An Irksome Tale: The Battle to Secure the Smart Grid

This is the slightly unsettling story of two organizations, FERC and NERC, as they squabble over the pace of improving the cyber security of our electrical grid. For the energy acronym challenged, that's the Federal Energy Regulatory Commission (a part of the Department of Energy), and the North American Electric Reliability Corporation. And one more you're going to need to know before this is through: CIP = critical infrastructure protection.

In last week's HuffPo post: "A Less-than-Obvious Connection of Great Import: Secure the Smart Grid to Improve the Environment" I made the case that in order to lay the foundation for grid-scale renewable energy sources, we've got to ensure that the massive electric grid modernization project called the Smart Grid gives us a system that's at least as hard to disrupt via cyber attack as what we've had up until now, else no one's going to want to see it deployed.

While hundreds (and maybe thousands) of companies, associations, and federal, state and local government entities are involved in this process, the decisions and actions of FERC and NERC have a disproportionally large impact on the rest. And the problem is, they simply aren't getting along. While they're not exactly the Montagues and the Capulets, it seems that some blood may be spilled before this drama is fully played out.

This battle over how fast (FERC) or how slow (NERC) cyber security controls are added, and to how many or how few systems is being waged in public, and their communications on these matters are essentially open letters cc'd to the wider world.

Now, regulatory compliance and the desire to avoid fines aside, some utilities are working to make themselves more secure, some aren't. Some organizations consider risk management part and parcel of running a sound business; others stick their heads in the sand and hope for the best. Most utilities admit, however, that despite whatever reservations they may have with the current NERC CIP standards, that they are more secure today with them than they would be without them.

The case for going faster rests on a couple of basic facts and observations. Here are just a few:

• Attacks on energy systems are increasing in tempo and sophistication (for those who haven't heard of it yet, the recently emerging Stuxnet virus has provided a real wake up call for industry in terms of attackers' advanced capabilities
• Other industries/sectors have much more substantial security controls and governance already in place and have only benefitted from them
• Emphasizing security early in the Smart Grid window will yield benefits including cost savings and much better efficacy
• Oh yeah, and one more little thing: and our entire economy and the well being of our nation depend on secure and reliable power infrastructure

Nevertheless, there's a strong case for going slower:

• Cultural challenges inside utility co's will hinder attempts to make them change too much too quickly
• Regulatory impediments need to be resolved before the whole system can be secured. For example, the fact that the Feds only have jurisdiction over generation and high-voltage transmission assets, while policy for low-voltage distribution is left to the states, and there's little/no standardization of state policy at present) Security standards are still taking shape. NERC's CIP standards are still in their infancy, and NIST just released the 1.0 version of its "Smart Grid Cyber Security Strategy and Requirements"
• Lastly, it costs money to significantly ratchet up the security posture of any complex system, not to mention the one that's been called the greatest engineering achievement of the 20th Century.

Sensitive to these barriers, NERC has played the role of the good cop, asking electric utilities companies to comment on the feasibility on the new controls it suggests. But it doesn't always get what it asks for. After asking them to accurately report on the number of systems each considers critical to the reliable operation of the national grid, and getting stiffed, then-NERC Chief Security Officer (CSO) Mike Assante wrote them this stern note in April of last year, saying it was time to get serious and identify for systems.

It didn't seem to work. Most of the operators of electrical generation equipment and many of the operators of electrical transmission systems continue to say they possess zero (or almost zero) assets critical to the reliable operation of the grid. When suicidal squirrels or low hanging branches touching a wire can trigger a blackout that impacts tens of millions of people, it's hard to understand the logic of these responses from the folks whose job it is to keep the power on 24/7/365.

Then in March of this year, FERC as bad cop, fired a shot across NERC's bow, saying, in essence, that it was mad as hell and not going to take (NERC's or the utilities' resistance) any more. To wit:

[FERC] said NERC's current rules do not provide a reasonable assurance that NERC is capable of complying with FERC reliability directives and that misuse of the NERC standards development process thwarts Congress' fundamental goal of instituting mandatory standards to protect reliability of the bulk power system.

NERC stakeholders [can] veto a [FERC] directive by refusing to approve a new or modified reliability standard intended to comply with the [FERC's] directive. That happened recently when NERC attempted to develop a standard requiring each transmission and generator owner to determine the ratings of its bulk power system facilities. FERC issued the directive in 2007 and NERC has not yet complied with it.

And most recently, in an order issued last week (September 16th), FERC gave NERC a double smack down, denying requests for a rehearing and for additional delays to the timeline for improving the new security standards development process.

