Friday, December 5, 2025

Review - Bills Introduced – 12-4-25

Yesterday, with both the House and Senate in Washington, there were 115 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 6429 To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a program to promote the cybersecurity field to disadvantaged communities, including older individuals, racial and ethnic minorities, people with disabilities, geographically diverse communities, socioeconomically diverse communities, women, individuals from nontraditional educational paths, individuals who are veterans, and individuals who were formerly incarcerated, and for other purposes. Brown, Shontel M. [Rep.-D-OH-11]

HR 6460 To amend title 49, United States Code, to clarify exceptions for limited recreational operations of unmanned aircraft, and for other purposes. Mann, Tracey [Rep.-R-KS-1]

 

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a brief look at two anti-scam bills, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-4-25 - subscription required.

Chemical Transportation Incidents – Week of 11-1-25

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 497 (464 highway, 29 air, 4 rail, 0 water)

• Serious incidents – 6 (1 Bulk release, 1 evacuation, 1 injury, 0 death, 1 major artery closed, 5 fire/explosion, 28 no release)

• Largest container involved – 28,480-gal DOT 117J100W Railcar {Petroleum Crude Oil} Manway bolts not tool tight.

• Largest amount spilled – 225-gal Plastic IBC {Sulfuric Acid With Not More Than 51% Acid} IBC fell.

• Total amount reported spilled in all incidents – 1619.7-gal

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Petroleum Crude Oil: A complex mixture of aliphatic and aromatic hydrocarbons containing low percentages of sulfur and trace amounts of nitrogen and oxygen compounds. A black sticky liquid with a strong hydrocarbon odor. (Source: CameoChemicals.NOAA.gov).

 


Short Takes – 12-5-25 – Federal Register Edition

Assessment Framework and Organizational Restatement Regarding Preemption for Certain Regulations Issued by the Coast Guard. Federal Register CG NPRM withdrawal. Summary: “The Coast Guard is withdrawing the proposed rule entitled “Assessment Framework and Organizational Restatement Regarding Preemption for Certain Regulations Issued by the Coast Guard,” published [link added] in the Federal Register on December 27, 2013. The Coast Guard is withdrawing the proposed rule because our practice of discussing the preemptive effect of the Coast Guard's legal authorities and regulations in the preamble of our rulemaking documents is sufficient to identify any preemptive effects.”

Request for Information (RFI) on Partnerships for Transformational Artificial Intelligence Models. Federal Register DOE request for information. Summary: “The U.S. Department of Energy (DOE) invites public comment on its Request for Information (RFI) regarding Partnerships for Transformational Artificial Intelligence Models. The purpose of this RFI is to solicit feedback from industry, think tanks, investors, research organizations, and other stakeholders on how DOE should best structure and enable partnerships to curate DOE scientific data across the National Laboratory complex for use in artificial intelligence (AI) models. This RFI also seeks input on using this data to develop self-improving AI models for science and engineering to advance scientific discovery, energy, and national security.” Comments due January 14th, 2026.

Space Modernization for the 21st Century. Federal Register FCC notice of proposed rulemaking. Summary: “In the Notice of Proposed Rulemaking (NPRM), the Federal Communications Commission (Commission or we) proposes to overhaul and modernize the Commission's space and earth station licensing process to help “ensure that new space-based industries, space exploration capabilities, and cutting-edge defense systems are pioneered in America rather than by our adversaries.” In particular, the NPRM proposes to develop a “licensing assembly line” designed so applications can be routed along different paths and segmented for review based on specific aspects of a request. This new process would set the stage for ongoing efficiency gains and would provide greater predictability and flexibility for applicants. In this way, we expect—like actual assembly lines—that the space review processes can be dramatically accelerated while improving the quality of the Commission's space licensing work.” Comments due January 20th, 2026.

Privacy Act of 1974; System of Records. Federal Register NASA notice of a modified system of records. Summary: “In accordance with the requirements of the Privacy Act of 1974, the National Aeronautics and Space Administration is providing public notice of a modification to an existing system of records entitled NASA Core Financial Management Records (CFMR). The notice updates the Routine Use section to include two additional routine uses . The system of records is more fully described in the SUPPLEMENTARY INFORMATION section of this notice.”

Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program. Federal Register FCC notice of proposed rulemaking. Summary: “In this document, the Federal Communications Commission (Commission or FCC) aims to further its actions in strengthening prohibitions on authorization of covered equipment and to clarify the rules and enforcement of such. The Commission seeks additional comment on modular transmitters and component parts in relation to covered equipment. The Commission addresses the partial court remand of the decision in its November 2022 EA Security R&O by proposing a definition of “critical infrastructure” as used on the Covered List and seeking comment on the implementation of that definition. The Commission also seeks comment on whether any modification to an authorized device by an entity identified on the Covered List should require a new application for certification. Finally, the Commission seeks comment on clarifying the scope of activities that constitute marketing of equipment and on measures to strengthen enforcement of marketing prohibitions.” Comments due January 6th, 2026.

Thursday, December 4, 2025

Review – 7 Advisories and 2 Updates Published – 12-4-25

Today CISA’s NCCIC-ICS published seven control system security advisories for products from Advantech, Solis Cloud, Sunbird, Johnson Controls (2), MAXHIB, and Mitsubishi. They also updated advisories for products from Johnson Controls and Consilium.

Advisories

Advantech Advisory - This advisory describes an SQL injection vulnerability in the Advantech iView product.

SolisCloud Advisory - This advisory describes an authorization bypass through a user controlled key vulnerability in the SolisCloud Monitoring Platform.

Sunbird Advisory - This advisory describes two vulnerabilities in the Sunbird DCIM dcTrack and Power IQ products.

Johnson Controls Advisory #1 - This advisory describes an improper validation of certificate expiration vulnerability in the Johnson Controls iStar products.

Johnson Controls Advisory #2 - This advisory describes a forced browsing vulnerability in the Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace.

