Pipeline Security Act

IB Union Calendar No. 224 116TH CONGRESS 1ST SESSION H. R. 3699 [Report No. 116–279] To codify the Transportation Security Administration’s responsibility relating to securing pipelines against cybersecurity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cyberse- curity of pipelines, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 11, 2019 Mr. CLEAVER introduced the following bill; which was referred to the Committee on Homeland Security NOVEMBER 12, 2019 Additional sponsor: Mr. TAYLOR NOVEMBER 12, 2019 Committed to the Committee of the Whole House on the State of the Union and ordered to be printed VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 3699 RH A BILL To codify the Transportation Security Administration’s re- sponsibility relating to securing pipelines against cyberse- curity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cybersecurity of pipelines, and for other purposes. VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 3699 RH Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Pipeline Security Act’’. 4 SEC. 2. PIPELINE SECURITY RESPONSIBILITIES. 5 Subsection (f) of section 114 of title 49, United 6 States Code, is amended— 7 (1) in paragraph (15), by striking ‘‘and’’ after 8 the semicolon at the end; 9 (2) by redesignating paragraph (16) as para- 10 graph (17); and 11 (3) by inserting after paragraph (15) the fol- 12 lowing new paragraph: 13 ‘‘(16) maintain responsibility, in coordination 14 with the Director of the Cybersecurity and Infra- 15 structure Security Agency, as appropriate, relating 16 to securing pipeline transportation and pipeline fa- 17 cilities (as such terms are defined in section 60101 18 of this title) against cybersecurity threats (as such 19 term is defined in section 102 of the Cybersecurity 20 Information Sharing Act of 2015 (Public Law 114– 21 113; 6 U.S.C. 1501)), an act of terrorism (as such 22 term is defined in section 3077 of title 18), and 23 other nefarious acts that jeopardize the physical se- 24 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 3699 RH curity or cybersecurity of such transportation or fa- 1 cilities; and’’. 2 SEC. 3. PIPELINE SECURITY SECTION. 3 (a) IN GENERAL.—Title XII of the Implementing 4 Recommendations of the 9/11 Commission Act of 2007 5 (Public Law 110–53) is amended by adding at the end 6 the following new section: 7 ‘‘SEC. 1209. PIPELINE SECURITY SECTION. 8 ‘‘(a) ESTABLISHMENT.—There is within the Trans- 9 portation Security Administration a pipeline security sec- 10 tion to carry out pipeline security programs in furtherance 11 of section 114(f)(16) of title 49, United States Code. 12 ‘‘(b) MISSION.—The mission of the section referred 13 to in subsection (a) is to oversee, in coordination with the 14 the Cybersecurity and Infrastructure Security Agency of 15 the Department of Homeland Security, the security of 16 pipeline transportation and pipeline facilities (as such 17 terms are defined in section 60101 of title 49, United 18 States Code) against cybersecurity threats (as such term 19 is defined in section 102 of the Cybersecurity Information 20 Sharing Act of 2015 (Public Law 114–113; 6 U.S.C. 21 1501)), an act of terrorism (as such term is defined in 22 section 3077 of title 18, United States Code), and other 23 nefarious acts that jeopardize the physical security or cy- 24 bersecurity of such transportation or facilities. 25 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 3699 RH ‘‘(c) LEADERSHIP; STAFFING.—The Administrator of 1 the Transportation Security Administration shall appoint 2 as the head of the section an individual with knowledge 3 of the pipeline industry and security best practices, as de- 4 termined appropriate by the Administrator. The section 5 shall be staffed by a workforce that includes personnel 6 with cybersecurity expertise. 7 ‘‘(d) RESPONSIBILITIES.—The section shall be re- 8 sponsible for carrying out the duties of the section as di- 9 rected by the Administrator of the Transportation Secu- 10 rity Administration, acting through the head appointed 11 pursuant to subsection (c). Such duties shall include the 12 following: 13 ‘‘(1) Developing, in consultation with relevant 14 Federal, State, local, Tribal, territorial entities and 15 public and private sector stakeholders, guidelines for 16 improving the security of pipeline transportation and 17 pipeline facilities against cybersecurity threats, an 18 act of terrorism, and other nefarious acts that jeop- 19 ardize the physical security or cybersecurity of such 20 transportation or facilities, consistent with the Na- 21 tional Institute of Standards and Technology 22 Framework for Improvement of Critical Infrastruc- 23 ture Cybersecurity and any update to such guide- 24 lines pursuant to section 2(c)(15) of the National 25 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 3699 RH Institute for Standards and Technology Act (15 1 U.S.C. 272(c)(15)). 2 ‘‘(2) Updating such guidelines as necessary 3 based on intelligence and risk assessments, but not 4 less frequently than every three years. 5 ‘‘(3) Sharing of such guidelines and, as appro- 6 priate, intelligence and information regarding such 7 security threats to pipeline transportation and pipe- 8 line facilities, as appropriate, with relevant Federal, 9 State, local, Tribal, and territorial entities and pub- 10 lic and private sector stakeholders. 11 ‘‘(4) Conducting voluntary security assessments 12 based on the guidelines developed pursuant to para- 13 graph (1) to provide recommendations for the im- 14 provement of the security of pipeline transportation 15 and pipeline facilities against cybersecurity threats, 16 an act of terrorism, and other nefarious acts that 17 jeopardize the physical security or cybersecurity of 18 such transportation or facilities, including the secu- 19 rity policies, plans, practices, and training programs 20 maintained by owners and operators of pipeline fa- 21 cilities. 