S-5541-119
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Sponsored by Edward Markey (D-MA)
What it does
The bill would establish, 90 days after enactment, an independent five-member Cybersecurity and AI Board of Investigations. The Board may review significant cyber incidents and near-misses affecting federal civilian and non-federal systems, publish reports with recommendations, and run a voluntary, anonymized near-miss reporting system. The Board may request documents and testimony and, with a majority Board vote, issue subpoenas to private entities and individuals, enforced through the Attorney General in federal court. Federal civilian agencies would have to respond in writing within 90 days to recommendations that apply to them. The Board would not assign legal fault, and other limits apply, including a restriction to incidents that can be reported using unclassified information.
Who benefits
Operators of critical infrastructure such as water utilities and telecommunications networks, which would receive public analyses and recommendations. Private companies that voluntarily share information, who would get liability, disclosure, and evidence-use protections. Federal civilian agencies and security researchers who would gain shared lessons and trend data. The general public, who depend on these systems and could see improved resilience, though the size of any such effect is uncertain.
Who is hurt
Companies and individuals subject to Board subpoenas, which would bear compliance costs and could face contempt proceedings for noncompliance. AI and technology vendors whose products may be named in public reports, with possible reputational effects despite the no-fault rule. Federal civilian agencies that would bear the burden of written responses and information requests. Taxpayers, who would fund a new agency whose cost the bill does not specify. Members of the public and journalists seeking records, since voluntarily submitted material would be exempt from FOIA and state open-records laws, and the Board is exempt from the Sunshine Act.
Supporters argue
Supporters argue that the United States lacks a standing, independent body to investigate major cyber incidents the way the National Transportation Safety Board investigates crashes. They contend that confidential near-miss reporting, liability protections, and a no-fault mandate would encourage companies to share information they now withhold. They point to a bipartisan membership cap, subpoena votes by the full Board, and public reports as safeguards that let the Board identify systemic AI-related vulnerabilities across sectors.
Opponents argue
Opponents argue that existing bodies such as CISA and sector regulators already investigate incidents, so a new agency would duplicate work and add cost. They contend that subpoena power over private parties, exemption from the Sunshine Act, and broad FOIA exemptions reduce transparency and burden businesses. They point to the fact that the bill does not specify funding, and that vendors may suffer reputational harm from public reports even though the Board assigns no legal fault.
Constitutional context
Congress's authority rests on the Commerce Clause and the Necessary and Proper Clause, and the Board's subpoenas must satisfy Fourth Amendment reasonableness limits for administrative subpoenas, as in Oklahoma Press Publishing Co. v. Walling (1946). The presidential removal power, limited here to inefficiency, neglect of duty, or malfeasance, implicates Humphrey's Executor v. United States (1935) and the narrowing in Seila Law v. CFPB (2020), whose application to a new multimember investigative board is unsettled.
Checks and balances
The bill creates an independent establishment in the executive branch, with presidential appointment, Senate confirmation, and for-cause removal. Checks include a party-balance cap, subpoena enforcement only through federal courts, reports to congressional committees, and agency written-response requirements, while the Board's exemptions from the Sunshine Act and FACA reduce public oversight.
Historical precedent
The National Transportation Safety Board and the Chemical Safety Board are existing independent, no-fault investigative bodies, and the Cyber Safety Review Board, created by executive order in 2022, performed similar reviews without statutory subpoena power.