HR 3583 Introduced – PREPARE Act

Last week Rep. McSally (R,AZ) introduced HR 3583, the Promoting Resilience and Efficiency in Preparing for Attacks and Responding to Emergencies (PREPARE) Act. The bill reauthorizes and makes minor modifications to a number of emergency response and planning grant programs. Program changes of specific interest to readers of this blog include

• Cybersecurity protections for Public Safety Broadband Network;

• DHS use of social networking; and

• The medical countermeasures program

FirstNet Cybersecurity

Section 206 of the bill requires the DHS National Protection and Programs Directorate Under Secretary to provide Congress with a report on the cybersecurity support that DHS is providing to the Department of Commerce FirstNet program. Specifically the Under Secretary is tasked with the requirement “to identify and address cyber risks that could impact the near term or long term availability and operations of such [public safety broadband] network and recommendations to mitigate such risks”.

Social Networking

Section 207 of the bill would add §318 to the Homeland Security Act of 2002. It provides for the establishment of a DHS Social Media Working Group. Alert readers of this blog will realize that I recently reported that the HR 623, with nearly identical language, has been reported in the Senate.

Medical Countermeasures Program

Section 303 of the bill would add §527 to the Homeland Security Act of 2002. It establishes a medical countermeasures program under the DHS Chief Medical Officer. The program is to be designed to “facilitate personnel readiness, and protection for working animals, employees, and individuals in the Department’s care and custody, in the event of a chemical, biological, radiological, nuclear, or explosives attack, naturally occurring disease outbreak, or pandemic” {new §527(a)}.

Moving Forward

McSally is the Chair of the Emergency Preparedness, Response, and Communications Subcommittee of the House Homeland Security Committee. The Committee Chair, Rep. McCaul, is cosponsor of this bill. So there is certainly the political will and power to move this bill forward.

The Subcommittee marked-up this bill before it was introduced. The full Committee markup is scheduled for Wednesday. I suspect that the bill will be approved by a voice vote without further amendment. If so it will move to the floor of the House before the end of the year; probably to be considered under suspension of the rules with little debate and no floor amendments.

Commentary

The Congress is taking more and more actions like that seen here in specifying that DHS will report on the cybersecurity of FirstNet. These little one section toss offs in a wide variety of legislation are doing more to further the centralization of cybersecurity responsibility in DHS than any single piece of legislation could. I expect that this means that I am going to have to be watching a wider variety of bills to find those mentions that might be of specific interest to the control system security community.

I am not sure why the Social Media Working Group language is once again in legislation that is obviously heading to the floor. It was already passed in the House as a standalone bill. The only thing that makes a modicum of sense is that McSally and McCaul do not expect the Senate to actually take up HR 623 and they really want this group to be formed.

Of concern to me is that this version of the §318 language is also missing any mention of monitoring social media to provide situational awareness to the Department. While the intel folks are trying desperately to monitor the social network communications of IS and AQ supporters, the emergency response folks are, due to excessive concern with avoiding the appearance of spying on the public, being forced to ignore the vital information that could be available in natural disasters and after attacks or manmade disasters. A vitally important requirement for this SMWG should be the development of tools to abstract information from publicly available social networks to support emergency response.

The medical countermeasures program also seems to be an overly limited, if certainly legitimate DHS program. DHS certainly has a responsibility to ensure that medically foreseeable countermeasures to CBRNE attacks are available to keep their troops in the field fully functioning in their emergency response and criminal investigation capacities in the event of such attacks.

With minimal expansion of responsibility, however, the DHS Office of Health Affairs could be developing plans and standards for the deployment of medical countermeasures to the general public. In particular, incidents like the acrylonitrile train wreck this summer point to the need for the centralized stockpiling and subsequent distribution of medical countermeasures for industrial chemical accidents. OHA could have been tasked in this bill with the requirement to identify those industrial chemicals requiring specific medical countermeasures that would not routinely be available to local emergency rooms. In conjunction with such a list they could have been required to submit a plan to Congress on how a regional stockpiling and distribution plan could be put together for such countermeasures.

