ETAP Act of 2025
- Sponsor
- Sen. Risch, James E. [R-ID]
- Committees
- Energy and Natural Resources Committee (primary)
- Last action
- May 22, 2025
Bottom line
This bill creates a dedicated Department of Energy program to bolster the cybersecurity and physical security resilience of the U.S. energy sector through enhanced intelligence sharing and operational collaboration.
What it actually does
This bill mandates the Secretary of Energy to establish an Energy Threat Analysis Program (ETAP) within the Department of Energy. The program aims to enhance situational awareness, analyze threats, identify mitigation measures, and support response activities for the energy sector. It emphasizes public-private operational collaboration and extensive coordination with various federal agencies, including intelligence and cybersecurity entities, to bolster the security and resilience of critical energy systems.
Proponents argue
Proponents argue that the bill is essential for national security and economic stability, providing a focused and coordinated approach to protect the nation's critical energy infrastructure from evolving threats. They emphasize that enhanced intelligence sharing and public-private collaboration are crucial for developing effective threat mitigation strategies and improving emergency response capabilities.
Opponents contend
Opponents might raise concerns about potential redundancy with existing federal cybersecurity programs or the creation of new bureaucracy. Some may also express reservations regarding the broad exemptions from public disclosure laws for information shared within the program, citing potential impacts on government transparency and accountability.
The bill is concise and clearly structured, making it accessible for an informed reader to understand its core provisions and implications quickly.
Section 3(a)
Establishment of the Energy Threat Analysis Program (ETAP)
This provision requires the Secretary of Energy to establish an Energy Threat Analysis Program (ETAP) as part of an existing program under the Infrastructure Investment and Jobs Act. The ETAP will be managed by the Office of Cybersecurity, Energy Security, and Emergency Response (CESER), in consultation with the Office of Intelligence and Counterintelligence. It allows for the creation of a physical Energy Threat Analysis Center and other necessary facilities.
Supporters argue
Supporters contend that establishing a dedicated program within DOE ensures a focused approach to energy threat analysis, leveraging existing departmental expertise and infrastructure to address critical national security vulnerabilities.
Critics contend
Critics might argue that creating a new program risks duplicating efforts already undertaken by other federal agencies or could lead to bureaucratic inefficiencies if not properly integrated with existing structures.
Tradeoffs
The provision balances the need for a dedicated energy security focus with the potential for overlap with broader cybersecurity initiatives, aiming for integration rather than isolation.
Section 3(a)(2)-(11) and Section 3(c)
Core Functions and Objectives of the Program
These sections detail the primary functions of the ETAP, which include enhancing situational awareness of energy sector threats, analyzing these threats, identifying mitigation measures, supporting response and restoration activities, informing R&D, and testing emergency response capabilities. It also aims to expand cooperation with the intelligence community, enhance monitoring tools for the energy sector, and increase industry participation in the Electricity Information Sharing and Analysis Center (E-ISAC). A key objective is fostering public-private operational collaboration for actionable threat information and mitigation advice.
Section 3(d)
Interagency and Non-Federal Coordination
This provision mandates extensive coordination and integration with various federal agencies, including the Department of Homeland Security (CISA, JCDC), Department of Defense (U.S. Cyber Command, NSA), Department of Justice (FBI), and the Office of the Director of National Intelligence. It also requires regular consultation with non-Federal entities such as state, local, tribal, and territorial governments, information sharing and analysis organizations (like E-ISAC), and private sector entities including manufacturers and vendors. The program is directed to leverage capabilities from National Laboratories and commercial threat intelligence providers.
Section 3(f)
Exclusion of Entities of Concern
This provision explicitly prohibits any 'entity of concern,' as defined in section 10114(a) of the Research and Development, Competition, and Innovation Act (42 U.S.C. 18912(a)), from participating in any manner in carrying out the functions of the Energy Threat Analysis Program. This aims to prevent adversaries from gaining access to sensitive energy security information or influencing program operations.
Section 3(h) and 3(i)
Exemptions from FACA and Public Disclosure Laws
These provisions exempt the Energy Threat Analysis Program from the requirements of the Federal Advisory Committee Act (FACA) and exempt information shared by or with federal, state, tribal, or local governments under this Act from disclosure under the Freedom of Information Act (FOIA) and similar state, tribal, or local open records laws. Information shared is deemed voluntarily shared and must be withheld from the public without discretion.
Section 3(k)
Authorization of Appropriations
This provision authorizes the appropriation of $50,000,000 to the Secretary of Energy to carry out the Energy Threat Analysis Program for the period of fiscal years 2025 through 2029. This funding is intended to cover the costs associated with establishing, operating, and maintaining the program, including any physical facilities and personnel.
The Energy Threat Analysis Program is established 'as part of the program developed under section 40125(c) of the Infrastructure Investment and Jobs Act (42 U.S.C. 18724(c))'.
Section 3(a)
Why it matters:This is standard legislative practice to avoid redundancy and ensure that new programs are seamlessly integrated into existing legal and administrative structures, leveraging established authorities and resources.
Case for: Integrating the ETAP into an existing program ensures continuity, avoids the creation of entirely new, isolated bureaucratic structures, and potentially streamlines implementation by building upon established foundations for energy sector cybersecurity.
Case against: A casual reader might miss the broader context and existing authorities that govern the foundational program, potentially underestimating the full scope or existing capabilities that the ETAP is designed to augment.
Estimated impact: This integration ensures the ETAP operates within a pre-existing framework for energy sector cybersecurity, affecting its administrative structure and operational dependencies.
The bill prohibits 'any entity of concern (as defined in section 10114(a) of the Research and Development, Competition, and Innovation Act (42 U.S.C. 18912(a)))' from participating in the program.
Section 3(f)
Why it matters:This is a common legislative technique to maintain consistency across federal law and avoid re-defining terms that have already been established and debated in other contexts, particularly for national security definitions.
Case for: Referencing an existing, established definition ensures legal consistency and avoids ambiguity regarding which entities are considered a risk, streamlining the legislative process and leveraging prior congressional intent on national security matters.
Case against: For a reader unfamiliar with the referenced statute, the full implications of this exclusion are not immediately apparent, requiring additional research to understand the scope of the prohibition and the specific criteria for an 'entity of concern.'
Estimated impact: This provision significantly impacts which foreign entities or entities with ties to certain foreign governments are permitted to interact with the ETAP, safeguarding sensitive information.