Review - H 3490 Introduced – Smart Water Technology

Last month, Rep Gallego (D,AZ) introduced HR 3490, the Water Infrastructure Modernization Act of 2023. The bill would help upgrade and modernize the drinking water, wastewater, and stormwater systems of the United States and encourage the use of water-efficient technologies to address drought and prepare for the growing strain that population growth and climate change will have on over-allocated water supplies. The bill would authorize $50 million in funding through 2028 to support the programs outlined in the legislation.

The bill is similar in intent to HR 6088 (removed from paywall) which was introduced last session by Gallego. No action was taken in the 117^th Congress on that bill. This current bill is a complete rewrite of the earlier legislation.

Moving Forward

While Gallego is not a member of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration, his sole cosponsor {Rep Duarte (R,CA)} is a member. This means that there may be sufficient influence to see the bill considered in Committee. This is a significant change from the potential for the consideration for HR 6088 in the last session. There will be little organized opposition to the technology supported by this bill, the $50 million (congressional small change) in authorizations are going to cause problems in an environment where the unofficial leadership of the House is trying to drastically cut spending. I will be surprised if this is taken up in Committee and do not expect this bill to come to the floor of the House.

Commentary

As with the earlier bill, there is no mention of protecting all of the smart technology being touted in the bill by cybersecurity measures. With the relatively small amount of money going to these grants, managers are going to try to pack as much tech as possible into their spending, so cybersecurity addons are going to be short shifted. In my post on HR 6088 I suggested cybersecurity language that could be added for the drinking water portion of the bill. I think that language is still appropriate.

 

For more details about the provisions of the proposed legislation, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/h-3490-introduced - subscription required.

Review – S 3282 Introduced - Water Infrastructure Modernization

Last month, Sen Kelly (D,AZ) introduced S 3282, the Water Infrastructure Modernization Act of 2021. This bill provides for two new grant programs to support the modernization of wastewater and drinking water treatment facilities in the United States. HR 6068, with an identical short title, only addresses the drinking water treatment program with identical language to that found in Title II of this bill. This bill would authorize $25 million for each of the two grant programs.

Kelly is a member of the Senate Environment and Public Works Committee to which this bill was assigned for consideration. This means that there may be enough influence to see this bill considered in Committee. Beyond the cost of the two grant programs, I do not see anything in this bill that would engender any specific opposition. If this bill were considered in Committee, there would probably be bipartisan support for the bill.

Commentary

This bill has the same problem that I identified in HR 6088; it provides for the use of advanced controls technology without providing a requirement to protect those systems from cyberattacks. The same language that I proposed for adding to HR 6088 should be added to Title II of this bill. Similar language, see below, should be added to subsection (a) of the proposed §228.

(3) Any program for which a grant is provided under this section will include a comprehensive cybersecurity program to protect the operation of the smart wastewater infrastructure technology funded by the grant. That cybersecurity program will include, as a minimum:

(i) virtual and physical network segmentation separating the smart water infrastructure technology from the business networks of the agency being supported,

(ii) least privilege access controls for the smart water infrastructure networks, including two-factor authentication for remote access, and

(iii) an annual third-party audit of cybersecurity controls, software updates, internal system log reviews and incident response reports.

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3282-introduced - subscription required.

Review - HR 6088 Introduced – Smart Water Infrastructure Grants

Last week, Rep Gallego (D,AZ) introduced HR 6088, the Water Infrastructure Modernization Act. The bill would amend 42 USC 300j–12, State Revolving Loan Funds, by adding a new subsection (u), Smart Water Infrastructure Technology For Drinking Water. It would establish a new grant program for “owners or operators of community water systems for purposes of the planning, design, construction of, and operations training” relating to smart water infrastructure. The bill would authorize $25 million per year through 2027 for the new grant program.

Neither Gallego nor his sole cosponsor {Rep Katko (R,NY)} are members of the House Energy and Commerce Committee to which this bill was assigned for consideration. This means that there is unlikely to be sufficient influence to see this bill considered in Committee. If the bill were considered, I suspect that it would draw bipartisan support and would be able to move to the floor of the House under the suspension of the rules process.

This bill would provide support for smart system technologies, including extensive sensor suites, operational controls and operations management, but there is no mention of any requirement to provide cybersecurity protections for those technologies. Any program that is so dependent on technology for success must have cybersecurity as a key part of the design, implementation and support process. To drive support for that necessity, I would suggest inserting a new paragraph (u)(2):

(2) Any program for which a grant is provided under this section will include a comprehensive cybersecurity program to protect the operation of the smart water infrastructure technology funded by the grant. That cybersecurity program will include, as a minimum:

(i) virtual and physical network segmentation separating the smart water infrastructure technology from the business networks of the agency being supported,

(ii) least privilege access controls for the smart water infrastructure networks, including two-factor authentication for remote access,

(iii) an incident response plan that allows for continued, uninterrupted drinking water delivery service in the event of a system failure due to cyberattack, power failure or foreseeable weather events, and

(iv) an annual third-party audit of cybersecurity controls, software updates, internal system log reviews and incident response reports.

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6088-introduced - subscription required.

Bills Introduced – 11-30-21

Yesterday, with both the House and Senate in session, there were 36 bills introduced. Four of those bills may received additional attention in this blog:

HR 6084 To require the Federal Energy Regulatory Commission to certify an Energy Product Reliability Organization which shall, subject to Commission review, establish and enforce energy product reliability standards, and for other purposes. Rep. Rush, Bobby L. [D-IL-1] 

HR 6088 To amend the Safe Drinking Water Act to authorize grants for smart water infrastructure technology, and for other purposes. Rep. Gallego, Ruben [D-AZ-7]

S 3282 A bill to amend the Federal Water Pollution Control Act and the Safe Drinking Water Act to authorize grants for smart water infrastructure technology, and for other purposes. Sen. Kelly, Mark [D-AZ]

S 3288 A bill to reauthorize and reform the National Telecommunications and Information Administration, and for other purposes. Sen. Wicker, Roger [R-MS] 

I will be watching all four bills for language and definitions that would include control system cybersecurity within the scope of their coverage.

NOTE: I would like to congratulate Rep Gallego and Sen Kelly for continuing the historic tradition of State delegations cooperating to introduce companion legislation in the House and Senate. We do not see much of this type of coordination on the Hill any longer.