats Act” is a positive step in the U.S. government’s efforts to protect infrastructure from state-sponsored cyber threats.
Image credit: Pixels Hunter, Adobestock
