Bills Introduced – 4-26-17

Yesterday both the House and Senate were in session. There were 59 bills introduced. Of those, only three may be of specific interest to readers of this blog:

HR 2169 To amend the Homeland Security Act of 2002 to enhance information sharing in the Department of Homeland Security State, Local, and Regional Fusion Center Initiative, and for other purposes. Rep. Katko, John [R-NY-24]

HR 2173 To improve passenger vessel security and safety, and for other purposes. Rep. Matsui, Doris O. [D-CA-6] 

HJ Res 99 Making further continuing appropriations for fiscal year 2017, and for other purposes. Rep. Frelinghuysen, Rodney P. [R-NJ-11]

The first two bills will only be of concern here if they contain specific cybersecurity language.

HJ Res 99 [.PDF text of resolution] is a short term continuing resolution moving the expiration date of the last year’s CR for FY 2017. The new expiration date would be May 5^th, 2017. This provides additional time for Congress and the President to work out a deal to carry spending through until September 30^th. This bill is very short and contains only one minor (pun intended) add-on, so it should be passed by voice votes in both the House and Senate before the Friday night deadline to avoid another shutdown fiasco.

HR 5459 Amended in Committee

Earlier this week the House Homeland Security Committee amended and approved HR 5459, the Cyber Preparedness Act of 2015. The amendment made a number of relatively minor changes to the requirements for sharing cybersecurity information with fusion centers. The most important change was to add a definition of ‘cybersecurity risk’, adopting the language of 6 USC 148(a)(1). As I noted earlier, this definition does not include control systems.

Unfortunately, the way that that definition was added to the bill does not extend that definition to the expansion of authorized expenditures for grants under the Urban Area Security Initiative and State Homeland Security Grant Program. This may be less important than the addition of the definition earlier in the bill because DHS has a certain amount of leeway in how they disperse grants under these programs.

This bill is currently scheduled for consideration under suspension of the rules this Wednesday. It will likely pass with substantial bipartisan support. The big question facing this bill is whether or not it will be taken up by the Senate. This late in the session, it is likely that the only way this bill would come to the floor would be through the unanimous consent process. That would mean that there would be no further chances to amend this bill before it is sent to the President.

HR 5459 Introduced – Cybersecurity Information Sharing

Last month Rep. Donovan (R,NY) introduced HR 5459, the Cyber Preparedness Act of 2016 [Note: there is currently something wrong with this link at the GPO, alternative text of bill here]. The bill makes minor revisions to the Homeland Security Act of 2002 to enhance cybersecurity information sharing.

Fusion Centers and NCCIC

Section 2(1) of the bill would add ‘cybersecurity risk information’ to the list of types of information designated in 6 USC 124h(b)(6) and (b)(8) to be shared with fusion centers by DHS. Additionally, the same ‘cybersecurity risk information’ would be added to the list of types of information in §124h(d)(1) for which DHS would be required to “assist law enforcement agencies and other emergency response providers of State, local, and tribal governments and fusion center personnel in using information within the scope of the information sharing environment”.

Section 2(2) of the bill would amend 6 USC 148 addressing the information sharing responsibilities of the National Cybersecurity and Communications Integration Center (NCCIC). It would add fusion centers to the information sharing requirements of §148(c)(5)(B).

Grants

Section 3 of the bill would amend 6 USC 609 by adding “enhancing cybersecurity, including preparing for and responding to cybersecurity risks and incidents” to the list of permitted uses at §609(a) for which grants under the Urban Area Security Initiative or State Homeland Security Grant Program can be used.

As is fairly typical no additional funding is provided for either grant program.

Moving Forward

Donovan and all three of his cosponsors {McCaul (R,TX), Ratcliffe (R,TX), and Payne (D,NJ)} are influential members of the House Homeland Security Committee. That means that this bill has a good chance of moving forward through the committee review process. In fact, shortly after the bill was introduced, it was approved without amendments by the Emergency Preparedness, Response, and Communications Subcommittee.

There is nothing in this bill that would draw any sort or organized opposition. If the bill makes it to the floor of the House it would almost certainly be approved under the suspension of the rules procedure. The only question is if there is enough interest in the bill to get it to the floor of the House for consideration in the limited time remaining in the session.

