H.B. 165 Critical Infrastructure Amendments: transcript

Yes. And I'm speaking to the third sub, so if it's appropriate between adopt that sub

Right. There was just some consistencies that we try to make through the bill that we already have in code, and that's using, um, federal prohibited, um, materials and, and equipment. And then the second part was instead of calling state, calling it government entities.

Third sub. Right. Third sub. I move that we delete entitled and Body House Bill 1 65 for substitute and replace it with third substitute House Bill. 1 65

Thank you Mr. Chair. Um, this is actually a small bill, but it's a really important bill. Um, you may have saw just a couple days ago, I guess it was Thursday of last week, where, um, we had a, a press release with the governor talking about some foreign influences buying property and different things. Um, I'm kind of glad that the media didn't get picked up on this part. It was basically me and, um, representative Pucci speaking about these two pieces. Um, because I guess it doesn't flat out explain it, but it really would scare you to death. Our water infrastructure, um, communications and electrical, um, they have components in them that we really didn't realize were that big of a deal. Like a little chini circuit board, we call it operational technology that turns on the pump, it turns off the pump, but what we found, there's malware on them, which means someone else can remotely access them and turn them on and turn them off. And that can do a couple things. One, shut off all the water or dump all the chlorine at one time into the water and, and ruin the water. Um, same thing with communications and electricity. So this is a, a bill that's, um, basically requires all government entities, special districts to, to be able to apply a tool to make sure that there, uh, is or is not malware and that it is shielded, so it can't be remotely accessed. Um, DTS has funding that would be able to help some of the smaller entities to make sure that they can get this done. So with that, I'm open to any questions.

Thank you Mr. Chair. Um, I'm just wondering, uh, why this bill is only on, um, foreign adversaries. Um, do we already have, uh, programs for domestic adversaries?

I mean, I would guess that that would still be Issue issue. It would, it would cover domestic as well, but, so this is both. Okay. We have had active threats with it, and so that's where this came from. Okay. Thank you. You're Welcome.

Mr. Chair, members of the committee. Uh, Tim Davis. Uh, DEQ, executive Director. It's good to see you all. Um, I'll just say that you, you've already passed through House Bill 19, um, that was Representative Jack's bill related to public water systems and being protected by, uh, cyber from, uh, from cybersecurity attacks. This bill, I think, goes well with it. They're kind of hand in glove to provide assistance and guidance to those public water systems as they're moving forward with, with protecting people's drinking water. So, happy to answer any questions.

I make a motion that third substitute house bill 1 65. Pass this committee. Go to the full floor of the Senate Discussion of that motion.

I waive. Thank you for your time.

Thank you, Mr. Chair and committee. Um, I have Alan Fuller with me from DTS, um, to help me present with this, this bill. We've worked on this for a couple years now, and it's, it's really trying to protect Utah state's critical infrastructure. Um, if you wanna look at the bill, um, inside, um, started on line 33. It really talks what we're, we're dealing with, like, uh, emergency service, communications, electric power, water wa and wastewater transportation and so forth. Um, what we've found in the last few years is that many of our technologies that we use, we don't realize that there's malware on many of them that allows remote access. So this last year, we've added water to this component. Um, we ran a test in Utah, and, um, some of the cities and smaller areas that have, um, used water pumps basically, and on, on these pumps. They don't really have a computer or anything, but there's a small, what we call operational technology or a little, um, little software on there that's had malware placed on it. So someone that is not supposed to could access those and either shut the pumps off or open up all the valves and dump chlorine in their water or whatever it may be. And, and we have that on all these different areas that, um, could really provide a massive disruption to the state. So this is working with, in conjunction with DTS. Um, they already doing a fantastic job. They're aware of this. This helps outline some of the components, what they need to, um, do. Um, there is a, a little piece of this that they already have, um, um, running, uh, Senator Harper has an RFA open to help provide some funding to DTS that can help smaller agencies and communities to be able to help them get moving forward with some of these, whether it's a software solution or other issues that help to make sure that we harden our systems a little bit. And with that, I'd like to give some time to, um, Alan Fuller to explain as well. Thank

You, representative. Thank you, Representative Brooks. Uh, we've, uh, Alan Fuller, chief Information Officer for the State of Utah. And I just want to say, uh, thank you to Representative Brooks for his leadership on this important, uh, issue with regard to, um, we have within our division of technology services, the Cyber Center for the State. And we've done a whole of state cybersecurity program that was funded by the, A grant from the federal government for 13 million and a match by the legislature for 4 million. And that program has been enormously successful in rolling out tens of thousands of endpoint protection and training, uh, to city and county, um, uh, people. And the, the RFA that he mentioned is, uh, is to extend that program as well as to both in time and to extend it to K through 12 and to to water districts. To the point of this bill, uh, this bill requires the cyber center to provide guidance on cybersecurity. Um, and we are, we are prepared to do that, and we will leverage resources, uh, from the, from cisa, the, the Federal Government for Agency for Cybersecurity, and also nist, which provides standards. And we will, we will provide, uh, guidance and advice and help. And then with the, the R ffa, we can provide tooling. Thank you. So you can tell, like in, in our state, we have a lot of little towns. Like in my district down in the south, we have enterprise or maybe over in Penguin, or even at, you know, Tropic. They, they don't have the resources that they need, but we have great resources here with, with the Department of Technology Services that can really provide guidance to make sure that we are protected statewide. With that, that pre uh, concludes my presentation chair, Mr. Chair.

