good morning welcome to the subcommittee on energy and environment and to this very important hearing the national academy of engineering has called the north american electric grid the supreme engineering achievement of the twentieth century the grid is one of our greatest strengths but if not properly protected it could become one of our greatest weaknesses wasn't any other technology the grid is the long pole in the tent of america's economy and national security all of our nation's critical systems financial services health care telecommunications transportation water defense law enforcement and so on depends on the grid remarkably ninety nine percent of the electric energy used to power our military facilities including critical strategic command assets come from the commercially operated grid our dependence on the grid will only deepen as we move towards greater reliance on automation and information technology it has become increasingly clear in the last two years that the grid is vulnerable to cyber attacks and to other threats from terrorists criminals and hostile states over two years ago the department of homeland security revealed the so called aurora vulnerability to which hackers could use communications networks to physically destroy electric generators transformers and other critical assets we know that the cyber system controlling the grid and other critical infrastructure are continuously probed by outside parties just last week the us china commission reported on china's deep involvement in cyber espionage in addition new risks are coming to light such as grid control systems vulnerability to portable weapons that use high powered radio frequency microwaves to destroy electronic equipment some of these vulnerabilities could worsen if we don't implement smart grid technologies in a smart way this past thursday i  was joined by a number of other members of this subcommittee at a classified briefing on grid security i assure you the vulnerabilities of the grid are every bit as urgent as the weaknesses in transportation security that were so tragically revealed by the events of september eleventh a coordinated attack on the grid could literally shut down the u s economy putting lives at risk and costing tens of billions of dollars more over i'm like a storm knocking out power lines that can be replaced in a matter of days an attack on the grid can result in damage requiring months or years to fix there is broad agreement that to meet these challenges we need new federal authorities and mandates beside a scope of federal regulation in this area which relies exclusively on industry development consensus reliability standards through the north american electric reliability corporation is inadequate lott said tough questions remain as to precisely what shape any new authority and mandates should take this morning we will consider two bills that address these issues one sponsored by mr barrow which chairman waxman and i have co sponsored and a second sponsored by homeland security committee chairman bennie thompson i commend mr barrow and chairman thompson for their leadership on this critical issue i think it's fair to say that the barrel bill of which i am a co sponsor would establish the minimum new authority that all parties including the utility industry and state regulators agree is necessary however many parties argue persuasively that we must go further in order to adequately address the threats before us i have kept an open mind on these issues and i urge the other members of the subcommittee to do likewise i am committed to working closely with mr upton and mr barton  along with the mr barrow and chairman waxman and all the other members of the committee to move strong grid security legislation as soon as possible this hearing represents an important first step in that direction i thank the witnesses for joining us i look forward to your testimony and now i turn and recognize the ranking member of the committee mr upton thank you mr chairman and i'd i do want to thank you for holding this very important hearing  appreciate a witness is joining us this morning as well the house homeland security committee has examined this issue focusing on the vulnerability in electric generator control systems which could allow remote access enabling a bad actor to remotely most productive way to ensure the security of our energy infrastructure i know we can work together on bipartisan legislation to address this very very serious issue it is my hope that legislation to protect our critical infrastructure protected for cyber security generally in addition to physical and electromagnetic threats efficiently i don't think it is to just cover the bulk power system we are also most include the distribution system it has become clear that the distribution system out there vulnerabilities can lead to problems with the power system and critical defense facilities are connected at the distribution level there is no question that this legislation should be comprehensive we should seek to feel as many security gaps as possible the threats that we face are too serious and abundant to only address a small portion of our vulnerability the stakes could not be higher and as we know security is not free there will be a cost to protecting our critical our national defense infrastructure our legislation should provide a mechanism by which all generators regardless of whether or not they are right regulated by state are capable of recovering the cost of investments that they are required to make in the name of protecting the national security of the u s the security of our nation's energy infrastructure from attack is one of the most important committees issues that our committee will address there is not an issue that we can take lightly or  this i had recently retired about a year ago from the army reserves that served three years actively in west germany and i have throughout my years here i've always followed up on comments about a electro magnetic pulse concern whether from natural resource by natural occurrences or ships or nuclear burst and we've always talked about smart metering is like the  holy grail of energy efficiency i think some people would argue that we set herself more at risk on some of this if it's an intentional electromagnetic burst over the in the atmosphere because of the ability to fry out the smart metering and all this solid state applications and the recovery time would be much greater than if we kept it simple so that would be my focus to debate to here to try to figure out what is good and how far should we go but but again being careful that we don't try to automate so much that we actually decrease our ability to have a quick recovery whether there be an intentional electronic magnetic pulse burst or something that will naturally occur that will cause us great harm it was interesting i to be on broadband because they don't want cybersecurity issues they don't want other types of concerns so it will be interesting to follow again this is just basically over the radio broadcast news so i look forward to following that up but you must turn your back to expire this year recognizing the gentle lady from california thank you mr chairman thank you for calling this hearing i am very pleased to be here today and would just take a couple of minutes so we can continue on to the distinguish witnesses i'd like to thank today's palace for joining us to discuss the security of our electric grid with regard to the two pending pieces of legislation in particular i like to welcome my friend and constituent jaundice audio general manager and c e o he was promoted to the utilities post top post last year after serving as assistant general manager since two thousand and being awarded a number of customer service honors i look forward to hearing his views on ways in which we could legislatively address security issues and relationship protecting our veteran infrastructure additionally i look forward to hearing all of your expert opinions the expertise you share here will be useful throughout the committee process and in considering these measures as we are aware  the world has become critically reliant on digital communications making military targets civilian infrastructure particularly our electric grid vulnerable to cyber attack electric grid is a significant part of our country's infrastructure value to take  cyber attacks and the implications for traditional methods of deterrence this committee is well positioned to examine this issue and has already suggested one manner in which to address it together we can assure that we have the tools and resources necessary to effectively defend on that infrastructure i look forward to hearing from the palace on the bills before us today and working with the committee and stakeholders on these important matters once again i thank you mr chairman for highlighting this important topic back the balance of my time upton for calling this really important hearing which basically is addressing the vulnerability of the nation's electrical grid to cyber attacks in this and the steps that are needed to take in to protect this critical infrastructure  apparent i think to all that electric grid is vulnerable to cyber attacks by terrorists and by other nations our nation's infrastructure systems are heavily obviously reliant on computer based systems that are used to monitor and control sensitive processes and physical function these systems were once mostly closed proprietary operations but are increasingly connecting to open networks like corporate internets and the internet and the transition towards widely used technologies and open connectivity exposes control systems to the ever present risks that exist in the information technology world in addition to control system specific tasks driving such concerns or reports that malicious attacks are arising on specialized computer control systems that open and shut valves on natural gas pipelines throw circuit breakers on power lines and make telecommunications and defense networks nuclear power plants and hydro dams do their jobs to address these technologies these vulnerabilities the institute for human and machine