House Passes HR 3583 – The PREPARE Act

This evening the House passed HR 3583, the PREPARE Act. There were only sixteen minutes of debate and a voice vote. The bill reauthorizes and makes minor modifications to a number of emergency response and planning grant programs.

The bill requires a DHS report on the cybersecurity of FirstNet, the nationwide first responder network. It also requires DHS to establish a Social Media Working Group to enhance public communications during emergencies. And it requires the DHS Office of Health Affairs to establish a medical stockpile program for DHS employees.

It is likely that this bill will be taken up by the Senate under their unanimous consent procedures; again with limited debate and no actual vote.

HR 623 Passed as Amended in Senate

Yesterday the Senate passed HR 623, Social Media Working Group Act of 2015, accepting the amended version reported by the Senate Homeland Security and Governmental Affairs Committee. As expected it was passed near the close of yesterday’s session under the Senate unanimous consent process with no debate and no vote.

The House will now have the choice of accepting the version that the Senate passed or to request a Conference Committee to work out the details. I suspect that the House will accede to the Senate version.

HR 3583 Introduced – PREPARE Act

Last week Rep. McSally (R,AZ) introduced HR 3583, the Promoting Resilience and Efficiency in Preparing for Attacks and Responding to Emergencies (PREPARE) Act. The bill reauthorizes and makes minor modifications to a number of emergency response and planning grant programs. Program changes of specific interest to readers of this blog include

• Cybersecurity protections for Public Safety Broadband Network;

• DHS use of social networking; and

• The medical countermeasures program

FirstNet Cybersecurity

Section 206 of the bill requires the DHS National Protection and Programs Directorate Under Secretary to provide Congress with a report on the cybersecurity support that DHS is providing to the Department of Commerce FirstNet program. Specifically the Under Secretary is tasked with the requirement “to identify and address cyber risks that could impact the near term or long term availability and operations of such [public safety broadband] network and recommendations to mitigate such risks”.

Social Networking

Section 207 of the bill would add §318 to the Homeland Security Act of 2002. It provides for the establishment of a DHS Social Media Working Group. Alert readers of this blog will realize that I recently reported that the HR 623, with nearly identical language, has been reported in the Senate.

Medical Countermeasures Program

Section 303 of the bill would add §527 to the Homeland Security Act of 2002. It establishes a medical countermeasures program under the DHS Chief Medical Officer. The program is to be designed to “facilitate personnel readiness, and protection for working animals, employees, and individuals in the Department’s care and custody, in the event of a chemical, biological, radiological, nuclear, or explosives attack, naturally occurring disease outbreak, or pandemic” {new §527(a)}.

Moving Forward

McSally is the Chair of the Emergency Preparedness, Response, and Communications Subcommittee of the House Homeland Security Committee. The Committee Chair, Rep. McCaul, is cosponsor of this bill. So there is certainly the political will and power to move this bill forward.

The Subcommittee marked-up this bill before it was introduced. The full Committee markup is scheduled for Wednesday. I suspect that the bill will be approved by a voice vote without further amendment. If so it will move to the floor of the House before the end of the year; probably to be considered under suspension of the rules with little debate and no floor amendments.

Commentary

The Congress is taking more and more actions like that seen here in specifying that DHS will report on the cybersecurity of FirstNet. These little one section toss offs in a wide variety of legislation are doing more to further the centralization of cybersecurity responsibility in DHS than any single piece of legislation could. I expect that this means that I am going to have to be watching a wider variety of bills to find those mentions that might be of specific interest to the control system security community.

I am not sure why the Social Media Working Group language is once again in legislation that is obviously heading to the floor. It was already passed in the House as a standalone bill. The only thing that makes a modicum of sense is that McSally and McCaul do not expect the Senate to actually take up HR 623 and they really want this group to be formed.

Of concern to me is that this version of the §318 language is also missing any mention of monitoring social media to provide situational awareness to the Department. While the intel folks are trying desperately to monitor the social network communications of IS and AQ supporters, the emergency response folks are, due to excessive concern with avoiding the appearance of spying on the public, being forced to ignore the vital information that could be available in natural disasters and after attacks or manmade disasters. A vitally important requirement for this SMWG should be the development of tools to abstract information from publicly available social networks to support emergency response.

