Review - HR 4649 Introduced - Smart Cities

Back in August Rep DelBene (D,WA) introduced HR 4649, the Smart Cities and Communities Act of 2025. The bill would promote the use of smart technologies and systems in communities. It contains one section specifically dealing with cybersecurity and six separate mentions in passing. The bill would authorize a total of $240 million in spending on four programs.

This bill is very similar to similar to HR 9892 that was introduced by DelBene in October 2024. No action was taken on that bill in the 118^th Congress.

Moving Forward

While DelBene is not a member of the House Energy and Commerce Committee to which this bill was assigned for consideration, her sole cosponsor, Rep Clarke (D,NY) is a member. This means that there may be sufficient influence for the bill to be considered in Committee. Unfortunately, with the new authorizations included in the bill, there is little chance that the bill will receive consideration.

Commentary

While the three grant programs outlined in the bill would certainly be useful to many jurisdictions in standing up a workable Smart Technology program, they are also the biggest drawback to passing this bill in the 118^th Congress. A more useful, potentially passable bill, would stand up the current §202, outlining the Cybersecurity Working Group. With minimal funding (potentially coming out of ‘existing’ DOC authorizations) the Working Group could provide a valuable opportunity for coming up with a base-driven, smart-technology protection program.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4649-introduced-smart-cities - subscription required.

Bills Introduced – 06-07-19

Yesterday with both the House and Senate meeting in proforma sessions (it was a short week for both) there were 16 bills introduced. Three of those will probably receive additional coverage in this blog:

HR 3156 To promote the use of smart technologies and systems in communities, and for other purposes. Rep. Clarke, Yvette D. [D-NY-9] 

HR 3163 Making appropriations for the Departments of Transportation, and Housing and Urban Development, and related agencies for the fiscal year ending September 30, 2020, and for other purposes. Rep. Price, David E. [D-NC-4]

HR 3164 Making appropriations for Agriculture, Rural Development, Food and Drug Administration, and Related Agencies programs for the fiscal year ending September 30, 2020, and for other purposes. Rep. Bishop, Sanford D., Jr. [D-GA-2]

We are seeing an unusual number of ‘smart technology’ bills in this session. This is typically an indication that a topic has garnered enough political attention that we can expect to see some action in the not too distant future. As is usual I will be watching HR 3156 for cybersecurity issues.

S 1398 Introduced – Smart Technologies

Last month Sen. Cantwell (D,WA) introduced S 1398, the Smart Cities and Communities Act of 2019. The bill is designed to “promote smart technologies and systems to improve community livability, services, communication, safety, mobility, energy productivity, and resilience” {§2}. It is very similar to HR 2636 that was introduced the same day.

Differences

There are two differences between these two bills. One is inconsequential; substituting ‘market place’ for ‘marketplace’ in §401(a)(3). The other is much more substantial; S 1398 removes §205, Technical assistance, voucher pilot program, and technologist in residence pilot program. Sharp eyed readers will recall that this was added to this session’s version of the House bill.

All of the other changes that were made to HR 2636 were carried over into this bill.

Moving Forward

Cantwell is the Ranking Member of the Senate Commerce, Science, and Technology Committee, the Committee to which this bill was assigned for consideration. This means that it is very likely that this bill will be considered by the Committee.

As I noted with the House bill, there is nothing in this bill that should drive any serious ideological opposition to the bill. As with most bills that include new program authorization language, money will be the biggest problem for this program moving forward and Cantwell removed one of the two funding authorizations when she deleted §205.

HR 2636 Introduced – Smart Technology

Earlier this month Rep. DelBene (D,WA) introduced HR 2636, the Smart Cities and Communities Act of 2019. The bill is designed to “promote smart technologies and systems to improve community livability, services, communication, safety, mobility, energy productivity, and resilience” {§2}. The bill is very similar to HR 3895 from the 115^th Congress.

Differences

Most of the differences between the two bills are inconsequential, though a grammatical change in §401(c)(2) from ‘may be not used’ to ‘may not be used’ is kind of interesting.

The one significant change is the addition of a new §205 that would require DOE to establish a Smart City Voucher Pilot Program. This program would be designed to “to improve the access of cities to the expertise, competencies, and infrastructure of National Laboratories for the purposes of promoting smart city technologies” {§205(b)(1)}. It would also expand the DOE’s current Technologist in Residence Program to include ‘smart cities’ efforts. Section 205 includes an annual authorization of $20 million to support the program through 2024.

