the subcommittee will come to order the subcommittee is meeting today to receive testimony on securing the modern electric grid from physical and cyber attacks we have been joined here today by many of my distinguished colleagues who don't sit on this subcommittee but who are integral part of the deliberations that we do and i'd like to acknowledge them and as that they be given unanimous consent to sit and participate in our hearing today hearing no objection so order i want to recognize some of our colleagues from other committees who are participating in today's hearing including mr bartlett we would not have a robust roadmap for addressing the e m  threat if it were not for his vision and leadership and i thank him for that i also have my colleagues who serve on the full committee  california congresswoman jackson lee of texas and miss the bill press grell of new jersey and i thank you for attending this very important hearing we expect to be joined by many other members and i'd like to just acknowledge them an abstention for right now mr land you've been who was my predecessor is chair of this committee and i'd like to congratulate him on his new chairmanship and thank him for his leadership on the electric grid security issue i'd also be expecting a colleague on the subcommittee for intelligence to the homeland security committee ms harman and thank her for her attendance today of fortunately a number of my colleagues in our friends from the energy and commerce committee are on a date unable to attend and participate today's session due to their work on the health care legislation we have reached out to mr waxman mr markey as the barrow to ask them to act with urgency on the subject matter we will discuss today our national health care delivery system just like all of our critical infrastructure systems requires secure and reliable electric system that is what this committee has been investigating for years and what we will discuss today the electric grid is fundamental to our lives and our country's existence without electricity medicines expire banks shut down food goes bad sewage and water plants don't function chaos ensues and our security is compromised we simply cannot afford to lose broad sections of our brid for days weeks or months it is our very reliance on this infrastructure that makes it an obvious target for attack we know that many of our adversaries from terrorist groups to nation states have and continue to develop capabilities that would allow them to attack and destroy our grid at a time of their choosing there are two significant threats that we will be that will be discussed at today's hearing one is the threat of a cyber attack many nation states like russia china north korea and iran have offensive cyber attack capabilities while terrorist groups like hezbollah and el al qaeda continue to work to develop capabilities to attack and destroy critical infrastructure like the electric grid through cyber means if you believe in cell gin sources our grid is already compromised an april two thousand and nine article in the wall street journal cited intelligence sources who claim that the grid has already been penetrated by cyber intruders from russia and china who are positioned to activate malicious code that could destroy portions of the grid at their command the other significant threat to the grid is the threat of a physical event that could come in the form of a natural or manmade electromagnetic pulse known as e m p the potentially devastating effects of an e m p to the grid are well documented during the cold war the us government simulated the effects of e m p on our infrastructure because of the threat of nuclear weapons which emit an e m p after detonation though we may no longer fearing nuclear attack from russia soviet russia rogue adversaries including north korea and iran possess and test high altitude missiles that could potentially cause a catastrophic pulse across the grid these are but two of the significant emerging threats we face in the twenty four century  adversaries openly discussed using these capabilities against the united states according to would cyber warfare doctrine china's military strategy is designed to achieve global electronic electronic dominance by twenty fifty to include the capability to disrupt financial markets military and civilian communications capabilities and the electric grid prior to the initiation of a traditional military operation cyber and physical attacks against the grid could both be catastrophic and incredibly destructive event they are they are not inevitable but sections can and must be in place ahead of time to mitigate the impact of these attacks my colleagues on the homeland security committee and i have spent nearly three years identifying every viewing the security protections that are in place to mitigate the effects of any intentional or unintentional on the electric system our goal is to determine whether appropriate protections are in place that would mitigate catastrophic incidents on the grid our rig review has required extensive discussions an assessment with the private sector which owns operates and secures the grid the private sector develops its own security standards the private sector also oversees compliance with the standards in short the private sector has the responsibility for securing the grid from electromagnetic events and cyber attacks in the course of our review we have questioned hundreds of experts every view thousands of pages of research and analysis many have submitted statements for the record today they have all reached one conclusion the electric industry has failed to appropriately protect against the threats we face in the twenty four century in the past this committee has been deeply critical of the standards that the industry has written they are in the words of g a o inist and other independent analysts inadequate for protecting critical national infrastructure the committee has suggested that the industry adopt adopt nist standards for a control system if it hopes to achieve greatest security my understanding is that the industry has not embraced this suggestion the committee has also been critical of the industry's effort to timely mitigate your roar of the vulnerability what should have been an urgent action is have taking some utilities years to fix many have not even hardened their assets at all this is especially troubling given the catastrophic damage that could be caused by  today there's a new problem many in the industry are apparently trying to avoid compliance with their own inadequate standards i'm deeply concerned about this irresponsible behavior a letter dated april ninth two thousand nine which is attached with the records sent to the industry by the nurse she security officer mike assigned to suggest that industry is choosing not to identify critical assets in order to avoid securing them according to mr sun today only twenty nine percent of general generation owners and generation operators reported identifying at least one critical asset sixty three percent of transmission owners identified at least one critical asset this effort seems to appear to my eyes the head in the sand mentality that seems to permeate broad sections of the electric industry the committee will be following up with nerves to learn which utilities have not appropriately identified and seek to make this information public it's amazing that many within the industry would rather a gamble with our national and economic security than implement precautionary security measures what's even more amazing is that utilities have to take this posture even though they can be reimbursed for the security expenditures in their rate case i'm at a loss as to why the industry is in a pram apparently securing its assets but clearly the time has come for change i am pleased to join chairman thompson and ranking member king and my other colleagues in co sponsoring are twenty one ninety five given the industry's lackluster approach towards securing its own assets i believe this measure will provide the federal energy regulatory commission with the appropriate authorities to ensure that our gr  cure and resilient against the threats we face in the twenty first century this subcommittee will continue to perform rigorous oversight and so we are satisfied that progress is being made i now services would be unavailable or severely limited conmen the public welfare becomes very early dependent on electricity consequently securing this grid is a critical national economic priority that congress must and i'm sure we will address whether jency in recent decades the push towards making our society more reliant on electric power has also made us more vulnerable because of expanding digital and computerized connections our electric grid is now more than ever vulnerable to cyber and physical attacks and these attacks could disable wide segments of the grid for weeks months possibly years the effective functioning of the electric grid is highly dependent on today's control systems which are computer based and used to monitor and control sensitive processes and physical functions you know once largely proprietary closed systems control systems are now increasingly connected to open networks such as corporate internets and the internet expansion of control systems including supervisory control and data acquisition that his status systems and the ability to monitor them via the internet has increased the vulnerability of our nation's critical infrastructure decide every attack as was mentioned u s adversaries whether they are nation states or rogue nations can strike crippling blows to our nation's infrastructure from remote locations around the world i think  these nation states that have the offensive cyber attack capabilities understand that it's far cheaper and oftentimes unattributable to attack and destroy us critical infrastructure through cyberspace rather than risk any type of conventional warfare or other significant threat to our grid is as mentioned by the chair that of and my colleague from maryland has done as much work on this is anybody's i know in the house and it's it's a concept that unfortunately i'm afraid most members are not fully aware of it because of rogue nations and their ability now to  certain missile delivery systems it seems to me that this is a far more urgent matter than it was just a number of years ago when we understood the importance of this vulnerability during the cold war i'm not sure we have  visited this subject with the intensity and the urgency that is necessary so i do appreciate what we are doing in this hearing because of these increased cyber any empty threats to our electric grid in the federal energy regulatory commission his lack of authority to address them in an expeditious manner i've joined chairwoman clark and the chair of the committee the ranking member of full committee in co sponsoring h r twenty one ninety five i believe our legislation will provide for w the authority to create mandatory physical and cyber security standards to protect the electric power system i just like to say we're all in this together or we're in the private sector and public sector we've got a lot of catching up to do i would hope that we would  try and strive for solutions and not necessarily be overly critical of all the participants in this it's just my reflection that we have in some ways come to this late both as a congress as an executive branch as the private sector as well and we need to work together as quickly as we can to protect this system is a  lifeline to so much of our economic life and actually life period in this country and the vulnerabilities have to be recognized up front can't be embarrassed about it we have to work with one another to try and solve this very urgent problem and that's why i'm very pleased that we have this hearing today i think we have a good lineup of witnesses that can give us various perspectives and help us move in the direction that i thank you i now recognize prime sponsor of h r twenty one ninety five chairman of the full committee the gentleman from mississippi mr thompson thank you very much chairwoman and clarke thank you