Congressional Hearings – Week of 10-10-11

In this holiday shortened week (What, you forgot about Columbus Day?) there are currently four hearings scheduled that might be of interest to the chemical security or cyber security communities; two dealing with emergency response, a DHS authorization hearing, and a small business look at GPS interference.

Emergency Response

There will be two hearings looking at emergency response at the Federal level. Neither will specifically address chemical emergency response, but one can always hope that someone will ask about planning for large scale chemical releases that could result from a terrorist attack on big chemical facility.

The Senate Homeland Security and Governmental Affairs Committee will hold their hearing on Wednesday looking at "The Federal Role in Disaster Recovery and Response." The current witness list only includes representatives from various federal agencies that might be involved in response efforts; including FEMA (obviously), the Army Corps of Engineers, and even the Department of Agriculture. Unfortunately no one from the US EPA has been included; so much for chemical issues.

On Thursday the House Transportation Committee’s Subcommittee on Economic Development, Public Buildings, and Emergency Management will look at cutting the costs of emergency planning and response. Their witness list includes more of a front line look at emergency response with FEMA Administrator Fugate being the only fed testifying. The cost cutting focus does not bode well for the possibility of expanding emergency response planning for chemical incidents.

DHS Authorization

The House Homeland Security Committee will meet on Wednesday to markup HR 3116 the Department of Homeland Security Authorization Act for Fiscal Year 2012. This bill was introduced last week and the text just became available from the GPO this morning. According to the Committee web site there will probably be a substitute language amendment introduced by Chairman King (R,NY). Currently there is no specific mention of CFATS or the Ammonium Nitrate Security Program in the bill.

GPS Interference

Congress continues to look at the potential GPS interference issues associated with the proposed LightSquared broadband system. This time it will be the House Small Business Committee that will look at the GPS interference effects on small businesses. The current witness list includes representatives from airports, ag retailers, and aircraft electronics industries. Again, it doesn’t look like anyone is interested in the potential effects on control system timing issues.

Congressional Hearings: Week of 09-06-11

Congress comes back from their summer recess this week, the Senate on Tuesday and the House on Wednesday. With less than a month until the start of FY 2012 and no spending bills passed, Congress has its work cut out for the month. There are only three hearings currently scheduled dealing with issues of concern to the chemical or cyber security communities; two spending hearings and a replay of a hearing originally scheduled before the break.

DHS Spending Bill

The House passed their version of the DHS spending bill, HR 2017, back in June and the Senate has yet to publish their version of the bill that will be substituted for the House version on the Senate floor. This is one of those silly things that the Founding Fathers inadvertently started when they required that the House initiate any spending bills.

The Homeland Security Subcommittee of Senate Appropriations Committee will be meeting Tuesday to mark up their, as of yet unnumbered, version of the Senate bill. The full Committee will meet the next day to place their mark on the bill as well as two other spending bills. Since the Senate has not produced a DHS spending bill in two years, it is a little difficult to guess how well this abbreviated process will work. Of course, we can expect that the committee staff has been working the bugs out while the Senators were back home.

GPS Interference

The House Science, Space and Technology Committee will be holding the hearing that was originally scheduled for August 3^rd dealing with the impacts of the Lightsquared Network on federal science activities.

As I noted in my blog about the original hearing, this will be focusing on federal R&D efforts so it may be a bit of a reach to hope that it might address the ICS timing issues that might be impacted by the GPS interference that has been reported to be associated with the design of this new broadband network. Mr. Anthony Russo, the Director of the National Coordination Office for Space-Based Positioning, Navigation, and Timing, might provide some insight into the effects of the interference on the timing services. If it’s not mentioned in his prepared testimony, I doubt that anyone will ask questions about this issue.

HR 2838 Introduced – CG Authorization

Yesterday, during the pro forma session of the House, Rep. LoBiondo (R,NJ), introduced HR 2838, the Coast Guard and Maritime Transportation Act of 2011. LoBiondo is the Chair of the Coast Guard & Maritime Transportation Subcommittee of the House Transportation and Infrastructure Committee.

This proposed legislation is a significant deviation from the recent history of authorization bills in that it does not introduce a large number of new programs and responsibilities for the covered organization. The bill does include a new policy on sexual harassment/violence {§202} and it does call for an assessment to be made on “the need for additional Coast Guard prevention and response capability in the high latitude regions” {§308}. These and a few other new requirements form a really modest set of mandates for the Coast Guard.

No mention is made of the Maritime Transportation Security Act or any of its components.

GPS Interference

There is an interesting provision that the Federal Communications Commission and Lightspeed may find disconcerting. Section 302 of the bill would make it a Class E Felony to “knowingly and willfully operate[s] a device that interferes with the broadcast or reception of a radio, microwave, or other signal (including a signal from a global positioning system) transmitted, retransmitted, or augmented by the Coast Guard for the purpose of maritime safety”.

