Senate Passes HR 5729 – TWIC Reader Delay

Yesterday the Senate passed HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. The bill was passed by unanimous consent at the end of the session; no debate and no vote.

The bill now goes to the President’s desk. There is no indication that there will be any problem with the President signing the bill.

House Passes HR 5729 – TWIC Reader Rule Delay

Yesterday the House passed HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018, by a voice vote. There was a short nine-minute debate on the bill with two representatives speaking in favor of the bill.

Both Rep. Katko (R,NY) and Rep. Norton (D,DC) mentioned in their floor speeches concerns about the “expanded scope of the final [TWIC Reader] rule where facility areas subject to the TWIC reader requirement went beyond what was included in the proposed rule and regulatory analysis accompanying that rule” (pg H5996). Norton also mentioned “concerns and questions about the reliability of background check information, the efficacy of fraud detection capabilities, and the relatively high cost of the credential have been persistent shortfalls that the Department of Homeland Security has never gotten right.”

Unfortunately for the two representatives neither issue is addressed by this bill. The bill simply extends the effective date for the TWIC Reader Rule until the “end of the 60-day period beginning on the date of the submission under paragraph (5) of section 1(b) of Public Law 114–278 [link added] (130 Stat. 1411 to 1412) of the results of the assessment required by that section.”

It will be interesting to see if the Senate takes up this bill before August 18^th, 2018. If it is signed by the President sometime after the 18^th it will have the interesting effect of prohibiting the implementation of something that will have already been implemented. That will cause all sorts of potentially interesting legal complications, at least until the report is filed.

This bill would have no effect on the current Coast Guard rulemaking underway to delay for three years the implementation of the TWIC Reader Rule for a limited sub-set of the currently affected facilities.

Committee Hearings – Week of 07-08-18

With both the House and Senate in session this week we start to see movement on other things than just spending bills. We have two cybersecurity hearings of potential interest and HR 6237, the FY 2018/19 intel authorization bill.

Spending Bills

• Wednesday – House – Committee - Labor, Health and Human Services, Education, and Related Agencies

• Wednesday – House – Rules Committee – HR 6147 (LHHE)  Amendment Deadline

Cybersecurity

On Wednesday the House Homeland Security Committee will be holding a hearing on “DHS’s Progress In Securing Election Systems And Other Critical Infrastructure”. The witness list includes:

• Christopher Krebs, DHS; and

• Nellie Gorbea, State of Rhode Island

While securing the election process is certainly important it is generally outside of the scope of this blog. I am mentioning this hearing though because of the following statement on the hearing web site:

“The hearing will also provide Members an opportunity to hear about DHS’s role working across all 16 critical infrastructure sectors because a cyber threat to elections may pose a similar threat to other critical infrastructure sectors.”

It will be interesting to hear what questions the Committee has for Krebs.

On Wednesday the Senate Commerce, Science, and Transportation will hold a hearing on “Complex Cybersecurity Vulnerabilities: Lessons Learned from Spectre and Meltdown”. The witness list includes:

• Donna Dodson, NIST;

• José-Marie Griffiths, Dakota State University;

• Joyce Kim, ARM;

• Art Manion, Carnegie Mellon University; and

• Sri Sridharan, University of South Florida

This is potentially too complex a topic for a congressional hearing. I hope the witnesses take this into account and concentrate on policy type issues instead of the technical details. It will be interesting to see what questions are posed by the Senators; this will reflect on the quality of the technical support the committee has.

Intelligence Authorization Act

On Wednesday the House Rules Committee will hold a hearing to set the rule for the consideration of HR 6237, the Matthew Young Pollard Intelligence Authorization Act for Fiscal Years 2018 and 2019. Thirty-seven amendments have been submitted to the Committee for consideration for inclusion in the debate on HR 6237. None of those amendments should be of specific interest to readers of this blog.

Last year’s version of the bill, HR 3180, finally passed the House under a closed rule (limited debate, no amendments), but was never considered in the Senate. It will be interesting to see how the Committee deals with this bill this year. The bill is scheduled to come to the floor on Thursday.

On the Floor

In addition to HR 3180, the House will also take up HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. That bill will be considered tomorrow under the suspension of the rules process; limited debate, no amendments, and a super-majority to pass. The bill will almost certainly pass with wide bipartisan support.

As I noted in my post on S 3094, the companion bill to HR 5729, from reading the Committee Report on the bill it is clear that the impetus for proposing this bill was to ‘punish’ DHS and the Coast Guard for ignoring the dictates of Congress. That will not, however, be the basis for the wide spread support for the bill. It provides a wide variety of congress critters a chance to vote against the TWIC program (for an equally wide variety of reasons) without taking any real action to affect the program. They get a show vote for certain constituencies without having to negatively effect a security program. You cannot get a better bill for politicians.