MAXHUB Advisory - This advisory describes a weak password recovery mechanism for forgotten password vulnerability in the MAXHUB Pivot client.

Mitsubishi Advisory - This advisory describes a cleartext storage of sensitive information vulnerability in the Mitsubishi GX Works2 product.

NOTE: I briefly discussed this vulnerability on November 29th, 2025.

Updates

Johnson Control Update - This update provides additional information on the FX80 and FX90 advisory that was originally published on August 7th, 2025.

Consilium Update - This update provides additional information on the CS5000 Fire Panel advisory that was originally published on May 29th, 2025.

NOTE: The original CISA advisory noted that no fix was planned for these vulnerabilities. See my May 29th, 2025, post for more information.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-2-updates-published-67d - subscription required.

Review – HR 2707 Introduced – Anthrax Strategy

Back in April Rep Davis (D,NC) introduced HR 2707, the Protecting American Families and Servicemembers from Anthrax Act. The bill would require the Department of Health and Human Services (HHS) and the DOD to develop a modernized 10-year strategy for ensuring sustained stockpiling of anthrax countermeasures. No new funding is authorized in this legislation.

Moving Forward

Davis, and 13 of his 17 cosponsors, are members of the House Armed Services Committee to which this bill was assigned primary consideration of this bill. This means that there may be sufficient influence to see the bill considered in Committee. I can see nothing in this bill that would engender any organized opposition to the bill, and I suspect that it would receive some level of bipartisan support, perhaps enough to be considered by the full House under the suspension of the rules process.

Commentary

DHS is an integral part of the threat analysis process set forth in 42 U.S.C. 247d–6b(a) that establishes the countermeasure requirements in the Strategic National Stockpile. Thus, the failure to include DHS in the ‘covered Secretaries’ definition seems odd until you realize that including them would have required, in turn, that the House Homeland Security Committee would have to have been added to the list of Committee that would have to sign off on the bill.

 

For more information on the provisions of this bill, and additional commentary on the inclusion of DOD stockpile requirements, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2707-introduced-anthrax-strategy - subscription required.

CISA Adds OpenPLC ScadaBR vulnerability to KEV Catalog - 12-3-25

Yesterday CISA announced that it had added an unrestricted upload of files with dangerous type vulnerability in the “OpenPLC ScadaBR” product. The vulnerability was previously disclosed by ScadaBR along with a cross-site scripting vulnerability that CISA had already added to the KEV catalog. The vulnerability has been fixed in Scada-LTS, a successor product to ScadaBR. On May 13th, 2025, Fellipe Oliveira published an exploit for this vulnerability.

CISA has directed all federal agencies that use the affected products to apply “mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” They have provided a deadline of December 24th, 2025, to accomplish those actions.

Review – PHMSA Publishes HAZMAT via HATS ANPRM

Today the DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) published in the Federal Register (90 FR 5836-55844) an advanced notice of proposed rulemaking (ANPRM) on “Hazardous Materials: Modernizing Regulations to Facilitate Transportation of Hazardous Materials Using Highly Automated Transportation Systems” (RIN 2137-AF68). PHMSA is seeking to obtain stakeholder input on potential revisions to the Hazardous Materials Regulations (HMR) to facilitate the safe transportation of hazardous materials using highly automated transportation systems. PHMSA had earlier published a request for information on this topic.

Highly Automated Transportation Systems (HATS)

The ANPRM provides a discussion about the potential types of modal highly automated transportation systems (HAT) that might be used to transport hazardous materials and the hazardous material regulation challenges that they may present. These include:

Highly automated rail transportation systems,

Highly automated air transportation systems,

Highly automated vessel transportation systems, and

Highly automated commercial motor vehicles

Public Comments

PHMSA is soliciting public comments on this ANPRM. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # PHMSA-2024-0064). Comments should be submitted by March 4th, 2026.

 

For more information on the information PHMSA is seeking, as well as a brief cybersecurity related discussion, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/phmsa-publishes-hazmat-via-hats-anprm - subscription required.

Wednesday, December 3, 2025

Review - Bills Introduced – 12-2-25

Yesterday, with both the House and Senate in session, there were 52 bills introduced. One of those bills will receive additional coverage in this blog:

S 3315 A bill to require the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency to coordinate to improve cybersecurity in the health care and public health sectors, and for other purposes. Cassidy, Bill [Sen.-R-LA]

 

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a brief look at two bills dealing with individual rights related to ‘computational algorithms’, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-2-25 - subscription required.

Short Takes – 12-3-25 - Federal Register Edition

Removing Support for the National Definition of a Zero Emissions Building. Federal Register DOE notice. Summary: “The Department of Energy is removing support for the National Definition of a Zero Emissions Building guidance document to comply with directions provided in various Executive orders.”

Formaldehyde; Updated Draft Risk Calculation Memorandum; Notice of Availability and Request for Comment. Federal Register EPA notice. Summary: “Consistent with statutory obligations and Executive Order 14303, Restoring Gold Standard Science, EPA remains committed to the highest standards of scientific integrity and reliance on the best available scientific information. To that end, and after further consideration of comments raised during the scientific peer review process, EPA is reconsidering the use of certain hazard values in the formaldehyde risk evaluation. This Notice, Draft Memorandum, and the materials included in the docket provide the science and science policy basis for determining how the revised draft inhalation point of departure (POD) impacts the corresponding draft margin of exposure (MOE) estimates and the risk determination for formaldehyde under TSCA.” Comments due February 2nd, 2026.

Agency Information Collection Activities: Requests for Comments; Clearance of Renewed Approval of Information Collection: Financial Responsibility for Licensed Launch Activities. Federal Register FAA 30-day ICR renewal notice. Summary: “This collection is applicable to operators requesting to conduct commercial launch operations as prescribed in 14 CFR parts 401, et al., Commercial Space Transportation Licensing Regulation. A commercial space launch services provider must complete the Launch Operators License, Launch-Specific License or Experimental Permit to gain authorization for conducting commercial launch operations. The information will be collected per 14 CFR part 440 Appendix A. A permit or license applicant is required to provide the FAA information to conduct maximum probable loss determination. Also, it is a mandatory requirement that all commercial permitted and licensed launch applicants obtain financial coverage for claims by a third party for bodily injury or property damage. FAA is responsible for determining the amount of financial responsibility required using maximum probable loss determination.” Comments due January 2nd, 2026.

