S 2388 Introduced

Cyber Circuit Rider Program

Last month, Sen Cortez-Masto (D,NV) introduced S 2388, the Cybersecurity for Rural Water Systems Act. The bill would require USDA to establish a rural water and wastewater cybersecurity circuit rider program” similar to the one established in 7 USC 1926(a)(22), but focused on cybersecurity. The bill would authorize $10-million per year through 2028 to support the program.

This bill is similar in intent to HR 3809, the Cybersecurity for Rural Water Systems Act of 2023. That bill would add cybersecurity to the existing circuit rider program. This bill would establish a separate, standalone entity.

Cybersecurity Circuit Rider

This bill would amend §1926(a) by adding a new paragraph (23), Rural Water and Wastewater Cybersecurity Circuit Rider Program. It would require USDA to establish a new Cybersecurity Circuit Rider program. The new program would:

• Provide rapid assessments of the current cybersecurity abilities of rural water and wastewater treatment associations,

• Develop reasonable protocols to enhance cybersecurity protection,

• Provide assistance to address inadequate cyber protection plans, and

• Document the state of cyber protection with respect to the water supplies of those associations.

S 2388 would authorize $10-million per year to support the program through 2028.

Moving Forward

Neither Cortez-Masto nor her sole co-sponsor {Sen Rounds (R,ND)} are members of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration. This means that it is unlikely that there is sufficient influence to see the bill considered in Committee. Adding $10-million dollars in spending is sure to draw opposition from many Republicans, but there may still be sufficient bipartisan support in the Committee to see the bill approved if it were considered.

As with most bills, there would not be sufficient interest in this legislation to see the Senate leadership tie up the Senate for the time that it would be necessary to consider this bill under regular order. Because of the added spending involved, it would not be possible to pass this bill under the Senate’s unanimous consent process; it would take just a single Senator to object to passage of the bill to kill consideration.

Commentary

While a cybersecurity add-on to the current circuit rider program would benefit from the existing administrative functions of the program, it could suffer from internal conflicts over resources. A stand-alone program would avoid those potential problems. The $2.5 million in additional funding in this bill would presumably go to pay for the administrative support.

The current circuit rider program has about 147 personnel periodically helping small water systems and small wastewater treatment systems. CISA reports about 153,000 water treatment facilities in the US with the vast majority (93 % by one estimate -pg 3) being small systems that would be covered by the circuit rider program. That means that each circuit rider would have to cover about 1,000 systems. They do not get around very often.

The other problem that neither bill addresses is where the USDA is going to find the cybersecurity personnel that would be needed to support the program. Finding 147 new cyber circuit riders that understand both cybersecurity and water treatment technologies is going to be very difficult. And realistically, we would probably need ten times that number to get timely cybersecurity assistance to all of the potentially affected systems. That would require a much more extensive program than envisioned in either of these bills.