Committee Hearings – Week of 10-19-15

Both the House and Senate are back in Washington this week after their Columbus Day Recess (excuse me; ‘district work session’). There are three hearings currently scheduled that may be of specific interest to readers of this blog; two cybersecurity related hearings and one terror threat briefing.

Cybersecurity

The Commerce, Manufacturing and Trade Subcommittee of the House Energy and Commerce Committee will be holding a hearing on Wednesday looking at “Examining Ways to Improve Vehicle and Roadway Safety”. The discussions will be centered on a committee draft of new automotive safety legislation that includes a title specifically addressing cybersecurity issues.

The witness list includes:

• Mitch Bainwol, Alliance of Automobile Manufacturers

• John Bozzella, Global Automakers

• Joan Claybrook, Former Administrator, NHTSA

• Greg Dotson, Center for American Progress

• Maneesha Mithal, Federal Trade Commission

• Mark Rosekind, Administrator, NHTSA

• Peter Welch, Automobile Dealers Association

• Ann Wilson, Motor & Equipment Manufacturers Association

I don’t typically review legislation before it is introduced, but I’ll give a brief overview of the cybersecurity provisions of this bill. Title III of the bill is called “Privacy, Hacking Prohibition, and Cyber Security”. Section 301 establishes privacy rules for information collected by privately owned motor vehicles. Section 302 prohibits hacking (access without authorization) “an electronic control unit or critical system of a motor vehicle, or other system containing driving data for such motor vehicle, either wirelessly or through a wired connection”. And §303 establishes the Automotive Cybersecurity Advisory Council that does not include anyone from ICS-CERT (or DHS in general) or security researchers.

Please note that none of the witnesses has any cybersecurity background so it is unlikely that we will hear anything of real substance about cybersecurity at this hearing; other than, of course, please leave our systems alone.

The other cybersecurity related hearing is before the Energy Subcommittee of the House Science, Space and Technology Committee on Wednesday. That hearing will address “Cybersecurity for Power Systems”.

The witness list includes:

• Bennett Gaines, CIO, FirstEnergy Service Company

• Annabelle Lee, Electric Power Research Institute

• Brent Stacey, Idaho National Lab

• Greg Wilshusen, Government Accountability Office

There is a better chance of a technical discussion at this hearing.

Terror Threat

The House Homeland Security Committee will be holding a hearing looking at “Worldwide Threats and Homeland Security Challenges” on Wednesday.

The witness list includes:

• James B. Comey, Director FBI;

• Jeh C. Johnson, Secretary DHS;

• Nicholas J. Rasmussen, Director, National Counterterrorism Center

No actionable intelligence, of course; just an overview of the cruddy state of the world.

On the Floor

There is one bill that is scheduled to come to the floor of the House this week that may be of specific interest to readers of this blog; HR 3350, the Know the CBRN Terrorism Threats to Transportation Act. It will be considered on Tuesday under suspension of the rules. Again, this means limited debate and no floor amendments. It also means that it is likely to pass with bipartisan support. It passed in the Homeland Security Committee on a voice vote without amendments.

Congressional Hearings – Week of 9-15-13

Actions to be taken in the House this week will determine whether or not the House will take their scheduled district work week next week, the 2014 spending bills or a continuing resolution need to be passed before October 1^st or the government will be shut down pending congressional action. With that hanging overhead there are a number of congressional hearings scheduled for the week, some of which will be of interest to the chemical safety and security and cybersecurity communities.

Terror Threat

The Subcommittee on Counterterrorism and Intelligence of the House Homeland Security Committee will hold a hearing on Wednesday on "Understanding the Threat to the Homeland from AQAP". No witness list is available yet so there is no telling if they are looking at potential cyber or chemical threats or something more conventional.

Markup Hearings

On the same day the Homeland Security Committee will hold a markup hearing on two bills, HR 2952 and a bill yet to be introduced. The new bill, expected to be introduced Tuesday by Rep Clarke (D,NY), will address cybersecurity workforce issues in the federal government. A committee draft is available.

The Senate Homeland Security and Governmental Affairs Committee will be holding a business meeting on Monday evening. There is no agenda available yet so we don’t know which bills will be marked up or even if there will be any legislation considered.

