HR 2271 – Electric Grid Security

Last week Rep. Latta (R,OH) introduced HR 2271, the Critical Electric Infrastructure Protection Act. In many ways this bill takes the ideas introduced in S 1068 and expands them to cover threats other than just cybersecurity threats. In fact, this new bill does not specifically mention the term ‘cybersecurity threats’.

Definitions

This bill would also amend Part II of the Federal Power Act (16 USC Chapter 12 Subchapter II), adding a new section. Where the earlier bill defined ‘cyber security threats’, this new bill provides predictable definitions for the following terms (new §215A(a)}:

∙ Critical electric infrastructure;

∙ Critical electric infrastructure information;

∙ Defense critical electric infrastructure;

∙ Electromagnetic pulse;

∙ Geomagnetic storm; and

∙ Grid security emergency.

The critical definition for this bill is ‘grid security emergency’. This is defined as either:

A “malicious act using electronic communication or an electromagnetic pulse, or a geomagnetic storm event, that could disrupt the operation of those electronic devices or communications networks, including hardware, software, and data, that are essential to the reli1ability of the bulk-power system or of defense critical electric infrastructure” {new §215A(a)(7)(A)(1)}; or

A “direct physical attack on the bulk-power system or on defense critical electric infrastructure” {new §215A(a)(7)(B)(1)}.

The definition also specifically includes the results of such acts or attacks.

Authority to Act

The new §215A(b) then goes on to provide the Secretary of Energy the authority to take emergency actions “as are necessary in the judgment of the Secretary” {new §215A(b)(1)} to protect the reliability of the bulk power system or defense critical electric infrastructure when the President identifies a grid security emergency in writing. Emergency orders under this provision may apply to {new §215A(b)(4)}:

∙ The Electric Reliability Organization;

∙ A regional entity; or

∙ Any owner, user, or operator of the bulk-power system or of defense critical electric infrastructure within the United States.

Such emergency authority and resulting orders will expire after 30 days. The Secretary, upon notification by the President that the grid security emergency continues, may extend the emergency actions for 30 days at a time. Unlike S 2068, there is no 90 day limit on those extensions.

As part of this emergency authority, the Secretary (and other ‘appropriate Federal agencies’) are required to provide temporary access to classified information related to the grid security emergency to any “key personnel of any entity subject to such emergency measures to enable optimum communication between the entity and the Secretary and other appropriate Federal agencies regarding the grid security emergency” {new §215A(b)(7)}.

Critical Electric Infrastructure Information

Section 215A(d) officially establishes Critical Electric Infrastructure Information (CEII) as controlled unclassified information (CUI, though the term is not actually used in the legislation) that is exempt from disclosure under Federal and State freedom of information laws. It requires the Secretary to establish regulations to provide for the appropriate protection of such information. Under the new rules being developed by the National Archives and Records Administration (NARA) this would move CEII out of the ‘Basic’ CUI classification and into the ‘Specified’ CUI category allowing the Secretary to establish the rules for protecting and sharing the information.

Moving Forward

Rep Latta is a relatively senior member of the Energy and Power Subcommittee of the House Energy and Commerce Committee. Rep. McNerney (D,CA) is a co-sponsor and the second highest ranking Democrat on the same subcommittee. Between the two of them they probably have enough pull to get this bill considered in the Subcommittee. Whether or not it will move forward from there depends on who else they can get on the bandwagon.

This bill would probably pass in both the House and Senate if it ever got to the floor. There is really nothing new here, it just legalizes and requires the establishment of a regulatory structure to allow the emergency actions that would take place in any case under the President’s executive powers under the Constitution.

It does look like this bill is being considered for inclusion in a larger bill. This would be the bill that I briefly discussed this morning as being the topic for tomorrow’s Energy and Power Subcommittee hearing. If that does happen this bill would be left hanging unless something happened to stop that new bill from proceeding.

