Letter to Jeh Johnson, Secretary of the US Department of Homeland Security - Members of New Jersey Congressional Delegation Call for Increased Security Funding to Guard Against Cyber Threats, Increase Port Security

Letter

Dear Secretary Johnson,

We commend you for your historically strong support to state and local community-based programs. In light of the recent attacks in San Bernardino, Paris, and Brussels, it is more critical than ever to provide adequate funding for security programs that bolster our cities' and states' emergency preparedness.

We write to express concern regarding the methodology for the assessment and risk scoring for the Urban Area Security Initiative (UASI) grant program. We are concerned that the current risk score calculation does not take into account the 21st century threats facing our communities. As you know under the UASI program funds are allocated based on the community's risk score, derived from a formula that includes three major areas -- threat, vulnerability, and consequence. We are concerned that the risk formula does not include cyber threats and does not appropriately calculate the maritime port security risks.

As demonstrated by the Iranian cyber-attack on a dam in New York last year, cyber-attacks are a major threat to our nation's critical infrastructure. The amount of critical infrastructure in New Jersey that must be protected creates a dense digital attack surface. The Garden State Network, a multi-agency, multi-protocol network that is the backbone of New Jersey's data network, alone receives 1.4 billion malicious attacks per month. There are over 500 pieces of critical infrastructure that if disrupted would impact New Jersey's ability to function and there are 15 pieces of critical infrastructure that would have national consequences if they were attacked. With the proliferation of Supervisory Control and Data Acquisition (SCADA) systems, this critical infrastructure is as susceptible to a cyber-attack as to a traditional terrorist attack.

New Jersey has served as a model for state-level cybersecurity programs. For example, pursuant to President Obama's Executive Order 13691, signed on February 13, 2015, New Jersey was the first state in the country to stand up a fully operational Information Sharing and Analysis Organization (ISAO) to share cyber-threat intelligence across the public and private sectors. Cyber threats should be incorporated into the UASI risk score to appropriately resource New Jersey's cyber defense efforts. Including cyber threat reporting in the UASI risk score methodology will also incentivize other major metropolitan areas to increase their cyber threat intelligence collection. New Jersey should serve as a model for other States in how to effectively collect and analyze cyber threat intelligence and data.

Furthermore, we are also troubled about the low risk score assigned to port security in the UASI risk methodology. The 2014 National Strategy for Transportation Security clearly identifies under its risk profile and high risk scenarios for Maritime Security that "a successful terrorist attack in the U.S. maritime domain, particularly in a heavily populated port area, involving Especially Hazardous Cargo could have devastating effects, including the potential death of thousands, adverse economic impacts, and the disruption of domestic and international trade."

The maritime infrastructure that is comprised of the Port Newark, the Elizabeth-Port Authority Marine Terminal and Port Jersey occupies 1,242 acres and is a gateway of commerce to the world. Port Newark occupies 267 acres and handles more than 700,000 containers annually. The Port is the third largest port in the country and largest port on the East Coast. Collectively, port industries of the Port Authority of New York and New Jersey grew from 296,000 jobs supported in 2012 to 336,600 jobs in 2014. The economic value of port operations included over $21.2 billion in personal income, nearly $53.5 billion in business income, close to $7.1 billion in federal, state and local tax revenues, with local and state tax revenues of over $2.3 billion and federal tax revenues of over $4.7 billion.

We strongly believe that Port Newark, the-Elizabeth-Port Authority Marine Terminal and Port Jersey should be included in the Targeted Infrastructure Index when calculating the UASI risk formula. Equally important, the ports cannot be left out of the economic index category of the Consequence element for the UASI risk formula. In addition, the UASI risk score should take into account the threat of cyber attacks to our critical infrastructure. Taken together, these adjustments to the UASI risk score methodology can more accurately reflect the threats facing our communities.