Review - HR 3684 Passed in House – FY 2022 Infrastructure Bill

Last Friday the House finally got around to passing HR 3684, the Infrastructure Investment and Jobs Act, by a slightly bipartisan vote of 228 to 206. With the complexity of the bill and the large amounts of money involved, this is a good time to re-look at the cybersecurity provisions in the bill.

The bill includes language from six separate pieces of cybersecurity legislation.

S 914, the Drinking Water and Wastewater Infrastructure Act of 2021, in §50113,

S 1316, the Cyber Response and Recovery Act of 2021, in §70601,

S 1400, the PROTECT Act of 2021, in §40123,

S 2199, the Cyber Sense Act of 2020, in §40122,

S 2585, the State and Local Cybersecurity Improvement Act, in §70611, and

HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act, in §40121.

It also contains two new standalone cybersecurity provisions in the Energy Division of the bill. Additional (over the current annual spending) cybersecurity spending is authorized for four agencies of the federal government. Finally, there are 23 separate instances where cybersecurity mentions are made in other provisions of the bill

For more details about those provisions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-3684-passed-in-house - subscription required.

 

Committee Hearings – Week of 7-18-21

This week with both the House and Senate meeting in Washington, there will be a full slate of committee hearings. Hearings of interest include the markup of the Senate version of the FY 2022 National Defense Authorization Act, three cybersecurity hearings and the start of the consideration process for FY 2022 spending bills. And we will have an interesting slate of cybersecurity legislation being considered on the floor of the House.

NDAA Markup in Senate

The Senate Armed Services Committee will be marking up their version of the FY 2022 NDAA. Each subcommittee will be meeting to markup their portions of the NDAA on Monday and Tuesday. Then the full Committee will meet Wednesday and probably Thursday to complete the markup process. The subcommittee markups of interest here include:

• Monday - Subcommittee on Cybersecurity. CLOSED

• Tuesday - Subcommittee on Emerging Threats and Capabilities. CLOSED.

Cybersecurity Hearings

On Tuesday the House Small Business Committee will be holding a hearing on “Strengthening the Cybersecurity Posture of America’s Small Business Community”. This hearing is unlikely to specifically address control system security issues. The witness list will include:

• Tasha Cornish, Cybersecurity Association of Maryland, Inc.,

• Sharon Nichols, Mississippi Small Business Development Center,

• Kiersten Todt, Cyber Readiness Institute,

• Graham Dufault, The App Association,

On Tuesday the Subcommittee on Oversight and Investigations of the House Committee on Energy and Commerce will be holding a hearing on "Stopping Digital Thieves: The Growing Threat of Ransomware". This hearing is very likely to specifically address control system security issues and could get fairly technical. The witness list includes:

• Kemba Walden, Microsoft Corporation,

• Robert M. Lee, Dragos,

• Christian Dameff, M.D., M.S., Medical Director of Cybersecurity, UC San Diego Health,

• Charles Carmakal, FireEye-Mandiant

• Philip Reiner, Institute for Security and Technology

On Wednesday, the Senate Environment and Public Works Committee will be holding a hearing on “Addressing Cybersecurity Vulnerabilities Facing Our Nation’s Physical Infrastructure”. While the witness list is not yet available, there is a decent chance that there will be some discussion about control system cybersecurity issues. I would not be surprised to see witnesses from the water treatment sector.

Spending Bills

The House Rules Committee has announced that they are accepting amendments for the first spending bill for FY 2022. The House will be considering a minibus (multiple spending bills under one bill number), probably next week. The amendment deadline is Wednesday evening and the Committee is likely to hold their rulemaking hearing next Monday.

The slate for the first minibus is set to include:

Division A (Labor, Health and Human Services, Education),

Division B (HR 4356 – Agriculture, Rural Development),

Division C (Energy and Water Development),

Division D (HR 4345 – Financial Services and General Government),.