S 1068 Introduced – Bulk Power Cybersecurity

Three weeks ago Sen Risch (R,ID) introduced S 1068 which would amend Part II of the Federal Power Act (16 USC 824 et seq) to give the Secretary of Energy specific authority over the cybersecurity of portions of the bulk power system.

The bill would add a new section (§224) to that statute. First it adopts two definitions (‘bulk power system’ and ‘Electric Reliability Organization’) from the existing statute {§824o(a)(1)} and then it provides a definition of a new term ‘cyber security threat’:

“The imminent danger of a malicious act that disrupts, attempts to disrupt, or poses a significant risk of disrupting the operation of programmable electronic devices or communications networks (including hardware, software, and data) essential to the reliable operation of the bulk-power system” {new §224(a)(2)}.

The bill would then provide the Secretary with the authority to “require, by order and with or without notice, any entity that owns, controls, or operates a bulk-power system facility to take such actions as the Secretary determines will best avert or mitigate the cyber security threat” {new §224(b)(1)}. That authority would be predicated on receiving a written finding from the President that “immediate action is necessary to protect the bulk-power system from a cyber security threat”.

The order could only be issued for a period of 30 days and the bill provides for procedures for up to two 30-day extensions of an order.

Moving Forward

Risch is the Chair of the Energy Subcommittee of the Senate Energy and Natural Resources Committee. Typically this means that this bill will likely be considered by that Committee in the near future. The bill is co-sponsored by Sen. Heinrich (D,NM) who is also a member of the Subcommittee (but not Ranking Member) so there does appear to be at least some bipartisan support for the bill. The 30-day limit on orders may assuage concerns of the bulk power community enough to allow this bill to make it to the floor of the Senate.

With all of the public foofaraw about cybersecurity vulnerabilities, particularly in the electric sector, I suspect that this bill would be able to be passed in the Senate and House. There is a remote possibility of this passing by unanimous consent, but that would depend on what changes the utilities would like to see made to this bill and if those changes were made in committee.

Commentary

 I’m not sure what changes could be made in a 90-day period that would adequately mitigate a ‘cyber security threat’. If an actual cyber attack had shut down a significant portion of the grid, I think that there is probably enough authority in place to respond to the situation and this added authority would not add anything to the adequacy of that response.

It is interesting, however, that the first thing described as being disrupted in the definition of ‘cyber security threat’ is “the operation of programmable electronic devices”. It is well understood in the cybersecurity community that a large number (if not most) of the PLCs in use in industrial control systems are specifically vulnerable to reprogramming by anyone that can gain access to the network on which they operate.

If we ascribe more technical knowledge than normal to the congressional staff that crafted this rather short bill (or the outside ‘consultant’ that pushed for the crafting) then a suspicious person might think that there could be a move made by DOE to require the replacement of all (more likely a specific sub-set) of the vulnerable by design PLCs with more modern and secure versions.

I don’t think that I am quite that paranoid, but I know enough people who are that the thought did cross my mind. If the authority had been given to DHS I would have dismissed this out of hand for lack of technical skills (outside of the relatively insignificant ICS-CERT; small size and out of regulatory loop) to require such a move. DOE, on the other hand, is much more technically oriented and may just have the technical and regulatory skills to pull of such a mandate.

Bills Introduced – 04-23-15

Yesterday a total of 79 bills were introduced in the House and Senate. Of those, only two were of potential specific interest to readers of this blog:

HR 1987 To authorize appropriations for the Coast Guard for fiscal years 2016 and 2017, and for other purposes Rep. Hunter, Duncan D. [R-CA-50]

S 1068 A bill to amend the Federal Power Act to protect the bulk-power system from cyber security threats. Sen. Risch, James E. [R-ID] 

As in recent years, I don’t really expect to see much about chemical facility security or maritime chemical transportation in HR 1987. But you never can tell….

Since NERC has already promulgated cybersecurity requirements it will be interesting to see what ‘new’ requirements S 1068 will add.