for holding this critical hearing today like you i'm determined to prevent any attack on the united states homeland a multitude of failures contributed to our inability to prevent the attacks on new york city and washington d c on september eleventh mindful of all of our previous mistakes let's review the set of facts before us in today's testimony we have significant vulnerabilities in the griots electrical infrastructure  infrastructure as only getting more vulnerable with smart grid technology that has a massive computer espionage campaign being launched against the united states about adversaries intelligence suggesting countries seek or have developed weapons capable of destroying our grid a congressional commission sais that our griot and a critical infrastructure that relies on the grid is not adequately protected our military installations are vulnerable because they rely on an insecure electric grid the private sector is in charge of writing its own security standards but experts have  to be ineffective in securing the infrastructure and many utilities are avoiding compliance with these standards i x my colleagues here today and those who could not join us what more do we need to hear from before we act we are more motivated then we need to the warnings signs of flashing red now is it time to act to secure the electric grid not after a major incident has occurred believe that all elements of the griot from generation to transmission to distribution to metering infrastructure should be included below covers physical attacks like electromagnetic pulse as well as cyber attack the critical electric infrastructure protection act will do four things to improve our defensive posture number one it requires first establish interim measures deemed necessary to protect against physical and cyber threats to critical elect tronic electric infrastructure will improve existing mandatory standards to provide support with the authorities necessary to issue emerge orders to owners and operators of the electric grid after receiving a binding from d h asked about a creditable imminent cyber attack three every choir's d h asked to perform ongoing cyber security vulnerability and threat assessment to the critical electric infrastructure and provide mitigation recommendations to eliminate those vulnerabilities and threats for it also requires d h asked to conduct an investigation to determine if the security of federally owned critical electric infrastructure has been compromised by outsiders i'm proud of this deal i know my colleagues are proud also we have support of both republican and democrat credit widely acknowledged here on the hill as one who has been a visionary and a leader in providing a real bass roadmap for addressing the threat of e m p and i like take knowledge him and have him make his comments at this time thank you very much for inviting me to sit with you today i'm very pleased that there is now increasing recognition of the vulnerability of our grid and our country to e m p i've been concerned about this a number of years dr graham is here who has chaired the commission that my legislation set up in zero one and this is probably one of the longest serving commissions on the hill and hopefully every serving for a while yet because the job is not done if an e m p attack were vigorous enough and you know this is kind of tough because it's said that if it's too good to be true it's probably not true and in this case if it's too bad to be true it's probably not true but in this case i'm sorry to say it could be true if the e m p laydown were vigorous enough you could find yourself in a world that essentially the only person you could talk to is the person next to you unless you are a ham operator with a vacuum tube set which is a million times less susceptible and the only way you could go anywhere is to walk unless you are the proud owner of an et sole or similar vintage automobile with a with coil tricity you do not are very you do not have electricity you do not have anything in our world our very vulnerability invites attack and it doesn't have to be a nation state a body who can get a tramp steamer buy a scud launcher for  hundred thousand dollars with a crude nuclear weapon could do an e m p lay down not country wide but certainly over new england and by the way if you missed your target by a hundred miles it's as good as a  obviously be the most asymmetric attack that we launched against us and my wife says i shouldn't talk about this because i'm giving these people ideas you know but you know it's in all of their literature it's in all of their war games not one out of fifty americans may know about e m p but i will assure you that one hundred percent of our potential enemies know all about e m p so thank you very much for your vision and holding this hearing and thank you for inviting me to be with you other members of the subcommittee are reminded that on the committee rules opening statements may be submitted for the record i welcome our first panel of witnesses today we are joined by a distinguished panel of private sector witnesses dr william graham is the chairman of the commission to assess the threat to the united states from electromagnetic pulse also known as the e m p commission missed the fabro is the president and chief security scientists of lofty perch mr michael a scientist is the chief security officer of the missed the nomine is providing testimony on behalf of the electric industry association edison electric institute and the electric power supply just to give you an idea about the importance of this topic we received a number of statements for the record i have made statements available to the members ahead of time but as you know them is consent that the following statements be included into the record the national association of systems no objection that it's so ordered in the interest of time i will ask that each of you provide a brief biography of your work without objection the full witnesses the witnesses statements will be inserted in the record i now ask you to introduce yourself and summarize your testimony for five minutes beginning with dr graham thank you madam chairwoman distinguished members of the committee for the opportunity testified today on the matter of the nuclear electromagnetic threat to the united states to our forces are our friends worldwide by way of background i'm an electrical engineer  us conducted over the pacific primarily jobs at that time continue to work on the problem most of my career now some forty five years including as among other things the director of the office of science and technology policy in the executive office of the president and the science advisor to president reagan during his second term several potential adversaries have your kind of choir the capability to attack the united states with high altitude nuclear weapon generated electromagnetic pulse in fact a determined adversary can achieve a capability without having a high level of technical sophistication e m p is one of a small number of threats that can hold our society at risk of catastrophic consequences e m p will cover a wide geographic region within line of sight of a nuclear weapon explosion it has the capability to produce significant damage to critical infrastructures and thus the very fabric of us as well as the ability of the us western and western nations to project influence and military power the common element that can produce such an impact primarily electronics so pervasive in all aspects of our society  military coupled with critical infrastructure an example of this and the increase in potential vulnerability can be seen in the smart grid where considerable interest and effort is being made in adding electronics to our electric distribution grid for efficiency effectiveness and safety but it can undermine that grid if it's not designed properly in relation to our potential adversaries who are not so dependent on modern electronic the current vulnerability of our critical infrastructure both inviting a reward attack if not corrected correction is feasible and well within the nation's means and resources to accomplish and in fact with proper design of protection for both physical and cyber attacks which should be integrated in our electrical distribution and other critical infrastructure systems i believe we can actually work to a net economic benefit because of the improve reliability and performance that we'll achieve with these critical infrastructure however there is an implicit invitation in the fact that the u s is vulnerable in this area to add the series we know that geomagnetic storms will occur and they will damage electric power distribution systems the question is not if but when concerning e m p the logic of the position is upside down if you know often made statements about it being improbable by ignoring large scale catastrophic  vulnerabilities we invite such attacks on our infrastructure by adversaries who seek to attack us where we are weak not where we're strong and to take advantage of that vulnerability we have prepared to unclassified reports one on critical national infrastructure and executive oversight report by the commission and i submit those to you as madam chairman and i'd like to say then while much of our discussion is contained in those in conclusion i'd say that i would like to go on the record of supporting a charge twenty one ninety five the bill to amend the federal power act to provide additional authority to adequately protect the electrical infrastructure against cyber attack and for other purposes purposes and at the same time i would like strongly recommend that very large scale electromagnetic threats to the critical infrastructure both e m p a naturally occurring be addressed explicitly in the bill in a manner comparable to and parallel with the cyber threats contained in the bill thank you very much opportunity to testify today my name is mark fabro and i'm the president and chief security scientist of lofty perch a company focused on providing control systems cyber security services and research i'm a member of the u t c smart network security committee the chairman of the canadian industrial cyber security council and co chair of i a say ninety nine working group ten i am here today to provide insight as to what measures can be taken to help protect the modern electric grid from cyber attack there is no doubt as to whether or not our electric infrastructure will continue to converge with internet based systems and as it matures it will inherit cyber vulnerabilities we know there is a problem we know the cause of the problem we know what works to correct it we just need a plan to implement our challenges to ensure that as we go forward we have done our due diligence in proving solutions that secure and reliable and that we protect what may be the most vital of all critical infrastructures but it's important to know the findings regarding cybersecurity risk are not ubiquitous across all the entities supporting the bulk power system moreover the not unique to single countries entities or operators and they most certainly are not indicative of an overall generally poor security posture we continue to witness excellent examples of effective cyber security activities for many entities and observe progress that does not align with the popular bulk power system is ripe for total cyber compromise the complexity of the problem and trying to measure how secure or resilient the grade is from cyber attack cannot be overstated often and erroneous leap the cybersecurity problem is framed under the assumption that there is simply a single uniform grid and that a mitigation strategy be a technical or policy based should be a political in all areas nothing could be further from the truth clearly the strategy for securing the modern grid requires significant utilization of information security technology security research information sharing capabilities and the integration of these in a manner that meets the challenges associated with current and future power delivery requirements to that end it becomes important  understand that many of the cyber security vulnerabilities in the bug power