Review - HR 2931 Introduced – Enhancing Grid Security

Back in March Rep McNerney (D,CA) introduced HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act. The bill would require the Department of Energy (DOE) to establish a voluntary security program for electric utilities and provide a report to Congress on cybersecurity of electricity distribution systems. Similar bills have been introduced and passed in the House back through the 115^th Congress (See HR 5240 in the 115^th Congress)

NOTE: This bill was reviewed using a Committee Print, the GPO has not yet printed an official copy of the bill.

Moving Forward

Last Thursday, the House Energy and Commerce Committee held a markup hearing that included consideration of this bill. It was approved, without amendment, by a voice vote. This indicates that this bill, like the similar bills in the last two congresses, has strong bipartisan support. The bill will be considered in the full House under the suspension of the rules process. This means that there will be limited debate, no floor amendments and the bill will require a supermajority to pass. The bill will likely pass with strong bipartisan support.

Commentary

This bill is job justification legislation. Congresscritters want to get reelected, so they demonstrate that they take action to solve problems. This bill is designed to do just that. DOE is already doing most of what is required in this bill. That is why no funding authorization is needed in the bill, funds have already been allocated for these activities.

For a more detailed look at the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2931-introduced (subscription required)

House Amends and Approves HR 4447 – Energy Bill

Yesterday the House completed their second day of deliberations on HR 4447, the revised and expanded version of the Expanding Access to Sustainable Energy Act of 2019. The amended bill passed by a largely partisan vote of 220 to 185 (18 Democrats voting Nay, 7 Republicans voting Yeah). The bill included grid cybersecurity provisions taken in large part from HR 5760.

The one cybersecurity related amendment that was considered, Amendment 12, offered by Rep. Burgess (R,TX) was included as part of en bloc #3. It would have required DOE to “report to Congress on the effect of variable and distributed energy resources on the reliability of the electric grid, specifically pertaining to natural disasters and physical or cyber-attacks on the grid infrastructure” {H Rept 116-528 pg 7; text of amendment at page 56}. The six amendments considered in that vote failed by a voice vote.

With the bill passing on party lines, it is extremely unlikely that it will be taken up by the Senate.

House to Consider Amended Version of HR 4447 – Grid Cybersecurity Additions

 The House Rules Committee approved a substitute language amendment for HR 4447, the Expanding Access to Sustainable Energy Act of 2019, today. The new language is a greatly expanded version of the bill that was approved by the House Energy and Commerce Committee on September 9^th. What was a 10 page bill reported by the Committee will be an 894 page bill that will be debated and amended on the floor of the House later this week. The new pages include, among a lot of other things, some minor grid cybersecurity provisions.

Cybersecurity Additions

Among the additions to the bill is Title V, Subtitle C, Part 3, Grid Security Research and Development. The new Part 3 includes three sections:

§5341. Amendment to Energy Independence and Security Act of 2007.

§5342. Critical infrastructure research and construction.

§5343. Conforming amendment.

Section 5341 is very similar to a provision in HR 5760 that would have required DOE to carry out “a research, development, and demonstration program to protect the electric grid and energy systems, including assets connected to the distribution grid, from cyber and physical attacks” {new §1313(a)}.

One apparently minor difference between the different versions of the proposed amendment to EISA is found in outline of research areas of interest to be funded by the new research program in the new paragraph (b)(1). In the reported version of the bill it says:

“identify cybersecurity risks to the electricity sector, energy systems, and energy infrastructure;”

In the substitute language it was changed to read:

“identify cybersecurity risks to information systems within, and impacting, [emphasis added] the electricity sector, energy systems, and energy infrastructure;”

This actually brings the language more in line with the frequent references in the remainder of the sub-paragraph in both versions to ‘information systems’.

Section 5341 would also add the following sections to the EISA (similar to sections added by 5760)

§1314. Grid resilience and emergency response,

§1315. Best practices and guidance documents for energy sector cybersecurity research,

§1316. Vulnerability testing and technical assistance to improve cybersecurity,

§1317. Education and workforce training research and standards,

§1318. Interagency coordination and strategic plan for energy sector cybersecurity research,

§1319. Report to congress, and

§1320. Definitions.

Finally §5241 ends by authorizing appropriations for the program outlined in the section at the same levels as HR 5760 would have authorized.

Section 5342 is very similar to the provisions an amendment that was made in Committee to HR 5760. It would require DOE to “establish and operate an Energy Sector Critical Infrastructure Test Facility” {§5342(c)}.

Section 5343 is a housekeeping amendment adding the new provisions of the EISA table of contents.

