Provides for enhanced protection of water supplies from terrorism and cyber terrorism attacks

Title of bill

An act to amend the executive law, the public health law and the environmental conservation law, in relation to the protection of water supplies

Purpose or general idea of bill

To enhance public safety by requiring drink water suppliers to submit a vulnerability assessment analysis relating to cyber terrorism

Summary of specific provisions

Section 1 of the bill adds a new section 711-b to the Executive Law to require the Commissioner of Homeland Security & Emergency Management to review each vulnerability analysis assessment from a water supplier sent to the Division. The Commissioner can also issue recommendations or general guidance to water suppliers based on the Division's review of the assessments.

Section 2 of the bill amends section 1125 of the public health law related to water supply emergency plans, to require the Department of Health to maintain a list of all water suppliers required to file emergency plans pursuant to existing law.

Section 3 of the bill amends section 1125 of the public health law to include an analysis of cyber attack within the water supplier's vulnerability analysis assessment submitted to the Department of Health.

Section 4 of the bill amends section 1125 of the public health law to require water suppliers to revise their emergency plan by January 1, 2017 to include an analysis of risk of cyber attack. The Commissioner of Health must transmit a copy of each vulnerability analysis assessment to the Superintendent of State Police.

Section 5 of the bill amends section 1125 of the public health law to allow the Commissioner of Health or a county health department to provide guidance and support to community water systems on conducting vulnerability analysis assessments. Community water systems that are not already required to submit vulnerability analysis assessments would be given the option of submitting such an assessment

Section 6 of the bill amends section 15-0507 of the environmental conservation law to authorize the Commissioner of Environmental Conservation to promulgate regulations related to response and prevention of terrorism and cyber terrorism by dam owners.

Section 7 of the bill states that this Act shall take effect immediately.

Justification

In March of 2016, federal prosecutors unsealed an indictment against seven Iranian hackers who attempted to gain access to the Bowman Avenue Dam in Rye, New York in 2013, as well as banks, the Nasdaq, and New York Stock Exchange. One of the hackers attempted to gain access to the dam's supervisory control and data acquisition system related to water levels, water temperature, and water flow. With operators of dams and drinking water systems computerizing much of their system functions, the state of New York must remain vigilant in obtaining and sharing information related to cyber threats and terrorist attacks against critical infrastructure.

In 2002, legislation was passed requiring drinking water suppliers to submit every five years an analysis of vulnerability to a terrorist attack. This bill would update that chapter to require the analysis to also include vulnerability to a cyber attack. Further, the bill enhances information sharing within state government related to possible terrorist or cyber terror attack by requiring this vulnerability assessment to be shared with state police and the department of homeland security and emergency management.

Prior legislative history

New bill.

Fiscal implications

none to the state

Effective date

Immediately