Senate Chemical Security Committee Reports

There have been a number of pieces of legislation in the 111th Congress that have been of some potential concern to the chemical security community that have stalled in the Senate after the appropriate committee ordered the bill to be reported favorably. After months of seeming inactivity, the following such bills were reported last week:

• HR 2868 – Chemical and Water Security Act of 2009
• S 773 – Cybersecurity Act of 2009
• S 1274 – A bill to amend title 46, United States Code, to ensure that the prohibition on disclosure of maritime transportation security information is not used inappropriately to shield certain other information from public disclosure, and for other purposes.
• S 1649 – Weapons of Mass Destruction Prevention and Preparedness Act
• S 3480 – Protecting Cyberspace as a National Asset Act of 2010

Amendment in form of Substitute

Each of these bills was passed in committee with bipartisan support. They were also amended with a significant re-write of the wording of the legislation in what is called an “amendment in the form of a substitute”. In each case there was no public record of the final form of that proposed legislative wording; that public disclosure is typically made in the report the committee files on the bill. That report also contains a detailed explanation of what the committee expects that legislation to accomplish; what is known as ‘congressional intent’.

In the three bills reported by the Senate Homeland Security and Governmental Affairs Committee (HR 2868, S 1649, and S 3480), the bills were reported with a Senate Report number provided, though as of this morning, there is no copy of that report available through the Government Printing Office. The two remaining bills (S 773 and S 1274) were reported by the Commerce, Science and Transportation Committee without a written report. In other words, starting the final week of the 111th Congress, we still don’t know what the final amended versions of these bills looks like.

No Further Action Expected

While each of these bills passed in committee with bipartisan support, they were controversial enough in their provisions to have garnered significant opposition; enough opposition that, in all but one case, there was little chance of the bill actually making it to a floor vote in the Senate. This was part of the reason for the delay in the reports being filed; there were significant behind the scenes negotiations being made to find accommodations that could be made to allow the bills to be passed.

The exception in this list is S 1274. This bill, as long time readers will remember, was introduced by Senators Rockefeller and Byrd, both from West Virginia. It was introduced in reaction to the disclosed efforts made by Bayer CropScience to hide information about a fatal chemical accident at their Institute, WV from the Chemical Safety Board by declaring the information to be protected from disclosure by the Maritime Transportation Security Act (MTSA). Wording effectively similar to this bill was successfully included in the FY 2010 DHS appropriations bill.

At this late date, no further action is expected on any of these bills. The filing of these reports just officially closes out the committee action on these bills. The Homeland Security Committee reports will eventually be printed by the GPO to become part of the historical record. When the Senate adjourns for the last time later this week, any future action on these legislative efforts will have to start all over again in the 112th Congress, and most of them will probably re-appear in early 2011.

Lame Duck Congress

While many pundits are focused on prognostication about the 112th Congress that will start in January, next week the 111th Congress will return to finish out the last month and a half of their term. The same people will be in charge and the same issues have to be addressed. The big difference is that many won’t be returning, so they won’t need to worry about what the voters think while others know that they will have more power to persevere in the next Congress. These two facts will color what can be done.

Chemical Security Legislation

The current CFATS authority expires on December 3rd. Congress will take some sort of action on legislation to continue that program. The most likely effort will be a one year extension in the DHS budget bill. If an actual budget doesn’t pass (a very real possibility if the Democrats try to stuff a budget bill with last minute attempts to add programs that won’t have a chance in the upcoming Republican controlled House) any continuing resolution will contain a CFATS extension for the length of the CR. I won’t be surprised to see a couple of short term continuing resolutions to give the 111th more time to pass their budget bill (probably a single, huge bill).

There are a number of bills that specifically address CFATS ranging from HR 2477 (which makes the current program permanent), thru HR 2868 (which slightly modifies and extends CFATS for three years), to S 2996 (which extends CFATS for five years). The only one that has any chance of passage is HR 2868 and I’ve discussed a number of possible scenarios that might result in passage in earlier blogs (most recently), but I won’t waste any money on betting on passage.