Transportation Safety and Security

On Wednesday the Senate Environment and Public Works Committee will be holding a hearing on "Implementing MAP-21's Provisions to Accelerate Project Delivery". There are no details or witness list available, so it is difficult to determine which MAP-21 provisions will be addressed in this hearing.

Spending

The House Majority Leader’s web site continues to show the consideration of a continuing resolution (CR) later in the week, but there are no indications which of the two competing resolutions (or perhaps a third one) will actually be considered. We can expect to see a Rules Committee hearing. The House Republican leadership is trying to get a consensus bill passed that has some chance of passage in the Senate or can be hammered into an acceptable bill in conference. The right-wing activist portion of the Republican majority is trying to get a CR passed that would stop all funding for ‘Obamacare’.  That would lock up in the Senate and probably bring the government to at least a short period shutdown.

Terrorism Threat

There is an interesting article over on HomelandSecurityNewswire.com that addresses the overall threat of a terrorist attack in the United States and whether that threat is being overblown for political reasons. It is hard to argue that the current terrorism risk picture presents a threat to the existence of the United States. Some people argue that the overhyped response to the relatively low level threat provides a greater existential risk to the country than the risk of an actual terrorist attack.

This is an argument that can be appreciated by the managers of high-risk chemical facilities. There is no question that the implementation of security measures to respond to the Risk-Based Performance Measures outline in the CFATS program will cost a great deal of money for all covered facilities. If managers cannot control these security costs it could certainly pose an existential threat to that facility.

Determining the Threat

I don’t think that anyone has made any claims that there is a high probability for a terrorist attack on a high-risk chemical facility. Based solely on past history there is no threat of an attack on a US chemical plant. Of course, based upon past history, on September 10th, 2001 there was no chance that someone would fly airliners into the Twin Towers in New York.

This is the reason that CFATS program bases the threat calculation for determining what facilities are covered not on past history but on the potential consequences of an attack. For facilities with release COI this is a fairly straightforward calculation. Tools exist to calculate the area at risk in the event of a catastrophic release. Once that is known it is a relatively simple matter to count the number of people in that affected area. The hard part, politically speaking, is setting the threshold numbers that put a facility into the high-risk category and the tier rankings. It is slightly more complicated for theft-diversion COI, but a consequence based calculation is still used to determine the risk.

Low Probability – High Costs

So, at high-risk chemical facilities we have a classic case of low-probability high-consequence event; the cost of the potential consequences is so high that it justifies the expenditures for preventing those low-probability consequences.

There is a savings grace here. Many of the security measures implemented to protect a facility from a release COI consequence would also serve to reduce the probability of an accidental release of those COI and to mitigate the potential consequences of such a release. That does nothing to reduce the costs, but it does provide further justification.

If We Identify a Specific Threat

If we reach a point in time where a specific threat against a specific high-risk chemical facility is identified, what will happen? First off, since a high-risk security program is already in, much of the hard work of protecting the facility will already have been done. Many security measures requiring long-lead times for designing, manufacturing and installing will have already been put into place. Without the CFATS program in place, many of these measures would never have been implemented.

Second, since the CFATS program requires each facility to have in place a plan for periods of elevated threats, the facility will have already done much of the planning necessary to increase their security profile.

Increased Security Decreases Threat

Finally, we must remember that increased security should also serve to deter potential attacks on the facility. Terrorist organizations, like any other political organization needs to appear to be effective to maintain a steady inflow of people and money. If facility security measures appear to be strong enough to cast doubts on possible mission success, the typical terrorist will move on to an alternative target.

Additionally, an effective security program raises security awareness of facility employees and contractors. This increased awareness would make it more likely that any pre-attack surveillance would be detected. This would increase the likelihood that attack can be pre-empted. Extending that security awareness to the surrounding community, including local law enforcement, increases the chances of attack detection even more.

Realistic Appraisal

A realistic appraisal of the current threat environment, from all of the unclassified information available to the intelligent public, makes it relatively clear (there are no absolutes in intelligence matters) that the probability of any given high-risk chemical facility being attacked by terrorists is very low, but not so low as to approach zero. Prudence and a realistic appraisal of the possible consequences of an attack on a high-risk facility require that precautions be taken to further reduce the possibility of a successful attack on one of these facilities.