CHEMICAL IMBALANCE — It’s been about six months since the nation's chemical security shield vanished, and now industry and agency officials are banding together today to push Congress to restore the regulation as part of this year's must-pass spending bills. And in the shadow of a war threatening expansion in the Middle East, anxieties are mounting about the vulnerability of the nation’s potentially weaponizable materials sitting overexposed — all which could be within reach for some of America’s foreign adversaries. — Fumbling the ball: After Congress failed to save the Chemical Facility Anti-Terrorism Standards program last July, thousands of facilities no longer are required to report their chemicals of interest to CISA. The cyber agency wants you to know that’s a big deal, since most chemical facilities rely on computer systems to control and monitor operations. And if a vulnerable computer system falls into the wrong hands, hackers could gain access to a facility's control systems. “Absent the CFATS authority, we cannot ensure that chemical facilities are mitigating the terrorist exploitation of chemical holdings,” Director Jen Easterly wrote in an August op-ed in the Washington Post. — Sound (sorta) familiar?: Who could forget that Iranian state-linked hackers breached at least 18 water facilities across the United States late last year to lock up systems and display crude messages? The water sector is not at all like high-risk chemical facilities, but successful critical infrastructure attacks may very well telegraph other more sinister ones by more sophisticated cyber actors down the line. — Protect yourself or else: The House overwhelmingly voted to revive the program, but in the other chamber Sen. Rand Paul (R-Ky.) stood alone in opposition. His reasoning? CFATS is a barrier to newer and smaller companies, while bigger companies will protect themselves and handle cyber safety just fine. But the American Chemistry Council’s advocacy communications director, Scott Jensen, said reality doesn’t quite jive with that explanation, telling Morning Cyber “our membership is actually comprised of about 50 percent small to medium sized enterprises and they all support CFATS.” — Flip the script: While the program is important, it needs some updates “to justify its monumental historical price tag,” Brian Harrell, CISA’s former assistant director for infrastructure security under the Trump administration, told POLITICO’s Matt Berg. CFATS was last approved with a $74 million budget. Harrell adds that the threat of terrorism is overhyped since there haven’t been any major disasters at such facilities or other high-risk places that don’t use the program. “The idea that the lack of a terrorist screening database is putting the country at risk is a stretch given that other critical sectors screen without this tool just fine.” — On the contrary: But try telling that to CISA executive director for instructure security David Mussington, who warned in an interview with POLITICO that “adversaries will have better opportunities to take previously well-secured chemicals … and misuse them.” According to Mussington and CISA data, the agency was watching around 3,200 facilities — with some 300 names run through agency databases every day to check for suspicious people. — What comes next: Rep. Laurel Lee (R-Fla.), CISA associate director of Chemical Security Kelly Murray and other industry groups are holding a virtual meeting this afternoon to talk through the path forward on the chemical program.
| 