Adding chemical security requirements to water treatment facility security requirements is currently only addressed by one bill (the Senate version of HR 2868 removed the House provisions that included this), S 3598. The Senate has held only one hearing on this bill and the Environment and Public Works Committee is unlikely to report this bill. If it does, the Democrats are unlikely to be able to muster 60 votes (because of the current IST provisions in the bill) to force a vote on this bill. If it does get to a floor vote, it would almost certainly pass and could be taken up and passed in the House if the Senate vote comes early enough. Needless to say that Greenpeace is pushing for this bill to be passed.

Cyber Security Legislation

There were a number of cyber security bills introduced in the 111th Congress. None really specifically address control system security issues. Only one has come to a floor vote, HR 4061, and it passed easily. No action has been taken in the Senate on that bill, no hearings and no committee votes. While it is unlikely to come to a floor vote, it would probably pass. It could make it to the floor at the very end of the session if the leadership really wanted to get some sort of cyber security bill passed and nothing else worked. If there were no floor amendments, this bill would not need to go back to the House for further action.

S 3480 is the Senate bill that is best positioned to come to a floor vote. As I have mentioned on a number of occasions, we have been waiting for the Senate Homeland Security and Governmental Affairs Committee’s report on this bill since June. There is some opposition to some provisions of this bill so there would probably be a fairly extensive number of floor amendments that would be faced. This would make this a time consuming bill to pass, making it difficult in this short session. If the leadership on both sides of the aisle could agree to limit the amendment process this bill could probably pass, but not in enough time to make it through the House.

Other Legislation of Interest

HR 2200, the TSA authorization bill, has been ordered reported in the Senate (last year), so it could come to the Senate floor. New concerns about cargo screening, and passenger screening technology could lead to a large number of floor amendments, again making this a time consuming bill to pass. It would have to go back to the House, because of changes made in committee. That makes it more difficult to pass in the short session.

HR 4842, the DHS S&T authorization bill, passed in the House but has had no action taken in the Senate. This could be a sleeper bill that could slide through a floor vote in the Senate if the leadership decides to take it up.

Watch Them Closely

While many people have called the 111th a ‘do nothing’ Congress, there have actually been a significant number of things passed. We will probably see a large number of little noticed bills making their way quickly through the legislative process in the lame duck session. Most will be mainly non-controversial, but lots of stuff can get tacked onto these bills. The budget bill(s) will be particularly vulnerable to stuffing with a number of Congress Critters trying one last time to get their personal favorite idea into law. This session could get very loud and very ugly, but we’ll have to pay close attention to the quiet stuff.

Stuxnet and Congress

It is interesting to see that the hearing listings are already starting to appear on Congressional Committee web pages; kind of early coming back from a long recess, especially for a lame duck session. Stuxnet will be one of the first subjects that the Senate Homeland Security and Governmental Affairs Committee will be looking at, with a hearing next Wednesday at 10:30 am EST.

The witness list provides an interesting mix of folks. It includes:

• Sean McGurk, Acting Director, National Cybersecurity and Communications Integration Center, U.S. Department of Homeland Security
• Michael J. Assante, President and Chief Executive Officer, National Board of Information Security Examiners
• Dean Turner, Director, Global Intelligence Network, Symantec Corporation
• Mark W. Gandy, Global Manager, IT Security and Information Asset Management, Dow Corning Corporation

Obviously this will be a high-level policy-review type hearing not an actual look at the nuts and bolts of Stuxnet. This is the first hearing that I have seen that will specifically address ICS security issues, certainly there has not been much in the way of legislation looking at ICS security. Its disappointing not to see someone from Siemens, but at least Symantec will be at the table.

BTW: We are still waiting to see this Committee’s report on S 3480, the Lieberman-Collins-Carper cyber security bill. This report was ordered by the Committee back in June. Nothing in the original version of the bill that specifically addressed ICS security, but we won’t know for sure about the final version until this report is issued. This bill is not likely to be passed in the lame duck session.

