Bills Introduced – 6-22-23

Yesterday, with both the House and Senate in session, there were 191 bills introduced. Six of those bills may receive additional coverage in this blog:

S 2103 An original bill to authorize appropriations for fiscal year 2024 for intelligence and intelligence-related activities of the United States Government, the Intelligence Community Management Account, and the Central Intelligence Agency Retirement and Disability System, and for other purposes. Warner, Mark R. [Sen.-D-VA] 

S 2127 An original bill making appropriations for military construction, the Department of Veterans Affairs, and related agencies for the fiscal year ending September 30, 2024, and for other purposes. Murray, Patty [Sen.-D-WA]

S 2131 An original bill making appropriations for Agriculture, Rural Development, Food and Drug Administration, and Related Agencies for the fiscal year ending September 30, 2024, and for other purposes. Heinrich, Martin [Sen.-D-NM] 

S 2153 A bill to provide for the use of members of the Selected Reserve and Individual Ready Reserve to respond to significant cyber events. Peters, Gary C. [Sen.-D-MI]

S 2178 A bill to extend the Chemical Facility Anti-Terrorism Standards Program of the Department of Homeland Security, and for other purposes. Peters, Gary C. [Sen.-D-MI] 

S 2201 A bill to increase knowledge and awareness of best practices to reduce cybersecurity risks in the United States. Klobuchar, Amy [Sen.-D-MN] 

I will be covering S 2103, S 2153, and S 2178. A special note on S 2178, the Chemical Facility Anti-Terrorism Standards (CFATS) program will terminate on July 27^th, 2023, unless it is reauthorized by Congress. S 2178 is the first bill introduced in either the 117^th or 118^th Congress that would reauthorize the program.

I will be watching the two spending bills, S 2127 and S 2131, for language addressing cybersecurity issues, particularly those addressing control system issues.

I will be watching S 2201 for language and definitions that include control system cybersecurity risks within the scope of the legislation’s requirements.

Mentioned in Passing

There are three bills that I would like to mention in passing:

HR 4310 To ban the sale of products with a high concentration of sodium nitrite to individuals, and for other purposes. Rep. Trahan, Lori [D-MA-3]

H Res 537 Amending the Rules of the House of Representatives to clarify that the payment of a bail bond constitutes a gift for purposes of the Rules.  Rep. Cohen, Steve [D-TN-9]

S 2168 A bill to rescind discretionary appropriations in the event of a debt ceiling crisis period and to honor the full faith and credit of the debts of the United States in the event of a debt ceiling crisis. Braun, Mike [Sen.-R-IN]

RE HR4310 - In trying to figure out why Trahan would want to see sodium nitrate sales banned leads to two possibilities, sodium nitrate capsules are being used as poison for feral hogs (there is a certain level of appropriateness in that) and there has apparently been an increase in the number of individuals that use sodium nitrate as a poison for suicide.

RE H Res 537 – This is a further attempt to deal with the ‘Santos’ problem in Congress. Making bail bond payments gifts would require a congress critter to report them to the Ethics Committee.

RE S 2168 – This is a radical ‘solution’ to the debt limit ceiling problem. It would (really?) keep the financial community happy because debt service payments could continue to be made while Congress dithered. It would also protect military pay, Social Security checks, and other mandatory spending.

S 2201 Passed in House – Supply Chain Risk Training

Today, the House took up S 2201, the Supply Chain Security Training Act of 2021, and passed it by a voice vote with only seven minutes of ‘debate’. Since the same version of the the bill passed in the Senate, the bill now heads to President Biden for signature. There is no indication that the President has concerns about the bill, so it will probably be signed later this week.

The bill would require the General Services Administration to develop “a training program for officials with supply chain risk management responsibilities at executive agencies.” While the term ‘supply chain risk’ is not defined in the legislation, with both CISA and NIST referred to as coordination targets, I would suspect that the crafters were at least partially considering protecting hardware and software against unauthorized manipulation in transit between the manufacturer and the Federal user.

NOTE: S 1097, the Federal Rotational Cyber Workforce Program Act of 2021, also passed in the House this afternoon. Since this is purely a federal workforce issue with little or no potential effect on control system cybersecurity, I have not covered this bill. It also going to Biden for signature.

Committee Hearings – Week of 5-8-22

This week, with both the House and Senate back in Washington, there is a heavy committee hearing schedule with a major focus on the FY 2023 budget. We also have one cybersecurity hearing and a hearing on the reauthorization of the Surface Transportation Board.

