S 1917 Passed in Senate – K-12 Cybersecurity

Yesterday, the Senate took up and passed S 1917, the K-12 Cybersecurity Act of 2021, under the Senate’s unanimous consent process. There was no debate and no vote. The House will not take up the bill until sometime after it returns from their Summer Recess in September.

A version of this bill was introduced in the House (HR 4691), but there is also a competing bill (HR 4005). There has been no action on HR 4005, but HR 4691 has been adopted by the House Homeland Security Committee. The House leadership will determine if HR 4005 or S 1917 will be the bill considered by the House. In either case, the bill will almost certainly be considered under the suspension of the rules process.

4 Sponsors Added for HR 4005 - Enhancing K–12 Cybersecurity

On Thursday, four new sponsors were added for HR 4005, the Enhancing K–12 Cybersecurity Act. Two of those sponsors {Rep Miller-Meeks (R,IA) and Rep Hayes (D,CT)} are members of the House Education and Labor Committee, the second committee to which this bill was assigned. Before this addition there were no cosponsors from that Committee. This means that there now may be enough influence for the bill to be considered in Committee.

The House Homeland Security Committee is the primary committee of jurisdiction for this bill. The bill could move to the floor of the House with just a hearing from Homeland Security if Chair Thompson (D,MS) could reach an agreement with the Chair of the Education and Labor Committee {Rep Scott (D,VA)}. Or Education and Labor could markup those portions of the bill under their purview. Or Scott could effectively kill the bill if he had strong objections to either provisions of the bill or felt slighted by a lack of coordinated effort on the bill. These two new cosponsors may indicate that the last two options have been dealt with. 

Review - HR 4005 Introduced - Enhancing K–12 Cybersecurity

Last month, Rep Matsui (D,CA) introduced HR 4005, the Enhancing K–12 Cybersecurity Act. The bill would require CISA to establish a school cybersecurity information exchange, a cybersecurity incident registry, and a K–12 cybersecurity technology improvement program. The bill would authorize $10 million per year through 2023 to fund such programs. This bill is not related to S 1917, K–12 Cybersecurity Act of 2021, in anyway.

Matsui is not a member of either the House Homeland Security Committee or the Education and Labor Committee to which this bill was assigned for consideration. Four of her cosponsors {Rep Katko (R,NY), Rep Langevin (D,RI), Rep Garbarino (R,NY), Rep McCaul (R,TX)} are members of the Homeland Security Committee (and Katko is the Ranking Member) so there is probably sufficient influence available to see this bill considered in Committee. I see nothing in this bill that would draw organized opposition.

I suspect that there would be sufficient bipartisan support for this bill in Committee that the House leadership would move this bill to the floor of the House under the suspension of the rules process.

For a more detailed analysis of the bill and my suggestions for its improvement, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4005-introduced - subscription required.

Bills Introduced – 6-17-21

Yesterday with both the House and Senate in Washington and preparing for the new federal holiday, there were 118 bills introduced. Three of these bills may receive additional attention in this blog:

HR 4005 To direct the Director of the Cybersecurity and Infrastructure Security Agency to establish a School Cybersecurity Improvement Program, and for other purposes. Rep. Matsui, Doris O. [D-CA-6]

HR 4006 To require original equipment manufacturers of digital electronic equipment to make available certain documentation, diagnostic, and repair information to independent repair providers, and for other purposes. Rep. Morelle, Joseph D. [D-NY-25]

S 2134 A bill to establish the Data Protection Agency. Sen. Gillibrand, Kirsten E. [D-NY]

I would also like to mention in passing one Senate Resolution:

S Res 279 A resolution designating June 21, 2021 through June 25, 2021, as "National Cybersecurity Education Week". Sen. Rosen, Jacky [D-NV] 

I will be watching HR 4005 for language and definitions that would indicate that building control and/or security systems are specifically covered. I am not holding my breath.

I will be watching HR 4006 for language and definitions that could have cybersecurity implications.

I will be watching S 2134 for definitions and language that might indicate that control system information would be covered. I am not really expecting to find it.