22 ‘‘(5) Carrying out a program through which the 23 Administrator identifies and ranks the relative risk 24 of pipelines and inspects pipeline facilities des- 25 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 3699 RH ignated by owners and operators of such facilities as 1 critical based on the guidelines developed pursuant 2 to paragraph (1). 3 ‘‘(6) Preparing notice and comment regulations 4 for publication, if determined necessary by the Ad- 5 ministrator. 6 ‘‘(e) DETAILS.—In furtherance of the section’s mis- 7 sion, as set forth in subsection (b), the Administrator and 8 the Director of the Cybersecurity and Infrastructure Secu- 9 rity Agency may detail personnel between their compo- 10 nents to leverage expertise. Personnel detailed from the 11 Cybersecurity and Infrastructure Security Agency may be 12 considered as fulfilling the cybersecurity expertise require- 13 ments in referred to in subsection (c).’’. 14 (b) UPDATED GUIDELINES.—Not later than March 15 31, 2021, the section shall publish updated guidelines pur- 16 suant to section 1209 of the Implementing Recommenda- 17 tions of the 9/11 Commission Act of 2007, as added by 18 subsection (a). 19 (c) CLERICAL AMENDMENT.—The table of contents 20 for the Implementing Recommendations of the 9/11 Com- 21 mission Act of 2007 is amended by inserting after the item 22 relating to section 1208 the following new item: 23 ‘‘Sec. 1209. Pipeline security section.’’. VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6211 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 3699 RH SEC. 4. PERSONNEL STRATEGY. 1 (a) IN GENERAL.—Not later than 180 days after the 2 date of the enactment of this Act, the Administrator of 3 the Transportation Security Administration, in coordina- 4 tion with the Director of the Cybersecurity and Infrastruc- 5 ture Security Agency of the Department of Homeland Se- 6 curity, shall develop a personnel strategy for enhancing 7 operations within the pipeline security section of the 8 Transportation Security Administration, as established 9 pursuant to section 1209 of the Implementing Rec- 10 ommendations of the 9/11 Commission Act of 2007, as 11 added by section 3. 12 (b) CONTENTS.—The strategy required under sub- 13 section (a) shall take into consideration the most recently 14 published versions of each of the following documents: 15 (1) The Transportation Security Administration 16 National Strategy for Transportation Security. 17 (2) The Department of Homeland Security Cy- 18 bersecurity Strategy. 19 (3) The Transportation Security Administration 20 Cybersecurity Roadmap. 21 (4) The Department of Homeland Security Bal- 22 anced Workforce Strategy. 23 (5) The Department of Homeland Security 24 Quadrennial Homeland Security Review. 25 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 3699 RH (c) RESOURCES.—The strategy shall include an as- 1 sessment of resources determined necessary by the Admin- 2 istrator. 3 (d) SUBMISSION TO CONGRESS.—Upon development 4 of the strategy, the Administrator of the Transportation 5 Security Administration shall provide to the Committee on 6 Homeland Security of the House of Representatives and 7 the Committee on Commerce, Science, and Transportation 8 of the Senate a copy of such strategy. 9 SEC. 5. OVERSIGHT. 10 (a) REPORT TO CONGRESS.—The Administrator of 11 the Transportation Security Administration shall report to 12 the Committee on Homeland Security of the House of 13 Representatives and the Committee on Commerce, 14 Science, and Transportation of the Senate not less than 15 annually on activities of the pipeline security section of 16 the Administration, as established pursuant to section 17 1209 of the Implementing Recommendations of the 9/11 18 Commission Act of 2007, as added by section 3, including 19 information with respect to guidelines, security assess- 20 ments, and inspections. Each such report shall include a 21 determination by the Administrator regarding whether 22 there is a need for new regulations or non-regulatory ini- 23 tiatives and the basis for such determination. 24 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 3699 RH (b) GAO REVIEW.—Not later than two years after 1 the date of the enactment of this Act, the Comptroller 2 General of the United States shall conduct a review of the 3 implementation of this Act and the amendments made by 4 this Act. 5 SEC. 6. STAKEHOLDER ENGAGEMENT. 6 Not later than one year after the date of the enact- 7 ment of this Act, the Administrator of the Transportation 8 Security Administration shall convene not less than two 9 industry days to engage with relevant pipeline transpor- 10 tation and pipeline facilities stakeholders on matters re- 11 lated to the security of pipeline transportation and pipeline 12 facilities (as such terms are defined in section 60101 of 13 title 49, United States Code). 14 VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS Union Calendar No. 224 116TH CONGRESS 1ST SESSION H. R. 3699 [Report No. 116–279] A BILL To codify the Transportation Security Administra- tion’s responsibility relating to securing pipelines against cybersecurity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cybersecurity of pipelines, and for other purposes. NOVEMBER 12, 2019 Committed to the Committee of the Whole House on the State of the Union and ordered to be printed VerDate Sep 11 2014 00:38 Nov 13, 2019 Jkt 099200 PO 00000 Frm 00012 Fmt 6651 Sfmt 6651 E:\BILLS\H3699.RH H3699 pamtmann on DSKBC07HB2PROD with BILLS