Enhancing Grid Security through Public-Private Partnerships Act

Madam Speaker, while I agree with my colleagues about the importance of securing our Nation's energy infrastructure, I am concerned that--as currently written--H.R. 2931, H.R. 2928, and H.R. 3119 may weaken the core tenets of the U.S. Government's framework for protecting critical infrastructure.

That framework is currently laid out in Presidential Policy Directive 21 (PPD-21) and has been reinforced in numerous Federal policies and statutes enacted since 9/11. It has been embraced by Republican and Democratic administrations alike and by Congress. Earlier this year, Congress strongly reaffirmed its commitment to the PPD-21 framework in the FY2021 National Defense Authorization Act.

PPD-21 designates the Department of Homeland Security (DHS) as the lead Federal agency responsible for coordinating Federal efforts to secure critical infrastructure across all 16 sectors--while working hand-in-hand with Sector Risk Management Agencies (SRMAs).

I support enhancing the Department of Energy (DOE)'s capacity, as the SRMA for the energy sector, to engage with the sector as a liaison, trusted partner, and valuable source of sector-specific expertise.

That said, it is important that legislation authorizing such activity acknowledge the role that DHS, through the Cybersecurity and Infrastructure Security Agency (CISA), plays as the Nation's risk advisor and Federal civilian interface for private sector engagement and collaboration.

Congress has often reiterated that it expects CISA to use its authorities and cross-sector convening power to maintain a bird's eye view of threats across sectors--taking threat intelligence from one sector and integrating it into a broader threat context to help other owners and operators protect themselves.

But CISA can only do this if its SRMA partners work with it in a collaborative way that complements--rather than duplicates--the tools, services, resources CISA brings in support of these broader efforts.

Herein lies the issue with H.R. 2931, H.R. 2928, and H.R. 3119: the measures, as drafted, would authorize DOE to carry out responsibilities and develop capabilities that overlap with or duplicate those already housed within CISA, and there is no directive for DOE to do so in coordination with DHS.

There are several problems that could arise from this lack of coordination.

First, it runs the risk of creating a siloed, stovepiped approach to managing information about threats to the energy sector--a critically important, lifeline sector that has been under sustained attack for decades.

Congress has worked to break down these siloes since 9/11, which is why DHS was tasked as a ``central hub'' for critical infrastructure in the first place.

Second, having multiple Federal agencies carry out overlapping roles and responsibilities creates confusion among private sector stakeholders, who are not sure who to call during a crisis, or who to partner with during steady state.

This duplication also means that the Federal Government is forced to spread an already thin supply of cybersecurity experts and resources even thinner.

Finally, cybersecurity is rarely--if ever--a sector-specific problem.

Critical infrastructure is interconnected, and technologies used in one sector are often deployed throughout others, as are the vulnerabilities embedded in those technologies. Adversaries can use the distributed nature of these vulnerabilities to exploit owners and operators across industry lines, at scale.

Take, for instance, the recent SolarWinds campaign. Russian intelligence agencies were able to corrupt a software update deployed across the public and private sectors, then use it as a foothold to infiltrate an equally ubiquitous set of Microsoft tools and products to seize an untold amount of sensitive information.

Hostile foreign nations like China and Russia do not organize cyber operations one sector at a time. They wage simultaneous, parallel campaigns designed to yield the highest possible reward at the lowest possible cost.

It is not uncommon for attacks on the energy sector to coincide with, or foreshadow, similar attacks on other sectors. In 2018, DHS and the FBI warned about a ``multi-stage intrusion campaign'' by Russia that targeted ``U.S. government entities, as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.''

While cyberattacks against the energy sector have accelerated, the sector does not exist in a vacuum.

Though I am concerned about the possibility that these challenges may arise, it is not a foregone conclusion that they will. If DOE collaborates with CISA to forge a more productive and effective partnership, I believe many of these challenges can be overcome.

Last year, I came to the floor to ask the chairman of the Energy and Commerce Committee to confirm his intent that the activities authorized by this legislation be carried out in coordination with DHS. He responded it was ``absolutely'' his intent that these bills be carried out with DHS ``first and foremost.''

I also asked for clarification that these bills do not detract from, erode, or infringe upon any existing authorities or policies laid out in the Cybersecurity and Infrastructure Security Act of 2018, PPD-41, Executive Order 13636, or Executive Order 13691. He responded that ``nothing in these bills is intended to infringe, curtail, or otherwise affect authorities of [DHS] . . . in any way, shape, or form.''

I would like to reiterate these commitments from one year ago, and I look forward to working with the Committee on Energy and Commerce to conduct vigorous oversight to ensure that DOE is coordinating with DHS in a manner that reflects congressional intent.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise today in support of H.R. 2931, the first of two grid security bills I have worked closely on with my good friend and colleague, the gentleman from California (Mr. McNerney) over the last several Congresses.

The goal of these two bills is to improve the resiliency of our Nation's energy grid against cyberattacks. Since the House last considered these bills on the floor, our country has experienced a new wave of cyberattacks on our critical infrastructure.

On December 13, 2020, the cybersecurity firm, FireEye, published research that a malicious actor was exploiting a supply chain vulnerability in SolarWinds products to hack into government and private sector information technology networks.