cognition which is part of the florida  technology and partnership there of miss chamas located my hometown of florida calif is creating new processes processes for better defending supervisory control and data acquisition systems  skated from attack such systems known as k to monitor and report on the functions of close computerized networks that provide real time data in the operation of the central facilities for example skate a network could track something as simple as a climate control system in an office building or monitor the key workings of something as complex and expansive as a nuclear power plant to get a network are also widely used to control the flow of oil and natural gas through pipelines dams and many non energy related processes such as the water and sewer lines telecommunications systems and mass transit systems so mr chairman i think this is a very good hearing i look forward to are wi out here today it amazes me that we have a network of physical networks of electrical system that serves our country that is vulnerable to cyber attack that can bring down large portions of our country lady from wisconsin thank you mr chairman for holding this important hearing on protecting the nation's electric grid from cyber attacks and other threats the threat of someone with  intent attacking and accessing the control systems of electric generators or other equipment presents a substantial concern that must be addressed these cyber or other forms of attacks perpetrated with the intent to disrupt services in the short term or recall long term havoc by damaging equipment could have a significant impact not only on our national security but also our economic security in fact according to one estimate if a third of the country lost power for three months the economic price tag would be seven hundred billion dollars the idaho national laboratory test which has been cited a couple of times already demonstrated how an attacker could break into a control system and disrupt the grid this test highlighted the seriousness of a potential threat to our infrastructure and the urgency with which congress and our nation and to ensure that industry is fully prepared to work in concert with government to prevent any disruptions i look forward to hearing from our witnesses today about how we can best address these reliability and security in this area is recognized well thank you mr chairman and thank you for moving this legislation forward and for the opportunity to work together on this issue of critical importance to homeland security i'm a sponsor of  twenty one sixty five the boat power system protection act of two thousand and one of the subject of today's hearing because i'm convinced that the threats to our critical inner g infrastructure every bit is real and every bit as dangerous as any threat we can imagine i'm pleased that this congress and this committee have given us a high priority will push forward to pass meaningful legislation i obviously think my bills on the right track but i'm open to new angles and new ideas into the mix i encourage my colleagues to co sponsor age are twenty one sixty five let's use it as a foundation for working together on these solutions sustainable security is that government and industry identify and address evolving threats against our country together as our society becomes more and more reliant on technology advances we actually become more and more vulnerable to build a debilitating attack this hearing is an important first step toward closing security gaps which threaten us the time to act is now that that statement be entered into the record without objection so ordered in all members can introduce their statements for that purpose i would also like to add that chairwoman that clarke of the relevant committee on the homeland security committee gentleman from pennsylvania statement will be included in the record at the appropriate point so we'll turn to a person witness mr joseph mcclellan director of the office of electric reliability at the federal energy regulatory commission mr mcallen has led efforts to approve an important mandatory reliability standards for the electric grid we thank you for joining us today please beg discuss the security of the power grid my name is joe mcclelland i am the rector of the office of reliability for their federal energy regulatory commission i'm here today as a commission staff witness in my remarks you not necessarily represent the views of the commission or any individual commissioner in the energy policy act of two thousand and five or the pact two thousand and five congress and trust of the commission with a major new responsibility to oversee mandatory enforceable reliability and cybersecurity standards for the nation's ball parks system this is there already is new section two fifteen of the federal power act under the new authority for cannot author or modify cybersecurity standards but must select an industry self regulatory organization termed the electric cybersecurity standard that applies to the users owners and operators of the ball power system and becomes mandatory in the united states the commission remands or proposed standard it is sent back to the e r for further consideration of work the commission selected the north american electric reliability corporation or nerk as the e r it is important to note that jurisdiction and reliability authority is limited to the quote power system and quote as defined in the federal power act which excludes alaska and hawaii transmission facilities in certain large cities such as new york city and distribution systems pursuant to this duty in january of two thousand and eight burke approved eight cybersecurity standards known as the critical infrastructure protection sanders or sipp standards proposed by new york while concurrently directing modifications to all of them although the existing sip standards are approved full implementation of these standards by all entities will not be mandatory until two thousand and ten the first of several batches of modifications responding to the commission's directives was a proved in september two thousand and although the commission directed further modifications to the revised standards is not yet clear how long it will take for the sip standards to be modified to eliminate some of the significant gaps in protection within them on a related note as smart grid technology is added to the bulk power system greater cybersecurity protections will be required given that this technology provides more access points to attackers and can increase the grids cyber vulnerabilities the sipp standards will apply to some but not all smart grid applications physical attacks against a power grid can cause equal or greater destruction  attacks one example of a physical threat is an electromagnetic pulse or e m p that in two thousand and one congress established commission to assess the threat from e m p and in two thousand and four and again in two thousand and eight the e m p commission issued its report among the findings of the reports were that a single e m p attack could seriously degrader shut down a large part of the electric power grid depending upon the attack significant parts of the electric infrastructure could be quote out of service for periods measured in months to a year or more and in addition to manmade attacks d m p events are also naturally generated caused by solar flares and storms disrupting the earth's magnetic field such events can be powerful and can also cause significant and prolonged disruptions to the power grid regardless of whether an e m p event is manmade or occurs naturally it can cause equal or even greater destruction than a cyber attack and the federal government should have no less ability to protect against it within six months the standards development system utilized under the federal power act of a developed mandatory reliability standards using an open inclusive process based on consensus although it can be an effective mechanism with dealing with the routine requirements  power grid it is too slow too independent and too open to address threats to the power grid that endanger national security for current legal authority is insufficient to ashore direct timely and mandatory action to protect the grid particularly where certain information should not be publicly disclosed any new legislation should address several key concerns first ferk should be permitted to take direct action before a cyber or physical national security as it has occurred second  allowed to maintain the appropriate confidence she ality of security sensitive information third the limitations on the term quote power system and quote should be considered as cannot act to protect attacks involving alaska and hawaii as well as some transmission and all local distribution facilities and large population areas finally if congress sponsored appropriate congress to provide a mechanism allowing entities to recover costs that the utilities incur to mitigate vulnerabilities and threats thank you for your attention today and i look forward to any questions that you may have great thank you very much and i'll say to each one of you that you only have five minutes for your opening statement and after i introduce myself after i introduce you you don't have to read th statement again you can get right to the meat of it so i will have done it our next witness is tricia hoffman principal deputy assistant secretary of the opera of electricity at the u s department of energy in this capacity ms hoffman provides leadership on a national level to modernize the electric grid and enhance the security and reliability of the electric the energy infrastructure thank you for joining us today whenever you're ready please begin thank you  microphone in a little bit closer thank you chairman mark members of the subcommittee for this opportunity to testify before you when h r twenty one ninety five and twenty one sixty five the energy sector is threat analysis natural events criminal acts and insider threats as well as foreign and domestic terrorism because of the diversity of assets in the systems in the energy sector a multitude of methodologies have been