Lautenberg Bills Update

The two chemical security related bills that I reported on last night were reported in yesterday’s Congressional Record and the ThomalLOC.gov web site today. This allows me to provide some more details on these bills. As I predicted the official copies of the two bills are still not available on the GPO web site. I would expect them to be available early next week. Water Facilities Security Act The WFSA was introduced as S. 3598. It was co-sponsored by Sen. Gillibrand (D, NY). As I expected the bill was referred to the Committee on Environment and Public Works. Chemical Facilities Security Act The CFSA was introduces as S 3999. It was also co-sponsored by Sen. Gillibrand. Also as expected it was referred to the Committee on Homeland Security and Governmental Affairs.

ISCD Fax Line Down

This is just a brief note to let everyone know that there is a new note on the ‘Latest News’ section of the CFATS Knowledge Center stating that:

“Apologize for any inconvience, but the ISCD is unable to receive faxes at this time.”

SCADA Virus

Well, we knew that it had to happen sooner or later; the folks over at FindingsFromTheField.com are reporting on the first virus (more properly a Trojan) targeted at an industrial control system. Not unexpectedly the route of infection seems to be via USB sticks. There are indications that this is a very sophisticated attack vector; again as one would expect with anything targeted against control systems. It uses a new vulnerability; it is signed with a RealTek security signature, and it uses a Siemens password. Someone obviously knew what they were doing. I’m not going to try to discuss the technical details here. Andrew Ginter is an expert in the field so go read his detailed posting. What I am concerned about is the motivation of the virus writer. Typically virus writers are motivated by revenge, money, or status (not necessarily in that order). Each of these motivations has its own potential consequences for the chemical processing community. If someone is out for revenge against Siemens, for instance, then we would expect to see the technique freely released into the larger hacker community. The methods of making money from such a virus are also of concern as they include industrial data theft (espionage) or extortion. Probably the scariest situation would be if this attack came from the pure hacker community. If these folks have now started to target control systems then we can expect to see a number of different approaches being developed. We can almost think of these folks as the basic researchers of the trade. Any exploits that they develop in their attempts to out do their competitors will make their way into the criminal hacker tool boxes. In any case, those of us in the security side of the business now have a counter to the question of why we need to be concerned about control system security. Too often we have been asked why take the effort to secure control systems when they are too complex to deliberately attack? We always knew that there was no systems that was too complex to attack, now we have the proof.

Lautenberg Introduces CFATS Legislation

Accompanied by a major public relations push from Greenpeace and a variety of environmental and labor organizations, Sen. Lautenberg’s (D, NJ) office announced that the Senator introduced two bills to regulate the security of chemicals, one for chemicals at water and waste water treatment plants and one for other high-risk chemical facilities. Bill numbers will not be available for these two bills until the Congressional Record is published tomorrow (if these bills were actually introduced today, a one or two day delay in the actual introduction is not unheard of in these situations). Official copies of the introduced legislation probably won’t be available until next week. Copies of the two bills provided by the Senator’s office should be essentially identical to the official copies of the legislation. The Secure Water Facilities Act (SWFA) appears to be essentially the same as Title II and Title III of HR 2868. The Secure Chemical Facilities Act (SCFA) appears to be at least similar to Title I of HR 2868; there are differences of construction that make it difficult to tell by a cursory inspection. Separate Consideration I would assume that the separation in to two separate pieces of legislation was done to make it easier to pass the water facilities legislation if the resistance to HR 2868 was too great to get Senate action this year. While there has been some opposition to the water facility security provisions of HR 2868, the IST provisions were watered down enough to prevent the same type opposition seen by the chemical industry. Until I can see the Congressional Record for today’s proceedings I won’t be able to tell for sure what the committee assignments are for the two pieces of legislation. I would suspect that the SWFA will not be assigned to the Homeland Security Committee. Since it is essentially an EPA bill (the responsible agency) the legislation would most likely be assigned to Sen. Boxer’s (D, CA) Environment and Public Works Committee as they have jurisdiction over the Safe Drinking Water Act. The SCFA would almost certainly be assigned to the Homeland Security Committee. It will take some time to review the wording of both pieces of legislation to see what differences there are between these bills and the provisions of HR 2868. The Lautenberg press release only says that HR 2868 is similar legislation. This late in the process it certainly cannot be considered to be a companion bill. SWFA Could Pass I don’t think that this will make a significant difference in how CFATS legislation will be considered in the Senate. The separation into two bills could provide for possible consideration of the SWFA, but I find it hard to believe that even this bill would make it through the legislative process this session. The SWFA would almost certainly be approved by the House if it gets that far.