Bills Introduced -12-01-14

Yesterday 11 bills were introduced in the House and Senate. Only one of these may be of specific interest to readers of this blog:

HR 5769 - To authorize appropriations for the Coast Guard for fiscal year 2015, and for other purposes. Sponsor Rep. Hunter, Duncan D. [R-CA-50]

Back in March the House passed HR 4005 on the same topic. That bill has not been considered by the Senate. Apparently the House and Senate transportation committees have worked out their differences and this new bill reflects a version that should be able to pass in both houses of congress before the session ends.

A quick look at the bill table of content shows no mention of MTSA, TWIC, or chemical transportation safety.

The bill has been added to the list of the bills that are to be considered under suspension of the rules today.

House Passes HR 4005

Yesterday the House passed HR 4005, the Coast Guard and Maritime Transportation Act of 2014. A bipartisan voice vote brought the consideration of the bill to a close after just about 45 minutes.

There was very little actual debate during the consideration of the bill. Most of the discussion was more praise for the bipartisan leadership of the Transportation and Infrastructure Committee for their ability to work together to craft this legislation.

The only question about this becoming law is when or if Sen. Reid (D, NV) will bring the bill to the floor for a vote. I expect that he will and probably well before the summer recess.

Congressional Hearings – Week of 3-30-13

Both the House and Senate will be in session this week. Budget and spending matters continue to dominate the hearing schedule, but only one of those will be of specific interest to readers of this blog. There is also a hearing this week on the reauthorization of the Hazardous Materials Regulations.

Budget

The table below shows the hearing status of the various agencies of specific interest to readers of this blog and when the hearing have been / will be held on the President’s budget request for them.

Agency	House Approp.	House Oversight	Senate Approp.	Senate Oversight
DHS	3-11-14	3-13-14	3-11-14	3-13-14
DOT	3-12-14	3-12-14	3-13-14
Defense	3-13-14	3-6-14	NA	NA
CG	3-12-14	3-26-14
FEMA	3-26-14	3-25-14		3-13-14
TSA	3-25-14

The hearing I mentioned above does not fit on this table because it isn’t specifically about the President’s budget. It is related to transportation safety so I’ll discuss it below. Please note that I’ve added ‘NA’ to the Senate side of the hearing table for ‘Defense’; they break out the hearings for defense spending into much smaller pieces so there is no single date that would fit into this block. In the unlikely event that they do a specific cybersecurity defense hearing I’ll replace the NA with that date.

Transportation Safety

The Railroads, Pipelines, and Hazardous Materials Subcommittee of the Senate Transportation and Infrastructure Committee will be holding a hearing looking at “Examining Issues for Hazardous Materials Reauthorization” on Wednesday. By definition chemical transportation safety will be the topic for this hearing.

The witness list includes:

• Cynthia Quarterman, PHMSA;

• William F. Downey, American Trucking Association;

• Thomas E. Schick, American Chemistry Council;

• Stephen Pelkey, American Pyrotechnics Association; and

• Kevin O'Connor, International Association of Fire Fighters

With the absence of any railroad or petroleum industry witnesses I don’t suspect that the crude oil classification issue will get much discussion, though it will probably be mentioned.

The Transportation, Housing and Urban Development, and Related Agencies Subcommittee of the House Appropriations Committee will be holding an oversight hearing looking at the DOT Modes (FAA, FHA, FRA, FTA, PHMSA, FMCSA and MA). Witnesses will include representatives from each of these agencies.

Chemical Transportation Safety will be one of the topics that will come up with a possible mention of the crude oil train safety issue.

House Floor

The Majority Leader’s web site shows mainly political posturing bills being considered by the House this week, as I would expect to see through the first Tuesday in November. Tuesday will be the day of bipartisanship this week with a number of bills being considered under suspension of the rules. The only bill of specific interest here will be HR 4005, the Coast Guard Authorization bill that I discussed in an earlier post.

HR 4005 Reported in House – CG Authorization

Earlier this week the House Transportation and Infrastructure Committee published their report on HR 4005, Coast Guard and Maritime Transportation Act of 2014.

Chemical Safety and Security

The Committee did not make any changes to the bill during its markup that had anything to do with chemical safety or the Coast Guard’s Maritime Transportation Safety Act (MTSA) during the markup of this bill last month.  

The only provision in the bill dealing, even tangentially, chemical safety and security is §202. This section deals with the Prevention and Response Workforce, the Coast Guard’s safety and security specialists, both enlisted and officer. The Committee Report describes this section this way:

“This section ensures servicemembers assigned to certain prevention and response jobs have opportunity for career advancement.”

