50,000 Weaponized Drones

I ran across an interesting article today over on Forbes.com, “Russia Braces For Attack By 50,000 Ukrainian Kamikaze Drones, Seeks Shotguns”. With a title like that, it had to show up on my daily ‘Short Takes’ post and it did (see below). But, I have read the article twice, and it still worries me more than a little and I am forced to write a late night post to explain my concerns.

I have been writing about drones and chemical plants for a number of years now in this blog. To the best of my knowledge, it has all been theoretical to this point, just pointing out how dangerous drones could actually be at a chemical facility if someone was intent on causing harm. And weaponized drones have been high on my list of concerns.

But, if I am pressed to talk about real threats, drones have been kind of low on my list of real weapons of concern. Most available drones are small enough that they just cannot deliver a large enough payload to really do significant damage to process equipment. Most chemical processing equipment is rather robust since it has to deal daily with heat extremes, pressure, and employee mistreatment. There are weak points to be sure, but they would require the nemesis of security threats, process knowledge to identify and exploit.

But seeing the picture today of an RPG-7 warhead suspended from a quadcopter literally struck fear into my heart. These projectiles are designed to pierce 11 inches of armor plate. A storage tank is not going to stand a chance. The projectile does not enter the target, a jet of high-intensity flame does. That jet of flame would immediately vaporize almost any liquid that it came into contact with inside the tank. The sudden rise in pressure may be enough to make the tank catastrophically fail and spew its contents all over the tank farm. A high-pressure storage tank may be able to withstand that sudden increase, but the pressure would still be sufficient to blow the liquid contents of the tank back out of the small hole the penetrator left. That hole would be edged with molten metal that would be hot enough to ignite most hydrocarbons, even those with relatively high (safe) flashpoints. The potential for cascading effects at that point would be enough to ruin any chemical engineer’s dreams.

The Forbes articles make it clear that these weaponized drones are relatively cheap to make. They note how easy it is to master the technique of flying the drones, even encumbered by the relatively massive warhead. If, as expected, the Ukrainians have success with these expected drone swarms, it would serve as a clear advertisement for their effectiveness as a weapon of war or terror.

CFATS Program Oversight Hearing

Last week the Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee held an oversight hearing looking at the Chemical Facility Anti-Terrorism Standards (CFATS) program. According to the opening statement of the Chair, this is the first step in the reauthorization process for that program. The current authorization for the program ends on December 18^th, 2018.

Support for CFATS Program

Three of the witnesses were from chemical manufacturing organizations who represent CFATS covered facilities in a range of industries. The fourth witness was a well-known environmental advocate who has frequently addressed chemical manufacturing safety issues.

Generally speaking, all four witnesses supported the CFATS program and advocated for its reauthorization. All expressed concerns that the reauthorization should not take the form of year-to-year extensions of the program that were seen prior to 2014.

Suggestions for Reauthorization Changes

Chet Thompson, representing the American Fuel & Petrochemical Manufacturers, specifically recommended another medium-term extension of the program requiring specific congressional reauthorization, as was done in 2014. His other recommendations for the reauthorization were generally restrictive:

• Do not include an inherently safer technology mandate (in oral testimony);

• Continue to protect the confidentiality of site security information;

• Require changes in the Appendix A chemical of interest (COI) list to go through comment-response process;

• Avoid extending the anti-terrorist vetting program to Tier III and Tier IV facilities; and

• Avoid any major changes to the program.

Kirsten Meskill, representing the American Chemistry Council, had three recommendations in her written testimony for the reauthorization of the CFATS program:

• Improve transparency in DHS risk determinations;

• Reconsider the value of Terrorist Screening Database (TSDB) screening at low risk facilities; and

• Recognize industry stewardship programs.

Pete Mutschler, representing both the Fertilizer Institute and the Agricultural Retailers Association, included two reauthorization suggestions in his testimony;

• Continue to protect the confidentiality of site security information; and

• Recognize industry stewardship programs.

Paul Orum, representing the Coalition to Prevent Chemical Disasters, was the most detailed in his recommendations for reauthorization changes. In his testimony Orum addressed (with specific suggestions):

• Use all available options – not just management and control strategies;

• Exercise oversight – especially of the ability of CFATS standards to realistically ensure protection;

• Use available resources – especially make better use of employee input;

• To improve public confidence, respect community concerns; and

• Support other programs that improve chemical security;

Commentary

Readers will remember that I started the CFATS reauthorization discussion rolling last fall when I did two blog posts on my suggestions for changes to the program (here and here).

My first post addressed cybersecurity issues. None of the witnesses addressed cyber issues in their prepared testimony and there was only one question about cybersecurity during the hearing (52 minutes). The responses were fairly generic calls for information sharing. Thompson did note that the current Risk Based Performance Standard 8 of the CFATS program addresses cybersecurity.