Congressional Hearings – Week of 11-17-13

Both the House and Senate will be back in session today. While there are a number of hearings scheduled for this week only three appear to be of specific potential interest to readers of this blog: they include medical software, FirstNet and DHS confirmation hearings. And it looks like the Senate may actually consider the 2014 National Defense Authorization Act, S 1197.

Medical Software

The Health Subcommittee of the House Energy and Commerce Committee will be holding a hearing tomorrow looking at “Federal Regulation of Mobile Medical Apps and Other Health Software” and HR 3303. As I mentioned in my blog post about that bill, there is nothing currently in the bill that would extend FDA regulatory authority to software security issues. There is an outside chance that this will come up during this hearing.

BTW: There is a nice background document on the hearing web site, but no mention of software security issues.

FirstNet

The Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold an oversight hearing on FirstNet and the Advancement of Public Safety Wireless Communications. No witness list is currently available.

DHS Confirmation

The Senate Homeland Security and Governmental Affairs Committee will vote tomorrow on the nomination of Jeh C. Johnson to be the Secretary of DHS. While there has been some controversy about the background of Mr. Johnson, this vote coming so soon after his appearance before the Committee probably means that a favorable vote will be forth coming.

S 1197

According to the Congressional Record, the Senate is scheduled to vote on a cloture motion to allow the Senate to proceed to consideration of S 1197. As I noted earlier this bill has a number of cybersecurity provisions. It’s original consideration was held up by the general disagreement between the Republicans and Democrats on spending issues. I’m not sure what has changed, but it would seem that Sen. Reid (D,NV) thinks that he has enough votes to move this bill forward.

If it passes (and it probably will if the cloture vote succeeds) it will then be tacked onto the House Bill (HR 2397) which probably means another spending conference committee. Many of the same folks will be on that conference as are on the budget conference that is trying to iron out differences between the Senate (read Democrats) and House (Republicans) so that a final 2014 spending bill can be put together.

This move by Reid may signal that there is at least some agreement between the conferees on defense issues.

FirstNet Short Notice Teleconference – 9-5-13

The NTIA published a public meeting notice in Tuesday’s Federal Register (78 FR 54241-54242, available on line Saturday) for a short notice teleconference for the FirstNET Board on September 5^th, 2013. The FirstNet Bylaws allow for a two-day notice for a special meeting and allow the Board to close portions of that meeting by a majority vote.

The notice does not provide a description of the purpose of the meeting, but does note that a copy of the agenda will be posted on the FirstNet web site before the meeting (none currently posted).

The public will be allowed to listen in to the open session deliberations, but only a limited number of lines will be available on a first-come, first-serve basis.

FirstNet Short Notice Teleconference – 6-27-13

The National Telecommunications and Information Administration (NTIA) published a meeting notice in today’s Federal Register (78 FR 38014) concerning a public teleconference that the First Responder Network Authority (FirstNet) Board will be conducting on June 27^th, 2013 at 1:00 pm EDT.

The notice indicates that the agenda for the meeting will be published on the FirstNet website, but there is nothing there as of 6:30 am EDT.

There is nothing in the notice that indicates why this very short notice for a public meeting has been issued. The only thing of current note on the FirstNet web site is the on-going negotiations with Broadband Technology Opportunities Program (BTOP) for spectrum lease agreements.

Personnel wishing to listen to the teleconference may dial in on a limited, first-come, first-serve basis (1 (888) 469-3306 and use passcode “FirstNet”).

NTIA Requests Nominations for FirstNet Board

The National Telecommunications and Information Administration (NTIA) published a notice in Monday’s Federal Register (available on-line Saturday, 78 FR 33072-33073) requesting nominations for three potentially open spots on the FirstNet Board. Four of the initial 12 non-permanent members of the Board were appointed last summer for a one-year term instead of the three-year full term.

The existing Board members that were only appointed for an initial one-year term are listed below. The Secretary of Commerce may re-appoint any, all, or none of these individuals.