Moving Forward

According to the Majority Leader’s web site HR 4005 will come to the House floor on Tuesday, April 1^st. It will be considered under suspension of the rules, so no amendments will be considered. The House leadership certainly expects this bill to pass with wide bipartisan support.

Since there is no Senate version of this bill, it will likely be considered in the Senate before the summer recess. It is remotely possible that there will be no Senate amendments.

HR 4005 Markup Hearing Scheduled

The problem with doing a hearing post as early as I did it this last weekend is that I might miss late posted hearing. The House Transportation and Infrastructure Committee will hold a markup hearing tomorrow that will address HR 4005, the Coast Guard and Maritime Transportation Act of 2014. At least two other bills will also be considered (HR 3676 and HR 1378) as well as some GSA related resolutions. Apparently the Committee leadership does not expect there to be much discussion about HR 4005, a sure sign that the bill was appropriately vetted by the Staff.

I noted this weekend that HR 4005 was on the fast track for consideration and this quick markup certainly supports that conclusion.

HR 4005 Introduced – FY 2015 CG Authorization

As I noted earlier this week Rep. Duncan (R,CA) introduced HR 4005, the Coast Guard and Maritime Transportation Act of 2014. As we have seen in recent years there is no specific mention of the Maritime Transportation Security Act (MTSA) or the Transportation Workers Identification Credential (TWIC) in the bill. There is, however, a move to formally recognize the work of port and facility safety and security specialists in the USC.

Safety and Security Specialists

Section 202 of the bill makes modifications to 14 CFR §57, Prevention and Response Workforces. It {§202(1)(c)} adds ‘port and facility safety and security specialist’ to the list of jobs in §57(b) requiring certain qualifications and describes those qualifications:

Port and facility safety and security specialist shall have knowledge, skill, and practical experience with respect to the safety, security, and environmental protection responsibilities associated with maritime ports and facilities. {§57(b)(5)}

It {§202(2)} then goes on to add “port and facility safety and security specialist” to the list of jobs that requires a 1 year apprenticeship {§57(f)}. Then it {§202(3)} adds “port and facility safety and security specialist” to the list of potentially qualifying specialties for the position Sector Chief of Protection.

These provisions should help to increase the professionalism of the current safety and security specialist workforce by recognizing their place within the Coast Guard hierarchy and making the specialty a viable part of the career progression for Coast Guard officers.

Moving Forward

This is one of a relatively small list of must pass authorization bills. It is being introduced fairly early in the year (2^nd quarter) so it should have time to wend its way through the legislative process, even in an election year, before the start of FY 2015. The fact that it has already been published by the GPO indicates the level of priority assigned to its consideration.

I expect that we may see the initial markup hearing on this bill by the end of the month even with the Valentine’s Day recess the week of the 17^th.

Bills Introduced – 02-06-14

There were 34 bills introduced in the House and Senate yesterday and two of those will be of specific  interest to readers of this blog. Those bills deal with CFATS authorization and the FY 2015 Coast Guard authorization.

HR 4005 Latest Title: To authorize appropriations for the Coast Guard for fiscal years 2015 and 2016, and for other purposes. Sponsor: Rep Hunter, Duncan D. (R,CA)

HR 4007 Latest Title: To recodify and reauthorize the Chemical Facility Anti-Terrorism Standards Program. Sponsor: Rep Meehan, Patrick (R,PA)

The second bill is the one that I have been hearing about for over a month now. Rep. McCaul is not the author as I had been told, but he is one of the co-sponsors. There are two disappointing aspects of the bill based on the limited data available at Thomas.LOC.gov. First there is not a single Democrat cosponsoring the bill [NOTE: It has been brought to my attention that Rep Green (D,TX) is a co-sponsor, but he is not a ranking member of any committee or subcommittee with oversight of the CFATS program so the intent of the comment is correct; 2-8-14 12:30 am CST]. This obviously not a problem in the House, but bodes ill for the possibility of the bill being considered in the Senate. Second, there are no cosponsors of the bill from the Energy and Commerce Committee, which indicates that there might be a problem getting this bill to the floor of the House. Now we just have to wait for the bill to be published by the GPO to see if there is something in the language of the bill that would allow it to overcome those two obstacles.

