Cyber Sense Act of 2021

Madam Speaker, while I agree with my colleagues about the importance of securing our Nation's energy infrastructure, I am concerned that--as currently written--H.R. 2931, H.R. 2928, and H.R. 3119 may weaken the core tenets of the U.S. Government's framework for protecting critical infrastructure.

That framework is currently laid out in Presidential Policy Directive 21 (PPD-21) and has been reinforced in numerous Federal policies and statutes enacted since 9/11. It has been embraced by Republican and Democratic administrations alike and by Congress. Earlier this year, Congress strongly reaffirmed its commitment to the PPD-21 framework in the FY2021 National Defense Authorization Act.

PPD-21 designates the Department of Homeland Security (DHS) as the lead Federal agency responsible for coordinating Federal efforts to secure critical infrastructure across all 16 sectors--while working hand-in-hand with Sector Risk Management Agencies (SRMAs).

I support enhancing the Department of Energy (DOE)'s capacity, as the SRMA for the energy sector, to engage with the sector as a liaison, trusted partner, and valuable source of sector-specific expertise.

That said, it is important that legislation authorizing such activity acknowledge the role that DHS, through the Cybersecurity and Infrastructure Security Agency (CISA), plays as the Nation's risk advisor and Federal civilian interface for private sector engagement and collaboration.

Congress has often reiterated that it expects CISA to use its authorities and cross-sector convening power to maintain a bird's eye view of threats across sectors--taking threat intelligence from one sector and integrating it into a broader threat context to help other owners and operators protect themselves.

But CISA can only do this if its SRMA partners work with it in a collaborative way that complements--rather than duplicates--the tools, services, resources CISA brings in support of these broader efforts.

Herein lies the issue with H.R. 2931, H.R. 2928, and H.R. 3119: the measures, as drafted, would authorize DOE to carry out responsibilities and develop capabilities that overlap with or duplicate those already housed within CISA, and there is no directive for DOE to do so in coordination with DHS.

There are several problems that could arise from this lack of coordination.

First, it runs the risk of creating a siloed, stovepiped approach to managing information about threats to the energy sector--a critically important, lifeline sector that has been under sustained attack for decades.

Congress has worked to break down these siloes since 9/11, which is why DHS was tasked as a ``central hub'' for critical infrastructure in the first place.

Second, having multiple Federal agencies carry out overlapping roles and responsibilities creates confusion among private sector stakeholders, who are not sure who to call during a crisis, or who to partner with during steady state.

This duplication also means that the Federal Government is forced to spread an already thin supply of cybersecurity experts and resources even thinner.

Finally, cybersecurity is rarely--if ever--a sector-specific problem.

Critical infrastructure is interconnected, and technologies used in one sector are often deployed throughout others, as are the vulnerabilities embedded in those technologies. Adversaries can use the distributed nature of these vulnerabilities to exploit owners and operators across industry lines, at scale.

Take, for instance, the recent SolarWinds campaign. Russian intelligence agencies were able to corrupt a software update deployed across the public and private sectors, then use it as a foothold to infiltrate an equally ubiquitous set of Microsoft tools and products to seize an untold amount of sensitive information.

Hostile foreign nations like China and Russia do not organize cyber operations one sector at a time. They wage simultaneous, parallel campaigns designed to yield the highest possible reward at the lowest possible cost.

It is not uncommon for attacks on the energy sector to coincide with, or foreshadow, similar attacks on other sectors. In 2018, DHS and the FBI warned about a ``multi-stage intrusion campaign'' by Russia that targeted ``U.S. government entities, as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.''

While cyberattacks against the energy sector have accelerated, the sector does not exist in a vacuum.

Though I am concerned about the possibility that these challenges may arise, it is not a foregone conclusion that they will. If DOE collaborates with CISA to forge a more productive and effective partnership, I believe many of these challenges can be overcome.

Last year, I came to the floor to ask the chairman of the Energy and Commerce Committee to confirm his intent that the activities authorized by this legislation be carried out in coordination with DHS. He responded it was ``absolutely'' his intent that these bills be carried out with DHS ``first and foremost.''

