S 245 Introduced – FY 2019 Intel Authorization

Last month Sen. Burr (R,NC) introduced S 245, the Damon Paul Nelson and Matthew Young Pollard Intelligence Authorization Act for Fiscal Years 2018 and 2019. Intel authorization bills were introduced last session (HR 6237 and S 3153), but only the House bill received any action; it passed by a vote of 363 to 54. No action was taken in the Senate on either bill.

Cybersecurity Provisions

There are a number of cybersecurity related provisions in this bill, but only one of potential specific interest to the industrial control system community. The cybersecurity sections of note include:

§303. Modification of special pay authority for science, technology, engineering, or mathematics positions and addition of special pay authority for cyber positions.

§307. Consideration of adversarial telecommunications and cybersecurity infrastructure when sharing intelligence with foreign governments and entities.

§308. Cyber protection support for the personnel of the intelligence community in positions highly vulnerable to cyber attack.

§309. Modification of authority relating to management of supply-chain risk.

§422. Establishment of Energy Infrastructure Security Center.

§701. Limitation relating to establishment or support of cybersecurity unit with the Russian Federation.

EISC

The potentially interesting ICS provision is, of course, §422 establishing the EISC. A nearly identical provision (different section/paragraph numbers is the only difference) was included in HR 6237. I covered that issue in my post on the introduction of the earlier bill.

Missing Provision

Last year Burr’s authorization bill included a section on energy sector cybersecurity. This was taken almost in whole cloth from last session’s S 79. A bill similar to S 79 was introduced earlier this session; S 174. It is not clear if Burr left this out because he felt that S 174 had a good chance to pass on its own (not likely in my opinion) or whether he got push-back from including the costly provisions in last year’s intel bill.

Moving Forward

Burr’s bill will move forward in Committee, he is after all the Chair of the Senate Select Committee on Intelligence. Getting it to the floor of the Senate may prove to be a bigger problem; he has not had an intel authorization bill on the floor since the FY 2017 bill passed.

Commentary

This used to be considered one of the ‘must pass’ annual authorization bills, but since Trump came to town that does not seem to be the case. Spending bills continue to be approved, but the general Congressional oversight provided through the authorization bills seems to be less important as the community status has waned under Trump. This is doubly unfortunate given the cybersecurity troubles being seen in the world.

S 3153 Introduced – FY 2018/19 Intel Authorization

Last month Sen. Burr (R,NC) introduced S 3153, the Matthew Young Pollard Intelligence Authorization Act for Fiscal Years 2018 and 2019. Both the bill and the accompanying Committee Report pay special attention to control system security issues.

Energy Sector Cybersecurity

Section 732 of the bill would require the Secretary of Energy to establish a 2-year pilot program to study control system security in the energy sector. The pilot program would be funded at $10 Million for the 2-year study. This section is essentially the same as S 79 which was reported in the Senate earlier this year by the Energy and Natural Resources Committee.

ICS Security and the Intelligence Community

On page 17 of the Committee Report, the matter of industrial control system security is directly addressed. The Report notes:

“The Committee is aware of significant threats to our critical infrastructure and industrial control systems posed by foreign adversaries. The sensitive nature of the information related to these threats make the role of the IC of vital importance to United States defensive efforts. The Committee has grave concerns that current IC resources dedicated to analyzing and countering these threats are neither sufficient nor closely coordinated. The Committee includes provisions within this legislation to address these concerns.”

Section 732 of the bill (described above) is the only place that I can find in the unclassified portions of the bill and annexes that directly mentions activities related to ICS security.

Moving Forward

The House passed HR 6237, the House version of this bill earlier this month. While the House bill did receive a large measure of bipartisan support, the Senate will still take up this version of the bill as an amendment to HR 6237 when it comes to the floor of the Senate. I expect that to happen sometime after the Senate returns from the abbreviated summer recess next month. There will be some contentious political amendments offered for the bill when it makes it to the floor, but eventually a version of the bill will be passed and then a conference committee will meld the two versions together into a workable whole.

Commentary

It is interesting to see the language from S 79 appear in this bill. Sen. King (I,ME) has been trying to get this bill to move forward through two sessions of Congress now, so it is not unexpected that he would use his position on the Intelligence Committee to try to advance the bill when it was apparently stalled after being approved in the Energy and Natural Resource Committee.

The association between this bill and the intelligence community is vague to say the least. The working group to be established would be under the Department of Energy which does have some tenuous ties to the IC, but that has been mainly in support of nuclear weapons program, not power generation. King has always included a representative of the IC in the working group {§732(c)(2)(F) in this bill}, but that always seemed to me to be a pro forma inclusion as a source of information rather than an actual participant.

It will be interesting to see where the funds come from to support this program. If they come out the intelligence spending bill, then I expect that the role of the IC will be much more important in the activities of the working group and the resulting study.

One political fact is certain however. Since the authorization for the program (if it makes it to the final bill that reaches the President’s desk) comes from the Intelligence Committee, it will be that Committee (and it’s House counterpart) that will provide the oversight for the program, that alone will color many of the decisions made as the program proceeds.