GAO Publishes Grid Resiliency Overview

This week the Government Accountability Office published a report on “Electricity Grid Resilience”. This is a brief, 2-page, overview of recent GAO reports on the topic. It does highlight previous GAO recommendations that have not yet been implemented. Includes discussion of cybersecurity and physical security risks.

I will not be covering HR 2885 – Grid Resilience Grants

A frequent feature of this blog is the Bills Introduced post. For each day that either the House or Senate is in session Congress.gov publishes, generally the next day, a listing of the bills that were introduced. I look at the brief descriptions of those bills and make a preliminary determination of whether the bills address a topic that I will be covering here in this blog. If it is, I make a brief announcement of the fact in a ‘Bills Introduced’ post for that day.

I did one of those posts for April 28^th, 2021. In that post I listed five bills that I might be covering, including HR 2885:

"HR 2885 To require the Secretary of Energy to establish an electric grid resilience grant program and an electric grid resilience research and development program. Rep. Johnson, Eddie Bernice [D-TX-30] ."

I listed that bill based upon the description provided above since cybersecurity is increasingly becoming a resiliency issue. For HR 2885 I noted:

“I will be watching HR 2885 for language and definitions that would include cybersecurity in the grid resilience programs; probably will not be any.”

Once the bill is actually printed, increasingly months later, I make a determination of whether or not I will be covering the bill, generally based upon the criteria that I list in the Bills Introduced post. If the bill does not meet those self-imposed criteria, I just generally never mention it again. Every once-in-a-while, however, I just have to mention a bill that I will not be covering in this blog. Yesterday, the text for HR 2885 was printed and it contained a provision that I just have to mention.

HR 2885 establishes both a grid-resilience grant program and a grid-resilience research and development program. As I expected, there is no language in the bill that includes cybersecurity in either program. What I did not expect to see, however, was specific language in the bill that prohibited the use of funds in the grant program from being used for cybersecurity purposes. But, there it is in §2(c)(2)(ii), under ‘prohibited uses’, cybersecurity.

Now, I understand that this bill is trying to address resiliency issues related to extreme weather events. That is clearly spelled out in §2(c)(1). And cybersecurity is clearly not specifically related to extreme weather events, again, I understand that. What I do not understand is why Rep Johnson (D,TX) felt it necessary to specifically spell out that cybersecurity expenditures were not covered by the grant program.

But, my understanding is not necessary. What I do understand is that this will be the last mention of HR 2885 in my blog. Weather resiliency of the grid is just not a topic that I intend on covering at this time. But Johnson had to specifically exclude cybersecurity issues so I had to specifically exclude her bill.

Committee Hearings – Week of 04-10-16

Both the House and Senate will be in Washington this week. The House Appropriations Committee is starting the hearing process for the appropriations bills in earnest; we should start to see those bills in the next couple of weeks. There are only three hearings of specific interest to readers of this blog this week and they all are related (potentially at least) to cybersecurity.

NHTSA Oversight

The Commerce, Manufacturing and Trade Subcommittee of the House Energy and Commerce Committee will be holding an oversight hearing of the National Highway Traffic Safety Administration (NHTSA) on Thursday. There are lots of topics of congressional interest for this agency and cybersecurity issues are linked to many of them. I would expect to hear questions about automotive cybersecurity, vehicle-to-vehicle and vehicle-to-infrastructure communications, and the autonomous vehicle program.

There is not witness list published yet, but these oversight hearings are typically the Administrator and perhaps someone from GAO if that agency has a new report.

Grid Security

The Economic Development, Public Buildings and Emergency Management Subcommittee of the House Transportation and Infrastructure Committee will be holding a hearing on Thursday on “Blackout! Are We Prepared to Manage the Aftermath of a Cyber-Attack or Other Failure of the Electrical Grid?”. There is no witness list available.

Swatting

The last one is not really about cybersecurity, but I’m mentioning it because of its obvious link to Brian Krebs, a well-known cybersecurity investigative reporter. The Communications and Technology Subcommittee of the House Energy and Commerce Committee will be holding a markup hearing on a number of bills. It includes HR 2031, the Anti-Swatting Act of 2015.

Swatting is, of course, the act of making a fake emergency call to law enforcement with the intention of instigating a response by a tactical team at someone’s residence. Brian Krebs was targeted by such an attack because of one of his cybersecurity expose’s.

On the Floor

Nothing of specific interest in the House this week, but I will be continuing to watch the Senate for their continued action on HR 636, the FAA authorization bill. We saw 50+ more amendments last Thursday (all non-cybersecurity related) and I expect that we will see more today and tomorrow. I have not yet seen anything with the potential to hold up final consideration of this bill, but this year you can never tell.

I haven’t heard anything new about the Energy Authorization bill (S 2012) that is still being held up in the Senate because of the Flint water crisis. If a settlement on that disagreement is ever obtained, we could see that bill move to a final vote in a day or two.