used to assess risk vulnerabilities and consequences also improving the resiliency of the nation's electric power grid for the purpose of national security will come at a cost as congress considers legislation we recognize there are limited resources therefore we must prioritize our activities continually assessing risk the impact to the electrics the sector and financial impacts incident response and information sharing still remains foremost our concern while the united states has had a good deal of experience with physical disruptions to the grid such as the two thousand and three northeast blackout and hurricanes of two thousand and five in two thousand and eight it does not have experience based lessons learned from the cyber incident while coordination and communication has improved between public and private organizations over the past several years much more is needed to prevent and respond to an attack that could hamper the u s electric power grid the two thousand and ten energy and water appropriation conference report directs the department of energy to develop an independent national energy sector cyber security organization to institute research development and deployment priorities including policies and protocols to ensure the effect of the point of tested and validated technology and software controls to protect the bulk power system and the integration of smart technologies to enhance the security of the electric grid congress assigned the national institute of standards and technology nist with the responsibility to coordinate the development of a framework and a roadmap for inner operability standards including cybersecurity the department has been working closely with nist and other agencies through the smart grid task force and the private sector i am pleased to say significant progress has been made nist issued release one point zero of then this framework in the roadmap for as well as the draft interagency report seven six two eight smart grid cyber security strategy and requirements the department recognizes the inherent weaknesses associated with driving system effectiveness and risk from a single worst case scenario it single worst case scenario is possible but rarely exists and often exceeds the known and projected adversary capabilities at the same time focusing on the worst case scenario may result in overlooking protection system elements needed to counter more probable significant and credible threat consequently the department is looking at a more balanced methodology to effectively detect and deter threats the department reviewed  various bills and conducted analysis to evaluate the effectiveness we also have reviewed the existing cyber security standards in the relative effectiveness effectiveness in addressing high consequences high consequence risk in a rapidly changing threat environment the department provides the committee the following technical comments the federal energy regulatory commission could be authorized to issue an emergency security directive to owners and operators of the ball power system covering a specific period of time if the secretary of energy has determined that a power grid emergency exists a power grid emergency could be defined as a situation that poses a high risk to the ball power system that must be addressed within sixty days without public disclosure determination of a power grid emergency in general would require the expertise of the secretary of energy in consultation with the secretary of homeland security the office of attorney general and the director of national intelligence and likelihood with a high likelihood if exploited vulnerability could result in significant consequences including damage to assets infrastructure loss of life and physical psychological damage the situation presents an of an alert that notifies owners or operators of a potentially serious situation methods for compliance could be left to the discretion of the provider of the ball collector power provided the security performance objectives are met any direct notify the private sector and operator of the ballpark system of the nature of the risk consistent with the proper handling of classified and restricted information and direct operators to investigate take appropriate  much brown he's the chairman of the new york state public service commission brown behalf of the national association regulatory utility commissioners that will in america he has thirty years of experience in mastering the arcane language regulatory law and you have five minutes good morning chairman markey as you said i am the chair of the electricity committee at state regulators take the reliability and security of the ball power system very seriously however as technology change new risks and vulnerabilities have emerged the transition to a smarter digital more efficient grid carries with it potential concern to talk through  three bells that we have a quorum when it goes out to six bells and then it goes six bells and then six thousand six bells you should start running very fast but that hasn't occurred in my thirty three years here but just want to notify you that if it just keeps going through and ringing that that's not a good thing but and but so far reliability council up here its chairman it's worse when there's no power so you hear no bel when they're no power so this is maybe the key hearing otherwise will be relied upon the same system that my district relied upon and seventeen seventy five with paul revere riding through and knocking on people's door that results in a framework where vulnerabilities to the system are identified prioritized and resolved in a timely fashion congress needs to distinguish between imminent threats which require immediate action and vulnerabilities which can be resolved more deliberately  first vulnerability focuses on business processes email office equipment databases etc that are not unique to utilities but take special significance given the utilities economic importance a second vulnerability is more specific tutelage ease and that is utility control systems supervisory control and data acquisition or skate systems are already in the bleep part of our utility operations and have served to improve the efficiency and awareness prevention management and restoration in spite of introducing new vulnerabilities smart grid fundamentally makes the electric system more secure still this technology brings with it new vulnerabilities and new points of access to create intentional disruption which should be taken extremely seriously in each of these areas steps are being taken to manage risk the regulated companies we oversee have through the north american electric reliability corporation develop good cyber security standards the question of how that standard not yet clear security standards are extensive and over the past two years electric electric utilities across the country request significant additional staffing and significant additional dollars for nerk standard compliance activities in their transmission rate work the standard already in place are adequate for both physical and cybersecurity overextending the applicability of those standards to lower voltage facility raises the question of how much more we are willing to pay for what may be a marginal increase in cybersecurity i'd like to share three examples of commissions and gauge to ensure compliance are made are meeting their response to ensure companies are meeting their responsibilities since two thousand and five the pennsylvania public utility commission has required all jurisdictional utilities to have a written cybersecurity plan to compliment their emergency response each of which are tested on an ongoing basis another state taking action is missouri the commission requires all of its utilities to have in place reliability plans and in may two thousand and nine steps taken or planned regarding cybersecurity as it relates to company operations the made highlighted in order number seven zero six which mandates that electric companies standards relative to cybersecurity since two thousand and three the new york commission's office of utilities security is carried out a regular program of oversight of both physical and cyber security practices and procedures as a regulated utility companies in the energy telecommunications and water sector staff of the devoted full time to security audit responsibilities generally we utilize the existing standard benchmarks to form our own judgments about the quality of cyber security measures in place at the regulated utility staff as adhering to a schedule that calls for visiting each regulated utility company four times a year to audit compliance with some portion  of the goal of measuring compliance all of the standards at each of the companies over the course of the year we have the benefit in new york of a close in effect a partnership with our state cyber security office the new york office of cyber security and critical infrastructure coordination directs effort to maintain cyber security practices within state government agencies we've established an excellent record of being a prompt and reliable source of information i've personally been in consultation with second nerk to consider cyber threats and risk to the smart grid i want to get to bed related legislation quickly neighbor believes congress should build upon existing federal state coordination and result in an environment where vulnerabilities to the system are identified prioritized and resolved in a timely fashion congress needs to distinguish between imminent threats which require immediate action and vulnerabilities which can be resolved more deliberately first a component of any legislation should be the ability for federal department and agencies that have information identifying priority vulnerabilities and imminent threats and how this information is communicated to the various electricity providers state and federal law enforcement and state regulatory authorities in normal situations the electric power industry can protect the reliability and security the bulk power system without governmental intelligence information however in the limited summarized in limited