More Information on PCII ANPRM

On Thursday the Department of Homeland Security published an advanced notice of proposed rulemaking (ANPRM) seeking public input on possible changes to the Protected Critical Infrastructure Information (PCII) program. Yesterday the Department also updated its website to provide additional information about the ANPRM. The Federal eRulemaking Portal also provided the docket number for comments on the ANPRM that was missing from the notice.

PCII Web Site

DHS has maintained a rather extensive web site about its PCII program. The landing page for that program was updated yesterday with a new section at the bottom of the page briefly outlining the purpose of this week’s ANPRM. It also provided links to two new web pages dealing with the ANPRM:

• ANPRM on the PCII Program

• PCII ANPRM: Frequently Asked Questions

The first page provides a brief overview of the rulemaking process and explains that the National Protection and Programs Directorate (NPPD) expects that this rulemaking process will take about two years and that the expectation is that a notice of proposed rulemaking (the next step in the process) should be published next year.

The second page provides essentially the same information in a slightly different format and just a tad bit more detail.

Docket Number

I noted in Thursday’s blog post about the ANPRM that DHS had made a minor administrative mistake and failed to include the docket number for the ANPRM in the notice. That docket number is important because it is used to access or provide information about this proposed rulemaking on the Federal eRulemaking Portal.

A search of that portal this morning shows that the docket number does actually exist. It is DHS-2016-0032. I still expect that DHS will publish either an amended ANPRM notice or an update to the current notice in the Federal Register that will show this docket number. That almost certainly needs to be done to keep everything kosher.

DHS Publishes PCII ANPRM

Today the Department of Homeland Security (DHS) published an advance notice of proposed rulemaking (ANPRM) in the Federal Register (81 FR 23442-23445) for a possible update of the Protected Critical Infrastructure Information (PCII) program as established in 6 CFR Part 29. This program protects critical infrastructure information (CII) voluntarily submitted to DHS from public disclosure.

Information Sought

The notice provides background information on the initial establishment of the PCII program in 2006. It then goes on to explain that the program needs to be transitioned to a modern electronic environment that transition would:

• Enhance the submission and validation process for critical infrastructure information;

• Use state of the art technology for an automated interface for quicker access and dissemination of PCII;

• Modify requirements for the express and certification statements;

• Expand the use of categorical inclusions;

• Require portion marking of PCII; and

• Implement specific methods to capture and deliver metadata to the PCII Program.

Specifically, DHS is requesting information and comments on the following topics:

• Automated Submissions;

• Marking/Portion Marking; and

• Sharing PCII with Foreign Governments.

The first topic is the one about which DHS is seeking the most information. It is seeking comments on nine specific areas in this topic. Those areas include:

• How to enhance the submission methods for critical infrastructure information and automate sharing via structured information expression profiles and electronic exchange protocols;

• Whether an updated PCII rule should permit multiple submissions of information under one express statement and certification statement enabling the submission of multiple documents by an organization over the course of several weeks or months;

• Whether an updated PCII rule should allow submissions in a purely electronic format that includes an electronic express statement and certification statement in order to simplify the submission of large data sets in particular;

• Whether and to what extent an automated submission process should incorporate auditing and statistical reporting requirements to increase transparency of the frequency and types of data being submitted to the program;

• Addressing any process amendments or program enhancements to effectively implement automated submission processing in order to facilitate the submitter's ability to request and receive timely audits of access to the submissions;

• What effect, if any, an updated PCII Program would have on enabling broader sharing and analysis among other trusted recipients of cyber threat and risk data;

• Which specific programmatic-submission use cases that define data collection needs should be developed and established as categorical inclusions in specific data exchange activities in order to increase the submitters' community use and ease of submission in the PCII submission process;

• The extent to which specific programmatic-submission use cases should be developed and established as categorical inclusions in order to normalize a range of permissible and impermissible uses for specific types of data shared as PCII; and

• Expanding categorical inclusions to the State governmental level to increase the range of submissions, enhance the efficiency of information sharing, and make the protection of critical infrastructure information more effective.

Public Comments

DHS is soliciting public comments on the above topics and questions. Those comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # OOPS there is no docket number provide in today’s notice). I expect that we will see a revision notice next week in the Federal Register providing a docket number. Until then, the only other method of comment submission included in the notice is snail mail, not my recommendation. Still comments should be submitted by July 20^th, 2016.

Commentary

The one thing missing from this notice is mention of the pending rule on Controlled Unclassified Information. The final rule on CUI was submitted to OMB back in October. This rulemaking from the National Archives and Records Administration (NARA) seeks to standardize the administration of CUI programs like PCII.

Since the PCII program was established by statute {the CII Act of 2002 (Sections 211-215, Title II, Subtitle B of the Homeland Security Act of 2002, PL 107-296)} most of the NARA regulations can be overridden by the PCII regulations. But, any areas of the NARA regulations that are not specifically addressed in the PCII regulations will have to comply with the NARA provisions. And there will be some areas of the NARA regulations that may not be superseded unless specifically authorized in legislation.

Unfortunately, this ANPRM cannot attempt to address those issues since the NARA regulations have not yet been approved. I suspect that the most likely areas of potential conflict will deal with page and paragraph marking requirements.

The other area of potential concern (though probably not an actual conflict since it has never been addressed) will be the requirements for cybersecurity of electronic copies of documents. This will be particularly important with this ANPRM because of the expressed intent of expanding the use of electronic data submission and sharing. But, again, it is hard to express concerns about these issues until the NARA rule is published.