• Jeffrey Johnson, Fire Chief (retired); former Chair, State Interoperability Council, State of Oregon; CEO, Western Fire Chiefs Association;

• William Keever, telecommunications executive (retired);

• Susan Swenson, telecommunications/technology executive; and

• Teri Takai, government information technology expert; former CIO, States of Michigan and California

FirstNet Board members are appointed as Federal employees and paid a daily rate of pay of almost $13,000 (at level IV of the Executive Schedule). They may not be registered lobbyists or agents of a foreign government. Conflict of interest rules apply to this position and financial disclosures must be made.

Persons wishing to be considered for these possible appointments should submit the appropriate information to FirstNetBoard@ntia.doc.gov. The notice does provide a snail mail address but notes that “all material sent via the U.S. Postal Service (including “Overnight” or “Express Mail”) is subject to delivery delays of up to two weeks due to mail security procedures” (brings new meaning to ‘snail mail’). Submissions should be made by June 14^th, 2013.

NPPD Announces NSTAC Meeting – 5-22-13

Today the DHS National Protection and Programs Directorate (NPPD) published a meeting notice in the Federal Register (78 FR 28237-28238) concerning an upcoming meeting of the President’s National Security Telecommunications Advisory Committee (NSTAC). Portions of the May 22^nd meeting in Washington, D.C. will be closed to the public.

Agenda

The Committee will receive briefings on:

• The Federal Government's current research and development priorities as they relate to cybersecurity and national security and emergency preparedness (NS/EP) communications;

• The committee's progress regarding its report on secure government communications;

• The progress of the Government's implementation of NSTAC recommendations from the 2012 NSTAC Report to the President on Cloud Computing; and

• Cybersecurity threats (classified/closed).

The agenda also includes Committee discussions about:

• The current implementation status of the national public safety broadband network (NPSBN), including current initiatives underway with the First Network Authority Board;

• The Committee report, NSTAC Report to the President on the National Security and Emergency Preparedness Implications of the Nationwide Public Safety Broadband Network; and

• Future studies based on Government's security priorities and perceived vulnerabilities (classified/closed).

Late Notice

NPPD is seven days shy (the notice says 3-days, but they expected this to be published last Friday) of their legal requirement to normally provide 15-day notice of the meeting of a federal advisory committee. They note that this is “due to the immediate need for NSTAC's members to receive a cyber-threat briefing”. The timing of this notice may indicate that the referenced cyber-threat may have something to do with the energy sector control system threat I mentioned Sunday.

Interestingly, according to the NSTAC web site, the classified portion of this meeting will be held in the White House Situation Room. Either the private sector members of the Committee are being seriously schmoozed, or this briefing is really serious; this is Washington, it could be either.

Public Comments

There will be a 30-minute public comment period midway through the public afternoon session of the meeting. People wishing to make a presentation (limited to 3 minutes) during that period need to contact  Helen Jackson (703-235-5321) by COB on May 15^th (tomorrow???) to assure a place in the cue. Written comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # DHS-2013-0022) though a time machine will be required as they were required to be submitted no later than yesterday.

NTIA Announces FirstNet Board Teleconference – 5-8-13

The National Telecommunications and Information Administration (NTIA) announced in Monday’s Federal Register (78 FR 26323; available on-line today) a teleconference of the Board of the First Responder Network Authority (FirstNet) on May 8^th, 2013. The public is invited to listen to the teleconference, but the notice does include standard verbiage about taking their conversation off-line if it goes into discussions of personnel or confidential financial matters.

There is no agenda included in the notice, but mention is made of the fact that the agenda will be available on the FirstNet web page prior to the meeting.

FCC Publishes FirstNet NPRM

Today the Federal Communications Commission published a notice of proposed rulemaking (NPRM) in the Federal Register (78 FR 24138-24147) to “implement provisions of the Middle Class Tax Relief and Job Creation Act of 2012 (Public Safety Spectrum Act) governing deployment of a nationwide public safety broadband network in the 700 MHz band under a nationwide license issued to the First Responder Network Authority (FirstNet)”.

The NPRM addresses:

• Technical service rules for the new public safety broadband network to be established pursuant to the Public Safety Spectrum Act;

• The Commission's statutory responsibilities as they relate to oversight of FirstNet; and

• The different classes of incumbents now occupying portions of the spectrum licensed to FirstNet.