S 3094 Introduced – TWIC Reader Rule Delay

Last month Sen. Sullivan (R,AK) introduced S 3094, the Transportation Worker Identification Credential Accountability Act of 2018. This bill is identical to the language of HR 5739 as introduced. It does not include the periodic reporting requirement added to the House bill by the House Homeland Security Committee two weeks prior to the introduction of this bill.

Moving Forward

Sullivan is the Chair of the Subcommittee on Oceans, Atmosphere, Fisheries, and Coast Guard of the Senate Commerce, Science, and Transportation Committee, the Committee to which this bill was assigned for consideration. This means that he should certainly have enough influence to see the bill considered in Committee.

This bill would almost certainly see the same bipartisan support in the Senate that HR 5739 saw in committee in the House. The major question here is whether or not the bill will make it to the floor in either body in time to affect the implementation date for the rule in question; August 18^th, 2018. If the bill were to pass after that date, it would still have the intended effect, but many of the affected facilities will have already made their expenditures to implement the rule.

I would suspect that there is about a 50:50 chance that this bill will not make it to the President’s desk during this session. This is not due to any specific opposition to the bill, but rather a function of the crowded calendar as the mid-term elections and the end of the session approach.

The House version of the bill may have a better chance of proceeding than does this version as Sen. McCaul (R,TX) is a cosponsor of HR 5729 and he might be expected to provide the necessary influence to move the bill to the floor for a vote. If either bill is considered in a floor vote, it will be under the respective expedited consideration provisions of that house.

Commentary

Neither version of the bill would necessarily have any impact on the current Coast Guard rulemaking delaying implementation of the TWIC Reader Rule on a limited portion of the affected maritime community.

Interestingly the House report from the Homeland Security Committee on HR 5729 was released this week. Nothing really new there, but the final comment in the ‘Need for the Legislation’ section of the report (pg 3) sheds some light on the reason for the bipartisan support for this legislation:

“Despite a requirement to commission a study within 60 of enactment of the law, DHS did not commission the study until 14 months after enactment and has not provided sufficient information to Congress to explain the delay.”

It would seem that Congress is more upset about being ignored by DHS than it is really concerned about delaying the implementation of the rule. This is particularly reflected in the language of the bill that would allow the Coast Guard to implement the bill within 60-days of the required report being submitted to Congress. That 60-days is not long enough to ensure that the report is read, much less allow the Congress to take any action on the TWIC program.

Committee Hearings – Week of 06-24-18

With both the House and Senate in session this week it looks to be a busy week for Committee work. We are still seeing spending bills being marked-up and we have three cybersecurity related authorization bills. There will also be a Senate mark-up of the TWIC Reader Delay bill in that body.

Spending Bills

Monday – House Rules Committee – HR 6157 DOD;

Tuesday – House Rules Committee – HR 6157 DOD;

Tuesday – House Committee – LHHS;

Tuesday – Senate Sub-Committee – DOD;

Tuesday – Senate Sub-Committee – LHHS;

Thursday – Senate Committee – DOD;

Thursday – Senate Committee – LHHS

The Senate will finish work on HR 5895, the FY 2019 EWR spending bill Monday evening. The House will take up HR 6157, the FY 2019 DOD spending bill, either late Tuesday or on Wednesday.

Cybersecurity Authorization Bills

The three authorization bills with a cybersecurity nexus are for the National Telecommunications and Information Administration (NTIA), the National Institute of Science and Technology (NIST) and the intelligence community.

On Tuesday the Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold a hearing on their draft of an authorization bill for NTIA. The witness list includes:

• Michael D. Gallagher, Entertainment Software Association;

• John Kneuer, JKC Consulting; and

• Joanne S. Hovis, CTC Technology and Energy

The draft bill includes two ‘Sense of Congress’ sections on cybersecurity threats and supply chain vulnerabilities, and on preservation of domain name system and WHOIS service.

On Wednesday the House Science, Space, and Technology Committee will hold a mark-up hearing for three as of yet unintroduced bills. One of those is the draft of the NIST authorization bill. The draft includes a section on general cybersecurity and a separate section on IoT with cybersecurity language included.

On Thursday the House Intelligence Committee will hold the inevitably closed-hearing on their mark-up of the as of yet unpublished FY 2019 Intelligence Authorization Act. The draft is not publicly available and, of course, the good stuff will be in the classified annex to the bill.

TWIC Reader Rule

On Wednesday the Senate Commerce, Science, and Transportation Committee will hold a mark-up hearing on eight bills, including S 3094. The text of that bill has not yet been published by the GAO, but it sounds like it should be a companion bill to HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. After having reviewed the Coast Guard NPRM on their proposed selective delay of the implementation of the TWIC Reader Rule, it seems unlikely that the two legislative delay attempts and the CG delay are very closely related to the same issues.