FY 2023 Budget Hearings

Tuesday – DOT – THUD Subcommittee, House Appropriations Committee,

Wednesday – DOD – DOD Subcommittee, House Appropriations Committee,

Wednesday – NSF – CSJ Subcommittee, House Appropriations Committee,

Wednesday – DOC – CSJ Subcommittee, Senate Appropriations Committee,

Thursday – DOC – CSJ Subcommittee, House Appropriations Committee,

Thursday – Coast Guard – Homeland Security Subcommittee, House Appropriations Committee,

Thursday – DOE Science & Energy – EWD Subcommittee, House Appropriations Committee,

Cybersecurity Hearing

On Wednesday two subcommittees of the House Science, Space, and Technology Committee will be holding a hearing on “Securing The Digital Commons: Open-Source Software Cybersecurity”. The witness list includes:

• Brian Behlendorf, Open Source Security Foundation, and

• Andrew Lohn, Georgetown University

I do not expect much specific focus on operational technology issues.

STB Reauthorization

On Thursday, the Subcommittee on Railroads, Pipelines, and Hazardous Materials of the House Transportation and Infrastructure Committee will hold a hearing on “Board Member Views on Surface Transportation Board Reauthorization”. The witness list will include:

• Martin Oberrman, Chair, STB,

• Patrick Fuchs, Member STB,

• Robert Primus, Member STB,

• Michelle Schultz, Member STB, and

• Karen Hedlund, Member STB

I suspect that there will be a number of questions about the Board’s views on the current railroad service issues and potential future actions by the Board.

On the Floor

The House plans to consider the following bills of interest here this week under the suspension of the rules process:

HR 7077 – Empowering the U.S. Fire Administration Act, as amended,

S 2201 – Supply Chain Security Training Act of 2021,

S 2201 Passed in Senate – Supply Chain Security Training

Yesterday the Senate took up S 2201, the Supply Chain Security Training Act of 2021. The reported version of the bill was withdrawn and the Senate considered an amendment (SA 4899) in the form of a substitute. The amendment and the bill were adopted by unanimous consent without debate.

The substitute language in SA 4899 was nearly identical to the substitute language that was reported by the Senate Homeland Security and Governmental Affairs Committee. The only difference in the new language was the addition of the phrase “and the Director of the National Institute of Standards and Technology” at the end of §2(c)(2).

The bill now goes to the House for consideration. If/when the bill makes it to the floor for consideration it will likely be taken up under the suspension of the rules process. This would mean limited debate and the bill would require a supermajority to pass. Based upon the action in the Senate, I would suspect to see the bill receive substantial bipartisan support.

It is interesting to see that there is no definition of ‘supply chain security’ included in this bill. With both CISA and NIST referred to as coordination targets, I would suspect that the crafters were at least partially considering protecting hardware and software against unauthorized manipulation in transit between the manufacturer and the Federal user. It could also mean ensuring that there were backup suppliers vetted and approved in the event the primary provider is unable to keep supplies moving due to conditions (like Covid for example) beyond their immediate control.

S 2201 Reported in Senate – Supply Chain Security Training

Last month, the Senate Homeland Security and Governmental Affairs Committee published their report on S 2201, the Supply Chain Security Training Act of 2021. The bill was amended and ordered reported favorably at a business meeting of the Committee on July 14^th, 2021. The amended version of the text of the bill is also available.

The relatively minor changes to the bill would require GSA to provide the developed supply chain risk management training program to all federal agencies, including those in the legislative and judicial branches. The Committee very carefully did not tread on the separation of powers clause in that they did not mandate the use of the training program.

The Committee could have been a bit more magnanimous; they could (should?) have required the GSA to make the training program available to State and local government agencies as well.

The bill is now available for consideration by the full Senate. The bill will not come to the floor under regular order, it is not important enough to consume the Senate’s time under that process. This bill could probably pass under the Senate’s unanimous consent process, but it is more likely to make its way forward as an amendment to some piece of ‘must pass’ legislation.

Review - S 2201 Introduced - Supply Chain Security Training Act

Last month, Sen Peters (D,MI) introduced S 2201, the Supply Chain Security Training Act of 2021. The bill would require the General Services Administration to develop “a training program for officials with supply chain risk management responsibilities at executive agencies.”

This bill will be marked-up by the Senate Homeland Security and Governmental Affairs Committee, the committee to which this bill was assigned for consideration, tomorrow. The bill will almost certainly be approved by a strong bipartisan majority.

For a more detailed review of this legislation, including an analysis of how the bill could be clarified, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2201-introduced - subscription required.

Bills Introduced – 6-23-21

Yesterday, with both the House and Senate in session, there were 63 bills introduced. Two of those bills may receive additional coverage in this blog:

S 2199 A bill to require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes. Sen. Rosen, Jacky [D-NV] 

S 2201 A bill to manage supply chain risk through counterintelligence training, and for other purposes. Sen. Peters, Gary C. [D-MI]

I will be covering S 2199. I suspect that it is a companion measure to HR 2928.

As always, one has to be careful with the term ‘supply chain risk’. I will be watching this bill to see if that term is used in the cybersecurity sense and, if it does, whether the bill contains language and definitions that would include industrial control systems in its coverage.