circumstances when the industry does not need governmental intelligence information on a threat or  vulnerability it is critical that such information be timely neighbor believes h r two twenty one sixty five takes the best approach to the issues that confront cyber security and our nation's electric system and we thank representative borrow chairman waxman in markey for introducing this in introducing this legislation there is a need for federal leadership in these complex cybersecurity this concludes my remarks thank you very much our next witness is mr david cook he is the counsel of the federal energy regulatory commission so again just for our audience mr cook is speaking for new york n which is the private sector mr brown is speaking to nehru which of the state and and it does get confusing to people ok but it's federal government state government and now the private sector mr cook whenever you're ready please beg thank you mr chairman and members of the subcommittee nurse overall mission is to ensure the reliability of the power system in north america cybersecurity is the important component of that mission the challenges the grid faces from cyber security threats however are different from other reliability concerns digital technology changes frequently and novel potential threats can arise very quickly requiring rapid and often confidential responses that's going to arise virtually anytime and anywhere across the bass communicating devices on the grid moreover cyber security threats are more likely to be driven by intentional manipulation of devices rather than the weather related or operational events that regularly occur on the system all of these characteristics at cybersecurity apart from their reliability concerns for these reasons believes that the us government needs additional emergency authority to address specific imminent cybersecurity threat as the international regulatory authority for the reliability of the power is responsible for developing reliability standards of all users owners and operators the  standards setting process brings together industry and security from the united states and canada develop standards that must apply to the international grid developing long term standards that apply to more than must do no harm recognizes that while the standards in place today provide starting point they should be and are being improved is also working in a number of areas to make available the kinds of information that will help the industry better secure critical assets well resourced threats and other known cybersecurity activity on an ongoing basis in its role as the electricity sector information sharing analysis cent coordination between the federal agency with that authority and appropriate officials in canada and mexico h r twenty one sixty five contains important provisions that require consultation while h r twenty one ninety five contains no specific provisions in this area the jurisdiction provided by h r twenty one ninety five would go beyond the scope of existing section two fifteen to cover distribution system assets  twenty one and sixty five would limit its scope to the section two fifteen while physical threats are also a concern addressing the present gap in authority to address specific imminent cybersecurity threats is the highest legislative priority at this time one of the greatest challenges the industry faces in dealing effectively with threats we've been discussing is a limited amount of concrete information coming from government agencies much of the information about threats is classified or otherwise subject to restrictions on disclosure without more specific information being appropriately made available to asset owners they are unable to determine whether particular cyber security concerns exist on their systems or develop appropriate mitigation strategies a mechanism therefore is needed to validate the existence of such threats and ensure information is appropriately conveyed over the and has worked to facilitate this information sharing and stands ready to support further efforts in this area both h r twenty one sixty five and h r twenty one ninety five contain provisions to address this problem the electric industry and the governments of north america share a mutual goal of ensuring that threats to their own liability the bulk power system especially cyber security that's very clearly understood and effectively mitigated fully supports legislative efforts to provide the federal government with emergency authority to address imminent cybersecurity threats as quickly as possible moving forward in iraq is committed to complementing federal authority to address cyber security challenges regardless of the form that legislation may take thank you chairman markey members of the subcommittee i appreciate the opportunity to explain how the electric industry is addressing cyber security challenges and our support narrowly targeted legislation to enhance those efforts  supplies electricity to california's capital region we serve a population of one point four million people we operate four hundred seventy three miles of transmission lines but nearly ten thousand miles of distribution lines our customers include the state of california county of sacramento companies such as intel and other customers critical to public welfare and our local kaname smut is a member of the american public power association  and the large public power council l p p c they're part of a larger coalition of electricity stakeholders that have been working together on cyber security issues for the last two years the industry coalition includes investor cooperatively and publicly owned utilities utility generators independent generators canadian utilities large industrial consumers and state we often have very different views on policy issues facing our industry but on the issue of cybersecurity we have been working together to help develop nurture reliability standards for critical infrastructure protection and more recently to identify areas where additional legislation may be needed a p p a l p c nehru the canadian electric association the edison electric institute the electric consumer's resource council the electric power supply association the national rural electric cooperative association and the transmission access policy study group all support carefully crafted specific legislation to deal with the discrete issue of cybersecurity we understand the seriousness of this issue and we know we need to deal with it it's in the industry's best interest to protect against cyber attacks when the lights go out for whatever reasons we're the ones held responsible if they do go out we want to be able to bring them back on as quickly as possible and to minimize potential risk to health safety and property and to minimize any adverse impacts to the public at the same time our industry is facing additional regulatory requirements in a number of areas which  translate to increased cost for our consumers therefore we must use our dollars and workforce wisely to address cyber security threats and vulnerabilities that that are most likely to occur and have the greatest potential impact we need close collaboration between government and industry participants rather than finger pointing therefore any cybersecurity legislation congress adopt should continue the strong industry partnership with government agencies in the united states and canada the interconnected north american electric power industry and nerk worked closely with department of homeland security deo we for canadian authorities new legislation should be built on this strong foundation we support continued participation in industry based and further proof standards development process nerk in the industry have committed significant resources to develop revised and new security standards we have committed some of our scarce resources are subject matter experts in cyber security and system operations to help develop second generation draft standards and it should be limited to the realm of cyber security some would prefer to include new legislation other national security threats as well as cyber threats smut in the industry coalition believe that other government entities both state and federal have more direct responsibilities for national security the electric utility industry addresses physical threats to communication with local state and federal law enforcement agencies and through our own security measures smudge is established a strong and long term partnership and communication with the f b i sacramento county sheriff's department eldorado county sheriff's department in the sacramento police department smudges and the industry coalition support h r twenty one sixty five this bill sets out a process for the federal government to interact with the industry in a cybersecurity emergency but does not disrupt the existing reliability regime set out in section two fifteen specifically the bill provides narrowly targeted authority for ferg to issue emergency orders in response to imminent cybersecurity threat to the book power system specific authority  to issue orders that address the aurora vulnerability improve communication flows of timely and actionable information from government to industry and it has responsibility for us to share critical energy infrastructure information enhanced authority for the electric power industry to protect and keep critical and infrastructure information confidential and nonpublic and be limited to the power system with that i'll conclude my remarks this time is out thank  very much and before i recognize myself just so everyone understands where we're going here so that we keep these definitions somewhat comprehensible for the audience  we're going to be talking about the bulk power system in the united states and the federal power act defines that to encompass large scale power plants and transmission facilities but the bulk power act specifically excludes distribution systems those are the local systems obliged to bring power from from the large transmission facilities that is from the bulk power system  to our homes and to businesses and it also specifically excludes the products