On the Floor

In addition to the two spending bills on the floor this week, we will also see the House take up two bills of potential interest to readers of this blog. Later today the House will consider HR 5081, the Surface Transportation Security and Technology Accountability Act of 2018, and HR 5733, the DHS Industrial Control Systems Capabilities Enhancement Act of 2018. Both bills will be taken up under the suspension of the rules provisions. This means limited debate and no floor amendments. It also means that the leadership expects serious bipartisan support for both bills since a super-majority is required for passage.

The House is also scheduled to take up a motion to go to conference on HR 5515, the FY 2019 DOD authorization bill, that passed in the Senate last week.

Committee Marks-Up Homeland Security Bills

Yesterday the House Homeland Security Committee met to mark-up 10 pieces of legislation. Two of those bills deal with topics of specific interest to readers of this blog; industrial control system security (HR 5733) and Transportation Workers Identification Credentials (TWIC; HR 5729). Both bills were amended and then adopted by unanimous consent.

ICS Security

Rep. Langevin (D,RI) proposed the single amendment to HR 5733. It added a new subparagraph to the proposed amendment to 6 USC 148 that outlines the responsibilities of the National Cybersecurity and Communications Integration Center (NCCIC) to address industrial control system security issues. The new sub-paragraph reads:

“(4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, and other industrial control systems stakeholders; and”

TWIC Reader Rule Delay

Rep. Jackson-Lee (D,TX) proposed the single amendment to HR 5729. The amendment added an ‘every 90-day’ reporting requirement on the status of the continued delays in the DHS implementation requirement to conduct an evaluation of the efficacy of the TWIC program. That delay is the underlying reason for delaying the implementation of the TWIC Reader Rule.

Moving Forward

The ‘unanimous consent’ provided for the adoption of both of these bills (as amended) is a strong measure of the bipartisan support they have in Committee. This means that they will probably be taken up by the whole House under the suspension of rules provision with no further amendments and they will certainly receive the super-majority required to pass bills under those provisions. The only question now is when they will make it to the floor of the House.

Commentary

The new language added to HR 5733 certainly affirms the current activities of the ICS-CERT to coordinate and publish industrial control system security alerts and advisories. The lack of a formal definition of ‘industrial control system’ beyond the vague “including supervisory control and data acquisition systems” {new §148(f)(1)} does nothing to affirm the ICS-CERT responsibility for activity for medical devices or transportation systems which are arguably not ‘industrial’.

As I noted in my post about the introduction of this bill, HR 5733 would have been an ideal place to deal with the IT-centric definition of ‘information systems’ and to provide a proactive definition of ‘industrial control system’ that could be used throughout DHS. Unfortunately, the lack of such action yesterday almost ensures that this bill will not be the vehicle for establishing that definition.

Committee Hearings – Week of 06-03-18

This week with both the House and Senate back from their extended Memorial Day Weekend spending bills will be the major topic on the Hill. There will also be two other hearings of potential interest to readers of this blog. The first will be a committee markup of a number of homeland security related bills. The second will be a hearing dealing with drone defense and S 2836.

Spending Bills

In addition to the Rules Committee hearings and floor consideration of HR 5895 that I mentioned in an earlier post, there will be some additional spending bills marked up this week:

• Tuesday – Senate – Subcommittee - Transportation, Housing and Urban Development (THUD), and Related Agencies;

• Tuesday – Senate – Subcommittee - Military Construction, Veterans Affairs, and Related Agencies;

• Wednesday – House – Committee - Interior, Environment, and Related Agencies;

• Thursday – House – Subcommittee – DOD;

• Thursday – Senate- Committee – THUD;

Markup Hearing

On Wednesday the House Homeland Security Committee will be holding a markup hearing to look at 10 bills. Of those, three may be of specific interest to readers of this blog:

• HR 5733, the DHS Industrial Control Systems Capabilities Enhancement Act of 2018;

• HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018; and

• HRes 898 Directing the Secretary of Homeland Security to transmit certain documents to the House of Representatives relating to Department of Homeland Security policies and activities relating to homeland security information produced and disseminated regarding cybersecurity threats posed by the ZTE Corporation, headquartered in Shenzhen, China.

The resolution is effectively a subpoena to be issued by Congress. It was introduced by Rep. Thompson (D,MS). It is a straightforward listing of the types of documents that Thompson expects to be provided by DHS without any of the politically loaded ‘Congressional findings’ that frequently accompany such documents. Practically speaking, since Thompson is the Ranking Member of the Committee, he should be influential enough in his own right to have this resolution considered by the Committee, but I suspect that there will be at least some bipartisan support for the resolution.

