As I noted yesterday, the House Homeland Security Committee are holding a hearing this afternoon looking their oversight plan for the Department of Homeland Security. DHS covers a wide range of activities, but thee of are particular interest here, chemical security, cybersecurity, and surface transportation security. All are covered in the Oversight Plan draft published by the Committee.
Chemical Security
Chemical security issues are covered under the heading ‘Protection of Critical Infrastructure’ under the auspices of the Subcommittee on Cybersecurity and Infrastructure Protection. First, under the broader cover critical infrastructure, the documents notes (pg 9):
“In the 118th Congress, the Committee will examine CISA’s programs to protect critical infrastructure, with focus on internal coordination mechanisms to ensure that expertise from both the cyber and physical ‘sides of the house’ can be leveraged efficiently and effectively. The Committee will also review how DHS, through CISA, works with the various critical infrastructure sectors and their respective sector risk management agencies pursuant to Presidential Policy Directive-21, Critical Infrastructure Security and Resilience (PPD–21).”
Secondly, the Plan addresses the Chemical Facility Anti-Terrorism Standards (CFATS) program and the pending expiration of authorization for that program (pg 9):
“During the 118th Congress the Committee will continue to oversee the Department’s implementation of the Chemical Facility Anti-Terrorism Standard (CFATS) program, which requires high risk chemical facility owners and operators to report chemical holdings, perform vulnerability assessments, and adopt risk-based security measures to protect against the threat of a terrorist attack. An act to extend the Chemical Facility Anti-Terrorism Standards Program of the Department of Homeland Security, and for other purposes, (Pub. L. 116-150), conveys CFATS statutory authority until July 27, 2023, at which point the Committee will rely on these oversight activities and findings to consider improvements or modifications to the CFATS program which can be achieved through reauthorization.”
There is no specific mention of CISA’s ChemLock program. Part of the reason for this is that the program is so small that it essentially escapes congressional scrutiny unless there are significant corporate complaints or major media notice. The other part is that, lacking specific congressional authorization, the ChemLock program draws funding and personnel from the CFATS program, so it gets lumped into that program in congressional reviews.
A third portion of the chemical security oversight responsibility falls under the Subcommittee on Emergency Management and Technology. It deals with the Countering Weapons of Mass Destruction Office (pg 10):
“During the 118th Congress, the Committee will examine the significant challenges posed by chemical, biological, radiological, and nuclear (CBRN) agents to the homeland and conduct oversight over the Department’s Countering Weapons of Mass Destruction Office (CWMD) to assess efforts in combatting CBRN threats. The Congressional authorization for the CWMD Office will expire in December of 2023 – an issue that the Committee will work on in the 118th Congress. The Committee will oversee the Department’s efforts to predict and respond to the evolving CBRN threat landscape, and ensure that CBRN expenditures are risk-based, coordinated, and are wise uses of taxpayer dollars.”
Cybersecurity
Cybersecurity is a major focus of DHS, particularly CISA. Thus it will also be a major oversight focus of the Committee. A large part of that focus is on cybersecurity issues within the Federal government, most of those fall outside the scope of this blog. Looking at private sector cybersecurity, particularly for control systems, the Plan provides a look at how the Committee plans to address that oversight, starting with the broad overview (pg 3):
“Equipped with broader and more concrete jurisdiction over cybersecurity under the new Rules of the 118th Congress, the Committee intends to rapidly mature and optimize the country’s lead federal civilian cybersecurity agency, CISA, to protect the nation’s federal networks and the 16 critical infrastructure sectors that underpin the American way of life. The Committee will examine CISA’s ability to execute its new authorities and funding and quantitatively exhibit its value-add in improving federal and critical infrastructure cybersecurity.”
Under the auspices of the Subcommittee on Cybersecurity and Infrastructure Protection, the plan mentions an interesting ‘whole-of-Congress’ approach to cybersecurity issues (pg 8):
“The Committee will lead quarterly meetings of relevant House Committees to conduct oversight, coordinate, and recommend changes to facilitate a whole of government approach to cybersecurity.”
It will be interesting to see how the Committee reports on these meetings, and whether they will be conducted in public.
The 117th Congress passed a large number of pieces of cybersecurity legislation and the Plan outlines the Committee’s intent to oversee the implementation of the various new programs (pg 8):
The Committee will examine the implementation of cybersecurity legislation enacted during the 117th Congress including: the Cyber Incident Reporting for Critical Infrastructure Act of 2022, (Pub. L. 117-103) (requiring reporting and other actions to address cybersecurity incidents, including ransomware attacks); the State and Local Cybersecurity Improvement Act (Pub. L. 117-58) (establishing a grant program to address cybersecurity risks); the K-12 Cybersecurity Act of 2021 (Pub. L. 117-47) (requiring CISA to study the cyber risk facing elementary and secondary schools and develop recommendations); the National Cybersecurity Preparedness Consortium Act of 2021 (Pub. L. 117-122) (developing cybersecurity training to state, tribal, and local first responders and officials); the State and Local Government Cybersecurity Act of 2021 (Pub. L. 117-150) (providing for collaboration between DHS and state, local, tribal, and territorial governments as well as the general public on cybersecurity); the U.S.-Israel Cybersecurity Cooperation Act (Pub. L. 117-81) (contributing to the cybersecurity research and development of both the U.S. and Israel); the DHS Industrial Control Systems Capabilities Enhancement Act (Pub. L. 117-81) (providing CISA authority to address threats to industrial control systems); the DHS Roles and Responsibilities in Cyber Space Act, the Cybersecurity Grants for Schools Act, the President’s Cup Cybersecurity Competition Act, and the ICS Cybersecurity Training Act (Pub. L. 117-263) (providing additional authorities for CISA in the FY23 National Defense Authorization Act).”
Surface Transportation
The Subcommittee on Transportation and Maritime Security will conduct oversight responsibilities for the TSA’s surface transportation security operations. There are two relatively short paragraphs covering that oversight in the Plan (pg 15):
“The Committee will review TSA’s efforts to secure surface transportation systems, including the highest-risk mass transit and rail systems. The Committee’s oversight will include a review of the Visible Intermodal Prevention and Response Program (VIPR), the Surface Transportation Security Inspection Program, and TSA’s surface transportation security regulations. Additionally, the Committee will conduct increased oversight on TSA’s cybersecurity directives for pipelines, freight rail, and passenger rail, as TSA transitions from security directives to rulemaking.
“The Committee will also review the extent to which TSA effectively coordinates with its federal, state, local, and private sector partners to secure the Nation’s transportation systems and to help prevent conflicting or unnecessarily redundant regulations. Finally, the Committee will assess the effectiveness of TSA’s efforts to secure the Nation’s pipeline systems through TSA’s oversight and inspection activities.”
Commentary
With just under five-months left until the current CFATS authorization runs out, there is not much time for oversight hearings, formulating reauthorization legislation and passing it through the legislative process before July 27th. Compounding the problem is that the Committee shares oversight of the CFATS program with the Energy and Commerce Committee. Thus, legislation needs to be coordinated before it can come to the floor of the House. The Republican leadership of the ECC is concentrating on energy matters and will have little time for CFATS oversight, this will complicate the reauthorization process.
I suspect that these problems will require Congress to kick the problem down the road by authorizing a short-term (one to two years) extension of the program. CISA would probably push to see that such an extension would include specific authorization for the ChemLock program to avoid funding problems.