S 88 Introduced – IOT Support

Earlier this month Sen. Fischer (R,NE) introduced S 88, the Developing Innovation and Growing the Internet of Things Act or “DIGIT Act”. The bill would establish a working group within the Executive Branch to provide recommendations to Congress on how to plan and encourage the growth of IoT. The bill was adopted without amendment in a markup hearing before the Senate Commerce, Science and Transportation Committee this week.

This bill is very similar to S 2607 introduced in the 114^th Congress and adopted by the same Committee. That bill never made it to the floor of the Senate.

Working Group

The bill would establish working group of Federal stakeholders to advise Congress on the internet of things (IOT). The working group would {§4(b)}:

• Identify any Federal regulations, statutes, grant practices, budgetary or jurisdictional challenges, and other sector-specific policies that are inhibiting or could inhibit the development of the Internet of Things;

• Consider policies or programs that encourage and improve coordination among Federal agencies with jurisdiction over the Internet of Things; and

• Consider any findings or recommendations made by the steering committee and, where appropriate, act to implement those recommendations.

The working group would also specifically look at how the Federal agencies will be affected by IOT. Included in that review is a requirement to look at security measures those agencies may need to take to {§4(b)(4)(D)}:

• Safely and securely use the Internet of Things; and

• Enhance the resiliency of Federal systems against cyber threats to the internet of things.

The working group would be advised by a steering committee established within the Department of Commerce. The steering committee would consist of personnel from outside of the government including experts from both the tech sector and other industrial sectors that could benefit from the use of IOT. The steering committee is tasked in looking at (among other things) three security related issues relating to IOT {§4(e)(2)(C)}:

• Promote or are related to the privacy of individuals who use or are affected by IOT;

• May enhance the security of IOT; and

• May protect users of IOT.

Moving Forward

Early action on S 88 in committee would seem to indicate that Fischer has the support of the Chair in proceeding with moving S 88 to the floor of the Senate. Whether or not that support will be enough to actually get the bill to the floor remains to be seen. With no funding or new regulations being authorized by the bill, there should be no impediment to this bill being passed in either house if it is actually considered. In the Senate, this bill would probably be considered under the unanimous consent provisions.

Commentary

There have been subtle changes in the wording of this bill with respect to the cybersecurity challenges associated with IOT. Whether or not those changes have any real effect on the recommendations that are made to congress as a result of the studies required in this bill remain to be seen.

I am still concerned that the relatively minor mentions of IOT security in this bill reflect a gross misapprehension of the problems that we have already seen with IOT security issues. There is no mention, for example, in the rather extensive findings section of the bill about how some recent denial of service attacks have utilized bot nets that consist mainly of inadequately secured IOT devices.

I am also concerned that ICS-CERT is not specifically mentioned in the list of agencies to be represented in the working group. While DHS is listed, ICS-CERT (the only agency specifically working on security issues for IOT type devices) is not listed. The Department of Commerce listing, on the other hand, specifically includes three technical agencies (NTIA, NIST, and NOAA) from the Department.

The lack of funding also concerns me. The committee eport on S 2607 (S Rept 114-364) last session contained the mandatory report from the Congressional Budget Office on the cost of the legislation. The CBO estimated that the working group and steering group would incur administrative costs of about $3 million (pg 5). That money would come from the budgets of the agencies involved in the activity. While $3 million is chump change in the federal government, it does have to come from somewhere and failing to account for that spending in bills like this is political slight-of-hand at best and dishonest accounting in practice.

Committee Hearings – Week of 1-22-17

This will be a very short (two-day) week for both the House and Senate and there will be relatively few congressional hearings as a result. Most of the scheduled hearings in the House will be organizational in nature and will include the Appropriations Committee and the Energy and Commerce Committee. Most of the scheduled hearings in the Senate will be confirmation hearings. There is one markup hearing scheduled in the Senate that may be of specific interest to readers of this blog.

The Senate Commerce, Science and Technology Committee will hold a markup hearing tomorrow. In addition to voting on the nomination of Elaine Cho to be the Secretary for the Department of Transportation the Committee will markup a number of bills; including S 88, the Developing Innovation and Growing the Internet of Things Act or “DIGIT Act”.

The GPO has not yet published an official copy of this bill yet (probably today or tomorrow) so I have not yet posted my review of the bill. The Committee web site does include a link to the Committee draft of the bill. As expected is quite similar to the version of S 2607 that was reported out of the same Committee last session. That bill never made it to the floor for a vote.

A quick review of the Committee draft does show that there has been a minor cybersecurity provision added to the bill, but it is only found in the portion of the bill that deals with Federal agency use of IOT devices. More on that when I see the official version of the bill.

Bills Introduced – 01-10-17

Yesterday with both the House and Senate in session there were 73 bills introduced. Of those two may be of specific interest to readers of this blog:

S 79 A bill to provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. Sen. King, Angus S., Jr. [I-ME]

S 88 A bill to ensure appropriate spectrum planning and interagency coordination to support the Internet of Things. Sen. Fischer, Deb [R-NE]

It will be interesting to see if S 79 addresses physical security, cybersecurity, or both.