I also asked for clarification that these bills do not detract from, erode, or infringe upon any existing authorities or policies laid out in the Cybersecurity and Infrastructure Security Act of 2018, PPD-41, Executive Order 13636, or Executive Order 13691. He responded that ``nothing in these bills is intended to infringe, curtail, or otherwise affect authorities of [DHS] . . . in any way, shape, or form.''

I would like to reiterate these commitments from one year ago, and I look forward to working with the Committee on Energy and Commerce to conduct vigorous oversight to ensure that DOE is coordinating with DHS in a manner that reflects congressional intent.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in support of H.R. 2931, the first of two grid security bills I have worked closely on with my good friend and colleague, the gentleman from California (Mr. McNerney) over the last several Congresses.

The goal of these two bills is to improve the resiliency of our Nation's energy grid against cyberattacks. Since the House last considered these bills on the floor, our country has experienced a new wave of cyberattacks on our critical infrastructure.

On December 13, 2020, the cybersecurity firm, FireEye, published research that a malicious actor was exploiting a supply chain vulnerability in SolarWinds products to hack into government and private sector information technology networks.

On May 8 of this year, the Colonial Pipeline Company announced that it was forced to halt its pipeline operation due to a ransomware attack, which disrupted critical supplies of gasoline and other refined products throughout the Southeast and the East Coast.

Cyberattacks on our critical infrastructure will only continue to grow in both size and severity and Congress must take a stand. H.R. 2931, the Enhancing Grid Security Through Public-Private Partnerships Act, will facilitate and encourage public-private partnerships in order to improve the cybersecurity of electric utilities.

Specifically, it would develop and provide for voluntary implementation of maturity models, self-assessments, and auditing methods for assessing the physical security and cybersecurity of electric utilities.

H.R. 2931 would provide training and technical assistance to electric utilities to address and mitigate cybersecurity supply chain management risks and increase opportunities for sharing best practices and data collection within the electric sector.

Finally, this legislation will require the Secretary of Energy to submit a report to Congress that assesses priorities, policies, procedures, actions, and implementations of electricity distribution systems to address threats to and vulnerabilities of such electricity distribution systems. We cannot allow criminal cyber behavior to go unchallenged. Both H.R. 2931 and H.R. 2928 will help in the fight against cyber attacks.

Mr. Speaker, I thank Chairman Pallone, Chairman Rush, leaders Rodgers and Upton for their efforts to advance these bills, and I encourage all my colleagues to vote ``yes'' on final passage.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, again, from the recent attacks that we have had across the country in the last year and a half, it shows the importance of making sure that we are protected on the cybersecurity front. And working with my good friend and colleague from California, it has been so important that we get these two bills across the finish line today.

Mr. Speaker, I urge all Members today to support H.R. 2931, and I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 2931) to provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days in which to revise and extend their remarks and include extraneous material on H.R. 2931.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I begin by thanking my colleagues on the Committee on Energy and Commerce, Representative McNerney of California and Representative Latta of Ohio, for their continued work and cooperation on energy security issues and for introducing H.R. 2931, the Enhancing Grid Security Through Public-Private Partnerships Act.

This legislation could not be more necessary. Our Nation is facing an increasing number of physical and cyber threats to its electric grid and infrastructure. This bill addresses those threats by directing the Secretary of Energy, in consultation with the Electric Reliability Organization, States, other Federal agencies, and industry stakeholders, to create and implement a program to enhance the physical and cybersecurity of electric utilities.

It calls for cybersecurity training to mitigate supply chain risks and improving the cybersecurity of third-party utility vendors. It also encourages utilities to share best practices and data within the electric sector.

The bill requires the Secretary of Energy to deliver a report to Congress on general cybersecurity concerns and to coordinate with the Department of Homeland Security and other relevant agencies to ensure good communications and smooth implementation of this program across the government.