So something's got to give, and give it may, as just a few months ago the House of Representatives passed HR 5026, aka the GRID Act, which among other things allows FERC to bypass the NERC standards setting process and issue orders directly to utilities concerning security vulnerabilities not addressed by NERC's CIPS. With Senate approval, FERC may soon cut out the middle man altogether and impose its desire for more security sooner on the utilities, and utilities need to plan and prepare for this possibility.

If you'd like to see firsthand how the industry is handling this and other pressing Smart Grid issues, I recommend you get to (or at least pay attention to) the GridWise Global Forum coming up in DC September 21-23. Some of the most senior leaders in government and industry are going to be there. And who knows, with all this horsepower in one place, maybe they'll make some progress, even if they can't quite resolve the FERC-NERC dispute on cyber security. That's going to take some more time, and probably some pain, before it's settled. Until then, here's hoping that the current level of security being built into the Smart Grid is enough ... for the utilities ... and the rest of us.

 

Comments

[fjpoblam]

02:11 PM on 10/01/2010

Waxman's proposal almost mirrors EXACTLY the proposal made by Google/Verizon/AT&T. Government&big industry in bed together as usual, ¿qué no?

[audadvnc]

04:21 PM on 09/23/2010

Do what they will, the PTB cannot totally protect the Internet from itself. Remember a few weeks ago, some university was fiddling with the Border Gateway Protocol, and brought down 1/5 the Internet one Friday afternoon - and they weren't even trying.

If it's that easy to break by accident, you can bet the NSA, KGB, MI6, France, China, and that dweeby kid you hated in high school could do it on purpose.

[OgreDaddy]

10:43 AM on 09/22/2010

When the power goes out completely across an entire town
You can't access your ATM and the bank can't access your account.
The Gas Stations can't pump gas.
The stores can't ring sales on their network.
Traffic screeches to a halt and first responders are tied up with accidents.

We are on our own and you may not even be able to leave town
if you can't get fuel when eventually your generator runs out of fuel.

If your car's digital controls fail, you're stranded.

[audadvnc]

04:24 PM on 09/23/2010

That's when you break out your bicycle.

[molly q]

10:30 AM on 09/22/2010

The passage of 1462 (the GRID Act) *with EMP protections restored* is one of the most important bills Congress has considered in decades. The very future of our country hangs in the balance if we do not protect our grid. The House recognized the danger and passed its version of the bill unanimously. We need to send the Senate a message loud and clear that we expect them to take action to protect our country from the devastating consequences of an EMP by restoring those provisions to 1462 and passing it. Tell them loud and clear that it is unacceptable to you for them to allow FERC and NERC's petty in-fighting to jeopardize the safety and well being of our grid and our country.

Want to know more about what life would be like after an EMP? Read "One Second After" by Bill Forstchen and you will quickly understand why this bill needs to be passed NOW and why the danger increases with every day that passes that the grid remains unhardened.

RESTORE EMP PROTECTIONS AND PASS 1462 NOW

[audadvnc]

04:24 PM on 09/23/2010

The sky is falling! The sky is falling! Give me 100 Billion Dollars and I'll keep the sky from falling... until I've spent it all, then the sky REALLY WILL FALL!!!

[OgreDaddy]

09:10 AM on 09/22/2010

The supervisors in charge of "The Grid" may be highly educated electrical engineers,
but a disturbing majority of Key Personnel are complete buffoons when it comes to understanding
computer security.

Key Personnel, who use their company laptops and desktops for shopping, surfing the net, e-mail entertainment, etc.

These laptops greatly compromised and the companies are in complete ignorant denial.

Even worse, the CIOs of these utilities refuse to spend the money to upgrade beyond XP Pro
because the IT staff prefers to stay in their Windows XP Certified comfort zone.

They will swear the really important control systems are not Windows based, but the supervisors
still use their laptops to access the network.

The software programs used on these critical control systems could be written better
by a 12 year old script kiddie with a clue.

The day of the big North East Blackout a few years back, every computer on the system
was infected with a trojan virus, shutting down and rebooting the computers.

[Robert Kaufmann]

01:38 PM on 09/21/2010

It is vitally important that our electric grid is protected. In fact, the Senate has an opportunity right now to accept the unanimous House bill 5026, that will start us on the long overdue journey to protect our electric grid like our Country's life and survival depend on it. Which it does!

