DHS Oversight Plan Hearing – 2-28-23

Today the House Homeland Security Committee held a business meeting to approve their Oversight Plan for the 118^th Congress. After considering and adopting two amendments, the Committee approved the amended Oversight Plan.

Rep Thompson (D,MS) offered an amendment that would have added a Domestic Terrorism section to the portion of the Plan dealing with the Subcommittee on Counterterrorism, Law Enforcement, and Intelligence. A subsequent amendment was offered by Rep Guest (R,MS) that proposed modifications to Thompson’s amendment. The Guest amendment was approved by a vote of 17 to 14. The modified Thompson amendment was then approved by a vote of 16 to 15. The amended Oversight Plan was approved by a vote of 17 to 14.

No further action needs to be taken on the approved Plan.

CFATS Hearing – 02-27-19

Today the House Homeland Security Committee held a hearing on the CFATS program. This hearing was with government witnesses only and provided Members with a chance to closely question Director Wulf of DHS Infrastructure Security Compliance Division. A video of the hearing is available on the Committee web site.

Witnesses

The two government witnesses at today’s hearing were:

• David Wulf, DHS – Testimony; and

• Nathan Anderson, GAO – Testimony

Their initial testimony at the hearing contained no new information. Wulf summarized the advances that the CFATS program had undergone since the 2014 authorization bill was passed. Similarly, Anderson summarized the issues that GAO had previously identified in reports issued through last summer and the actions that GAO has verified that ISCD had undertaken to comply with the recommendations from those reports.

Hearing Overview

This is the first full Committee hearing on the CFATS program since the 2014 reauthorization bill was passed. The Committee has had a mixed past on how it has looked at the CFATS program depending on which party was in control of Congress. While both parties have broadly supported the CFATS program, the Democrats have tended to be more supportive of environmental and safety advocates view points on chemical safety issues and Republicans more supportive of business interests.

Interestingly today we saw an internal conflict between the majority and minority at the very start of the meeting. Apparently, the Republicans had asked for a non-governmental witness (probably from one of the many affected industry associations) to participate in today’s hearing and that was disallowed by Chairman Thompson since the hearing was being limited to governmental witnesses.

Thompson faced similar conflicts during the last two sessions of Congress as the Ranking Member and utilized the Minority’s right to hold separate hearings to get their views on the record. Rep. Rogers (R,AL) the Ranking Member, formally asked for a separate hearing today to hear from their witness.

It will be interesting to see how these minor conflicts (at least it looks like today’s problem was relatively minor) affect future operations of the Committee.

Information Sharing

As I noted in my discussions about last session’s CFATS hearing, the Democrats are certainly looking at the CFATS reauthorization process as a chance to address information sharing about chemical hazards. Thompson in particular wants to ensure that the problems encountered at the West Fertilizer incident are not repeated.

There were a number of questions to Wulf about the efforts that ISCD has undertaken to ensure that information about chemical hazards at CFATS facilities is shared with first responders. Wulf noted that facilities are required to coordinate with local police and emergency response personnel as part of their Site Security Plan (SSP) processes. Failure to effect that coordination would be cause for disapproval of an SSP or failing an SSP compliance inspection.

Wulf also reported in response to questions by Rep. Torres-Small (D,NM) that ISCD had placed ‘outreach officials’ at each regional office to aid in the outreach process with State and local officials.

Cybersecurity

Cybersecurity was another topic that brought questions from multiple Committee Members. Wulf received multiple questions about ‘cybersecurity requirements’. He noted that there were no specific ‘requirements’ since the CFATS regulations rely on risk-base performance standards that allow facilities to craft security measures specific to the risks at their facilities.

In response to a question by Rep. Langevin (D,RI), Anderson noted that GAO had not taken a specific look at cybersecurity processes within the CFATS program, but as a general matter they had concerns throughout DHS about the human resources that the Department had for supporting cybersecurity matters. Wulf noted that all chemical security inspectors (CSI) had ‘basic’ cybersecurity training; about half had an additional two-weeks of specific cybersecurity training and there was a limited number of cybersecurity subject matter expert CSI that provided specific support where needed.

Rep. Slotkin (D,MI) had some questions about cybersecurity threat awareness within ISCD. Wulf noted that DHS NCCIC was responsible for tracking cybersecurity threats and vulnerabilities. He also reported that there is an active information sharing process between NCCIC and ISCD. He also explained that as new threats are identified, facilities are notified and are prepared to put additional security measures into place as required.