One interesting topic that did come up during questioning (49 minutes) was the use of unmanned aerial vehicles (UAV) or drones. There was just one question (51 minutes) on the topic and the answers were very generic. Meskil pointed out that drones are a duel edged sword; they are useful in many inspection and maintenance operations at facilities, but weaponized drones are a potential threat that has yet to be addressed. While I will address specific recommendations for drone provisions of the CFATS reauthorization, I will note here that drone rules have to take into account two specific restrictions:

• Interference in the operation of a drone is a federal felony; and

• Tracking and intercepting a drone is technologically and operationally complicated.

Finally, on the topic of inherently safer technology (IST); there should be no mistake made, the CFATS regulations have had a positive impact on the application of risk reduction measures at a relatively large number of chemical facilities. This is clearly seen in the reduction in the number of facilities over the years that have left the CFATS program. Orum is correct that DHS and ISCD could further aid this legitimate risk reduction effort by being more forthcoming about the number and types of facilities that have exited the program by reducing and/or eliminating their COI inventories. As I have said on a number of occasions, requiring a specific IST review/implementation process ignores the complexity of the situation, but ISCD should be providing information gleaned (and anonymized) from former CFATS facilities to similar facilities to make the process somewhat less complicated.

The Actual Drone CI Provision

The information that I received yesterday for last night’s post about drones and critical infrastructure facilities was not as complete as it could have been and as a result I made a small leap to the wrong amendments. While the two amendments that I reported on were submitted for consideration, they were not taken up by the Committee. Instead, Chairman Schuster’s (R,PA) Manager’s Amendment does contain similar language and was adopted by the Committee.

The Schuster amendment still adds a new 49 USC 45509 that adds the requirement I described yesterday for new regulations from the FAA. There is no requirement for covered facilities to register in order to have the regulations apply like we saw in Babin #81.

The very real difference between the adopted Shuster language and the two Babin amendments that I described last night can be found in the definition of critical infrastructure. The Schuster amendment’s definition {§45509(c)} only includes CFATS facilities and MTSA facilities. It does not include water treatment plants, waste water treatment facilities, DOD/DOE owned facilities or NRC regulated facilities.

Moving Forward

HR 4441 was approved in Committee yesterday on a near party line vote. In fact, there were two Republicans that voted against the bill. This means that the bill probably would not pass if it was brought to the floor under suspension of the rules which requires a 2/3rds vote to pass. This means that it would require a rule which would leave open the possibility of further amendments on the floor.

The unanimous Democratic opposition to the bill means that this version of the bill would almost certainly not get considered in the Senate. We are likely, therefore, to see another version of the bill with more bipartisan support introduced and voted upon in the Senate. The House could then either accept the Senate language or demand that a conference committee work out the differences in the two bills. In the 114^th Congress there has been a pretty even split between the two options.

There was no recorded vote on the Schuster amendment (not unusual) so it is hard to tell whether there is any substantial opposition to this provision which was a relatively minor part of that amendment. I suspect that there was significant opposition to the Babin amendments and that the Schuster language was offered as an acceptable substitute. This might mean that the Schuster language could end up in any conference reported bill.

Commentary

My comments from last night still stand except that the even further limiting of the drone regulations to just CFATS and MTSA covered facilities is even more inexplicable than was the lack of coverage in the Babin amendments for the electric grid and gas distribution lines. The only thing that I can figure is that including the water facilities would have required involving the EPA oversight committees and that was fraught with problems. There has been a general disinterest in Congress in requiring any real security of water treatment facilities. This is probably due to the fact that most of the facilities are owned by local governments that generally have little interest in spending money on real security measures.

DOT/DOE and NRC regulated facilities are already typically listed as flight restricted zones so that technically flying drones over them is already illegal. Raising the issue in this forum would just add ways for the bill to acquire more opposition.

It will be interesting to see if the industrial backers of this language can convince the Senate Commerce, Transportation and Infrastructure Committee to include it in their version of this bill.

Critical Infrastructure Drone Restrictions

Earlier this evening I received a heads up that the House Transportation Committee, during their markup of HR 4441, the Aviation Innovation, Reform, and Reauthorization Act of 2016, the Committee passed an amendment that would restrict small unmanned aircraft systems from flying over critical infrastructure facilities.

Somehow I over looked this bill when it was introduced last week, but it has an entire sub-title dealing with small unmanned aircraft systems, commonly referred to as drones. I’ll go back and review that entire sub-title in a subsequent post.

There were actually two nearly identical amendments (#081 and #084) introduced by Rep. Babin (R,TX) that dealt with drones and critical infrastructure facilities. It is not clear from the Committee web site tonight which of the two amendments was adopted, but it really does not matter much at this point for reasons that I will discuss later in this post.

Definitions

The underlying bill defines ‘small unmanned aircraft’ as “an unmanned aircraft weighing less than 55 pounds, including everything that is on board the aircraft” {new 49 USC §45501(8)}.

