Senate to Vote on S 3254 – More Cybersecurity

The Senate voted today to close debate on S 3254, the National Defense Authorization Act FY 3013 after passing a large number of amendments including some additional cyber provisions. The cloture vote was 93-0. Along with these new amendments, there are a number of cybersecurity and cyber-warfare provisions included in this year’s bill.

Cyber

Last Thursday the Senate adopted an amendment (SA 3222) by Sen. Johanns (R,NE) that expressed a congressional expectation that Congress would be consulted before the Department of Defense change the command status of the U.S. Cyber Command. A ‘congressional expectation’ has about the same force of law as a ‘sense of Congress’; it’s only important because the executive branch has to come to Congress to get the money to pay for their programs.

There was no debate about this amendment and it was passes by unanimous consent along with 16 other amendments en bloc. Senate leaders from both parties took these 17 non-controversial amendments and agreed that there would be no opposition to their passage. They were lumped together to speed their legislative processing.

On Friday morning another 17 amendment en bloc consideration included a cybersecurity  amendment (SA 3280) by Sen. Levin (D,MI). This amendment would require the Under Secretary of Defense for Intelligence to establish a program requiring certain defense contractors to report “successful penetrations of designated network or information systems” {§935(d)(1)}. The wording is vague enough to allow the program to require reporting of penetrations of control systems. The program could also require the contractors to allow DOD to obtain “access to equipment or information of a contractor necessary to conduct a forensic analysis” to determine if DOD information was exfiltrated from the system {§935(d)(3)}. Information reported under this program could not be shared outside of DOD without explicit permission of the contractor, but the information is not explicitly required to be classified.

As was the case with the previous en bloc consideration the amendment was adopted without debate by unanimous consent.

Fire Safety

In an interesting parliamentary move by Sen. Lieberman (I,CT) a homeland security provision was added to this bill as an amendment (SA 3090). The amendment re-authorizes the FEMA Fire Grants Program. The money for these grants is routinely approved as part of the budget so this reauthorization is not strictly required, but it does make program management clearer. The amendment also re-authorizes the United States Fire Administration. Is should have been included in a DHS authorization bill, but there hasn’t been one of those passed in quite some time.

This amendment did stand on its own, but it was also considered without debate and was adopted by unanimous consent.

The Way Forward

As I noted in a blog post earlier today, this bill will pass in the Senate later this week and should be taken up by the House next week.

CCPS Safety Beacon

Long time readers of this blog will be well aware that I am a fan of the monthly Process Safety Beacon that is published by the Center for Chemical Process Safety. This month’s issue, Fireproofing Structural Supports, is a good example of why. They provide a small number of pictures that demonstrate the consequences of a safety issue along with short written description. Then they identify what workers and engineers at chemical processing facilities can do to avoid those consequences. While this monthly publication is directed at safety issues, it frequently identifies potential security issues. I have noted on a number of different occasions that one way to attack a release toxic storage tank is to start a fire using flammable chemicals stored nearby; chemicals that may not even make the list of release flammable COI. The Beacon notes that:

“Without fireproofing, exposed structural steel, such as the pipe rack support columns in the photograph at left, or the support columns in the photograph on the right, can rapidly lose strength and fail, possibly within minutes. The failure of the piping and equipment supports can break pipes or cause vessels to fail, releasing more flammable material, and causing a larger fire.”

The same thing could happen with pipes or vessels that contain other types of chemicals, including, of course, release toxic COI. If those COI were stored in pressure vessels, it might be difficult to cause a catastrophic release with other available means. This might mean that these types of fires would be the preferred method of attack.

As the Process Safety Beacon points out, protection of structural steel is a well understood process. Security managers might want to look at these structures around potential target tanks and piping to make sure that appropriate protections are provided.