Rule for Consideration of HR 3354 – FY 2018 Spending Bill

Last night the House Rules Committee completed their work on the rule for the consideration of HR 3354, the FY 2018 combined spending bill. This will be a structured rule with only 117 amendments that may be submitted during the debate of the bill; a huge decrease from the number submitted. There were only three of those amendments that may be of specific interest to readers of this blog:

Amendments of Interest

The three amendments of potential specific interest are:

21. Lipinski (D,IL): Decreases the Office of the Secretary of Transportation Salaries and Expenses account by $9,000,000 and increases the National Highway Traffic Safety Administration's Salaries and Expenses account by the same amount for the purpose of expanding NHTSA's connected and automated vehicles oversight and regulatory capabilities;

37. Carbajal (D,CA): Provides $1,000,000 to PHMSA for the finalization of an automatic valve shut-off safety rule; and

67. Delaney (D,MD), Donovan (R,NY): Funds the National Biodefense Analysis and Countermeasures Center, Chemical Security Analysis Center, and National Urban Security Technology Laboratory and is offset by a reduction in Management Directorate, Operations and Support account.

There are no specific provisions in these amendments beyond the simple addition (and co-equal subtraction) of funds in the appropriate places in the proposed bill. All funding changes have to be funding neutral; funds being added to a program have to be specifically taken from somewhere else. That somewhere else in these cases are from management accounts, not specific programs.

Moving Forward

The consideration of the bill is scheduled to begin today with a vote on the resolution (the rule for the consideration of the bill) and will probably conclude tomorrow. The bill is likely (but NOT guaranteed) to pass. If it does pass the important thing to be watching for is a significant bipartisan vote with a substantial majority; anything less will mean that the bill will not be considered in the Senate.

It is not likely that this bill will reach the President’s desk or even make it to a conference committee. It is becoming increasingly likely that there will be a continuing resolution to continue funding for the government through sometime in December.

Committee Hearings – Week of 09-04-17

Yes, the House and Senate have actually returned to Washington; it must be September. Spending (including Harvey Relief) and debt limits are the big items that will have to be addressed before the end of the month. But, this week, in addition to the spending bill hearing this evening, there are two cybersecurity hearings scheduled and one cybersecurity bill on the floor of the House that may be of interest to readers of this blog.

Cybersecurity Hearings

The House Homeland Security Committee will hold a markup hearing on Thursday with four bills under consideration. The one of specific interest here is HR 3101, the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017. No amendments to this bill are currently listed on the Committee web site.

The Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will be holding an information hearing on Thursday. It will address “Challenges of Recruiting and Retaining a Cybersecurity Workforce”. The witness list is not currently available.

On the Floor

As I mentioned earlier, there is one cybersecurity related bill scheduled to be considered by the House this week; HR 3388, the SELF DRIVE Act. Additional cybersecurity provisions found in this bill are addressed here, here and here. This bill contains some of the most comprehensive cybersecurity provisions that I have seen to date and may end up having far ranging indirect impacts outside of the automotive world. This will be considered Wednesday under the suspension of the rules provisions that limit debate and require a supermajority for passage.

The bulk of the time on the floor of the House this week will be consumed with the consideration of HR 3354, the Make America Secure and Prosperous Appropriations Act, 2018. The House is taking this up early to provide time to recover if it fails in either the House or Senate. There is still a reasonable chance that we are going to end up with a last minute continuing resolution to keep the government operating at the end of the month.

Rules Committee to Meet on FY 2018 Spending Bill

The House Rules Committee will meet later today on HR 3354, the vehicle for a combined FY 2018 spending bill. There have been a couple of changes to the proposed spending bill since I originally wrote about it last month; HR 3219 (the previously House passed DOD/VA/Energy/Legislative spending bill) has been added into the bill making this a true omnibus bill; and the recision of $875 million unspent Disaster Relief Funds has been removed for fairly obvious reasons.

As I suggested in that earlier post, a large number of amendments have been proposed for this bill;

• 174 for the Interior/EPA Division;

• 50 for the Agriculture/FDA Division;

• 145 for the Commerce/Science/Justice Division;

• 150 for the Financial Services Division;

• 119 for the Homeland Security Division;

• 184 for the Labor/HHS Division;

• 89 for the State/Foreign Operations Division; and

• 89 for the Transportation/Housing and Urban Development Division

There is no way that even I am going to try to review all of those proposed amendments (unfortunately the staff of the Rules Committee does not have that option), but a quick review of the 119 DHS amendments shows that many are duplicative (or contradictory) politically motivated amendments and surprisingly there are no cybersecurity amendments included in the list.

I do expect that the meeting tonight will formulate a rule with a limited (but relatively large) number of amendments that will be authorized to be submitted from the floor later this week. The amendments will not make or break this bill, however. It will be the number of conservative talking point provisions in the bill. If the number is not high enough, the Leadership will lose enough Republican votes that they may not be able to pass the bill. Conversely, if the number is too high there will not be enough support from Democrats to counter the defecting Republicans. The Republican leadership has an interesting tightrope to walk with this bill. The problem is further magnified in the Senate because the Republican ‘control’ of that body is illusory at best. And, of course, a Presidential signature is still not a foregone conclusion this year.

Harvey Chemplant Explosion – Part II

This is the third in a series of blog posts about a chemical safety incident at an organic peroxides manufacturing facility outside of Houston, TX. The other posts included:

Harvey Related Chemplant Explosion Predicted

Harvey Chemplant Explosion – Part I

Well, it looks like the organic peroxide facility incident is physically over. Over the weekend the decision was made by the owner and local emergency response officials to burn off the remaining material rather than wait for decomposition to take its slightly unpredictable course. There was no loss of life and apparently no major structural problems at or around the facility as a result of this incident. The only injuries reported have been the police officers reporting smoke inhalation problems from the initial fire.