HR 1535 Introduced – Port Security

As I mentioned a week ago, Rep. Hahn (D,CA) introduced HR 1535, the Gauging American Port Security (GAPS) Act. This bill would require the DHS Inspector General to prepare a classified report on the “remaining gaps in port security in the United States” {§2(a)(1)}. This bill is nearly identical to HR 4005 that was passed in the House in the last session, but was never acted upon in the Senate.

The only difference between this bill and the previous version is that the previous bill required the Secretary of DHS to produce the GAPS report not the IG. The change to requiring the IG to conduct the study is odd in that the bill also requires the report to address the “prioritization of such gaps and a plan for addressing them” {§2(a)(2)}. This is an inherently political decision and thus not normally under the purview of the IG.

Classified Report

Requiring the report to be made in classified form with an unclassified annex {§2(b)} will make sharing of the information problematic with the people at the local level that will most likely be responsible for fixing the identified problems. Section 3 of the bill attempts to address this by requiring the Secretary to “help expedite the clearance process, as appropriate” for ‘designated’ points of contact. Beyond the generic “Federal agencies and State, local, or tribal governments, and port system owners and operators” the bill does not define ‘designated’.

The one point that this bill (and to be fair most bills requiring the sharing of classified information) fails to recognize is that a person receiving classified information also has to have specially approved methods of storing the classified information. Obtaining the approval of the storage can be as time consuming as, and much more expensive than, obtaining a security clearance.

Additionally, State and local governments will inevitably have to go through a public funding process for any improvements that they will have to make to port operations. Having to rely on a classified report to justify those expenditures will make that funding process much more difficult.

Moving Forward

In the last session, HR 4005 passed with overwhelming bipartisan support (the vote was 411 – 9) in the House, but was never addressed in the Senate. That was due, at least in part, to its late introduction and passage in the House. When this bill gets to the floor in the House and if it gets to the floor in the Senate, it will pass without significant opposition.

Port Security Votes

As I noted last weekend the House was scheduled to consider three separate port security related bills; HR 3173, HR 4005, and HR 4251. All three were debated on Tuesday, but a lack of a quorum caused the actual votes to be pushed back. On Thursday the House passed all three bills; two by overwhelmingly bipartisan votes and the other by a voice vote.

While these bills have enjoyed wide bipartisan support in the House (and no significant opposition) there are only a limited number of days left before the summer recess and it is unlikely that these bills will be taken up by the Senate in that time. Between the summer recess and the election in November, no significant political work will get done in the Senate as both sides posture for November. The best hope for these three bills to actually pass this year will be during post-election lame duck session.

Congressional Hearings – Week of 6-22-12

As the summer recess approaches Congress tries to figure out what work will actually get done before the fall election. There is only one hearing of potential interest this week and that deals with TWIC issues. Interestingly two days before this hearing the full House will vote on two bills that deal with the issues being reviewed in this hearing.

TWIC Hearing

The House Transportation and Infrastructure Committee will be holding a hearing on Thursday that looks at the delays and problems with the management of the TWIC program. The witness list is interesting; a Coast Guard Rear Admiral, a policy wonk from DHS, a port authority representative and a union representative. No one from the Transportation Security Administration will be there to answer the various accusations and complaints.

Port Security Week

As the summer recess approaches the House leadership continues to bring up large numbers of bills that will be relatively easy to pass; it helps to counter the election year claims of being a ‘do nothing’ body. This week three of the sixteen bills that will be considered under suspension of the rules will deal with port security issues. Those bills are:

• HR 3173 To direct the Secretary of Homeland Security to reform the process for the enrollment, activation, issuance, and renewal of a Transportation Worker Identification Credential (TWIC) to require, in total, not more than one in-person visit to a designated enrollment center

• HR 4005 GAPS Act

• HR 4251 Securing Maritime Activities through Risk-based Targeting for (SMART) Port Security Act

I’ve addressed the last two bills in earlier blogs (HR 4005, HR 4251). The first bill is interesting in that it is basically included as a section (§205) in HR 4251. There is an interesting difference though, HR 3173 gives the Secretary 90 days to reform the TWIC application process and HR 4251 allows 270 days. I suppose that whichever passes last is the one that governs the time frame that DHS will ignore.

