Securing Communications of Utilities from Terrorist Threats

Summary: Securing Communications of Utilities from Terrorist Threats or the SCOUTS Act This bill authorizes the Department of Homeland Security (DHS) to work with critical infrastructure owners and operators and state, local, tribal, and territorial entities to seek voluntary participation of sector-specific agencies to determine how DHS can best serve cybersecurity needs to manage risk and strengthen the security and resilience of the nation's critical infrastructure against terrorist attacks. A "sector-specific agency" is a federal agency designated as such by Presidential Policy Directive 21 relating to critical infrastructure security and resilience. DHS: (1) shall seek to reduce vulnerabilities, minimize consequences, identify and disrupt terrorism threats, and hasten response and recovery efforts related to impacted critical infrastructures; (2) may investigate the best means for engaging sector-specific agencies in a voluntary cybersecurity information sharing, emergency support, and emerging threat awareness program; and (3) shall establish voluntary opportunities for such agencies and critical infrastructure owners and operators to inform DHS of sector-specific challenges to cybersecurity. DHS shall: (1) establish terrorism prevention policy to engage with international partners to strengthen the security and resilience of domestic critical infrastructure and critical infrastructure located outside of the United States or in its territorial waters, and (2) facilitate the timely exchange of terrorism threat and vulnerability information as well as information that allows for the development of a situational awareness capability for federal civilian agencies during terrorist incidents. DHS shall implement an integration and analysis function for critical infrastructure that includes: (1) operational and strategic analysis on terrorism incidents, threats, and emerging risks; and (2) integration of data sharing capabilities with Fusion Centers.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Securing Communications of Utilities 
from Terrorist Threats'' or the ``SCOUTS Act''.

SEC. 2. POLICY.

    (a) Security and Resilience.--The Secretary of Homeland Security, 
in coordination with the sector-specific agencies, may work with 
critical infrastructure owners and operators and State, local, tribal, 
and territorial entities to seek voluntary participation of such 
agencies to determine how the Department of Homeland Security can best 
serve the sector-specific cybersecurity needs to manage risk and 
strengthen the security and resilience of the Nation's critical 
infrastructure against terrorist attacks that could have a debilitating 
impact on national security, economic stability, public health and 
safety, or any combination thereof.
    (b) Objectives.--In implementing subsection (a), the Secretary 
shall seek to reduce vulnerabilities, minimize consequences, identify 
and disrupt terrorism threats, and hasten response and recovery efforts 
related to impacted critical infrastructures.
    (c) Investigation of Best Means To Engage Owners and Operators.--
The Secretary, in coordination with the sector-specific agencies, may 
investigate the best means for engaging sector-specific agencies in 
participation in a voluntary cybersecurity information sharing, 
emergency support, and emerging threat awareness program.
    (d) Listening Opportunity.--The Secretary shall establish voluntary 
opportunities for sector-specific agencies and critical infrastructure 
owners and operators to inform the Department of Homeland Security of 
sector-specific challenges to cybersecurity, including regarding--
            (1) what needs they may have or may not have regarding 
        critical infrastructure protection; and
            (2) how the Department of Homeland Security is or is not 
        helping to meet those needs that have been identified, through 
        voluntary participation.
    (e) GAO Report.--The Comptroller General of the United States shall 
report to the Congress by not later than 6 months after the date of the 
enactment of this Act on the views, experiences, and preferences of 
critical infrastructure owners and operators regarding the benefits of 
engaging in voluntary cybersecurity incident reporting, intelligence 
gathering, and technical support resources provided by the Department 
of Homeland Security.
    (f) International Partners.--The Secretary shall, in consultation 
with appropriate Federal agencies, establish terrorism prevention 
policy to engage with international partners to strengthen the security 
and resilience of domestic critical infrastructure and critical 
infrastructure located outside of the United States, or in its 
territorial waters, on which the Nation depends.

SEC. 3. STRATEGIC IMPERATIVES.