Notice of Partially Closed Federal Advisory Committee Meeting. Federal Register DHS advisory committee hearing notice. Summary: “The Office of Partnership and Engagement is publishing this notice to announce that the Homeland Security Advisory Council will meet in person on Wednesday, December 10, 2025. This meeting will be partially closed to the public. This meeting will be led by the Secretary of Homeland Security to discuss new taskings for the Council and sensitive DHS Operations.”

Aerospace Safety Advisory Panel; Meeting. Federal Register NASA advisory committee hearing notice. Summary: “In accordance with the Federal Advisory Committee Act, as amended, the National Aeronautics and Space Administration announces a forthcoming meeting of the Aerospace Safety Advisory Panel (ASAP). The ASAP will hold a special meeting to deliberate on new formal recommendations for 2025. This discussion is pursuant to carrying out its statutory duties for which the Panel reviews, identifies, evaluates, and advises on those program activities, systems, procedures, and management activities that can contribute to program risk. Priority is given to those programs that involve the safety of human flight.” Meeting date December 19, 2025.

The Sunset Rule. Federal Register NRC final rule. Summary: “The U.S. Nuclear Regulatory Commission (NRC) is amending its regulations to insert a conditional sunset date into certain regulations in response to Executive Order (E.O.) 14270, “Zero-Based Regulatory Budgeting to Unleash American Energy.”” Comments due January 2nd, 2026. If ‘significant adverse comments’ are received then the associated notice of proposed rulemaking will take effect.

OMB Approves Removal of NEPA Implementing Regulations Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the Council on Environmental Quality (CEQ) on “Removal of National Environmental Policy Act Implementing Regulations”. This final rule was sent to OIRA on August 11th, 2025. The interim final rule was published on February 25th, 2025.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“This interim final rule removes the Council on Environmental Quality (CEQ) regulations implementing the National Environmental Policy Act (NEPA) from the Code of Federal Regulations.”

I expect that this final rule will be published in the Federal Register next week. I do not plan on providing any detailed analysis of this rule, but I will publish a note in the appropriate Short Takes post when it is published.

PHMSA Sends Pipeline Class Locations Final Rule to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) on “Pipeline Safety: Class Location Requirements”. The advanced notice of proposed rulemaking (ANPRM) for this rulemaking was published on July 31st, 2018 and the notice of proposed rulemaking (NPRM) was published on October 14th, 2020.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“This rulemaking action would address class location requirements for natural gas transmission pipelines, specifically as they pertain to actions operators are required to take following class location changes due to population growth near the pipeline. Operators have suggested that performing integrity management measures on pipelines where class locations have changed due to population increases would be an equally safe but less costly alternative to the current requirements of either reducing pressure, pressure testing, or replacing pipe.”

Tuesday, December 2, 2025

Short Takes – 12-2-25

‘Fire amoeba’ survives in hotter conditions than any other complex cell. Nature.com article. Pull quote: “Water samples from the [Lassen Volcanic National Park] stream looked devoid of life under a microscope, but after culturing them with nutrients, the researchers spotted the amoeba growing at 57 °C, within the stream’s temperature range. The scientists slowly raised the temperature, sailing past the previous eukaryote record of 60 °C. I. cascadensis was still able to divide at 63 °C and was still moving around at 64 °C. Even at 70 °C, the cells could form dormant ‘cysts’ that were capable of reactivating at cooler temperatures.”

Shingles vaccine may actually slow down dementia, study finds. WashingtonPost.com article. Pull quote: “Crucially, the study suggests that the shingles vaccine — two doses of which are recommended for adults 50 and older or those 19 and older with a weakened immune system — may help people who already have dementia. Those who got the vaccine were almost 30 percent less likely to die of dementia over nine years, suggesting the vaccine may be slowing the progression of the neurodegenerative syndrome.”

How U.S. Export Controls Risk Undermining Biosecurity. LawFareMedia.org article. Pull quote: “Securing governmental authorizations for such [deemed] exports can take a month or more, but competitive pressures push AI labs to complete evaluations in a matter of weeks. This timing mismatch forces American AI companies into a difficult choice: delay product releases to seek export licenses while competitors forge ahead, limit testing to U.S. citizens only and sacrifice evaluation quality, or risk violating export controls and exposing themselves to significant civil and criminal penalties. Our recent white paper discusses these issues in greater technical and legal depth.”

Changing the rules of global chemicals trade. ChemistryWorld.com commentary. Pull quote: “Facing excess global supply of many basic chemicals, and with little prospect of China’s industry backing off production to raise prices, the US has responded with massive trade tariffs. These are intended to deter imports and allow its own chemicals industry to maintain production and profitability, taking advantage of cheaper feedstocks and lower energy costs than European rivals. That has left Europe, along with other markets like South Korea, and others across southeast Asia, bearing the brunt of the supply glut.”

Using AI in Professional Engineering. SCADAMag.Infracritical.com commentary. Pull quote: “So if you are a professional engineer, and you are thinking of using an AI on your next project, remember this: It cannot take responsibility for its actions. You are essential for review. Are you willing to stand behind something that does not formally reason? Are you willing to approach your classically taught profession with post-modernist practice? For now, my answer is no. Some day, if the concerns I expressed above are addressed, I may change my mind.”

Cyber Threats to Water Infrastructure: Insights from Josh Corman. SecurityLedger.com commentary. Pull quote: “As Josh points out, the lack of mandatory reporting laws for cyber disruptions in critical infrastructure like water utilities means many incidents like those detected in Littleton remain unreported, leaving gaps in our understanding of the risks facing critical infrastructure and our defenses. That amplifies the risks associated with integrating software and internet connectivity into operational technology—advancements that, while beneficial, have opened new avenues for cyber threats.”