Where the appropriations committees have been requiring reports from various agencies on the reports of GPS interference by the proposed new broadband communications system from Lightspeed, Chairman LoBiondo appears to be trying to do something about it. It remains to be seen how liberal (excuse me for mentioning ‘liberal’ and ‘LoBiondo in the same paragraph) he expects the term ‘maritime safety’ to extend. Would it cover, for instance, control systems at portside chemical facilities?

Authorization Bill a Priority

According to the Subcommittee web site, passing a Coast Guard Authorization Bill is a priority for Chairman LoBiondo. We’ll have to watch how quickly it progresses in the next couple of weeks to see how much of a priority it really is. Of course, this bill will have to be reconciled with the desires of Chairman Rockefeller of the Senate Commerce, Science and Transportation Committee.

Congressional Hearings Week of 8-1-11

In a week dominated by economic news there aren’t a lot of Congressional hearings scheduled. There is one, however, that could potentially be of interest to the cyber security community; a detailed Congressional look at GPS interference by the proposed new LightSquared cell phone network.

The House Science, Space and Technology Committee will hold their look at the problem on Wednesday. Their focus will be on how the potential GPS interference will impact ‘federal science activities’. Five of the six witnesses represent a variety of federal agencies. The sixth witness is from the Space Policy Institute at George Washington University.

It’s odd that there is no one from the FCC scheduled to appear before the Committee; they are the agency that will make the final decision about what is going to be done about the problem. I can’t understand why they aren’t being grilled.

This is an R&D oriented hearing so I suppose that it isn’t surprising that there is no one from ICS-CERT included on the panel. Still, I’m disappointed that this technically oriented panel doesn’t have anyone on board that is qualified to talk about the potential effects of GPS interference control system operations.

There is one possible exception; Mr. Anthony Russo, Director, The National Coordination Office for Space-Based Positioning, Navigation, and Timing. Since the potential ICS effects are based upon their use of the GPS timing signals, his office may have some knowledge about the problem. It will be interesting to see if this is mentioned in his prepared testimony. I’ll be surprised if there are any questions asked about ICS interference.

S 1253 Introduced – FY 2012 National Defense Authorization Bill

Last week Sen. Levin (D, MI) introduced S 1253, the National Defense Authorization Act for Fiscal Year 2012. It provides authority for appropriations for fiscal year 2012 for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy, to prescribe military personnel strengths. The bill contains a number of cyber security provisions.

GPS Interference

The Senate Armed Services Committee has concerns about the same GPS interference issue that I have discussed on a number of occasions. Sec 913 of this bill addresses this issue by requiring DOD to conduct an ongoing review to “determine if commercial communications services are causing or will cause widespread or harmful interference with national security Global Positioning System receivers” {§913(b)(2)}. If and when DOD determines that interference is or may be occurring, then DOD is required to ‘promptly’ submit a report to Congress on the situation.

Detecting Cyber Attacks

Section 931 of the bill addresses the problem of detecting new forms of cyber attacks; for example new worms and viruses for which there are no anti-virus signatures available to allow AV software to detect the attack. Specifically, the Committee is looking for DOD to obtain the capability to “enable well-trained analysts to discover the sophisticated attacks conducted by nation-state adversaries that are categorized as ‘advanced persistent threats’” {§931(b)(1)(a)}.

The legislation envisions DOD seeking this capability to be acquired from commercial sources if possible. Specifically it requires that:

“In making decisions on the procurement of such capabilities from among competing commercial and Government providers, the Secretary shall take into consideration the needs of other departments and agencies of the Federal Government, State and local governments, and critical infrastructure owned and operated by the private sector for unclassified, affordable, and sustainable commercial solutions.” {§931(b)(2)}

WIKI Leaks Prevention

Section 932 requires the Secretary of Defense to support an expanded information sharing program while providing for “the adoption and improvement of technical and procedural capabilities to detect and prevent personnel without authorization from acquiring and exporting information from classified networks” {§932(a)}. This would help to prevent the occurrence of future ‘WIKI Leaks’.

The Committee envisions a wide range of activities to be included in this effort {§932(b)} including:

• Disabling ‘removable media ports of computers’;

• Requiring system administrator approval of downloads on computers where such ports are necessary;

• Electronic monitoring and reporting of downloading to removable media;

• Public-key identity authentication to control information access;

• Electronic auditing and reporting of user activity;

• Using ‘data-loss prevention’ and ‘data-rights management’ to prevent unauthorized data export; and

• Integrating all of the above to “enable efficient management and operations, and effective protection of information, without impairing the work of analysts and users of networks” {§932(b)(7)}.

