HR 2931 Introduced - Enhancing Grid Security
Back in March Rep McNerney (D,CA) introduced HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act. The bill would require the Department of Energy (DOE) to establish a voluntary security program for electric utilities and provide a report to Congress on cybersecurity of electricity distribution systems. Similar bills have been introduced and passed in the House back through the 115th Congress (See HR 5240 in the 115th Congress)
NOTE: This bill was reviewed using a Committee Print, the GPO has not yet printed an official copy of the bill.
Definitions
Section 5 of the bill provides the definitions of key terms used in the bill. The three definitions provided all refer to existing definitions in other statutes. The three terms defined are:
Electric reliability organization {16 USC 824o(a)(2)},
Electric utility {16 USC 796}, and
State regulatory authority {16 USC 796}.
Promote Physical and Cyber Security
Section 2 of the bill requires DOE to carry out a program to {§2(a)}:
Develop, and provide for voluntary implementation of, maturity models, self-assessments, and auditing methods for assessing the physical security and cybersecurity of electric utilities,
Provide training to electric utilities to address and mitigate cybersecurity supply chain management risks,
Increase opportunities for sharing best practices and data collection within the electric sector,
Assist with cybersecurity training for electric utilities,
Advance the cybersecurity of third-party vendors that work in partnerships with electric utilities; and
Provide technical assistance for electric utilities subject to the program.
Information Protection
Section 2(c) provides that information provided to, or collected by, the federal government under the program described above will be protected against disclosure via the Freedom of Information Act or similar State, local or Tribal laws under provisions of 5 USC 552(b). Similar language is found in §3(b) for the report described below.
Report on Cybersecurity and Distribution Systems
Section 3 of the bill requires DOE to prepare a report to Congress that assesses {§3(a)}:
Priorities, policies, procedures, and actions for enhancing the physical security and cybersecurity of electricity distribution systems to address threats to, and vulnerabilities of, such electricity distribution systems, and
Implementation of such priorities, policies, procedures, and actions, including an estimate of potential costs and benefits of such implementation, including any public-private cost-sharing opportunities.
Differences from Earlier bills
The only real change from earlier versions is an editorial change of the language used to describe the coordination efforts DOE needs to take in completing the above actions. In earlier versions the bill said in multiple places:
“The Secretary of Energy, in consultation with State regulatory authorities, industry stakeholders, the Electric Reliability Organization, and other Federal agencies the Secretary determines appropriate….”
In this version of the bill the same consultation requirement is worded as:
“The Secretary of Energy, in coordination with relevant Federal agencies and in consultation with State regulatory authorities, industry stakeholders, and the Electric Reliability Organization, as the Secretary determines appropriate…
The added “in coordination with relevant Federal agencies” is merely a reflection of the current Administration’s stated cybersecurity policy of Federal agencies working together to solve cybersecurity problems.
Moving Forward
Last Thursday, the House Energy and Commerce Committee held a markup hearing that included consideration of this bill. It was approved, without amendment, by a voice vote. This indicates that this bill, like the similar bills in the last two congresses, has strong bipartisan support. The bill will be considered in the full House under the suspension of the rules process. This means that there will be limited debate, no floor amendments and the bill will require a supermajority to pass. The bill will likely pass with strong bipartisan support.
Again, like previous versions, this bill will probably not be considered in the Senate. It is not important enough to take up the time for the debate and amendment process under regular order. Consideration under the unanimous consent process is possible, but this does not happen often enough to be considered a real possibility.
The most likely way that this bill will find its way onto the President’s desk will be as language added to some must pass legislation like an annual authorization bill. Past performance is usually a good indicator of future action; no one bothered trying to add this language to authorization bills in the last two congresses.
Commentary
This bill is job justification legislation. Congresscritters want to get reelected, so they demonstrate that they take action to solve problems. This bill is designed to do just that. DOE is already doing most of what is required in this bill. That is why no funding authorization is needed in the bill, funds have already been allocated for these activities.