Another Methyl Bromide Screed

I’m sorry, but every time I think that I am done writing about the issue of methyl bromide as a potential release toxic chemical, the EPA has to come along and push my buttons one more time. Today they posted a notice in the Federal Register requesting applications for methyl bromide ‘critical use’ exemptions for the use of methyl bromide as a soil fumigant for 2013. As long-time readers of this blog will undoubtedly remember I was concerned when DHS removed methyl bromide from the original DHS chemicals of interest list (Appendix A, 6 CFR Part 27). The justification was that EPA was phasing out the use of methyl bromide as a fumigant in accordance with Clean Air Act and the Montreal Protocol. An exception to the phase out is authorized for ‘critical use’ situations and according to this notice the “EPA has allocated critical use methyl bromide through rulemaking for each of the six years (2005-2010) since the U.S. phaseout, and plans to do so for another four years (2011-2014)” (75 FR 41177). Interestingly this notice also makes the point that EPA has yet to determine when it will stop considering the approval of ‘critical use exceptions’. The EPA explains in this notice that:

“While EPA with this notice is seeking applications for 2013 and will likely request applications for 2014, EPA believes it is appropriate at this time to consider a year in which the Agency will stop requesting applications for critical use exemptions. EPA will seek comment on this issue in the proposed rule for the 2011 critical use exemption.”

Ignoring for the moment the issue of justifying the continued use of a chemical that adversely affects the ozone layer (I have my opinion, but that is of little interest to the chemical security community), it is obvious that methyl bromide is going to be continued to be used and distributed in the United States for a number of years; perhaps a large number of years. The failure to consider this toxic gas a release toxic COI under CFATS cannot be justified as a diminishing threat because it is being ‘phased out’.

CSSS – Sec. Keil’s Remarks

This is just a brief note to let you know that DHS updated their Chemical Sector Security Summit page again late yesterday. They added a link at the bottom of the page to a copy of the opening remarks made by Assistant Secretary Keil. This is taken from a transcript and not just a set of slides. I haven’t had a chance to read this yet, but I will get around to it along with the other CSSS presentations.

Lautenberg and CFATS

There is an interesting article on NorthJersey.com about how Sen. Lautenberg (D, NJ) is using his new ‘temporary’ position as the Chairman of the Homeland Security Subcommittee of the Senate Appropriations Committee to bring DHS funding to New Jersey. Nothing new here and Sen. Lautenberg has a long way to go to catch up with his predecessor, the late Sen. Byrd. For more details on Senate earmarks for the DHS Budget see this report. For members of the chemical security community, the most interesting part of the article (unless they are also NJ residents) is found in the last two paragraphs:

“The bill also pressures DHS to prepare a comprehensive risk assessment and national strategy for passenger and freight rail security, and extends chemical plant security standards included in previous DHS spending bills. “Lautenberg plans to introduce a bill this week imposing tougher standards.”

The CFATS extension referenced in the end of the first paragraph quoted here was included in the President’s budget request. Due to the improbability of CFATS legislation passing before the October expiration of the CFATS authority I am glad to see that Sen. Lautenberg is going to include the CFATS extension in the budget bill. It will be interesting to see exactly how he words the section providing the extension. As soon as I see the actual wording of the bill I will let you know how this section is worded. Once again Sen. Lautenberg is promising to introduce a comprehensive CFATS authorization bill, just as he has been promising for the better part of a year. At this point it really doesn’t matter because the bill will likely not see any hearings before November and is even less likely to be voted upon. It really makes no sense since he isn’t up for re-election until 2014; this isn’t a campaign ploy. Maybe he is just trying to keep his name associated with chemical security issues; voters in NJ would count that as an important issue.