Analysis of S 3414 – Protection of Information

This is part of an ongoing in-depth review of the provisions of S 3414, the Cybersecurity Act of 2012, that will be of interest to the control systems community. The earlier posts in the series were:

Analysis of S 3414 – National Cybersecurity Council

Analysis of S 3414 – Critical Cyber Infrastructure

Analysis of S 3414 – Voluntary Cybersecurity Practices

Analysisof S 3414 – Voluntary Cybersecurity Program

NOTE: The GPO now has a copy of this bill available.

This post will look at the provisions of §106, Protection of Information. The public-private partnership outlined in Title I allows for and requires critical infrastructure entities within the private sector to provide information to the Federal government. This section provides for the protection of that information.

Information Protection Program

There is a much overdue on-going (but very much delayed) Executive Branch review of the multitude of sensitive but unclassified information programs within the Federal government. The idea is to reduce the number of such programs to a minimum and to rationalize the requirements of the various programs. To avoid adding another complicating program this bill would add the information collected to support the critical cyber infrastructure program to an existing critical infrastructure information program under 6 U.S.C. 133.

NOTE: The bill actually refers to “section 214 of the Homeland Security Act of 2002” {§106(b)(1)}; this is a common and confusing practice in writing legislation. It is much easier to cite the appropriate US Code entry and much easier for a researcher to find the appropriate reference.

That program is designed to protect voluntarily provided information and specifically limits the coverage to information “that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructure and protected systems” {6 USC 133(a)(1)}. Since some of the information submitted under this bill is required to be submitted {see specifically §102(b)(4)}, the crafters of this bill provided an exception to the ‘voluntarily provided’ requirement {§106(b)(1)}. It is unusual that this section does not actually revise the existing USC language to provide this exemption; that may create an interesting situation for lawyers to argue the applicability of this exemption.

This established information protection regime protects the provided information from:

• Federal {6 USC §133(a)(1)(A)} and State or local {§133(a)(1)(E)} Freedom of Information Act type disclosures;

• Any agency or judicial rules regarding ex parte communications {§133(a)(1)(B)}; and

• Disclosure in any Federal or State civil action {§133(a)(1)(C)}.

It does not prevent disclosure in:

• Criminal investigations and/or prosecutions {§133(a)(1)(D)(i)};

• Congressional hearings and/or investigations {§133(a)(1)(D)(ii)(I)}; or

• Government Accounting Office investigations {§133(a)(1)(D)(ii)(II)}.

Interestingly I see nothing in this section that would allow the Government to share generalized threat information obtained through data provided under the voluntary critical infrastructure cybersecurity program. There is authority to do so under 6 USC §133(g), but again since this section does not modify that portion of the USC in its inclusion of involuntarily provided information, it could be argued that it doesn’t apply to information obtained under this Title.

This is particularly true since the protections on 6 USC 133 only apply to information provided that includes the statement {6 USC §133(a)(2)}:

‘This information is voluntarily submitted to the Federal Government in expectation of protection from disclosure as provided by the provisions of the Critical Infrastructure Information Act of 2002.”

Cybersecurity Tip Line

An interesting part of this section that in some ways seems out of place is the requirement for the establishment of a Critical Infrastructure Cybersecurity Tip Line. This would be established to allow individuals to anonymously (well it doesn’t actually say ‘anonymously’) report “concerns involving the security of covered critical infrastructure against cyber risks” {§106(c)(1)(A)}. It would also be useable for reporting ‘concerns’ about programs or functions established under Title I involving {§106(c)(1)(B)}:

• A possible violation of any [emphasis added] law, rule, regulation or guideline;

• Mismanagement;

• Risk to public health, safety, security, or privacy; or

• Other misfeasance or nonfeasance.

The program concerns reported to this Tip Line would be investigated by an Inspector General. The definition of ‘Inspector General’ in this section {§106(a)(2)} makes it clear that this is not limited to the Inspector General of DHS. There is nothing that describes how it will be determined which IG will conduct the investigation or who will make that determination.

Any information submitted to the Critical Infrastructure Cybersecurity Tip line would be covered information afforded the protections of this section {§106(a)(1)(E)}. That is probably the reason that this was placed in this section of the bill.

Limitations on Protection

Section 106(d) makes it clear that the crafters of this bill did not intend for the protections to be applied overly broadly. It outlines a number of areas to which this section does not apply or limit. It does not:

• Limit the “right, ability, duty, or obligation of any entity to use or disclose any information of that entity” [thus it prohibits the attempted Bayer CropScience PCII defense];

• Prevent the classification of information submitted under this section;

• Prevent the government from obtaining information that is not covered information;

• Prevent DHS from using the information in enforcement proceedings under this Act (the whole thing not just Title I);

• Authorize the withholding of information from Congress, the Comptroller General or any [emphasis added] IG; or

End of Title I

There are a number of sections of Title I that I have ignored in this series of blog posts. They are:

Sec. 105. Rules of construction.

Sec. 107. Annual assessment of cybersecurity.

Sec. 108. International cooperation.

Sec. 109. Effect on other laws.

Sec. 110. Definitions.

While certainly not unimportant, these sections do not appear that they will have any great impact on the control system community as they do not directly apply to operations in the private sector.

I will try to get a general look at the information sharing provisions of Title VII of this bill written up in a post later this week. A lot will depend on how the debate goes and how many additional amendments are proposed that deal with Title I of this bill. Right now it appears that the bulk of the public opposition to this bill deals with Title I and not the privacy concerns with Title VII that were seen with previous versions of the bill.