of the grid outside the continental united states alaska hawaii and guam so just so you clear dividing line dividing the control systems that serve the bulk power system and those that serve the distribution system so how can we possibly limit the federal authority to the ball power system only when it's so interconnected to the distribution system and and the fact that that does affect people's homes and businesses as state regulators what we're concerned with the whole system from the top to the bottom including the ball power system and the distribution system we have always had this dual jurisdictional aspect to our system whereby the federal energy regulatory commission oversees the ball power system the state regulators oversees the local distribution system for one hundred years we've worked together since the federal power act seventy years we've worked together in maintaining the reliability guess my question is there are so many since washington d c is not is not under the ball power system since new york is nonsense so much of our military is not how can you separate them shouldn't it be integrated as a single authority here to make sure that there is one system put in place the york standards apply to all elements of the system from top to bottom i think when you're talking about cyber security we would welcome federal leadership in a stablish standards for cyber issues but i think you need to separate the new york state it's only implied of the bulk power system would you want them extended over to distribution as well i don't think they need to be but they intricately intertwined with the local distribution system there certainly the connection between the bulk power system and the distribution of should and we've been integrate but that doesn't mean that having a centralized authority is necessarily going to be more effective in terms of the reliability of the local system i think you need to distinguish between the physical assets which for a long longtime have been under the dual control the any time that is to a communication between equipment there's a chance to call from us that equipment from a sovereign security perspective deployment of two way communication devices at the distribution level creates a huge technical challenge to secure that equipment secure those protocols and protect the assets up and down the line  software performance measures that if some urgency authority was provided as you look at the legislation that was stated is twenty one ninety five and twenty one sixty five framed as developing performance  measures performance measures could be implemented either at the state level or at the federal level so one could look at the performance measure and the commission could consider that as part of their responsibilities to the leadership could be provided at the federal level under the form of a performance measure on an ongoing basis we just have to take note of the fact that when we did have that blackout you know several years ago a problem in ohio affected canada and new york city my understanding that over two years after the iraq vulnerability was identified new york still has not established and is that would address that vulnerability in an optimal way why is that and how can we possibly argue that the process is adequate given this delay the standards are moving in the direction to address some of the vulnerabilities that the aurora incident disclosed and burned up in a constant process of upgrading those standards then and that's in the process what is your timeline on completion the commission has directed us to give them a timeline for completing the the changes to the standards they recently issued in order and we're to give them that timeline by the end of this year we're in the process we're in the process of developing that standards the standards that you're developing specific to a are are are optimized to deal with the war they don't focus solely on our or they're looking at a range of the threats that that the system is dealing with i thank you time's expired gentleman from michigan is recognized for five is that accurate i mean the mission the commission directed in order seventy six we approved the eight standards we directed modifications to every standard somewhere very substance and significant to provide specific examples as to why they're not jurisdiction have to be compliant with the standard today and only twelve requirements of the standards do they have to be required whether it's a phased in implementation would you agree with that mr mccollum can you power system they wreak havoc on particularly large bulk power system transformers they will destroy this transformers within a matter of seconds if they haven't been mitigated against such an occurrence there's also natural or i'm sorry go ahead there's also manmade electromagnetic pulse attacks those generate three separate types of energy disbursement one is termed any one it happens within a billionth of a second it's a very high very strong radio frequency type energy burst the wires and the transmission wires and facilities act as antenna they pick that burst up and it destroys all control equipment very shortly thereafter there's a need to effect which is similar lightning utilities are very how difficult is it to build a man made device that would it's not difficult it's not for a nation state for a sponsored terrorist organization it's not difficult it's getting easier dollars those can be portable and they could be directed to be pretty close to your target but if you are close you can pretty close within a quarter mile hundred yards within a few hundreds or thousands of feet depending on the quality of the will the commission doesn't have any information as far as what folks have done or haven't done regarding you know we suspect there hasn't been a lot of activity there and again that's a that's a physical attack not a cyber attack that is correct very three as it relates to the distribution of that power across not only new york but but all fifty states and that's sort of the the crux is we look at the two different bills before us said the distribution i don't know if you had access to classified reports as some of us were able to participate yesterday or last week mr mccollum was part of that discussion that we had  but i just want to know what evidence you have as you indicate that the president standards are adequate well obviously i don't have access and that's one of the concerns we have is that we don't necessarily have access to some of the newer threats that are emerging  all we can judge on is what we what we know and see there are a variety of threats to the electric system you can take out an electric system and in a variety of different ways and that's why we've been trying to work with new york on the broad array of broad array of security requirements that are necessary to protect the system and that's why i pointed out the difference between a threat and a vulnerability if there is an active threat out there i think everybody needs to know what not to think any of the legislation at this point kind of has a mechanism in place that if there's a threat that there's a way of sharing that threat with all of the state jurisdictional agencies law enforcement agencies are going to need to to address that threat i'm not sure a single standard somewhere established in legislation is going to be able to solve that problem or they don't want to time is expired i just ask one quick question mr mcclellan and that is as they see in your written testimony the challenges posed by smart grid technology in your opinion are the local utilities aware of this vulnerability and if so if not what can we do to enhance that lack  of preparation and we have an expression inside the commission that the killer bees are out in the wild what that means is they haven't really bought them brought in and briefed about the level of the sophisticated level of threat that could occur with cyber vulnerabilities with two way communications i think that's evidenced by some of the activity that happens other federal agencies department of defense and sophistication of the levels  valley you should take it personally but you mention that utility sector experts are not necessarily cyber security experts and lock high level security clearances is there a the electric grid has become operated in a more digital way more skater controls and so forth there's been a greater integration of the physical operators of the system and the technologists and we actually both participate nerd process but within our on utilities and we use what's called a layered defense in depth process where we look at people and technology and operations controls that addressable physical and cyber  segregation of our systems protection of our systems control of information training and access to the individual so that's actually underway and most utilities across the nation i will say the diversity of our systems  leads us not to be able to necessarily have a one size fits all way to resolve that issue thank you you know it seems to me that the real question here is how much additional authority is needed to to to approach this problem thank you mr brown for bringing up the distinction between immediate and imminent threat versus vulnerabilities when you look at twenty one sixty five versus twenty one ninety five twenty one sixty approaches for which one of those approaches would be preferable to that from the industry perspective twenty one sixty five as i said in my testimony would be preferential because i think it's very important to distinguish between vulnerabilities which need to be dealt with on a continuous improvement basis over time on a proactive and a preventative measure versus immediate and imminent threats or  emergency issues that we need confidential information to be able to respond to quickly and so we think that twenty one sixty five best addresses that differentiation and the other responders on the panel to that question  two thousand and five the authorization for nerk think a lot of progress has been made along the way in trying to address the vulnerability question trying to set standards