In the Media
A Republican-Led Lawsuit Threatens Critical US Cyber Protections
Read Time: 1 minOf Counsel Michael Blumenthal (Cleveland) was interviewed by Wired in a story on a lawsuit brought by the attorneys general of Arkansas, Iowa, and Missouri regarding water system inspections and cybersecurity system implications.
Michael Blumenthal, an environmental regulation lawyer at McGlinchey Stafford, says the EPA did appear to have violated the Administrative Procedure Act by issuing its directive to states as a reinterpretation of existing guidance about states’ responsibilities to conduct “sanitary surveys” of water facilities, thus sidestepping the public comment process.
But the most consequential argument in the case concerns whether the EPA’s regulatory authority for the water sector even extends to cybersecurity. Blumenthal says the Safe Drinking Water Act “does not give them the authority to fold in cybersecurity.”
The EPA derived its authority from newly reinterpreted definitions of key terms in its guidance to states, but Blumenthal says that approach was invalid and would allow mandates that were “never contemplated to begin with.”
The EPA lawsuit looms large as a potential stumbling block for the Biden administration’s new national cyber strategy, which describes critical infrastructure regulation as a national security imperative. Other regulators “are going to watch this case very closely to see what happens,” Blumenthal says.