system that were once only theorized have indeed been proven sometimes the risk is connected to the core technology the vulnerabilities in hardware and software and various protocols can manifest in multitude of attack vectors even ones that could involve the compromise of large aggregated systems that could impact millions of consumers simultaneously but as researchers and subject matter experts our ability to communicate findings in a broad and effective manner is often impeded by the absence of an effective information sharing system thankfully there is good work being done today that can be leveraged for a secure grid to morrow we've seen the next standards in action reducing some cybersecurity risk profiles by orders of magnitude we have seen the creation of no invasive security assessment tools that create usable guidance for securing energy management systems we have seen extensive energy sector road maps that have provided for the creation of technologies that can be used for security in the electricity domain and has proven time and time again there are public private partnerships already in place contributing to the mitigation of security threats to the ball power system rather than develop new plans that are tied to more aggressive standards and enforcement we need to ramp up the efforts in place now and support the continuation of what has been proven to work i feel that there are three areas that should be focused on to meet the emerging security challenges research improve standards and procurement language first research the research effort regarding the cyber security of the bulk power system needs to be expanded and nurtured by saying activity that promotes the injured in the independent assessment of power system technologies without the risk of legal retaliation or negative attributes than is necessary in essence cybersecurity researchers must be protected this research must also include information sharing and cyber instant response functions so that we can better prepare for detect and respond to incidents unique to bulk power system architectures second refining standards the continued development of cybersecurity standards for grid elements is required this effort should leverage standards that are already in place and accepted by the national and international community of stakeholders the standards should be updated to be more flexible so that they can accommodate shared threat and vulnerability information but not so flexible to allow for erroneous reporting regarding critical assets and cyber assets the standard should also incorporate instruction regarding how to implement emergency orders related to specific and imminent cyber attacks and third for human guidance this public private activity should leverage the existing body of work done for industrial control systems and enhance it with sections tailored to the electric sector simple refinement of existing part your main guidelines can have a tremendous influence in bulk power system cybersecurity and it can be done immediately to the committee madam chairwoman committed to improving our response to cyber security i'm here constantly to report that we have done so but we realize there's much more work to be done cyberspace is proving paramount both as a national and an economic security issue the compromise of our nation through individual this invisible battle ground has cost billions of dollars from our economy in terms of both intellectual property and the option of information systems even though nerk is not aware of any cyber attacks have directly affected their liability of power systems in north america we have no illusions of immunity as we are well aware of both government systems and business systems that have been successfully attacked at home and power systems that have been disrupted abroad united states and canada must be ready to act in the event of a specific and imminent cyber threat we believe there's an important gap in authority when it comes to these emergency situations in the united states and dish annoying emergency authority should be put into place and put in place soon nor can the electric sector have been working to answer president obama's broad call to action stemming from a sixty day cyber study complete in may of two thousand and nine and we are preparing for can is forthcoming national strategy an action plan for critical infrastructure and a national cyber strategy some of these efforts include ongoing revisions to cyber security standards with the goal of building a stronger foundation phase one of these revisions was submitted to for approval in may we're going to show phase two or visions continues we're about to complete a thorough evaluation of how we can incorporate portions of this framework into the next standards i personally believe another important element of the revisions will be to consider how best to construct broad requirements for training and awareness programs in incident response and reporting to apply to all entities of the black power system we have also instituted improved our voluntary alert mechanism whereby  reach nearly five thousand professionals in control rooms power plants and engineering centers across north america within hours of being informed of vulnerability or threat has issued nine such alerts over two thousand and nine efforts also include expanded work and deeper analysis of risk or risk of parents assessment conducted in close coordination with industry is designed to evaluate the preparedness to dealing with challenging cyber threats while the pilot group will be small the goal of this is cessna's to develop a tool for entities so that they may assess their ability across the industry is also partnering with the department of energy in a very important effort to breathe new life into the previous work to address high impact low frequency risks such a space weather electromagnetic pulse and pandemics many of these are focused on cybersecurity risks by a physical risk the security of the power system are very real concern or understanding the system redundancies couple of the existing authorities far  mysterious one much like the ever present more deeply mass cyber attacks of today the threat is playing out beneath the cyber seas but unlike submarine warfare it has not stopped or shoreline attackers able to strike strike without being in harms way cyber weapons are often not flagged in their true origins are unknown and therefore unattributable and most importantly they have been largely successful in evading the instruments available to prevent and deter it this is the risk of power grid that is the interconnected system of wires power plants a digital controls is still evolving is still not yet fully understood the potential for an intelligent but attacker to exploit a common vulnerability across the system impact many assets at once and from a distance is one of the most concerning aspects of this challenge this is not but addressing it will require better intelligence and new thinking on top of sound operating and planning analysis complicating this issue much of the information about security threats remain classified in government communities with restricted opportunity to share information with affected acid owners  adoption of smart grid technologies such as advanced metering systems in the distribution grid has been come with the need to build in more security and flexibility to mitigate the emerging risk of exploiting this new connectedness while single device in the distribution system will not be cons an electric institute and the electric power supply organization we appreciate the opportunity testify about cybersecurity in critical infrastructure on behalf of these organizations i'd like to discuss three issues relating  to curing critical electric infrastructure first the success of public private partnerships and recognizing and addressing cyber threats and vulnerabilities sucking the need to avoid unintended consequences when implementing cybersecurity to evolve when our adversaries become more sophisticated the public sector welcomes even more cooperation with and information from government partners both the federal government and electric utilities have distinct realms of responsibility and expertise in protecting the bulk power system from cyber attack ideally to ensure the cyber security of the nation's electric grid and utilize the vast expertise of both public and private sectors we need to clearly define these complementary roles and responsibilities while facilitating cooperation and information sharing between government agencies and utilities giving you an example of how exelon operates we address risks to a defense in depth strategy while balancing the considerations for accounts this includes preventive monitoring and protective measures to ensure the security of our systems we regularly perform penetration tests to inform us of whether our preventative strategies are working so we can enhance our protection as technologies and capabilities evolve these tests allow us to practice and handsome monitoring capabilities like we do going onto to smart grid one of the issues that was right was the possible vulnerability of adding these devices to the distribution system we believe it's very important to work with the manufacturers and the vendors to ensure that security is built into the device and is upgradable from the device we would encourage the development of the curity certification program a good housekeeping seal of approval if you will to which smart grid components and systems could undergo independent testing and receive  that certification that security tests have been passed this would help the utilities differentiate among vendors like those providing appropriate cybersecurity the careful consultation with the electric utility industry which helps ensure that government intervention in protecting the grid from a cyber attack doesn't have unintended or harmful consequences as mentioned the electricity grid is a complex system that certain measures that might prevent a particular type of cyber attack could themselves have adverse impacts to safe and reliable utility operation and service to customers for this reason any new legislation th will give additional cybersecurity authority to a federal agency should be limited to true national emergency situations where there is a significant national security public welfare concern and should provide to the extent possible consultation with industry experts congress should focus then on what additional authority is needed in order to provide to promote clarity and focus in response to immin security the section two fifteen mandatory reliability framework reflects years of work and broad consensus reached by industry and other stakeholders and is a good starting point build in their member companies remain fully committed to work with the government me industry partners to increase security i appreciate the opportunity to appear today and would be happy to answer any questions thank you very much against a fiber e m p attack mr chairman the electric industry today does not have adequate protection place or as far as i can tell any protection in place for the power distribution power generation systems of this country given that the power grids are in a state of transformation i believe this is a appropriate time to build that protection in and it will help not only with e m p but with such problems as grid collapse as we saw on on aug thirteenth two thousand and three and earlier times as well so it could be very effective it's very timely and i believe very needed very long i think i have to admit i love the name of your company to thank sir the question that you're asking is one that's that's quite difficult because you're trying to encapsulate a very very large problem with with one single question is the bulk power system of the electric grid completely immune and protected from cyber attack you know but there are significant pockets significant pockets and significant pockets of progress that have shown that the overall cybersecurity risk profile of the bulk power system in north america not just within the us within north america because