Finally, the bill instructs the Secretary of Energy to update the Interruption Cost Estimate Calculator, which is an electric reliability planning tool for estimating electricity interruption costs and the benefits associated with reliability benefits.

Mr. Speaker, H.R. 2931 is an important bipartisan bill that will help address the security of our Nation's electric utilities, and I urge my colleagues to support it.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield such time as he may consume to the gentleman from California (Mr. McNerney), the Democratic sponsor.

Mr. Speaker, I have no additional speakers, and I reserve the balance of my time.

Mr. Speaker, I would also ask that all our colleagues would support this on a bipartisan basis, and I yield back the balance of my time.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in support of H.R. 2928, the Cyber Sense Act, which is the second of two grid security bills that I have introduced and, again, worked closely on with my good friend and colleague, the gentleman from California (Mr. McNerney).

This bipartisan legislation will establish a testing process under a newly established voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, including products relating to industrial control systems and operational technologies, such as supervisory control and data acquisition systems.

It would provide technical assistance to electric utilities, product manufacturers, and other electricity sector stakeholders to develop solutions to mitigate identified cybersecurity vulnerabilities in products and technologies tested under the Cyber Sense program.

H.R. 2928 would also develop guidance for electric utilities for procurement of products and technologies and consider incentives to encourage the use of analysis and results of testing under the program in the design of products and technologies for use in the bulk-power system.

The SolarWinds attack exposed a vulnerability in our supply chains that

should serve as a wake-up call to the energy sector. Similar attacks on products used in grid operators' IT networks could go undetected and, when exposed, result in the costly process of disabling and removing such products from operation.

Having a program that would allow for the testing of a product's cybersecurity would help grid operators share information and maintain coordination with the Federal Government to keep pace with evolving cybersecurity threats. H.R. 2928 would accomplish these goals.

Again, I want to thank Chairman Pallone, Chairman Rush, Leader Rodgers, and Leader Upton for their support. I call on my colleagues to support this bill, and I reserve the balance of my time.

Mr. Speaker, I have no other speakers, and I am ready to close.

Mr. Speaker, again, as the gentleman from California mentioned about the ongoing cyberattacks we have had in this country, it is absolutely essential that we get this bill across the finish line. H.R. 2928 is going to help accomplish these goals and protect our grid out there.

Mr. Speaker, I urge all of my colleagues to support this legislation, and I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 2928) to require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days in which to revise and extend their remarks and include extraneous material on H.R. 2928.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise in support of H.R. 2928, the Cyber Sense Act of 2021. Grid security is a national security issue. Fortunately, there has not yet been a broad cyberattack that has taken down large parts of the electric grid in the United States. But as we learned from the ransomware attack on the Colonial Pipeline earlier this year, we must not let our guard down.

Mr. Speaker, I am proud to support H.R. 2928, which gives the electric sector critical tools and technologies necessary to protect our grid from malicious harm.

This legislation gives the Department of Energy an important new authority to facilitate the adoption of more secure technologies and equipment in our Nation's grid. It does this by requiring the Department of Energy to set up a voluntary ``Cyber Sense'' program to identify cyber-secure products for use in the bulk-power system.

The bill also requires the Secretary of Energy to coordinate with the Department of Homeland Security and other relevant Federal agencies in order to ensure smooth and seamless implementation across the Federal Government.

This program would also provide technical assistance to electric utilities and product manufacturers to assist them in developing solutions to mitigate cyber vulnerabilities in the grid.

I want to again thank my colleagues, Representatives McNerney and Latta, for their hard work on this critical issue and for their persistence in pursuing this bill for the last several years. Their partnership and bipartisan leadership on cybersecurity issues continues to benefit us all.

Mr. Speaker, I urge all of my colleagues to support this important bipartisan bill, and I reserve the balance of my time.

Mr. Speaker, I yield such time as he may consume to the gentleman from California (Mr. McNerney), the sponsor of the bill.

Mr. Speaker, I urge my colleagues on both sides to support this bill, and I yield back the balance of my time.