Review – HR 2594 Introduced – Water Risk and Resilience Organization

Last month Rep Crawford (R,AR) introduced HR 2594 (no fancy name). The bill would require the EPA to craft regulations providing for the certification of an independent Water Risk and Resilience Organization (WRRO) seemingly similar to NERC in the electric sector. The bill would authorize $10 million dollars to initially fund the WRRO.

The bill is very similar to HR 7922 introduced by Crawford in April of 2024. No action was taken on that bill in the 118^th Congress. There are a large number of editorial changes made in this latest version of the bill that have little or no impact on the legislative intent.

Moving Forward

Crawford is a member, as is his sole cosponsor {Rep Duarte (R,CA)}, of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration. This means that there may be sufficient influence to see it considered in Committee. I expect that any number of small communities are going to pressure their representatives to oppose this legislation as it would end up increasing the costs of maintaining their water systems. Many mid to large size water systems will also object, again because of funding issues. I suspect that there will be significant bipartisan opposition to this bill based upon those objections.

I do not expect this bill to move forward, especially since there is no cosponsor on the House Energy and Commerce Committee, to which this bill has been assigned for secondary consideration. That Committee is well known for guarding their prerogatives when they have even limited oversight responsibilities.

Commentary

The change from an annual funding authorization to a single funding amount (…“$10,000,000 to remain available to the WRRO until expended.”) better reflects the fact that §1(h) firmly establishes that the “The WRRO is not a department, agency, or instrumentality of the United States Government.” The only other funding source for the WRRO provided for in this bill is the retention of the of the penalties by the WRRO for any enforcement actions taken by the organization. This would seem to ensure that the WRRO would be quick to undertake formal enforcement actions rather that work with water agencies to increase their resilience to cybersecurity risks. This could be problematic for the vast majority of covered water systems that are smaller systems financed by local governments agencies. An annual funding mechanism, while certainly an anathema to the current Republican controlled congress, could help to ensure that the focus of the WRRO is more on helping these smaller water agencies than on collecting penalties.

 

For more information on this provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2594-introduced-water-risk-and - subscription required.

Review - HR 7922 Introduced – Water Risk and Resilience Organization

Earlier this month, Rep Crawford (R,AR) introduced HR 7922 (no fancy name). The bill would require the EPA to craft regulations providing for the certification of an independent Water Risk and Resilience Organization (WRRO) seemingly similar to NERC in the electric sector. The bill would authorize $5 million per year through 2025 to establish the WRRO.

Moving Forward

Crawford is a member, as is his sole cosponsor {Rep Duarte (R,CA)}, of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration. This means that there may be sufficient influence to see it considered in Committee. I expect that any number of small communities are going to pressure their representatives to oppose this legislation as it would end up increasing the costs of maintaining their water systems. Many mid to large size water systems will also object, again because of funding issues. I suspect that there will be significant bipartisan opposition to this bill based upon those objections. I do not expect this bill to move forward, especially since there is no cosponsor on the House Energy and Commerce Committee, to which this bill has been assigned for secondary consideration. That Committee is well known for guarding their prerogatives when they have even limited oversight responsibilities.

Commentary

This attempt to move cybersecurity oversight of water systems out from under the direct control of the EPA is fraught with problems. The first is funding; the two-year $5 million authorization under the bill is a pittance compared to what it is going to need to establish and operate an organization with this level of oversight. Again, based upon the NERC model, the crafters expect the WRRO to be funded from dues and fees from the covered water systems. Those fees will come on top of the costs of implementing the new cybersecurity requirements established by the WRRO. Since the vast majority of these systems are small, municipal-controlled systems, they are going to have a hard time funding required cybersecurity upgrades, much less the dues and fees assessed by the WRRO.

On a side note, this idea has some support in the water sector. In fact, the idea traces back at least as far as the American Water Works Association. You can see a brief look at their interpretation of the idea in an article on ACSH.org from May of last year. Needless to say, the AWWA will almost certainly support this bill.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-7922-introduced - subscription required.

Bills Introduced – 4-10-24

Yesterday, with both the House and the Senate in session, there were 48 bills introduced. One of those bills may receive additional coverage in this blog:

HR 7922 To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector. Crawford, Eric A. "Rick" [Rep.-R-AR-1]

I will be watching this bill for language and definitions that specifically include cybersecurity risk in the scope of the coverage of the bill.