Committee Hearings Week of 9-25-22

This week with both the House and Senate in session (and the FY spending deadline approaching quickly), there is a relatively light hearing schedule, particularly on the House side of the Hill. We do have a markup hearing of interest, and a hearings on UAS integration.

Homeland Security Markup

The Senate Homeland Security and Governmental Affairs Committee will be holding a business meeting today. It will include nine nomination votes, 22 pieces of legislation and four facility naming bills. Of particular interest here:

S ___, Strengthening Agency Management and Oversight of Software Assets Act of 2022,

S 4913, Securing Open Source Software Act of 2022,

S 4882, Fire Grants and Safety Act,

S ___, Protecting the Border from Unmanned Aircraft Systems Act,

HR 7777, Industrial Control Systems Cybersecurity Training Act,

HR 6824, President’s Cup Cybersecurity Competition Act, and

HR 6873, Bombing Prevention Act of 2022

UAS Integration

The Subcommittee on Aviation Safety, Operations and Innovation of the Senate Commerce, Science, and Transportation Committee will be holding a hearing on “FAA Reauthorization: Integrating New Entrants into the National Airspace System”. The witness list includes:

• Lisa Ellman, Commercial Drone Alliance,

• Gregory Davis, Eviation,

• Stephen P. “Lux” Luxion, FAA Center of Excellence for Unmanned Aircraft Systems (ASSURE),

• Stéphane Fymat, Honeywell Aerospace, and

• Edward M. Bolen, National Business Aviation Association

Counter drone operations may come up in the discussion.

On the Floor

The 900-lb gorilla this week is the spending bill, or rather a continuing resolution that ‘must’ pass by midnight on Friday. A weekend final vote is not beyond possible.

The House is scheduled to take up 32 bills in this short week under the suspension of the rules process. With spending bill pending, we can expect Republican bomb throwers to demand votes on many if not most of these bills, just to gum up the process. Bills of potential interest here include:

• S 4900 – SBIR and STTR Extension Act of 2022,

• HR 8956 – FedRAMP,

HR 7777 Passed in House – ICS Cybersecurity Training

Yesterday, the House took up on HR 7777, the Industrial Control Systems Cybersecurity Training Act. The bill was considered under the suspension of the rules process and passed by a mostly bipartisan vote of 368 to 47. The debate in the House was quick, just about 10 minutes. Nary a word was heard in opposition to the bill.

As I noted yesterday, this bill just authorizes the current training programs conducted by CISA.

The bill now goes to the Senate. It is unlikely to be considered under regular order, it is not important enough to take up the time for that process. The bill might be able to be considered under their unanimous consent process, but the fairly large vote against it in the House argues against that. It is more likely to be considered as an amendment to a spending or authorization bill.

The House also took up HR 7174, the National Computer Forensics Institute Reauthorization Act of 2022, under the suspension process. A vote was also demanded and may take place today.

Committee Hearings – Week of 6-19-22

This week, with both the House and Senate in session and the Summer Recess deadline approaching, there is a moderately heavy hearing schedule. The House Armed Services Committee will markup their FY 2023 NDAA. The House is pushing ahead with spending bill markups while there are still budget hearings being held (including a bunch of closed intel agency hearings). There will also be a hearing looking at the cybersecurity of new technologies. Finally, there are a couple of cybersecurity bills scheduled for consideration in the House.

FY 2023 Spending Bill Markups

Tuesday – House – IER – Subcommittee,

Tuesday – House – EWD – Subcommittee,

Wednesday – House – State – Subcommittee,

Wednesday – House – CJS – Subcommittee,

Thursday – House – ARD – Subcommittee,

Thursday – House – THUD – Subcommittee,

Thursday – House – LHH – Subcommittee, and

Friday – House – DHS & Legislative – Full Committee

Cybersecurity Hearing

On Wednesday, the Cybersecurity, Infrastructure Protection, & Innovation Subcommittee of the House Homeland Security Committee will hold a hearing on “Securing the Future: Harnessing the Potential of Emerging Technologies While Mitigating Security Risks”. The witness list includes:

• Andrew Lohn, Georgetown University,

• Charles Robinson, IBM,

• Ron Green, Mastercard, and

• Rob Strayer, Information Technology Industry Council (ITI)

This looks like it will be concentrating on quantum technology, so I do not expect to hear much about control system security.