it is a multinational and issue has improved substantially substantially and it is very easy to go and look at the things that are notably bad reports from the from the press or or other issues that we hear in various news outlets but overall from someone who experiences and i day to day basis who lives and works in the trenches of this i actually see standards in work in cooperative in industry to secure vital systems to protect the bullpen our system is a very complex problem in order to wrestle and i will tell you this i've been working for years and looking at the underlying technology the vulnerabilities that exist in the operating environments with the technology exist we do believe that the there are vulnerabilities in the system we know that we're not immune from these attacks we are committed to this call to action my letter dated april seventh was a i think very important in that it brought out the dialogue that was necessary to talk about how to prioritize assets for protection some important issues to consider when you look at how one could manipulate technology in such a way to cause an impact the misuse of technology is a very important thing to consider and the ability to exploit technology horizontally is important industry i believe is up for that challenge i don't think there's an easy answer and it won't happen very quickly standards reporting to place all the mechanisms necessary to be able about threats and warning so we can take quicker action we're dedicated to public and private partnership to learn more information and very briefly on e m p i again believe that  the high impact concern is something that we are concerned in the logic power system we are partnering with the department of energy we've consumed b n p commission's report we supported it as knowing staff but also industry experts that's in their deliberation we intend to look at these risk alongside of other risks evaluate them apartheid's them and to take a look at what mechanisms we have to further mitigate the system for these types of threats  thank you my belief is that in general the north american grid is well protected against cyber attacks at least those threats that we know the biggest problem we believe we face is the lack of information because of the secure security nature of that information and it's it's hard to devise  mitigation against something you don't know that's that's an ongoing something that's ongoing we're trying to work with the federal agencies but that to us is the number one thing that we need to work it is something that the industry will pay attention to wants to work with the federal government to devise mitigation and responses but what we need to know is what is the design threat that needs to be dealt with what are the mitigation from that we need to work out what are the consequences of that mitigation and what is the priority longer very much mr chairman again i'd like to congratulate the panel there not only on their verbal testimony but the written testimony is very helpful we could spend hours here and then we've got to really serious subjects one to e m p in one  security and i think it's good that we have them here together but also there's a problem because we can't go in depth as to where we want to go on this first of all mr norman you talked about the problem the problem with the industry not knowing the threat because of the security nature of the information from the federal government are we beginning to attack attack that problem how would you suggest that we try and resolve that problem i believe we need to have a more formal collaborative where a certain set of industry people are given sufficient clearance and this is something that  working on where the federal government can give us high level security information those experts can then working with the federal government devise the mitigation and then  sentially censor the information but send out the mitigation to the industry so that we could implement that mr stanton we have been working hard i think it is a critical impasse and i think it gets back to the vulnerability what's needed to does devise the best mitigation strategies accurate information in order to supply at the development strategies we have been working very hard with the department of energy with the department of homeland security and and even through the intelligence community to be able to share information to be able to validate information as we see it in print and in public press for the last few journal to be able to understand the success of tactics that adversaries have been able to use to compromise systems whether they be government or private sector and be able to appropriately adjust our defense posture and importantly going past information sharing we're working on the elements to share the information within our industry given information people who need to take action and we're also working on developing the ability to respond to contain and to minimize the consequences of a successful attack we're not going to put all our effort into simply prevention that is failed us as a nation prevention is important but it's not the only part of it and we're dedicated to working with entities to be able to let me ask you this when we usually do a risk analysis we talk about threat vulnerability and consequence you obviously know the consequences companies would know the consequence of of a problem disastrous or  consequential interruption are you saying what you need more from the federal government information with respect to the threat only or also that the federal government has an ability to tell what your vulnerabilities how we would respond to those attacks but importantly as you address phone abilities control systems are very complex implementations that technology is complex and the ability of anyone acetone or utility understand the inner workings of that technology all the underlying weakness is that might be there it's very difficult for the to do that now so who would you look to for that we look over it's a government department of energy and a department of homeland security have two very successful programs have been testing control system technology the discovery vulnerabilities are very helpful for us to be able to enhance the security of those systems that need to be somehow made more robust is there a problem with getting secure security ratings for your people and where is the problem there the some of the problem has to do with the partnership that's required in this global supply chain of working with these vendors that supply the technology a lot of times they're willing to look at the technology but under contract agreement so that the information wouldn't be made public that information then goes to the vendor to address in many cases shared with utilities but that progress has been limited by the scope of those programs we do believe they provide a lot of value we've been  heavily purchased you need any additional legislative umbrella for that let us know dr graham can you tell me are there any other countries hardening their critical infrastructure to get to defend against  worked on that we know that china is extremely interested in has a large number of people their engineers scientists working on it and there is enough traffic among communities that deal with high has had an interest in this for some time mr landor even who chaired the subcommittee with jurisdiction over cyber was earlier here and a long time ago i was the  ranking member on the cyber security subcommittee when it was chaired by mr thornburgh so it's many years of frustration over this situation that has brought us here today and i am happy to be an original co sponsor of this bill i think  i think back to the last congress at a hearing that we had and we all knew because we had been briefed in a classified setting about something that needed to be done to make the nation secure and it was not happening and when we turned to ferk they were unable to make it happen and we asked them if they wanted the authority to take to require the steps to keep the nation secure they basically said they couldn't do it and they didn't want to do it which i thought was a pretty weird answer at all honesty because of the comments made today about the need for collaboration we agree with and the comments made about the wall the ice axe we agree with and the need and if there are suggestions and that's my question to add some additional steps so that the private sector has consultation  that would just enhance the matter but when all is said and done the infrastructure that is own primarily by the private sector is relied on by the entire country and if a skate a system has a vulnerability that we know about and steps are not taken to secure it and the whole grid goes down the government has a right to be interested in that matter and a right to relate to require that steps be taken to protect the nation so i'm interested in specific comments that any of the witnesses may have about how you believe that collaboration might be enhanced in this bill i don't think it precludes anything actually i don't think there's a need to enhance it because it doesn't preclude the things that you've discussed but if you have specific suggestions on how to involve the private sector i'd be interested in hearing them and before i turn to you i  didn't want to declare neglect mr bartlett who of course has been known for some time on the wrong focusing on cyber but the issue he is focused in on some time that also need to tension so anybody who has a suggestion on engaging department of homeland security in this area and today i went to the homeland security website put in the took me to fema and there it told me that he was a form of radioactive paying attention mr brown i think that the questions i think the statement that you've made is exceptionally accurate that we have all the pieces in place from what i see from my my experience indicates is that the element of robustness as a relates to what's coming up towards from independent research what's actually being discovered and found within the operational environment of the private sector itself isn't coming up words and there's no sharing mechanism for that information to come up words to either validate substantiate disprove or have some other impact on what's being done by the federal research community and make no mistake the work is being done within d h s s and vo we absolutely valuable absolute valuable capabilities for an arc so the research world needs to be brought in a need to be it need to be brought in and and as has been spoken about earlier the complexities involved with the fact that there's so much vendor specific issues related to securing that the vendors are often exceptionally reticent accept the independent research because it may impact of writing different things from business in the business perspective i don't know if i have time mr chairman to get a few quick comments from the other two witnesses under a minute total  i do believe our interests are well aligned here in terms of what to protect one of the obligations that we have is that we enhance our security incident reporting as in since occur within the private sector it's very important that quickly be shared the incident be absolutely analyzed and information to lesson learned be shared back so others can protect themselves it's something we feel very strongly about we think we've demonstrated that recently we also believe in terms of research that better cyber awareness tools and what actually is occurring across the internet and large networks is very important this is an area that the government can contribute greatly and couldn't the ice axe be used to that effect we absolutely believe dissects be the fact that they probably need some analytical support and their ability to mr nam when you have fifteen seconds much thank you very briefly we just to add on with the most important thing is clear concise communication so that if there is a threat out there that threat gets down to the users owners and operators who understand our system and equipment so that we can take appropriate mitigation if we don't know