Division E (HR 4372 – Interior, Environment),

Division F (HR 4355 – Military Construction, Veterans Affairs),

Division G (Transportation, Housing, and Urban Development),

I do not typically review the FSG, or MCV spending bills, and the ARD bill contained nothing that I cover in this blog. The LHHS and THUD bills will probably be introduced today.

On the Floor

The House will be spreading their 27 bills considered under suspension of the rules over two days this week. The list includes seven cybersecurity bills:

• Monday

◦ HR 2931 – Enhancing Grid Security through Public-Private Partnerships Act,

◦ HR 2928 – Cyber Sense Act of 2021

• Tuesday

◦ HR 1871 – Transportation Security Transparency Improvement Act,

◦ HR 3138 – State and Local Cybersecurity Improvement Act, as amended,

◦ HR 1833 – DHS Industrial Control Systems Capabilities Enhancement Act of 2021, as amended,

◦ HR 2980 – Cybersecurity Vulnerability Remediation Act, as amended,

◦ HR 3223 – CISA Cyber Exercise Act

Republicans have been forcing recorded votes on the suspension bills. Democrats have responded by voting on some and including the remainder in the vote on the language of the rule for consideration of bills under regular order. This may make reporting passage of these bills somewhat piece meal.

Review - HR 2931 Introduced – Enhancing Grid Security

Back in March Rep McNerney (D,CA) introduced HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act. The bill would require the Department of Energy (DOE) to establish a voluntary security program for electric utilities and provide a report to Congress on cybersecurity of electricity distribution systems. Similar bills have been introduced and passed in the House back through the 115^th Congress (See HR 5240 in the 115^th Congress)

NOTE: This bill was reviewed using a Committee Print, the GPO has not yet printed an official copy of the bill.

Moving Forward

Last Thursday, the House Energy and Commerce Committee held a markup hearing that included consideration of this bill. It was approved, without amendment, by a voice vote. This indicates that this bill, like the similar bills in the last two congresses, has strong bipartisan support. The bill will be considered in the full House under the suspension of the rules process. This means that there will be limited debate, no floor amendments and the bill will require a supermajority to pass. The bill will likely pass with strong bipartisan support.

Commentary

This bill is job justification legislation. Congresscritters want to get reelected, so they demonstrate that they take action to solve problems. This bill is designed to do just that. DOE is already doing most of what is required in this bill. That is why no funding authorization is needed in the bill, funds have already been allocated for these activities.

For a more detailed look at the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2931-introduced (subscription required)

Energy & Commerce Committee Approves 3 Cybersecurity Bills

Today the House Energy and Commerce Committee held a markup hearing for six bills. Three of those bills were related to cybersecurity. All three cybersecurity bills were ordered reported favorably to the full House, each by voice votes. No amendments were offered on any these three amendments.

The three cybersecurity bills were:

• HR 3078, the Pipeline and LNG Facility Cybersecurity Preparedness Act,

• HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act, and

• HR 2928, the Cyber Sense Act of 2021

NOTE: To date, I have only reviewed HR 3078. None of these bills have yet been published by the GPO.

House Energy and Commerce Cybersecurity Markup Hearing Scheduled

The House Energy and Commerce Committee will be holding a markup hearing tomorrow. The agenda includes three cybersecurity bills:

HR 3078, the Pipeline and LNG Facility Cybersecurity Preparedness Act,

HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act, and

HR 2928, the Cyber Sense Act of 2021

NOTE: Each of the links above are to committee prints of the bills. GPO has not yet gotten to these bills. I have not yet reviewed them.

Bills Introduced – 4-30-21

Yesterday, with the House meeting in pro forma session and the Senate out of town until May 10^th, there were 56 bills introduced. Two of those bills will receive additional coverage in this blog:

HR 2928 To require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes. Rep. Latta, Robert E. [R-OH-5] 

HR 2931 To provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes. Rep. McNerney, Jerry [D-CA-9]