CRS Reports – Small Drinking Water Systems

This week the Congressional Research Service (CRS) published a report on “Small Water Systems: Selected Safe Drinking Water Act (SDWA) Provisions”. The report looks at compliance issues (including cybersecurity) facing small public drinking water systems. There is little discussion about the specific requirements, instead it focuses on the assistance programs available to help these systems achieve and maintain compliance.

Bills Introduced – 03-16-17

Yesterday, with just the House in session {the Senate left for an early start to a week in their home states campaigning (er, working)}, there were 44 bills introduced. Of those, three may be of specific interest to readers of this blog:

HR 1571 To provide first responders with planning, training, and equipment capabilities for crude oil-by-rail and ethanol-by-rail derailment and incident response, and for other purposes. Rep. Herrera Beutler, Jaime [R-WA-3]

HR 1579 To require drinking water systems to assess and address their vulnerabilities to climate change, source water degradation, and intentional acts to ensure security and resiliency. Rep. Peters, Scott H. [D-CA-52] 

H Res 200 Expressing the sense of the House of Representatives that the United States should develop and adopt a comprehensive cybersecurity policy. Rep. Taylor, Scott [R-VA-2]

It will be interesting to see why HR 1571 was referred to the House Science, Space, and Technology Committee instead of the Transportation and Infrastructure or the Homeland Security Committees.

I will be following HR 1579 only if it specifically addresses cybersecurity or cyber resiliency issues.

While House Resolutions are usually of little real importance if this one actually mentions control system security issues that should be addressed as part of a ‘comprehensive’ cybersecurity policy. If it does not, the policy will hardly be ‘comprehensive’.

Bills Introduced – 02-13-13

Yesterday there were two bills introduced in the House that may be of specific interest to readers of this blog. They were:

H.R.624: To provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes. Sponsor: Rep Rogers (R,MI)

H.R.654: To amend the Safe Drinking Water Act to reauthorize technical assistance to small public water systems, and for other purposes. Sponsor: Rep Harper (R,MS)

CISPA

HR 624 is the Cyber Intelligence Sharing and Protection Act of 2013. A quick look at the Committee Draft of the bill (the GPO version is not yet available) does not reveal any major differences from the version (HR 3523) passed in the House last session. I’ll take a closer look at the provisions of the bill when the GPO version comes out.

I did see at least one press report yesterday that claimed that this bill would prohibit the implementation of the President’s Cybersecurity Executive Order. I clearly do not see any such provision in the Committee Draft of this bill.

Drinking Water Security

According to a press release from Rep. Harper, HR 654 would “reauthorize and modernize much needed technical assistance and compliance training for small water districts to meet federal compliance for an additional five years” under the Safe Drinking Water Act. Since this act contains the only current drinking water system security requirements (minimal though they are), this bill may have some impact on drinking water security. We will have to see the details of the bill when it is made available by the GPO.

Title II and III of HR 2868

As promised in an earlier blog, I have gone back and reviewed Title II, Drinking Water Security, and Title III, Waste Water Treatment Works Security, of the new version of HR 2868 that was introduced last week in the Rules Committee as an ‘amendment in the form of a substitute’. Title II is essentially a transfer of the contents of HR 3258 as reported by the Energy and Commerce Committee. Title III was written out of whole cloth since treatment works were originally included under the provisions of HR 2868. Chairman Oberstar and his staff presumably prepared Title III so that treatment works would receive the same special security treatment accorded to water treatment facilities. Changes in Title II As I had predicted before reading Title II, it is essentially a word for word transfer of the provisions of the reported version of HR 3258. There have been some minor revisions that clear up some legal ambiguities but no real changes have been made in the provisions. The following changes were made:

§1433(a)(1)(B)(i) – added wording to specifically require submission of vulnerability assessments to the Administrator of the US EPA. §1433(a)(1)(B)(iii) – added wording to specifically require submission of site security plans to the Administrator of the US EPA. §1433(l)(2)(C) – changed the legal standard for determining violations of the information disclosure rules to: “Whoever discloses protected information in knowing violation of the regulations and orders issued under subparagraph (A)”. §1433l(l)(7)(A)(v) – added ‘documents, or records’ to the information protected. §1433(m) – changed the wording of this section to specifically refer to amendments made by Title I of the Chemical and Water Security Act of 2009 to Title XX1 of the Homeland Security Act of 2002 as regulations that do not apply to water treatment facilities.