S 3480 – Cyber Security

Last week I took a brief look at some concerns being expressed about the new comprehensive cyber security bill coming out the offices of Sen. Lieberman (I, CT) and Sen. Collins (R, ME). At that time I hadn’t had a chance to review the text of the bill. Now that I have had a chance to do so it doesn’t seem that this bill will have serious affects on industrial control systems (ICS), but owners of conventional IT systems at chemical facilities that are considered to be critical infrastructure may be affected. ICS I have to waffle a little bit on the potential affects on ICS. I cannot find anywhere in the bill where the terms ‘industrial control system’ or ‘SCADA’ are mentioned. These are two of the most commonly used descriptors of the computer systems used to control chemical processes. In fact the word ‘industrial’ only shows up once in the legislation and that in regards to industrial espionage {§406(a)(2)(E)}. I don’t think that it is unreasonable to assume that ICS are not covered under the introduced bill. Having said that, there may be a loophole that regulators could use to attempt to regulate ICS in ‘critical industries’. In defining ‘cyberspace’ the legislators expansively state that it includes “the Internet, telecommunications networks, computer systems, and embedded processors and controllers [emphasis added] in critical industries” {§3(2)}. Since this statement is modifying ‘the interdependent network of information infrastructure’, I think that any such ICS regulations would certainly end up in lengthy court battles. Information Systems The major focus of this legislation is the protection of information systems of the Federal Government, but it does potentially apply many of the same controls to privately owned information networks. Covered critical infrastructure is defined as a system “that is on the prioritized critical infrastructure list established by the [DHS] Secretary under section 210E(a)(2)” {§241(4)(A) in §201}. Section 503 provides guidance to the Secretary about the maintenance of the ‘critical infrastructure list’. The catch all phrase “any other security related factor determined appropriate by the Secretary” could certainly be used to include high-risk chemical facilities on this list. I’ll leave the analysis of what specific affects that this bill could have on the managers of IT systems in these high-risk chemical facilities to those with more experience in IT systems; I have only been a user of such systems. Mark-up As I mentioned in a posting on Friday, this bill is currently scheduled to be marked-up in the Senate Homeland Security and Governmental Operations Committee on Thursday. There is no telling what changes will be made at that hearing. In fact, given the way that Senate committees conduct such hearings, we will have little idea of what changes have been made to the legislation until the final committee report is filed. I am certainly not going to predict when that will occur; we are still waiting on the report from this Committee on S 1649, the WMD bill that Sen. Lieberman and Collins pushed last year and upon which mark-ups were finished back in November. If and when a report on this bill is published, I will again look to see if there have been any provisions made that would specifically address ICS at high-risk chemical facilities.

DB on S 3480

Dale Peterson over at DigitalBond.com, writes in a serious control system security blog, and he has an interesting, if brief, look at S 3480, the Protecting Cyberspace as a National Asset Act of 2010, sponsored by Sen. Lieberman (I, CT) and Collins (R, ME). I’ve just downloaded a copy of that legislation, so I’ll reserve my comments on the bill. Here I’ll just look at Dale’s comments. Conflict of Interest Beyond having concerns about DHS being able to actually take on the tasks outlined in the bill due to manpower and funding constraints, Dale has concerns about the control system security set-up in the bill. He writes:

“Are we really proposing that DHS set the regulations, be in position to issue fines, and help owner/operators comply with regulations, and be brought in for remediation? So then they could be regulating the security controls they recommended, designed and maybe helped implement? Sounds like the days of the accounting companies providing services to companies they audited.”

Then he questions if this is what DHS wants or if it is completely from the minds of the Senators. I can’t answer that question any better than Dale can apparently. I would hope that if DHS was buying off on this they would point out the need for loads of additional resources. I’m not sure completely I share Dale’s concern about the internal conflicts of interest. This could be set up in such a way that separate sections of DHS-CERT have responsibility for the different parts of the system. ICS Remediation Interestingly, the Control System Security Program people at DHS-CERT did apparently volunteer to get into the remediation business for a short period of time last month. I noted in an earlier blog that they posted the following offer on their web page:

“In addition, the ICS-CERT is able to provide onsite assistance, free of charge, to organizations that require immediate investigation and resolve in responding to a cyber attack.”

The offer was missing from the revised web page just five days later. No explanation was given, but it could have been due to lack of manpower, or even complaints from the industry that this was putting CERT in direct, and unfair competition with a number of companies. I just don't know, but it is an interesting coincidence. I’ll be trying to wade through the lengthy bill to pull out the stuff of interest to the chemical security community. In the mean time, take a quick look at Dale’s post, it is an interesting read. BTW: Yesterday Rep. Harmon (D, CA) introduced another ‘comprehensive’ cyber security bill (HR 5548). It is not yet available from GPO so I have no details available yet, except that it is also a bipartisan bill, having been co-sponsored by Rep King (R, NY) the ranking member of the House Homeland Security Committee.