about the threat it's very hard to mitigate against so this bill well let's certainly let you know about that threat to the for but if there's an emergency to the extent there is time it's very important that rather than issuing a directive there be as much consultation as possible on the circumstances else our concern about unintended consequences of that of those direct thank you mr chairman i appreciate the extra minute thank you might you know five minutes potential like your house burning you buy an insurance policy you do something that will make you whole in the event that that happens i would submit that in our country we have done essentially nothing that would make us hold of this were to happen  exposed to one hundred or two hundred kilo volts per meter protecting to fifty meter is a little better than doing nothing or thirty it's now thirty is that correct well it's unknown as to how good the production would from on up through power grid it would have to be an apparent ground that if it were to survive is that correct yes individual components that are wrapped up in protect ability to understate i'm now kind of a recovering scientist but dr graham is a scientist and he says that e m p is one of a small number of threats that can hold our society at risk of catastrophic consequences in other words that could end life as we know it is that correct certainly as we know it in the united states i don't think north korea would find a shot if they had an e m p event because they have so little infrastructure to begin with but our country has many times the population it had in one thousand nine hundred and yet our facilities could be driven back to the pre nine hundred level us back a century and technology that's roughly correct yes maybe a little more than a century service is such a horrendous consequence why are we not paying more attention to it one of the great experts in this area lowood says is just too hard they don't want to deal with it is that the problem is probably a better question for social scientists to answer but i've had i've heard characterized as a low probability high impact of the commission would not assign a probability to it however we do know that all of our adversaries across their whole reach have all the capability necessary to execute this kind of attack and they know are billeted to it so it seems to me that we cannot assign a low probability of occurring it won't happen every day but it would take us by surprise if it happened today thank you very much mr chairman thank you very much for recovering scientists you do all right p the research of that commission gives you comfort to make the statement you're making today is that correct yes that's correct and three other members of the commission are here as well let me thank them for their work let me just read the opening of your comment e m p is one of a small number of that we can hold our society at risk of catastrophic consequences and then you make mention of fact the several potential adversaries have or can acquire the capability to attack the united states with a high altitude nuclear weapon generated electro matic pulse e m p determine an adversary can achieve an e m p attack capability without a high level of sophistication would you make these comments right at the front of your statement without substance and being able to substantiate it i would make those statements we have substantiated them you would not community and with the department of energy and its nuclear weapon design laboratories a great line and we base our conclusions on that let me ask the three gentlemen i think to your right if i'm correct a simple hurricane that most people don't know anything about called hurricane ike which obviously is a natural disaster had a catastrophic impact exponential impact because in fact after the storm was over the community that impact that was without electricity for six weeks plus it is probably the most costly if a hurricane in that gulf region short of hurricane katrina and possibly rita but more importantly the suffering was enormous can you explain to me the bases of the self regulation of your industry mr nomen and why you would want more intense regulation because a potential attack or impact said would be enormously catastrophic in fact whole communities could be wiped out that's an omen thank you i don't believe it's an issue of of regulation i believe it's an issue of getting together setting the priorities determining what threat is and then you don't think that we could do that you could do it better with a government partnership and having more stringent regulations as relates to e m p i don't believe the regulation itself would make the difference the partnership wouldn't you agree with dr graham that we have the potential of a catastrophic impact with the a m p if if i i c and i think that's a group that self regulates and allows electric companies to go out during a hurricane and have no criteria for getting back on what is your description of self regulation do you feel the need to be more regulation and partnership between the government and this industry to protect against a m p as dr graham has mentioned certainly e m p as a threat is disturbing and that different than i it destroys components of the power system that be difficult to restore from ike is on an example i understand electricity absolutely understand i do believe that and we had a meeting with the commission and we have met with experts that has provided title would you support more government regulation  heard my comments and dr grant's comments we have a real problem do you believe that we need to have a greater enhancement of government partnerships regulation to ensure against this disaster i absolutely if the findings from dr graham and his commission  accurate as scientists myself i firmly agree that that these issues are are very important i think that the partnership with involvement from the federal government is critical to fully understand the issues i think that the findings from that must be incorporated into future state standards  from a regulation perspective i don't know if it has to be a regulatory function but i certainly do agree involving from the federal government's required for a full picture i thank you i think without regulation we don't get in for spending and implementation i thank you and i yield back to the chairman thank you very much now five minutes yeoman from new jersey thank you mr chairman where i was the chairman this legislation did not come out of the blue it didn't materialize itself i want to associate myself with the comments  bartlett we should all be very seriously concerned i guess that's why we're here but i remember last  sat and that seat over there and he admitted to this committee that we the committee had been lied to by the electric industry maybe a member that for those members who were not here last year never told us in october of two thousand and seven that three quarters of the industry had mitigated a vulnerability known as aurora nork nerk claimed that they sent the survey out the window street and they had received obviously responses back we finally got the truth out and found out that the survey hadn't been sent nurse had no hard numbers never just made them up to get us off their back we found that out last year so institute in the electric power supply association nama is that correct yes congressman a question about september eleventh your two thousand and eight meeting of the nerk critical infrastructure protection committee at the committee meeting the nerd infrastructure protection committee received a briefing on the report of the commission to assess the threat to the united states from the report was written by the congressional commission that dr graham chairs the commission has been reviewing our electric grid security against an intent to intentional or unintentional event for years the commission found mr chairman and mr ranking member a single e m p attack may seriously degrade or shut down a large part of the electric power grid in the geographic area of the empty exposure effectively instantaneously graham i currently have had my aunt the minutes from the meeting and i asked for unanimous consent to introduce these minutes into the record mr chairman without objection you would think that an issue as serious as an electro magnetic poles which has catastrophic consequences is not terribly expensive to fix spurred the electric industry into action you would think that an at risk industry would want to fix its vulnerabilities you would think that after not fixing the aurora vulnerability for years the industry would want to show some proactive security efforts send the message that at least they're moving in the right direction but this is not what happened was the of september eleventh of last year according to the minutes let me quote there are no actions expected by the critical infrastructure protection committee or never to this report on quote no actions nothing the industry which is as chairwoman clarke stated responsible for operating security plans on doing nothing to secure its infrastructure but to mitigate this threat now mr nominee why aren't your colleagues doing more to secure your infrastructure against an intentional or unintentional e m p event or cyber attack mr now congressman as i said we want to work with nerk in the industry in identifying what needs to be done what the what the threat what the design threat is i just heard from congressman mark what for example whether the threat is two hundred volts per meter or fifty volts per meter is that him and mr nominee she is me why aren't you doing anything right now to secure the infrastructure in order to tell me something well everybody knows in this room we listen that will please answer my question in order to secure the infrastructure we first have to determine what threat to protect against and then design mitigation so i understand it through mr santelli is taking this as one of the action items but it has to be done in a thoughtful manner so the industry these are the minutes i amendment as i listened to the testimony today one of the things that i think we could add your testimony in the very back three points that we could focus on one is research which has been much discuss santelli did i hear you correctly that when there was a reference to cyber security that prevent something online prevention is not necessarily the answer i don't think we should put our full faith in preventing attacks it's very important  we also address investments and being able to categorize observe them and respond to them and minimize their consequences in the system so we would like to take a comprehensive approach to cyber attacks not just installing more cyber security solutions that have failed in the past  threats are capable of getting around those solutions we want to make sure that we've got the full capabilities to be able to handle this important challenge do any of the book power systems have a responsibility to report to nurture the body if there is a cyber attack they do into this the ip standards today they have to report security incidents affecting critical cyber assets to new york take that information analyze it and pass on for warnings for other organizations to date have there been any reports yet we have reports of security incidents the bulk power system so is the grid safe today i would tell you that it's i believe that the grid is is not immune from attack we've seen the attacks occur what we can do is try to respond to those attacks enhanced our security ability to respond to them it's definitely concern it's why we're asking for emergency authorities for the federal government for very specific and imminent cyber threats so mr norman with that being said  i stand corrected but i thought i heard you say earlier that you feel that the grid is safe today i believe i said is relatively secure from the threats that we know  may not be secure from the threats we don't know which is why we we support the emergency legislation and mr zandi with that being said i think that we've heard from mr richardson and others the importance of making sure