Security1 publisher2 min readPublished
Bipartisan bills would put biomanufacturing and genomic data inside CISA's infrastructure planning
Five lawmakers announced two bills putting biotech and genomic data under CISA's infrastructure planning, with no new sector. If enacted, DHS would contact key biotech firms and fold their input into the National Infrastructure Protection Plan this year.
The Watch · Security desk
What happened
- A bipartisan group announced the Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act and the Protecting Biological Data Act on Thursday, with identical cosponsors.
- The first bill directs DHS to identify key biotech players, reach out to them and update the National Infrastructure Protection Plan this year with their input.
- The second covers systems holding genomic sequences and sensitive biometric data, adds joint CISA exercises with industry and gives CISA new biometric-security staff.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Firms that store genomic sequences or biometric data would fall inside CISA's critical-infrastructure scope and become candidates for joint exercises and attention from new federal security staff.
- decision Biotech firms DHS names as key players would have to decide how much security detail to hand over as input for the revised national protection plan.
- constraint Keeping the 16-sector map leaves biotech companies working through whichever health, agriculture or industrial sector arrangements cover them now, with the new plans layered on top.
- precedent If enacted, the approach gives Congress a way to add an industry to CISA planning without the new-sector designation that space and AI advocates have lobbied for.
In CyberScoop's account of the two bills, every obligation falls on DHS and CISA: plans, outreach, exercises, staff [4][5]. Both bills would amend the law that created DHS [3]. If either passes, a biotech security team would first see a request from DHS for input to the National Infrastructure Protection Plan. The first bill calls for steps to update that plan this year [4].
No other date appears in the record. The bills were announced Thursday and are still proposals [2]. Until one is enacted, the update date binds no agency and no company.
The second bill targets data. It would treat systems handling genomic sequences and sensitive biometric data as critical infrastructure [5]. Senator Todd Young, R-Ind., chairs the National Security Commission on Emerging Biotechnology, and he tied the bill to data access [10]. "Just as we are serious about where the sensitive data of Americans is stored and who can access it, we should be equally serious about protecting our biological data and infrastructure," Young said [12].
The sector map stays at 16 [1][6]. Biotech today cuts across the health, agricultural and industrial sectors, and the bills leave it there [7]. Some industry groups and experts have lobbied for new sectors, including space and artificial intelligence [9]. Young still used the language of designation. "Designating biotech as critical infrastructure is about recognizing its strategic importance and making sure the capabilities America will depend on tomorrow remain resilient and protected from foreign threats," he said [13].
CyberScoop's report puts two incidents next to the bills. Boston Scientific and Amgen each disclosed a recent cyberattack within the last two months [8]. The report does not describe either intrusion. Nothing public links the two attacks to a single actor or to the genomic and biometric systems the second bill covers [8].
There are five sponsors, three Democrats and two Republicans [15]. In the House they are Ro Khanna, Stephanie Bice and Scott Peters; in the Senate, Young and Maggie Hassan [11]. "These bipartisan bills will help ensure we are protecting this sector from physical and cyber threats while keeping America as the world leader in biotechnology," said Khanna, D-Calif., a member of the commission [14].
What to watch
- Committee referral, markup or a floor vote on either bill in the House or Senate.
- Which biotech companies DHS identifies as key players, and a draft of the revised National Infrastructure Protection Plan.
- Technical disclosures from Boston Scientific or Amgen showing whether biometric or genomic systems were reached.