```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

     OVERSIGHT OF FEDERAL EFFORTS TO ADDRESS ELECTROMAGNETIC RISKS

=======================================================================

                                 HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                             OVERSIGHT AND
                         MANAGEMENT EFFICIENCY

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 17, 2016

                               __________

                           Serial No. 114-69

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT] 

                                    
      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                  U.S. GOVERNMENT PUBLISHING OFFICE
22-763 PDF                WASHINGTON : 2017

________________________________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].  

                  

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Lou Barletta, Pennsylvania           Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania            Filemon Vela, Texas
Curt Clawson, Florida                Bonnie Watson Coleman, New Jersey
John Katko, New York                 Kathleen M. Rice, New York
Will Hurd, Texas                     Norma J. Torres, California
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Daniel M. Donovan, Jr., New York
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 
                                 ------                                

          SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY

                  Scott Perry, Pennsylvania, Chairman
Jeff Duncan, South Carolina          Bonnie Watson Coleman, New Jersey
Curt Clawson, Florida                Cedric L. Richmond, Louisiana
Earl L. ``Buddy'' Carter, Georgia    Norma J. Torres, California
Barry Loudermilk, Georgia            Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Ryan Consaul, Subcommittee Staff Director
                    Kris Carlson, Subcommittee Clerk
         Cedric C. Haynes, Minority Subcommittee Staff Director
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Scott Perry, a Representative in Congress From the 
  State of Pennsylvania, and Chairman, Subcommittee on Oversight 
  and Management Efficiency:
  Oral Statement.................................................     1
  Prepared Statement.............................................     2
The Honorable Bonnie Watson Coleman, a Representative in Congress 
  From the State of New Jersey, and Ranking Member, Subcommittee 
  on Oversight and Management Efficiency:
  Oral Statement.................................................     3
  Prepared Statement.............................................     4
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     5

                               Witnesses

Mr. Chris P. Currie, Director, Homeland Security and Justice 
  Issues, U.S. Government Accountability Office:
  Oral Statement.................................................    11
  Prepared Statement.............................................    13
Mr. Brandon Wales, Director, Office of Cyber and Infrastructure 
  Analysis, National Protection and Programs Directorate, U.S. 
  Department of Homeland Security:
  Oral Statement.................................................    18
  Prepared Statement.............................................    20
Mr. Joseph McClelland, Director, Office of Energy Infrastructure 
  Security, Federal Energy Regulatory Commission, U.S. Department 
  of Energy:
  Oral Statement.................................................    22
  Prepared Statement.............................................    24
Mr. Judson M. Freed, Director, Emergency Management and Homeland 
  Security, Ramsey County, Minnesota, On Behalf of the National 
  Association of Counties:
  Oral Statement.................................................    26
  Prepared Statement.............................................    28

                             For the Record

The Honorable Scott Perry, a Representative in Congress From the 
  State of Pennsylvania, and Chairman, Subcommittee on Oversight 
  and Management Efficiency:
  Statement of Patricia Hoffman, Assistant Secretary, Office of 
    Electricity Delivery and Energy Reliability, U.S. Department 
    of Energy....................................................     6

                                Appendix

Questions From Chairman Scott Perry for Chris P. Currie..........    45
Questions From Chairman Scott Perry for Brandon Wales............    47
Question From Chairman Scott Perry for Joseph McClelland.........    47

 
     OVERSIGHT OF FEDERAL EFFORTS TO ADDRESS ELECTROMAGNETIC RISKS

                              ----------                              

                         Tuesday, May 17, 2016

             U.S. House of Representatives,
                    Committee on Homeland Security,
                             Subcommittee on Oversight and 
                                     Management Efficiency,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:07 a.m., in 
Room 311, Cannon House Office Building, Hon. Scott Perry 
[Chairman of the subcommittee] presiding.
    Present: Representatives Perry, Duncan, Clawson, Carter, 
Loudermilk, Watson Coleman, and Torres.
    Also present: Representative Franks.
    Mr. Perry. The Committee on Homeland Security Subcommittee 
on Oversight and Management Efficiency will come to order.
    The purpose of this hearing is to receive testimony 
regarding the Federal Government's efforts to address risks 
associated with electromagnetic pulse, or EMP, events.
    The Chair asks unanimous consent to allow the gentleman 
from Arizona, Mr. Franks, the opportunity to participate in 
today's hearing.
    Without objection, so ordered.
    The Chair now recognizes himself for an opening statement.
    America's energy infrastructure is the heart that pumps the 
American economy. Long-term power outages resulting from an 
attack on our critical infrastructure could cripple our 
Nation's economy and put America's health and safety in 
jeopardy. Because the Nation's critical infrastructure is so 
vital to America's way of life, the Federal Government has 
recognized the necessity of securing our infrastructure from an 
array of risks, including the threat of EMP, electromagnetic 
pulse, attack.
    The most serious EMP risk would come in the form of an EMP 
resulting from a nuclear detonation at high altitude. Such an 
attack could cause long-term damage to the power grid. While 
many believe the likelihood of such an attack is low, the 
damage and economic aftershocks that would follow demand that 
we address these risks. We cannot discount that other nation-
states, such as North Korea, or sophisticated terror groups 
might want to utilized EMP to wreak havoc on our economy.
    The Departments of Homeland Security and Energy and the 
Federal Energy Regulatory Commission have an active role in 
protecting our critical infrastructure. According to a GAO, 
Government Accountability Office, report released last month, 
Federal agencies have taken action--it is important to note--
have taken action to prepare and mitigate EMP risks, but there 
is still room for improvement, as always.
    According to GAO, DHS and Department of Energy have 
addressed some but not all of the recommendations in a 2008 
report from the Congressionally-authorized EMP Commission. 
Unfortunately, DHS has yet to clearly identify a lead office or 
official within the Department to coordinate efforts internally 
and with other Federal and industry stakeholders. How can DHS 
protect us against EMP risks if they don't know who is in 
charge? I expect to hear from DHS's witness today on how the 
Department has corrected this failure.
    GAO has also found that Federal partners must do a better 
job of collaborating their planning activities. Additionally, 
GAO made recommendations to improve how DHS analyzes EMP risks 
and how DHS and DOE identify and implement key research and 
development priorities.
    Overall, GAO found that the Federal Government's efforts to 
prepare for and mitigate EMP risks are at best a mixed bag. The 
progress made to date is certainly due in part to Congress' 
oversight efforts and the recommendations made in 2008 by the 
EMP Commission. DHS and DOE must make more headway in their 
efforts to address EMP. Effectively engaging the private sector 
to assist with planning and building system resiliency will be 
an essential component of these efforts.
    Congress must also do its part. In November 2015, the House 
passed H.R. 1073, the Critical Infrastructure Protection Act, 
authorized by Congressman Trent Franks of Arizona, which would 
require better planning research and development for EMP risks. 
Unfortunately, like many other bills passed by this committee, 
it remains stuck in the Senate.
    I certainly appreciate the hard work of our watchdogs at 
GAO for their report and the witnesses for appearing before 
this subcommittee today. I look forward to hearing how Federal 
agencies will work to improve themselves in light of GAO's 
findings to better protect the American people from EMP risks.
    [The statement of Chairman Perry follows:]
                   Statement of Chairman Scott Perry
                              May 17, 2016
    America's energy infrastructure is the heart that pumps the 
American economy. Long-term power outages resulting from an attack on 
our critical infrastructure could cripple our Nation's economy and put 
Americans' health and safety in jeopardy. Because the Nation's critical 
infrastructure is so vital to Americans' way of life, the Federal 
Government has recognized the necessity of securing our infrastructure 
from an array of risks, including the threat of an electromagnetic 
pulse (EMP) attack. The most serious EMP risk would come in the form of 
an EMP resulting from a nuclear detonation at high altitude. Such an 
attack could cause long-term damage to the power grid. While many 
believe the likelihood of such an attack is low, the damage and 
economic aftershocks that would follow demand that we address these 
risks. We cannot discount that other nation-states, such as North 
Korea, or sophisticated terror groups might want to utilize an EMP to 
wreak havoc on our economy.
    The Departments of Homeland Security and Energy, and Federal Energy 
Regulatory Commission have an active role in protecting our critical 
infrastructure. According to a Government Accountability Office (GAO) 
report released last month, Federal agencies have taken action to 
prepare and mitigate EMP risks, but there's still room for improvement. 
According to GAO, DHS and the Department of Energy have addressed some 
but not all of the recommendations in a 2008 report from the 
Congressionally-authorized EMP Commission.
    Unfortunately, DHS has yet to clearly identify a lead office or 
official within the Department to coordinate efforts internally and 
with other Federal and industry stakeholders. How can DHS protect us 
against EMP risks if they don't know who is in charge? I expect to hear 
from DHS's witness today on how the Department has corrected this 
failure. GAO also found that Federal partners must do a better job of 
collaborating their planning activities. Additionally, GAO made 
recommendations to improve how DHS analyzes EMP risks and how DHS and 
DOE identify and implement key research and development priorities.
    Overall, GAO found that the Federal Government's efforts to prepare 
for and mitigate EMP risks are at best, a mixed bag. The progress made 
to date is certainly due, in part, to Congress's oversight efforts and 
the recommendations made in 2008 by the EMP Commission. DHS and DOE 
must make more headway in their efforts to address EMP. Effectively 
engaging the private sector to assist with planning and building system 
resiliency will be an essential component of these efforts.
    Congress must also do its part. In November 2015, the House passed 
H.R. 1073, the Critical Infrastructure Protection Act, authored by 
Congressman Trent Franks of Arizona, which would require better 
planning, research, and development for EMP risks. Unfortunately like 
many other bills passed by this committee, it remains stuck in the 
Senate.
    I appreciate the hard work of our watchdogs at GAO for their report 
and the witnesses for appearing before the subcommittee today. I look 
forward to hearing how Federal agencies will work to improve 
themselves, in light of GAO's findings, to better protect the American 
people from EMP risks.

    Mr. Perry. The Chair now recognizes the Ranking Member of 
the subcommittee, the gentlelady from New Jersey, Mrs. Watson 
Coleman.
    Mrs. Watson Coleman. Thank you, Mr. Perry. Thank you for 
holding today's hearing.
    Thank you to Messrs. Chris Currie, Brandon Wales, Joseph 
McClelland, and Jud Freed for your testimony today.
    The Department of Homeland Security is tasked with the 
overall safety and security of the United States. Last week, 
the Department revealed a new mission statement: ``With honor 
and integrity, we will safeguard the American people, our 
homeland, and our values.''
    One risk to the homeland is an EMP, or electromagnetic 
pulse--is a burst of electromagnetic radiation that results 
from suddenly fluctuating magnetic fields. An EMP can be either 
man-made or natural and can damage high-voltage transformers 
and possibly contribute to grid failure and electric power 
blackouts.
    EMPs are considered a high-impact, yet low-probability risk 
occurrence. As DHS tries to prioritize its efforts across a 
wide spectrum of potential dangers to the Nation, it should 
take seriously all risks impacting the homeland, not only EMPs 
but also climate change impacts, solar storms, and a wide range 
of natural disasters.
