H.B. 19 Drinking Water Utilities Amendments: transcript

Thank you, Mr. Chair. So this is a bill you all heard last year? Uh, it's HP 19 this year. It, uh, passed through the house last year, passed through this committee, and then we didn't quite get it through the third reading calendar before midnight, so we brought it back as a committee bill this summer for public utilities. Besides that, we also took it through, uh, the water task force and the water commission this summer. So, uh, this bill has been around, so we're asking again, and just because you all may have slept since you last heard it, I don't think I have. But what, what we're dealing with here is the cybersecurity of drinking water utilities. And I have with me the director of the division of drinking water, and he's, he's the subject matter expert here. But I'll tell you that, uh, I think a number I heard is like 2000 water companies in the state, uh, of varying levels of cyber sophistication. Uh, we have large water con county water conservancy districts that probably have all kinds of cybersecurity, and we have very small mom and pop shops who are serving small neighborhoods who maybe don't have any. But what we are seeing is a large and increasing number of hack attacks by, uh, foreign adversaries who are working to destabilize our economy by either turning off the drinking water, damaging the, uh, the infrastructure, uh, taking, uh, electronic control away from the water companies poisoning the water, and or stealing, uh, customer data. So, uh, but this and bank accounts Yeah. And accessing right bank accounts for those who do, uh, do online banking. Yeah. And that's happening in Utah. Uh, and it's happening across the country. Uh, so this bill would, would address those. Some companies, some water companies have had to resort when they lost control of their electronically controlled valves. They've had to resort to manual control their valves for weeks at a time, which is a lot harder and a lot more work. But not all, uh, water companies even have manual controls on their valves anymore. So this, this bill addresses that. Anyway, if it's okay with you, Mr. Chair, I would have our expert maybe give you some better details.

Okay. Yeah. Thank you Mr. Chair. Um, Nathan Lundstedt, director for the Division of Drinking Water. And we appreciate Representative Jack sponsoring this bill. Uh, drinking water infrastructure is critical and like he mentioned, um, a lot of our water systems are under constant attack. Um, we've had a water system in Senator Hinkins, um, district that was actually attacked, uh, twice in one year. Um, and it, you know, poses significant, uh, financial, um, hardships on, on those, uh, water systems. And we've even, even had larger water systems attacked. Um, so it's not just the small systems. Um, and then since 2018, the America's Water Infrastructure Act has required water systems, um, with a population over 3,300 to have a cybersecurity, um, plan as part of their emergency response plan. Um, but we are finding that it's, you know, a lot of our small systems are being attacked. So that's where this bill is, um, very beneficial 'cause it's including all community water systems. Great. Okay. Does that conclude? I, I guess that would conclude our, uh, presentation and, and we'd be open to any questions or, uh, comments from the committee.

Thank you. On line 1 21, we, we've uh, we've set a threshold for 3,300, I guess, uh, users of the system and above what, uh, percentage of, first of all, do you have the, to the director, if I may chair?

Do, uh, the good sponsor mentioned roughly 2000. Do we have a, a accurate number of how many systems we have across the state?

Yeah, Mr. Chair, if I may. Yeah. Um, yes, we do. I don't know the exact numbers off the top of my head, but we have roughly 1200 systems that are active, um, now, and the majority of those are small systems.

That, that, that's the question I'm just, in my mind, I'm wondering how many of those 1200 would be less than 3,300? That, that below that threshold on line 1 21,

If, if I re remember the numbers correctly, Mr. Chair, um, it's probably around 500. Um, I can research that and get those numbers with to you. And part of, um, the resources that we have, we have technical assistance and the outreach and training. We have resources to support, you know, the, especially the smaller water systems to provide them the templates and the plans to, you know, provide the, to get the emergency response plans to address cybersecurity. And Mr. Chair, may I maybe also answer what might be the underlying question? For sure. So on line one 20 to 1 22, it does talk about serving populations greater than 3,300. And we've asked for or required a, uh, emergency response plan by December of this year. That's the larger systems. Uh, the next three lines talk about lesser than 3,300. We gave them more time till July of 2027 to submit the same plan. Uh, so we are capturing in this bill all sizes of water system, but we just gave the smaller ones more time to do that because they may be dealing with, uh, lesser manpower. And, and as director LTA said, they have resources. The Cyber Center of Utah is also here. They have resources and also I'm aware of an RFA that or another bill that actually directs funds towards critical infrastructure such as this.