The other critical definition (pardon the repetition here) is that for critical infrastructure. Instead of the typical weasel worded definition that can be stretched to fit everything or nothing these amendments get very specific. They use coverage by other federal security programs as the basis for the definition. Those specifically listed programs are {{new 49 USC §45509(d)}:

• MTSA program;

• CFATS program;

• Public water system program;

• Public treatment works program;

• Facilities owned by DOD or DOE; and

• Facilities regulated by NRC

New Regulations

The amendments would require the Administrator of the FAA to issue final regulations (in an unreasonably short 6 months) “concerning the operation of small unmanned aircraft systems in the proximity of critical infrastructure facilities” {§45509(a)}. The regulations would be required to {§45509(b):

• Describe the critical infrastructure facilities to which the regulations would apply;

• Ensure that the designated facilities are part of an established federal security laws;

• Establish boundaries for permissible unmanned aircraft operations;

• Permit facility owners to operate unmanned aircraft over the facilities; and

• Establish criminal penalties for violating the regulations.

The difference between the two amendments is that #081 would require eligible facilities to register with the Administrator for the regulations to have effect. Amendment #084 automatically covers all of the eligible facilities.

Moving Forward

Until the complete committee record for this markup becomes available and we can look at the votes I will not be able to tell for sure if this bill has bipartisan support. As it clearly has the support of the Chair of the Transportation and Infrastructure Committee {Rep Shuster (R,PA) is the author and Committee Chair}, the bill will make its way to the House floor and it will pass. If it has bipartisan support it may make it whole to the Senate floor for consideration.

Given the very large number of amendments that were offered in Committee, I suspect that this bill may require a rule for consideration in the House, which would open it up for more amendments there.

It is way too early to know if one of these amendments will make it into the final FAA authorization act.

Commentary

I strongly suspect that industry will support this amendment (either version). The American Chemistry Council has provided me with a statement of support that the vote for the amendment will “help address a mounting security concern and help safeguard chemical facilities”. I really expect other industry organizations to chime in.

Now I have frequently written about the potential hazards that drones pose to chemical facilities (most recently here), so one would expect that I would be supportive of these amendments, and I suppose that I am. They are a good first pass at attempting to address the obvious security problems with drones. But there are three glaring problems with these amendments.

First, they missed a couple of types of very important critical infrastructure facilities in their definition; electric grid facilities and gas transmission facilities come quickly to mind. The gas transmission facilities I almost understand; they are not covered by a formal federal security program (TSA security coverage is very vague and voluntary). Large portions of the electric grid, however, are covered under the NERC CIP program which should count as a federal security program.

The second and certainly more important problem is that making flying drones over one of these protected facilities a crime is not going to stop someone who intends to do the facility harm; its just another law to be broken in the process. To make this restriction really mean something it has to authorize covered facility owners to take action to stop a drone from flying over their facility.

Currently the FAA has made clear that shooting down a drone is just as illegal as shooting down any other aircraft in the national airspace. There are a number of good reasons for taking; probably the most important is that shooting down aircraft results in uncontrolled crashes that may do more damage than the unrestricted drone ever word.

There are, however, a number of emerging technologies are being designed for active drone defense that would allow a defender to take control of a drone in a specified area and cause it to make a controlled landing in a designated area. Unfortunately, a critical infrastructure owner would be unlikely to try to employ such a system, fearing running afoul of the current rules that protect aircraft.

For legislation to provide real protection to critical infrastructure from drone attacks of whatever sort, it will have to provide legal cover for taking action against the drones. While I don’t think we want the local chemical company to employ air-defense weapons to protect their air space (like nuclear facilities did after 9-11), but specifically taking control of drones violating very clearly defined airspace near and over designated facilities to force a controlled landing would seem to me to be very reasonable.

Finally, there is the problem of identifying the restricted air space defined in the required regulations well enough so that a non-adversarial drone hobbyist does not inadvertently violate that air space. Currently pilots have very detailed maps of restricted air space that they are supposed to maintain and they have received training in how to read those maps as part of their required pilot training. Even so, there are a relatively large number of inadvertent restricted air space incursions every year.

How we are going to get that level training to the over 350,000 currently registered sUAV owners is completely beyond me.

Drone Threats for Chemical Facilities

There was an interesting article this week over at Net-Security.org about a British report on the potential use of drones by terrorist organizations. That report provides an interesting set of data about potential drone threats. It includes capability tables for a number of aerial (UAV) ground (UGV) and marine (UMV) drones. Unfortunately, there is no specific discussion about such vehicles and chemical facilities.

Activist Propaganda

Let me start off by saying that I know of only one ‘instance’ of use of a UAV ‘against’ a chemical facility. Back in 2010 Greenpeace made a big show using their small blimp to investigate chemical facility security. There was apparently no attempt made to overfly the facilities and the photographs published by Greenpeace were from another aircraft (almost certainly a helicopter) with the blimp in the fore ground and the facility in the background.