for the vulnerability question i think what makes the th reat issue is where we believe the focus might be best served for this for this legislation and that there be more note of an ability a process established by congress that will say if there is an imminent threat exactly what the process will be in terms of disseminating that information to state regulators utilities on a confidential basis so that we can all address this together i think that's most important part of the legislation that kind of reinventing what's get people to agree on these things how's that working out i mean are your participants finding ways to agree on these things and then the broader utility network buying into those agreements is that what's happening as a general standards and we're making that progress the time has expired chair recognizes the gentleman from california the gentleman from texas the ranking member of the full committee mr barr thank you mr chairman i'm sitting here and we appreciate excellent i'll try to respond before the end of your comments i know you're going to be you're going to have you're going to have to work to beat that because i had ten or fifteen minutes to  distribution system and if you feel that the federal government should preempt the states in looking at this issue with regard to the distribution system i can start the book power system is generally defined as one hundred thousand volts were above the legislation pac two thousand and five required the commission to approve standards or you know approve standards for the ball park system however it is defined by the regions and so a region that chooses to redefine the ball power system is say two hundred thousand volts nobody can exempt sixty or seventy percent of the transmission facilities within that region by redefining the term power system so i think it's important to make the distinction that it's not just distribution that would be excluded under ball power system it may also be what is traditionally considered transmission facilities that serve major metropolitan areas that could be excluded by that definition back to the term distribution facilities it does the legislation does exclude facilities used for the distribution of local energy which would be the facilities that would capture it say the meters on the smart meters and any cyber facilities or appliances within the homes that communicate to the meters that may communicate back to the transmission systems and from an oversight the consequences are our most profound at the bulk system level and that's where our focus has been and that's where that's where we believe the focus needs to be with the witness from department of energy want to comment on  chairman i'm going to you about i think this would be really serious this is a serious hearing and you're doing it i would hope that we could legislate at the federal level without impinging too much on the local or the state level for distribution systems i would be reluctant to be too bold in preventing the states but i think this is an important issue and i'm very wisconsin thank you mr chairman one very specific question hopefully followed by a broad open question in our briefing memo from committee staff we have our attention pointed  to physical vulnerabilities of the gret grid and i'm just going to read you an excerpt for example large transformers essential essential to the reliable operation of the grid are manufactured outside of the united states replacement may require up to two years a limited number of spare large transformers are available within the united states an industry has developed a program to spare transformer equipment program or step another acronym providing for sharing of such assets a very very important point discreditable to the reliability of all power is the recovery of that system so an important aspect of that is the focus on manufacturing and manufacturing capabilities in the united states so as we look at developing protection mechanisms we must recognize that some parts of the grid will go down so another key aspect is how fast can we restore and that's directly what is our very own domestic manufacturing capacity and what are we doing to bolster it or large transformers very limited in fact i think there's only one company that is that will be looking at large transformers thank you on a much broader much broader question for all of you is  issue of communication and information exchange we've had testimony i you know the state perspective from the new york perspective of frustration being that much of this is classified and tightly held and needs to be communicated to actors in a bill with the ability to prepare and plan and yet we have sensitivities with getting certain information out we've been grappling with this as a committee on previous legislation relating to chemical plant security with water treatment plant security now in this arena i know it's a very broad question but i would like to hear your perspective on how we get the information that we're  at the department of energy at work to the hands of the people who actually need to plan and help us prepare while protecting that information carefully and we haven't even talked about a s l s but there another level of all of this and if you wouldn't determine how effective the mitigations were put into place we couldn't protect the information or felt that we may not be able to protect it from a foyer request and so we ended up asking for industry volunteers and reviewed their plans one of time without taking any information back to the commission this information transfer the inability to protect the information really impeded folks ability to use ability to implement mitigation strategies and we saw a whole gambit i don't want to say that was the only reason there were some folks that were very well mitigated there was good old american ingenuity that that had been deployed but there were other entities that had done nothing and additional information didn't it's about any comment on the communications we deal with confidential information at the state level all the time in terms of information regarding the power system i think we're well well prepared in positions if we get the information to protect it and use it the electric systems run on contingencies all the time that's how the electoral system is run it's always planning for the worst thing that could happen and that if it happens the system will stay up because there's adequate backup obviously the more information available about threats the better that contingency system can work we have been successful in the last year in arranging for cleared briefings for some c e o s to have access to some more some more of that information more that needs to happen i agree with mr kaufman that the clearances program needs to be needs to be accelerated and there needs to be a way that this information can get out to folks without having to without them having to make it public the state open  en records act sometimes get in the way of that because anything that some state agencies get has to be made public and i would agree with mr cook i think that that's an important step for congress to consider because right now without adequate wear and the information we might it would be limited and not applicable to a pending emergency or a vulnerability that we're the ones responsible for addressing so we certainly support additional clearance levels to make sure that threats can be dealt with in a timely manner and confidentially generally time has expired the chair recognizes the gentleman from illinois  just if you've got a piece of paper scribble down solar storm radio frequency e m p and then cyber and then my first question there's two questions i asked you to prioritize the threat as you see it in those four categories and then i'd ask you to prioritize  cost a recovery and and kind of following up on my opening statement about where our focus should be i think sometimes we don't really know what is the biggest threat what is the biggest cost recovery and so if i would start with mr mcclellan and just go down the line if you all could do that for me and if you don't want to you don't have to but i mean if you could that would be helpful difficult question who wants to be a millionaire if you can rank them one two three four and then we can feel it is tough to do cyber as one solar storms have as of two and in fact storms could be one because they're inevitable we are going to get another storm we are going to get another nineteen twenty one of which is being called a one in one hundred year storm that's going to happen and if it does devastating consequences are of weapons  unveil tuesday three point four billion in grants to smart meters updated transformers and other devices that were headed yes exactly the point is there's going to be a whole new system of two way communications introduced the electricity industry that really does that make  secure or less secure it can be both if not it should be more secure more real time information about the system should be good but it introduces new vulnerabilities that this is the ok like which if not protected i have limited time so if you four again ok let me go back to cost recovery if any of you could do that based upon these these attacks or of weapons i would put as number one and i write them the and i do want to add that in the original grouping i don't have these although i rank them for you i don't have them very far apart yet thank you and i'm going to stop there because i'm limited time i want to highlight that in april twenty first two thousand and nine a study by the national academy of scientists found that the u s could suffer one point two one to two trillion in damage as a result of e m p and take four to ten years to fully recover by contrast hurricane katrina inflicted hundred fifty three hundred billion in  damage so this is my concern i have a wind generating elect power plant that went down because of internet connection and went down for ten or fifteen days be speaks to the greening of america and the reliability of electricity the other issue that i wanted to address although we've kind of covered