Inventory Reporting

There has been much discussion (see here for example) in the popular press over the last couple of days about the company’s failure to share with the public information about the types and quantities of chemicals stored on the site. Apparently, the company has completed the appropriate Tier II EPA reporting requirements for the site, but there is no requirement for the company to make this information public.

On the other hand, C&EN (a publication of the American Chemical Society, a professional organization for chemists) has reported that there are at least 225 metric tons of organic peroxides stored on the site. They also point to the company’s fairly detailed incident web site that provides a list of both the products and raw materials stored on site along with a link to access the Safety Data Sheets for the products. While no industrial chemical is really considered ‘safe’ for human exposure; there is nothing in the list of raw materials of special concern.

NOTE: Thanks to Richard Rosera for pointing me at this article as my subscription to C&EN has lapsed along with my ACS membership.

CSB Investigation

Thursday the Chemical Safety Board announced that it would be investigating this incident, though it has not yet been added to the list of current investigations. The announcement stated that the investigation team would not actually be dispatched until the site was “deemed safe for entry”. We may see an announcement about that today.

Commentary

On Thursday, I tweeted that: “I am actually kind of sad that CSB is deploying for this relatively low impact incident due to their limited resources. But national news...”. The play that this relatively minor incident has received in the national press made it a certainty that the CSB would have to conduct an investigation. I think that we are going to see in the coming weeks news that there were many more significant chemical releases during the impact of Harvey on the Texas and Louisiana coast than this incident.

Having said that, this may be a good stand-in for all of the chemical incidents that will have taken place as a result of this storm. The CSB does certainly not have anywhere near the resources to investigate all of the inevitable incidents, and given the relatively small size of this facility, the physical investigation should not tie up too many resources. If the CSB uses this incident to take a detailed look at the type of planning that should take place in areas like the petrochemical coast of the Gulf of Mexico, then the investigation will be another valuable contribution to chemical manufacturing safety.

OMB Approves Emergency FEMA Harvey ICR

On Friday, the OMB’s Office of Information and Regulatory Affairs (OIRA) approved an emergency information collection request from the DHS Federal Emergency Management Agency (FEMA) for a new electronic form to collect information from survivors of a major disaster residing in shelters. The purpose of the new data collection is to aid in the rapid transition of those people from shelters into more appropriate living situations.

The impetus for the emergency submission of the Survivor Sheltering Assessment ICR is the current situation in Texas and Louisiana that resulted from the unprecedented flooding from Harvey. This is clear from the wording of the ‘Emergency Justification’ portion of the ICR approval notice. It is also clear from the Abstract that this is a new tool that FEMA expects to use in any future situation where that agency is going to be expected to provide support to people in emergency shelters.

While this ICR was submitted on Friday, it is clear that the ICR was being prepared a week or two before that as it used some extremely outdated estimates (eg: “An incredible amount of rain, 15 to 30 inches with isolated amounts of up to 40 inches, is predicted…”) of the scope of the potential damage from the storm. This also resulted in an almost certainly low estimate of the number of people (30,000) that will be expected to complete the form.

Commentary

It seems clear to me that the collection of data of this sort from a large emergency shelter population is necessary to effectively work to move that population out of shelters and into more appropriate housing conditions in the aftermath of a major disaster. It is actually quite surprising to me that such a data collection effort did not already exist.

It is heartening to me to see that the Trump Administration had started work on this effort before the true extent of the Harvey disaster became known. While this still may (and that is not entirely clear at this point) have been a reactive effort to this specific incident, it still shows a welcomed ability to look ahead and plan ahead. This is especially important to see in an anti-government and anti-regulation administration like the one we currently have.

Whether or not this particular tool is effective, or whether or not FEMA (and the remainder of the Federal government) is up to the task of dealing with the aftermath of Harvey (and do not take your eyes off of Irma) remains to be seen. But, this is an important first step in dealing with the Administration’s first major domestic crisis.

Public ICS Disclosure – Week of 9-25-17

This week Karn Ganeshen provided exploit information on the Full Disclosure web site for vulnerabilities that he had previously coordinated with ICS-CERT. Most of them are relatively simple DLL insertions so there is nothing here that the experienced researcher would not have been able to deduce from the ICS-CERT reports on the vulnerabilities. I include these here since ICS-CERT will not update their advisories to indicate that exploits are publicly available.

The affected products include:

• Schneider Electric Pro-Face WinGP – ICSA-17-215-01;

• Solar Controls WATTConfig M Software - ICSA-17-222-03;

• Solar Controls Heating Control Downloader - ICSA-17-222-02;

• SIMPlight SCADA Software - ICSA-17-222-01;

• SpiderControl SCADA Web Server - ICSA-17-234-03;

• Spider Control SCADA MicroBrowser - ICSA-17-234-02;

• Moxa SoftNVR-IA Live Viewer - ICSA-17-220-02; and

• AzeoTech DAQFactory - ICSA-17-241-01

OMB Approves NHTSA Automated Driving Guidance

Yesterday the OMB’s Office of Information and Regulatory Affairs announced that it had approved the DOT’s National Highway Transportation Safety Administration (NHTSA)’s voluntary guidance document on automated driving systems.

A similar sounding document was published by the Obama Administration last year, but that was directed at pre-deployment development of automated vehicles. That document included a very broadly worded section on cybersecurity. It will be interesting from both a system development/introduction perspective and a change in regulatory theory perspective how this document differs from the one published last year.