Smaller, more modern UAVs, will not have the same sort of visual impact that the Greenpeace blimp had. This means that they are unlikely to be used for propaganda type efforts. These more maneuverable UAVs are more suited to surveillance and data gathering. The use of onboard cameras and chemical detectors could be used by various environmental and environmental justice organizations to document chemical releases at chemical facilities. The use of UGVs and UMVs can certainly be expected to be added to this effort as they become more commercially available.

I would not be surprised to hear of the use of UAVs in civil disobedience actions where they could be employed to deliver paint bombs against transportation assets in and around chemical facilities. Paint bombs deployed against tractor or railroad windshields could serve to delay or disrupt chemical transportation operations.

UAV support of conventional civil disobedience operations is only going to increase. Aerial filming of the activity and the security/law enforcement response to the activity can be expected to be used for propaganda purposes for money raising and encouraging copy-cat operations.

Pre-Attack Reconnaissance

Because of the large number of relatively cheap UAVs available with onboard video capability, it is to be expected that there will be an increasing number of UAV’s flown around, over and through chemical facilities. While the vast majority of these will probably be flown by local activists for propaganda purposes or just busybodies looking to see what is going on, some will be flown by activists or terrorists (different objectives and ‘attack’ methodologies) gathering intelligence to support possible future actions.

Activist ‘attacks’ are typically civil disobedience activities designed to interfere with facility operations, particularly those associated with transportation activities. UAV reconnaissance would be used to identify critical activity locations, points of entry and routes between the two. Of particular interest would be areas to hang banners and choke points where a small number of activists could block vehicle movements. As UGVs become more robust and cheaper their use in these types of reconnaissance operations can be expected to increase.

The British report does a good job of outlining the experience of many terror groups with the use of UAVs for battlefield reconnaissance as well as command and control. Significant terror attacks on chemical facilities will almost certainly include pre-operational reconnaissance by UAVs.

This type of UAV reconnaissance will include gathering of the same sort of information that activists would look for, but in much greater detail. In many cases the reconnaissance effort will include looking for specific chemical storage and transfer facilities. If a vehicle born improvised explosive (VBIED) attack is intended, the best site for vehicle placement and routes to that location will be the primary focus. If smaller, more targeted IEDs are to be employed, then tanks, valves and transfer lines will be the recon objectives. In both cases, internal security measures and response routes for security forces will also be important.

For possible attacks against water-side facilities the use of UMVs is a possibility. The British report, however, shows that the current cost of such vessels is quite high and there are only a limited number of options currently available. This will change if there is an increase in hobby use of this type of craft.

The use of UGVs is even less likely. Because of the prevalence of spill containment dikes and multi-story buildings and pipe structures, only a very limited amount of ground level reconnaissance will be possible. Route reconnaissance for VBIEDs is one area where UGVs may be very helpful, but they are still more likely to be detected and intercepted.

Attack Vehicles

All three classes of drones could certainly be used to deliver explosive devices in attacks on chemical facilities. They have the advantage of reducing the casualties in the attacking force and could potentially be used to allow a large diversionary attack at a secondary facility to allow a more complicated attack to go unopposed at the primary target.

UAV’s have limited payload capability so they would have to be used in precision type attacks rather than area effect attacks. Placing explosive devices on the top of storage tanks or isolated pipelines are well within the capabilities of such vehicles.

UGV’s up to and including remotely operated cars (see the British report – pg 11 - for an actual incident of such cars being by ISIS) could deliver larger explosive packages to accessible areas within the facility. The payload is still going to be significantly smaller than the typical truck VBIED that have been used by any number of terror groups around the world.

The high-cost and relative unavailability of UMVs probably argues against their use for delivery of explosives in an attack in the near term. It must be remembered, however, that smaller underwater explosives are more effective due to pressure waves underwater.

Attack Support

As the British report notes, ISIS has been gaining proficiency in the use of UAVs for battlefield surveillance and command and control activities. The use of UAV’s in such roles in terrorist attacks has not yet been seen, but is clearly an activity that can be expected in the future. For ground based terror operations to seize or destroy a chemical facility, the ability to use UAV’s to watch responding security or law enforcement personnel will make for a much more effective terror operation.

The use of small explosive devices deployed by UAVs used to attack or disrupt such response could be used to allow the ground team to harden their position or more time to emplace their explosive devices.

Stopping Drones

There is very little that chemical facilities can do to stop drone operations near, over and in their facilities. In addition to the known difficulties in spotting and disabling UAVs in flight, there is currently no legal authority for chemical facilities to take them down, even if they are in the facility airspace. Currently the best bet is to deploy anti-drone netting to snare UAVs and prevent them from approaching critically vulnerable assets.

