H.R. 7208: Preventing Remote Operations by Threatening Entities on Critical Technology for the Grid Act

This legislation, titled the Preventing Remote Operations by Threatening Entities on Critical Technology for the Grid Act (PROTECT the Grid Act), aims to enhance the security of the electric grid in the United States from potential threats posed by certain Internet-connected devices and applications, especially those associated with foreign adversaries. The key components of the bill are as follows:

Findings and Concerns

The bill outlines several findings related to the proliferation of high-wattage Internet of Things (IoT) devices, such as electric vehicle chargers and smart household appliances. These devices are increasingly managed through applications and software that could be vulnerable if developed by companies under the jurisdiction of foreign adversaries. Specific concerns highlighted include:

• The potential for large-scale manipulation of electricity demand, which poses threats to grid stability.
• The influence of foreign adversaries, particularly from countries like China, which may have political oversight mechanisms that blend commercial and state interests.
• Existing cybersecurity laws in certain jurisdictions that require access to consumer data by state authorities.
• The risk that smart appliances could be exploited for attacks on critical infrastructure, especially during periods of conflict.
• Recognition that foreign adversaries could control a significant portion of the U.S. major appliance market, facilitating the deployment of potentially harmful IoT devices.
• Data collection from U.S. consumers by foreign-owned applications, which could lead to targeted disruptions of the electric grid.

Objectives of the Bill

The PROTECT the Grid Act aims to:

• Support and complement existing efforts aimed at securing the supply chain of information and communication technology (ICT), particularly in light of manipulation risks by foreign adversaries.
• Direct the Secretary of Commerce to prepare a report assessing national security risks posed by certain applications that could control high-wattage IoT devices, with a focus on measures to secure the electric grid.

Report Requirements

The Secretary of Commerce is required to submit a report within 270 days of the bill's enactment, which must assess:

• The extent of high-wattage IoT device usage in the U.S.
• Risks from foreign adversary-controlled applications and their potential impacts on electric grid stability.
• Public feedback from industry experts and stakeholders about the risks associated with foreign influence over these technologies.

The report should include recommendations for mitigation strategies, which may include:

• Applying existing security measures to IoT devices related to the electric grid.
• Restricting Federal procurement of consumer products with foreign adversary-controlled applications.
• Implementing certification or labeling for high-wattage IoT devices.

Codification of Existing Executive Order

The bill also aims to formally codify the provisions of Executive Order 13873, which deals with securing the ICT supply chain. This adds a legal framework to existing executive actions already in place.

Summary

Overall, the PROTECT the Grid Act seeks to strengthen the safeguarding of critical infrastructure from potential threats by ensuring that internet-connected appliances do not become entry points for foreign adversaries. This includes thorough assessments of high-wattage IoT devices and their applications, recommendations for security measures, and the establishment of a legal framework to address these concerns.

Relevant Companies

• GE (General Electric) - As a major manufacturer of home appliances, any regulations regarding IoT devices might impact their product designs, compliance, and market strategies.
• WHR (Whirlpool Corporation) - Similar to GE, Whirlpool’s sales and production of smart home appliances could be directly affected by new compliance and technological standards introduced by this legislation.
• PHG (Philips) - With a focus on smart home products, Philips could have to adapt their technology and data management practices in response to security concerns raised in the bill.