# Presentation: 889948

## Security at FERC Energy Projects Energy Bar AssociationMid-Year Meeting

**Robert J. Cupina, Deputy Director**
**Office of Energy Projects**
**Federal Energy Regulatory Commission**
**November 4, 2004**

**Notes:**
Good Morning:
 In the wake of 9/11, FERC, like many other agencies and organizations, was forced to look at security in a new light.

Although we regulate various aspects of the electric, gas, oil and hydro industries, the focus of my remarks today will will the highly visible  hydro and LNG facilities over which we have construction, operation and safety/security responsibilites.

NEXT SLIDE

## Public Information Availability
Interagency/Industry Coordination
Security Assessments
Consequence Analysis
Threat Dissemination/Information Sharing
Siting Impacts
Cost Recovery

- Interagency/Industry Coordination
- Security Assessments
- Consequence Analysis
- Threat Dissemination/Information Sharing
- Siting Impacts
- Cost Recovery

- Security at FERCEnergy Projects

**Notes:**
These are various aspects of the security issue with which we have been dealing.

NEXT SLIDE

## Non-Internet Public (NIP)
Critical Energy Infrastructure Information (CEII)
Re-evaluate in 2005
Beyond CEII
DHS’ Critical Infrastructure Act (CII)

- Critical Energy Infrastructure Information (CEII)
- Re-evaluate in 2005
- Beyond CEII
- DHS’ Critical Infrastructure Act (CII)

- Public InformationAvailability

**Notes:**
Soon after 9/11, we began removing information from our web site that we felt would provide useful information to a potential terrorist.
Within a month, we removed about 70,000 documents, consisting mainly of facility maps and flow diagrams.
In April of ’03 the Commission issued Order No. 630, (388.113) which defines CEII as information about proposed or existing infrastructure relating to the production, generation, transportation, transmission, or distribution of energy, could be useful to a person planning an attack, and is exempt from FOIA mandatory disclosure. The rule sought to balance the need for security with our permitting role requiring participant access to information.
CEII is designated by the applicant/company and available to members of the public with a demonstrated need and willingness to sign a non-disclosure agreement.
Thus far, we have received 450 requests: 158 for electric, 224 for hydro and 58 for gas information.  
In addition, the rule establishes a lesser category of information Non-internet public (NIP), which consists mainly of less detailed maps and diagrams, that is more readily 
available by request from the public reference room, but not via the internet.
The policy is evolving and will be revisited in 2005.  For example, some of us have concerns about NIP being too sweeping. 
Also, we recently perceive a need to restrict totally information that goes into the security realm, beyond CEII.
What we have done so far with CEII contrasts with DHS’ CII which completely protects information voluntarily submitted to it from disclosure.  

NEXT SLIDE

## Hydro: Coast Guard, Corps of Engineers, National Dam Safety Review Board, R&D Agencies, States, Licensees And Local Law Enforcement and Response Agencies

LNG: Department of Transportation, Coast Guard MOU, Companies and Local Law Enforcement and  Emergency Response Agencies

- _LNG_: Department of Transportation, Coast Guard MOU, Companies and Local Law Enforcement and  Emergency Response Agencies

- Interagency/Industry Coordination

**Notes:**
Dams
Close Coordination with U.S. Coast Guard (33 CFR)
Protection of Port and Riverine Systems
Federal Agencies are Advancing the State of the Art of R&D  
Cratering Effects on Dams 
Susceptibility of Dam Features to Attack Scenarios 
 Working Towards the Development of Protective Measures

LNG
DOT – 49 CFR Part 193, Subpart J - Security
DHS’ Coast Guard lead for LNG terminal/vessel security
CFR 33 Part 127
July 1, 2004 - Facility Security Plans
DHS’ Transportation Security Admin lead for pipeline/peakshaver security
FERC will coordinate with Coast Guard/DOT for existing/planned facilities
It is essential for identification and prevention of a major incident to coordinate closely with other responsible agencies on the federal, state and local level.  In  February ‘05 we are again meeting with other federal agencies and our licensees at a security workshop, and in February of ’04 the Chairman signed an MOU with DOT and the Coast Guard setting forth our respective safety/security responsibilities and making a commitment to coordinate.

NEXT SLIDE

## Hydro: Licensees Completed in September 2003
Hydro: Annual Security Inspections
LNG: Biennial Site Visits
LNG: Review Emergency and Security Plans

- _Hydro_: Annual Security Inspections
- _LNG_: Biennial Site Visits
- _LNG_: Review Emergency and Security Plans

- Security Assessments

**Notes:**
Dams
Licensees Completed Vulnerability/Security Assessments on Sept 30, 2003
All Security Group 1 and Group 2 Dams (1,050) Completed Studies 
 Used to Assess and Upgrade Security Where Necessary 
 Used as Baseline for Future Needs 
FERC Engineers Will Continue Annual Security Inspections

LNG
FERC staff inspect facility security measures during biennial site visits
FERC staff review facility Emergency and Security Plans. 

Soon after 9/11, we issued new security guidance for hydro requiring licensees to perform security assessments. They were completed for high hazard dams by September ’03.  The results will be used to assess and upgrade security and as a baseline for future needs. Hydro in a sense had a head start in existing regs, which covered acts of sabotage, which were applied during the Gulf War and Y2K.
At LNG facilities, DOT issued a guidance document 9/02 with new procedures for operators to respond to five levels of DHS security alerts. We added a section to our inspection manual to confirm that such evaluations have been done. EG, intrusion detection camera coverage.

