Securing Energy Infrastructure Act

II Calendar No. 173 116TH CONGRESS 1ST SESSION S. 174 [Report No. 116–71] To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. IN THE SENATE OF THE UNITED STATES JANUARY 17, 2019 Mr. KING (for himself, Mr. RISCH, Mr. HEINRICH, Ms. COLLINS, and Mr. CRAPO) introduced the following bill; which was read twice and referred to the Committee on Energy and Natural Resources AUGUST 16, 2019 Reported under authority of the order of the Senate of August 1, 2019, by Ms. MURKOWSKI, with an amendment [Omit the part struck through and insert the part printed in italic] A BILL To provide for the establishment of a pilot program to iden- tify security vulnerabilities of certain entities in the en- ergy sector. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 174 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Securing Energy Infra- 2 structure Act’’. 3 SEC. 2. DEFINITIONS. 4 In this Act: 5 (1) APPROPRIATE COMMITTEE OF CONGRESS.— 6 The term ‘‘appropriate committee of Congress’’ 7 means— 8 (A) the Select Committee on Intelligence, 9 the Committee on Homeland Security and Gov- 10 ernmental Affairs, and the Committee on En- 11 ergy and Natural Resources of the Senate; and 12 (B) the Permanent Select Committee on 13 Intelligence, the Committee on Homeland Secu- 14 rity, and the Committee on Energy and Com- 15 merce of the House of Representatives. 16 (2) COVERED ENTITY.—The term ‘‘covered en- 17 tity’’ means an entity identified pursuant to section 18 9(a) owner or operator described in section 9(c) of 19 Executive Order 13636 of February 12, 2013 (78 20 Fed. Reg. 11742), relating to identification of crit- 21 ical infrastructure where a cybersecurity incident 22 could reasonably result in catastrophic regional or 23 national effects on public health or safety, economic 24 security, or national security. 25 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 174 RS (3) EXPLOIT.—The term ‘‘exploit’’ means a 1 software tool designed to take advantage of a secu- 2 rity vulnerability. 3 (4) INDUSTRIAL CONTROL SYSTEM.— 4 (A) IN GENERAL.—The term ‘‘industrial 5 control system’’ means an operational tech- 6 nology used to measure, control, or manage in- 7 dustrial functions. 8 (B) INCLUSIONS.—The term ‘‘industrial 9 control system’’ includes supervisory control 10 and data acquisition systems, distributed con- 11 trol systems, and programmable logic or embed- 12 ded controllers. 13 (5) NATIONAL LABORATORY.—The term ‘‘Na- 14 tional Laboratory’’ has the meaning given the term 15 in section 2 of the Energy Policy Act of 2005 (42 16 U.S.C. 15801). 17 (6) PROGRAM.—The term ‘‘Program’’ means 18 the pilot program established under section 3. 19 (7) SECRETARY.—The term ‘‘Secretary’’ means 20 the Secretary of Energy. 21 (8) SECURITY VULNERABILITY.—The term ‘‘se- 22 curity vulnerability’’ means any attribute of hard- 23 ware, software, process, or procedure that could en- 24 able or facilitate the defeat of a security control. 25 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 174 RS SEC. 3. PILOT PROGRAM FOR SECURING ENERGY INFRA- 1 STRUCTURE. 2 Not later than 180 days after the date of enactment 3 of this Act, the Secretary shall establish a 2-year control 4 systems implementation pilot program within the National 5 Laboratories for the purposes of— 6 (1) partnering with covered entities in the en- 7 ergy sector (including critical component manufac- 8 turers in the supply chain) that voluntarily partici- 9 pate in the Program to identify new classes of secu- 10 rity vulnerabilities of the covered entities; and 11 (2) evaluating technology and standards, in 12 partnership with covered entities, to isolate and de- 13 fend industrial control systems of covered entities 14 from security vulnerabilities and exploits in the most 15 critical systems of the covered entities, including— 16 (A) analog and nondigital control systems; 17 (B) purpose-built control systems; and 18 (C) physical controls. 19 SEC. 4. WORKING GROUP TO EVALUATE PROGRAM STAND- 20 ARDS AND DEVELOP STRATEGY. 21 (a) ESTABLISHMENT.—The Secretary shall establish 22 a working group— 23 (1) to evaluate the technology and standards 24 used in the Program under section 3(2); and 25 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 174 RS (2) to develop a national cyber-informed engi- 1 neering strategy to isolate and defend covered enti- 2 ties from security vulnerabilities and exploits in the 3 most critical systems of the covered entities. 4 (b) MEMBERSHIP.