S 2095 – DOE Cybersecurity

Last month Sen. Gardner (R,CO) introduced S 2095, the Enhancing Grid Security through Public-Private Partnerships Act. The bill would require the Department of Energy (DOE) to establish a voluntary security program for electric utilities and provide a report to Congress on cybersecurity of electricity distribution systems. This bill is very similar to HR 359, which was ordered favorably reported by the House Energy and Commerce Committee last month.

Differences in the Bills

There are a number of differences between the two bills. Many of them are strictly structural; the definitions are in §2 of the Senate bill and §5 of the House bill. Others are editorial in nature; adding ‘of a State’ following ‘political subdivision’ in the Senate version. These changes are of interest only to grammarians, lawyers and judges.

Other changes are of more consequence. The senate bill does not include the section on electricity interruption information that was included as §4 in the House bill. There are two changes (an addition and a deletion) to the voluntary security program described in §3 of S 2095 (see below). Finally, the Senate bill adds a 1 year deadline for the required report to Congress on cybersecurity and distribution systems.

Security Program

The security program in this bill was originally introduced in HR 5240 in the 115^th Congress. That program would have required DOE to:

• Develop, and provide for voluntary implementation of, maturity models, self-assessments, and auditing methods for assessing the physical security and cybersecurity of electric utilities;

• Provide training to electric utilities to address and mitigate cybersecurity supply chain management risks;

• Increase opportunities for sharing best practices and data collection within the electric sector;

• Assist with cybersecurity training for electric utilities;

• Advance the cybersecurity of third-party vendors that work in partnerships with electric utilities; and

• Provide technical assistance for electric utilities subject to the program.

S 2095 modifies that program by removing the requirement for DOE to assist with cybersecurity training. This bill would substitute a requirement for DOE to “to assist with threat assessment and cybersecurity training for electric utilities” {§3(a)(2)}.

Moving Forward

Neither Booker nor his single cosponsor {Sen. Bennet (D,CO)} are members of the Senate Energy and Natural Resources Committee to which this bill was assigned for consideration. With no representation on that Committee it is unlikely that this bill will receive consideration.

The House version of the bill received bipartisan support in the markup of the bill last month in the House Energy and Commerce Committee. I suspect that this bill would also receive bipartisan support if it were considered in Committee. The changes described above would have no significant bearing on the support this bill would receive.

NOTE on HR 359

In my post on the introduction of HR 359 I noted that it would be considered by the full House on January 11^th, 2019 under the suspension of the rules process. This had been scheduled, along with the consideration of two other cybersecurity bills, HR 360 and HR 370. None of those bills were considered.

It looked like the new Democratic leadership was going to act quickly (if somewhat inadequately) on some critical infrastructure cybersecurity measures. It did not happen for reason which have not been made public. With that initial quick intent to pass these three cybersecurity bills, it is odd that no action was taken in Committee until a subcommittee markup (with no amendments) in May and full Committee markup in July.

The bipartisan support for these bills in Committee would seem to indicate that the bills would easily pass in the House under the suspension of the rule process. I would have thought that the initial pass on considering these bills indicated that there was an intent to revise these bills to include some sort of regulatory authority to insure that facilities complied with the ‘voluntary measures’ included in the bill. The lack of amendments in Committee would seem to indicate that the leadership has decided that such cybersecurity mandates were not going to make it to the President’s desk.

I suspect that all three House bills will be considered by the full House in September.

HR 370 Introduced – Pipeline Security

Last week Rep. Upton (R,MI) introduced HR 370, the Pipeline and LNG Facility Cybersecurity Preparedness Act. This bill is nearly identical to the version of HR 5175 that was reported in the House last session. That bill never made it to the floor of the House for consideration. The bill would provide the Department of Energy with some level of responsibility for pipeline security (specifically including cybersecurity) but without any regulatory authority in the area. The respective responsibilities of DHS/TSA and DOT/PHMSA in the area would not be affected.