DOT Appropriations

The House will also consider HR 5272, the DOT and HUD appropriations bill. This will be considered under an open rule with a large number of amendments to be submitted from the floor. I’ve already addressed some of the chemical safety and pipeline safety provisions of the bill in an earlier blog. There is no telling what neat new amendments will be offered on the floor.

Homeland Security Markup Results

Yesterday’s markup hearing before the House Homeland Security Committee ended with four bills ordered to be reported favorably to the House. Unusual in this Congress is the fact that three of the four bills were adopted by unanimous consent and the fourth by a voice vote; making these bills poster children for bipartisan support.

The four bills are:

HR 2356, WMD Prevention and Preparedness Act of 2011;

HR 3173, TWIC renewal;

HR 3857, Public Transit Security and Local Law Enforcement Support Act; and

HR 4005, GAPS Act.

Typically when you see four bills covered in a single hearing like this at least two or three of them are passed without additional action. In each of these pieces of legislation there was at least one amendment (HR 3173) offered and adopted. In fact, there were a total of 14 amendments adopted and one was defeated. All but one of the adopted amendments were approved by either ‘unanimous consent’ or a voice vote.

Still nothing in any of these bills that directly affects chemical facility security, but there are a couple of interesting amendments that deserve a second look.

GAPS Act

The Committee did not take my suggestion about avoiding over-classification of the ‘gaps’ report. Rep. Clarke (D,NY) and Rep. Jackson-Lee (D,TX) stood mute on the subject leaving Rep. Sanches (D,CA) to address the issue. Rather than trying to reduce the designation to the legally specified PCII, Ms. Sanchez’ amendment added a new section to the bill requiring that the Secretary to share “relevant information regarding remaining gaps in port security of the United States” {§3}. Recipients should include government agencies as well as ‘port system owners and operators’.

The new section goes on to address the security clearance issue by requiring the Secretary, when appropriate, to “help expedite the clearance process”. This looks like a workable solution until you realize that there will only be a limited number of people that will be getting these clearances in any organization and sharing classified information within the organization is forbidden. Additionally, the physical security requirements for storing classified information (including approval and periodic inspection requirements) will ensure that many organizations that might need access to this information will not be able to get it.

TWIC Renewal

Rep. Sanchez was also responsible for sole amendment to HR 3173. It added another complaint about the current TWIC situation to the findings in §1; the delay in issuing rules for the use of TWIC Readers. This led to a subsequent addition to §2 that it is the ‘Sense of Congress’ that the Secretary should promulgate final TWIC Reader rules “as soon as practicable” {§2(2)}. Why anyone thinks that a ‘as soon as practicable’ requirement will carry any more weight than the original two year time limit is completely beyond me.

There is one additional part to this amendment that may have a practical effect. Section 2(3) extends the expiration of any Port Security Grants that have been awarded for TWIC projects. Such awards would not expire “before the issuance of the final TWIC reader rule”. Unfortunately the staffers need to go back and learn some grammar; this could allow those grants to expire on the date the TWIC Reader rule is published in the Federal Register. I would have suggested that the end of this subparagraph would read “before a period of six months has passed after the effective date of the final TWIC Reader rule.

Republicans Loose Vote

I don’t have much interest in HR 3857; I don’t live in a city with a real public transit system and these systems (where they do exist) do not directly service high-risk chemical facilities. But, it is interesting to note that on the only roll call vote of the hearing the Chairman was on the losing end of the vote and the Ranking Member was on the winning side. Rep. Cuellar (D,TX) proposed an amendment that would require grant recipients for the new ‘specialized patrol teams’ must submit a “sustainment plan for maintaining in future years the capability or capacity achieved with the grant funds”. A bipartisan majority over-rode the chairman; it doesn’t happen often, but when it does its worth looking at.

Moving Forward

It seems that there is little or no reason that these four bills wouldn’t pass if they reach the floor of the House. I don’t see any real reason why they couldn’t pass easily in the Senate as well. It all depends on the legislative inertia; if the leadership doesn’t move on these they languish as so many bills do during an election year.

Update on Today’s HS Markup Hearing

The House Homeland Security Committee web site shows that there will now be an amendment in the nature of a substitute (ANS) offered today by Rep. Hahn (D,CA) during the mark-up of HR 4005, the Gauging American Port Security (GAPS) Act today.