    Last month, the Government Accountability Office released a 
report reviewing the Department's assessment and coordination 
efforts in the EMP space. According to GAO, DHS components, 
including NPPD, FEMA, and S&T, conduct independent activities 
addressing EMPs, including research and development, 
stakeholder coordination, and mitigation. However, no specific 
component has been tasked with lead responsibility for 
coordinating activities within the Department or with Federal 
and industry stakeholders. Further, the Department has not 
fully leveraged opportunities to collect key inputs often used 
in a risk assessment, such as threat vulnerability and 
consequences information.
    Risk assessments are a beneficial means of incorporating 
methods or tools to reach a specific identifiable conclusion. 
Specifically, with the use of a risk assessment, the Department 
can better characterize the risk of EMPs in the overall 
protection mission.
    In 2007, this committee passed the 9/11 Commission Act, 
which required the Department to produce the Quadrennial 
Homeland Security Review, a document produced every 4 years for 
the purpose of comprehensively examining the Department's 
homeland security strategy and risk priorities. Thus far, 2 
QHSRs have been created, and it is my view that the latest 2014 
release showed improvement from the 2010 review, but the 
Department still needs improvement in the way it assesses its 
risk, such as EMPs.
    In the coming weeks, I will introduce legislation that 
addresses the importance of risk assessment in the development 
of the QHSR, specifically the need for detailed documented 
methods for gauging homeland security threats. In order to 
determine roles and responsibilities for the Department, as GAO 
suggests, DHS must first determine where EMP fits in the 
overall protective strategy for the Department.
    With that, Mr. Chairman, I yield back the balance of my 
time.
    [The statement of Ranking Member Watson Coleman follows:]
           Statement of Ranking Member Bonnie Watson Coleman
                              May 17, 2016
    The Department of Homeland Security is tasked with the overall 
safety and security of the United States. Last week, the Department 
revealed a new mission statement: With honor and integrity, we will 
safeguard the American people, our homeland, and our values.
    One risk to the homeland, an EMP, or Electromagnetic Pulse, is a 
burst of electromagnetic radiation that results from suddenly 
fluctuating magnetic fields.
    An EMP can be either man-made or natural and can damage high-
voltage transformers and possibly contribute to grid failure and 
electric power blackouts. EMPs are considered a high-impact, low-
probability risk occurrence.
    As DHS tries to prioritize its efforts across a wide spectrum of 
potential dangers to the Nation, it should take seriously all risks 
impacting the homeland, not only EMPs but also climate change impacts, 
solar storms, and a wide range of natural disasters.
    Last month, the Government Accountability Office released a report 
reviewing the Department's assessment and coordination efforts in the 
EMP space. According to GAO, DHS components, including NPPD, FEMA, and 
S&T conduct independent activities addressing EMPs including research 
and development, stakeholder coordination, and mitigation.
    However, no specific component has been tasked with lead 
responsibility for coordinating activities within the Department or 
with Federal and industry stakeholders. Further, the Department has not 
fully leveraged opportunities to collect key inputs often used in a 
risk assessment, such as threat, vulnerability, and consequences 
information.
    Risk assessments are a beneficial means of incorporating methods or 
tools to reach a specific, identifiable conclusion. Specifically, with 
the use of a risk assessment, the Department can better characterize 
the risk of EMPs in its overall protective mission.
    In 2007, this committee passed the 9/11 Commission Act, which 
required the Department to produce the Quadrennial Homeland Security 
Review, a document produced every 4 years for the purpose of 
comprehensively examining the Department's homeland security strategy 
and risk priorities.
    Thus far, 2 QHSRs have been created. It is my view that the latest 
2014 release showed improvements from the 2010 review, but the 
Department still needs improvement in the way it assesses its risks, 
such as EMPs.
    In the coming weeks, I will introduce legislation that addresses 
the importance of risk assessments in the development of the QHSR, 
specifically the need for a detailed, documented method for gauging 
homeland security threats.
    In order to determine roles and responsibilities within the 
Department as GAO suggests, DHS must first determine where EMPs fit in 
the overall protective strategy for the Department.

    Mr. Perry. The Chair thanks the gentlelady.
    Other Members of the subcommittee are reminded that opening 
statements may be submitted for the record.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                              May 17, 2016
    An electromagnetic pulse or EMP is a burst of electromagnetic 
radiation created when a nuclear weapon is detonated or when a non-
nuclear EMP weapon is used. Additionally, naturally-occurring solar 
weather can generate effects similar to other EMP events.
    An EMP could cause catastrophic damage to our Nation's critical 
infrastructure. An EMP is a high-impact, low-probability risk. Over the 
past 10 years, 92 percent of counties have had at least 1 Presidential 
disaster declaration issued; however, none of them were for an EMP.
    This does not mean that we should be dismissive of the threat; 
however, we have the responsibility to examine the Federal Government's 
efforts, while making sure that we do not use our platforms to promote 
fear in the minds of the American public.
    As the lead agency coordinating the Federal Government's efforts to 
promote the security and resiliency of the Nation's critical 
infrastructure, the Department of Homeland Security must take this 
threat, and all threats to the Nation's critical infrastructure, 
seriously.
    Last month, the Government Accountability Office issued a report 
detailing the Department's work in the EMP space and determined that 
DHS has not fully identified its risk assessments when it comes to an 
EMP attack.
    GAO also found that DHS officials could not identify any DHS 
representatives or offices as having broader designated responsibility 
for performing key oversight or coordination roles regarding 
electromagnetic risks within DHS's overall infrastructure protection 
efforts. According to GAO, stakeholders are unclear who within DHS is 
responsible for addressing electromagnetic risks.
    This leaves me to ask an age-old question that I have asked the 
Department on several occasions with regard to various responsibilities 
across several components--``Who's in Charge?'' While the Department of 
Homeland Security is 2 years into its ``Unity of Effort'' initiative, 
GAO's findings, while not shocking, are concerning.
    This is also troubling because as part of the Department's effort 
to become more unified, the National Protection and Programs 
Directorate is looking to Congress for authorization for a 
reorganization. This reorganization includes having an infrastructure 
directorate that works with the public and private sectors on threats 
to physical and cyber infrastructure.
    Congressional leaders need to know what if any impact a NPPD 
reorganization would have on the Department's responsibilities with 
oversight of the threat from EMP and where EMP fits in the Department's 
overall infrastructure protection strategy. We also need to know how 
the infrastructure directorate would plan on working with Federal, 
State, and local stakeholders when it comes to infrastructure security.
    I look forward to the testimony from today's witnesses that can 
provide greater context to how the Government, in particular DHS, is 
dealing with the threat from EMP, including how DHS will address risk 
assessments and continue to work with outside stakeholders.
    Finally, I am pleased that the Ranking Member of this subcommittee 
has taken the initiative to introduce legislation that addresses the 
importance of risk assessments, and I look forward to cosponsoring her 
legislation.

    Mr. Perry. We are pleased to have a distinguished panel of 
witnesses before us today. The witnesses' entire written 
statements will appear in the record. The Chair will introduce 
all of the witness first and then recognize each of you for 
your statements.
    At this time, I ask unanimous consent that the statement 
from the Department of Energy for the record from Patricia 
Hoffman is entered in the record.
    Without objection.
    [The information follows:]
     Statement of Patricia Hoffman, Assistant Secretary, Office of 
 Electricity Delivery and Energy Reliability, U.S. Department of Energy
                              May 17, 2016
    Chairman Perry, Ranking Member Watson Coleman, and Members of the 
subcommittee, thank you for continuing to highlight the importance of a 
resilient electric power grid. I appreciate the opportunity to address 
the Department of Energy's role in in helping to ensure a resilient, 
reliable, and flexible electricity system in an increasingly 
challenging environment.
    Our economy, National security, and even the health and safety of 
our citizens depend on the reliable delivery of electricity. The 
mission of the Office of Electricity Delivery and Energy Reliability 
(DOE-OE) is to strengthen, transform, and improve energy infrastructure 
to ensure access to reliable, secure, and clean sources of energy. We 
are committed to working with our public and private-sector partners to 
protect the Nation's critical energy infrastructure, including the 
electric power grid, from disruptions caused by natural and man-made 
events, such as severe weather, physical attacks, cyber attacks, and 
electromagnetic pulses (EMP).
    The electrical grid is more than just infrastructure. It is an 
ecosystem of asset owners, manufacturers, service providers, and 
Government officials at Federal, State, and local levels, all working 
together to run one of the most reliable power grids in the world. 
Ninety percent of the Nation's energy infrastructure is in private 
hands, and 3,306 electricity providers serve approximately 148 million 
customers \1\ through a network of 450,000 miles of high-voltage 
transmission lines.
---------------------------------------------------------------------------
    \1\ American Public Power Association (APPA), ``U.S. Electric 
Utility Industry Statistics'' http://www.publicpower.org/files/PDFs/
USElectricUtilityIndustryStatistics.pdf.
---------------------------------------------------------------------------
    There are plenty of risks beyond cyber, including physical, severe 
weather, natural disasters, aging infrastructure, and infrastructure 
interdependencies. In the face of these diverse threats, we can help 
ensure that the grid is poised to recover quickly following an 
incident. Fostering partnerships with public and private stakeholders 
plays a critical and necessary role in this work.
                      the ecosystem of resilience
    A crucial factor to meeting these challenges is to be proactive and 
cultivate what I call an ecosystem of resilience: A network of 
producers, distributors, regulators, vendors, and public partners, 
acting together to strengthen our ability to prepare, respond, and 
recover. We continue to partner with industry, other Federal agencies, 
local governments, and other stakeholders to quickly identify threats, 
develop in-depth strategies to mitigate those threats, and rapidly 
respond to any disruptions.
    Our resilience efforts are further bolstered by our broader grid 
modernization activities, including our support of the research, 
development, and demonstration of advanced technologies and our work 
with State, local, Tribal, and territorial stakeholders to help them 
improve their local resilience and energy emergency response 
capabilities. Of the $4.5 billion that we invested in grid 
modernization through the American Recovery and Reinvestment Act 
(ARRA), $3.4 billion was used to help industry accelerate the 
deployment of advanced technologies that are now reducing costs and 
keeping the lights on more reliably and efficiently. This smarter grid 
is helping to prevent outages, reduce storm impacts, and restore 
service faster when outages occur.
    Our model is partnerships first. We are all in this together. It is 
through working together that we continue to strengthen our ability to 
bounce back following an event.
                       partnerships for readiness
    DOE-OE has been working with utility owners and operators, 
regulators, and State and local officials across the country concerning 
threats to cybersecurity and other risks. Through these partnerships, 
we are providing tools, best practices, new technologies, and funds to 
support their many on-going efforts.
    We directly support preparedness efforts at the community level, in 
part through products and tools produced by our Infrastructure Security 
and Energy Restoration (ISER) division, to inform and educate State and 
local officials in their energy emergency preparedness activities. This 
is done through forums, training, and tabletop exercises for Federal, 
State, and local energy officials.
    In early February, DOE Secretary Ernest Moniz signed an updated 
Energy Emergency Assurance Coordinators (EEAC) Agreement with the 
National Association of State Energy Officials (NASEO), National 
Association of Regulatory Utility Commissioners (NARUC), National 
Governors Association (NGA), and National Emergency Management 
Association (NEMA). This updated EEAC Agreement lays out concrete items 
to improve our collective ability to share information, which is 
essential for making sound response and restoration decisions during 
emergencies. To support this effort, DOE and State officials will 
develop information-sharing protocols and processes to streamline 
response operations. We will also test these processes and information-
sharing mechanisms through routine drills and exercises.