S 88 looks to be a continuation of efforts by Fischer to promote IOT development. How close this will be to S 2607 from the last session. That bill was reported out of committee but never made it to the floor of the Senate.

S 88 Introduced – Clean Air Act General Duty Clause

As I mentioned earlier Sen. Vitter (R,LA) introduced S 88, the General Duty Clarification Act of 2015. This bill would amend 42 USC 7412(r), the section of the Clean Air Act dealing with the prevention of accidental releases. The bill is nearly identical to both HR 888 and S 1781 introduced in the 113^th Congress. Neither bill was considered by committee.

The bill attempts to accomplish three things. First it requires the Administrator of the EPA to clarify by regulation what some of the terminology in the section means and ensure that those definitions are consistently applied across the country. Secondly it clarifies that the actions required only apply to the prevention of accidental release not to prevention of deliberate releases, like a terrorist attack. Finally it would prohibit the Administrator from specifying any particular method for complying with the requirement to ‘design and maintain a safe facility’.

General Duty Definitions

Section 7412(r)(1) is the General Duty clause of the Clean Air act. It was intended to approximate the use of 29 USC 654, the Duties of Employers and Employees clause of the Occupational Health and Safety Act. The important portion of the sub-paragraph reads:

“The owners and operators of stationary sources producing, processing, handling or storing such substances [listed in paragraph (3) or “any other extremely hazardous substance”] have a general duty in the same manner and to the same extent as section 654 of title 29 to identify hazards which may result from such releases using appropriate hazard assessment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of accidental releases which do occur.”

The bill would require regulatory definitions for ‘extremely hazardous substance’, ‘appropriate hazard assessment techniques’, and ‘design and maintain a safe facility’ {§7412(r)(1)(B)(i)}.

Consistent Enforcement

Since there have not been specific definitions provided for these terms the various regional offices charged with enforcing the Clean Air Act have apparently interpreted these terms in different ways in the enforcement activities and even in different ways when enforcement personnel have changed within an office.

The bill addresses this by requiring the Administrator to publish a guidance document about how this section of the Clean Air Act would be enforced {§7412(r)(1)(B)(ii)}.

Deliberate Acts

There has been a growing effort in the environmental and safety advocacy communities away from getting legislation passed requiring the implementation of inherently safer technology and instead having the EPA to require such implementation via the General Duty Clause. This suggestion has been made particularly vociferously in conjunction with the storage and/or use of toxic inhalation hazard chemicals. Where current safety standards may be applicable to routine storage and use, these advocates point out that they are not adequate to protect those deadly chemicals from deliberate release from a terrorist attack.

This bill would prohibit the application of the General Duty Clause to security issues by amending the definition of ‘accidental release’ to read:

“The term ‘accidental release’ means an unanticipated emission of a regulated substance or other extremely hazardous substance into the ambient air from a stationary source, other than an emission resulting from an act intended to cause harm.” [New language in italics]

Specifying Methods

Industry has long maintained that the design of a safe facility is primarily an engineering function and that each chemical facility will require a unique approach to that design based upon the products produced, the raw materials used and the manufacturing processes employed. Because of this it is claimed that there is no way that a regulatory agency could require any specific design or process that would meet the safety requirements of every covered facility.

The bill reinforces this idea by adding a new sub-paragraph to §7412(r). It prohibits the EPA from requiring any owner/operator “to consider or implement particular designs, approaches, or technologies relating to manufacturing, processing, handling, or storage” {§7412(r)(12)}.

Moving Forward

While Sen. Vitter has considerably more clout in the 114^th Congress than he did in the 113^th there is still enough opposition to this bill on the part of environmentalists and labor that the bill would almost certainly be able to make it to the floor of the Senate for consideration.

Vitter is a Sub-Committee Chairman, but the Transportation and Infrastructure Subcommittee will not be the subcommittee of the Senate Environment and Public Works Committee that will initially consider this bill. It will be interesting to see if he has enough power to see the Committee consider this bill knowing full well that it has no chance in its present form of being considered by the Senate.

The prospects for this bill would dramatically change, however, if the EPA were to begin to craft IST regulations.

Bills Introduced – 1-7-15

Their second day back in Washington and the House and Senate only managed to introduce 113 bills yesterday; most of those by Sen. Vitter (R,LA). Of those only two are potentially of specific interest to readers of this blog:

HR 198 To amend titles 23 and 49, United States Code, to establish national policies and programs to strengthen freight-related infrastructure, and for other purposes. Rep. Sires, Albio [D-NJ-8]

S 88 A bill to amend the Clean Air Act to clarify the definition of accidental release, and for other purposes. Sen. Vitter, David [R-LA] 

I’m not sure that either of these actually contain any language that I would be interested in, but the titles sound like they might be interesting.