Showing posts with label HR 7203. Show all posts
Showing posts with label HR 7203. Show all posts

Tuesday, July 7, 2020

HR 7203 Introduced – GRID Act


Last month Rep Crow (D,CO) introduced HR 7203, the Guaranteeing Resilient Installations for Defense (GRID) Act of 2020. The bill would require DOE to carry out a pilot program on the implementation of mitigating actions to address vulnerabilities to defense critical electric infrastructure. The bill would also modify the definition of the term ‘defense critical electric infrastructure’ in 16 USC 824o-1.

Pilot Program


Section 2 of the bill requires DOE (in consultation with DOD and the affected Service Secretaries) to “carry out a two-year pilot program under which the Secretary shall implement mitigating actions to address vulnerabilities assessed under” {§2(a)} §824o-1. The GAO is required to conduct a review of the pilot program within 2 years of this bill being adopted.

The bill provides authorization for the spending of $25 million to support this pilot program.

The current language of §824o-1 does not include any language requiring vulnerability assessment. Section 3(2) of the bill addresses this by modifying the current language in §824o-1(c) to read:


Definition Change


Section 3(1) of the bill makes the following revisions to the definition of ‘defense critical electric infrastructure’ in §824o-1(a)(4):

“The term ‘defense critical electric infrastructure’ means any electric infrastructure located in any of the 48 contiguous States or the District of Columbia State that serves a facility designated by the Secretary pursuant to subsection (c), but is not owned or operated by the owner or operator of such facility.”

Moving Forward


Crow and his Republican cosponsor {Rep Bacon (R,NE)} are both members of the House Armed Services Committee (one of the two committees to which this bill was assigned for consideration) and Crow is Vice Chair of the Subcommittee on Intelligence and Emerging Threats and Capabilities. It is likely that there is enough influence here to have this bill considered favorably in this Committee. The third cosponsor {Rep Peters (D,CA)} is an influential member of the House Energy and Commerce Committee, the other committee to which this bill was assigned.

The only potential draw back to this bill being considered favorably in the House is the $25 million authorization. This is a relatively small authorization, but the money will have to come from somewhere. This may not be a fatal draw back for this bill.

I would not be surprised to see this bill (or similar language) find it way into either a DOE authorization bill or the House version of the NDAA.

Commentary


There are two minor problems with the changes that this bill makes to §824o-1. First the way the change was made to the definition of the term ‘defense critical electric infrastructure’ would mean that there would no longer be any such infrastructure in the District of Columbia. I suppose that there would be some people in DOD that would like to see the Puzzle Palace removed from such designation, but I do think that it would be counter-productive. The deleted language should be changed from “of the 48 contiguous States or the District of Columbia” to “of the 48 contiguous States”.

The second change is the change in §824o-1(c). As is currently written, paragraph (c) is the requirement for DOE to designate ‘‘defense critical electric infrastructure’. This designation requirement is referred to in various places in the Section. The change in this bill would effectively remove that designation requirement.

Since the initial designations under this section have already been made, I would suggest that the revision established in this bill should change (c) to read:

(c) Designation of critical defense facilities
(1) Not later than 180 days after December 4, 2015, the The Secretary, in consultation with other appropriate Federal agencies and appropriate owners, users, or operators of infrastructure that may be defense critical electric infrastructure, shall identify and designate facilities located in the States and the District of Columbia that are—
(A) critical to the defense of the United States; and
(B) vulnerable to a disruption of the supply of electric energy provided to such facility by an external provider.
(2) The Secretary may, in consultation with appropriate Federal agencies and appropriate owners, users, or operators of defense critical electric infrastructure, periodically revise the list of designated facilities as necessary.
(3) Not later than 180 days after this section is adopted, the Secretary , in consultation with other appropriate Federal agencies and appropriate owners, users, or operators of infrastructure that may be defense critical electric infrastructure, shall identify, designate, and mitigate vulnerabilities at facilities that are designated in (1) above. [corrected paragraph numbering, 7-7-20 11:15 EDT]



Tuesday, June 16, 2020

Bills Introduced – 6-15-20


Yesterday with the Senate in Washington and the House meeting in pro forma session there were 56 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 7203 To direct the Secretary of Defense to carry out a pilot program on the implementation of mitigating actions to address vulnerabilities to defense critical electric infrastructure, and for other purposes. Rep. Crow, Jason [D-CO-6]

HR 7214 To authorize appropriations to the Department of Transportation for surface transportation research, development, and deployment, and for other purposes. Rep. Johnson, Eddie Bernice [D-TX-30]

I will be watching HR 7203 for control system security language and HR 7214 for autonomous vehicle security research language.

NOTE: A press report last Friday indicated that Sen. Peters had introduced on that date two pieces of cybersecurity legislation. I commented yesterday on TWITTER that neither bill had been introduced Friday and would probably be introduced today. It obviously did not happen today either, so I went back and did some more checking. The bills were apparently (the bill name that Peters quoted in his press release are not included on the initial introduction description) introduced on Wednesday, S 3928 and S 3929. I reported the introduction of S 3929 but not S 3928 because the description provided made no reference to ‘cybersecurity’, I will now be watching for the publication of that bill as well.

 
/* Use this with templates/template-twocol.html */