Inherently Safer Technology

Wulf was handed a number of questions about the potential of adding requirements for implementing inherently safer technology (IST) to the CFATS program. He noted that over the years in which the CFATS program has been in operation over 3,000 facilities had been removed from the program by implementing various IST processes. Wulf admitted that the information collected by ISCD as those facilities left the program could provide information that could prove valuable for both facilities in the CFATS program and the 30,000 plus other facilities that have reported to ISCD via Top Screens but were not included in the program. Currently, ISCD does not have a process for that information sharing.

Fusion Centers

Rep. Rose (D,NY) asked an interesting series of questions about CFATS and fusion centers (a topic that I had never heard before). Wulf reported that ISCD has supported a number of fusion centers with CSI. Details were spare, but it sounded like specific CSI or CSI supervisors were in contact with fusion centers, not stationed with fusion centers full-time.

Commentary

For the most part I was pleasantly surprised at the general lack of speechifying during the questioning phase of this hearing. For most of the nearly two-hour long hearing, reasonably well-informed questions were posed to Wulf and Anderson with sufficient time allowed for responses.

Thompson is definitely interested in moving CFATS authorization legislation quickly to the President. He does not want to see a repeat of last year’s slow playing legislation leading to a near shutdown of the program. It will be interesting to see how quickly the staff crafts a bill to introduce over Thompson’s and Roger’s sponsorship. It will be interesting to see if Thompson can rope the leadership from the House Energy and Commerce Committee into cosponsoring such legislation like he did with the short-term reauthorization last month.

One delaying factor may be the need for a subcommittee hearing to look at cybersecurity concerns. The Cybersecurity and Infrastructure Subcommittee held a hearing last year, but it did not focus on cybersecurity. We may see Rep. Richmond (D,LA) hold a more cybersecurity focused hearing next month. That hearing would be interesting given the presence of both Reps. Slotkin (D,MI) and Langevin (D,RI) on the Subcommittee.

House Hearing on PTC Deployment

This morning the Railroads, Pipelines, and Hazardous Materials Subcommittee of the House Transportation and Infrastructure Committee held a hearing on “The State of Positive Train Control Implementation in the United States”. I was not able to provide advance notice because the hearing was not listed on the Congress.gov website (the House site I normally monitor for hearing information) until after the hearing had started.

The witnesses were an interesting mix of government and industry representatives:

∙ Ms. Sarah Feinberg, FRA;

∙ Mr. Russell Kerwin, Metrolink/AECOM;

∙ Mr. Frank Lonegro, CSX Transportation;

∙ Mr. Charles Mathias, FCC; and

∙ Mr. Donald Orseno, Metra Commuter Railroad

The PTC system is required by law to be installed and operable on all tracks where passenger rail operates and on Class I rail lines that are used to transport toxic inhalation (TIH) chemicals. The deadline for installation, again by law, is December 31, 2015. Some of the passenger railroads have mainly completed their PTC installations and most will apparently have their installations complete by the deadline, though the individual systems may not be approved by the FRA by that time. The freight railroads will not, however, be anywhere near meeting that deadline.

Two interesting comments about the problem can be found in the written testimony from the FRA and CSX:

FRA (pg 2) – “FRA reserves the right to use any and all enforcement tools from civil penalties to emergency orders, to require the railroads to make progress on PTC implementation to ensure public safety prior to January 1, 2016.”

CSX (pg 8) – “Operating certain trains on nonPTC-compliant tracks could be an unacceptable choice for some railroads, and the impact of railroads’ decisions on commuters and industries that rely on rail service could have significant effects that have not yet been fully examined.”

FRA is stuck. The December deadline was set by Congress and they are required to enforce the deadline. They have yet to come up with their detailed enforcement plan, but at some point in the process (CSX does not expect to have their PTC plan fully deployed until 2020) there will be imposition of some really significant fines (eg: up to $25,000/day for each line segment where PTC is not deployed).

The freight railroads may have to make a decision if they are willing to continue to allow passenger railroads to operate on their lines where PTC is not functioning. The potential liability for an accident on a line that is legally deficient in safety makes the lawyers and bankers for the railroads extremely nervous.

The issue for the transportation of TIH chemicals on lines where PTC is not yet functioning has the same issue. It is even made worse because the railroads have frequently made public their concern about their potential liability for transporting these chemicals without the PTC concerns. It is very likely that railroads will refuse to transport these chemicals on lines that do not have approved PTC deployments.

The ‘easy solution’ to the problem is for Congress to extend the deadline. There would certainly be a great deal of opposition to such an extension from the safety community. There is currently a bill on the Senate side of the hill, S 650, that is awaiting floor action in that body. There is currently no bill being considered in the House. I expect that that will change as a result of this hearing.