[audadvnc]

04:27 PM on 09/23/2010

I could bring down the local electric grid with a bowling ball, 100' of wire and a pickup-mounted catapult.

No House bill will save us from ourselves - but treating our people better might. How about doing something about that incredible wealth disparity you guys have foisted upon us?

[Cindy Ayers]

09:51 PM on 09/20/2010

Has common sense taken a vacation? Our country is being held hostage to this feud and we’re all going to suffer the consequences of non-action—unless our elected officials are able to take action in time to keep us from going down. The author may be right about “some blood” being spilled “before this drama is fully played out”— according to the EMP Commission report, large numbers may perish if this disagreement continues to delay fixes and we end up having to deal with a continental-wide catastrophic infrastructure event. This is at least one issue that virtually all of our Congressmen and Senators are trying to do something about. That’s some comfort—but then if corrective action is left up to people like those “operators” mentioned in this article—those who want to keep their heads in the sand-- we’re in deep trouble.

[huffn wolf]

08:31 AM on 09/21/2010

For anyone who wants to see some of the actual testimony from the House Homeland Security and Energy and Commerce sub-committees on this issue, including testimony by FERC and NERC, check out: http://www.empactamerica.org/videos_hearings.php. It's pretty obvious that FERC is taking this a lot more seriously than NERC, which appears to be an obstruction on this issue. I certainly hope FERC's position prevails in the Senate as it ultimately did in the House. The hearings linked above refer to HR 2195 & HR 2165, but those bills were basically combined and became HR 5026. The House should be commended for its bi-partisan efforts in this area. Hopefully, the Senate will wake-up and follow suit.

[Al Tokar]

06:50 PM on 09/20/2010

Such controversy in the Land of Living Acronyms makes it easy for one to see this turning to acronym name changing shortening NERC's name, cutting out an "rth" from the N-word so we have the No Ameican Electric Reliability Corp and chopping out a "de" from the F-word to nah-nah, na, nah-nah the Feral Energy Reliablity Corp and while they banter the grid remains horribly vulnerable to failure beyond the cyber security threat. Or maybe that's the answer to a cyber security threat: let the grid be lost for years by EMP or some other cause and we have solved the cyber security vulnerability. No power means no computers hence no cyber threat and voila, an FS (Free Solution). I'll bet that was a "Feral" squirrel that took out the grid previously. The House got it right when they assessed the situation and saw huge concerns involving threats in addition to cyber and quickly and unanimously sent an all hazards bill, HR 5026, to the Senate who now appear to be starting in cyber land where the House started but quickly awoke to other real dangers. Huff Po had a great aticleon this: http://www.huffingtonpost.com/lawrence-e-joseph/the-solar-katrina-storm-t_b_641354.html Maybe it's time to dispatch another Feral squirrel to prove the point to the Senate and get things moving asap. Perhaps the FBI (Feral Bureau of Investigation) has one of these agents ready.

[huffn wolf]

04:06 PM on 09/20/2010

BIPARTISAN ISSUE OF NATIONAL IMPORTANCE. PLEASE CONTACT YOUR SENATOR USING THE LINK PROVIDED BELOW.

The US Senate Committee on Energy and Natural Resources ignored the unanimous bipartisan* endorsement of the U.S. House, two Congressional Commissions and the National Academy of Sciences, and threw out the House's protection from electromagnetic pulse (EMP) in HR 5026 for the Senate version of the bill (S.1462). BTW - When is the last time you saw the words "unanimous" and "bipartisan" when referring to a bill like this?

The House's bill protects the grid from nuclear and other physical attacks and great geomagnetic storms. The Senate committee deleted provisions re: EMP and those protecting the grid's large transformers and requiring adequate backup inventory.

The grid is most vulnerable to an EMP attack due to its age, a growing reliance on computer control systems (SCADA), and varrious methods of attack/damage, including from EMPs generated from hand-held weapons, high-altitude denotation of a nuclear bomb, and the sun.

Please use EMPact America's automated e-campaign to contact your Senators now using the following link, and ask them to adopt in S.1462 (or in a stand alone bill) the House's protection from EMP:

http://www.votervoice.net/Core.aspx?AID=1150&Screen=alert&IssueId=22654&SessionID=%24AID%3d1150%3aSITEID%3d-1%3aVV_CULTURE%3den-us%3aAPP%3dGAC%24)

To learn more about EMP and what you can do about it, please visit www.empactamerica.org. EMPact America is a non-partisan, non-profit organization for citizens dedicated to protecting America from a man-made or natural EMP catastrophe.