    (a) Research and Report on the Most Efficient Means for Information 
Exchange by Identifying Baseline Data and Systems Requirements for the 
Federal Government.--The Secretary shall facilitate the timely exchange 
of terrorism threat and vulnerability information as well as 
information that allows for the development of a situational awareness 
capability for Federal civilian agencies during terrorist incidents. 
The goal of such facilitation is to enable efficient information 
exchange through the identification of requirements for data and 
information formats and accessibility, system interoperability, and 
redundant systems and alternate capabilities should there be a 
disruption in the primary systems.
    (b) Implementation of an Integration and Analysis Function To 
Inform Planning and Operational Decisions Regarding the Protection of 
Critical Infrastructure From Terrorism Events.--The Secretary of 
Homeland Security shall implement an integration and analysis function 
for critical infrastructure that includes operational and strategic 
analysis on terrorism incidents, threats, and emerging risks. Such 
function shall include establishment by the Secretary of integration of 
data sharing capabilities with Fusion Centers that accomplish the 
following:
            (1) Determine the appropriate role that Fusion Centers may 
        fill in reporting data related to cybersecurity threat or 
        incident information regarding individuals or service providers 
        with access to or ongoing business relationships with critical 
        infrastructure.
            (2) Determine whether or how the National Protection and 
        Programs Directorate and the National Cybersecurity and 
        Communications Integration Center may work with Fusion Centers 
        to report possible cybersecurity incidents.
            (3) Determine a means for Fusion Centers to report 
        availability of critical infrastructure to support local, 
        State, Federal, tribal, and territorial law enforcement and the 
        provision of basic public services after disruption events such 
        as electric power brownouts and blackouts, accidents that 
        disrupt service, and vandalism to or near facilities.
            (4) Categorize and prioritize cybersecurity intake risk 
        information based on relevance to critical infrastructure 
        owners or operators in the area served by the Fusion Center.
            (5) Establish an emerging threat hotline and secure online 
        sector-specific cybersecurity incident reporting portal by 
        which information may be disseminated through Fusion Centers.
            (6) Develop, keep up to date, and make available a Federal 
        agency directory of designated offices or individuals tasked 
        with responding to, mitigating, or assisting in recovery from 
        cybersecurity incidents involving critical infrastructure and 
        make the directory available on a voluntary basis to critical 
        infrastructure owners and operators.
            (7) Establish a voluntary incident access portal with the 
        ability to allow users to determine the means, methods, and 
        level of incident reporting that is sector-specific and 
        relevant to the recipient as defined and controlled by the 
        recipient.
            (8) Gather voluntary feedback from critical infrastructure 
        owners and operators on the value, relevance, and timeliness of 
        the information received, which shall include how they believe 
        information and the means used to disseminate that information 
        might be improved.
            (9) Report to Congress every 2 years on the voluntary 
        participation of critical infrastructure owners and operators 
        in the programs established under this title.
            (10) Implement a capability to collate, assess, and 
        integrate vulnerability and consequence information with threat 
        streams and hazard information to--
                    (A) evaluate the impact of cybersecurity and 
                cyberphysical impacts of critical physical assets;
                    (B) aid in prioritizing assets and managing risks 
                to critical infrastructure in impacted areas;
                    (C) determine, through the voluntary cooperation of 
                critical infrastructure owners and operators, the 
                staffing and professional need for cybersecurity 
                critical infrastructure protection with Fusion Centers;
                    (D) determine, through coordination with the 
                sector-specific agencies, the agency staffing needed to 
                support cybersecurity critical infrastructure 
                protection and report the findings to Congress;
                    (E) research and report findings regarding the 
                feasibility of exploring terrorist incident 
                correlations between critical infrastructure damage, 
                destruction, and diminished capacity, and what occurs 
                during certain natural disasters;
                    (F) anticipate interdependencies and cascading 
                impacts related to cyber telecommunications failures;
                    (G) recommend security and resilience measures for 
                critical infrastructure prior to, during, and after a 
                terrorism event or incident;
                    (H) evaluate interdependencies and cascading 
                impacts related to electric grid failures;
                    (I) support post-terrorism incident management and 
                restoration efforts related to critical infrastructure; 
                and
                    (J) make recommendations on preventing the collapse 
                or serious degrading of the telecommunication 
                capability in an area impacted by a terrorism event.
            (11) Support the Department of Homeland Security's ability 
        to maintain and share, as a common Federal service, a near 
        real-time situational awareness capability for critical 
        infrastructure that includes actionable information about 
        imminent terrorist threats, significant trends, and awareness 
        of incidents that may impact critical infrastructure.

SEC. 4. DEFINITIONS.

    For purposes of this Act:
            (1) Critical infrastructure.--The term ``critical 
        infrastructure'' means systems and assets, whether physical or 
        virtual, so vital to the United States that the incapacity or 
        destruction of such systems and assets would have a 
        debilitating impact on security, national economic security, 
        national public health or safety, or any combination of those 
        matters.
            (2) Resilience.--The term ``resilience'' means the ability 
        to prepare for and adapt to changing conditions and withstand 
        and recover rapidly from disruptions. The term includes the 
        ability to withstand and recover from deliberate attacks, 
        accidents, or naturally occurring threats or incidents.
            (3) Sector-specific agency.--The term ``sector-specific 
        agency'' means a Federal department or agency designated as a 
        Sector-Specific Agency by Presidential Policy Directive 21, 
        relating to Critical Infrastructure Security and Resilience.
            (4) Security.--The term ``security'' means reducing the 
        risk to critical infrastructure by physical means or defense 
        cyber measures to intrusions, attacks, or the effects of 
        terrorist intrusions or attacks.