Review – HR 2594 Introduced – Water Risk and Resilience Organization

Last month Rep Crawford (R,AR) introduced HR 2594 (no fancy name). The bill would require the EPA to craft regulations providing for the certification of an independent Water Risk and Resilience Organization (WRRO) seemingly similar to NERC in the electric sector. The bill would authorize $10 million dollars to initially fund the WRRO.

The bill is very similar to HR 7922 introduced by Crawford in April of 2024. No action was taken on that bill in the 118^th Congress. There are a large number of editorial changes made in this latest version of the bill that have little or no impact on the legislative intent.

Moving Forward

Crawford is a member, as is his sole cosponsor {Rep Duarte (R,CA)}, of the House Transportation and Infrastructure Committee to which this bill was assigned for primary consideration. This means that there may be sufficient influence to see it considered in Committee. I expect that any number of small communities are going to pressure their representatives to oppose this legislation as it would end up increasing the costs of maintaining their water systems. Many mid to large size water systems will also object, again because of funding issues. I suspect that there will be significant bipartisan opposition to this bill based upon those objections.

I do not expect this bill to move forward, especially since there is no cosponsor on the House Energy and Commerce Committee, to which this bill has been assigned for secondary consideration. That Committee is well known for guarding their prerogatives when they have even limited oversight responsibilities.

Commentary

The change from an annual funding authorization to a single funding amount (…“$10,000,000 to remain available to the WRRO until expended.”) better reflects the fact that §1(h) firmly establishes that the “The WRRO is not a department, agency, or instrumentality of the United States Government.” The only other funding source for the WRRO provided for in this bill is the retention of the of the penalties by the WRRO for any enforcement actions taken by the organization. This would seem to ensure that the WRRO would be quick to undertake formal enforcement actions rather that work with water agencies to increase their resilience to cybersecurity risks. This could be problematic for the vast majority of covered water systems that are smaller systems financed by local governments agencies. An annual funding mechanism, while certainly an anathema to the current Republican controlled congress, could help to ensure that the focus of the WRRO is more on helping these smaller water agencies than on collecting penalties.

 

For more information on this provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2594-introduced-water-risk-and - subscription required.

Review – HR 2344 Introduced - Water ISAC Threat Protection Act

Last month Rep Schakowsky (D,IL) introduced HR 2344, the Water Intelligence, Security, and Cyber (Water ISAC) Threat Protection Act. The bill would require the EPA to carry out a program to support, and encourage participation in, the Water Information Sharing and Analysis Center (W-ISAC). The legislation would authorize $10-million for FY 2024 and FY 2025 to support this initiative.

This bill is very similar (with the exception of the bill’s short title) to HR 1367 that was introduced by Schakowsky in March 2023. No action was taken on that bill in the 118^th Congress.

Moving Forward

Schakowsky and her sole cosponsor, Rep Mullins (R,OK) are members of the House Energy and Commerce Committee to which the bill was assigned for secondary consideration. While this may provide sufficient influence to see the bill considered in that Committee, it will not provide sufficient influence to see the bill considered in the House Transportation and Infrastructure Committee to which this was assigned for primary consideration. In fact, the T&I chair may consider this bill an assault on that Committee’s oversight prerogatives, resulting in active opposition to the bill.

 

For more information on the provisions of the bill, including an expanded ‘Moving Forward’ section, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2344-introduced - subscription required. 

Bills Introduced – 09-22-16

Yesterday with both the House and Senate in session there were 73 bills introduced reflecting the impending (if currently unknown date) shutdown of Congress for the remainder of the election season. Most of the bills introduced yesterday (and for the remainder of the month) are re-election tools not real attempts to enact legislation. Of those bills three may be of specific interest to readers of this blog:

HR 6116 To enable needed drinking water standards, reduce lead in drinking water, plan for and address threats from climate change, terrorism, and source water contamination, invest in drinking water infrastructure, increase compliance with drinking water standards, foster greater community right to know about drinking water quality, and promote technological solutions for drinking water challenges. Rep. Pallone, Frank, Jr. [D-NJ-6]

HR 6121 To amend the Safe Drinking Water Act with respect to climate resiliency, security, and source water protection planning, and for other purposes. Rep. Capps, Lois [D-CA-24]

HR 6134 To establish a National TechCorps program, and for other purposes. Rep. Bera, Ami [D-CA-7]

HR 6116 and HR 6121 are only two of a number of bills about public water systems, but they are the only two to specifically mention ‘security’ in their description blurb. I will specifically be watching these two for chemical security or cybersecurity measures, but I’m not holding my breath.

The National TechCorps will only be of interest hear if it specifically deals with cybersecurity matters.

Integrating Multiple Critical Systems

The folks at GrayMatterSystems.com have posted links to an interesting white paper on two different LinkedIn Groups, ICS-CS and Water Treatment Industry. It looks at work done by Longwatch, Inc integrating a video surveillance system, an access control system and a SCADA system for a public water utility across multiple sites.

The System

The paper concentrates on the difficulties involving adding video surveillance capabilities to the system that uses digital radio to link 32 remote sites to the central control/monitoring system. This diagram from the whitepaper shows how the video surveillance system at each site was integrated into the overall system with the control of that system using the same human machine interface (HMI) as the multiple facility access control system and the water treatment SCADA system.

In this case the link to the LAN was via a MDS iNET 900 transceiver, the same device used to connect the remote access control and SCADA systems to the LAN. A Wonderware HMI is used to monitor “the status of all doors, alarms, cameras and wireless systems” (pg 5). The whitepaper goes on to note that:

“Monitoring and control of the [water treatment] system is our highest priority, so it is very important that the access control and video do not interfere with process data on the radio network.”

Because of the relatively narrow bandwidth of the radio system (50 kb/sec), the paper describes some of the trade-offs that were made in the video surveillance system. The system transmitted stills to the LAN from each camera every 20 minutes and the operator could switch to live video on any camera when required.

System Security Compromised

While I do understand that utilities (and everyone else in our current economic environment) operate on tight budgets, it does seem to me that the integration of three separate control systems through a single HMI is just asking for security problems. You now have five different software systems (SCADA, HMI, video control, access control and communications) and an untold number of devices that may provide unintended remote access to all of the systems. And in this instance, they are all connected to a “corporate LAN or Internet”; no air-gap here.

A 0-day vulnerability in any of the interconnected systems and devices could lead to a compromise of the entire system. Since each of the remote video systems is specifically designed to allow for a thumb-drive download of video files at each of the remote sites, the system also seems to be inadvertently designed to allow for easy insider attacks, deliberate or otherwise.

Finally, this integrated-system makes water-system operators security-monitors. There is no doubt in my mind that water-system issues will receive priority attention from these personnel, not system security.

The integration of these three systems is certainly cost effective and that makes this an attractive option for many facilities. But the integration of control systems and security systems makes no more sense than integrating control systems and safety systems. A single point of failure or vulnerability compromises all of the integrated systems. The potential cost of failure is just too high.