Public Safety and Homeland Security Bureau Reminds Broadcasters to Ensure They Comply With Best Practices to Prevent Cyberattacks. Docs.FCC.gov notice. Pull quote: “It appears that these recent hacks were caused by a compromised studio-transmitter link (STL)—the broadcast equipment that carries program content from the studio to remote transmitters—with threat actors often accessing improperly secured Barix equipment and reconfiguring it to receive attacker-controlled audio in lieu of station programming. Affected stations broadcast to the public an attacker-inserted audio stream that includes an actual or simulated Attention Signal and EAS alert tones, as well as obscene language, and other inappropriate material.”

Strengthening Pharma Cybersecurity: A Guide for Manufacturers. ForeScout.com blog post. Pull quote: “This interconnectivity, while enabling benefits like condition monitoring, Overall Equipment Effectiveness (OEE) measurement, predictive maintenance, and digital twin capabilities, also creates new entry points for cyber attackers. The need for scalability across multiple lines and plants, customized applications, and seamless integration between IT and OT systems means more software and firmware components are embedded throughout production lines.”

Backlog List

Manufacturer issues remote kill command to disable smart vacuum after engineer blocks it from collecting data — user revives it with custom hardware and Python scripts to run offline,

Ukraine isn’t just hurling attack drones; they’re waging real robot warfare,

Research roundup: 6 cool science stories we almost missed,

Trump administration tells Congress war law doesn’t apply to cartel strikes,

The mysterious rise of cancer among young adults in the Corn Belt, and

Climate Change Made Hurricane Melissa 4 Times More Likely, Study Suggests.


Review – 3 Advisories and 2 Updates Published – 12-2-25

Today CISA’s NCCIC-ICS published two control system security advisories for products from Iskra and Industrial Video & Control, as well as a medical device security advisory for products from Mirion Medical. They also updated two advisories for products from Mitsubishi Electric.

Advisories

Iskra Advisory - This advisory describes a missing authentication for critical function vulnerability in the Iskra iHUB and iHUB Lite smart metering gateways.

Industrial Video & Control Advisory - This advisory describes a code injection vulnerability in the IVC Longwatch video surveillance and monitoring system.

Mirion Advisory - This advisory describes three vulnerabilities in the Mirion EC2 Software NMIS BioDose.

Updates

Mitsubishi Update #1 - This update provides additional information on the MELSEC iQ-R Series/iQ-F Series advisory that was originally published on June 6th, 2023, and most recently updated on April 25, 2024.

NOTE: I briefly discussed the updated Mitsubishi advisory on Sunday.

Mitsubishi Update #2 - This update provides additional information on the CNC Series advisory that was originally published on July 24th, 2025.

NOTE: I briefly discussed the updated Mitsubishi advisory on Sunday

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-2-updates-published-59b - subscription required.

OMB Sends UAS List of Associated Elements IFR to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an interim final rule (IFR) from the OMB on “American Security Drone Act of 2023; Unmanned Aircraft System List of Associated Elements”. This rulemaking was not listed in the Spring 2025 Unified Agenda. It looks like this rulemaking is implementing the requirement of §1823(a) of the American Security Drone Act of 2023 {Section 1821 et seq, PL 118-31, 137 STAT. 691}.

This requirement in §1823 is placed upon the Federal Acquisition Security Council (FASC). The FASC was established by the Federal Acquisition Security Council Rule. The FASC is an executive branch interagency council chaired by a senior-level official from the Office of Management and Budget. This is the reason that the OMB is authoring this regulation.

The term ‘associated elements’ is used in §1823 to describe those parts of unmanned aircraft systems that are “related to the collection and transmission of sensitive information (consisting of communication links and the components that control the unmanned aircraft) that enable the operator to operate the aircraft in the National Airspace System.” The ‘list of associated elements’ will be used to limit federal agencies from acquiring such elements when they come from a ‘covered foreign entity’ {§1822(1)}.

I do not expect that I will be covering this rulemaking in any detail, but I do expect that I will announce its publication in the appropriate Short Takes post.

STB Sends Regulatory Barriers NPRM to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from the Surface Transportation Board (STB) on “Eliminating Regulatory Barriers to Competition: Review of 49 CFR Part 1144” [link added]. This rulemaking was not listed in the Spring 2025 Unified Agenda, but it looks like this is the STB’s implementation of the requirements of EO 14267, Reducing Anti-Competitive Regulatory Barriers.

It does not look like this rulemaking will have any specific impact on hazmat transportation issues, so I will probably not be covering this rulemaking in any detail. I would expect to announce it’s publication in the appropriate Short Takes post.

Review - Bills Introduced – 12-1-25

Yesterday, with both the House and Senate in Washington, there were 36 bills introduced. Two of those bills will receive additional coverage in this blog:

S 3290 A bill making appropriations for financial services and general government for the fiscal year ending September 30, 2026, and for other purposes. Hagerty, Bill [Sen.-R-TN]

S 3293 A bill making appropriations for energy and water development and related agencies for the fiscal year ending September 30, 2026, and for other purposes. Kennedy, John [Sen.-R-LA]

 

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a brief look at an intelligence sharing bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-1-25 - subscription required.

Monday, December 1, 2025

Review S 2388 Introduced – Cyber Circuit Rider Program

Back in March Sen Cortez-Masto (D,NV) introduced S 1018, the Cybersecurity for Rural Water Systems Act. The bill would require USDA to establish a rural water and wastewater cybersecurity circuit rider program” similar to the one established in 7 USC 1926(a)(22), but focused on cybersecurity. The bill would authorize $10-million per year through 2028 to support the program.

This bill is essentially the same as S 2388, the Cybersecurity for Rural Water Systems Act, that was introduced by Cortez Masto in July 2023. No action was taken on that bill in the 118th Congress.

