Review - HR 8775 Introduced – CI Contingency Plan

Back in June, Rep Crenshaw (R,TX) introduced HR 8775, the Contingency Plan for Critical Infrastructure Act. The bill would require CISA to submit to Congress a “joint sector-by-sector assessment on the ability of critical infrastructure owners and operators to operate critical systems in a manual operating mode during cyber incidents.” It would also require FEMA to update their “Planning Considerations for Cyber Incidents” last published November 7^th, 2023. No new funding is authorized by this legislation.

Moving Forward

While Crenshaw is not a member of the House Homeland Security Committee to which this bill was assigned for primary consideration, his sole cosponsor {Rep Magaziner (D,RI)}, is a member. This means that there may be sufficient influence to see the bill considered in Committee. I suspect that a number of process manufacturing and distribution organizations would object to the government suggesting that they should be able to switch to manual operation in the event of a cyberattack. That opposition will ultimately result in pressure on members to oppose the bill. While this is not a partisan issue, I do not expect to see sufficient support in Committee to move this bill forward.

Commentary

With the increase in attacks on operational control systems, and a larger increase in the number of instances where cyberattacks on business assets results in preventative shutdowns in those control systems, it would seem obvious that organizations should want to be able to switch to some sort of system control that does not rely on vulnerable automated control systems. Unfortunately, the more complex the manufacturing/distribution system is, the wider is the gap between ‘want to’ and ‘able to’ switch to ‘manual operation’. In the most complex systems (petrochemical refineries, for instance), there are certainly not enough trained personnel on site to go back to the old, pre-automation control processes.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-8775-introduced - subscription required.

Bills Introduced – 6-18-24

Yesterday, with the Senate in Washington and the House meeting in pro forma session, there were 67 bills introduced. Two of those bills may receive additional attention in this blog:

HR 8775 To require an assessment on manual operations for critical infrastructure, and for other purposes. Crenshaw, Dan [Rep.-R-TX-2]

S 4572 A bill to direct the Secretary of Commerce, acting through the Assistant Secretary of Commerce for Communications and Information, to conduct a study of the national security risks posed by consumer routers, modems, and devices that combine a modem and router, and for other purposes. Blackburn, Marsha [Sen.-R-TN]

I will be covering HR 8775.

I will be watching S 4572 for language and definitions that would specifically include the consideration of industrial control system in critical infrastructure operations as part of the ‘national security risks’ to be included in the scope of the study required by this bill

Mention in Passing

I would like to mention in passing one space-technology bill introduced yesterday:

HR 8787 To establish a demonstration program for the active remediation of orbital debris and to require the development of uniform orbital debris standard practices in order to support a safe and sustainable orbital environment, and for other purposes. Neguse, Joe [Rep.-D-CO-2] 

As the number of commercial space launches continues to increase, the problem of space debris is going to be an even larger problem as time progresses. It will be interesting to see how the bill intends to fund the demonstration program.