that we're able to provide the information necessary so that you can prepare for any cyber attacks that do exist but there was a wall street journal article on an april of this year that i lighted threats that we do know that occurred that i don't know if they have been addressed or not but in your testimony you say that there have has been progress made through a nerve with the bulk power systems can you just highlight those quickly sure absolutely can most importantly our ability kate affectively with eight hundred plus and of these that comprise the bulk power system is an important capability that we work very hard to achieve the second piece is that we've been working in great partnership the department homeland security department of energy to be able analyze advance threats so when we become aware of them and i give you a quick example we have seen suspicious activity against our system networks they reported that to me at the sac i shared that information with our government partners they provided excellent an analysis of what it looked like what it was and we went back and was able to notify and warn other entities of the suspicious activity so those are the types of progress that i think is very important i think it's we're working full full force in the collaborative side but if a cyber threat was imminent and specific we believe necessity to have an emerge authorities to deal with that and deal with it in a mandatory way and with that being said mr rahman there was a reference made earlier that there's not a set of standards in place for utilities across the country today that everyone has their own platforms of the operate on and it would be difficult to institute a fix that would reach everyone with that being said is there a need to go to standard platforms as utilities are making investments just issued a final rule that said any news any smart grid devices that are attached to the system should follow protocols that are being developed under the auspices of this so it's it's the protocols as to how they communicate and how they interact with the system is very important that they become and that they be secure and the last question that mr chairman is as we go forward and we understand the direction where smart grid will take us and how broadband applications are going to be critical to achieving the efficiencies that we need with distribution and transmission understanding that nurse sole responsibility is with  power systems and does not include distributed generation or some investor owned utilities or applications even within similar rural cooperatives who's overseeing that aspect is there anybody there are any i guess large umbrella support systems other than state regulatory bodies that are working directly with them where those have to be report system standards so we can build security into this technology before it gets deployed in great numbers but most of the jurisdiction and regulation of the system has been done at the local level the state level however in a lot of cases that can be very appropriate based on  local issues but nerk is concerned about the bulk power system and in the future as devices in aggregate might cause a material issue to reliability and we're actively engaged in those efforts and mr chairman just one suggested quickly there  we may want to work with nehru the national association of regulatory utility commissions to truly get an inventory of how many utilities investor owned utilities across the country have been working with their state partners having come to congress as a former regulator from utility aura i welcome the second panel of witnesses we are joined by joe mcclelland the director of reliability at the federal energy regulatory commission also known as for our second witness is patricia hofmann acting assistant secretary at the office of electricity delivery and energy reliability department of energy out there w director of the control systems charity program at the department of homeland security and finally is the director of the information technology laboratory national  institute of standards and technology and when i welcome you all here without objection the witness statements will be entered into the record hearing no objection so ordered i now as the witnesses to introduce yourself and summarize your statement for five minutes beginning with the mcclelland chairwoman clarke member longer  witness in my remarks do not necessarily represent the views of the commission or any individual commissioner and the energy policy act of two thousand and five congress and trust of the commission with a major new responsibility to oversee mandatory enforceable reliability standards for the nation this is there already is a new section two fifteen of the federal power under the new authority cannot author or modify or reliability standards but must select an electric proposed reliability standards it applies to the users owners and operators of all system becomes mandatory in the united states if a commotion remands or proposed standard is sent back to the for further consideration defined in the federal power which excludes alaska and hawaii transmission facilities and certain large cities such as new york and distribution systems in addition to the reliability of the already burke is also charged with the oversight of the existing existing substandard full implementation of the standards by all entities will not be mandatory until the first of several batches of modifications responding to the commission's directive was received from the e r o i in may of two thousand and nine and they are now under review on a related note a smart grid technology is added to the bulk system greater cybersecurity protection will be required given e m p in two thousand and four and again in two thousand and eight the e m p commission issued its report among the findings in the report or that a single e m p attack could seriously degrade or shut down a large part of the electric power grid depending upon the attack significant parts of the electric infrastructure could be quote out of service for periods measured in months to a year or more and  in addition the man made it to the m p of us are also naturally generated caused by solar flares and storms disrupting the earth's magnetic field such events can be powerful and can also cause significant long disruptions to the power grid the standard development system utilized under foot to fifteen evolve mandatory reliability standards using an open and inclusive process based on consensus although it can be an effective mechanism with dealing with the routine requirements of the power grid it is inadequate one addressing threats to the power grid that endanger national security despite its active role in approving reliability standards for current legal authority is insufficient assure direct timely and mandatory action to protect the grid particularly where certain information should not be publicly any new legislation to address several key concerns first virtue be permitted to take direct action before a cyber or physical national security incident has occurred burchett be allowed to maintain appropriate confidentiality of security sensitive information third the limitations of the term all power systems should be considered as cannot act to protect against attacks involving alaska and hawaii as well as some transmission in all local districts distribution facilities in population builder thank you very much mr mcclellan thank you chairwoman clarke members of the subcommittee for this opportunity to testify before you on electric vulnerabilities and cyber security issues for more than a decade the department of energy has been engaged with the private sector to secure the electric grid the homeland security presidential directive seven designated the department of energy as the energy sector specific agency and provide authorization to collaborate with all federal state and local governments and the private sector to conduct vulnerability assessments of the energy sector and to encourage risk management securing the critical infrastructure is a shared responsibility and requires public private partnership asset owners bear the responsibility for ensuring that the resources are secure and for making the appropriate investments for reporting emergency information to the government and for implementing ranking member longer and distinguished members of the subcommittee on sean mcgurk the director of the apartment of homeland security's control system security program director of the industrial control system cyber emergency response team or the i c s sir i'm pleased  before you here today to discuss the importance of securing control systems that operate our critical infrastructure including the smart grid control system security in our electric power grid is essential because of the use of energy and all other sectors we depend on electric power to operate the physical processes which produce the goods and services that we rely upon on a daily basis therefore assessing risk and effectively securing industrial control systems is vital to maintaining our nation's strategic interests public safety and economic prosperity in two thousand and three the department of homeland security was designated as the lead agency for cybersecurity since then several homeland security presidential directives have established national policy and further outline a department's responsibility to collaborate with public and private sector entities to evaluate emerging technologies in may of two thousand and four d h has created the control system security program to further this mission and lead a cohesive effort focused on reducing the risk to control systems that operate the critical infrastructure the c s s p recognizes that leading these activities such as understanding threats vulnerabilities and subsequent mitigation strategies is essential securing these systems to support our leadership role c s c s s p funding for fiscal year two thousand and nine is twenty two million dollars this was an increase from the previous year's budget of twelve million dollars that enabled us to expand enhance our vulnerability discovery facility this facility provides advanced capabilities that was aided identify find the interdependencies of the critical infrastructures additionally the federal workforce was increased from one position to an authorization of nine federal employees for fiscal year two thousand and ten the president's budget request included an increase of five point five six million for c s s even with these enhanced ments the requirements to evaluate new technologies and the ability to assess risk across the eighteen critical infrastructures presents a challenge in order to understand the risk is important to understand the threats including those actors and motivations not only to control systems but to digital computing in general common crackers or hackers comprise the most prevalent group of cyber attackers they attempt to break in in order to hack into computer systems to exploit flaws often motivation is data exfiltration for financial gain of greater concern are the hackers who install back doors such as trojans or root kits that enable them to remotely access the systems or the devices the knowledgeable insider is probably the most dangerous threat to systems operation and security because this is someone that is trusted and has access to the networks and other important company information cyber terrorists or hacktivists or those who seek to disrupt internet activity in the name of personal political or social cause or shared ideology these individuals collaborate via cyberspace and work as an organized group against their target these challenges to security offer several opportunities for malicious actors to attempt to penetrate our systems using the vulnerabilities and the advanced technologies that control our critical infrastructure be evaluate to risk conducts operational risk management and develops mitigation plans to manage risk to an acceptable level these activities include process control system sector analysis scenario development and the development of various tools and training