A more important security job, however, is the spotting and hopefully identifying UAVs as they approach the facility. This should be part of the facility anti-reconnaissance plan that is designed to detect a terrorist attack before it happens. Every employee should be required to report any UAV sighting at or near the facility to their supervisor and the security manager should consolidate such reports to be submitted to local law enforcement. All such reports should include the location of the siting, the type of UAV, the direction of approach and the direction the drone departed.

While little can currently be done to prevent UAV incursions, facility security managers need to take a hard look at their facility from the point of view of UAV attack vulnerabilities. Facilities need to begin consideration of measure that they can take to hide such vulnerabilities or prevent UAV access.

HR 3669 Introduced – Drone Crime

Earlier this month Rep. Garamendi (D,CA) introduced HR 3669, the Safety for Airports and Firefighters by Ensuring Drones Refrain from Obstructing Necessary Equipment (SAFE DRONE) Act of 2015. The bill would make it a Federal crime to operate a drone near a hub-airport or federal firefighting scene.

The bill would add §40A to 18 USC. It would make it a crime (punishable by fines and/or 1 year in prison) to operate “a drone in a restricted area” {new §40A(a)}. The bill defines a drone as an unmanned aircraft as defined in §331(8) of the FAA Modernization and Reform Act of 2012 (PL 112-95); so this definitely includes both commercial and hobby unmanned aerial vehicles.

The bill provides its own definition of ‘a restricted area’ {new §40A(c)(2)}:

• Within a 2-mile radius of a small hub airport, medium hub airport, or large hub airport;

• Within 2 miles of the outermost perimeter of an ongoing firefighting operation involving the Department of Agriculture or the Department of the Interior; or

• In an area that is subject to a temporary flight restriction issued by the Administrator of the Federal Aviation Administration.

There is no language in the bill that allows for authorized use in restricted area except for operations by Federal, State, or local unit of government (or their contractors) in support of firefighting activities. This would seem to mean that drones could not be used, for instance, in perimeter security operations at a hub airport.

Moving Forward

Garamendi is not a member of the House Judiciary Committee (the committee of jurisdiction for this bill), but one of his co-sponsors, Rep. Lofgren (D,CA) is a fairly influential member of that Committee. This means that there may be enough political pull to get this to a Committee hearing. The fact, though, that none of the ten cosponsors are Republicans tends to weigh against that possibility.

It is not clear at this point how much opposition there would be to this bill from commercial drone services or manufacturers. Any that does arise may be able to be placated by the addition of the word ‘unauthorized’ as a modifier of ‘operation’.

Commentary

This bill is obviously a response to several reports of interference in aerial firefighting operations by drones being sighted in the area combined with vague FAA reports about drone operations around airports. Something clearly needs to be done, but a tad bit more attention to detail needs to be paid in the construction of criminal statutes. Why for example is operation in an area covered by a temporary FAA flight restriction a crime operation in an area covered by a permanent FAA flight restriction is not?

The way this bill is currently written a child playing with a remote controlled helicopter in his yard within two miles of an airport could be made a felon. While one would like to think that a prosecutor would have more sense than that, stranger things have happened.

The one thing that does disturb me, however, is that there are no provisions in the bill that would make unauthorized operation of a drone over critical infrastructure facilities a crime. Again, some careful attention to the wording would be required, but this is clearly an area that needs to be addressed and a bill like this would seem to be the ideal vehicle.

Congressional Hearings – Week of 10-04-15 –

Both the House and Senate will be in session this week. Budget issues have been pushed to the backrooms so we are going to see a variety of issues coming up in hearing rooms this week. Hearing of probable interest to readers of this blog include: drones, NPPD organization, and maritime cybersecurity.

Drones

The Aviation Subcommittee of the House Transportation and Infrastructure Committee will hold a hearing on Wednesday on “Ensuring Aviation Safety in the Era of Unmanned Aircraft Systems”. The witness list includes:

• Michael G. Whitaker, Deputy Administrator, FAA

• James Hubbard, Deputy Chief, United States Forest Service

• Captain Tim Canoll, President, Air Line Pilots Association

• Rich Hanson, Director of Government and Regulatory Affairs, Academy of Model Aeronautics

• Dr. Mykel Kochenderfer, Professor of Aeronautics and Astronautics

NPPD Organization

On Wednesday the Cybersecurity, Infrastructure Protection, and Security Technologies Subcommittee of the House Homeland Security Committee will hold a hearing on “Examining the Mission, Structure, and Reorganization Effort of the National Protection and Programs Directorate”. The witness list includes:

• Ronald J. Clark, Deputy Under Secretary, NPPD

• Chris P. Currie , US GAO

• Phyllis Schneck, Deputy Under Secretary, Cybersecurity and Communications, NPPD

• Suzannee Spaulding, Under Secretary, Cybersecurity and Communications, NPPD

Looking at the witness list this certainly looks like it will concentrating on the cybersecurity side of NPPD. I doubt, however, that much mention will be made of ICS-CERT.

