Bills Introduced – 12-03-18

With both the House and Senate in session yesterday, there were 14 bills introduced. I will be watching three of these in the short time left in the 115^th Congress:

HR 7213 To amend the Homeland Security Act of 2002 to establish the Countering Weapons of Mass Destruction Office, and for other purposes. Rep. Donovan, Daniel M., Jr. [R-NY-11]

HR 7214 To direct the Secretary of Education to establish a pilot program to award competitive grants for the integration of cybersecurity education, and for other purposes. Rep. Langevin, James R. [D-RI-2]

HJ Res 143 Making further continuing appropriations for fiscal year 2019, and for other purposes. Rep. Frelinghuysen, Rodney P. [R-NJ-11]

HR 7213 is a perennial favorite, but I suspect this version is unique in that it would include CISA language. I am interested in this bill for possible provisions concerning chemical weapons and more importantly the weaponization of industrial chemicals.

HR 7214 looks like an interesting concept from a Congressman noted for his interest in cybersecurity issues. Note: he will be a tad bit more important next year in the Democratic House and this bill will almost certainly reappear then.

HJ Res 143 is a two-week continuing resolution that continues funding those portions of the Government without a passed funding bill (principally DHS and State) until December 21^st, 2018. Ostensibly this is required because the House and Senate will be honoring the late President HW Bush today and tomorrow and they will not be able to work on the actual spending bill during that time. This is a relatively ‘clean’ CR as the only added provision is a similar extension of the flood insurance program. This bill will be passed in the House on Thursday and either Thursday or Friday in the Senate.

NOTE: Only HJ Res 143 will see any action in this session; the other two are ‘look what I have done’ bills.

Committee Report Filed on WMD Bill

Last week the House Homeland Security Committee submitted their report on HR 2356, the WMD Prevention and Preparedness Act of 2011. None of the information presented in the report deal with the threat of chemical weapon attacks based upon terrorist attacks on chemical facilities that could release huge volumes of toxic inhalation hazard chemicals in or near large metropolitan areas.

Leadership Delays

While there continues to be bipartisan support for this limited WMD legislation, the leadership of the House continues to put road blocks in the way of the consideration of this bill. First the Committee leadership took over four months to complete action on their report, guaranteeing that floor action could not take place on the floor of the House before the election.

The three other Committees to which this bill was referred {Committees on Energy and Commerce, Transportation and Infrastructure, Foreign Affairs, and Intelligence (Permanent Select)} have not taken action on the bill. The House leadership extended their deadlines to consider the bill until November 30^th, 2012. If that were not enough to ensure that no action will be taken on this bill during this session, an additional Committee (House Committee on Science, Space, and Technology) was added to the list of Committees to which the bill was referred.

Ignores Industrial Chemical Weapons

I have long maintained that this bill spends too much time concentrating on potential bioweapons, weapons that have as yet not been employed by nation-states, much less terrorists. These potential weapons should certainly be addressed, but ignoring the much easier to employ class of WMD, industrial chemicals, makes little or no sense.

While the CFATS program does address a security at a fraction of the potential facilities holding large quantities of industrial chemicals that could be used as improvised chemical munitions a large number of such facilities have been exempted from the strict security standards of that program. More importantly, however, the CFATS program ignores the emergency response and post-incident clean up requirements that are addressed in this bill for potential bioweapons.

Perhaps the 113^th Congress will be able to more appropriately address the potential problems of the whole range of potential weapons of mass destruction and prioritize the efforts of that program based upon the likelihood of the employment of the various types of weapons.

Cyber Weapons of Mass Destruction

There is an interesting article over on SecurityDebrief.com by Steven Bucci that takes an interesting look at ‘weapons of mass destruction’. He would like to extend the definition of WMD to include cyber and economic attacks. I’ll leave the general discussion of ‘economic’ WMD to other, but I would like to expand on his idea of some cyber-attacks being included under the mantle of WMD.