products in two thousand and six c s s p conducted the analysis based on the of using the electric grid to attack a facility we demonstrated how a perpetrator could use the electric grid system to produce significant physical damage to the equipment and the systems the aurora analysis highlights the importance of assessing risk interdependencies and the need to secure industrial control systems in order to maintain our nation's strategic interests while these efforts result in cybersecurity strategies that help to increase the overall security of the grid they do not protect the grid from attack the h s works closely with responsible federal agencies such as the part of energy and the federal energy regulatory commission as well as the private sector with the north american electric reliability corporation to provide mitigation measures that reduce the risk of cyber attack the secretary of homeland security takes the issues of securing our critical infrastructure very seriously since two thousand and four that the parliament has conducted one hundred  forty eight assessments of electric sector facilities through the office of infrastructure protection to further our mission we lead a cohesive effort between government and industry and the program created the industrial control systems cert to analyze and respond to private sector reports of control systems incidents we also engage with our federal partners such as department defense department energy nitel just community to address equities and mitigate the risks as we move forward we also work closely with industry partner such as nerk to provide detailed analysis of cyber events in order to identify the risks and provide real time actionable information for asset owners chairwoman clark ranking member longer and distinguished members i have outlined the role of the department department's control systems security program and the role it will play in addressing the risk that technologies including the smart grid with your assistance we will help the department to continue to protect america thank you again for this opportunity to testify and i'll be happy to answer lani remember longer and members of the subcommittee mc to for lani the director of the information technology laboratory at the department of commerce is national institute of standards and technology thank you for the opportunity to appear before you today to discuss a role in ensuring the cyber security and reliability of the information and communication aspects of the smart grid as the nation's measurement and standards institute has aren't a reputation as an impartial technically knowledgeable third party with a long history of working collaboratively with industry and with other government agencies the strength alone is to make a unique contribution to the establishment of a smart grid recognizing the benefit of focusing this technical expertise and industry oriented mission on what is one of the nation's most pressing issues congress and the energy independence and security act of two thousand and seven called on this to take and leadership role  ensuring and interoperable secure and open energy infrastructure that will enable all electric resources including demand side resources to contribute to an efficient reliable electricity network three phase approach is to build on the relationship with another federal agencies to engage stakeholders to achieve consensus on smart grid standards by early fall the process will deliver the smart grid architecture framework interoperability and cybersecurity standards and initial set of standards to support implementation in addition plans to meet remaining standards needs to launch a formal public private partnership to facilitate development of additional standards to address remaining gaps and integrate new technologies third develop a plan for testing and certify cation to ensure that smart grid equipment and systems conform to standards for security and interoperability views its role as excel or aiding the process by which the standards development can occur the actual standards development work is a process that takes place largely in the private sector with standards development organizations utilities and other stakeholders nist is reaching out to the private sector and is using our expertise to identify where the barriers exist where relevant standards currently exist where standards exist but are not in or operable and where gaps exist that require standards to be developed i would like to caution however that the process of creating comprehensive and effective standards can be time consuming and difficult to be effective standards must be developed with broad representation and buy in from all the stakeholders it can take time to do this right but nist is establishing an agile framework that will meet the urgent national need for specific smart grid standards for the reliability of the electric power industry to be fully realized cyber security concerns must be addressed in addition to assuring interoperability congress recognize this and specifically calling out the issue of potential vulnerabilities has been acknowledged across the federal government this need has also been cited in the sixty day cyberspace policy review with the adoption and implementation of the smart grid the telecommunications sectors will be more directly involved these sectors have existing cyber security standards to address vulnerabilities conformity assessment programs to evaluate cybersecurity broad an assessment programs to identify known vulnerabilities and system another issue for the smart grid and the implementation of cybersecurity standards is the concern that legacy equipment may be difficult to modified to meet new standards smart grid cyber security strategy must address the addition and continual upgrade of cyber security controls the cyber security strategy will require the development of an overall cyber security architecture to address potential points of failure conformity assessment procedures and certification criteria for personnel and processes to achieve secure interoperability products and systems will require conformity assessment that can be developed my newest conformity assessment verifies the product but here to the specifications defined in the standard once a standard has been published conformity assessment going to sell or a product development giving bender's well defined criteria to meet such testing should ensure that cybersecurity standards are effective and do not adversely impact interoperability proud to have been given such an important role in smart grid cybersecurity legislation we believe with the continued cooperation and collective expertise of the industry in this effort we will be able to establish the cyber security standards to ensure the smart grid vision becomes a reality thank you for the opportunity to testified today i would be happy to answer any questions you may have as i'd to thank you as well a ranking member lundgren and members of the subcommittee let me take a moment to request unanimous consent to insert additional written reports and testimony from the canadian electricity association the industrial defender incorporated mr brian m a her and the southern  california into the record having no objection so ordered i thank the witnesses for their testimony and i will mind member that he or she will have five minutes to question the panel and i will now recognize myself for five minutes for question do any of you on the panel believe that the current standards setting process where industry rights standards self selecting what it wants to secure makes sense in the context of our national security start and i concur with my colleagues the challenge of coming up with operational operability standards is usually followed through one process but to respond to threats or to respond to a vulnerability requires emergency action that may or may not be available given the current construct challenges present themselves getting that information into the hands of the operators and the authority needs to be there for the government to direct that activity is for lani and i agree also that when you start talking about interconnected systems wherever the different types of systems touch is a vulnerable spot and there's not a you really need an overarching understanding of the network and the architecture you can't do it in isolated pieces mitigate either a physical or cyber threat the process under to fifteen by law is open and so if a standard were to be developed it would have to be developed in an open forum so not only the addressed from the standpoint of department we look at all of the pending legislation and we look at opportunities to identify the best method to move forward of the concern from our standpoint i go back to some of my previous experience as an arms control inspector under the start treaty and i n f treaty we were directed to trust but verify and there lies the key i can issue a directive but unless i have the ability to follow up and determine whether those actions were taken i have no f understanding whether or not threat has been or the risk has been mitigated so subsequently language that addresses that opportunity for whatever appropriate agency will take those necessary steps feel is vital to continuing the mission and we're going to yield back the balance of my time and now recognize the ranking member of the subcommittee the gentleman from california mr long and for his question very much addressed this to all of you we talked about the smart grid in some ways it reminds me of some of the issues we had when i went to online banking it's only going to be utilized by people people are only going to have confidence that if they feel that it's secure are we doing what we need to do to make sure develop smart grid proposals at various levels to build security into it way for other kind of enterprises we have insurers to assess risk and make insurance rates based on that risk and obviously to mitigate those consequence how do we ensure or how do we provide incentives that the private sector and the let's just concern the private sector the private sector will take seriously these sorts of things and what i mean by that is this if you're going to go to whatever authority it is you have to go to for your rates rate approval and they say well to justify your rates you have to show us that there is a reasonable reasonable cost to what you are doing what you want to charge for and they go in there and they say well low probability high consequence does a ra organisation authority in the state or even a regional area understand that and we need the focus of the federal government to actually have us take it seriously the reason i say that is i just don't think we're taking this seriously enough when you hear the testimony of the consequences i mean it makes katrina look like a day in the park and yet after katrina we said oh my god will never let that happen again we've got to be more focused on it we'll put billions of dollars in to make sure that that kind of thing doesn't occur i don't sense that in terms of e m p you seem to take e m p seriously you seem to accept the argument that it can have devastating consequences but yet it does not appear to me that we are in the congress or the executive branch of taking it seriously enough to make it the kind of priority that i would have and so i guess i would ask you what do we need to do so that  to set the standards in order that interoperability is established one of the key elements in the policy statement last week was that the commission would provide great recovery and would even consider stranded costs for an entity that began to install smart grid equipment but then the equipment was obsolete turned out to be obsolete if the built in cybersecurity that was one of the four elements and so there's a cost recovery mechanism the same application can and should be applied it's unrealistic to think that entities that utilities will move forward on e m p mitigation measures in the context of the high risk low probability and if i just might say something about that on the last panel there were two different witnesses