Review – HR 3169 Introduced – Foreign Crane Inspections

Earlier this month, Rep Gimenez (R,FL) introduced HR 3169, the Port Crane Security and Inspection Act of 2023. The bill would require new port cranes to be inspected by DHS for potential security risks before they were placed into operation. It would also prohibit new foreign (read Chinese) cranes and require existing foreign cranes to switch to non-foreign software within five years. No new funding is authorized by this bill.

Moving Forward

Gimenez and one of his six cosponsors {Rep Higgins (R,LA)} are members of the House Homeland Security Committee to which this bill was assigned for consideration. This means that there could be sufficient influence to see the bill considered in Committee. While there will be some bipartisan support for this bill based on the China bashing provisions inferred in the bill, I do not expect that it will pass in its current form in Committee. That is because the sharp line drawn in prohibiting the future installation of foreign (read Chinese) cranes section 3 of the bill does not reflect the reality on the ground. That flat prohibition will draw opposition of many port operators, shippers, and (less important to be sure) the Chinese government. If the bill is considered in Committee it will almost certainly involve substitute language crafted by the Committee staff.

Commentary

Section 2 of the bill probably needs to be rewritten to better clarify how DHS/CISA is supposed make the decision about what constitutes a security threat. For example, does the presence of programmable logic controllers (PLCs) that can be reprogrammed by anyone with access to the network constitute a security threat. If so, CISA can probably determine that all foreign cranes pose a security threat, but then again so would most domestic cranes. The question that needs to be answered before CISA can really make these decisions is when is something a security threat for Chinese cranes but not for US (or South Korean, or German) cranes? This needs to be spelled out before Chinese manufacturers sue CISA in US Courts.

 

For more details about the provisions of this bill, including an expanded commentary, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-3169-introduced - subscription required.

Bills Introduced – Week of 5-6-23

VACATION DELAYED

This week with both the House and Senate in Washington, 314 bills were introduced. Eight of those bills may receive additional attention in this blog:

HR 3147 To establish a defense industrial base advanced capabilities pilot program. Houlahan, Chrissy [Rep.-D-PA-6]

S 1493 A bill to amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes. Sinema, Kyrsten [Sen.-I-AZ] 

S 1500 A bill to amend the Help America Vote Act of 2002 to require the Election Assistance Commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems. Sen. Warner, Mark R. [D-VA]

HR 3169 To require the inspection of certain foreign cranes before use at a United States port, and for other purposes. Gimenez, Carlos A. [Rep.-R-FL-28]

S 1526 A bill to amend the National Telecommunications and Information Administration Organization Act to establish the Office of Policy Development and Cybersecurity, and for other purposes. Hickenlooper, John W. [Sen.-D-CO]

HR 3208 To amend the Homeland Security Act of 2002 to establish a DHS Cybersecurity On-the-Job Training Program, and for other purposes. Jackson Lee, Sheila [Rep.-D-TX-18]

HR 3224 To amend the Homeland Security Act of 2002 to extend the authorization of the Countering Weapons of Mass Destruction Office of the Department of Homeland Security, and for other purposes. D'Esposito, Anthony [Rep.-R-NY-4]

S 1560 Rural Hospital Cybersecurity Enhancement Act Hawley, Josh [Sen.-R-MO]

I will be covering HR 3208, HR 3224, and S 1526.

I will be watching the remaining bills for language and definitions that specifically include control system or medical device cybersecurity requirements within the scope of the legislation.