    The President's fiscal year 2017 budget request includes $15 
million for a State Energy Assurance program to foster regional hazard 
preparedness. This program would focus on providing State, local, 
Tribal, and territorial governments with analysis, training, and 
exercising of shared regional risk factors where entities depend on 
each other for energy supplies and must work together to resolve energy 
disruptions to restore energy infrastructure.
    This new program would be facilitated through competitive regional 
cooperative assistance awards to State and local partners. As needed, 
DOE, including our National Laboratory expertise and capability, would 
be available to the awardees to enhance preparation and allow for real-
world energy emergency support. Lessons learned would be shared with 
other communities to leverage the program across the Nation and help 
improve resiliency planning.
    DOE-OE also focuses on enabling our State, local, and utility 
partners with information. EAGLE-I (Environment for Analysis of Geo-
Located Energy Information), for example, is a DOE-designed and 
operated web tool that automatically gathers electrical grid service 
status data from company websites every 15 minutes, and organizes it 
into an easy-to-read picture of electrical service status Nation-wide. 
Now covering 75 percent of all U.S. electricity customers, it provides 
real-time information about the grid--what is up, what is down, the 
number and location of outages, when service is restored--to DOE and, 
through our information-sharing efforts, with other Federal agencies.
Geomagnetic Disturbances (GMD) or Space Weather
    President Obama and the administration recognize the threat posed 
by a GMD from space weather and the administration continues to 
prioritize work to address these concerns. In April 2015, the 
Quadrennial Energy Review highlighted methods to reduce our electric 
grid's vulnerabilities to multiple forms of risks. The Secretary of 
Energy has prioritized DOE efforts to help understand and mitigate 
these risks for the electricity subsector (subsector).
    In 2015 the administration issued the National Space Weather 
Strategy and follow-up National Space Weather Action Plan to better 
understand and address the risks of geomagnetic storms. The plans gave 
DOE primary responsibility for 2 of the actions in the Action Plan. 
First, by the end of 2016, DOE will coordinate with regulatory agencies 
and the electric power industry to define data requirements that 
facilitate a centralized reporting system to collect real-time 
information on the status of the electric power transmission and 
distribution system during geomagnetic storms. Second, also by the end 
of 2016, DOE, in coordination with Departments of Homeland Security and 
Commerce, and stakeholders in the subsector, will develop plans to 
provide monitoring and data collection systems to inform a system-wide, 
real-time view of geomagnetically induced currents (GICs) at the 
regional level and, to the extent possible, display the status of power 
generation, transmission, and distribution systems during geomagnetic 
storms.
    For several years DOE has taken actions and funded efforts to 
better understand the risk from space weather. Our space weather 
strategy included analysis, enhancing science, and collaboration with 
stakeholders both domestically and internationally. Efforts include:
   Encouraging the development of a North American Reliability 
        Corporation (NERC) GMD task force and supporting it to better 
        understand space weather. The task force developed standards 
        for GMD. In addition to monitoring geomagnetic disturbances, 
        industry is prepared to take action as needed, including 
        reducing load if necessary and changing operational settings to 
        respond to system needs.
   Funding the Electric Power Research Institute's (EPRI) 
        SUNBURST program, a geomagnetically-induced current monitoring 
        system. When our support began there were only 10 monitors, all 
        in the Eastern Interconnection. Now there are over 40 and they 
        are in all 3 major grids in the Continental United States
   Funding a new program to evaluate and install variometers to 
        collect and share data on changes on magnetic fields during 
        GMDs. Our program will put in 12 variometers to help system 
        owners and operators better model the expected potential 
        currents going into transformers causing grid and possible 
        system damage. With the data grid operators can take informed 
        risk-based decisions on actions to mitigate and protect against 
        GMDs. Prior to the deployment of the first variometer, the 
        United States Geological Survey had only 6 magnetometers to 
        measure such data.
   Funding a study at Oak Ridge National Laboratory (ORNL) to 
        evaluate the susceptibility of the eastern grid to GMD. The 
        study will be completed by year's end.
   Organizing, attending, and participating in several space 
        weather workshops with government and industry stakeholders, 
        including those from some of our allies such as Canada, the 
        United Kingdom, and Ireland.
Electromagnetic Pulses (EMP)
    DOE has increased its efforts to better understand the EMP threat 
to the electric grid and what measures can mitigate its potential 
adverse impacts. DOE plans to take the necessary steps to develop cost-
effective strategies for all hazards to mitigate, respond to, and 
recover from potential disruptions. We have a multi-pronged approach to 
addressing EMP threats, allowing the subsector to advance readiness for 
potential EMP impacts through research to quantify the threat, 
scientific development of mitigation strategies, and analysis of the 
policies needed for the future.
    A recent GAO Report 16-243 from March 2016 presented 
recommendations to Federal agencies on methods to address EMP. DOE 
concurred with the report's recommendations to DOE, including that the 
``Secretary of Energy direct responsible officials to engage with 
Federal partners and industry stakeholders to identify and implement 
key EMP research and development priorities, including opportunities 
for further testing and evaluation of potential EMP protection and 
mitigation options.''
    The Fixing America's Surface Transportation Act of 2015 (FAST Act, 
Pub. L. 114-94) also gives the Department impetus to enhance planning 
for events such as EMP. In the Act, Congress enhanced the Secretary of 
Energy's abilities to take emergency actions related to grid operations 
during a grid security emergency caused by any high-impact event such 
as an EMP attack.
    Other on-going or planned activities related to EMP include:
   The Department is analyzing the vulnerability of the grid to 
        an EMP event and the potential impact on reliability and 
        delivery of electric power. The analysis will examine options 
        such as hardening, blocking, stockpiles, and planning.
   The Department is conducting a risk analysis for ``extreme 
        events'' including EMP electricity industry planning.
   The Department is working jointly with the Department of 
        Homeland Security through Los Alamos National Laboratory and 
        DHS's National Infrastructure Simulation and Analysis Center to 
        begin developing methods to analyze the impact and consequences 
        of different sources of EMP and GMD events on U.S. electric 
        power infrastructure and to use those methods to determine 
        events of concern.
    DOE is committed to helping forge the grid of the future that will 
be more resilient to all hazards, including EMP. Continued progress in 
grid modernization is vital to helping us protect the grid from EMP.
                       partnerships for response
    Our partnerships with private and public stakeholders also focus on 
quickly identifying threats, developing in-depth strategies to mitigate 
them and rapidly responding to any disruptions. With 90 percent of the 
Nation's power infrastructure privately held, coordinating and aligning 
efforts between the Government and the private sector is the only 
viable path to success.
    Under Presidential Policy Directive-21: Critical Infrastructure 
Security and Resilience and the FAST Act, DOE is the Sector-Specific 
Agency (SSA) for electrical infrastructure. The SSA plays the pivotal 
role of ensuring unity of effort and message across Government 
partners, including the Department of Homeland Security, the Department 
of Defense, and DOE offices.
    As the Energy SSA we also serve as the day-to-day Federal interface 
for the prioritization and coordination of activities to strengthen the 
security and resilience of critical infrastructure in the electricity 
subsector. This involves building, maintaining, and advancing our 
relationships and collaborative efforts with the energy sector. We have 
invested in public/private partnership programs and initiatives that 
involve sharing real-time information, assessing vulnerabilities, 
clarifying responsibilities, and engaging in training and exercises.
    In addition, the Department of Energy serves as the lead agency for 
Emergency Support Function 12 (ESF-12) under the National Response 
Framework. As the lead for ESF-12, the DOE is responsible for 
facilitating the restoration of damaged energy infrastructure. During a 
response operation, the Department works with industry and Federal/
State/local partners to:
   Assess disaster impacts on local and regional energy 
        infrastructure;
   Coordinate asset delivery to repair damaged infrastructure;
   Monitor and report on restoration efforts; and
   Provide regular situational awareness updates to key 
        decision makers in the administration and our interagency 
        partners.
    To achieve these operational priorities, the Department deploys 
responders who work directly with the affected utilities and local 
officials on the ground during a disaster. The responders provide 
expertise on a variety of energy issues, and have direct access to our 
subject-matter experts in Washington, DC who work with our interagency 
partners to coordinate the appropriate waivers, when needed, to further 
speed restoration efforts. In extreme cases, the Department can use its 
legal authorities under the Federal Power Act, Defense Production Act, 
and other statutes to assist in response and recovery operations.
    The National electricity infrastructure spans 19,000 power plants, 
450,000 miles of transmission lines, 55,000 substations, and 6 million 
miles of distribution lines. The grid is truly a National system of 
complex systems, where small variations in power output or quality can 
be felt almost instantly several States away. That said, every piece of 
that infrastructure is local.
    Threats ranging from a fallen tree to a dedicated hacker from 
overseas can threaten the broader transmission system and the 
distribution system. When the power goes out, the local utility is the 
first responder. Should any threat or emergency exceed local public or 
private resources or require a full-blown National response, a utility 
CEO, a representative trade association member of the Electricity 
Subsector Coordinating Council (ESCC), the Electricity Information 
Sharing and Analysis Center (E-ISAC), or the Federal Government can 
request what is called a Crisis State Activity. Crisis State Activities 
are coordinated through the ESCC because, as with preparedness, we 
respond through partnerships. The ESCC is a group of leaders from 
across the electricity subsector that meet regularly with Government to 
coordinate and share information. Together, we work toward collective 
actions to address the threat or risk.
    Congress enacted several important new energy security measures in 
the FAST Act. The Secretary of Energy was provided a new authority, 
upon declaration of a Grid Security Emergency by the President, to 
issue emergency orders to protect or restore critical electric 
infrastructure or defense critical electric infrastructure. This 
authority allows DOE to respond as needed to the threat of cyber and 
physical attacks on the grid. DOE is developing a proposed rule of 
procedure regarding this new authority.
    The FAST Act codifies DOE's role as the lead SSA for energy sector 
cyber incident coordination. These actions provide a central point of 
contact for the energy sector and can expedite recovery from cyber and 
physical incidents.The FAST Act protections afforded to critical 
electric infrastructure information provide essential information-
sharing tools to enhance the Federal Government's situational awareness 
while assuring the private sector that sensitive information on 
vulnerabilities will be safeguarded. DOE looks forward to consulting on 
the forthcoming Federal Energy Regulatory Commission (FERC) critical 
electric infrastructure information ruling.
    The FAST Act will also enable a more robust response for energy 
incidents, and DOE is on track to implement the energy security 
provisions.
                      partnerships for innovation
    Innovation and preparedness are vital to grid resilience. In 
January 2016, the DOE built upon its Grid Modernization Initiative--an 
on-going effort that reflects the Obama administration's commitment to 
improving the resiliency, reliability, and security of the Nation's 
electricity delivery system--by releasing a comprehensive new Grid 
Modernization Multi-Year Program Plan (MYPP). The MYPP, developed in 
close collaboration with a wide range of key external partners, lays 
out a blueprint for DOE's research, development, and demonstration 
agenda to enable a modernized grid, building on concepts and 
recommendations from the first installment of the Quadrennial Energy 
Review (QER) and Quadrennial Technology Review (QTR).