Maritime Cybersecurity

The Border and Maritime Security Subcommittee of the House Homeland Security Committee will be holding a hearing on “Are Our Nation’s Ports at Risk for A Cyber-Attack?” The witness list includes:

Jeh C. Johnson, Secretary, DHS;

James B. Comey, Jr., Director, FBI;

Nicholas J. Rasmussen, Director, National Counterterrorism Center,

Don’t expect to hear too many actionable details from this hearing. It is going to concentrate of policy and broad threat overviews.

On the Floor

Among the many bills that will be considered in the House on Tuesday under suspension of the rules, there is one bill that might be of specific interest to readers of this blog:

HR 3510 – Department of Homeland Security Cybersecurity Strategy Act of 2015, as amended

This bill was marked up in Committee last week. There was one amendment adopted dealing with privacy issues. HR 3510 is expected to pass with bipartisan support, minimal debate and no floor amendments will be authorized.

Bills Introduced – 07-10-11

Twenty bills were introduced yesterday in the House; the Senate had already left for the weekend. Only one of those may be of specific interest to readers of this blog:

HR 3025 To amend title 18, United States Code, to provide a criminal penalty for launching drones that interfere with fighting wildfires affecting Federal property, and for other purposes. Rep. Cook, Paul [R-CA-8] 

While recent news reports about fire-fighting flights being canceled due to the presence of drones in the fire area make this a potentially important bill to fire-fighters it is the presence of the ‘and for other purposes’ at the end of the title that caught my attention. Lots of room for other drone actions there.

House Passes DHS Bills with Minimal Debate

This has been the week for the House to consider a number of low-controversy bills for DHS. Two of the bills in particular have been ones that I have been commenting on in this blog:

HR 1646 – The Homeland Security Drone Assessment and Analysis Act

HR 2200 – The CBRN Intelligence and Information Sharing Act of 2015

Both of these bills were debated on Tuesday, but neither attracted much discussion. The debate on HR 1646 lasted a little over six minutes. The debate on HR 2200 only took nine minutes. There were 40 minutes allotted for the debate of each bill.

HR 1646 was passed on a voice vote on Tuesday. When it came to vote on HR 2200 a recorded vote was requested which delayed the proceedings until this morning. The House voted 420 to 2 to approve HR 2200. Both bills now head to the Senate where they are likely to be considered under the unanimous consent process, but there is no telling when that might happen. They could even  die a quiet death by being ignored by the Senate leadership.

Bills Introduced – 06-18-15

There were 73 bills introduced in the House and Senate yesterday. Of those four may be of specific interest to readers of this blog:

S 1608 A bill to protect the safety of the national airspace system from the hazardous operation of consumer drones, and for other purposes. Sen. Feinstein, Dianne [D-CA]

S 1611 A bill to authorize appropriations for the Coast Guard for fiscal years 2016 and 2017, and for other purposes. Sen. Thune, John [R-SD]

S 1619 An original bill making appropriations for the Department of Homeland Security for the fiscal year ending September 30, 2016, and for other purposes. Sen. Hoeven, John [R-ND]

S 1634 A bill to amend the Federal antitrust laws to provide expanded coverage and to eliminate exemptions from such laws that are contrary to the public interest with respect to railroads. Sen. Klobuchar, Amy [D-MN]

Unless Feinstein’s drone bill specifically addresses critical infrastructure this will probably be the last mention of this bill.

The House version of S 1611 did not contain any references to chemical transportation safety or security and neither will this version (likely). We will see.

The DHS spending bill and its report from the Senate Appropriations Committee has already been printed by the GPO. I’ll probably have a review prepared later today.

Klobuchar’s railroad antitrust bill may be of specific interest to chemical shippers but I won’t cover the bill unless there are specific mentions of chemical shipping provisions.

House Amends and Passes HR 2577

Yesterday the House finished action on the FY 2016 THUD spending bill, HR 2577. While there were no new provisions in the original bill that would be of specific interest to readers of this blog there were a couple of amendments brought to the floor that might peak that interest. The bill passed by a very close (216 to 210) due to the defection of 31 Republicans.

Pipeline Safety Amendments

There were a couple of amendments from Rep Capps (D,CA) that proposed modifying some of the funding for the pipeline safety segments of the bill. She attempted (CREC, 613-15, pg H3856) to increase the industry funded Oil Spill Liability Trust Fund by almost $28 Million, but was defeated on a vote that was very similar to the final vote on the bill, 202 to 222.

She was successful (CREC, 6-3-15, pg H3856) in adding an amendment that would earmark $1 Million of the PHMSA funding for completing the regulation for requiring the addition automated shut shutoff valves and leak detection on pipelines. This was not new funding, just specifying how some of the standard appropriation for the Oil Pollution Spill Liabilty Trust Fund would be spent.