Moving Forward

As with the earlier bill DelBene is not a member of any of the four committees to which this bill was assigned for consideration. Again, Rep. Lujan (D,NM), her sole cosponsor, is a member of the House Energy and Commerce Committee, but his influence on that Committee is much increased with the change in House leadership. I suspect that the bill has a much higher chance of committee consideration than did the earlier bill.

There is nothing in this bill that would drive any ideological opposition, but the spending authorizations (including the new §205 authorization), while federal chump change, still will have to come from somewhere. That will call for some additional backroom negotiations for this bill to move forward.

Commentary

The general problems that I had with the cybersecurity language in the earlier bill remains in the new language; nothing in the new section alleviates any of those concerns. In a bill like this that attempts to comprehensively address the issues of enhancing the employment of undefined ‘smart technology’, the failure to specifically address the control system cybersecurity issues associated with this new technology is more than shortsighted, it borders on the legislative incompetence.

Then again, it may be deliberate. Adding significant cybersecurity language might have called for the addition of the House Homeland Security Committee to the list of committees from which the bill would require consideration. That added intra-committee conflict might be enough to kill any real consideration of this bill.

Bills Introduced – 05-09-19

Yesterday with both the House and Senate in session there were 101 bills introduced. Four of those bills will likely see future coverage on this blog:

HR 2636 To promote the use of smart technologies and systems in communities, and for other purposes. Rep. DelBene, Suzan K. [D-WA-1]

HR 2644 To direct the Secretary of Commerce to conduct a study and submit to Congress a report on the state of the internet-connected devices industry in the United States. Rep. Latta, Robert E. [R-OH-5]

S 1388 A bill to manage supply chain risk through counterintelligence training, and for other purposes. Sen. Peters, Gary C. [D-MI]

S 1398 A bill to promote the use of smart technologies and systems in communities, and for other purposes. Sen. Cantwell, Maria [D-WA]

I will be watching all four bills for cybersecurity language, particularly language pertinent to control system security.

I suspect that HR 2636 and S 1398 are companion bills.

Bills Introduced – 10-26-17

Yesterday, as the House and Senate were preparing to leave for the weekend, 50 bills were introduced. Of those three may be of specific interest to readers of this blog:

HR 4147 To amend title 49, United States Code, to provide certain port authorities, and for other purposes. Rep. Nadler, Jerrold [D-NY-10]

HR 4151 To promote the use of smart technologies and systems in communities, and for other purposes. Rep. Comstock, Barbara [R-VA-10]

S 2020 A bill to establish a voluntary program to identify and promote Internet-connected products that meet industry-leading cybersecurity and data security standards, guidelines, best practices, methodologies, procedures, and processes. Sen. Markey, Edward J. [D-MA]

It is not clear whether or not HR 4147 or HR 4151 include cybersecurity provisions at this point. If they do, they will receive further mention.

S 2020 looks like it will be another overly broad effort by Markey to address a very real cybersecurity concern. This bill will only receive further mention here if the definition of ‘Internet-connected products’ includes industrial control systems.

HR 3895 Introduced – Smart Technology

Earlier this month Rep. DelBene (D,WA) introduced HR 3895, the Smart Cities and Communities Act of 2017. The bill is designed to “promote smart technologies and systems to improve community livability, services, communication, safety, mobility, energy productivity, and resilience” {§2}. It includes a workforce training and development grant program supporting smart technology implementation.

Cybersecurity

Cybersecurity concerns are mentioned throughout the bill. For example, in the discussion about the purpose of the bill in §2, it mentions the protection of “the security of data and systems” {§2(2)}. Again, in the definition of ‘smart city or community’ the bill includes, as one of the inclusive actions taken by such communities, measures “to ensure the resilience of civic systems against cybersecurity threats and physical vulnerabilities and breaches” {§3(6)(B)(vi)(I)}.

Section 101 of the bill requires the establishment of the Interagency Council on Smart Cities “to promote the coordination of the activities and funding from Federal agencies relating to smart cities or communities” {§101(a)(1)(A)(i)}. The Council would consist of the Secretary of Commerce (Chair), the Secretaries of Energy, HUD, and Transportation, and the Director of the National Science Foundation.