    For example, large power transformers are critical to grid 
resilience, and are ripe for innovation. These important grid assets 
can weigh hundreds of tons, are expensive, and are typically custom 
made with procurement lead times of a year or more. A significant 
number of damaged transformers from any type of hazard could result in 
a long-term impact on the overall resilience of the grid. The QER 
recognized the risks associated with the loss of large power 
transformers. The QER recommended that DOE work with other Federal 
agencies, States, and industry on an initiative to mitigate these 
risks. Approaches envisioned in the QER include the development of 1 or 
more strategic transformer reserves through a staged process, beginning 
with an assessment of technical specifications and whether new Federal 
regulatory authorities or cost-share are necessary and appropriate.
    The Transformer Resilience and Advanced Components (TRAC) program 
includes a number of R&D activities to improve the resilience of 
transformers. Replacing aging grid assets with outdated technology 
leads to infrastructure lock-in that increases the total cost of grid 
modernization. The typical lead time between a large power transformer 
order and delivery ranges from 5 to 12 months for domestic producers 
and 6 to 16 months for producers outside the United States. The 
President's fiscal year 2017 budget request of $15 million for TRAC 
will help develop cost-effective, next-generation components that are 
inherently more resilient.
    The FAST Act (Sec. 61004) also addressed this issue and requires 
DOE in consultation with FERC, the ESCC, Energy Reliability 
Organization (ERO), and owners and operators of critical electric 
infrastructure to submit a plan to Congress evaluating the feasibility 
of establishing a Strategic Transformer Reserve for the storage, in 
strategically-located facilities, of spare large power transformers in 
sufficient numbers to temporarily replace critically damaged large 
power transformers. The plan is to include an analysis of the degree to 
which electricity subsector initiatives including utility ownership, 
sharing agreements, etc., satisfy needs and funding options including 
fees on owners and operators and public-private cost share with 
industry. In January, DOE-OE awarded the analysis project to a team led 
by the Oak Ridge National Laboratory. The team includes researchers 
from the University of Tennessee-Knoxville, Sandia National 
Laboratories, the Electric Power Research Institute, and Dominion 
Virginia Power.
    Secretary Moniz also announced last January an award of up to $220 
million over 3 years, subject to Congressional appropriations, to DOE's 
National Laboratories and partners to support critical research and 
development in advanced storage systems, clean energy integration, 
standards and test procedures, and a number of other key grid 
modernization areas. This Grid Modernization Laboratory Consortium 
effort recognizes regional differences and will strengthen regional 
strategies while defining a diverse and balanced National strategy. In 
addition to projects that address the needs of incorporating individual 
grid technologies like solar or energy storage, DOE is also developing 
cross-cutting projects that have an impact across multiple 
technologies. As Secretary Moniz said at the announcement, 
``Modernizing the U.S. electrical grid is essential to reducing carbon 
emissions, creating safeguards against attacks on our infrastructure, 
and keeping the lights on.''
    Energy storage is a key technology for whole-grid resilience. 
Energy storage fundamentally changes the relationship between when 
energy is produced and when it is consumed. The President's fiscal year 
2017 budget request supports OE's work on materials research, device 
development, demonstrations, and grid analysis to help transition 
selected energy storage technologies from R&D to industrially relevant 
scales with improved safety, industry acceptance, and reduced cost. 
Improved energy storage technologies will enable the stability, 
resiliency, and reliability of the future electric utility grid, as 
well as increased deployment of variable renewable energy resources.
    We have been proactive in advancing technologies to modernize and 
make our grids smarter and more adaptive to the challenges posed by 
threats to the grid. For example, DOE-OE has made key investments in 
the area of synchrophasor technology, which reduces grid 
vulnerabilities by providing timely and accurate power outage 
information and better self-healing capabilities, and has also invested 
in microgrids, which keep local communities up and running during 
regional and other outages and help supply power to affected areas.
    Many of these projects are working in local jurisdictions 
throughout the United States. Supporting the research, development, and 
deployment of next-generation technologies enhances the grid's ability 
to recover quickly from disruptions.
                               conclusion
    Threats continue to evolve, and DOE is working diligently to stay 
ahead of the curve. The solution is an ecosystem of resilience that 
works in partnership with local, State, and industry stakeholders to 
help provide the methods, strategies, and tools needed to help protect 
local communities through increased resilience and flexibility. To 
accomplish this, we must accelerate information sharing to inform 
better local investment decisions, encourage innovation and the use of 
best practices to help raise the energy sector's security maturity, and 
strengthen local incident response and recovery capabilities, 
especially through participation in training programs and disaster and 
threat exercises.
    Building an ecosystem of resilience is--by definition--a shared 
endeavor, and keeping a focus on local communities remains an 
imperative. Because DOE has spent decades building--and continues to 
build--local partnerships and investing in technologies to enhance 
resilience, the grid is better able to withstand and recover quickly 
from disasters and attacks.

    Mr. Perry. All right. Mr. Chris Currie is the director of 
GAO's Homeland Security and Justice Team, where he leads the 
agency's work on emergency management, National preparedness, 
and critical infrastructure protection issues. In this role, he 
evaluates Federal efforts and programs to prevent, plan for, 
and respond to natural and man-made disasters. Prior to this 
position, he served as an acting director in GAO's Defense 
Capabilities and Management Team, where he led reviews of 
Department of Defense programs.
    Welcome.
    Mr. Brandon Wales is the director of the Office of Cyber 
and Infrastructure Analysis at the Department of Homeland 
Security. His office provides integrated analysis of cyber and 
physical risk to the Nation's critical infrastructure. 
Previously, Mr. Wales was the director of the Homeland 
Infrastructure Threat and Risk Analysis Center.
    Welcome.
    Mr. Joseph McClelland is the director of the Office of 
Energy Infrastructure Security at the Federal Energy Regulatory 
Commission, or FERC. His works with Federal and State agencies 
and the energy industry to minimize risk to the Nation's energy 
infrastructure. Mr. McClelland joined the Commission in 2004 
and has more than 20 years of experience in the electric 
utility industry. He is a graduate of the Pennsylvania State 
University.
    Welcome.
    Mr. Judson Freed is the director of the Office of Emergency 
Management and Homeland Security for Ramsey County, Minnesota--
thanks for traveling here today, sir--and is testifying on 
behalf of the National Association of Counties in his capacity 
as the vice chair of its subcommittee on homeland security and 
emergency management. The association represents elected and 
appointed officials in over 3,000 counties across the Nation.
    Thank you all for being here today.
    The Chair now recognizes Mr. Currie for your statement, 
sir.

 STATEMENT OF CHRIS P. CURRIE, DIRECTOR, HOMELAND SECURITY AND 
     JUSTICE ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Currie. Well, thank you, Chairman Perry, and thank you, 
Ranking Member Watson Coleman, as well, and other Members of 
the subcommittee. I appreciate the chance to be here to discuss 
our recent report on Federal efforts to address electromagnetic 
risks.
    Within the United States, there are 16 critical 
infrastructure sectors--for example, water, transportation, 
communications, and, of course, energy. The energy sector ties 
all of these sectors together, and without it the others can't 
function. This makes protecting it a National security 
priority.
    One of the greatest threats to the electric grid is an EMP, 
or electromagnetic pulse; also, a natural solar weather event. 
These are also called GMDs, or geomagnetic disturbances. Both 
could cause large power outages over a long period of time.
    The concern was so great that Congress established the EMP 
Commission in 2001. It issued reports in 2004 and 2008, and 
most of the recommendations were aimed at the Departments of 
Homeland Security and Energy.
    Now, DHS and DOE are not required in law to implement the 
Commission recommendations; however, we found that many of the 
recommendations align with responsibilities that both 
departments already have. For example, various laws and 
Presidential directives already require DHS and DOE to assess 
the risks to critical infrastructure assets and prioritize 
those.
    DHS, DOE, and FERC have all taken some action, as the 
Chairman noted, to address electromagnetic risks. Most of these 
actions are indirect, since electric infrastructure is mainly 
owned by the private sector. But here are some examples:
    DHS and DOE have invested in research to study the 
vulnerability of large, high-voltage transformers to EMPs, 
GMDs, and other natural disasters. These transformers are 
particularly critical to our electric grid. They are also 
expensive, large, and difficult to replace quickly.
    In the response area, FEMA is developing a specific plan to 
address long-term power outages, and while it is not specific 
to electromagnetic risks, this plan would describe how the 
Federal Government would respond and recover from a long power 
outage.
    Just to be clear, while some of these actions align with 
certain EMP Commission recommendations, there has not been a 
comprehensive, holistic effort to address them. There are still 
whole or part recommendations that remain open.
    Now, the next question is, what more should we expect the 
Federal Government to do? We found several areas where Federal 
efforts need to be strengthened.
    First, it wasn't clear and, frankly, there was a bit of 
confusion within DHS for who exactly should be responsible for 
electromagnetic risks. As I mentioned, various components took 
action, but there is no designated lead for coordinating all of 
these efforts together. We think this is important, not just to 
clarify things within DHS, but also so DHS's partners, like 
DOD, DOE, FERC, and the industry, know who to work with. We 
recommended that DHS designate roles and responsibilities, and 
they fully agreed with that.
    We also found that much more needs to be done to identify 
and prioritize key electric-sector infrastructure. Neither DHS 
nor DOE could identify actions in this area. While FERC did 
conduct a review in 2013 of certain critical electric-sector 
substations, DHS and DOE were not involved at that time. What 
we recommended is that DHS and DOE review FERC's assessment and 
determine what more needs to be done to assess and prioritize 
assets. Both agencies fully agreed with us and are now taking 
some action to address that.
    Last, more needs to be done to coordinate and prioritize 
efforts across the departmental stovepipes. This includes areas 
like research and the testing and development of mitigation and 
protection technologies. Recently, there's been more focus and 
coordination on natural solar events through efforts like the 
White House National Space Weather Action Plan, but this plan 
addresses only natural events, not EMPs.
    We recommend that DHS and DOE better coordinate with each 
other and the industry--and that is critical--to identify and 
implement EMP research and development priorities. Importantly, 
this would include coordinating to test and evaluate potential 
EMP protection options. Both agencies agreed and told us they 
plan to work with industry over the next year or so to develop 
that.
    So we will continue to monitor DHS and DOE's progress in 
implementing these recommendations moving ahead. That completes 
my prepared remarks. I would be happy to answer your questions.
    [The prepared statement of Mr. Currie follows:]
                 Prepared Statement of Chris P. Currie
                              May 17, 2016
    critical infrastructure protection.--federal efforts to address 
                         electromagnetic risks
                              gao-16-641t
    Chairman Perry, Ranking Member Watson Coleman, and Members of the 
subcommittee: I am pleased to be here today to discuss our March 2016 
report on Federal efforts to address electromagnetic risks to the 
electric grid.\1\ Electromagnetic risks caused by a man-made 
electromagnetic pulse (EMP) or a naturally-occurring solar weather 
event could have a significant impact on the Nation's electric grid as 
well as other infrastructure sectors that depend on electricity, such 
as communications. The impact of these events could lead to power 
outages over broad geographic areas for extended durations. Addressing 
these events necessitates effective collaboration among multiple 
Government agencies and industry partners, as no single Federal program 
or entity has sole responsibility for addressing electromagnetic risks. 
In April 2008, the Commission to Assess the Threat to the United States 
from Electromagnetic Pulse Attack (EMP Commission)\2\ issued a report 
that included over 90 recommendations addressing the preparation for, 
and protection and recovery from, a possible EMP attack against U.S. 
critical infrastructure. The majority of these recommendations were 
made to the Department of Homeland Security (DHS) and to the Department 
of Energy (DOE).