Drone Defense

On Wednesday the Senate Homeland Security and Governmental Affairs Committee will hold an informational hearing on S 2836 and Countering Malicious Drones. The witness list includes:

• David J. Glawe, Department of Homeland Security;

• Hayley Chang, Department of Homeland Security;

• Scott Brunner, Federal Bureau of Investigation; and

• Angela H. Stubblefield, Federal Aviation Administration

This hearing will be focused on policy and the legal aspects of counter-drone operations. I suspect that the witnesses will be generally supportive of S 2836, but it will be informative looking at how down into the weeds they get into the legal aspects.

I am glad to see Chairman Johnson holding this type of hearing before moving to a markup of his bill. I think that it would also be helpful if the Committee held a hearing looking at the types of technology currently available to conduct counter-drone operations.

HR 5729 Introduced – TWIC Reader Rule Delay

Earlier this month Rep. Katko (R,NY) introduced HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. The bill would delay implementation of the TWIC Reader Rule, which is due to become effective on August 23^rd, 2018. The delay would extend until after report to Congress was made that is required by the Transportation Security Card Program Assessment Act (PL 114-278).

Reports to Congress

The earlier act required DHS to commission a study by a “research organization with

significant experience in port or maritime security” {§1(b)(2)} that would include an assessment of the efficacy of the TWIC program. That assessment was to have included a review of {§1(b)(3)}:

• The credentialing process;

• The process for renewing applications; and

• The security value of the program.

The original version of HR 710 included language {§2(f)} that would have delayed implementation of the TWIC Reader Rule until the reports required by the bill had been submitted to Congress. That language was removed in a last minute amendment to the bill when it was passed by the Senate in the closing hour of the 114^th Congress.

Moving Forward

Katko is the Chair of the Transportation and Protective Security Subcommittee of the House Homeland Security Committee, one of the two committees to which this bill was assigned for consideration. He is also a member of the House Transportation and Infrastructure Committee, the other committee to which the bill was assigned. This means that he should have sufficient influence to have the bill considered in at the very least the Homeland Security Committee. And the bill does have bipartisan leadership sponsorship; Rep. McCaul (R,TX), Rep. Jackson-Lee (D,TX) and Rep. Richmond (D,LA).

The main issue here is the short time frame for the passage of this bill for it to be effective. It has been four weeks since this bill was introduced and there has been no committee (or even subcommittee) action on the bill. We have one month left before the currently scheduled summer recess. If action is not taken during that time (and the schedule is already busy with spending bills and nominations) the TWIC Reader Rule is scheduled to go into effect during that recess.

It seems unlikely that this bill would get the abbreviated treatment that HR 710 got in the Senate (no debate and no vote). There was obviously some objection in the Senate to the language requiring the stay of the implementation of the rule that held up consideration of HR 710 until the last minute in that body. That objection is unlikely to have changed.

There is, however, some possibility that the effective deadline for the passage of this bill could slip. DHS has submitted a rulemaking to OMB to delay the implementation of the TWIC Reader Rule. The details of that rule, including the reasons for change and the revised implementation date, are not publicly available. It is unclear whether such a rulemaking could be completed in time to avoid the August implementation date, though it is unlikely that affected industries would object to the delay.

Bills Introduced – 05-09-18

Yesterday with both the House and Senate in session there were 43 bills introduced. Of these, two may be of specific interest to readers of this blog:

HR 5729 To restrict the department in which the Coast Guard is operating from implementing any rule requiring the use of biometric readers for biometric transportation security cards until after submission to Congress of the results of an assessment of the effectiveness of the transportation security card program. Rep. Katko, John [R-NY-24]

HR 5733 To amend the Homeland Security Act of 2002 to provide for the responsibility of the National Cybersecurity and Communications Integration Center to maintain capabilities to identify threats to industrial control systems, and for other purposes. Rep. Bacon, Don [R-NE-2]

The Transportation Workers Identification Credential (TWIC) reader rule was adopted in 2016 with an implementation date of August 23, 2018. With the Coast Guard having submitted a rule to delay the implementation of that rule and now this bill being introduced it would seem that the regulated community seems to be having some problems with the implementation. Katko is the Chair of the Transportation and Protective Security Subcommittee of the House Homeland Security Committee. It will be interesting to see how fast this bill is considered in that Subcommittee. It will have to be quick (next week?) if HR 5729 is to be effective.

I am really looking forward to seeing the text of HR 5733 for two reasons. First I am hoping to see an effective definition of control system that can be used in this and subsequent cybersecurity legislation. Second, since this looks to be an authorization bill, it will be interesting to see if ICS-CERT is specifically mentioned.