The FCC is soliciting public comment on this NPRM. Comments need to be submitted by May 24^th, 2013 and replies to submitted comments need to be submitted by June 10^th. There is nothing in the NPRM that tells how the comments/replies are to be submitted beyond giving an email address for the point of contact Gene Fullano (genaro.fullano@fcc.gov). Nor is there any mention of where the public can see the submitted comments in order to prepare replies to those comments.

I have not covered much about the FCC’s work over the years, but I have to say that this is the worst written, least informative NPRM that I have ever reviewed. There are extensive changes proposed to 47 CFR parts 1, 2, 27 and 90, but nowhere is there a coherent description of what those changes entail or what the FCC is specifically attempting to do with those changes.  

NTIA Announces FirstNet Board Meeting – 06-04-13

The National Telecommunications and Information Administration (NTIA) published a meeting notice in today’s Federal Register (78 FR 20619) announcing that the First Responder Network Authority (FirstNet) Board would be meeting in Westminster, CO on June 4^th. The agenda for this public meeting has not yet been published, but it will be posted on the FirstNet web site before the meeting.

The NTIA has kind of a weird take on the term ‘public meeting’; the notice states that:

“Given the space limitations of the meeting room, members of the public wishing to attend the meeting in person will be directed to the Westminster Ballroom at the Westin Westminster Hotel, 10600 Westminster Boulevard, Westminster, Colorado 80020, where they can observe the meeting by video.” (78 FR 20619)

Since the meeting will also be web cast; details will be posted at some later date on the FirstNet web site, I suppose there doesn’t seem to be much reason to actually go to Westminster.

Congressional Hearings – Week of 3-10-13

Both houses in town again this week and maybe the weather will be nice enough for the House to stay the week. Nothing on the Senate side currently scheduled, but we are expecting the Appropriations Committee to have their amendment (either a new bill or amendment language) for the House appropriations bill (HR 933) passed last week, but that’s all being done behind the curtain. The House has a number of hearings of specific or probable interest to the chemical and cyber communities, including CFATS and cybersecurity.

CFATS

The Environment and the Economy Subcommittee of the House Energy and Commerce Committee will hold their periodic progress update hearing on CFATS on Thursday. No witness list has yet been posted, though we can expect at least one panel consisting of Under Secretary Beers and ISCD Director Wulf. There may be an industry panel as well.

Readers should remember, I’ve mentioned it enough times, that the last time this hearing was held in September, Beers promised Chairman Shimkus (R,IL) that the new CFATS Personnel Surety Program 60-day ICR notice would be published in the Federal Register within 30-days. It has been just about six months and Shimkus is sure to remind Beers about the failed promise.

I suspect that there will also be questions about how CFATS will deal with the President’s cybersecurity executive order. It is clearly one of the regulatory programs that could be modified fairly easily to implement the Framework being developed by NIST.

Cybersecurity

There are going to be two cybersecurity hearings this week, one before the House Homeland Security Committee (postponed from last week due to snowmaggedon) and a different look from the House Judiciary Committee.

The Subcommittee on Crime, Terrorism and Homeland Security and Investigations (quite a wide area of responsibility) will hold a hearing on Wednesday looking at “Investigating and Prosecuting 21st Century Cyber Threats”. No witness list is yet available, but I suspect that we will see the FBI and Justice Department represented before the Subcommittee at the very least.

TSA

The Transportation Security Subcommittee of the House Homeland Security Committee will hold a hearing on Thursday to look at “TSA’s Efforts to Advance Risk-Based Security”. No witness list has been announced. As usual this will focus primarily on passenger air transportation and I wouldn’t be surprised to hear questions on the effects of sequestration on passenger screening. There is always the remote possibility that there will be some discussion of surface transportation security, but that would certainly also focus on passenger transportation security issues. Who cares about hazardous chemical rolling around the country?

FirstNet

The Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold an oversight hearing on Thursday for the First Responder Network Authority (FirstNet) and Emergency Communications. Again no witness list has been published. I would love to hear some questions about the inclusion in the FirstNet of private sector security and response personnel looking after critical infrastructure. Probably not though; why would they need to communicate with first responders since they are already on the scene when the first responders get there?