---------------------------------------------------------------------------
    \1\ GAO, Critical Infrastructure Protection: Federal Agencies Have 
Taken Actions to Address Electromagnetic Risks, but Opportunities Exist 
to Further Assess Risks and Strengthen Collaboration, GAO-16-243 
(Washington, DC: Mar. 24, 2016).
    \2\ Established pursuant to the National Defense Authorization Act 
for Fiscal Year 2001, the EMP Commission was responsible for assessing 
the following: (1) The nature and magnitude of potential high-altitude 
EMP threats to the United States; (2) the vulnerability of U.S. 
military and civilian systems to an EMP attack in terms of emergency 
preparedness; (3) the capability of the United States to repair and 
recover from damage inflicted by an EMP attack; and (4) the feasibility 
and cost of hardening selected military and civilian systems against 
EMP attack. See Pub. L. No. 106-398,  1401-09, 114 Stat. 1654, 1654A-
345-348 (2000). See also Pub. L. No. 109-163,  1052, 119 Stat. 3136, 
3434-35 (2006) (reestablishing the EMP Commission to continue its 
efforts to monitor, investigate, make recommendations, and report to 
Congress on the evolving threat to the United States in the event of an 
EMP attack resulting from the detonation of a nuclear weapon or weapons 
at high altitude) and Pub. L. No. 110-181, Div. A,  1075 122 Stat. 3, 
333 (2008) (providing, among other things, that the EMP Commission and 
the Secretary of Homeland Security shall jointly ensure that the work 
of the EMP Commission with respect to EMP attack on electricity 
infrastructure, and protection against such attack, is coordinated with 
DHS efforts on such matters). The National Defense Authorization Act 
for Fiscal Year 2016 once again reestablishes the EMP Commission but 
with an expanded purpose that includes the evolving threat from, among 
other things, non-nuclear EMP weapons and natural EMP generated by 
geomagnetic storms. See Pub. L. No. 114-92,  1089, 129 Stat. 726, 
1015-16 (2015).
---------------------------------------------------------------------------
    According to experts, a nuclear EMP is the burst of electromagnetic 
radiation resulting from the detonation of a nuclear device, which can 
disrupt or destroy electronic equipment. Non-nuclear EMP weapons can 
also be designed to intentionally disrupt electronics, but these 
generally have short range and are not a threat to multiple assets. In 
addition to man-made EMPs, naturally-occurring solar weather events of 
sufficient intensity can also cause electromagnetic impacts that can 
adversely affect components of the commercial electric grid, as well as 
other infrastructure such as satellites and undersea cables. The 
resulting impact of a solar weather event is commonly referred to as a 
geomagnetic disturbance (GMD). In 1989, a GMD caused wide-scale impacts 
on the Hydro-Quebec power system in Canada which caused this regional 
electric grid to collapse within 92 seconds and left 6 million 
customers without power for up to 9 hours.
    The National Infrastructure Protection Plan (NIPP) outlines the 
roles and responsibilities of DHS and applicable sector-specific 
agencies for each of the 16 critical infrastructure sectors.\3\ DHS has 
the lead role in coordinating the overall Federal effort to promote the 
security and resilience of the Nation's critical infrastructure and 
DOE--as the sector-specific agency for the energy sector, which 
includes critical electrical infrastructure--shares responsibility with 
DHS. Other Federal agencies working to address the threat of EMP and 
GMD include the Department of Defense (DOD) and the Federal Energy 
Regulatory Commission (FERC), as well as the National Oceanographic and 
Atmospheric Administration (NOAA), the U.S. Geological Survey (USGS), 
and the National Aeronautics and Space Administration (NASA).
---------------------------------------------------------------------------
    \3\ DHS, National Infrastructure Protection Plan, Partnering for 
Critical Infrastructure Security and Resilience (Washington, DC: 
December 2013). Sector-specific agencies are the Federal departments 
and agencies responsible for providing institutional knowledge and 
specialized expertise, as well as leading, facilitating, or supporting 
the security and resilience programs and associated activities of their 
designated critical infrastructure sector in the all-hazards 
environment.
---------------------------------------------------------------------------
    As noted in Presidential Policy Directive 21, the energy and 
communications sectors are uniquely critical due to the enabling 
functions they provide to other critical infrastructure sectors.\4\ The 
U.S. electric power delivery system is a highly complex network of 
substations and electric lines that transport electricity from 
generators to residential, commercial, and industrial consumers. 
Approximately 85 percent of the Nation's critical electrical 
infrastructure is owned and operated by private industry.
---------------------------------------------------------------------------
    \4\ Presidential Policy Directive-21, Critical Infrastructure 
Security and Resilience (Feb. 12, 2013) (identifying, among other 
things, the 16 critical infrastructure sectors and the sector-specific 
agencies).
---------------------------------------------------------------------------
    My statement today summarizes the findings from our March 2016 
report, and like the report, addresses: (1) The extent to which key 
Federal agencies have taken actions to address electromagnetic risks to 
the electric grid, including how these actions align with selected 
recommendations from the 2008 EMP Commission report and (2) the extent 
to which additional opportunities, if any, exist to enhance Federal 
efforts in addressing those risks to the electric grid. To conduct this 
work, we reviewed program documents, research reports, applicable risk 
assessments, and other supporting documentation related to 
electromagnetic risks and interviewed agency officials at DHS, DOE, 
DOD, FERC, and NOAA. We also interviewed officials from industry 
associations, subject-matter experts from research organizations, 
product manufacturers, and electric utility operators. More detailed 
information on our scope and methodology can be found in our March 2016 
report.\5\ We conducted the work on which this statement is based in 
accordance with generally accepted Government auditing standards.
---------------------------------------------------------------------------
    \5\ GAO-16-243.
---------------------------------------------------------------------------
federal agencies have taken various actions to address electromagnetic 
 risks; some actions align with the 2008 emp commission recommendations
    DHS, DOE, and FERC have taken various actions to address 
electromagnetic risks to the electric grid, and these actions generally 
fall into 4 categories: (1) Standards, guidelines, tools, and 
demonstration projects; (2) research reports; (3) strategy development 
and planning; and (4) training and outreach. Additionally, some of the 
actions DHS and DOE have taken generally aligned with recommendations 
made by the EMP Commission.
    Because Federal agencies generally do not own electric grid 
infrastructure, Federal actions to address GMD risks are more indirect 
through such things as developing standards and guidelines, and 
conducting research that could benefit electric grid owners and 
operators. Federal agencies have also been involved in strategy 
development and planning, as well as training and outreach efforts, as 
a means of preparing Federal officials and others to respond to both 
EMP and GMD events, and enhancing knowledge about electromagnetic 
risks. For example, DHS's Science and Technology Directorate (S&T) led 
the design and development of a prototype transformer that can be more 
easily transported to another location to help restore electric power 
in a timelier manner. DHS has also participated in various training and 
outreach events to enhance understanding of EMP and GMD events. DOE's 
primary efforts include supporting research to enhance the 
understanding of the potential impacts to the electric grid from 
electromagnetic events. More detailed information on key Federal 
agencies' actions taken since 2008 to address electromagnetic risks can 
be found in Appendix II of our March 2016 report.\6\
---------------------------------------------------------------------------
    \6\ GAO-16-243.
---------------------------------------------------------------------------
    Although DHS and DOE did not report that any of their actions were 
taken in response to the EMP Commission recommendations, some actions 
taken by both agencies have aligned with some of the recommendations. 
Specifically, of the 7 recommendations made by the EMP Commission 
related to the electric grid,\7\ some of the actions that DHS and DOE 
took aligned with 4 of them: Conducting research to better understand 
the interdependencies of critical infrastructures, addressing the 
vulnerability of control systems to an EMP attack; identifying 
responsibilities for responding to an EMP attack; and utilizing 
industry and other Governmental institutions to assure the most cost-
effective outcomes.\8\ For example, with respect to the recommendation 
on conducting research to better understand interdependencies of 
critical infrastructures, DHS's Sector Resilience Report: Electric 
Power Delivery includes some assessment of how various critical 
infrastructures--including the energy, communications, and 
transportation sectors, among others--are interdependent in maintaining 
operations. For more detailed information regarding how identified 
Federal actions align with these 7 EMP Commission recommendations, see 
Appendix III of our March 2016 report.\9\
---------------------------------------------------------------------------
    \7\ The 7 EMP Commission recommendations related to the electric 
grid include the following: (1) Conducting research to better 
understand infrastructure systems and interdependencies; (2) expanding 
activities to address the vulnerability of control systems; (3) 
identifying clear authority and responsibility to respond to an EMP 
attack; (4) engaging Federal and industry entities to determine 
liabilities and funding; (5) establishing monitoring efforts and 
defining testing standards and metrics; (6) providing capabilities to 
help protect the electric grid from an EMP attack and recover as 
rapidly and effectively as possible; and (7) utilizing industry and 
Governmental institutions to assure cost-effective outcomes.
    \8\ With regard to the last multi-part recommendation identified 
above, DHS and DOE took some actions that aligned with 5 of the 15 
subparts of this recommendation. Some of the sub-parts include such 
efforts as developing National and regional restoration plans and 
assuring the availability of critical communication channels, among 
other efforts.
    \9\ GAO-16-243.
---------------------------------------------------------------------------
 additional opportunities exist to enhance federal efforts to address 
               electromagnetic risks to the electric grid
DHS Has Not Clearly Identified Roles and Responsibilities for 
        Addressing Electromagnetic Risks
    In our March 2016 report, we found that DHS had not clearly 
identified internal roles and responsibilities for addressing 
electromagnetic risks to the electric grid or communicated these to 
external Federal and industry partners. While multiple DHS components 
and offices, including the National Protection and Programs Directorate 
(NPPD), the Federal Emergency Management Agency (FEMA), and S&T, had 
each conducted independent activities addressing electromagnetic risks 
to the electric grid, none had been tasked with lead responsibility for 
coordinating related activities within the Department or with Federal 
and industry stakeholders. As a result, during the course of our review 
for our March 2016 report, we experienced on-going challenges in 
identifying applicable DHS personnel and related Departmental actions. 
For example, NPPD officials had difficulty identifying their specific 
roles and activities addressing electromagnetic risks to the electric 
grid, including efforts to collect or synthesize available risk 
information to provide input into Department-wide risk assessments.
    Furthermore, industry representatives and other Federal officials 
told us it is not clear who within DHS is responsible for addressing 
electromagnetic risks. The 2008 EMP Commission report recommended that 
DHS make clear its authority and responsibilities, as well as delineate 
the functioning interfaces with other Governmental institutions, 
regarding EMP response efforts. We concluded that designating internal 
roles and responsibilities within DHS regarding electromagnetic risks 
and communicating these to Federal and industry partners could provide 
additional awareness of related activities and help ensure more 
effective and coordinated engagement with other Federal agencies and 
industry stakeholders, and could help reduce the risk of potential 
duplication, overlap, or fragmentation within the Department or across 
Federal agencies.
    In our March 2016 report, we recommended DHS designate roles and 
responsibilities within the Department for addressing electromagnetic 
risks and communicate these to Federal and industry partners. DHS 
concurred with our recommendation and reported that their Office of 
Policy is coordinating across the Department to identify and document 
applicable roles and responsibilities regarding electromagnetic issues 
to ensure full mission coverage while minimizing potential overlap or 
redundancy and expects to complete this effort by December 2016. These 
actions, if implemented effectively, should address the intent of our 
recommendation.