## 
Assesses Threat Potential 
Assesses Consequences of Various Attack Scenarios 
Assesses Effectiveness of Current Security System 
Identifies if Upgrades to Security are Needed 
Allows Decisions to be Made for Corrective Measures

- Assesses Threat Potential
- Assesses Consequences of Various Attack Scenarios
- Assesses Effectiveness of Current Security System
- Identifies if Upgrades to Security are Needed
- Allows Decisions to be Made for Corrective Measures

- Vulnerability and Security AssessmentMethodology for Dams

**Notes:**
The DAMSVR is a procedure that takes the licensee through the 3 components of a vulnerability assessment; threat analysis, consequence analysis, and security system effectiveness.  It takes the licensee to a decision point that identifies whether or not security enhancements are required. 
This procedure is still under development 
Finalizing it will be a main focus of the Security Task Force made up of  FERC and other agency staff and licensee representative in Fort Worth in February.

The results suggest that upgrades are needed mainly in the communications areas of agency coordination and employee awareness, and the physical prevention areas of vehicular restriction, CCTV, increased locks and alarm/motion detection. 

In terms of the threat perceived by the licensees, No. 1 was garden-variety vandalism, and No. 2 is, surprisingly, no known threat, ie, is it real?
 This highlights some of the frustrations that licensees are experiencing and agencies have to consider.
We are stressing that enhanced security measures will yield immediate benefits in thwarting vandalism, their No. 1 perceived threat, whatever the likelihood of more serious attacks.

NEXT SLIDE

## Hydro: Recovery Plan will reduce consequences
Hydro: Operation Plan will provide best options
LNG: DOT required exclusion zone analysis
LNG: FERC-sponsored pool hazard model

- _Hydro_: Operation Plan will provide best options
- _LNG_: DOT required exclusion zone analysis
- _LNG_: FERC-sponsored pool hazard model

- Consequence Analysis

**Notes:**
Dams
In the Event of a Terrorist Attack, a Recovery Plan Will:
Reduce Consequences to the Nation 
Reduce Consequences to the Infrastructure Owner
 In the Event of a Terrorist Attack, an Operation Plan Will: 
Provide Infrastructure Owners with Best Possible Options 
LNG
DOT required exclusion zone analyses
FERC sponsored ship hazard model (ABS study)
DOE and industry ship hazard models

Recovery plan might include such things as spare parts.
Operation plan might include sharing institutional knowledge on unique project conditions.
Cascading events like Silver Lake impact on power plant

NEXT SLIDE

## Hydro: Information Sharing and Analysis Center (ISAC)
Hydro: NERC TAL List Serve/COE Fusion Cell
Hydro: Disseminate Alerts via email
LNG: Disseminate Alerts and Intelligence via email

- _Hydro_: NERC TAL List Serve/COE Fusion Cell
- _Hydro_: Disseminate Alerts via email
- LNG: Disseminate Alerts and Intelligence via email

- Threat Dissemination/ Information Sharing

**Notes:**
Dams
White House Study1 Identified the Need for an Information Sharing &     Analysis Center (ISAC) for the Dam Sector
 Coordinated Effort with Federal Agencies and ASDSO (Assn of State Dam Safety Officers)
 Identifying Technical Needs and Logistics for Creation  
 Can be Used by all Dam Owners to Share Intelligence Information
Participating in Intelligence-Sharing Fusion Cell
Participating in NERC TAL List Serve (Threat Alert List)
Disseminate Alerts and Intelligence via email

LNG
Disseminate Alerts and Intelligence via email
Operator to FERC to All Other Operators

NEXT SLIDE

## Siting Impacts

- _Hydro_: CEII
- _LNG_: Heightened public security concerns, restricted attendance technical conferences
- _Pipelines_: Emergency Reconstruction Rule, Order 633

**Notes:**
For proposeD projects and relicensings, the primary impact of heightened security has been the increase in CEII in hydro applications.

For LNG, we’ve experienced greater security concerns by the public.  This, in turn, has led to technical conferences with attendance limited to parties in the case and relevant security agencies.

For pipelines, the Commission issued Order No. 633, which authorizes reconstruction of facilities in the event of an emergency due to an unanticipated loss of natural gas or capacity for protection of life or health or maintenance of physical property.

NEXT SLIDE

## Cost Recovery

- September 14, 2001 Policy Statement
- Nine Applications (gas, oil, electric, LNG)
- April 19, 2004 Reliability Policy Statement
- No applications to date

**Notes:**
Of the nine applications,       have been from oil and products pipelines.
The Commission approved surcharge provisions for security-related costs.

On the gas side, the most significant case was FGT, the Commission approved a settlement that allowed recovery of security-related costs, but found that Pipeline Integrity Act inspection and replacement costs did not qualify as securtiy-related.

The Reliability Policy Statement derived from the 2001 Policy Statement in that it would consider reliability-related costs similar to security-related.
We are not persuaded by FGT's argument that the non-security costs it is proposing to track are similar to security costs in that they are incurred as a response to events outside its control. Jurisdictional pipelines commonly incur capital costs in response to regulatory requirements intended to benefit the public interest. They are entitled to seek recovery of such costs, along with a just and reasonable return, at any time through a general NGA Section 4 rate proceeding. Therefore, the proposal to recover costs related to compressor emissions, pipeline relocation, and the requirements of the Pipeline Safety Improvement Act of 2002 are not eligible costs under the Policy Statement and should be removed from any such proposal.

NEXT SLIDE

## Conclusion

- FERC continues to advance infrastructure protection
- FERC must balance security with its permitting function
- Security programs are an evolving process
- Success requires participation by regulated companies

**Notes:**
We continue to pursue project security in hydro and LNG

For Hydro, we are working with licensees and agencies.

For LNG, we are addressing site-specific security concerns and conducting a review of our inspection program.
Security is not static; we do more as we learn more.

We are working with licensees on Security Workshop.

And we are revisiting security measures with existing LNG operators, and working with the Coast Guard to move marine security up front to be done concurrently with EIS.