Commentary

This is the type of ‘i-dotting and t-crossing’ legislative work that needs to take place to ensure that everyone has the appropriate authority to carry out legislative mandates that have been previously passed. Unfortunately, in this case, problems with the underlying definitions that are critical to the intent of the legislation are not addressed.

In this case we go back to the problem of the definition of ‘cybersecurity risk’. There is no definition of the term in §124h, so we are still left with the lack of any real authority to share cybersecurity risk information within the fusion center environment. In §148 we do have a definition {§148(a)(1)}, but it is one of those definitions that narrowly defines the term just with respect to IT systems. So again, we technically have no authority for the NCCIC to share information about cybersecurity risks that apply uniquely to industrial control systems.

Finally, as I have mentioned numerous times, expanding the allowable uses of federal grant monies is all well and good as long as the amount of available funding is already increased. In cases like the one here in this bill where that money pool is not enlarged, the expansion of the allowable uses has the direct effect of decreasing the money available to the existing list of potential grant uses. This means that grants will either be smaller (and less useful) or fewer grants for exiting programs will be approved. Either may be a perfectly legitimate outcome, but there is no discussion of those consequences when bills like this are discussed.

House Passes HR 3503

This afternoon the House passed HR 3503, the Department of Homeland Security Support to Fusion Centers Act of 2015 by a voice vote. The ‘debate’ lasted just over ten minutes and no amendments were allowed since the bill was considered under suspension of the rules.

The bill will move to the Senate where it will also, if moved to the floor, will be considered with little debate and no amendments.

I would still like to see this bill amended to include an assessment of the need for surface transportation and chemical facility intelligence analysis capability in DHS to support fusion centers, but that is unlikely to happen with this bill.

Bills Introduced – 09-24-15

Yesterday, with both the House and Senate in session for the first time this week, there were 37 bills introduced. Of those three were of potential interest to readers of this blog:

HR 3598 To amend the Homeland Security Act of 2002 to enhance the partnership between the Department of Homeland Security and the National Network of Fusion Centers, and for other purposes. Rep. Barletta, Lou [R-PA-11]

S 2080 A bill to amend title 49, United States Code, to enhance pipeline safety, to provide communities with access to improved information concerning the equipment and operations of pipeline facilities, and for other purposes. Sen. Peters, Gary C. [D-MI]

S Amdt 2680 to HJ Res 61 Making continuing appropriations for the fiscal year ending September 30, 2016, and for other purposes. Sen. Cochran, Thad [R-MS]

It will be interesting to see the differences between HR 3598 and HR 3503 that I reported on earlier this week.

It is interesting that the junior Democrat on the Senate Commerce, Science and Transportation Committee is the author of this pipeline safety bill.

As expected the first continuing resolution amendment to HJ Res 61 failed its cloture vote yesterday. This new version does not contain the Planned Parenthood defunding provisions. A cloture vote is scheduled for Monday evening. This will then go to the House for a vote on Tuesday or Wednesday.

NOTE: Because of DC travel restrictions yesterday for the Pope’s visit the GPO has not yet made the Congressional Record available for Wednesday’s Senate Session. There may be a bills introduced blog post later today for any bills of interest that may have been introduced on Wednesday.

Bills Introduced – 09-11-15

With just the House actually in session yesterday there were only sixteen bills introduced. Two of those may be of specific interest to readers of this blog:

HR 3490 To amend the Homeland Security Act of 2002 to authorize the National Computer Forensics Institute, and for other purposes. Rep. Ratcliffe, John [R-TX-4]

HR 3503 To require an assessment of fusion center personnel needs, and for other purposes. Rep. McSally, Martha [R-AZ-2]

I doubt that HR 3490 will have any specific language for control system forensics, but you never can tell.

With McSally’s interest in emergency response there may be specific language in HR 3503 pertaining to the incorporation of emergency response planners in fusion centers, but I’m not going to hold my breath.