Bucci does not want to include every kind of cyber hack/attack as part of the arsenal of potential WMDs. In fact, he’s not even sure that an APT hack that steals information should be called an attack (that’s a totally separate discussion). He does note, however, that with the advent of Stuxnet (and I would add the Beresford and Luigi vulnerability disclosures and the GLEGG tool as obvious enabling events) there now exists the demonstrated capabilities to use cyber controls as a means to cause destructive events.

He provides one clear example of how a cyber-attack could achieve WMD effects:

“One can imagine the elegance (for a terrorist or rouge state) of hitting the “enter” button on one continent and having all the valves in a chemical plant next to an American city open simultaneously? We would suddenly have a “Bopol [Bhopal], India-like” disaster that kills a multitude.”

I can add a number of other examples just to keep things interesting. They would include:

• Doctoring flow meter reporting so that large containers (storage tanks, rail cars, tank wagons, etc. are overfilled resulting in a large scale release;

• Opening a series of valves so that two incompatible chemicals are introduced into the same tank at the same time (results could include fire, explosions, toxic release, etc. depending on the chemicals involved); or

• Doctoring pressure reporting devices so that hazardous chemical or gas pipelines are over-pressured (ala San Bruno) resulting in explosion or toxic release.

Of course all of these could also be considered to be chemical attacks with the cyber component being just the initiator. It could be argued that including these types of incidents in the discussion of WMD would be similar to calling a cell phone a WMD because it was used to detonate an IED. I think that such an argument would be shortsighted and oversimplified, the scale of skill necessary to implement the above attacks alone would justify calling the cyber component a weapon.

Outside of the chemical industry I could think of a couple other areas where cyber attacks could be raised to the level of WMD effects. Messing with the controls of a a large municipal water system so that the system was over-pressurized could lead to multiple large scale main ruptures which could essentially shutdown the water system for a prolonged period. Shutting down the automatic sterilization controls at a food packaging operation could result in subsequent illnesses.

In short, there are a number of ways that a control system could be manipulated to cause a significant impact on the community. If the results were catastrophic or physically impressive enough, the cyber attack could certainly be considered to be a WMD attack.

Jihadist CBRN Threat

There is an interesting article over on Stratfor.com, an open-source private intelligence organization, that discusses the possibility of Jihadist organizations using chemical, biological, radiological or nuclear (CBRN) weapons against the United States. This is especially timely since the Obama Administration has repeatedly emphasized that the threat of terrorists using such weapons against the United States is among the greatest threats facing this country. The Stratfor analysts reason that it “chemical and biological weapons are expensive and difficult to use and have proved to be largely ineffective in real-world applications”. They compare the effectiveness of the Aum Shinrikyo chemical and biological attacks in Tokyo with the IED attacks on Madrid rail lines and note that the more readily available explosives are much more effective at causing death and destruction. They also point to the ineffectiveness of chlorine augmented attacks in Iraq to argue against the potential threat of improvised chemical weapons. They do describe two possible exceptions to this rule; the use of radiological dispersion weapons (the so called dirty bombs) and attacks on toxic chemical storage or transportation to disperse those chemicals. They note that a dirty bomb is technically quite simple, but it would cause few actual deaths or injuries beyond those caused by the conventional explosives used as the dispersion agent. In fact, they go so far as to coin a new descriptive term for this type weapon, weapon of mass disruption, because of the potential for panic related to the irrational fear of radioactivity. Readers of this blog will certainly be aware of the potential effectiveness of a successful attack on chemical storage facilities. Even this is less of a threat for large scale casualties, according to the Stratfor analysis. They state:

“Of course, it is not unimaginable for al Qaeda or other jihadists to think outside the box and attack a chemical storage site or tanker car, or use such bulk chemicals to attack another target — much as the 9/11 hijackers used passenger- and fuel-laden aircraft to attack their targets. However, while an attack using deadly bulk chemicals could kill many people, most would be evacuated before they could receive a lethal dose, as past industrial accidents have demonstrated. Therefore, such an attack would be messy but would be more likely to cause mass panic and evacuations than mass casualties. Still, it would be a far more substantial attack than the previous subway plot using improvised chemical weapons.”

The full article is worth reading, especially in light of the near constant stream of warnings about the weapon of mass destruction threat to the country.