Yes, I, I actually, I have two or three if I may. Would that be okay? Please? Do you want me to go through you or just directly or what? Let's go right directly. Thank, thank you chair. That was, that was a segue in and, and thank you, uh, representative for, for that response. The question that I, I'm looking at the fiscal note. There's, it's, it's a, there, there's, uh, not a significant, uh, issue there. So director, are you indicating then for those that, is that 3,300 kind of a threshold that those that are maybe less than that would need your assistance and help? And those are above, it may not. Or are you anticipating, I'm sure being involved. What is your, your workload in, in this space to get this done, would you say?

Yeah, Mr. Chair. Um, so, so yes, the systems 3,300 and above have been compliant with that. Um, and so that won't take much effort on our part. Um, the smaller systems, uh, many of them also have already included, uh, cybersecurity is part of their emergency response plans. But we do know there's, um, quite a few that have not, have not started that. Uh, but with our, um, outreach that we do, we're meeting with water systems. We provide the training, we're meeting, we call 'em sanitary surveys where we, um, you know, are doing inspections. And during those visits, um, that's a great opportunity to educate and provide that assistance. Um, and so we have the staffing and the workload to, um, you know, support those water systems that don't have the plans in place now. And especially with, you know, as Representative Jack mentioned, um, there is more time for those small systems to come into compliance. Um, and so there's, you know, a lot of time to, you know, provide that support and education and resources, um, to make sure, you know, the water systems are protected.

Does that answer your question? Yes. I, I'm, I'm just trying to put my sit in the shoes of someone that is, maybe they have a couple of, or maybe they have a couple hundred people that they're servicing, you know, and there's all those concerns that Senator Hinkins talked about, the loss of data and infringement on financial institutions and all that goes with that. Uh, I'm just wondering what has been the response or, or your sense on to either the sponsor or, or the director to, uh, you would think that someone would say, yeah, I really need to do this, but is this a mandate that's gonna be really hard for me to fulfill? What resources are available? You stated, you know, the willingness to help. What's been the, the, the pushback or concern in the industry providers among those 1200 thoughts?

Yeah, Mr. Chair. Yep. Um, yeah, that's a, a great question. And you know, this was a bill proposed bill last year that, you know, as Representative Jack had just ran outta time. So there was a lot of outreach, um, last session. And then during the interim, uh, we did a lot of outreach and went through the water task force. And, um, everything I've heard, there's, um, overwhelming support for this, uh, to have more support for the water systems to be able to handle cyber security issues. 'cause they know that they're constantly under attack. And this bill, um, also requires two hour reporting of a security breach. And we know like the sooner we can get the experts involved, um, it's more likely to recover funds. And, um, the data, especially in, and the, the example in, uh, Senator Hinkins district, you know, we weren't notified until, um, a month later. And we understand, you know, from the FBI Homeland Security, if they had reported at least within 24 hours, all their data and funds would've been recovered. Um, but because of the constant attack and the, the financial losses, uh, there is support. And, you know, I think there is everything I've heard, water systems need help and they need the support 'cause they, um, wanna protect their system and, you know, be able to continue to provide that critical infrastructure.

Different, different line of thought. Real quickly, on line 1 33, it talks about annual cybersecurity training. Are you prepared to if offer that training? Is that the, are you, is, is your department gonna be over the training of cybersecurity or how's that gonna take place?

Yeah, Mr. Chair. Yes. Okay. Um, so we, we do provide many training opportunities. So we have staff that are, um, you know, a cybersecurity expert or running that program that can provide that training. We also have technical assistance providers that are, um, able and other associations that are able to step in. And also I believe the, um, DTS department of or technology services, the cyber center, um, has resources and, um, you know, is willing to provide that training. Is the training already established then? What, what to meet that requirement? Um, we, we do, yes.

Uh, thank, thank you. And, uh, this fiscal note is what the cost is to the state. It's not what it is to the, the water users, their, them themselves will be billed into their rates, uh, their power rates. And so there it'll cost a lot more than what it's showing the 36,000. But that's just the cost of the state. And so that doesn't reflect the water systems. What, uh, and you know, the main part of this bill is to, uh, assure the integrity of our water quality. But, uh, as if always you follow the money, and usually what's the bridge that they done there was, uh, done in Emery County was that they went after the water, the, with the artificial intelligence that they have. Now, this lady that Uintah school with her friend called and had 'em change the bank account. And, uh, actually, I mean, she, they knew they're personal friends, but she actually thought it was her that has had her change the, they said basically, we've changed banks and we, uh, have got the different bank number. And so the money that was being deposited was going into this other bank that, uh, artificial. And so that's where they're going after is the money. And so it breaks a little company like that, you know, when, if you take a month's, uh, water bill or maybe even two months before they realize that it's not in their bank when they get their bank statement at the end of the year or end of the month or whatever it is. And, uh, so it's, uh, it'd be a real hardship on some of these small water users. And so, uh, utility companies and like I said, they, they didn't know that it would happen until too late. And then they reported it even later 'cause they didn't know what to do. And so this training is just part of, it's just to, to know who to get ahold of if something like this happens. And so this is very, a very important bill, uh, that we have this, because with this artificial intelligence, you don't even know what's true and what's not true. Correct. And so I appreciate, uh, Representative Jack doing this and, and you guys support him in this. So Yeah. Thank you. Thank

