Thread by @ericgeller

New: FBI Cyber Division chief Bryan Vorndran told House Oversight in written statement for the record that Biden admin is “troubled” that cyber incident reporting mandate doesn’t set up simultaneous reporting to CISA *and* FBI.

Story with @woodruffbets: politico.com/news/2021/11/1…

Going beyond what he said at the still-ongoing hearing, Vorndran's statement says the current legislation “fails to recognize the critical expertise and role” of DOJ/FBI.

Both CISA and the FBI “should immediately receive all information mandated to be reported,” Vorndran wrote.

Needless to say, this could throw a wrench into the plan to pass the painstakingly crafted incident reporting mandate that is in the House NDAA and is expected to be folded into the Senate NDAA soon.

I've asked the legislation's sponsors if they'll rework the provisions.

In his written statement for today's hearing, Vorndran also said that the Biden administration believes that “both DHS and DOJ should be co-equal partners in developing the rules that will be used to set incident reporting requirements."

Current bill leaves this to DHS/CISA.

.@ncdinglis alluded to the Biden administration's concerns at today's hearing.

https://twitter.com/ericgeller/status/1460631450454315017

At the hearing, Vorndran said: “I can't stress enough the importance of the FBI receiving full and immediate access to cyber incidents so we can act on them as soon as possible and in unison with our federal partners at CISA.”

Vorndran also said at the hearing that the current legislation would hinder the FBI's ability to quickly respond to attacks. “Why would a team bench one of its best players in the first quarter of the Super Bowl?" he asked. "It doesn't make a lot of sense to me."

As we wait to see whether the Biden administration can convince Congress to make cyber incident reporting a joint CISA/FBI program in the eleventh hour before NDAA passage, House bill sponsor @RepYvetteClarke defends having CISA run it alone.