HHFT Funding

There was an attempt by Rep. Gosar (R,AZ) to strip funding (CREC, 6-4-15, pg H3886) for the enforcement of the recent DOT Highly-Hazardous Flammable Train (HHFT) regulations. While most of Gosar’s ire was directed at the new railcar standards, the amendment would have stopped all funding for the enforcement of the regulation. This amendment was defeated in a mainly bipartisan vote of 136 to 286.

Drones

Rep. Newhouse (R,WA) introduced an amendment that would prevent the FAA from spending money to implement or enforce their recent rulemaking on Drones unless agricultural uses were specifically addressed. The original amendment (CREC, 6-9-15, pg H3978) was withdrawn due to a registered point of order on the language (presumably the standard ‘legislating in a spending bill’ objection). A modified version was subsequently offered that would prohibit implementing any drone rules unless they followed the restricted category certificate requirements of 14 CFR 21.25(b)(1).

The second version of the amendment was adopted by a voice vote.

Moving Forward

The close vote in the House indicates that there might be problems in getting this bill onto the floor of the Senate for consideration. The Democrats in the Senate have already indicated that they intent to oppose any spending bills that continue the sequestration program, but the Republican leadership had hoped that this bill would get to the floor with the backing of some moderate Democrats. If any Republican Senators join those from the House that objected to this bill, there is no way that there will be enough Democratic votes available to bring this bill to the floor.

House Amends and Passes 2016 NDA

This morning the House finished the amendment process on HR 1735, the National Defense Authorization Act for 2016. A large number of amendments to the bill were adopted including both of the amendments (drone and cybersecurity) that I mentioned in yesterday’s post on the bill. Both of the amendments were included in en bloc considerations adopted by voice vote yesterday. The final vote was a partially bipartisan vote of 269 to 151.

The Senate Armed Services Committee is finishing up their markup of the Senate version of the NDA. The full Senate will take up that bill in the coming weeks. Then a conference committee will be convened to work out the differences in the two bills before it is voted upon again by both house of Congress and shipped off to the President for signature. There has been a presidential threat to veto the current House version of the bill.

Committee Hearings – Week of 05-11-15

Both the House and Senate will be in session this week. The National Defense Authorization Act (NDA) for 2016 is big on both sides of the Hill. The THUD (Transportation, Housing and Urban Development) spending bill is also moving forward. There are also two other hearings of potential interest to readers of this blog on drones and EMP.

Spending

The Senate Armed Services Committee and various sub-committees will be marking up their NDA (S 1118) all week. The text of that bill hasn’t been released yet, so we will have to wait and see what the final bill looks like, probably next week.

The House Rules Committee only has a general debate scheduled for the House version of the NDA (HR 1735). That hearing is scheduled for tomorrow evening. But the House is scheduled to take up the bill later this week so a rule meeting will almost certainly be held on Wednesday.

The House Appropriations Committee will markup the THUD bill on Wednesday. It would not be surprising to see amendments concerning rail hazmat issues.

Drones

The Oversight and Management Efficiency Subcommittee of the House Homeland Security Committee will hold a markup hearing on Wednesday. Five bills will be addressed, including HR 1646, the Homeland Security Drone Assessment and Analysis Act. This bill has some serious bipartisan support and should move to the floor of the House rather quickly.

EMP

The Interior and National Security Subcommittees of the House Oversight and Governmental Reform Committee will be holding a hearing on Wednesday looking at the threat of EMP events. No witness list is yet available.

How to Disrupt Drones - Background

There is an interesting article over at WTOP.com about work supposedly being carried out by the Secret Service in their attempts to prevent a re-occurrence of the recent ‘drone incursion’ at the White House. I’m very surprised that they are doing their testing in Washington, DC, but that may just be because there are more air space controls in place there than most anywhere else in the country. But, all of that aside, the discussion of disrupting drone activities is an important one for all critical infrastructure security, one that I have pretty much ignored until now.

This will be the first of a short series of articles about the use of drones as weapons against critical infrastructure and what can be done to reduce the risk of their successful employment as a weapon.

What is a Drone

Thanks to the War on Terror just about anyone in the world that hears the word ‘drone’ first thinks of war birds like the Predator equipped with Hellfire missiles, taking out al Qaeda leadership or killing innocent civilians depending on your point of view. This is for all intents and reasonable purposes a war plane. While some commentators (and a couple of popular TV shows) have warned about terrorists gaining control of such weapons, defending a facility against such attacks is a job for the US Air Force not the local chemical facility security manager. So I will ignore such sophisticated weapons until such time as North Korea or Iran starts selling them at Wal-Mart prices to various terrorist organizations.

No what is of legitimate concern to security managers at critical infrastructure locations is the much more common and less sophisticated remotely piloted vehicles that the FAA is calling sUAV (small unmanned aerial vehicle). Weighing less than 55 lbs this class of vehicles encompasses everything from the small toy helicopters you buy in the mall (the FAA calls these micro UAV if they weigh less than 4.4 lbs) to hobiest type vehicles like the quad copter that crashed at the White House, to sophisticated surveillance aircraft being introduced into service around the country.

