Review - HR 3684 Passed in House – FY 2022 Infrastructure Bill

Last Friday the House finally got around to passing HR 3684, the Infrastructure Investment and Jobs Act, by a slightly bipartisan vote of 228 to 206. With the complexity of the bill and the large amounts of money involved, this is a good time to re-look at the cybersecurity provisions in the bill.

The bill includes language from six separate pieces of cybersecurity legislation.

S 914, the Drinking Water and Wastewater Infrastructure Act of 2021, in §50113,

S 1316, the Cyber Response and Recovery Act of 2021, in §70601,

S 1400, the PROTECT Act of 2021, in §40123,

S 2199, the Cyber Sense Act of 2020, in §40122,

S 2585, the State and Local Cybersecurity Improvement Act, in §70611, and

HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act, in §40121.

It also contains two new standalone cybersecurity provisions in the Energy Division of the bill. Additional (over the current annual spending) cybersecurity spending is authorized for four agencies of the federal government. Finally, there are 23 separate instances where cybersecurity mentions are made in other provisions of the bill

For more details about those provisions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-3684-passed-in-house - subscription required.

 

Review – S 1400 Introduced – PROTECT Act of 2021

Back in March, Sen Murkowski (R,AK) introduced S 1400, the Protecting Resources on The Electric grid with Cybersecurity Technology (PROTECT) Act of 2021. The bill would provide energy cybersecurity investment incentives and establish a grant and technical assistance program for cybersecurity investments. The language is virtually identical to S 2556 that was introduced in the 116^th Congress and reported in the Senate.

Section 2 of the bill would amend the Federal Power Act by adding a new §219A, Incentives for Cybersecurity Investments. The bill would require the Federal Energy Regulatory Commission (FERC) to “conduct a study to identify incentive-based, including performance-based, rate treatments for the transmission of electric energy subject to the jurisdiction of the Commission that could be used to encourage” investment by public utilities in advanced cybersecurity technology.

One year after the study was completed the bill would require FERC to establish a rule providing for “incentive-based, including performance-based, rate treatments for the transmission of electric energy in interstate commerce by public utilities for the purpose of benefitting consumers by encouraging” the same investments and participation described above.

Finally, the bill would require DOE to establish the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program to “to provide grants and technical assistance to, and enter into cooperative agreements with, eligible entities to protect against, detect, respond to, and recover from cybersecurity threats.” The bill would authorize $50 million dollars per year thru 2026 for the grant program.

Murkowski and three of her cosponsors {Sen Manchin (D,WV), Risch (R,ID), and King (I,ME)} are all members of the Senate Energy and Natural Resources Committee to which this bill was assigned for consideration. Between them (especially considering that Manchin is the Committee Chair) they certainly have enough influence to see the bill considered in Committee. I expect that this bill (as did S 2556 last session) would receive strong bipartisan support in Committee and ultimately in the Senate.

For a more detailed review of the details of this bill, see my article on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-1400-introduced - Subscription Required.

Bills Introduced – 4-28-21

Yesterday, with both the House and Senate in session, there were 101 bills introduced. Five of those bills may receive additional coverage in this blog:

HR 2885 To require the Secretary of Energy to establish an electric grid resilience grant program and an electric grid resilience research and development program. Rep. Johnson, Eddie Bernice [D-TX-30] 

HR 2894 To establish a Civilian Cyber Security Reserve as a pilot project to address the cyber security needs of the United States with respect to national security, and for other purposes. Rep. Panetta, Jimmy [D-CA-20]

S 1400 A bill to amend the Federal Power Act to provide energy cybersecurity investment incentives, to establish a grant and technical assistance program for cybersecurity investments, and for other purposes. Sen. Murkowski, Lisa [R-AK] 

S 1407 A bill to enhance the early warning reporting requirements for motor vehicle manufacturers, and for other purposes. Sen. Markey, Edward J. [D-MA]

S 1419 A bill to require the Secretary of Defense to support and provide incentives for domestic manufacturing of printed circuit boards, to identify national security risks in printed circuit boards imported from certain foreign countries, and for other purposes. Sen. Hawley, Josh [R-MO] 

I will be watching HR 2885 for language and definitions that would include cybersecurity in the grid resilience programs; probably will not be any.

I will be covering both HR 2894 and S 1400 for rather obvious reasons.

I will be watching S 1407 for language and definitions that would include cybersecurity issues as part of the enhanced early warning reporting requirements; probably will not be any.

I will be watching S 1409 since there are obvious cybersecurity implications here, but I do not expect this bill to go anywhere given Hawley’s reputation.