who they are it was very telling one witness classified it as high risk low probability a second witness however said high risk low frequency is a very big difference the probability is not in assessment and i think you heard that very clearly that without intelligence without information it's not it that an entity or person is qualified to make that should be left to the folks to deal with intelligence and so high risk low frequency is a better way to in the absence of some regulatory mechanism to force an attitude to take action to simply will not take action regulation is there for the use that won't take action and so i really believe a personal of two thousand and eight in september of two thousand and eight i participated in a brief hosted by the department of defense for the cross sector cyber security working group on the e m p process we also engaged with the doctor's group to evaluate the impacts on the critical infrastructure and produced a report in november recognizing the importance of not only the impacts on the electric grid but the other other critical structures across our country so we have been engaging across the board and the doctor has met all of the department of homeland security my organization focused specifically on cyber security and physical security threats to industrial control systems and i will report to the director of the national cybersecurity division briefed both the previous undersecretary and secretary and i have had the opportunity to brief the current deputy undersecretary i have not had an opportunity to brief the current undersecretary beers did you have an opportunity to read the mentioned regulation is just part of the equation it's not the final solution so there has to be an understanding and a collaborative effort between the private sector and the federal government to ensure that we address these issues we often focus on the critical asset owners we miss the responsibility in the opportunity of dealing with the vendor community we actually have a subgroup in the industrial control joint working group the focus is on the vendors and brings the vendors to the table so that we can incentivize the development of more secure products for the future that was a key part in developing our pick your mint standards which we published in august of last year identifying those steps necessary to develop and distribute and integrate more secure system joint working group is following on the efforts that were established by the process control systems forum so we're we're maturing and growing that activity and again much of our focus in the past was on primarily the energy sector specifically the electric sector unfortunately we need to focus on all eighteen critical infrastructures so we've been invested heavily in developing the partnerships with water chemical transportation critical manufacturing across the board because when it really comes down to it these industrial control systems are pretty much the same across all these industries the components that we use have the same vulnerabilities whether it's moving the robotic arm that builds a car or generating power  i now recognize the gentleman from maryland mr bartlett for five minutes you very much and thank you again for convening this hearing mr mcbride like you that helped me clear up a definition problem on page two of your testimony written testimony on page two of mr santelli written testimony there are definitions of both powers and they seem to be different you have a fairly restrictive one that exams that exempt all local distribution facilities including virtually all of the grid facilities in certain large cities the definition and mr santelli written testimony power system is defined be low and he gives a section of the law facilities and control systems necessary for operating an interconnected electric energy transmission network or any portion thereof and electric energy from generation to still is needed to maintain transmission system facilities so his would appear to include anything and everything and that dr graham made about a robust e m p attack bringing down the power grid and it might be out for several months or a year or more and some like wonder how could that be that's because if the grid comes down it is very likely to out large transformers we don't make them there are no spares they're made somewhere overseas if you order one they'll deliver one in a year or eighteen months or so that's how long it takes to make them which is why that why that  receive federal grants what do we need to do to fix that can you fix it in a straight of lee or does that need legislation to fix that because we certainly ought to be helpful don't you think do we have to do something or can you do it the more effective we are in producing a smart grid the less secure we are from an e m p attack because that just increases our vulnerability we really do need to do something about that national strategy to secure cyberspace or if there is if dr graham is correct and there is a robust e m p lay down there will be no cyber space to secure you think is wrong absolutely not good then i hope that we're doing something more than we're now doing because incorporated among the factors for developing smart grid standards are you doing that is this new grid going to be hard for e m p it's one of the areas that we are we have in our long list and we are certainly taking that under consideration with our partners and to understand where the standards needs might be i hope that this gets higher priority than it has had because as a testimony they indicated where enormously vulnerable here and vulnerability encourages attack and it doesn't have to be a state actor non state actor i had a guy from from the department of defense tell me of a no platforms out there for which these guys could launch this any transformer is a is an adequate platform  scud launcher goes up one hundred eighty miles apogee that's plenty high enough to take out all the new england or all of california and other territories and a crude nuclear weapon if you miss a target by a hundred miles it's just as good as a  must be vigilant around him it's hofman not where we're telling you that this is really a priority and we want to ask you to please take this back to secretary chu and now recognize the gentleman from new mexico mr lu one for five minutes thank you very much madam chair my questions go along the same questions that i asked the first panel in around my question as to if you know all these generation transmission companies all distribution networks investor owned utilities rural cooperatives are included in this broad definition of bulk power system knowing that they're not and and with that being said what are we doing to prepare to be able to address all those needs that fall outside of nerd authority and i would pose that to the panel including their distribution networks what's occurring for the coordination there because according to some of the testimony fall of last panel that authority seems to fall to some extent under the under nerd but the remaining authority is  fall upon state regulatory authorities or other entities depending on the makeup of the utility and so what are we doing to to include them as we begin to deploy some of the smart grid technologies that will be invested and i  guess i'd like to start with the system definition is defined per region and so the definition of all our system is very different in new england for instance than it is in the west that excludes many more facilities now having said that to protect the grid from a national security threat it's fine for every day reliability matters but if there is an emergency action that's necessary to protect the grid from either a physical or cyber attack it is an adequate and that's why the commission has advocated the chairman has a k to the commission receive additional authority if the expectation is that the commission could protect it on the facilities the fall outside of the system the commission did issue a policy statement last week and it said that one of the one of the items necessary for a recovery is that smart grid appliances and devices must demonstrate conformity to cyber security must be protected from a cyber security standpoint and so the simplist out by first with the position that smart grid investments have to comply with cyber security technology can grants also be applied for those reasons or kind of funds be used in that way to make sure that they're investing the necessary cybersecurity preparation or tools platforms software whatever the application may be or technology may be included in some of the investments they'll be making  as part of their proposal identified we also know department look from the end user home delivery system backup without having regard to any defined division between paul power or the distribution networks so we work across the board along with the part miss for laney and maybe she gets emitted into the record in a written format but just the same question i posed to the panel earlier as far as the lack of standards a do exist for platform from a cyber security perspective or some of the data systems that exist for energy companies should some standards be included there with the department looking at in order to be able to facilitate your response to those questions or however they're evaluating thanks very much venture thank you that i grid remains highly vulnerable to the cyber physical attack that could possibly disable portion of the grid for weeks months even possibly years and as we move into the twenty first century is moving towards new technology and we push towards making  alectryon electric infrastructure electronic and digital on the one hand we're saving money billions of dollars possibly and we're making it much more quicker much more reliable much reliable system but on the other hand  have a comprehensive plan in place for that protection in place right now you know today most of the critical electric infrastructure is owned and operated by the private sector regulators of the electric grid currently ask mr mccollum first and recap on what the ranking member started to go down this route as far as first of all what what should you to what he's do to better identify those critical cyber assets that are out there and then the question is come amount of critical assets to identify who is on the panel wrote a letter to industry saying hey rather than assume that your one particular facility in isolation on the whole power grid is not critical you need to start from the it there for the commission direct to rewrite the standards and bring the standards back to the commission in that from that point on from the time the stans will be revised will be a regional review process and then those determinations will be subject to the commission review unfortunately it's going to use a standard development process which can take years for it to get through and then come back to the commission and it may not be entirely response to the commission that's the process under federal  critical infrastructure we are getting cooperation we have focused on the vendor community we have taken several different approaches to looking at security improvements within the sector working with the vendors and working with electric or energy companies directly  valuable testimony here today and i want to thank the members for their questions mr bartlett thank you for the your wisdom on this on this matter and also let the members of the subcommittee know that you may you have additional questions for the witnesses we will ask for you to respond you can submit them and we will get it to you and we ask that you will respond to was expeditiously in writing to those questioning hearing no for the business i want to thank you once again for your testimony here today i know that there is a lot of a lot of inquiry coming from the membership with regard to this matter a lot of interest and concern and so this is probably probably what we will call part one of what will be a number of other hearings around this matter during this session so want to thank you and just alert you to that this meeting is a