The medical countermeasures program also seems to be an overly limited, if certainly legitimate DHS program. DHS certainly has a responsibility to ensure that medically foreseeable countermeasures to CBRNE attacks are available to keep their troops in the field fully functioning in their emergency response and criminal investigation capacities in the event of such attacks.

With minimal expansion of responsibility, however, the DHS Office of Health Affairs could be developing plans and standards for the deployment of medical countermeasures to the general public. In particular, incidents like the acrylonitrile train wreck this summer point to the need for the centralized stockpiling and subsequent distribution of medical countermeasures for industrial chemical accidents. OHA could have been tasked in this bill with the requirement to identify those industrial chemicals requiring specific medical countermeasures that would not routinely be available to local emergency rooms. In conjunction with such a list they could have been required to submit a plan to Congress on how a regional stockpiling and distribution plan could be put together for such countermeasures.

HR 623 Reported in Senate – Social Media Working Group

Earlier this week the Senate Homeland Security and Governmental Affairs Committee published their report on HR 623, Social Media Working Group Act of 2015. The Committee amended and adopted the bill during a hearing on May 6^th. A copy of the revised language for the bill has also been published.

Changes

Most of the changes to the bill were minor, mostly increasing the emphasis in the language for the use of social media during natural disasters where the emphasis in the previous versions had been on that use during the response to terrorist attacks.

There is another minor, yet interesting wording change in the new version. In describing the purpose of the bill {new §318(b)}, the original language started with the following premise: “In order to enhance information sharing  [emphasis added] between the Department and appropriate stakeholders….” The new version reads: “In order to enhance the dissemination of information [emphasis added] through social media technologies between the Department and appropriate stakeholders….”

The one significant change was a provision that calls for the termination of the Social Media Working Group after 5 years unless the Chairman certifies that “that the continued existence of the Group is necessary to fulfill the purpose” {new §318(g)(1)} outlined in the bill.

Moving Forward

The bill has been placed on the Senate calendar, but that is no guarantee that it will be considered. The bill was adopted in Committee by a voice vote indicating substantial bipartisan support for the bill. This would mean that it would probably be considered under the unanimous consent process in the Senate at a time decided by the Majority Leader.

Commentary

I am still more than a little puzzled by the lack of information about how Congress would intend for the processes and techniques developed by this Working Group would be disseminated to the agencies in the field. I would have expected to see a requirement to publish a public report on suggested best practices. I’m fairly sure that DHS will be able to figure out how to get the word out, but this is still a fairly odd oversight.

The change in wording of the purpose of the working group, may actually be the most significant change in the document. Where the original wording used information sharing that would seem to indicate a two way flow of information between the government and the public. The new use of ‘dissemination’ indicates a one way data flow.

I suspect that this was done to ease privacy concerns about the government monitoring of social networks. This would seem to me to be a knee jerk reaction that could actually limit the ability of the government to acquire timely information that might aid emergency response. I am certainly not advocating that the government be allowed to monitor emails, telephone calls or even texts, but the use of social media is by definition public and poses no presumption of privacy.

In a wide scale emergency live information about what is actually happening can provide valuable intelligence that could guide the deployment of fire, rescue and medical response assets. Ignoring that information because of an overblown fear of the appearance of violating privacy is a sure way of ensuring that innocent people are denied necessary life-saving emergency services.

In my opinion one of the most valuable things that this Working Group should be doing is developing the technology to capture and display timely information from social networking sources about an incident that will allow incident commanders to provide effective deployment of emergency response capability to protect the public.

Well, it is too late now for this bill. If, as I suspect it will, the bill is considered under the unanimous consent provisions there will not be another chance to change the language. Even when it goes to Conference there will only be a selection of one version of the language or the other, not a chance to actually add new or additional requirements. At best we can hope for a reversion to the House language for the purpose of the bill.