Securing the Smart Grid: Protecting National Security and Privacy Through Mandatory, Enforcable Interoperability Standards

III. EFFORTS TO ADDRESS CYBERSECURITY: THE CURRENT LEGISLATIVE AND REGULATORY ENVIRONMENT Congress and the Obama Administration have demonstrated an awareness of the dangers that cybersecurity vulnerabilities pose to national security and, in response, have factored these concerns into For additional information regarding "backdoors" and the vulnerabilities they can create in otherwise secured systems, see Swire & Ahmad, supra note 78. legislation, executive orders, and project funding requirements. However, these responses have been inadequate in the Smart Grid context. In an industry as fast-moving as the Smart Grid, mandatory interoperability standards must be established early if they are going to be established at all. Instead, a voluntary adoption regime persists to the potential detriment of citizens and businesses. (147) While a self-regulatory model (148) can be effective in regulating an industry, the model established through the Energy Policy Act of 2005 (EPAct) (149) (which amended the Federal Power Act (FPA)) to develop mandatory reliability standards does not fully address Smart Grid cybersecurity from the interoperability perspective. The separate regulatory relationship established between NIST and the Federal Energy Regulatory Commission (FERC) under the EISA to implement interoperability standards is too burdensome and inactive to appropriately account for the fast-moving nature of Smart Grid development. (150) While all interoperability standards remain voluntary, utilities will continue to pick and choose what standards to abide by, often opting for minimum security to save money. Profit generators, such as Smart Grid technologies, will likely continue to be produced amongst a patchwork of inconsistent state and/or industry interoperability standards, rendering the Smart Grid highly vulnerable to cyber attacks. (151) A. FERC, NERC, and the Mandatory Reliability Standard Development Process Under section 215 of the EPAct, (152) Congress granted FERC the authority to develop mandatory standards aimed at ensuring the reliability of the "bulk-power system. " (153) "Reliability standards" include requirements for "existing bulk-power system facilities, including cybersecurity protection, and the design of planned additions or modifications to such facilities. " (154) The "bulk-power system" includes "facilities and control systems necessary for operating an interconnected electric energy transmission network" and "electric energy from generation facilities needed to maintain transmission system reliability. " (155) Notably, the "bulk-power system" excludes "facilities used in the local distribution of electric energy. " (156) The statute further directed FERC to certify an "Electric Reliability Organization" (ERO) to "establish and enforce reliability standards for the bulk-power system, subject to [FERC] review. " (157) In 2006, FERC certified the North American Electric Reliability Corporation (NERC) as the ERO. NERC's principal members are owners, operators, and users of the bulk-power system. (158) Once NERC has developed a reliability standard, (159) it submits it to FERC for approval. If FERC disapproves of a standard in whole or in part, it is not given statutory authority to unilaterally modify the standard; however, it may remand the standard to NERC for further consideration. (160) FERC may also conduct formal rulemaking proceedings for submitted reliability standards to allow for comment by other interested parties. (161) Ultimately, to establish a mandatory reliability standard, FERC must determine that the standard, as filed, is "just, reasonable, not unduly discriminatory or preferential, and in the public interest. " (162) Once approved by FERC, the reliability standard becomes mandatory for participants in the bulk-power system, and enforceable by NERC. (163) NERC documentation has suggested that while interoperability standards operate to ensure free exchange of information in the Smart Grid without logical barriers, reliability standards put barriers in place to protect the critical infrastructure assets of the bulk power system. …