Moving Forward

The Republicans have yet to announce their committee rosters yet so it is too early to tell if Upton will be back on the Energy and Commerce Committee, the Committee to which this bill was referred for consideration. His single co-sponsor {Rep. Loebsack (D,IA)} is a member of that Committee so this bill may end up being considered in Committee.

There is a lesser chance that the bill will move directly to the floor of the House for consideration as so many bills reintroduced in the previous session are. If Upton were really hoping for that to happen, he probably should have had Loebsack listed as the sponsor of the bill.

This bill will almost certainly be approved with substantial bipartisan support. The modifications made in the marked-up version of the previous bill were designed to throw bones to the other committees (Transportation and Homeland Security) that might object to the bill overstepping into their areas of oversight. Additionally, the revised language now seen in this ‘original bill’ easy any potential industry concerns by clarifying that the tools and procedures developed by DOE under direction of this bill {in §2(3) and §2(6)} would be available for ‘voluntary use’ by industry and not mandated.

If this bill makes it through the backroom processes in the House and is considered on the floor, it will be sent to the Senate with bipartisan support.

Bills Introduced – 01-09-19

Yesterday with both the House and Senate in session there were 89 bills introduced. Of these, three bills will likely receive future mention in this blog:

HR 359 To provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes. Rep. McNerney, Jerry [D-CA-9]

HR 360 To require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes. Rep. Latta, Robert E. [R-OH-5] 

HR 370 To require the Secretary of Energy to carry out a program relating to physical security and cybersecurity for pipelines and liquefied natural gas facilities. Rep. Upton, Fred [R-MI-6] 

Bills Also Worth Mentioning

I am also going to call attention here to six other bills here that would attempt to mitigate the effects of the current Federal Funding Fiasco. I will briefly discuss these bills in this post and will probably not mention them again in this blog.

HR 367 Making appropriations for Coast Guard pay in the event an appropriations Act expires before the enactment of a new appropriations Act. Rep. DeFazio, Peter A. [D-OR-4]

HR 371 Making appropriations for certain Federal employees working during the Government shutdown beginning on or about December 22, 2018, and for other purposes. Rep. Biggs, Andy [R-AZ-5]

HR 374 To make continuing appropriations for Coast Guard pay in the event that appropriations for Coast Guard pay in fiscal year 2019 expire and a new appropriations Act has not been enacted. Rep. Byrne, Bradley [R-AL-1]

HR 419 To make continuing appropriations for the Federal Aviation Administration for fiscal year 2019. Rep. Van Drew, Jefferson [D-NJ-2]

HR 421 Making continuing appropriations for the Coast Guard. Rep. Wild, Susan [D-PA-7] 

S 72 A bill to suspend the enforcement of certain civil liabilities of Federal employees and contractors during a lapse in appropriations, and for other purposes.  Sen. Schatz, Brian [D-HI]

FFF Effect Mitigation

As we quickly approach the 21-day FFF record it is interesting to note the efforts by a wide variety of congresscritters to protect various agencies and employees of the Federal government from the effects of the FFF. At first glance it would seem that these efforts are commendable as they would reduce the suffering of employees who are, after all, bearing the direct brunt of this political foofaraw.

On the other hand, and there is ALWAYS an ‘other hand’ when it comes to politics, I think that these efforts are misguided. While reducing the pain and suffering of these employees would be great for them and their families, it would also serve to reduce the political price for shutting down the government (or portions thereof) and make future shutdowns more likely.

On the first Tuesday in November, 2020, the voters of this country will remember this little game of political hostage taking. The hardcore supporters of both the President and the Democratic leadership of Congress will probably reward them for their intransience, but the vast majority of folks in the center will take revenge for those hurt during this FFF. They will go into the voting booth having decided who was mainly at fault (both sides share at least some portion of the blame) and will vote for their political retirement.

That is as it should be, there should be a high price to pay for using the disruption of the government as a political tool. Unfortunately, any measures taken to reduce the impact of that disruption will lesson the anger of the electorate and thus reduce the price to be paid for this game of political one-up-man-ship.  That could have the unintended consequence of extending the length of the current FFF and increase the chance of a repeat performance in FY 2020.