Moving Forward

Neither Cortez-Masto nor her sole co-sponsor {Sen Rounds (R,ND)} are members of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration. This means that it is unlikely that there is sufficient influence to see the bill considered in Committee. Adding $10-million dollars in spending is sure to draw opposition from many Republicans, but there may still be sufficient bipartisan support in the Committee to see the bill approved if it were considered.

As with most bills, there would not be sufficient interest in this legislation to see the Senate leadership tie up the Senate for the time that it would be necessary to consider this bill under regular order. Because of the added spending involved, it would not be possible to pass this bill under the Senate’s unanimous consent process; it would take just a single Senator to object to passage of the bill to kill consideration.

Commentary

The current circuit rider program has about 147 personnel periodically helping small water systems and small wastewater treatment systems. CISA reports about 153,000 water treatment facilities in the US with the vast majority (93 % by one estimate -pg 3) being small systems that would be covered by the circuit rider program. That means that each circuit rider would have to cover about 1,000 systems. They do not get around very often.

 

For more details about the provisions of this bill, including a brief look at the related NRWA actions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2388-introduced-cyber-circuit-rider - subscription required.

Review – Committee Hearings – Week of 11-30-25

With both the House and Senate back from their Thanksgiving break, there is a moderately busy hearing schedule. Of interest here are two fact-finding hearings on grid security and communications security. There are also two Space Geek hearings.

Grid Security

On Tuesday the Subcommittee on Energy of the House Energy and Commerce Committee will hold a hearing on “Securing America’s Energy Infrastructure: Addressing Cyber and Physical Threats to the Grid”.

Communications Security

On Tuesday the Subcommittee on Telecommunications and Media of the Senate Commerce, Science, and Transportation Committee will hold a hearing on “Signal Under Siege: Defending America’s Communications Networks”.

Space Geek Hearings

On Wednesday the Senate Commerce, Science, and Transportation Committee will hold a nomination hearing  that will bring Jared Isaacman back before the Committee for his renomination to be NASA Administrator.

On Thursday the Subcommittee on Space and Aeronautics of the House Science, Space, and Technology Committee will hold a hearing on “Strategic Trajectories: Assessing China’s Space Rise and the Risks to U.S. Leadership”.

 

For more information on these hearings, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/committee-hearings-week-of-11-30 - subscription required.

Review - S 2465 Introduced – FY 2026 THUD Spending

Back in July Sen Hyde-Smith introduced S 2465, the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act, 2026. At the same time the Senate Appropriations Committee published their Report on the Bill. While there is a cyber security mention in the bill, the main focus here will be PHMSA spending in the bill and discussions in the Report, as well as some UAS discussions in the Report.

S 2465 is be similar to S 4796, the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act, 2025, that was introduced by Sen Schatz (D,HI) in July 2024. No action was taken on that bill in the 118th Congress. The related House bill, HR 9028, was also introduced in July 2024, and similarly, no action was taken on that bill in the 118th Congress.

Moving Forward

The plan in the House currently appears to be to add the language of S 2431 to the substitute language for the consideration of HR 4016, the Department of Defense Appropriations Act, 2026. The Senate has not yet held their first cloture vote that would allow actual debate to begin on the bill. This probably indicates that there is still some backroom dealing going on to determine the broad outline of what will end up in the Senate version of the bill. Then further dealing with determining what further amendments will be considered on the floor.

Right now, SA 3951 from Sen Collins (Chair of the Appropriations Committee) is the current candidate for the substitute language to be considered, and it includes the language from S 2431. But a lot can happen in the short legislative month of December.

 

For more information on the provisions of this bill dealing with cybersecurity, PHMSA, and UAS issues, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2465-introduced-fy-2026-thud-spending - subscription required.

Sunday, November 30, 2025

Short Takes – 11-30-25 – Space Geek Edition

Varda Space launches its fifth mission, extends run of AFRL test flights. SpaceNews.com article. Pull quote: “AFRL awarded Varda a multi-year Indefinite Delivery, Indefinite Quantity contract that secures access to reentry flights through at least 2028. Under the IDIQ, AFRL can task Varda with flying experimental payloads, collecting reentry data and returning hardware for analysis, effectively treating the commercial capsules as a repeatable hypersonic test range.Commercial reentry vehicles like Varda’s offer a way to increase test cadence without major infrastructure investments.”

Before a Soyuz launch Thursday someone forgot to secure a 20-ton service platform. ArsTechnica.com article. Pull quote: “The at least temporary loss of Site 31 will only place further pressure on SpaceX. The company currently flies NASA’s only operational crewed vehicle capable of reaching the space station, and the space agency recently announced that Boeing’s Starliner vehicle needs to fly an uncrewed mission before potentially carrying crew again. Moreover, due to rocket issues, SpaceX’s Falcon 9 vehicle is the only rocket currently available to launch both Dragon and Cygnus supply missions to the space station. For a time, SpaceX may also now be called upon to backstop Russia as well.”

Northrop Grumman selected to provide cargo services for final phase of ISS. SpaceNews.com article. Pull quote: “That constraint does not affect Northrop Grumman’s Cygnus, which is grappled by the station’s robotic arm and attached to one of two separate berthing ports. “NG is the only CRS-2 provider currently capable of attaching to the ISS via a berthing port, which means NG is the only responsible source that can provide resupply services after the USDV [US deorbit vehicle] arrives and docks to the ISS,” NASA stated in a justification document.”

Space Force awards first prototype deals for space-based interceptors under Golden Dome. SpaceNews.com article. Pull quote: “According to his calculations, intercepting even one missile [in boost phase] reliably might require about 950 orbiting interceptors. If an adversary fires 10 missiles, the constellation might need to grow to 9,500 interceptors. The scaling cost, he said, could make the architecture impractical.”