Cyberspace Experts

No authorization bill would be complete without any number of mandated studies. Section 1076 of this bill requires the conduct of a manpower study that will look at the “availability of military and civilian personnel for Department of Defense defensive and offensive cyberspace operations, identifying any gaps in meeting personnel needs, and recommending available mechanisms to fill such gaps, including permanent and temporary positions” {§1076(a)}.

In addition to the requisite look at ‘various recruiting, training, and affiliation mechanisms’ that may be used to address the manpower situation, probably the most valuable part of the study will be the requirement to look at “the availability of personnel with expertise in matters related to cyberspace operations from outside of the Department of Defense” {§1076(b)(2)(B)}. Properly done, this could provide a good snapshot of the current status of cybersecurity personnel.

Control Systems Not Addressed

As one would expect, there is nothing in this bill that specifically addresses industrial control system security. On the other hand, all of the areas addressed above could have significant impacts down the road on ICS security activities.

As is usual with major legislation like this, we might expect to see additional policy areas and reporting requirements in the Committee Report that accompanies this legislation. I’ll look at that document in a separate blog posting.

HR 1540 Passes in House

This afternoon the House passed HR 1540, the National Defense Authorization Act for Fiscal Year 2012 by a recorded vote of 322 to 96; a margin that must be counted as ‘bipartisan’. The bill was heavily amended, so the bill looks quite different than when it was approved by the House Armed Services Committee.

Amendment Results

I have been watching two particular amendments that could be of potential interest to the chemical security community; one dealing with cyber security, and the other dealing with GPS interference. Yesterday the Langevin (D, RI) cyber security amendment failed on voice vote and that ‘failure’ was confirmed this afternoon by a recorded vote of 172 to 246. While this isn’t technically the death of HR 1136 (the bill from which this amendment was extracted as nearly whole cloth), the vote almost ensures that no committee will take any time considering this legislation.

The Turner (R, OH) amendment was grouped into an ‘en bloc’ amendment with 10 other less than controversial amendments for a single period of debate and a single vote. It was the sixth such en bloc amendment considered today in an effort to speed up the processing of this bill on the House Floor. As is typical with en bloc amendments this passed by a voice vote.

Senate Action

Interestingly this bill is being sent to the Senate on the same day that the Government Printing Office (GPO) finally got around to printing a similar bill produced by the Senate Armed Services Committee; S 981, the National Defense Authorization Act for Fiscal Year 2012. Typically we would expect the Senate to substitute the language of S 981 for the House passed language of HR 1540. The differences would then get worked out in Conference.

I haven’t had a chance to peruse S 981 yet, but rest assured I’ll be looking for cyber security language in that bill.

First House Floor Vote on Cyber Security

Last night, during the debate on HR 1540, the National Defense Authorization Act for Fiscal Year 2012, one of the measures that was debated and voted upon was an amendment offered by Rep. Langevin (D, RI) that specifically dealt with cyber security issues; making it the first time this session that the whole House has taken a vote on a cyber security measure.

HR 1136

Looking at the actual language for Amendment #49, found in House Report 112-88 (the report accompanying H. Res 276, the rule governing the debate of HR 1540), it turns out that this ‘Amendment’ was actually a virtual copy of HR 1136, the Executive Cyberspace Coordination Act of 2011, a bill introduced by Langevin back in March. As I noted in a blog about the bill when it was introduced, this bill was essentially an IT security bill dealing mainly with Federal cyber security. There was a section on ‘critical infrastructure’ that actually mentioned SCADA systems, but there were no real ICS cybersecurity requirements.

After the authorized 10 minutes of debate on the amendment the House voted it down on a voice vote. A recorded vote was ‘demanded’ by Rep. Langevin. As of 11:00 pm EDT last night that vote had not yet occurred. In bills with these lengthy debates and amendment processes (152 amendments were offered on this bill) the House pulls a bunch of these recorded votes together to minimize the time the Members actually have to spend on the floor of the House. A vote will be held sometime today.

This vote on a virtual copy of HR 1136 does not mean that this bill is legally dead. It is technically possible that the bill could still wend its way through the committee review and voting process to make its way back to the floor of the House. Possible but unlikely, otherwise Langevin would not have taken this to the floor as an amendment to a virtually unrelated bill; controversial amendments like this seldom pass as an amendment.

GPS Interference

Earlier this week in a blog posting about this bill I discussed the provisions of HR 1540 dealing with the GPS interference controversy. In that I dismissed an amendment by Rep. Turner (R, OH) modifying provisions of §911 of the bill dealing with the FCC’s approval of the new cell phone service by LightSpeed. That was based upon the summary of the amendment that described it as a ‘Sense of Congress’ measure. The actual amendment was published in the House Rules Committee report and it is a tad bit more potent than a ‘Sense of Congress’ measure.