DHS and DOE Have Not Fully Addressed NIPP Requirement to Identify Key 
        Electrical Infrastructure Assets
    In our March 2016 report, we found that DHS and DOE had not taken 
actions to identify key electrical infrastructure assets as required 
given their respective critical infrastructure responsibilities under 
the NIPP. The NIPP explicitly states that to manage critical 
infrastructure risk effectively, partners must identify the assets, 
systems, and networks that are essential to their continued operation, 
considering associated dependencies and interdependencies of other 
infrastructure sectors. The 2008 EMP Commission report also recommended 
that DHS and DOE prioritize nodes that are critical for the rapid 
recovery of other key sectors that rely upon electricity to function, 
including those assets that must remain in service or be restored 
within hours of an EMP attack. Neither DHS nor DOE reported any 
specific actions taken to identify critical electrical infrastructure 
as part of risk management efforts for the energy sector, including any 
systematic review of a 2013 FERC analysis of critical substations, or 
any further collaboration to determine the key elements of criticality 
that they believe should be considered when evaluating the vast array 
of infrastructure assets constituting the U.S. electric grid. The 
extensive size and scope of the electric power system necessitates 
collaboration among partners to ensure all individual expertise is 
effectively leveraged.
    As a result, we recommended in our March 2016 report that DHS and 
DOE direct responsible officials to review FERC's electrical 
infrastructure analysis and collaborate to determine whether further 
assessment is needed to adequately identify critical electric 
infrastructure assets. DHS and DOE each concurred with our 
recommendation. DHS reported that NPPD is to collaborate with FERC to 
identify critical electrical infrastructure assets beginning with the 
evaluation of critical substations identified by FERC, and will explore 
elements of criticality that might not have been considered by FERC, in 
coordination with DOE. DOE stated that its Office of Electricity 
Delivery and Energy Reliability will review FERC's electrical 
infrastructure analysis and will work with FERC and DHS to identify any 
additional elements of criticality and determine if further assessment 
is needed. Both DHS and DOE expect to complete these efforts by March 
2017. These actions should address the intent of our recommendation.
DHS Has Not Fully Leveraged Existing Opportunities to Collect and 
        Analyze Information on Electromagnetic Risks
    We found in March 2016 that although DHS components had 
independently conducted some efforts to assess electromagnetic risks, 
the Department had not fully leveraged available risk information or 
conducted a comprehensive analysis of these risks. Within the Office of 
Policy, there is recognition that ``space weather'' and ``power grid 
failure'' are significant risk events, which DHS officials have 
determined pose great risk to the security of the Nation. However, DHS 
officials were unable to provide detailed information about the 
specific risk inputs--namely threat, vulnerability, and consequence 
information--that were used to assess how electromagnetic events 
compared to other risk events, or how these inputs were used to inform 
DHS's applicable risk-management priorities. Further, officials within 
NPPD were unable to identify any specific actions taken or plans to 
systematically collect or analyze risk information regarding 
electromagnetic impacts to the electric grid as part of Department-wide 
risk assessment efforts.
    According to the NIPP, to assess risk effectively, critical 
infrastructure partners--including owners and operators, sector 
councils, and Government agencies--need timely, reliable, and 
actionable information regarding threats, vulnerabilities, and 
consequences. Additionally, the electric grid remains vulnerable to 
other potential threats, such as physical and cyber attacks. We 
concluded that better collection of threat, vulnerability, and 
consequence information through existing DHS programs and strengthened 
collaboration with Federal partners could help DHS better assess the 
relative risk ranking of electromagnetic events versus other risks and 
help inform asset protection priorities. Moreover, according to 
subject-matter experts, the impact to the electric grid from 
electromagnetic threats may vary substantially by location, network, 
and operating characteristics, and other factors. For example, key 
reports on GMD indicate that high-voltage transformers located at 
higher latitudes in the United States are likely subject to increased 
potential for adverse impacts from GMD events than those at lower 
latitudes. Further collection of information on sector 
interdependencies could also help DHS to assess the potential economic 
consequences associated with long-term power outages and provide 
information to help assess the cost-effectiveness of various mitigation 
strategies.
    In our March 2016 report, we recommended that DHS's NPPD and Office 
of Infrastructure Protection (IP) work with other Federal and industry 
partners to collect and analyze key inputs on threat, vulnerability, 
and consequences related to electromagnetic risks. DHS concurred with 
our recommendation and reported that the Department has initiated 
efforts to assess electromagnetic risk and help determine priorities. 
For example, DHS stated the Department has a joint study with DOE under 
way that will analyze the hazard environments, impacts, and 
consequences of different sources of EMP and GMD on the electric grid 
to determine events of concern and potential means of mitigation. DHS 
expects to implement these efforts by December 2016 and if implemented 
effectively, should address the intent of our recommendation.
Federal Agencies Have Not Fully Coordinated Efforts to Implement EMP 
        Risk Management Activities
    We also found in March 2016 that key Federal agencies, including 
DHS and DOE, as well as industry partners had not established a fully 
coordinated approach to identifying and implementing risk management 
activities to address EMP risks. According to the NIPP Risk Management 
Framework, such activities include identifying and prioritizing 
research and development efforts, and evaluating potential mitigation 
options, including the cost-effectiveness of specific protective 
equipment. The publication of the National Space Weather Action Plan in 
October 2015 identified many key Federal activities in these areas 
regarding the GMD risk; however, no similar efforts had been proposed 
regarding EMP risks to the electric grid.\10\
---------------------------------------------------------------------------
    \10\ White House, National Space Weather Action Plan (Washington, 
DC: October 2015). Among other actions, the National Space Weather 
Action Plan lays out responsibilities for Federal entities to establish 
benchmarks for space weather events, which are intended to serve as 
inputs into such activities as developing vulnerability assessments, 
creating engineering standards, and developing more effective 
mitigation practices and procedures.
---------------------------------------------------------------------------
    DHS officials stated an EMP attack generally remains a lower-risk 
priority compared to other risk events with higher probability such as 
natural disasters or cyber attacks. DOE officials also noted resource 
limitations and competing priorities as the key driver for not pursuing 
additional risk management activities specifically related to EMP 
events. However, we found that even if an EMP attack is not determined 
to be among the highest-resource priorities for DHS and DOE relative to 
other risk events, there are opportunities for enhanced collaboration 
among Federal agencies and industry stakeholders to address identified 
gaps and help ensure that limited resources are more effectively 
coordinated and prioritized. For example, recent reports issued by DOE 
and a leading research organization for the electric industry 
identified gaps in the information available regarding likely EMP 
impacts to modern grid technologies and electronic control systems. 
They noted that such information remains important for developing 
applicable protective guidelines and equipment design specifications.
    In our March 2016 report, we recommended that DHS and DOE engage 
with Federal partners and industry stakeholders to identify and 
implement key EMP research and development priorities, including 
opportunities for further testing and evaluation of potential EMP 
protection and mitigation options. DHS and DOE concurred with our 
recommendation and each identified actions to convene applicable 
stakeholders to jointly determine mitigation options and conduct 
further testing and evaluation. DHS stated S&T will work with DOE and 
the Electricity Subsector Coordinating Council to develop a joint 
Government and industry approach to identify options for mitigating the 
consequences of an EMP event. DHS expects to implement this effort by 
September 2016. In addition, DOE stated it is working with the Electric 
Power Research Institute to develop an EMP Strategy that is scheduled 
for completion by August 31, 2016, and the strategy is to be followed 
by a more detailed action plan identifying research and development 
priorities and specific opportunities to test and evaluate EMP 
mitigation and protection measures. If implemented effectively, DHS and 
DOE's actions should address the intent of our recommendation.
    We will continue to monitor DHS and DOE actions taken to address 
our March 2016 recommendations and have also recently initiated two 
additional reviews. One is evaluating the electromagnetic event 
preparedness of U.S. electricity providers and the other is a technical 
assessment of protective equipment designed to mitigate the potential 
impacts of a GMD on electrical infrastructure. We expect these projects 
to be completed by mid-2017.
    Chairman Perry, Ranking Member Watson Coleman, and Members of the 
subcommittee, this completes my prepared statement. I would be pleased 
to respond to any questions that you may have at this time.

    Mr. Perry. Thank you, Mr. Currie.
    The Chair recognizes Mr. Wales for his opening statement.

   STATEMENT OF BRANDON WALES, DIRECTOR, OFFICE OF CYBER AND 
   INFRASTRUCTURE ANALYSIS, NATIONAL PROTECTION AND PROGRAMS 
       DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Wales. Thank you, Chairman Perry, Ranking Member Watson 
Coleman, and distinguished Members of the committee. It is my 
pleasure to be here to discuss the threat posed by 
electromagnetic pulse events, or EMP, to our Nation and our 
critical infrastructure.
    Over the past several decades, the risk to digital and 
physical infrastructures has grown. Today's power grid and 
information networks may be more vulnerable to EMP than those 
from a few decades ago as the grid transitions from an analog 
to a digital system.
    My testimony today will focus on the Department of Homeland 
Security's efforts to prepare for, respond to, and recover from 
a potential EMP attack, as well as touch on the joint DHS-
Department of Energy effort to review the EMP science and 
provide a peer-reviewed estimate of potential risks.
    As you know, an EMP is the burst of electromagnetic 
radiation created when a nuclear weapon is detonated or when a 
non-nuclear EMP weapon is used. EMPs can be high-frequency, 
similar to a flash of lightning, or low-frequency, similar to 
an aurora-induced phenomenon.
    The consequences of an EMP can range from permanent 
physical damage to temporary system disruptions and can result 
in fires, electric shocks to people and equipment, and critical 
service outages. EMP in some of its forms can cause wide-spread 
disruption and serious damage to electronic devices and 
networks, including those upon which many critical 
infrastructures rely.
    All critical infrastructure sectors are at risk from EMP, 
particularly those sectors that rely heavily on the electric 
grid and communications and information technology, such as 
industrial control systems. The complex interconnectivity among 
critical infrastructure sectors means that EMP incidents will 
likely create cascading failures across sectors.
    We recognize that the Federal Government plays an important 
role supporting the critical infrastructure community manage 
risks from low-probability, high-consequence events, such as 
EMPs and severe geomagnetic disturbances. DHS and its 
interagency partners are using our unique resources, built over 
the past decade, to address the scale and degree of uncertainty 
associated with EMP risk.
    DHS has been working on the topic of EMP for a number of 
years, and we will continue working collaboratively both 
internally and with external stakeholders in various arenas to 
address the recommendations issued by the Government 
Accountability Office on this issue.
    The Office of Cyber and Infrastructure Analysis within 
DHS's National Protection and Programs Directorate has 
partnered with the Department of Energy's Office of Electricity 
Delivery and Energy Reliability to assess the impacts of EMP 
and geomagnetic disturbance events on electric power assets.
    This study, facilitated through DHS's National 
Infrastructure Simulation and Analysis Center and DOE's 
National Laboratories, is intended to develop scientifically 
rigorous, peer-reviewed methods for assessing electric power 
asset impacts from EMP events. This study will include 
participation from the intelligence community, the broader 
interagency, the academic community, and the private sector 
when possible. We expect to complete this study in mid-2017.
