HR 1850 Introduced - Supporting Research and Development for First Responders Act

Last week Rep Rice (D,NY) introduced HR 1850 (GPO version not available, link to Committee Print), the Supporting Research and Development for First Responders Act. The bill would authorize DHS S&T to establish the current National Urban Security Technology Laboratory (NUSTL) “to test and evaluate emerging technologies and conduct research and development to assist emergency response providers in preparing for, and protecting against, threats of terrorism” { new §322(a)}.

NUSTL

This bill amends the Homeland Security Act of 2002 by adding a new section 322 to Title III of the Act. It provides for the establishment of the NUSTL and mandates that the laboratory will {new §322(b)(2)}:

• Conduct tests, evaluations, and assessments of current and emerging technologies, including, as appropriate, the cybersecurity of such technologies that can connect to the internet, for emergency response providers,

• Act as a technical advisor to emergency response providers, and

• Carry out other such activities as the Secretary determines appropriate.

Moving Forward

The House Homeland Security Committee is taking up this bill today. I expect that it will receive substantial bipartisan support. It will move to the floor of the House, where it will be considered under the suspension of the rules process. That will limit debate, prevent amendments from the floor, and require a supermajority for passage. The bill will pass in the House with substantial bipartisan support.

Commentary

This bill is a housekeeping measure. The NUSTL already exits and has been funded for sometime. The housekeeping nature is further evidenced by the fact that there is no authorization (MONEY) language in the bill, it is already a line-item in the S&T budget.

But, housekeeping also means straightening up things, and there is one item that should be addressed in the bill. Since the language specifically addresses cybersecurity research, I think that it is only proper that it should specifically include language establishing a cybersecurity information sharing requirement. So I would like to propose two subparagraphs being inserted in the §322(c):

“(3) act as a clearing house for first responder information on cybersecurity issues related to discovered and reported vulnerabilities and indicators of compromise on technologies used by first responders that can connect to the internet,

“(4) coordinate vulnerability reporting with vendors and developers for vulnerabilities identified by research at the Lab and by those vulnerabilities reported to the Lab by independent cybersecurity researchers,”

First Responders Community of Practice ICR Renewal – 60-day Notice

Today the DHS Science and Technology Directorate published a 60-day information collection request (ICR) notice in the Federal Register (78 FR 53464) for the renewal of their ICR (1640-0016) supporting their First Responders Community of Practice web site. This limited access web site allows for the exchange of information between registered members of the first responder community.

The previous renewal of this ICR only provided a one-year extension of the ICR. In the previous approval OMB noted that DHS should provide the following information in the next submission to justify the continued collection of the required information:

• How the First Responders Community of Practice is being used.

• Has the intended audience been reached?

• An analysis by DHS of the practical utility of the collection.

• An analysis by DHS of other similar platforms currently in use by first responders.

The requested information has not been provided in this ICR submission. I suspect that, unless the requested information is added to the 30-day submission notice that this ICR will be rejected by OMB. It would have been nice to have that information available for the 60-day public comment period.

NOTE: This submission continues the current practice of not including a cost burden estimate. The previously approved ICR showed an estimated annual cost burden of $50,000 for 2,000 (registration) responses at a half-hour each. This comes out to $50/hour for the value of a first responder’s time. I know that they wish they got paid that much.

DHS S&T Withdraws First Responders Community of Practice ICR

Yesterday the Office of Management and Budget announced that the DHS Science and Technology Directorate (S&T) had withdrawn their information collection request (ICR) supporting the on-line First Responders Community of Practice being developed to establish “a collaborative environment for the first responder community to share information, best practices, and lessons learned” (76 FR 11254).

I mentioned the publication of the 60-day notice of the intent to submit this ICR over a year ago. I have still not seen any information on this program (but I haven’t really looked for any either) beyond the two earlier Federal Register publications. It sounds like a worthwhile information sharing exercise, but in the current budget situation it is probably not being funded. That is a guess on my part as the OMB notice does not provide any reason for the withdrawal of this ICR.

I really hope that this ICR withdrawal is not due to a cancellation of this program. First responders are the people that we count on in any emergency to protect us from whatever danger is coming our way. Generally speaking, these folks are under trained and underfunded, and their professionalism is based, in large part, upon the experiences they have individual accumulated over the years.

Fortunately, terrorist attacks, particularly those using hazardous chemicals, are rare events. But that means that very few of our first responders have the requisite knowledge of, or experience in, responding to these events. Establishing a methodology for sharing that experience would be a valuable tool for increasing the ability of these brave men and women to appropriately respond when they are faced with these infrequent events.

DHS S&T First Responders Community of Practice ICR

The DHS Science and Technology Directorate (S&T) published their initial 60-day information collection request (ICR) in today’s Federal Register for a new program they plan to establish, the First Responders Community of Practice. This program is being designed to provide “a collaborative environment for the first responder community to share information, best practices, and lessons learned” (76 FR 11254).