Actually, I did have one clarifying question. Go ahead. Quick, sorry. Um, you said there's an RFA that goes along with it. Do you

Know what? Oh, the bill itself stands alone, but we do, we're trying to help a program that they already have in place that helps with the, um, K through 12, the public school systems and water districts. And this allows that, so let's say a small, um, community, they can provide some funding to help them get started in it until they build up their own revenue source to be able to pay for it.

Is that RFA going through, like public ed? Or is It, I I don't know where it's going Through general governance.

General governance, uh, the sponsors are, uh, actually a little bit more complex. Senator Harper and Representative Albrecht both did RFAs and I think they're going to merge, be merging those together. Okay.

Okay. All right. Thank you. I just had a Question. We're still on negotiation on all of that. Okay. Good question.

So I, I move that we pass forward with a favorable recommendation. First substitute HB 1 65 critical infrastructure amendments

Um, sounds good. I think hardening our grid as much as possible is good. So thank you.

Thank you, committee. Okay, we're gonna go

Thank you Mr. Speaker. For the last couple years we've been working on, um, different organizations and how we can protect UTAHNS from our critical infrastructure being accessed by those who should not access it. This bill expands that and includes, um, protecting our emergency services, communication systems, our water systems and electrical systems. Um, just, just last year, you think that on a water pump, there's not a lot of technology that can be accessed. And there's a, there's usually a little teeny, uh, circuit board and that on that circuit board has what they call operational technology. But what they're finding is there's malware on it that allows someone to be able to re access that remotely and they can do all kinds of things in our critical infrastructure with water and our electricity and our communication. So this is, uh, allows DTS to be able to further their, their pilot program to make sure that we're safe here in Utah and protect us and say, and with that, I'm open to any questions.

Thank you. Thank you, Mr. Speaker. Um, I move that the following bill be lifted from the political subdivision's, uh, house standing committee and return to rules. And that's Senate bill one 31st substitute River Restoration Amendments.

Would. Um, this is a bill that, uh, actually was assigned already to the political subdivisions committee. It, uh, passed the committee was sent back to rules and we loved it so much. We sent it back over to political subdivisions for another hearing and, uh, uh, realized that it needed to go back to rules for fiscal impact, Trying to double check and scrub those Senate bills.

Thank you Mr. President. I think we have online a Substitute or an amendment. I think it's an amendment. We're on the third. Oh, we got it. We we did that. Take it. Okay. Very good. Great. Bill. Uh, thank you. We're we're as as, as we look at the threats, one of, you know, one of the great world wars is what we're doing with cybersecurity. And this, this really, uh, uh, creates some safety valves for us and addresses the concerns, prohibits the use of federally banned equipment and critical infrastructure, authorizes voluntary security assessments for critical infrastructure, uh, involving foreign adversary technology. Uh, be glad to answer any questions. Thank you for the presentation.

we don't have a substitute, right? We Don't. Okay. I, I, okay, thank you. I I move that, uh, third HB 1 65 criminal infrastructure. Be read for the third time And the question is, is shall third substitute house bill 1 65, be read for a third time. Roll call vote.

Thank you Mr. President Pro Tem, uh, having voted on the prevailing side of Senate Bill 2 69, I'd like to make a motion that we reconsider our actions on that bill.

Thank you Mr. President Pro tem.

Thank you Mr. P Pro Tem. Uh, what we're doing here, this deals with our critical infrastructure and maintaining it in, in the environment we face today directs our cyber center develop guidance on foreign advers adversarial threats to our critical infrastructure. Uh, forbids the federally abandoned equipment being used in it in our critical infrastructure. Authorizes, uh, voluntary security assessments and our directs, our Utah Cyber Center to interact with our other governmental agencies. One thing is interesting to note. Line 63 68 deals with, uh, recommendations and plan in place. A comprehensive plan to manually operate are critical infrastructure in the event of a, uh, uh, shutdown or an attack that, uh, is really helpful in, in having that as part of our readiness for what may come. With that, be glad to answer any questions, Discussion to the bill.

You all. Waive summation and move that, uh, third substitute HB 1 65 be passed.

Senator Vickers Baldry Lewin Brammer bus Aye. Palmore Escamilla Fillmore Aye. Grover Harper Kinins Aye. Ipson Johnson Quan McKay Macl Aye. Milner a Musman o Owens pitcher Plum Plum Rebe Sandal Stevenson Stratton Aye. Vickers Bier Aye. Wilson Aye. Winterton Aye. President Adams

You Mr. Speaker. I make a motion that we refuse to concur with the Senate.

Uh, that motion is ordered as I speak to it With all their wisdom. They forgot some things and we need to go address them.