TSA Budget Hearing

The Homeland Security Subcommittee of the House Appropriations Committee held two hearings today on different portions of the DHS budget request for FY 2011. While I did not really expect to hear chemical security issues raised in the prepared testimony for the DHS Intelligence Programs hearing, I was very disappointed to see that the Freight Rail Security Program administered by the TSA was completely ignored in the TSA budget hearing. With the exception of a brief mention of the TWIC program and the minor increase in the number VIPR teams for ground passenger transportation security, the entire testimony of the Acting Administrator was focused on air transportation security issues. Chairman Price did not mention ground transportation security issues at all in his statement opening the hearing.

Chemical Security Intelligence

Last week the Subcommittee on Intelligence, Information Sharing and Terrorism Risk Assessment of the House Homeland Security Committee conducted a hearing on the “Defining a Homeland Security Intelligence Role”. Chairwoman Harmon invited Bart Johnson, Acting Under Secretary, Office of Intelligence and Analysis at DHS to explain what I&A is doing to improve the development and sharing of domestic intelligence information to prevent terrorist attacks on the United States. Unfortunately, little was said about sharing information with private sector players like high-risk chemical facilities. Secretary Johnson did make a number of generic comments about sharing information with the private sector. For example, in discussing the I&A Strategic Vision he noted that: “I&A’s primary customers are clear: the Secretary; state and local fusion centers and state, local, territorial, and tribal authorities; Department components; the private sector; the Intelligence Community (IC); and other federal departments and agencies”. Later in discussing State and Local Fusion Centers he stated that “the key for protecting the Homeland from attack is disseminating useable [sic] intelligence and information to our state, local, tribal and private sector partners, getting similar intelligence and information back from those partners for analytic work by I&A and the IC, and ensuring this two-way exchange happens on a real-time basis”. Fusion Centers Do Not Serve Chemical Facilities From the perspective of the security manager at a high-risk chemical facility there has been little done to provide for that two-way exchange of intelligence information. Information sharing procedures have focused on fusion centers established by State or major urban areas governmental organizations. While security officers may work through these fusion centers that does not assure that that is being done on an individual basis with not inter-facility exchange of information. The problem with the ‘local’ fusion center is that it is not focused on chemical facilities. This means that there is likely no one at the center that is specifically trained to identify threats that are directed against chemical facilities. For example the theft of an IED or chemical weapon precursor chemical may not trigger a warning for facilities that possesses/produce the other precursors needed to make that particular weapon. In fact, a conventional fusion center might not recognize that the report of the theft of thiodiglycol, for instance, was a potential predictor of a terrorist attack. Establish a Chemical Fusion Center What is needed is a chemical specific fusion center; an intelligence collection/analysis/dissemination organization that is targeted on chemical security issues. Actually, DHS already has an organization that is at least half-way there, the team that is administering the CFATS program in the Infrastructure Security and Compliance Division (ISCD). Think about it. They already have an extensive data base of chemical facilities that have significant amounts of one or more potential chemical weapons or precursors for chemical weapons on site; the information came from Top Screen Submissions from over 30,000 chemical facilities. They have point of contact information for responsible personnel at each of those sites. They have a secure web site that they could use to disseminate chemical security intelligence information to high-risk facilities. And those high-risk facilities are already trained and certified in procedures for protecting sensitive information. All that is needed is the addition of a chemical intelligence section to ICSD that would collect and process intelligence of about potential threats to chemical facilities. They would need to be tied into the Fusion Center network to collect and share intelligence information from/with that network. ICSD would have to establish a reporting network for collecting intelligence information directly from high-risk chemical facilities. That network could be based on the CSAT reporting system. That CSAT network could also be used to share information with the high-risk facilities. This is the next logical step in the process of developing a security process for high-risk chemical facilities. Unfortunately, the current CFATS regulations do not address this issue. A significant part of the reason for that is the fact that Congress never made any provisions for an intelligence operation to support chemical facility security. This is another over sight that Congress can correct as it moves forward with the approval process for HR 2868, the Chemical Facility Anti-Terrorism Act of 2009.