Vehicle-to-Vehicle Communications Hearing

This afternoon the House Energy and Commerce Committee updated their web site for Thursday’s hearing on vehicle-to-vehicle (V2V) communications. The site now has a witness list, copies of the witnesses’ written testimony (NHTSA testimony is not yet available) and a Committee Staff document discussing the issues to be covered at the hearing.

The witness list includes:

∙ Nat Beuse, National Highway Transportation Safety Administration (NHTSA);
∙ Barry Einsig, Cisco;
∙ Harry Lightsey, General Motors;
∙ David St. Amant, Econolite Group, Inc; and
∙ Peter Sweatman, University of Michigan Transportation Research Institute

There are a number of issues that will be discussed during this hearing. According to the staff document those issues will include answering the following questions (pgs 6-7):

∙ How will a rulemaking requiring V2V communications in new vehicles impact used cars on the road today?

∙ What driver education is necessary to prepare drivers to operate vehicles equipped with V2V capability?

∙ How does the implementation of V2V technology foster the development of vehicle automation technologies?

∙ How is the auto industry preparing a rollout that will allow this technology to evolve? Will any technological evolution require ongoing government oversight?

∙ What is a realistic timeframe by which drivers will see the benefits of this technology?

Readers of this blog will quickly note that there is no specific mention of cybersecurity issues in the list above. The staff background document does note that NHTSA has made attempts to address the cybersecurity and personal information protection issues potentially associated with the V2V program. Following the comment period on their advance notice of proposed rulemaking (ANPRM) last year NHTSA issued a request for information (RFI) about the development and governance of a “Security Credential Management System” (SCMS) for the system.

There is at least a mention of these SCMS issues in the written testimony:

Einsig – “This network needs interoperability, standards-based technology, as well as a tested architecture for delivering a highly secure, mobile, and high availability solution.” (pg 3)

Lightsey – “National and international standards must be adopted to insure interoperability of V2V systems deployed by all auto makers and those deploying related V2I systems. A scaleable and operational security credential management system must be developed.” (pg 3)

St. Amant – “Efforts underway to create a Security Credential Management System (SCMS) for connected vehicles are critically important.” (pg 5)

Sweatman – “Current gaps requiring federal support include: Cyber-security solutions that suit both the vehicle and the infrastructure.” (pg 8)

In point of fact, these are the only significant mentions of cybersecurity issues in the four written testimonies submitted to the Committee. Of more concern is the fact that according to Sweatman Michigan has already constructed its first V2V/V2I enabled stretch of public road and Mr. Lightsey is announcing that GM will begin to sell its first V2V equipped vehicle, the 2017 Cadillac CTS, next year. Both of these have taken place before there is an established and accepted SCMS.

Homeland Security Committee Adds Markup Hearing – 6-25-15

The House Homeland Security Committee announced this evening that they were adding a full-committee markup hearing on Thursday to address a number of pending bills. Two of the bills included, HR 1073 (the Critical Infrastructure Protection Act) and HR 2786 (Cross-Border Rail Security Act of 2015) have been reviewed in this blog.

According to the announcement there will be an amendment in the form of a substitute offered by Rep. McSally for HR 1073. A quick review of that amendment shows that it does not include any significant new requirements.

Markup of House DHS Spending Bill

The Homeland Security Subcommittee of the House Appropriations Committee has announced that it will hold a hearing tomorrow at 10:30 to mark-up the Subcommittee draft of the FY 2014 DHS spending bill.

CFATS

The CFATS program made it into the big leagues in this draft document; it was actually (for the first time) mentioned in the spending section of the bill. On pages 32 and 33 it says:

“Provided, That of the total amount provided for the ‘‘Infrastructure Security Compliance’’ program, project, and activity, $20,000,000 shall be withheld from obligation until the Under Secretary for the National Protection  and Programs Directorate submits to the Committees on Appropriations of the Senate and the House of Representatives an expenditure plan for the Chemical Facility Anti-Terrorism Standards program that includes the number of facilities covered by the program, inspectors on-board, inspections pending, and inspections projected to be completed by September 30, 2014.”

We also have the standard one year CFATS authorization extension. This time it is in §532 and extends the program until October 4^th, 2014.

TWIC

The suggestion of the GAO about the TWIC Reader pilot will be partially fulfilled in this draft. On pages 19 and 20 it says:

“Provided, That of the funds provided under this heading,$50,000,000 shall be withheld from obligation for headquarters administration until the Administrator of the Transportation Security Administration submits to the Committees on Appropriations of the Senate and the House of Representatives detailed expenditure plans for air cargo security, checkpoint support, and explosives detection systems refurbishment, procurement, and installations on an airport-by-airport basis for fiscal year 2014 and the completion of a security assessment measuring the effectiveness of using the Transportation Worker Identification Credential [emphasis added].”