The requirement for the production of a classified report on the current gaps in port security is being modified somewhat in the ANS. While the report will still be classified DHS is also being required to produce an ‘unclassified annex’ to the report {§2b}. Presumably this will allow for sharing of some of this information with the public, though such annexes rarely see the lite of day.

This still doesn’t deal with the issue of over classification of information that so many of Ms Hahn’s Democratic colleagues on the Homeland Security Committee have been decrying over the years. Port security is specifically addressed under the Protected Critical Infrastructure Information (PCII) Program. That program provides the security requirements for documents of this sort as sensitive but unclassified documents rather than classified. The public still won’t see the information, but port security personnel will be better able to access the appropriate information.

One would suspect that Ms. Clarke (D,NY) or Ms. Jackson-Lee (D,TX), both leading opponents of over-classification, would offer an amendment to this bill to change the ‘classified’ report to a ‘PCII’ report. They certainly would if the bill had been authored by a Republican.

Congressional Hearings – Week 5-8-12

The House and Senate come back to Washington this week. Two different committees will work on spending bills for DHS and a number of security related bills will be marked up in the House. The full House will consider a spending bill that could have cybersecurity provisions.

DHS Budget Hearings

Wednesday morning the Senate Appropriations Committee’s Homeland Security Subcommittee will hold a hearing to look at the President’s FY 2013 funding request for the Coast Guard. Adm. Papp, the Commandant, will be the sole witness.

Over in the House, at about the same time, the House Homeland Security Subcommittee will be marking up their FY 2013 DHS spending bill. A copy of the bill to be marked up will not be available until after both the subcommittee and the full committee have done their markups and reported the bill.

Security Related Markups

The House Homeland Security Committee will hold a markup hearing on Wednesday, looking at four separate bills. Three of the bills have some relationships to chemical security issues. They are:

• HR 2356, WMD Prevention and Preparedness Act of 2011;

• HR 3173, TWIC Processing; and

• HR 4005, Gauging American Port Security Act

The WMD act looks like it will finally get its time in the sun. There will be an amendment in the nature of a substitute (ANS) offered by Chairman King. This is the same ANS that would have been considered back in February when the markup was previously scheduled. The bill concentrates on biohazards, the personal bête noir of Chairman King. Even the Metropolitan Medical Response System reauthorization contained in the does nothing to direct planning for a response for an attack on a chemical facility.

The TWIC processing bill was introduced last year and almost immediately added to HR 3116, the FY 2012 DHS Authorization bill, in the full committee markup of that bill. Since that bill has died a death of quiet neglect (yet again) the Committee will now try to get this bill passed on its own right. In an effort to make it easier for legitimate port workers to get their TWIC issued or renewed, the provisions of the bill will probably reduce the security of the documents according to the GAO.

The GAPS bill will add another study to the long list of ignored studies conducted by DHS. The bill requires the report to be classified, ignoring the rules for protecting port security information; just another classified report to gather dust.

All three bills will certainly be passed in committee, probably with some measure of bipartisan support. If/when they come to the floor of the House they will all probably pass there as well.

Other Spending Bills

The House will vote on two (maybe three) spending bills this week according to the House web site HR 5326, the appropriations bill for Commerce and Justice will be considered this week under rule (Rules Committee Hearing on Monday). There isn’t much in the actual bill about cybersecurity, but the Appropriations Committee Report briefly describes the FBI setting up cybersecurity equivalents of Joint Terrorism Task Forces. I’ll watch this for more cybersecurity coverage.

Two bills (one unnumbered as of today and HR 4966) would attempt to bypass some or all of the sequester provisions of last year’s spending bill will be considered this week. There is only a slim chance that security provisions could be included in the bills.

HR 4005 Introduced – Port Security Report

This week Rep. Hahn (D,CA) introduced HR 4005, the Gauging American Port Security (GAPS) Act. The bill is short and to the point. It requires the Secretary of DHS to conduct a classified study of the gaps in the current port protections programs and propose methods to correct the current deficiencies.

One small problem with this bill; this study does not technically fall within the requirements for it to be classified. ‘Sensitive Security Information’ (SSI) certainly, but not classified. Oh well so much for technicalities, if this bill is passed the report will certainly be classified.