Senate Passes Two Cybersecurity Bills – S 333 and S 1846

Yesterday the Senate passed two cybersecurity bills under their unanimous consent process. There was no debate and no vote. The bills now move to the House.

The two bills were:

S 333, the National Cybersecurity Preparedness Consortium Act of 2019; and

S 1846, the State and Local Government Cybersecurity Act

A companion bill (HR 1062) was introduced in the House, but no action has been taken on that bill in Committee. This bill passing in the Senate may allow that roadblock to be bypassed.

S 1846 has not received any coverage in this blog beyond its introduction because there is nothing in the language that addresses control system security issues.

S 1846 Reported in Senate

On Tuesday the Senate Homeland Security and Governmental Affairs Committee published their report on S 1846, Critical Infrastructure Protection Act (CIPA) of 2015. The report and revised language of the bill reflect changes made to the bill during a markup hearing conducted last July.

Changes to the Bill

The first significant change to the bill is found in the way it changes definitions in 6 USC 101. Instead of a single definition for ‘EM Threat’, the new language adds two definitions; one for ‘EMP’ (electromagnetic pulse) and a separate definition for ‘GMD’ (geomagnetic disturbance). Both EMP and GMD were included in the definition of EM Threat in the original language.

This revised definition results in a large number of editorial changes in the subsequent wording of the bill where ‘EMP and GMD’ are substituted for ‘EM’ or ‘EM Threat’. The real significance of this change is not apparent until the revised wording for the proposed addition to 6 USC 121(d) is seen. The original change called for a study on how to protect critical infrastructure against EM threats. The new wording calls for a similar report, but only after requiring an “intelligence-based review and comparison of the risk and consequence of threats and hazards, including GMD and EMP, facing critical infrastructures” {new §121(d)(26)(A)}. This means that the EMP and GMD threats are evaluated separately and may be treated differently in the subsequent strategy.

Similar wording changes were made in the proposed language for the new §319 (GMD and EMP Mitigation Research and Development) and the new §527 (National Planning and Education).

Moving Forward

Publication of this report indicates that Johnson is prepared to try to move this bill forward to the Floor of the Senate. I doubt that this bill will engender any significant debate or amendments; it does not allow any new regulations or expenditures. It is probable that this bill would be considered under the Senate’s unanimous consent provisions with no debate and no actual vote.

The House bill on this topic (HR 1073) was reported last August, but there has been no move to bring it to the floor. That bill is not as extensive in its treatment of the EMP threat (the definition of which in that bill encompasses both the EMP and GMD issues identified in this bill).

The big problem here for both of these bills is that there are some congress critters that are passionate about this problem, but for most it is seen as a non-issue. The closer we get to the summer recess, the less likely it is that either of these bills will see floor action. Higher priority bills are going to squeeze them out of the available time.

Commentary

The changes to the S 1846 will place the risks to the grid from EMP attacks or GMD activities in a more realistic perspective. Requiring the evaluation of these risks alongside the other risks to critical infrastructure will help to ensure that appropriate responses to all of the risks are properly prioritized.

S 1846 Introduced – EMP Protection

Last week Sen. Johnson (R,WI) introduced S 1846, the Critical Infrastructure Protection Act (CIPA) of 2015. In my initial post about the introduction of this bill I commented that it might be a companion bill to HR 1073; that is not the case even though they share a common title. This bill requires more extensive activities from DHS than just consider electromagnetic pulse events (natural and man-made) in federal planning scenarios.

The bill starts off by adding a definition of ‘EM Threat’ to 6 USC 101 which encompasses electromagnetic pulses caused both by manmade actions and natural events. It then adds a new paragraph to 6 USC 121(d) requiring DHS to develop a “strategy to protect and prepare the critical infrastructure of the American homeland against EM threats, including from acts of terrorism” {new §121(d)(26)(A)(i)}.

It then goes on to add two new sections to the Homeland Security Act of 2002:

SEC. 318. EM threat research and development.

SEC. 526. National planning frameworks and education.

Research

The new §318 would require DHS S&T to conduct research and development to mitigate the consequences of EM threats. That research would include {new §318(b)}:

∙ An objective scientific analysis of the risks to critical infrastructures from a range of EM threats;

∙ Determination of the critical national security assets and vital civic utilities and infrastructures that are at risk from EM threats;

∙ An evaluation of emergency planning and response technologies that would address the findings and recommendations of experts, including those of the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack;

∙ An analysis of technology options that are available to improve the resiliency of critical infra- structure to EM threats;

∙ The restoration and recovery capabilities of critical infrastructure under differing levels of damage and disruption from various EM threats;

∙ An analysis of the feasibility of a real-time alert system to inform electric grid operators and other stakeholders within milliseconds of a high-altitude nuclear explosion.