    Our work also benefits from the activities of DHS's 
National Cybersecurity and Communications Integration Center, 
or NCCIC. The NCCIC is an essential conduit within DHS to share 
information between the interagency community and the private 
sector on risks to the communication and control elements of 
our infrastructure systems and has conducted past studies on 
EMP risks to communications infrastructure.
    In addition, the Office of Infrastructure Protection has a 
long history of working with the private sector to enhance 
electric grid security and resilience. This office conducts and 
facilitates vulnerability and resilience assessments to help 
critical infrastructure owners and operators and State, local, 
Tribal, and territorial partners understand and address risks 
to their critical infrastructure.
    I would also like to recognize my colleagues' activities at 
the Science and Technology Directorate and the Federal 
Emergency Management Agency.
    The Science and Technology Directorate has a mission to 
deliver effective and innovative insight, methods, and 
solutions for the critical needs of the homeland security 
enterprise. Past research efforts on electric grid resilience 
have resulted in successes, such as the recovery transformer 
project, which is available to be deployed by the private 
sector today for risk reduction against a variety of hazards.
    Finally, the Federal Emergency Management Agency leads 
Federal efforts to respond to and recover from impacts of a 
wide-spread disruption in the power grid regardless of cause. 
Through the development of the Power Outage Incident Annex, a 
collaboration of the Federal Government and the private sector, 
FEMA is enhancing the existing response and recovery Federal 
interagency operational plans.
    The Department of Homeland Security has since its inception 
pursued a deeper understanding of the EMP threat as well as its 
potential impacts and effective mitigation strategies. These 
efforts have been undertaken in cooperation with other Federal 
agencies and the private sector, and we are committed to 
continuing to expand our focus on this issue as warranted by 
the risk environment.
    The Department takes seriously the recent review and 
recommendations of the Government Accountability Office on 
Federal efforts to address EMP risk and welcomes further 
cooperation with other Government agencies to ensure we are 
appropriately responsive on this critical topic.
    I want to thank the committee for the invitation to speak 
here today and for your on-going support for our work in this 
area. Thank you.
    [The prepared statement of Mr. Wales follows:]
                  Prepared Statement of Brandon Wales
                              May 17, 2016
    Thank you, Chairman Perry, Ranking Member Coleman, and 
distinguished Members of the committee. It is my pleasure to be here to 
discuss the threat posed by electromagnetic pulse events (EMP) to our 
Nation and its critical infrastructure, including its cyber, 
communications, and electric-grid assets.
    Over the past several decades, the risk to digital and physical 
infrastructures has grown. For example, today's power grid and 
information networks may be more vulnerable to EMP than those of a few 
decades ago, as the grid transitions from an analog system to a digital 
system to improve efficiency. My testimony today will focus on the 
Department of Homeland Security's (DHS) preparations to respond to and 
assist recovery from a potential EMP attack, as well as touch on the 
joint DHS/Department of Energy (DOE) effort to review the EMP science 
and provide a peer-reviewed estimate of the potential risks.
    The Federal Government plays an important role supporting the 
critical infrastructure community to manage risks from low-probability, 
high-consequence events, such as EMPs and severe geomagnetic 
disturbances (GMDs). DHS and its interagency partners will be using our 
unique resources built over the past decade to address the scale and 
degree of uncertainty associated with risks such as the ones I am here 
to discuss today.
    The Department takes seriously the recent review and 
recommendations of the Government Accountability Office (GAO) on 
Federal efforts to address EMP risk, as well as the recommendations 
issued by the 2008 EMP Commission, and welcomes further cooperation 
with other Government agencies to ensure we are appropriately 
responsive on this critical topic.
                           background on emp
    An EMP is the burst of electromagnetic radiation created, for 
instance, when a nuclear weapon is detonated or when a non-nuclear EMP 
weapon is used. EMPs can be high-frequency, similar to a flash of 
lightning, or low-frequency, similar to an aurora-induced phenomenon. 
The consequences of an EMP can range from permanent physical damage to 
temporary system disruptions, and can result in fires, electric shocks 
to people and equipment, and critical service outages.
    There are two general classes of EMP of concern: (1) Nuclear 
sources of EMP, such as High-altitude EMP (HEMP), and (2) Non-Nuclear 
sources of EMP (NNEP). HEMP results from a nuclear detonation typically 
occurring 15 or more miles above the Earth's surface. The extent of 
HEMP effects depends on several factors including the altitude of the 
detonation, the weapon yield, and whether it was designed for EMP 
effects. On the ground, effects may be diminished by the 
electromagnetic shielding, or ``hardening,'' of assets. A high altitude 
burst could blanket the entire continental United States and could 
cause wide-spread impacts to multiple sectors, including to lifeline 
sectors such as the energy and communications. HEMP threat vectors can 
originate from a missile, such as a sea-launched ballistic missile; a 
satellite asset; or a relatively low-cost balloon-borne vehicle.
    Non-Nuclear EMP (NNEP) can be created by sources such as Radio 
Frequency Weapons or Intentional Electromagnetic Interference devices, 
which are designed to produce sufficient electromagnetic energy to burn 
out or disrupt electronic components, systems, and networks. NNEP 
devices can be either electrically-driven, where they create narrowband 
or wideband microwaves, or explosively-driven, where an explosive is 
used to compress a magnetic field to generate the pulse. The range of 
an NNEP is fairly short (typically less than 1 kilometer) and faraday 
casings with line filters and surge arresters can mitigate much of the 
EMP effects.
              potential impacts on critical infrastructure
    In some of its forms, EMP can cause wide-spread disruption and 
serious damage to electronic devices and networks, including those upon 
which many critical infrastructures rely. There is uncertainty over the 
magnitude and duration of an electric power outage that may result from 
an EMP event due to ambiguity regarding the actual damage to electric 
power assets from an event. Any electric power outage resulting from an 
EMP event would ultimately depend upon a number of unknown factors and 
effects to assets that are challenging to accurately model, making it 
difficult to provide high-specificity information to electric system 
planners and system operators. These variables include characteristics 
such as the EMP device type, the location of the blast, the height of 
the blast, the yield of the blast, and design and operating parameters 
of the electric power system subject to the blast. Secondary effects of 
EMP may harm people through induced fires, electric shocks, and 
disruptions of transportation and critical support systems, such as 
those at hospitals or sites like nuclear power plants and chemical 
facilities.
    All critical infrastructure sectors are at risk from EMP, 
particularly those sectors that rely heavily on communications and 
sensor (e.g., radar) technology, information technology, the electric 
grid, or that use a Supervisory Control and Data Acquisition system. 
The complex interconnectivity among critical infrastructure sectors 
means that EMP incidents that affect a single sector are likely affect 
other sectors--potentially resulting in additional failures.
               dhs efforts to address gao recommendations
    DHS is working collaboratively, both internally and with external 
stakeholders, in various arenas to address the recommendations issued 
by GAO on this topic. DHS has been working on the topic of EMP for a 
number of years, and we will continue working on it in the future. An 
example of our previous work on the topic of EMP includes a 2010 study 
on ``Electromagnetic Pulse (EMP) Impacts on Extra High Voltage Power 
Transformers'' conducted by the National Infrastructure Simulation and 
Analysis Center for DHS.
    As part of DHS's continuing commitment to this issue, there are 
resources across the Homeland Security enterprise engaged on this 
topic, including within the Federal Emergency Management Agency (FEMA), 
the National Protection and Programs Directorate (NPPD), and the 
Science and Technology Directorate (S&T). The scope of activity, as 
reviewed by GAO, falls into 3 areas of activity: (1) Risk assessment 
and analysis, (2) communication and coordination of threat information, 
and (3) research and development to mitigate EMP risks.
    NPPD's involvement on EMP issues resides in a number of functional 
components including the Office of Cyber and Infrastructure Analysis 
(OCIA), the Office of Infrastructure Protection (IP), and the Office of 
Cybersecurity and Communications (CS&C). OCIA has partnered directly 
with the DOE's Office of Electricity Delivery and Energy Reliability to 
assess the impacts of EMP and Geomagnetic disturbance events on 
electric power assets. This study, facilitated through DHS's National 
Infrastructure Simulation and Analysis Center and DOE's National 
Laboratories, is intended to develop scientifically rigorous, peer-
reviewed methods for assessing electric power asset impacts to EMP 
events. This study will include participation of the intelligence 
community, the broader interagency, the academic community, and the 
private sector, when possible.
    The EMP study by OCIA will leverage newly-started private-sector 
activities that are occurring through the Electric Power Research 
Institute, as well as previous government investments in research which 
have been sponsored by DHS and DOE. The estimated completion date of 
this risk analysis-based study of the electric power sector is 
approximately mid-2017.
    IP and OCIA continue to work collaboratively with the Department of 
Energy and the Federal Energy Regulatory Commission (FERC). As the GAO 
report indicates, collaboration can and should be increased with an 
emphasis on identification of critical infrastructure assets of the 
electric power sector. Once identified, this list of assets can be used 
to guide protection and preparedness activities at DHS and to help 
prioritize response and recovery actions by DOE and DHS after a large-
scale event. DHS is also increasing our collaboration with DOE and FERC 
in the near term, including additional collaboration between staff-
level subject-matter experts.
    CS&C, which oversees the National Cybersecurity and Communications 
Integration Center (NCCIC), has been assessing the potential risks to 
the communications and control elements of the electric grid from EMP, 
as well as radio frequency weapons, solar weather, and cyber threats 
for several years. As part of these efforts, the NCCIC developed the 
``EMP Protection Guidelines for Equipment, Facilities and Data 
Centers'' report and provided related briefings to the Continuity of 
Government community and to the Communications Sector, as well as other 
programs and sectors, to inform the community and help mitigate EMP and 
radio frequency weapons threats. The previously-mentioned joint study 
by OCIA and DOE's Office of Electricity Delivery and Energy will seek 
to learn and build upon the knowledge and expertise gained from the 
NCCIC's previous studies on this topic.
    FEMA continues to leverage the National Preparedness System to 
build, sustain, and deliver the capabilities needed to prevent, protect 
against, mitigate, respond to, and recover from the threats and hazards 
that pose the greatest risk, including risks to the energy sector. The 
tools and processes within the National Preparedness System include, 
but are not limited to, plans, training, and exercises for managing a 
variety of risks to the Nation's infrastructure, including EMP and 
cyber vulnerabilities.
    FEMA is also actively developing their Power Outage Incident Annex 
to enhance the Response and Recovery Federal Interagency Operational 
Plans. The Annex, developed in partnership with the Federal interagency 
community and the private sector, will describe the process and 
organizational constructs through which the Federal Government will 
respond to and recover from the impacts of a wide-spread disruption in 
the power grid from any cause.
    Lastly, S&T develops near-term solutions to bridge capability gaps, 
and S&T has invested in multiple research programs for increasing the 
electric grid's resilience against solar weather hazards. Previous 
research investments, such as the Recovery Transformer (RecX) project, 
are available for private-sector risk reduction on EMP and are 
available to be deployed by private-sector owners and operators today.
                               conclusion
    DHS, for many years, has pursued a deeper understanding of the EMP 
threat, as well as its potential impacts, effective mitigation 
strategies, and a greater level of public awareness and readiness. 
These efforts have been undertaken in cooperation with other Federal 
agencies and private-sector owners and operators; and we are committed 
to continuing to expand our focus on this issue, as warranted by the 
risk environment.