The long list of priorities {§101(b)} for the Council includes the safeguarding of cybersecurity, specifically including by “promoting industry practices regarding cybersecurity” {§101(a)(1)(B)(vii)}. Three separate ‘considerations’ are listed in that paragraph supporting the cybersecurity priority {§101(a)(1)(C)}:

• Take into account existing Federal, State, and local frameworks, guidelines, and best practices when considering their application to smart city technologies;

• Take into consideration software quality, especially as that quality impacts reproducibility, maintainability, reliability, and security; and

• Ensure the privacy of individuals through the use of technologies with inherent privacy and security considerations

Building upon existing Department of Commerce (DOC) programs (eg: Internet Policy Task Force and the Digital Economy Leadership Team) §202 of the bill requires DOC to establish the Cybersecurity Working Group “to develop tools for communities to use to evaluate the cybersecurity of smart city or community technologies” {§202(b)(1)}. Membership of the Group would include {§202(b)(2)}:

• Representatives of consumer groups;

• Representatives of small units of local government;

• Representatives of large units of local government;

• Manufacturers of smart city or community devices, equipment, and software;

• Individuals with expertise in communications networks;

• Federal, State, and local law enforcement officials; and

• Such representatives of the Council as the Secretary determines to be appropriate.

The Group would be tasked with the requirement to {§202(b)(3)}:

• Leverage and build on previous activities carried out by the Department of Commerce relating to Internet of Things technology;

• Develop tools for communities to evaluate the cybersecurity of smart city or community technology being considered by the communities for adoption in those communities; and

• Develop tools for communities to protect against cybersecurity threats relevant to the technology the community has chosen to adopt.

Additionally, the Group would be specifically directed to assess {§202(b)(3)(D)}:

• Whether Internet of Things cybersecurity standards should exist;

• Whether the standards should be voluntary or mandatory; and

• Identify which entity is appropriate to devise the standards

Moving Forward

While DelBene is not a member of the House Energy and Commerce Committee (the primary of four committees assigned consideration of this bill), her single co-sponsor {Rep. Lujan (D,NM)} is. This means that it is possible that that Committee could take up this bill. Some fairly large amounts of money for the various grant programs included in this bill will be the biggest stumbling block to potential consideration and adoption of this bill. If the House Leadership can be convinced that those funds are reasonable and supportable then this bill should be able to pass with bipartisan support.

Commentary

While cybersecurity is mentioned throughout the bill there is not a single definition related to cybersecurity provided. Nor is there a working definition of the technologies encompassed by the term ‘smart technologies’. This makes it difficult to assess whether or not operations systems would be addressed by the cybersecurity concerns outlined in the bill. The lack of specificity means that they could be, but there is no clear congressional intent that they will be addressed.

The other thing that concerns me about the bill is the lack of inclusion of the Department of Homeland Security in the Council. DOC could invite DHS to provide representation, but it is not required to do so. While DOC certainly has a great deal of cyber expertise, DHS has the mandate to be responsible for the cybersecurity information sharing activities of the Federal government and ICS-CERT has specific responsibility for that information sharing when it comes to operational technology. I do not think that this was an intentional slight of DHS by the crafters of this bill, but rather reflects a general lack of congressional appreciation for the scope of the problem.

Finally, I am disappointed in not seeing the bill provide for a grant program for continued studies on the development of cybersecurity tools and strategies supporting the smart technology covered in this bill. While the grant program included in the bill (the TechHire Workforce Training and Development Pilot Program in §203) is required to include “privacy and cybersecurity considerations” {§203(b)(3)} in its curriculum, there is no on-going program to address the inevitable changes in the cybersecurity realm caused by developing technology and changes in the threat landscape.

Bills Introduced – 10-02-17

Yesterday with both the House and Senate in session, there were 30 bills introduced. Of those, two may be of specific interest to readers of this blog:

HR 3895 To promote the use of smart technologies and systems in communities, and for other purposes. Rep. DelBene, Suzan K. [D-WA-1]

HR 3901 To direct the Secretary of Transportation to establish the Strengthening Mobility and Revolutionizing Transportation (SMART) Challenge Grant Program to promote technological innovation in our Nation's cities. Rep. DeSaulnier, Mark [D-CA-11]

I suspect that neither bill will be covered here in the future, but I will be watching to see if there are any cybersecurity provisions in either bill. If you are going to promote smart technology, it would seem to me to be smart to include promoting the cybersecurity of that tech. Anyone wanna take any bets on how smart congresscritters are?