China launches an emergency lifeboat to bring three astronauts back to Earth. ArsTechnica.com article. Pull quote: “While this crew is just one month into their planned six-month expedition, an emergency could force them to leave the station and return home at any time. Although remote, another collision with space junk, a major systems failure, or a medical emergency involving one of the astronauts could trigger an evacuation. That’s why Chinese officials wanted to quickly launch Shenzhou 22 to give the crew a ticket home.The International Space Station follows the same policy, with SpaceX’s Dragon spacecraft and Russian Soyuz ships serving as lifeboats until their crews’ scheduled return to Earth.”

Shenzhou-22 docks at Tiangong space station, resolving human spaceflight emergency. SpaceNews.com article. Pull quote: “The [new] spacecraft incorporates updates including an improved human–machine interface, a miniaturized instrument panel, an optimized return-capsule layout, and increased down-mass capability. It also carries a device described as being able to treat the cracks in Shenzhou-20’s port window. The Shenzhou-20 spacecraft will remain in orbit to conduct relevant experiments,” CMSEO stated.”

Oman brings GEO orders level with 2024 as larger spacecraft regain traction. Pull quote: “Financial details were not disclosed. The contract includes a knowledge-sharing partnership as Oman joins other Middle Eastern nations pursuing greater space sovereignty and a more diversified economy in anticipation of a post-oil future.”

BlackSky announces latest Gen-3 satellite in orbit after confidential Electron launch. SpaceNews.com article. Pull quote: “The company announced Nov. 25 that its newest Gen-3 satellite produced its first high-resolution imagery less than 24 hours after its launch this month. The spacecraft is the third Gen-3 satellite in orbit, capable of producing images at a resolution of 35 centimeters and offering advanced features such as infrared imaging and intersatellite links.”

Backlog List:

New 'nearly interstellar' comet — wrongly linked to 3I/ATLAS — will reach its closest point to Earth on Tuesday (Nov. 11),

European companies to fly commercial microgravity mission in 2026,

Ground truth: Why the lunar program needs its Earthbound network,

Dream Chaser completes key tests ahead of first flight,

The fallacy of being first — let’s be enduring instead, and

OHB raises concerns about planned European space joint venture.

Review – Public ICS Disclosures – Week of 11-22-25 – Part 2

For Part 2 we have three additional vendor disclosures from ABB, and Wibu (2). There are also six vendor updates from ABB, FortiGuard (2), and Mitsubishi (3). Finally, we have five exploits for products from Broadcom, FortiGuard (2), HP, and Ruckus.

Advisories

ABB Advisory - ABB published an advisory that discusses 22 vulnerabilities in their Ability Camera Connect product.

Wibu Advisory #1 - Wibu published an advisory that describes a write-what-where condition vulnerability in their legacy WibuKey product.

Wibu Advisory #2 - Wibu published an advisory that describes an improper restriction of operations within the bounds of a memory buffer vulnerability in their legacy WibuKey product.

Updates

ABB Update - ABB published an update for their Terra AC wallbox advisory that was originally published on September 16th, 2025, and most recently updated on October 27th, 2025.

FortiGuard Update #1 - FortiGuard published an update for their CAPWAP daemon advisory that was originally published on November 18th, 2025.

FortiGuard Update #2 - FortiGuard published an update for their CAPWAP daemon advisory that was originally published on November 18th, 2025.

Mitsubishi Update #1 - Mitsubishi published an update for their Lighting Control System MILCO.S advisory that was originally published on November 18th, 2025.

Mitsubishi Update #2 - Mitsubishi published an update for their Flexera InstallShield advisory that was originally published on July 24th, 2025.

Exploits

Broadcom Exploit - Indoushka published an exploit for two vulnerabilities in the Broadcom Brocade Fabric OS.

FortiGuard Exploit #1 - Indoushka published an exploit for a relative path traversal vulnerability in the FortiGuard FortiWeb product.

FortiGuard Exploit #1 - Sfewer-r7 published a Metasploit module for two vulnerabilities in the FortiGuard FortiWeb product.

HP Exploit - Indoushka published an exploit for an improper authentication vulnerability in the HP Intelligent Management product.

Ruckus Exploit - Huthaifa Qashou published an exploit for a cross-site scripting vulnerability in the Ruckus Unleashed product.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-f10 - subscription required.

Saturday, November 29, 2025

Review - Bills Introduced – 11-28-25

With both the House and Senate meeting in pro forma session, there were 13 bills introduced. One of those bills may receive additional coverage in this blog:

HR 6326 To accelerate accreditation and access to sensitive compartmented information facilities for industry, and for other purposes. Ryan, Patrick [Rep.-D-NY-18]

 

For more information on these bills, including legislative history for similar bills in the 118th Congress, as well as a brief mention of a tariff price gouging bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-11-28-25 - subscription required.

Review – Public ICS Disclosures – Week of 11-22-25 – Part 1

This week is a moderately busy disclosure week. For Part 1 we have 13 vendor disclosures from Carrier (3), Dassault Systems (2), Eaton, Hitachi, Janitza, Mitsubishi, Moxa (3), and Splunk.

Advisories

Carrier Advisory #1 - Carrier published an advisory that describes two vulnerabilities in the multiple Carrier and Automated Logic products.

Carrier Advisory #2 - Carrier published an advisory that describes an improper validation of array index vulnerability in multiple Carrier and Automated Logic products.

Carrier Advisory #3 - Carrier published an advisory that describes an improper input validation vulnerability in Carrier and Automated Logic Zone Controllers.

Dassault Advisory #1 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Product Manager.

Dassault Advisory #2 - Dassault published an advisory that that describes a cross-site scripting vulnerability in their DELMIA Service Process Engineer product.

Eaton Advisory - Eaton published an advisory that describes a path traversal vulnerability in their Galileo Software.

Hitachi Advisory - Hitachi published an advisory that discusses three vulnerabilities in multiple Hitachi products.

Janitza Advisory - CERT-VDE published an advisory that describes an improper validation of specified type of input vulnerability in the Janitza UMG 96-PA and UMG 96-PA-MID products.

Mitsubishi Advisory - Mitsubishi published an advisory that describes a cleartext storage of sensitive information vulnerability in their GX Works2 product.