OMB approval of the ICR would allow S&T to collect registration information to allow them to limit participation in the program to first responders and selected non-first responders. Participating on-line members of this community would be able to “create wikis, discussion threads, blogs, documents, etc., allowing them to enter and upload content in accordance with the site’s Rules of Behavior”.

Public comments on this ICR are being solicited. They should be submitted by May 2nd, 2011. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov) using docket number DHS-2011-0008.

First Responder Background Checks

In Saturday’s blog about the FAQ updates I kind of glossed over the DHS response to question 1368 since the answer wasn’t new. That question dealt with whether or not first responders like fire department personnel are required to under go background checks under the CFATS rules. The DHS response to that question was a straightforward:

“6 CFR Part 27 does not require that fire department personnel undergo background checks.”

At first glance that seems to directly contradict the CFATS regulations. Section 27.230(12) outlines the risk-based performance standards requirements for personnel surety. It explains that the facility would need to conduct “appropriate background checks on and ensure appropriate credentials for facility personnel, and as appropriate [emphasis added], for unescorted visitors with access to restricted areas or critical assets”. 

The words ‘as appropriate’ would appear to give DHS the necessary wiggle room to essentially exempt first responders from the personnel surety program coverage. The exemption would certainly seem to be reasonable. After all, when a fire truck shows up at the front gate with lights flashing on its way to a on-site fire, no one wants to slow them down to make sure that all the firemen are on an approved access list. 

The question then becomes, who else could be covered under the ‘as appropriate’ exemption. Lacking specific guidance from DHS (and that may be coming, according to rumors, in an NPRM outlining a DHS program for TSDB checks) it would be up to the facility to define in its SSP which off-site personnel would be exempt from the background check requirements of its facility personnel surety program. Of course, those exemptions would have to be approved by DHS, so the facility must be prepared to justify those listings. 

There is, of course, another class of people that are already exempted from the personnel surety program requirements, a wide variety of Federal inspectors. Section 27.405(1) makes it clear that the CFATS regulations do not supersede requirements allowing inspectors access to covered facilities.

HR 1187 Status – 02-25-09

On February 25th, Rep Rodney Frelinghuysen (R. NJ) introduced HR 1187, the Smarter Funding for All of America’s Homeland Security Act of 2009. The bill would authorize the Secretary of DHS to make grants to first responders, establish an Advisory Council on First Responders, make modifications to the Homeland Security Advisory System, require reports on information sharing with State and local governments, and require a study of the spectrum needs for first responders. The bill was assigned to the Homeland Security Committee with additional assignments to the Committees on Transportation and Infrastructure, the Judiciary, and Energy and Commerce for the areas under their jurisdictions. First Responder Grants This legislation would add §802, Faster and Smarter Funding for First Responders, to Subtitle A of Title VIII of the Homeland Security Act of 2002. The grants made under this section would be in addition to any existing first responder grant program. It would establish a State and Regional First Responder Grant Program through the Office for State and Local Government Coordination. The grants would be targeted at specific risks identified by the Under Secretary for Information Analysis and Infrastructure Protection. Section 802(e)(2) establishes the ten categories of threats that will be used to establish the risk requirement for this grant. The categories include such things as threats against the water supply, food supply and energy supply. Interestingly threats against high-risk chemical facilities are not a listed category; though they would probably fall under one of the listed categories. Grants may not be made under this section unless “unless the Under Secretary identifies a specific vulnerability that is subject to a present or analytically projected threat of an act of terrorism” {§ 802(e)(4)}. Advisory Council on First Responders The bill would also add §803, establishing the Advisory Council on First Responders. The Council would advise the Secretary on the “need for a Federal standard with respect to any particular first responder equipment or training” and other areas of the Department’s missions that would enhance the capabilities of first responders. The Council would meet at least quarterly. Homeland Security Advisory System Section 210F would be added to Subtitle A of title II of the Homeland Security Act of 2002 requiring changes to the Homeland Security Advisory System. It would require that any threat level or warning will be “accompanied by a designation of the geographic regions and economic sectors to which the designation applies.” It would also require the Secretary to make an annual, unclassified-report to Congress explaining the basis for the region specific and sector specific warnings issued in the previous year. Information Sharing Subtitle I of title VIII of the Homeland Security Act of 2002 would be amended by adding § 899a requiring an annual report from the Secretary to Congress on the issue of security clearances requested by, and issued to, members of State and local governments to allow for the sharing of classified information. First Responder Spectrum Needs The final section of this legislation would require the Secretary to conduct a study to determine if there was a need to assign additional communication spectra to first responders to meet their “their needs associated with a catastrophic regional or national emergency”. The Secretary would be required to report to Congress the results of such a study within 180 days of the enactment of this legislation.