The limited payload size of these aircraft means that they will be unlikely to be used against hardened targets like nuclear reactors. They would, however, be able to carry a small explosive or incendiary device, which means that they could be capable of initiating an attack on a chemical facility.

More likely, however, is that the surveillance capability of these types of vehicles could by terrorists to gain detailed knowledge of the layout and security measures at a targeted facility in preparation for an attack, or even for command and control activities during an infiltration.

A much more likely use of these vehicles will be surveillance activities by non-violent activist groups (think GreenPeace) wanting to document perceived or alleged environmental or ethical violations at chemical facilities. Similarly, I expect that we will see an increasing number of news organizations using these sUAV for acquiring videos for the evening news.

Drone Capabilities

Because of the wide variety of potential vehicles it is going to be difficult to describe a specific set of characteristics for this class of aircraft. In order to remain in the sUAV classification the FAA does intend to limit the maximum speed to 100 mph and require that an operator be in constant control of the device.

Fixed wing versions of these drones are going to have some limitations on their maneuverability just because they require air flow over/under their wings to maintain lift; they won’t be able to hover for instance. Their low weight, however, will mean that they will be able to fly relatively slowly without stalling. Low speed also means pretty good maneuverability.

Rotary winged versions will probably not reach the 100 mph speed, but they will be very maneuverable and will be able to hover and reverse. Spinning the aircraft body in place will also be a rather unique capability.

Motive power will be electric for the smaller aircraft and internal combustion engines will be common on the larger versions. The electric versions will be relatively quiet; the IC’s not so much.

All of these sUAV will require real-time electronic communications with their controller/pilot. This means a WiFi, cell phone or radio link.

Weaponization

To date I haven’t seen any specific discussion of weapons actually being deployed on any of these small aerial vehicles, but it is just a matter of time. Because of the size of the platform, however, there will be some limitations.

You can just about forget these vehicles being used as gun platforms. It wouldn’t be too hard to mount a small barrel and firing device, but any cartridge of significant caliber will provide so much recoil that the flight controls will be seriously disrupted. This will be less true of the larger, fixed-wing aircraft, but the engineering required to design and build a system with any significant size (caliber) and accuracy will be extensive. I know some gun-nuts that would be interested in the challenge, but I don’t see anything happening in this arena soon.

Rockets would be much better suited to this type of platform. The problem would still be size/weight restrictions. The aiming and firing mechanism is going to be a design challenge. The small size of the warhead for any but those mounted on the largest platforms in the class will limit the strike utility of these weapons.

The most effective way to weaponize these vehicles would be with explosives. Bombing will certainly be tried, but I suspect that the accuracy will be WWI level; certainly nothing like the precision weapons delivery we’ve come to expect of sophisticated aerial platforms. Much more effective will be the flying bomb where the explosive payload never leaves the aircraft. A couple of pounds of plastic explosive will be well within the capability of all but the smallest micro UAV. This is the type of weaponization that would be the cheapest and easiest to engineer; I expect that it will be the first to be employed in the wild.

There is also the possibility that these aircraft could be employed in an electronic warfare mode. Many large chemical manufacturing facilities use wireless communications techniques in their control system deployments. Using a drone as a platform to intercept, jam or mimic these communications could provide a unique attack capability. This mode of attack would require a great deal of sophistication and multiple areas of expertise to implement. In the near term this is a low probability attack method.

There are other less sophisticated ways to employ sUAV as weapons. The easiest, of course, is to employ the aircraft as a direct kinetic weapon, just fly it into the target. This was a well publicized method used by a very limited number of Japanese pilots in WWII. The higher the speed capability the more effective this will be as an attack method.

There are other attack techniques that could be used in specialized situations. I’ll give just couple of examples that come to mind. Attach a long copper wire to the drone and fly it into an electric sub-station; exciting things will happen. Or fly a drone through a flare at a refinery; great balls of fire.

OMB Approves FAA Drone Rule

On Friday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the FAA’s notice of proposed rulemaking (NPMR) on the Operation and Certification of Small Unmanned Aircraft Systems (sUAS). This is the same ruling that the FAA and the TSA held a joint media call about yesterday. A draft of the NPRM is available and will probably be published in the Federal Register this week.

The sUAS rules would apply to unmanned aircraft that weigh under 55 lbs. The NPRM would contain a proposal to set a subcategory of micro UAS category for UAS that weigh under 4.4 lbs. A number of additional restrictions would apply to both categories of UAS.

An operator of either type UAS would be required to have a ‘unmanned aircraft airman certificate” which would include a requirement for vetting by the DHS Transportation Security Administration (TSA).

I don’t see anything that would specifically prohibit flying micro UAS or sUAS over critical infrastructure facilities unless they were already covered under existing FAA restrictions. I’ll be going into more detail on this when it is published in the Federal Register.