Moxa Advisory #1 - Moxa published an advisory that describes a clickjacking vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #2 - Moxa published an advisory that describes a password autocompletion vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #3 - Moxa published an advisory that describes a cleartext transmission of sensitive information vulnerability in their ioLogik E1200 Series and E 2200 series products.

Splunk Advisory #1 - Splunk published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Add-On for Palo Alto Networks.

Splunk Advisory #2 - Splunk published an advisory that discusses three vulnerabilities (one with publicly available exploits) in their SOAR product.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-485 - subscription required.

Friday, November 28, 2025

CISA Adds OpenPLC-ScadaBR Vulnerability to KEV Catalog – 11-28-25

Today CISA announced that they had added a cross-site scripting vulnerability in the “OpenPLC ScadaBR” product. ScadaBR reported the vulnerability in June of 2021 (no mention of OpenPLC). On March 2st, 2021, Fellipe Oliveira published two exploits (for Windows, for Linux) for the vulnerability. On October 9th of this year, Forescout’s Vedere Labs published a report about a ‘Russian aligned group’ used this vulnerability to exploit access to a honeypot (that they thought was a public water system) that had been gained via default authentication.

According to the ScadaBR web site (Google translation from Portugese) in the response to the initial report of this vulnerability by h3v0x (apparently Fellipe Oliveira):

“Here in Brazil, ScadaBR was discontinued by the developers; the last version was 1.1. ScadaBR is being continued, but not by Brazilian developers. The project has 20 contributors worldwide and is now called ScadaLTS.”

There are currently no security advisories for ScadaLTS, so maybe the vulnerability does not affect that version of the product.

CISA has directed federal agencies that are operating the affected ‘OpenPLC – ScadaBR’ product to apply “mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” A deadline of December 19th, 2025 has been set for compliance.

Short Takes – 11-28-25 – Federal Register Edition

Agency Information Collection Activities: 1670-0048: SAFECOM Nationwide Surveys Generic Clearance. Federal Register DHS 30-day ICR notice. Purpose: “To perform these statutory obligations [link added], CISA seeks renewal of its PRA Generic Clearance to maintain flexibility in implementing surveys that are relevant to the current emergency communications environment. To meet the statutory requirements of 6 U.S.C. 573, ECD conducts the SAFECOM Nationwide Survey (SNS) to assess evolving capability needs and gaps and track progress against policy initiatives, status of strategic plans, and major industry or market shifts affecting the emergency communications capability.” Comments due Decemver 29th, 2025.

Pipeline Safety: Information Collection Activities. Federal Register PHMSA PSR 30-day ICR notices. 12 separate ICRs included. Comments due: December 29th, 2025.

1.       Excess Flow Valves—New Customer Notifications - OMB Control Number: 2137-0631,

2.       Natural Gas Distribution Infrastructure Safety and Modernization Grant Program - OMB Control Number: 2137-0641,

3.       Reporting Safety-Related Conditions on Gas, Hazardous Liquid, and Carbon Dioxide Pipelines and Liquefied Natural Gas Facilities, OMB Control Number: 2137-0578,

4.       National Pipeline Mapping Program, OMB Control Number: 2137-0596,

5.       Hazardous Liquid Pipeline Operator Annual Reports, OMB Control Number: 2137-0614,

6.       Hazardous Liquid Operator Notifications, OMB Control Number: 2137-0630,

7.       Notification Requirements for Gas Transmission Pipelines, OMB Control Number: 2137-0636,

8.       Transportation of Hazardous Liquids by Pipeline: Record keeping and Accident Reporting, OMB Control Number: 2137-0047,

9.       Record keeping Requirements for Gas Pipeline Operators, OMB Control Number: 2137-0049,

10.   Annual Report for Gas Distribution Operators, OMB Control Number: 2137-0629,

11.   Incident Reports for Natural Gas Pipeline Operators, OMB Control Number: 2137-0635, and

12.   Annual and Incident Reports for Gas Pipeline Operators, OMB Control Number: 2137-0522.

Notice of Funding Availability for Credit Assistance Under the Water Infrastructure Finance and Innovation Act (WIFIA) Program. Federal Register EPA notice of funding availability – Summary: “The purpose of this notice of funding availability (NOFA) is to solicit letters of interest (LOIs) from prospective borrowers seeking credit assistance from the U.S. Environmental Protection Agency (EPA) under the Water Infrastructure Finance and Innovation Act (WIFIA) program. EPA estimates that it may lend approximately $6.5 billion to help finance $13 billion in water infrastructure investment.” Includes support for cybersecurity measures with the Drinking Water State Revolving Fund.

EO 14363 - Launching the Genesis Mission – Federal Register.

Transportation Chemical Incidents – Week of 10-25-25

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 544 (510 highway, 29 air, 5 rail, 0 water)

• Serious incidents – 2 (2 Bulk release, 0 evacuation, 2 injury, 0 death, 0 major artery closed, 1 fire/explosion, 33 no release)

• Largest container involved – 30,420-gal DOT 113C120W9 Railcar {Ethylene, Refrigerated Liquid (Cryogenic Liquid)} The tank car was at 76 psi and intermittingly venting.

• Largest amount spilled – 800-gal DOT 406 Trailer {Gasoline Includes Gasoline Mixed With Ethyl Alcohol, With Not More Than 10% Alcohol.} Driver attempted to adjust truck position while still hooked up to tank.

• Total amount reported spilled in all incidents – 2063.2-gal

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Barium Selenate: No data available in Cameo (Source: CameoChemicals.NOAA.gov). This is the first time that I have seen a listing on Cameo that had nothing beyond the generic ERG guide {#151 – Toxic (Non-Combustible)} information; no description and no physical data.