—The working group established 5 under subsection (a) shall be composed of not fewer than 6 10 members, to be appointed by the Secretary, at least 7 1 member of which shall represent each of the following: 8 (1) The Department of Energy. 9 (2) The energy industry, including electric utili- 10 ties and manufacturers recommended by the Energy 11 Sector coordinating councils. 12 (3)(A) The Department of Homeland Security; 13 or 14 (B) the Industrial Control Systems Cyber 15 Emergency Response Team. 16 (4) The North American Electric Reliability 17 Corporation. 18 (5) The Nuclear Regulatory Commission. 19 (6)(A) The Office of the Director of National 20 Intelligence; or 21 (B) the intelligence community (as defined in 22 section 3 of the National Security Act of 1947 (50 23 U.S.C. 3003)). 24 (7)(A) The Department of Defense; or 25 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 174 RS (B) the Assistant Secretary of Defense for 1 Homeland Security and America’s Security Affairs. 2 (8) A State or regional energy agency. 3 (9) A national research body or academic insti- 4 tution. 5 (10) The National Laboratories. 6 SEC. 5. REPORTS ON THE PROGRAM. 7 (a) INTERIM REPORT.—Not later than 180 days 8 after the date on which funds are first disbursed under 9 the Program, the Secretary shall submit to the appro- 10 priate committees of Congress an interim report that— 11 (1) describes the results of the Program; 12 (2) includes an analysis of the feasibility of 13 each method studied under the Program; and 14 (3) describes the results of the evaluations con- 15 ducted by the working group established under sec- 16 tion 4(a). 17 (b) FINAL REPORT.—Not later than 2 years after the 18 date on which funds are first disbursed under the Pro- 19 gram, the Secretary shall submit to the appropriate com- 20 mittees of Congress a final report that— 21 (1) describes the results of the Program; 22 (2) includes an analysis of the feasibility of 23 each method studied under the Program; and 24 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 174 RS (3) describes the results of the evaluations con- 1 ducted by the working group established under sec- 2 tion 4(a). 3 SEC. 6. EXEMPTION FROM DISCLOSURE. 4 Information shared by or with the Federal Govern- 5 ment or a State, Tribal, or local government under this 6 Act shall be— 7 (1) deemed to be voluntarily shared informa- 8 tion; 9 (2) exempt from disclosure under section 552 of 10 title 5, United States Code, or any provision of any 11 State, Tribal, or local freedom of information law, 12 open government law, open meetings law, open 13 records law, sunshine law, or similar law requiring 14 the disclosure of information or records; and 15 (3) withheld from the public, without discretion, 16 under section 552(b)(3) of title 5, United States 17 Code, or any provision of a State, Tribal, or local 18 law requiring the disclosure of information or 19 records. 20 SEC. 7. PROTECTION FROM LIABILITY. 21 (a) IN GENERAL.—A cause of action against a cov- 22 ered entity for engaging in the voluntary activities author- 23 ized under section 3— 24 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 174 RS (1) shall not lie or be maintained in any court; 1 and 2 (2) shall be promptly dismissed by the applica- 3 ble court. 4 (b) VOLUNTARY ACTIVITIES.—Nothing in this Act 5 subjects any covered entity to liability for not engaging 6 in the voluntary activities authorized under section 3. 7 SEC. 8. NO NEW REGULATORY AUTHORITY FOR FEDERAL 8 AGENCIES. 9 Nothing in this Act authorizes the Secretary or the 10 head of any other department or agency of the Federal 11 Government to issue new regulations. 12 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 13 (a) PILOT PROGRAM.—There is authorized to be ap- 14 propriated $10,000,000 to carry out section 3. 15 (b) WORKING GROUP AND REPORT.—There is au- 16 thorized to be appropriated $1,500,000 to carry out sec- 17 tions 4 and 5. 18 (c) AVAILABILITY.—Amounts made available under 19 subsections (a) and (b) shall remain available until ex- 20 pended. 21 VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS Calendar No. 173 116TH CONGRESS 1ST SESSION S. 174 [Report No. 116–71] A BILL To provide for the establishment of a pilot program to identify security vulnerabilities of certain enti- ties in the energy sector. AUGUST 16, 2019 Reported with an amendment VerDate Sep 11 2014 20:52 Aug 16, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6651 Sfmt 6651 E:\BILLS\S174.RS S174 pamtmann on DSKBFK8HB2PROD with BILLS