Planning

The planning requirements under the new §526 are very similar to those found in HR 1073. It would require the DHS National Protection and Programs Directorate to:

∙ Include EM threats in national planning frameworks; and

∙ Conduct outreach to educate owners and operators of critical infrastructure, emergency planners, and emergency response providers at all levels of government regarding EM threats.

Restricting DHS Activity

The final two sections of the bill limit the ability of DHS to effectively complete any of the above actions. Section 4 specifically denies DHS any regulatory authority to advance EMP protections. Section 5 specifically requires DHS to execute the actions discussed above with funds currently appropriated to the Department.

Moving Forward

Johnson is the Chair of the Senate Homeland Security and Governmental Affairs Committee so he certainly has the political pull to move this bill forward. In fact, the bill was marked up in a Committee business meeting this week. Unfortunately, because the way the Senate does their business the substitute language adopted by the Committee is not posted to the Committee web site like we see in the House. This means that we will have to wait for the Committee Report on the bill to see what changes were made.

It will be interesting to see if Johnson is interested enough in this bill to put his political will forth to move the bill to the floor of the Senate. If it gets there, this bill will likely be passed by a bipartisan majority since it deals with a potentially catastrophic event, but does not require new regulations, nor will it cost any new money.

Commentary

EMP threats are the classic black swan event; absolutely catastrophic consequences but very low probability of occurrence. A cataclysmic geomagnetic storm has about the same probability of happening as a major comet/asteroid strike on the Earth. The difference between the two type of events is significant; we will see a comet/asteroid strike coming and may be able to take actions to prevent the strike. Any warning for a geomagnetic storm will be quite short.

The problem of a man-made EMP event of national significance has been widely overblown. Yes a properly designed nuclear weapon detonation very high over the heartland would very likely result in a catastrophic national-level EMP event. Fortunately, the old Cold War, strategy for preventing such an event is still in place; mutually assured destruction. Long before the weapon reached it detonation point, the massive counterstrike of our nuclear triad would be in route to the country that launched that missile. There are much more deniable methods for our nuclear missile capable adversaries to take out our electric grid infrastructure.

The other main problem with the current efforts to protect the Homeland against a catastrophic EMP event is that they are quite frankly a waste of time. Even if we were able to protect the electric grid from such an event (a very expensive and technologically iffy proposition at best) it would still not stop the virtual destruction of our country. That is because an EMP event of the requisite magnitude would also destroy almost every civilian (and many military) microprocessors in the country. No modern vehicles would be running, no communications would be functioning, no distribution systems would be operating, almost all modern electronic gadgets, widgets and dodads would be dead because their microelectronic circuits would be fried beyond redemption. It would be the ‘end of civilization as we know it’. And the scope of that electronic cataclysm gets worse every day as the internet of things expands.

I am much more concerned about the tactical level EMP event like that seen in the Oceans 11 (2001 remake) movie. A portable electromagnetic device is used to create a localized EMP event. The resulting local chaos would then be used to cover a more common type of terror attack that would be made more effective by a very reduced response due to the lack of communication and physical response capability. But even this type of event is currently at almost the science fiction level possibility, these types of devices would be large, cumbersome and require a large energy source.

Having said all of that, I understand the congressional fascination with EMP events. They are conceivably a societal level cataclysm and no one wants history to record that they did not attempt to do something to prevent them. Unfortunately, because no funding is made available for the work required, this bill will only take resources away from other problems that have a much higher probability of occurrence and it will do nothing to mitigate the underlying EMP problem.

Bills Introduced – 07-23-15

Yesterday there were 70 bills introduced in the House and Senate. Only one of those may be of specific interest to readers of this blog:

S 1846 A bill to amend the Homeland Security Act of 2002 to secure critical infrastructure against electromagnetic threats, and for other purposes. Sen. Johnson, Ron [R-WI]

Given yesterday’s hearing of the Senate Homeland Security and Governmental Affairs Committee on the subject, I suspect that the ‘electromagnetic threats’ referenced in the title of this bill refer to electromagnetic pulse (EMP) and geomagnetic storms. We will have to wait and see if this is just another study/planning bill or if it actually outlines very expensive measures to protect CI against these low probability, high consequence events.