 



Section 2209 Fixed Site Drone Exclusion Rulemaking Delay

Back in May the DOT’s Federal Aviation Administration (FAA) sent a notice of proposed rulemaking to the OMB’s Office of Information and Regulatory Affairs (OIRA) on “Designation - Restrict the Operation of an Unmanned Aircraft in Close Proximity to a Fixed Site Facility”. This rulemaking was mandated by §2209 of the FAA Extension, Safety and Security Act (PL 114-190, 130 STAT. 634), and was supposed to have been completed by January 11th, 2017. Then in June, the President issued EO 14305, Restoring American Airspace Sovereignty, reiterating the Administration’s intent to quickly implement this legislative mandate. So, why has this NPRM not yet been approved by OIRA?

Generally speaking, OIRA has 90-days {§6(b)(2)(B) EO 12866} to ‘approve’ a rulemaking, though that can be extended for 30-days. Or the Administrator can send the rulemaking back to the submitting agency for “for further consideration of some or all of its provisions” {§6(b)(3)}. There is no requirement to notify the public of such ‘further consideration’ actions.

As part of its review process, OIRA may receive input from the public via meetings with OIRA that include representatives of the submitting agency. This input process is also governed by EO 12866 {§6(b)(4)}. A public listing of meetings governed by this process is maintained by OIRA and is available online as part of the Unified Agenda listing for each rulemaking. The record for the §2209 rulemaking can be found here.

There are a total of 19 EO 12866 meetings listed for this rulemaking, three before the rulemaking was submitted to OIRA by the FAA, 15 within 35 days of that submission, and one in September. OIRA did not accept any EO 12866 during the funding fiasco. While the details of these discussions are not available, a look at the names of the parties involved makes it clear that (not surprisingly) most of the meetings were requested to discuss concerns about the scope of the rulemaking.

With a variety of drone delivery services being participants in a significant number of the meetings, I would expect that their concerns would deal with scope of the area covered by the drone exclusion zone for the critical infrastructure. If that zone were to extend beyond the boundaries of the requesting critical infrastructure facility, it could restrict deliveries to some customers of those services. Questions could also have been raised about UAV deliveries to the facilities requesting the exclusion zone. Overly large exclusion zones could also impact route selection and thus the cost of deliveries made by those services.

Drone manufacturers and user groups were also well represented at these meetings. Both groups would be expected to have concerns about how these exclusion zones would be communicated to the public, how operators would be expected to be aware of those zones, and where their vehicles were in relation to those zones. Would there be requirements for geofencing, for example, and if there were such requirements, how would they affect UAVs already in service. Finally, how would the size of the vehicle affect the application of the rulemaking; would micro-drones, for example, be affected.

If any of these concerns were not appropriately addressed in the proposed rule, the FAA may have had to make changes to the regulatory requirements in the rule, or changes to the discussions in the preamble that would clarify the intent of the agency. All of these could further slow the publication of the notice of proposed rulemaking.

Wednesday, November 26, 2025

Short Takes – 11-26-25 – Federal Register Edition

Internal Governance. Federal Register CSB final rule. Summary: “The U.S. Chemical Safety and Hazard Investigation Board (“CSB”) is amending regulations relating to its CSB's internal organization, management, and operations. These amendments make grammatical and stylistic updates to current CSB internal regulations in order to improve their function and better reflect the CSB's mission. The amendments also clarify procedures involving quorum and public meetings. Finally, the amendments update the current address of the CSB.” Effective date: January 26th, 2026.

Notice of Request for Information; Accelerating the American Scientific Enterprise. Federal Register OSTP request for information. Summary: “The Office of Science and Technology Policy (OSTP) requests input from all interested parties on Federal policy updates that aim to accelerate the American scientific enterprise, enable groundbreaking discoveries, and ensure that scientific progress and technological innovation benefit all Americans. Through this Request for Information (RFI), OSTP seeks input from academia; private sector organizations; industry groups; state, local, and tribal governments; and other stakeholders regarding priorities for strengthening the science and technology (S&T) ecosystem to support both the expansion of scientific knowledge and the mechanisms to transition these discoveries into the marketplace. This RFI will inform the formulation of Executive branch efforts to advance and maintain U.S. S&T leadership.”

Revision of Agency Information Collection Activity Under OMB Review: Department of Homeland Security Traveler Redress Inquiry Program (DHS TRIP). Federal Register TSA 30-day ICR renewal notice. Abstract: “DHS TRIP is a single point of contact for individuals who have inquiries or seek resolution regarding difficulties they have experienced during their travel screening. TSA manages the DHS TRIP office on behalf of DHS. The collection of information includes: (1) a Traveler Inquiry Form, which includes the individual's identifying and travel experience information; and (2) two optional, anonymous customer satisfaction surveys to allow the public to provide DHS feedback on its experience using DHS TRIP.”

EO 14361 - Regulatory Relief for Certain Stationary Sources To Promote American Coke Oven Processing Security. Federal Register.

OMB Approves PHMSA Drone HAZMAT Delivery ANPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an advanced notice of proposed rulemaking (ANPRM) from the DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA) on “Hazardous Materials: Modernizing Regulations to Facilitate Transportation of Hazmat Using Autonomous Systems”. This news comes just a week after the DOT’s Federal Aviation Administration (FAA) published their guidance document on “Hazardous Materials: Modernizing Regulations to Facilitate Transportation of Hazmat Using Autonomous Systems”.

According to the Spring 2025 Unified Agenda entry for this PHMSA rulemaking:

“In this rulemaking, PHMSA would amend the Hazardous Materials Regulations (HMR) to address the role of autonomous transportation systems (e.g., drones, etc.) in the transportation of hazardous materials. The rulemaking will consider necessary clarifications to the HMR regarding handling, transportation, and hazard communication unique to the movement of hazardous materials by autonomous transport systems. PHMSA would coordinate closely with its modal partners within the Federal Aviation Administration, Federal Motor Carrier Safety Administration, Federal Railroad Administration, and U.S. Coast Guard to ensure a comprehensive approach that allows for the seamless movement of goods across multiple modes of transport while allowing for the specific needs of each mode to be safely addressed.”


I expect that this ANPRM will be published in the Federal Register after the Thanksgiving holiday.
 
/* Use this with templates/template-twocol.html */