Uh, yes. Thank you, Mr. Chair. That, that's accurate.

I would make a motion we pass out house bill 19 with the favorable recommendation for the full body of the Senate.

Thank you. I I do support the, the motion. I would like to ask the question though, what type of cost this is gonna be to the water users and the company. If, if, if that has been considered financial cost to Senator Hinkins, it's gonna probably about Half of what it would be. If they don't have cyber security, It may, if it gives They get robbed or if something happens contaminate their water system, it's gonna be a whole lot more than what this is gonna cost, I believe. You know, to be be honest with you. I mean, it's something that they can't go out and get personally, and they, and you don't really know who you can trust if the state's overseeing it. You, you can pretty well be rest assured that because there's other places that do cybersecurity, but you really don't know if they're even legitimate or not either so, or they're even looking out for your best interests.

Yeah, it will vary. Um, it will be system specific and, um, it could be, you know, for a system that doesn't have much automation, um, it may be, you know, very inexpensive, hundreds of dollars to, um, it could be quite expensive for bigger systems with that have a lot of infrastructure and a lot of, um, control systems built in. Um, but you know, as senator, you know, kin's mentioned, you know, the systems that don't take action if they are attacked, it becomes, uh, very expensive. You know, we had a large system in the Salt Lake Valley that was attacked and it took them eight 18 months and longer to recover, um, their systems, which took down the entire city, you know, 9 1 1 services, um, payroll, um, you know, and having to go to manual operation, which was a, a big challenge. Wow. And so, you know, the cost upfront to have a plan in place and be protected, you know, definitely outweighs the, the risk. Right.

Go ahead, Mr. Chair. Can I just, so, um, I'm not, not necessarily a water guy, but I'm a utility guy. And, uh, and in, and in our small electric utility, uh, we had, we had to adjust to this new reality and think about some of the, some of the things that you might already do or maybe you don't and you should do, uh, you things that don't cost money, but think about, uh, your passwords. Do you have any passwords that are password, the word password? You can't, shouldn't have any of those. Uh, you should change all the default passwords. That's, that's part of this, uh, you should patch your systems. Unpatched, uh, systems. Those are, those are the biggest source of hack attacks. So just downloading the patch and the firmware and your software and then using multifactor authentication on your systems. So that's all, that's all things that you start out with. And that's kind of the low hanging fruit and has almost no cost. So from there on up, uh, that's, that's the scope. So it's not like you have to be from zero to NASA in one year, but you do have to have a plan and work towards it. That's what we're trying to do, Is that, uh, further discussion to the motion.

Th thank you. I, again, I support the motion. I I would, I hope this is, is pertinent and relevant, uh, germane to the motion. We need to recognize that, that these are some real realities we're dealing with today in today's world. And, and unfortunately that's the case. I heard a statistic that the majority of businesses that, uh, are have a cyber attack go outta business. And that potentially is the cost. But, but we are putting, uh, and have on our landscape many pressures to our water system financially. It, it could be that, uh, this would be potentially a, a cost that would, a percentage, maybe it's a third more what, whatever I'm paying now to take care of this cyber security stuff, I need to pay another third. I don't know what it, that, that's why I asked the question to, to the motion. We don't have an option not to do it. 'cause our vulnerability is certainly there, but we need to recognize the stress that that's putting on the budgets and, and, and, uh, these are some of those, those unforecasted unrecognized costs that, uh, we're dealing with in today's society. And be careful and weigh, bring these all into consideration when we talk about what are, how are we going to, are we gonna put this burden, the future burden of infrastructure for the whole state on all? Spread it throughout. You know, there's, there's a lot of things that we're, we're doing here that we need to just keep on our landscape. That's my comment. Thank

Uh, thank you. Yes. I think, uh, just exactly has been stated today. Uh, not doing this is not an option. Yes, it comes at some cost, but as also has been pointed out today that the cost not to do it is probably the price of going outta business and, and putting customers out of service. And this is critical infrastructure. And so we can't, we, we cannot not do it. Thank you, Mr. Chair. Thank you. And back to you, Senator.