Amendments Authorized

The Rules Committee adopted a rule for the consideration of this bill (and two others) that allows for limited debate and approved amendments to be submitted from the floor. There has only been one cybersecurity related amendment that has been authorized to be offered on the floor of the House:

12. Burgess (TX): Requires the Secretary of Energy to report to Congress on the effect of variable and distributed energy resources on the reliability of the electric grid, specifically pertaining to natural disasters and physical or cyber-attacks on the grid infrastructure. (10 minutes)

Committee Hearings – Week of 07-07-19

With both the House and Senate back in Washington after their 4^th of July recess there is a relatively light committee hearing schedule. Only two hearings of interest here; one on grid cybersecurity and a Rules Committee hearing on the House version of the NDAA.

Grid Cybersecurity

On Friday, the Energy Subcommittee of the House Energy and Commerce Committee will hold a hearing on “Keeping The Lights On: Addressing Cyber Threats To The Grid”. The witness list is not yet available.

HR 2500 Rule

On Tuesday the House Rules Committee will meet to consider HR 2500, the FY 2020 National Defense Authorization Act. To date, a total of 658 amendments have been submitted to the Committee for consideration. This hearing will determine which of those amendments will be considered on the Floor of the House.

The bill is currently scheduled to be considered on the floor starting on Wednesday with a final vote likely on Friday.

NOTE: While there had been some talk about including the DHS appropriations bill (still not published by the House Appropriations Committee) in this bill as a way to move that forward, it does not look like that will happen.

Bills Introduced – 01-09-19

Yesterday with both the House and Senate in session there were 89 bills introduced. Of these, three bills will likely receive future mention in this blog:

HR 359 To provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes. Rep. McNerney, Jerry [D-CA-9]

HR 360 To require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes. Rep. Latta, Robert E. [R-OH-5] 

HR 370 To require the Secretary of Energy to carry out a program relating to physical security and cybersecurity for pipelines and liquefied natural gas facilities. Rep. Upton, Fred [R-MI-6] 

Bills Also Worth Mentioning

I am also going to call attention here to six other bills here that would attempt to mitigate the effects of the current Federal Funding Fiasco. I will briefly discuss these bills in this post and will probably not mention them again in this blog.

HR 367 Making appropriations for Coast Guard pay in the event an appropriations Act expires before the enactment of a new appropriations Act. Rep. DeFazio, Peter A. [D-OR-4]

HR 371 Making appropriations for certain Federal employees working during the Government shutdown beginning on or about December 22, 2018, and for other purposes. Rep. Biggs, Andy [R-AZ-5]

HR 374 To make continuing appropriations for Coast Guard pay in the event that appropriations for Coast Guard pay in fiscal year 2019 expire and a new appropriations Act has not been enacted. Rep. Byrne, Bradley [R-AL-1]

HR 419 To make continuing appropriations for the Federal Aviation Administration for fiscal year 2019. Rep. Van Drew, Jefferson [D-NJ-2]

HR 421 Making continuing appropriations for the Coast Guard. Rep. Wild, Susan [D-PA-7] 

S 72 A bill to suspend the enforcement of certain civil liabilities of Federal employees and contractors during a lapse in appropriations, and for other purposes.  Sen. Schatz, Brian [D-HI]

FFF Effect Mitigation

As we quickly approach the 21-day FFF record it is interesting to note the efforts by a wide variety of congresscritters to protect various agencies and employees of the Federal government from the effects of the FFF. At first glance it would seem that these efforts are commendable as they would reduce the suffering of employees who are, after all, bearing the direct brunt of this political foofaraw.

On the other hand, and there is ALWAYS an ‘other hand’ when it comes to politics, I think that these efforts are misguided. While reducing the pain and suffering of these employees would be great for them and their families, it would also serve to reduce the political price for shutting down the government (or portions thereof) and make future shutdowns more likely.

On the first Tuesday in November, 2020, the voters of this country will remember this little game of political hostage taking. The hardcore supporters of both the President and the Democratic leadership of Congress will probably reward them for their intransience, but the vast majority of folks in the center will take revenge for those hurt during this FFF. They will go into the voting booth having decided who was mainly at fault (both sides share at least some portion of the blame) and will vote for their political retirement.

That is as it should be, there should be a high price to pay for using the disruption of the government as a political tool. Unfortunately, any measures taken to reduce the impact of that disruption will lesson the anger of the electorate and thus reduce the price to be paid for this game of political one-up-man-ship.  That could have the unintended consequence of extending the length of the current FFF and increase the chance of a repeat performance in FY 2020.

Committee Hearings – Week of 3-26-17

This week both the House and Senate will be in session. There are a number of committee hearings that will be held on both sides of the Capitol, but there is only one, a cybersecurity hearing, that may be of specific interest to readers of this blog.

On Tuesday the Energy Subcommittee of the Senate Energy and Natural Resources Committee will be holding a hearing to look at cybersecurity threats to the US electric grid. The hearing will also receive testimony on S 79, the Securing Energy Infrastructure Act. The witness list includes:

• Michael Bardee, Federal Energy Regulatory Commission;

• John DiStasio, Large Public Power Council;

• Thomas Zacharia, Oak Ridge National Laboratory; and

• Ben Fowke III, Xcel Energy