On the Floor

The House is scheduled to take up eleven bills today under the suspension of the rules process. They include two cybersecurity bills that I briefly discussed yesterday:

• HR 7777 – Industrial Control Systems Cybersecurity Training Act, as amended, and

• HR 7174 – National Computer Forensics Institute Reauthorization Act of 2022, as amended

Both bills are likely to pass with substantial bipartisan support, but Republican bomb-throwers are likely to demand recorded votes in their continuing campaign to slow the legislative process.

To be clear there are ‘bomb-throwers’ on both sides of the aisle. This is not a dig against Republicans in general. After all, I was a Goldwater Republican in ’64 and a member of the California Republican Assembly in 1972.

HR 7777 Reported in House – ICS Cybersecurity Training

Last week the House Homeland Security Committee published their report on HR 7777, the Industrial Control Systems Cybersecurity Training Act. The Committee considered the bill last month and ordered the bill reported favorably without amendment. The House is scheduled take up the bill on Tuesday under the suspension of the rules process. This means limited debate, no floor amendments, and requires a super majority for passage. The House leadership expects the bill to pass with strong bipartisan support.

The Report includes an interesting discussion about the differences between IT and OT cybersecurity training needs (pg 2):

“While cybersecurity education is often focused on information technology (IT), there are unique skills required to secure ICS as it relies on both IT and operational technology (OT) that, if exploited, could result in material harm, including loss of life, and significant economic damage. In contrast to IT cybersecurity, which prioritizes ensuring confidentiality, integrity, and availability of data, ICS cybersecurity prioritizes safety, reliability, and functionality of systems. Because those working in ICS cybersecurity must understand how technology impacts industrial operations, there are additional types of training required. According to a group of industrial cybersecurity experts convened by Idaho National Laboratory and Idaho State University, there are six industrial cybersecurity knowledge domains that are not included in traditional cybersecurity education: industrial operations, instrumentation and control equipment, communications, safety, and regulation. Expanded Federal support for ICS cybersecurity training would ensure more workers have the necessary, specialized skills to protect ICS.”

The Committee Report also includes the mandatory Congressional Budget Office report on the costs associated with the bill. That CBO report notes that (pg 5):

“CISA already provides cybersecurity training courses for critical infrastructure operators; thus, the bill would codify those responsibilities and would not impose any new operating requirements on the agency. CBO estimates that implementing H.R. 7777 would cost less than $500,000 over the 2022–2027 period to prepare and deliver the required reports; such spending would be subject to the availability of appropriated funds.”

HR 7777 Adopted in Homeland Security Committee – ICS Training

Yesterday, the House Homeland Security Committee held a business meeting where five DHS related bills were considered, including HR 7777, the Industrial Control Systems Cybersecurity Training Act. Without amendment, the bill was ordered favorably reported by a voice vote. Once the Committee report is published, this bill will be cleared for consideration by the Whole House. The bill will almost certainly be taken up there under the suspension of the rules process. It will likely pass with strong bipartisan support.

This bill would amend the Homeland Security Act of 2002 to establish within CISA an Industrial Control Systems Cybersecurity Training Initiative. No new funding is authorized in the bill. This, in effect, authorizes the long-standing ICS training program is CISA.

Review – HR7777 Introduced – ICS Training

Earlier this week, Rep Swalwell (D,CA) introduced HR 7777, the Industrial Control Systems Cybersecurity Training Act. The bill would amend the Homeland Security Act of 2002, adding a new §2220D that would establish within CISA an Industrial Control Systems Cybersecurity Training Initiative. No new funding is authorized in the bill.

Moving Forward

Swalwell is a member of the House Homeland Security Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see this bill considered in Committee. I see nothing in this bill that would engender any organized opposition. I suspect that the bill would receive substantial bipartisan support in Committee. The bill would likely pass in the House after consideration under the suspension of the rules process.

Commentary

This bill is another example of Congress authorizing a long-standing program run by the executive branch and taking credit for the idea. The description of the Industrial Control Systems Cybersecurity Training Initiative provided in §2220D(b) could have been taken from the CISA ICS training web page that I described (subscription required) on Tuesday. And the fact that the in person classes are held at DOE’s Idaho National Laboratory certainly fits with the requirements of §2220D(b)(2)(A).

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr7777-introduced - subscription required.

Bills Introduced – 5-16-22

Yesterday, with both the House and Senate in session, there were 33 bills introduced. One of those bills will receive future coverage in this blog:

HR 7777 To amend the Homeland Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency to establish an industrial control systems cybersecurity training initiative, and for other purposes. Rep. Swalwell, Eric [D-CA-15] 

I am hoping that the ‘training initiative’ is something more than just authorizing the current CISA ICS training programs, but I am not holding my breath.