Fusion Center and EOC Coordination

Fusion Centers provide for the coordination and dissemination of information that might allow for the prevention of terrorist attacks. Emergency Operations Centers provide for the coordination of law enforcement and emergency response personnel for a wide array of emergency situations including potential terrorist attacks. FEMA recently released a draft Comprehensive Preparedness Guide (CPG) outlining how these two organizations can cooperate to more effectively work together to protect the public. Thanks to HSDL.org I learned about the existence of this draft CPG. It can apparently only be accessed through the International Association of Emergency Managers (IAEM) web site. I have not been able to find the document on either the FEMA web site or the DOJ web site; these being the two agencies that collaborated on producing the document. The IAEM is asking for feedback on the document. I haven’t had a chance to review the 81 page document yet, but I wanted to let everyone know about this since the IAEM is asking for that feedback to be submitted by next Thursday, 9-17-09. I’ll take a more detailed look at the draft of CPG 502, Considerations for Fusion Center and Emergency Operations Center Coordination, over the weekend and comment back if there is anything of specific interest to the chemical security community.

Napolitano Wants Private Sector Involved in Fusion Centers

Last week Secretary Napolitano addressed the Fusion Center Conference in Kansas City, MO. She re-affirmed the importance of the Fusion Centers as information collection, analysis, and sharing organizations. She also told the conferees that these centers should develop the capability for lateral sharing of information amongst the Fusion Centers as well as sharing with elements of the Federal Government. Finally she noted that Fusion Centers needed to have increased private sector involvement. Private Sector Information Flow While Secretary Napolitano mentioned that Fusion Centers should be processing more than just terrorist information, the primary focus of these centers is counter-terrorism. Since many of the potential terrorist targets are privately owned, it seems obvious that the private sector needs to be included in the information sharing aspects of Fusion Centers. Information needs to flow from these centers to facility security managers about changes in the local terrorist threat status. Increased chatter indicating terrorist interest in a state, region or city should result in increased vigilance and counter-surveillance activities at high-risk facilities. That can only happen when the information gets down to the facility level. Likewise, information needs to flow from facility level to the fusion centers. High-risk facilities need to have a direction information submission channel to the local Fusion center. Reports of suspicious activity, apparent surveillance activities, or testing of security measures are all indications of potential future activities. Fusion centers have the capability to draw these reports together and put them together with information from other sources. Private Sector Analysis One of the main objectives of intelligence analysis is to ‘connect the dots’ between disparate pieces of information. For example, the theft of a single drum of a non-hazardous chemical means little. Combine that with the chemical process knowledge that this chemical is a potent polymerization initiator and you have a possible indicator of a sabotage attack on a chemical facility. Further combine that with the disappearance of an empty tank truck from a company known to ship monomers and you have the potential means to execute an attack and the information necessary to identify potential targets. This type technical information is not normally available to law enforcement personnel. The background to evaluate this type information is not included in the development of most intelligence analysts. This is where the private sector can help in the data analysis function. Unfortunately, there is currently no mechanism for getting the information to technically qualified analysts. And this is true for other sectors than just the chemical sector. Each of the 18 critical infrastructure/key resource (CIKR) sectors in the National Infrastructure Protection Plan has a different set of specialized knowledge that would have to be tapped to adequately protect high-risk facilities in that sector. To make matters worse, each of those sectors has a wide variety of specialties with its own knowledge set. It would be nearly impossible to staff each of the fifty odd Fusion Centers with a sufficiently large set of sector analysts to make a significant difference. Sector Fusion Centers Each of the CIKR has its own Sector Coordinating Council (SCC). For example the Chemical Sector Coordinating Council is made up of representatives of eighteen chemical trade associations. The Chemical SCC works with DHS and other Federal Agencies to ensure that the industry security efforts are coordinated with Federal NIPP efforts. Each SCC could form its own Fusion Center. Each center would provide data analysis unique to its sector, supporting State and regional Fusion Centers. It would also provide a unique base for industry specific data analysis supporting conventional intelligence organizations. It would also allow for communication of intelligence information to high-risk facilities within the Sector. The ‘analysts’ would be drawn from companies within the sector. Mid-level managers that have been identified as future security managers would be seconded to the Sector Fusion Center for a period of 12 to 18 months. This would provide them with the training and experience necessary for managing security and intelligence positions within their parent organization. It would also provide them with personal contacts in the intelligence side of the Federal government as well as personal security contacts across the Sector. Congress has a unique chance to establish a sector specific Fusion Center during the re-authorization of CFATS. The Chemical Sector Fusion Center could be authorized in that legislation. It would serve as a test bed for establishing similar fusion centers in each of the 18 CIKR sectors.