it in the this also speaks of more my opinion are by now is on the supply guy here on this committee more generation versus last we limit the ability for us to increase generation america we increase the ability to put ourselves at risk when anyone two or three of these  the sponsor of the bill i thank the chair the tables pretty much been set for the issues that we're going to be taking on to deliberation in goshi ations going forward on this but one thing that has very much about and it's an issue it's very much on the minds of the folks who are going to be tasked with following we're implementing any policies that we're going to be authorizing the implementation of and that's what the logical industry the generators and the distributors so i want to talk just briefly least kind  of set the stage for those discussions by asking if any of you all can identify any issues of disparate treatment or disparate impact that might result from the kinds of rules that we're all talking about trying to create and authorize here can you foresee looking down the road that there might be any impacts in terms of some of the mandates that might be forthcoming impacts it might be very might be disparate in terms of when i drew a big guy a big profit utility company as opposed to a little guy in e m c whether any regional impacts that you can foresee as a result of the mandates that we're contemplating here we all want to do the right thing and i know the generators and distributors all want to do the right thing but i'm sure that as there are staggering costs we're trying to avoid they're going to cost we're going to incur along the way so the first thing i want to ask is can anybody here on the panel give us some ideas the kinds of cost and especially the issues of equity and fairness disparate impacts that might result from any the mandates we're talking about today mr brown i think is sort of in the hot seat representing the utility commissioners of the country want to go first sure i'm not sure about disparate impacts but i think you need to put this into a context if there's a federally mandated cost that we've got to recover from our rate payers it means that perhaps we won't be able to do something else that we've been trying to do an opportunity cost another right now at the state level we're collecting money for renewable portfolio standard for over thirty states at energy efficiency programs infrastructure needs new transmission so there's a lot of pressures already on electricity rates what kind of cost do you foresee what billions of dollars state level tens of billions of dollars on a national level at the same time customers that are over sixty days in arrears on their bills in new york is over six hundred million dollars in arrears that's up twenty five percent from a year ago so just the rates that we have today people are unable to be able to pay so i guess my concern is the more mandates that we get requiring expenditures is going to mean dollars that we're not going to be able to collect to do other things that we really want to do commission any generators that have cost base contracts or contractual arrangements but not necessarily qualify for security security upgrades for cybersecurity or for say e m p expenditures and so that would have to considered by the state commissions especially if there was a security upgrade necessary for distribution system say smart metering upgrades and as far as whether or not we incur the cost i think the threat is here the vulnerabilities here in the threat is here this is a different world there are cities that are intent they believe that the ball power system united states they like to create is a myth as a legitimate military target and they have set their sights on that system and so whether or not  the costs are just going to have to be incurred or we're going to have to address the issue any way you slice it the cost of prevention a whole lot smaller than the cost of an action what you're saying about you mr zazi i would just want to add from the industry  the actual regime that was enacted in two thousand and five we've already added significant compliance resources and industry experts to that at a cost of a fair amount of money and one of the reasons that we're actually supportive of the approach that you're taken to this is it does tend appropriately focused on emergency threats which to me that represents a much smaller cost i think i mentioned the fact that we have four hundred miles of transmission but ten thousand of distribution which is not uncommon for many utility systems and if you look at the expansion of taking it down to lower probability assets in the distribution system it adds significant mr mcclelland can you give us some sense of the of the task ahead if we were to have a grid that was completely impervious to do anything versus what is actually practical what it what are the cost differentials that we're talking about we have infrastructure needs at state regulatory levels of billions of dollars just to maintain the existing the aging the system t technology exists to do that if dollars were not an issue do we have the technical know how to do that it's a matter of duplication you could duplicate a lot of the system over and over and over again so that technically i'll leave it to some of the experts whether it's completely impervious but that's a lot of money and this is all a cost benefit analysis i think that's what regulators do all the time is cost benefit analysis i could gold plate the electric system in new york and make sure that we don't have as many outages but the cost might be two to three times the rate payers they find it on affordable to pay the rates that are out there it's always a balance between reliability and cost and you can't just look at cost because you have an unreliable system but you can't just look at liability because you'll have a gold plated expensive system top balance on  balance the legislation look at the subject of this hearing do you think where do you think threading that needle appropriately with trying to balance those two hands one of the concerns i had about some of the legislation was it's reaching down all the way into the distribution system was the chairman's first question and i will note that for example the three major blackouts we've had in new york city ranging from one thousand were all bulk power system disruptions problems at the bulk power level got to the local level it wasn't problems with the local system so spending a lot of money on the local system and then perhaps sacrificing some things being done on the bulk power system may not be a cost effective way of meeting the concern and that's why we'd like to see the focus on the bulk power system and we think the work that began in two thousand and five with nerk is the appropriate way to be moving towards that goal and yet i mean there are technologies available today that weren't available five or ten years ago and those technologies do as i think you point out in your testimony at increased vulnerabilities and in different ways are with this legislation are we taking an appropriate over the horizon look at what may be available to electricity consumers in the future and providing them the protections or were we are we looking at a situation where we may have to be back here in five or ten years fifteen years and  communications we really need to get that secure i think that's the most important focus at this point in time just you know back back home there was a an effort to go to smart meters and then they turned out to not be in compliance with what we said they ought to have and so you've got a company down there now that is asking its rate payers to pick up the millions of dollars for meters that are going to be able to use what we do have to be careful how we implement these things because we can end up costing people a lot of money for  great time's expired the chair recognizes the gentleman from utah mr matheson thank you mr chairman i've heard some different opinions about whether or not utilities receive specific action intelligence from the federal government regarding imminent cyber threats and so i was wondering i'd ask all the witnesses are any want to respond what your thoughts are about this and do you think utility should receive more clearances or more information i could dress that from the industry perspective today we have not received any notifications or specific actionable intelligence  relative to imminent threats we did have the information that's been discussed regarding aurora there were thirty utilities as was mentioned that worked on a voluntary basis to try to understand in mitigate that that i do believe we do need additional clarence because there are many reports out there that there are significant threats and while there's been briefings that suggest that these things are real and imminent the utility industry to date has not been notified with any specificity in order to best mitigate those or prevent them we do work through the nerd standards prospected base but we do think that additional confidential clearance and additional ability to get additional federal authority to provide specific and actionable information would be very helpful the i guess i want to be very clear right up front and their standards are wholly inadequate to address threats to national security through the power grid then there are standards on average take four years develop modifications many different interation they're done i an open and inclusive form so not only is there a reason for the standard published but also all the proposed mitigation strategies and baggage have access to the web sites you can look at look at those proposed mitigations so the  existing standards that are in place the commission has identified substantial security gaps in those standards directed modifications and are awaiting their process to finish the modifications as far as information to utility yes i agree utilities do need more specific information to be conveyed but it's not just the information in the or advisory which was issued in june they were very specific mitigations that were requested and advisory is