Yeah, I would just like to add that, you know, if a small, uh, uh, water district or something may not elect to do this, they can be on manual. Uh, they don't have to be online, but anytime you tie into the internet, you're gonna be subject to that. So if you want your, uh, personnel to be able to control the water system from their homes and not have to run out to the water plant every couple hours and check on it, or have people do that, they have that. Right. You know, they, they could do that and say, well, we don't need cybersecurity because we're not tied into to anything starlink or anything else. And so they would have that option if they can't afford it. But I'm, most of 'em already do it. I mean, 90% of 'em. But they just, like you said, just changing passwords and little simple things that it's good to be reminded. I mean, I, I'm the worst one of to not change mine. I mean, I've, and I know better. But anyway, it's one of those things that it's kind of nice to know. But, uh, anyway, I would, with that, I would just ask for your support on this bill.

Thank you Mr. Speaker. Uh, HP 19, uh, was passed by this body. Last session passed by committee's last session and died at midnight on the Senate Third Reading calendar, along with several other good and important bills. So in this, uh, interim, we brought this bill back in, uh, maybe verbatim, uh, what it was that you all approved last year. We took it through three interim committees. Uh, the first was a public utilities energy technology, which adopted it as a committee bill. It passed unanimously, which is why we're hearing it today. It also passed through, um, uh, the Natural Resources Committee unanimously, and it passed through the Legislative Water Development Commission unanimously. So, uh, this bill has been well and truly vetted. But for those of you who have slept since last session, I know I haven't, but some of you might have. Um, what this bill does is it deals with cybersecurity. There are approximately 2000 water companies in the state of Utah. And, uh, water companies have not been as, um, as aggressive or as forward pressed to deal with cybersecurity as power companies. And so they have been hugely attacked. And there have been several cybersecurity breaches in the state of Utah with water companies. So we've worked with the Division of Drinking Water and with the Utah Cyber Center to try to solve those problems. The specifics are in the bill, but that is the short and sweet recap of what everybody already voted on last year. And with that Mr. Speaker, I am open to any questions people may have.

Thank you. I'll waive Summation has been waived.

In light of the recent water audit findings that came out last Friday, this bill could not be more timely. The good representative Colin Jack asked me to be a sponsor and I was happy to do this. This is a good Samaritan bill. So what it does is it addresses the security at our drinking water facilities. First, it requires a community water system to complete an emergency response plan. Second, ask them to report a security breach to the Utah Cyber Center within two hours of discovering the breach. Third, it requires the division of drinking water to report annually to two legislative committees on security at community water systems. And lastly, it classifies a community water systems emergency response plan as a protected record. And especially we don't want our enemies knowing where our vulnerabilities are, but they're out there, uh, as noted in the water audit. And, um, with that I am open to questions. Thank you. Really important, bill.

Thank you. Um, call the question please. Thank You. And the question is, shall

house bill 19 be read A third time? Roll call vote. Senator Spery Aye. Lewin Aye. Brammer Aye. Bus Colmore Escamilla Fillmore Grover Harper Kinins Aye. Ipson Johnson Quan McKay. Mikel Mikel Milner Musselman Owens Pitcher Plum Rebe Sandal Stevenson Stratton Vickers. Weiler Aye. Wilson Aye. Winterton Aye. President Adams Aye. House

Thank you. Today I'd like to introduce my guest, Jacob Torres.

Thank you Mr. President. Uh, Utah's drinking water systems are becoming more reliant on digital control systems, which makes them more vulnerable to cyber attacks and system failures. While our federal government already has emergency planning in place, this bill is going to put it into our state, which would require a community water system to have and complete an emergency response plan to report any security breaches to the Utah Cyber Center. Within two hours of discovering the breach, require the division of drinking water to report annually to two legislative committees on security at community water systems and classify community water's emergency response plan as a protected record so that we keep it safe from those who are not our friends and allies. Um, this is, uh, in light of the recent water audit that happened last Friday. This is super timely according to the concerns that were brought up about vulnerabilities and cyber attacks. And with that, I conclude my presentation. Thank you for the presentation.

I move that this bell pass.

Thank you Mr. President. Uh, the gist of this bill is a result from the study from the interim committee, uh,