On May 8 of this year, the Colonial Pipeline Company announced that it was forced to halt its pipeline operation due to a ransomware attack, which disrupted critical supplies of gasoline and other refined products throughout the Southeast and the East Coast.

Cyberattacks on our critical infrastructure will only continue to grow in both size and severity and Congress must take a stand. H.R. 2931, the Enhancing Grid Security Through Public-Private Partnerships Act, will facilitate and encourage public-private partnerships in order to improve the cybersecurity of electric utilities.

Specifically, it would develop and provide for voluntary implementation of maturity models, self-assessments, and auditing methods for assessing the physical security and cybersecurity of electric utilities.

H.R. 2931 would provide training and technical assistance to electric utilities to address and mitigate cybersecurity supply chain management risks and increase opportunities for sharing best practices and data collection within the electric sector.

Finally, this legislation will require the Secretary of Energy to submit a report to Congress that assesses priorities, policies, procedures, actions, and implementations of electricity distribution systems to address threats to and vulnerabilities of such electricity distribution systems. We cannot allow criminal cyber behavior to go unchallenged. Both H.R. 2931 and H.R. 2928 will help in the fight against cyber attacks.

Mr. Speaker, I thank Chairman Pallone, Chairman Rush, leaders Rodgers and Upton for their efforts to advance these bills, and I encourage all my colleagues to vote ``yes'' on final passage.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, again, from the recent attacks that we have had across the country in the last year and a half, it shows the importance of making sure that we are protected on the cybersecurity front. And working with my good friend and colleague from California, it has been so important that we get these two bills across the finish line today.

Mr. Speaker, I urge all Members today to support H.R. 2931, and I yield back the balance of my time.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 2931) to provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days in which to revise and extend their remarks and include extraneous material on H.R. 2931.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I begin by thanking my colleagues on the Committee on Energy and Commerce, Representative McNerney of California and Representative Latta of Ohio, for their continued work and cooperation on energy security issues and for introducing H.R. 2931, the Enhancing Grid Security Through Public-Private Partnerships Act.

This legislation could not be more necessary. Our Nation is facing an increasing number of physical and cyber threats to its electric grid and infrastructure. This bill addresses those threats by directing the Secretary of Energy, in consultation with the Electric Reliability Organization, States, other Federal agencies, and industry stakeholders, to create and implement a program to enhance the physical and cybersecurity of electric utilities.

It calls for cybersecurity training to mitigate supply chain risks and improving the cybersecurity of third-party utility vendors. It also encourages utilities to share best practices and data within the electric sector.

The bill requires the Secretary of Energy to deliver a report to Congress on general cybersecurity concerns and to coordinate with the Department of Homeland Security and other relevant agencies to ensure good communications and smooth implementation of this program across the government.

Finally, the bill instructs the Secretary of Energy to update the Interruption Cost Estimate Calculator, which is an electric reliability planning tool for estimating electricity interruption costs and the benefits associated with reliability benefits.

Mr. Speaker, H.R. 2931 is an important bipartisan bill that will help address the security of our Nation's electric utilities, and I urge my colleagues to support it.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield such time as he may consume to the gentleman from California (Mr. McNerney), the Democratic sponsor.

Mr. Speaker, I have no additional speakers, and I reserve the balance of my time.

Mr. Speaker, I would also ask that all our colleagues would support this on a bipartisan basis, and I yield back the balance of my time.

Mr. Speaker, I thank the chairman for yielding.

Mr. Speaker, I rise today in support of my legislation, H.R. 2931, the Enhancing Grid Security Through Public-Private Partnership Act. The prior bill, this bill, and the next bill are good examples of working together on a bipartisan basis to accomplish things that are very critical to this country, and I thank my colleagues for being a very important part of this partnership.

Mr. Speaker, I am pleased that we are considering this bill today, because we simply can't afford to wait any longer to secure our Nation's critical infrastructure, including the grid. The Colonial Pipeline attack coming on the heels of the SolarWinds attack was a bright warning sign that we need to act quickly to pass this legislation.

Since the Colonial Pipeline attack, ransomware attacks have continued to skyrocket, and the need to enact H.R. 2931 has become even more pressing. H.R. 2931 would create a program to enhance the physical and cybersecurity of electric utilities. This program would develop methods for assessing security vulnerabilities. It would also provide cybersecurity training to electric utilities, advance cybersecurity of utility third-party vendors, and promote sharing of best practices and data collection in the electric sector.

Under this legislation, the Secretary of Energy would work in consultation with States, Federal agencies, and industry stakeholders to create this program. By encouraging these partnerships, we will better position ourselves to keep the Nation's lights on and to

protect our grid from the growing cyber threats.

Additionally, H.R. 2931 would require the Interruption Cost Estimate Calculator, which is used to calculate the ROI on utility investments, to be updated at least every 2 years to ensure accurate calculations.

Mr. Speaker, I thank my good friend and partner in this legislation, Representative Latta from Ohio, for working with me on this important bill. I also thank Chairman Pallone, Ranking Member Rodgers, and the staff of the committee for helping us move this legislation.

Mr. Speaker, I urge my colleagues to support it.