voluntary there is no ability for any federal agency to direct you to lead us to take action to protect their systems in the event of a threat or a vulnerability so the advisory was voluntary and we saw compliance that wasn't great we didn't see great compliance even with entities that understood the issue however everyone could have benefited by additional information just to dance to your question and the feedback we're getting is that more specific actionable intelligence information is what's needed that's the feedback we got on a roar there were limits on what could be said so that's a combination of clearances to the industry and figuring out ways of having arranging emergency orders is too broad that could also cause some other unintended consequences do you have thoughts about where we get the sweet spot on this you know it's very difficult the authorities being called extraordinary it's and that is much more targeted and specific than say of a standard action might be ok can i ask you do you have thoughts about how the steps the federal government could take to you've heard some of the questions about costs from other members just thoughts about how the federal government could work with utilities to help mitigate the cost impact relative to the risks that we're trying to address yes we had the benefit of reviewing with the utilities we asked for thirty volunteers and to get thirty volunteers on the order of mitigation we had the benefit of spending a day with each of those utilities and there were some very good ideas that came from the utilities back to the commission so it would be an interim process the commission would have to move quickly if it was if it was a vulnerability or threat that endangered national security we would issue that there would be a hearing process or a back and forth process where alternative products as could be proposed by the utilities to accomplish the same purpose but nevertheless not delay the mitigation being put into place to protect the economy and citizens in the military  specific threat that they're supposed to figure out how to deal with i mean isn't that what you're saying what i said was to date has not been any specific actionable information provided not to say there are vulnerabilities but there has not been an individual threat just been communicated beyond this aurora test and yet we know there  are you're able to talk about this that there are fairly specific threats and attack what we all know every computer it seems like being attacked by somebody and so how do we get the how do we bridge this it would seem to me with so much on the line that there must be a way that we can communicate the information you need to understand how serious this is and to cope with it i understand you understand how serious it is but i want to be clear how do we bridge that i want to be very clear on one point the utility industry has been dealing with vulnerabilities maybe that originated from reliability and now much more security and cyber based for many many years and will continue to do that so we're not awaiting information to do that however if there is a gap it's around this issue that there's a lot of discussion around pending threats that seem to be more imminent that have not been communicated and we just need to understand what those are so we can best mitigate them on the ground within our systems is the issue here that no the very timely specific threat as in x organization is going to do y to your system or is it is there anything you're not doing now to protect your system that kind information would help you but it would seem to me it's pretty pretty clear where the threat was not where it comes from from a specific individual organization necessarily but there are only so many ways to get into your system and do damage and i guess that's the question you'd think you'd know what those ways are and set up to mitigate right and we we do believe that we're in a position to best mitigate a method i mentioned before that we used this layered approach to deal with these but to the extent there was something that's yet not known to the industry that needs to be communicated we would benefit by having specific and actionable information that let me go to our government witnesses here without getting into specific things we can't talk about here are the actions or talking about they're doing th sort of physical actions to deal with management of their systems and prevent against those threats are they do they have as much knowledge as they need to know need to have to deal with it without knowing specific time place type of attack the distinction between classified non classified is who is the actor what specific systems are being targeted to vector back as far as the or advisory for instance there was sufficient information and detail within that advisory for folks to be able to perform mitigation actions and that advisory was not developed by the commission but developed idea and then issued to industry i think part of the question here is is there a central agency that's responsible to get the information to the end history and can hold industry accountable right now all that we have is we have a coordination and great partnership with  and industry but the advisories the information that's conveyed is voluntary in nature and is it also your sense that those advisories that information those recommendations are not being acted upon to the extent they need to be acted upon well none of the systems aren't being upgraded or modified to deal with the threat and they're fully they should be fully aware of what that threat is absent the classified piece of who it is and specific targets  only if it can be compelled we'd be able to assure that compliance has been executed or mr brown let me give you the last fourteen seconds the more information the better i'll use new york state as an example the single single largest contingency we planned for is a twelve hundred megawatt nuclear power plant going down because that's our single largest venue or something that could happen and at all times they maintain enough what's called spinning reserves plant goes down everything's and then they figure out the next biggest contingency and start planning that more information the more you can do those contingencies and be prepared for what happens to your system without the information without a specific threat they're going to be operating as if the situation was normal and that's where i think you become most vulnerable at that point when you're not prepared for two or three things happening at once which if you knew that there was a threat of that you could can plan your system around it so that's why the control area is even more important than the utilities when it comes to this the utilities maintain their little footprint but a speck in the northwest in the northeast there are larger control areas that are looking at the system as a whole and the  focus very keenly in on all of the issues that have been identified here today it's not lost on the committee that when a recent standards would apply and so that in and of itself says something about this issue that only one third of all generators in america felt that they had any critical assets at all that should have protection so there's a big gap here we have to find a way of closing it and i think today you've really helped us to shape kind of the challenge for the committee our system versus the distribution system cyber threats versus physical threats emergency authority standards being set we have to walk through each of these issues alumina aided by the testimony that you have provided for us here today we thank all of you very much for your testimony we want to stay very close to all of the stakeholders in this discussion that we can ensure that we make the right decision in terms of the additional question while we're all gathered here the gentleman interrupted the chairman's concluding statement in order to make that unanimous consent request so without objection the gentleman will be as though it was coming down from my sinai as the ten commandments and so i understand the different perspectives actually orient members differently when they hear the person with the gavel it was just a general knowledge question on the on the issue of the solar interference and i really miss mccloy i guess this is for you a couple of years ago when i was worked with the pilots union and the flight attendants unions on trying to mitigate their exposure to in flight radiation i got the impression that these things there was a predictive ability to these are we able to predict with any accuracy the the sudden burst of solar activity that's an excellent question and it it speaks to  how the same questions were posed a different way at the commission did have an emergency authority to be able to order mitigations against a solar magnetic activity how could it actually is that when the warning would be so little there is a satellite to plot it deployed  be a satellite that has about fifteen to thirty minutes of warning for solar activity and in fact some of the most massive solar storms in history have been with little or no signs activities sunspot activity is not a good predictor of the magnitude of solar storm that might occur fifteen or thirty minutes would be wholly inadequate and less the commission had ordered mitigation plans be put into place first for instance the e m p commission said that a good way to to mitigate against the three this effect would be to put a resist or in series with a transformer maybe even a capacitor those could be put into place with fifteen to thirty minutes as long as the cities were practiced they could be given that notice and thought would be they'll get more time and they could switch those in to  and it's into relationship with the smart grid so obviously that focuses us on on on solar on smart grid on making sure we build this out correctly because obviously in this new distributed energy world that solo presents we need to continue to think through but my congratulations to florida power and light for that big breakthrough today with the president and with that this hearing is a