Title III Title III, the Wastewater Treatment Works Security Act of 2009, adds a new section to Title II of the Federal Water Pol1lution Control Act (33 U.S.C. 1281 et seq.). Section 222 will do for the treatment works what the proposed §1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) does for drinking water treatment facilities. It would have been nice if the Transportation and Infrastructure Committee staff had taken the easy way out and copied HR3258 and then made revisions appropriate to treatment works. No, instead, they used the ideas and most of the provisions from HR 3258, but wrote the actual provisions of HR 3258 in original language. That meant extra work for the staffers, for people like me who review legislation, as well as for the lawyers and courts that will inevitably have to interpret these regulations. This last part is particularly aggravating since there is no congressional record of hearings or committee reports supporting Title III. Thus courts will have little or no record of congressional intent when they are required to interpret the provisions of this legislation. Title III does provide another unique standard to determine what treatment works are covered by this title. Where Title II uses the number of customers that a facility supports, Title III uses a 2.5 million gallon/day of treatment capacity as the standard. Shortcomings It is clear that the Energy and Commerce Committee staff did not do as much work on Title II (or HR 3258) as they did on their revisions to the introduced version of HR 2868. It is equally apparent that the Transportation and Infrastructure Committee staff did even less work on Title III, though they certainly have a legitimate excuse given the short amount of time they had to work on this legislation. There are several serious shortcomings in these sections of this legislation that will go to the floor of the House in the next week or so. It seems to me that these shortcomings reflect the lack of concern and expertise in these two committees for security in general or chemical security in particular. To paraphrase Rep Dingell’s snide comments about the Homeland Security Committee in the full markup hearing of the Energy and Commerce Committees, it is apparent that these two committees don’t know anything about security. Risk-Based Performance Standards Each of these titles requires the Administrator of the Environmental Protection Agency to establish risk-based performance standards (RBPS) that the facilities will have to use to establish their site security plans. Both require the Administrator “take into account section 27.230 of” 6 CFR. This vague wording provides little guidance to an agency that has little experience in security matters. Title I, on the other hand spelled out in great detail the areas that the Homeland Security Committee wanted the DHS Secretary to address in the development of risk-based performance standards for high-risk chemical facilities. This shortcoming is particularly acute when considering that these two titles address chemical security as just a minor part of the security planning that the facilities must address. Both of these titles rightly recognize that the unique missions of these types of facilities make them potential terrorist targets even if they have no significant quantities of substances of concern on site. These two committees did the communities surrounding these treatment facilities a serious disservice when they ignored this fact when they wrote these weak and ineffectual RBPS provisions into these two titles. They punted on their oversight and policy setting responsibilities. Background Checks There are no provisions in these security regulations for conducting background checks on facility employees. It seems absolutely ludicrous for facilities that can have multiple rail cars of chlorine gas on site, not to be required to have the background of their employees and contractors checked to ensure that they are, at the very least, not on a terrorist watch list. Title I goes into great depth and detail into the procedures required for these background checks and the protections provided to employees to ensure that these checks are not used as methods to get rid of politically troublesome (ie: labor organizers) employees. The exact same provisions should have been included in each of these titles. Methods to Reduce Consequences Both titles require facilities that “possesses or plans to possess a substance of concern in excess of the release threshold quantity set by the Administrator” {Title II, §1433(g)(2)} must complete an assessment of methods to reduce the consequences of a terrorist attack. They also allow for Tier I and II facilities that must conduct such an assessment to be required to implement such methods. In states where the State has enforcement authority for drinking water treatment or wastewater treatment, the appropriate State official is given authority to order the implementation. In all other States, the Administrator is given that authority. The Administrator is given authority to ensure State officials obtain timely submissions and make timely decisions about requiring implementation. The Administrator is not allowed to review the actual implementation decision made by the State. This ensures that there will be a wide variety of standards used to evaluate the implementation requirements. In most States, there will be few if any required implementations. This assessment is supported by testimony of Brian Ramaley, President of the American Water Works Association, before the Energy and Environment Subcommittee on October 1st. He stated in his written testimony (pg 7) that he was confident that state enforcement agencies would “generally defer to the water treatment determinations made by local water experts.” This may explain why these two titles do not provide any provisions for the appeal of implantation decisions. It appears that the assumption is being made that the States will not require implementation so there is no need for an appeal procedure. Even if that is true, there needs to be a procedure in the legislation for an appeal process because the States are being given full authority to require privately owned facilities to spend money without any safeguards against capricious or arbitrary decisions. If appeals procedures are not included in the legislation these cases will inevitably end up in court with the attendant threats of unintentional disclosure of security information. No provisions for Inspectors Neither title provides any requirement for the Administrator to develop and train an inspection organization to enforce the security provisions of this legislation. It is not clear that either committee made an effort to determine how many facilities would actually be covered by the standards in this bill. I would suspect that the EPA will, between the two titles, be inspecting a comparable number of covered facilities as DHS is currently dealing with high-risk chemical facilities. This means that EPA will have to have a security-trained inspection force of about 250 personnel to provide the same level of service to the covered facilities. To fulfill the Obama Administration’s desire to have similar standards used for chemical security at all federally covered facilities this legislation should have required that the inspection personnel used by the EPA would have to be trained by the ISCD’s Chemical Security Academy. Suits and Petitions With all of the concerns that the Democrats have expressed about the requirements for citizen suits and petitions in Title I for high-risk chemical facilities, it is amazing to me that there are no similar provisions in Title II or III. This may simply be that there are already provisions for these actions in the underlying legislation. If that is the case, then there should be specific provisions that deal with the security implications of such suits. The Way Forward The House Rule’s Committee is accepting proposed amendments to this new version of HR 2868 until 6:30 p.m. EST on Monday. They will be holding a Committee hearing on HR 2868 on Tuesday at 3:00 pm to formulate the ‘rule’ and resolution to bring the bill to the floor of the House. The bill could come to the floor on Wednesday or Thursday. You can expect a late posting on Tuesday evening on this blog describing the amendments that will be considered during the House floor debate on this bill. The timing will depend on when the Rule’s Committee posts their ‘unofficial copy’ of the rule on their website. The official publication of the resolution on the GPO web site will likely not take place until Wednesday afternoon.