The language of the Turner Amendment would actually prohibit the FCC from providing final approval of the LightSpeed license “until the Commission has resolved concerns of widespread harmful interference by such commercial terrestrial operations to the Global Positioning System devices of the Department of Defense.” {§911(a)}. This would be a much more effective response than what I had described.

Unfortunately, this still does not address the potential for interference with GPS timing signals used by some control system components. No one has actually reported interference problems with the timing signals, but I have found no reports that anyone has bothered testing this issue.

Turner’s amendment is #149 in the list of amendments to be debated on the floor during the consideration of this bill, so it will be one of the last ones considered. It will probably come up for a vote late this evening. It will be interesting to see how this vote turns out.

Continued Debate

I don’t know how long the House continued their debate of this bill last night. They will be back at it again when the come back to work today. A final vote on the bill will certainly be held before the House goes home for the long Memorial Day Weekend. The final version of the bill will almost certainly pass, probably with bipartisan support.

More on GPS Interference

Yesterday while I was perusing the House Armed Services Committee’s report on HR 1540 looking for cyber security related provisions, I came across an interesting discussion (pgs 182-4) about the GPS interference that I reported on this weekend. The discussion is providing a Committee explanation of a provision of the revised version of HR 1540 that is currently being considered by the House Rules Committee in drafting its rule for the consideration of the bill on the floor of the House this week.

The military and a number of other agencies of the Federal government have expressed some concerns about the FCC’s potential approval of the new cell phone service license being sought by LightSpeed. The provision in HR 1540 (§911, Title IX, Subtitle B) would require DOD to report to Congress when it determines that a ‘commercial communications service’ will cause or is causing widespread ‘harmful interference’ with the GPS receivers of DOD. Presumably, then the Congress would react to stop that interference.

According to this discussion the FCC gave conditional approval to LightSpeed in January of this year pending final resolution of the ‘interference’ issue. It also notes that the FCC is scheduled to make their final determination on June 15th. There is a chance that this bill could become law before that date, but it wouldn’t have any direct effect on the FCC’s decision even if it did, it would just require DOD to prepare a report to Congress.

It is disappointing that the discussion says nothing about the potential affect of this interference with control systems. It does mention, in passing, that there is the potential for interference with timing services. That is the portion of this issue that could be of concern to some control systems engineers and is lumped in with “myriad commercial applications”.(pg 183) in the list of areas potentially affected.

One of the amendments being considered by the Rules Committee would take this issue one very small step forward. Rep. Turner (R, OH) has offered an amendment (#76) to HR 1540 that express the ‘Sense of Congress’ that “any commercial communications that interferes with the Global Positioning System (GPS) should not receive final authorization by the Federal Communications Commission until the potential interference with GPS is resolved”. A ‘Sense of Congress’ resolution has no legal effect on Federal agencies.

We’ll have to wait and see if this amendment (as effective as it is) makes it to the short list of amendments that the Rules Committee will allow to be considered during the floor debate. The Rule Committee hearing from yesterday evening is continuing this afternoon.

A Permanent GPS Timing Outage?

Remember the late alerts from DHS ICS-CERT last month (see my posts of 01-25-11 and 01-26-11) about the tests being conducted by the Air Force that might (but it turned out not really) affect the timing signals for certain SCADA devices? Well, according to an article at AVWeb.com there might be an even more serious problem when a new 4G Broadband Network by LightSquared goes online later this year.

According to the article, the GPS industry claims that the L Band frequencies approved by the FCC for the LightSquared project (1525 MHz—1559 MHz) are very close to the frequencies being used by the GPS system (1559—1610 MHz). Apparently at least one GPS device (a Garmin 430) looses its GPS fix within about 5 miles of a 4G transmitter on the nearby approved frequencies.

LightSquared reportedly disputes the potential of problems with ‘properly filtered’ GPS devices, but is required by the FCC to test devices against their actual transmission system. That testing is supposed to be done by the end of June. Nothing in the article indicates that there are any plans for testing ICS devices that use GPS signals for timing purposes.

Hmmm. It would sure be nice to hear that ICS-CERT was getting involved in this testing issue before the end of June. Or, are we going to have to wait to see an ICS-CERT alert that there are reported problems with ICS outages because of unidentified transmitters near facilities?

Once again this is a demonstration of the potential problems that arise when someone develops an unauthorized (not illegal, just not specifically authorized) usage of a ‘free’ resource like the GPS timing signal. Since no one (read FCC) officially knows of the usage, they are under no requirement to take that usage into account when making official decisions affecting that resource.

As the RF spectrum is getting more and more crowded because of the new communications devices being used, how many more frequency interference issues will be affecting ICS devices? Have all of these devices been ‘properly filtered’ to avoid interference from transmitters on nearby frequencies? Has anyone bothered to do the necessary testing to determine how much of a problem this could be?