Ritchie Torres: “A cyberattack on a software supply chain is like an infectious disease outbreak, spreading widely and rapidly, and…”

“A cyberattack on a software supply chain is like an infectious disease outbreak, spreading widely and rapidly, and causing untold damage far and wide. The SolarWinds espionage campaign against the United States, which spread surreptitiously through a software product, represents the greatest intrusion into the Federal Government in the history of the United States. SolarWinds should serve as a wake-up call. The United States Government can no longer take for granted the safety of the software it uses. The Federal Government must be proactive in identifying and correcting cyber vulnerabilities; and as the lead agency on cybersecurity, DHS in particular must emerge as the gold standard. I am therefore proud to partner, on a bipartisan basis, with my colleague, the gentleman from New York (Mr. Garbarino), to pass H.R. 4611, the DHS Software Supply Chain Risk Management Act of 2021. H.R. 4611 would require the DHS Under Secretary for Management to issue department-wide guidance that in turn requires DHS contractors to submit a software bill of materials, identifying the origin of each component of software provided to DHS. DHS should know the precise origin of the software it uses; whether a software component comes from a questionable firm that fails to follow best practices in cybersecurity; whether it comes from a hostile nation-state intent on planting back doors. Homeland security can easily die in darkness, and the purpose of H.R.…”