OMB Approves FCC Satellite Spectrum Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that approved a final rule from the FCC on “Satellite Spectrum Abundance (SB Docket No. 25-180)”. The notice of proposed rulemaking was published on June 27th, 2025. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“On May 22, 2025, the Commission adopted a Notice of Proposed Rulemaking to seek further comment on ways to use the 12.7-13.25 GHz band (12.7 GHz band) and the 42.0-42.5 GHz band (42 GHz band) more efficiently and intensively. Specifically, the item seeks comment on the possibility of achieving more intensive use of the 12.7 GHz band by satellite communications through the removal of existing regulatory restrictions and the opening of the band to a wider range of satellite operations. Likewise, it seeks comment on the potential for more intensive use of the 42 GHz band by adding for the first time an allocation for fixed-satellite service (FSS). In both instances, the item seeks comment on ways to protect any incumbent spectrum users in the bands, as well as ways to protect spectrum users, particularly Federal operators, in adjacent bands.” 

This final rule will be covered under my limited Space Geek coverage and its publication will be reported in the appropriate Short Takes post. 

2 Advisories Published – 10-13-26

Today CISA’s NCCIC-ICS published two control system security advisories for products from Swann and Inductive Automation. 

Advisories  

Swann Advisory - This advisory describes three missing authentication for critical function vulnerabilities in the Swann Communications SWIFI-SE2KIC WiFi camera. The vulnerabilities were reported to CISA by Elliott Phillips. 

Inductive Automation Advisory - This advisory describes an incorrect authorization vulnerability in the Inductive Automation Ignition Software. The vulnerability was reported by Tim Hemingway. 

Review - Vulnerability Notifications

Last week I discussed HR 10671, the Securing Our Critical Infrastructure Act. The bill would require CISA to establish a vulnerability notification program for water facilities. Today, I would like to take a brief look at how such a program might work. 

Unfortunately, it is not really possible to produce a short version of the post that appears on my CFSN Detailed Analysis blog- https://patrickcoyle.substack.com/p/vulnerability-notifications - subscription required. It addresses the following topics: 

• Notification Agency,   
• Identification of Vulnerabilities, 
• Vulnerable Device Identification, 
• Notification Process, 
• Facility Response,   
• KEV Special Case,   
• Other Routes of Attack, and    
• Program Drawbacks   

The article will be removed from the normal paywall tomorrow. 

HR 10083 Introduced – Water Cyber Grant Reauthorization

Back in August, Rep Cisneros (D,CA) introduced HR 10083, the Water Technology and Resilience Reauthorization Act. This bill is a clean reauthorization of the EPA’s Advanced drinking water technology grant program {42 USC 300j-19h(b)}. Technically, no new funding is authorized by this bill; it continues the current $10 million annual funding authorization. 

According to a press release from Cisneros’ office:  

“The grant funding would be used to invest in technologies that address cybersecurity vulnerabilities in drinking water systems. Recent reports showed that at least seven U.S. states have reported cyberattacks affecting water infrastructure to the FBI. The Metropolitan Water District of Southern California signed on as a supporting organization.” 

The bill would amend §300j-19h(b)(5)(A) to read: 

“(A) Authorization of appropriations - There is authorized to be appropriated to carry out the program $10,000,000 for each of fiscal years 2022 through 2026 2027 through 2031, to remain available until expended.” 

Grants under this program can be used to fund “technology that could address cybersecurity vulnerabilities” {§300j-19h(b)(1)(A)(ii) and (iii)} 

Moving Forward  

While Cisneros is not a member of the House Energy and Commerce Committee to which the bill was referred for consideration, but one of his eight cosponsors, Rep Carter (D,LA), is a member of the Committee. This means that there may be sufficient influence to see the bill considered by that Committee. While I do not expect any organized opposition to this bill, I would be very surprised to see any action on the bill this late in the session. 

Even without this bill, Congress could fund this program in the FY 2027 spending bill, but it was not included in the House IER spending bill (HR 9171). But the water facility cybersecurity situation became more of a recognized problem after that bill was crafted, so the grant funding could still end up in the year end spending mix. 

Review – Bills Introduced – 10-9-26

Yesterday, with the House and Senate meeting in pro forma session, there were 31 bills introduced. Two of those bills may receive additional coverage in this blog: 

HR 10777 To codify certain policies to combat transnational cyber-enabled crime, and for other purposes. Fallon, Pat [Rep.-R-TX-4]   

HR 10790 To amend the Clean Air Act to require that at least one member of the Chemical Safety and Hazard Investigation Board has demonstrated knowledge and substantial experience in the trades or industrial labor, and for other purposes. Perez, Marie Gluesenkamp [Rep.-D-WA-3]    

For more information on these bills, including legislative history for similar bills in the 118th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-10-9-26 - subscription required. 

Review- HR 10671 Introduced – Vulnerability Warning

Last week, Rep Gottheimer (D,NJ) introduced HR 10671, the Securing Our Critical Infrastructure Act. The bill would reinstate and revise a recently expired CISA ransomware notification program to turn it into a program to notify small water utilities of known vulnerabilities. No new funding is authorized. 

This bill would amend §105, Ransomware Vulnerability Warning Pilot Program, of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (Division Y of PL 117-103, 136 STAT. 1055). The authorization for that program {§105(g)} terminated on March 15th, 2026. That program was codified at 6 USC 652 Note. 

Moving Forward  

Neither Gottheimer, nor any of his four cosponsors, are members of the House Homeland Security Committee to which this bill was assigned for consideration. This means that it is unlikely that there will be sufficient influence to see the bill considered by that Committee. Without additional spending for CISA to fund this new program, there is no way that the Agency would have enough personnel to support these new requirements. I suspect that common knowledge of that fact will ensure that there would be minimal Republican support for this legislation, if it were to be considered. 

Commentary 

This is an unusual solution to the problem of vulnerabilities in water treatment facilities. It assumes that the problem facing these facilities is lack of knowledge about the vulnerabilities in their systems. However, even if that is true (a topic for another day), I am pretty sure that setting up this program in CISA is not the way to go. Most importantly, why should CISA focus such efforts on water systems when they are not the Sector Specific Agency responsible for that sector. The appropriate SSA would be the Environmental Protection Agency (EPA). 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-10671-introduced-vulnerability - subscription required.