    I want to thank the committee for the invitation to speak here 
today and for your on-going support for our work in this area. I 
welcome your questions.

    Mr. Perry. Thank you, Mr. Wales.
    The Chair now recognizes Mr. McClelland.

  STATEMENT OF JOSEPH MC CLELLAND, DIRECTOR, OFFICE OF ENERGY 
INFRASTRUCTURE SECURITY, FEDERAL ENERGY REGULATORY COMMISSION, 
                   U.S. DEPARTMENT OF ENERGY

    Mr. McClelland. Chairman Perry, Ranking Member Watson 
Coleman, and distinguished Members of the subcommittee, thank 
you for the privilege to appear before you today to discuss 
electromagnetic threats to the electric grid in the United 
States.
    My name is Joe McClelland, and I am the director of the 
Office of Energy Infrastructure Security at the Federal Energy 
Regulatory Commission, or FERC. I am here today as a FERC staff 
witness, and my remarks do not necessarily represent the views 
of FERC or any individual commissioner.
    Under section 215 of the Federal Power Act, FERC is 
entrusted with the responsibility to approve and enforce 
mandatory reliability standards for the Nation's bulk power 
system. These standards are developed and proposed by the North 
American Electric Reliability Corporation, or NERC.
    Section 215 of the Federal Power Act provides a statutory 
foundation to develop reliability standards for the bulk power 
system. However, the nature of a National security threat by 
entities intent on attacking the United States by exploiting 
vulnerabilities in the electric grid using physical or cyber 
means stands in stark contrast to the other major reliability 
events that have caused regional blackouts and reliability 
failures in the past. Wide-spread disruption of electric 
service can quickly undermine the United States Government, its 
military, and the economy, as well as endanger the health and 
safety of its citizens.
    Congress took steps to address such a situation late last 
year. In the Fixing America's Surface Transportation Act, or 
FAST Act, Congress assigned notable new authority to the 
Department of Energy, or DOE, and FERC, among other Federal 
agencies.
    Consistent with these requirements, FERC established our 
office, the Office of Energy Infrastructure Security, in late 
2012 to provide a more agile and focused approach to growing 
cyber and physical security threats. Our office works 
collaboratively with industry to share information, including 
best practices, to help address threats from geomagnetic 
disturbances, GMD, or electromagnetic pulses, EMP.
    Just briefly, in 2001 Congress established a commission to 
assess and report on the threat from EMP. In 2004 and again in 
2008, the Commission issued reports on these threats.
    One of the key findings in the reports was that a single 
EMP attack could seriously degrade or shut down a large part of 
the electric power grid. Depending upon the attack, significant 
parts of the electric infrastructure could be, ``out of service 
for periods measured in months to a year or more.''
    In order to better understand and quantify the effect of 
EMP and GMD on the power grid, FERC, DOE, and the Department of 
Homeland Security sponsored a study conducted by the Oak Ridge 
National Laboratory in 2010. The results of the study support 
the general conclusion of prior studies that EMP and GMD events 
pose substantial risk to equipment and operation of the 
Nation's electric grid and, under extreme conditions, could 
result in major, long-term electrical outages.
    Unlike EMP attacks that are dependent upon the capability 
and intent of an attacker, GMD disturbances are inevitable, 
with only the timing and magnitude subject to variability. The 
Oak Ridge study assessed a solar storm that occurred in May 
1921 which has been termed a 1-in-100-year event and applied it 
to today's electric grid. The study concluded that such a storm 
could damage or destroy over 300 bulk power system 
transformers, interrupting service to 130 million people, with 
some outages lasting for a period of years.
    To help address GMD and EMP threats, FERC has applied both 
regulatory and collaborative actions. With respect to 
regulatory actions, FERC has taken steps such as directing NERC 
to propose two reliability standards on GMD requiring new 
operational procedures and vulnerability assessments.
    With respect to collaborative actions, FERC works closely 
with Federal agencies, State agencies, and industry members in 
many ways. In general, such collaboration has included efforts 
to identify key energy facilities, conduct physical and cyber 
threat briefings and reviews to industry, including sessions on 
GMD and EMP, to assist with best practices for mitigation.
    Examples of such collaborative action includes FERC's 
participation on the SWORM--Space Weather Operations, Research, 
and Mitigation--Task Force created in late 2014 by the National 
Science and Technology Council.
    In addition, as required by the FAST Act, DOE, in 
consultation with FERC and others, is developing a plan to 
establish a strategic transformer reserve. Specific to the 
subject of today's hearing, the strategic transformer reserve 
plan will identify ways to decrease vulnerabilities from 
physical and cyber threats, including both EMP and GMD.
    Thank you again for the opportunity to testify today, and I 
would be happy to answer any questions you may have.
    [The prepared statement of Mr. McClelland follows:]
                Prepared Statement of Joseph McClelland
                              May 17, 2016
    Chairman Perry, Ranking Member Watson Coleman and Members of the 
subcommittee: Thank you for the privilege to appear before you today to 
discuss electromagnetic threats to the electric grid in the United 
States. My name is Joe McClelland and I am the director of the Federal 
Energy Regulatory Commission's Office of Energy Infrastructure Security 
(OEIS). I am here today as a Commission staff witness, and my remarks 
do not necessarily represent the views of the Commission or any 
individual Commissioner.
    In the Energy Policy Act of 2005, Congress entrusted the Commission 
with a major new responsibility to approve and enforce mandatory 
reliability standards for the Nation's bulk power system. This 
authority is in section 215 of the Federal Power Act. It is important 
to note that FERC's jurisdiction and reliability authority under 
section 215 is limited to the ``bulk power system,'' as defined in the 
FPA, which excludes Alaska and Hawaii, as well as local distribution 
systems. Under the section 215 authority, FERC cannot author or modify 
reliability standards, but must depend upon an Electric Reliability 
Organization (ERO) to perform this task. The Commission certified the 
North American Electric Reliability Corporation (NERC) as the ERO. The 
ERO develops and proposes for the Commission's review reliability 
standards or modifications, which the Commission can either approve or 
remand. If the Commission approves a proposed reliability standard, it 
becomes mandatory in the United States and is applicable to the users, 
owners, and operators of the bulk power system. If the Commission 
remands a proposed standard, it is sent back to the ERO for further 
consideration. The Commission is required to give ``due weight'' to the 
technical expertise of the ERO when reviewing any of NERC's proposed 
standards.
    Section 215 of the Federal Power Act provides a statutory 
foundation for the ERO to develop reliability standards for the bulk 
power system. However, the nature of a National security threat by 
entities intent on attacking the United States by exploiting 
vulnerabilities in its electric grid using physical or cyber means 
stands in stark contrast to other major reliability events that have 
caused regional blackouts and reliability failures in the past, such as 
events caused by tree-trimming practices. Wide-spread disruption of 
electric service can quickly undermine the U.S. Government, its 
military, and the economy, as well as endanger the health and safety of 
millions of citizens.
    I note that Congress took steps to address such a situation late 
last year, including in the Fixing America's Surface Transportation Act 
(FAST Act) a section entitled, ``Critical Electric Infrastructure 
Security.'' That section assigned notable new authority to the 
Department of Energy (DOE) and the Commission, among other Federal 
agencies. Under this new authority, DOE can declare a grid security 
emergency and order actions to address it. As I will discuss further 
below, DOE is also to consult with the Commission regarding development 
of a Strategic Transformer Reserve Plan to reduce the threats from 
physical, cyber, EMP, GMD, severe weather, and seismic events. The 
Commission, in consultation with DOE, is to develop regulations 
governing the designation, protection, and appropriate sharing of 
Critical Electric Infrastructure Information. In addition, under the 
Cybersecurity Act of 2015 also enacted late last year, Congress 
directed the Federal Government to share and receive cybersecurity 
threat and mitigation information, while restricting its regulatory 
use, with non-Federal entities including State governments and 
industry.
    Consistent with these requirements, the Commission established OEIS 
in late 2012 to provide a more agile and focused approach to growing 
cyber and physical security threats. The mission of OEIS is to provide 
expertise and assistance to the Commission, other Federal and State 
agencies and jurisdictional entities in identifying, communicating, and 
seeking comprehensive solutions to significant potential cyber and 
physical security risks to the energy infrastructure under the 
Commission's jurisdiction. This includes threats from geomagnetic 
disturbances (GMDs) and electromagnetic pulses (EMPs).
    Specific to the subject of this hearing, GMD and EMP events are 
generated from either naturally-occurring or man-made causes. In the 
case of GMDs, naturally occurring solar magnetic disturbances 
periodically disrupt the earth's magnetic field which, in turn, can 
induce currents on the electric grid that may simultaneously damage or 
destroy key transformers over a large geographic area. Regarding man-
made events, EMPs can be generated by devices that range from small, 
portable, easily concealed battery-powered units all the way through 
missiles equipped with nuclear warheads. In the case of the former, 
equipment is readily available that can generate localized high-energy 
bursts designed to disrupt, damage, or destroy electronics such as 
those found in control systems on the electric grid. The EMP generated 
during the detonation of a nuclear device is far more encompassing and 
generates 3 distinct effects, each impacting different types of 
equipment; a short high-energy RF-type burst called E1 that destroys 
electronics; a slightly longer burst that is similar to lightning 
termed E2; and a final effect termed E3 that is similar in character 
and effect to GMD targeting the same equipment including key 
transformers. Any of these effects can cause voltage problems and 
instability on the electric grid, which can lead to wide-area 
blackouts.
    In 2001, Congress established a commission to assess and report on 
the threat from EMP. In 2004 and again in 2008, that commission issued 
reports on these threats. One of the key findings in the reports was 
that a single EMP attack could seriously degrade or shut down a large 
part of the electric power grid. Depending upon the attack, significant 
parts of the electric infrastructure could be ``out of service for 
periods measured in months to a year or more.'' It is important to note 
that effective mitigation against solar geomagnetic disturbances and 
non-nuclear EMP weaponry can also provide an effective mitigation 
against the impacts of a high-altitude nuclear detonation.
    In order to better understand and quantify the effect of EMP and 
GMD on the power grid, the Commission, DOE, and the Department of 
Homeland Security (DHS) sponsored a study conducted by the Oak Ridge 
National Laboratory in 2010. The results of the study support the 
general conclusion of prior studies that EMP and GMD events pose 
substantial risk to equipment and operation of the Nation's electric 
grid and under extreme conditions could result in major long-term 
electrical outages. Unlike EMP attacks that are dependent upon the 
capability and intent of an attacker, GMD disturbances are inevitable 
with only the timing and magnitude subject to variability. The Oak 
Ridge study assessed a solar storm that occurred in May 1921, which has 
been termed a 1-in-100-year event, and applied it to today's electric 
grid. The study concluded that such a storm could damage or destroy 
over 300 bulk power system transformers interrupting service to 130 
million people with some outages lasting for a period of years.
    To date, a few U.S. entities have taken some initial steps to 
address EMP on their systems, but much work remains. Internationally, 
the United Kingdom, Norway, Sweden, Finland, Germany, South Korea, 
Japan, Australia, New Zealand, South Africa, Israel, and Saudi Arabia 
have GMD and/or EMP programs in place or are in the early stages of 
addressing or examining the impacts of GMD or EMP. The costs of these 
initiatives can vary widely depending on factors such as the threshold 
of protection, the service requirements of the load, the type of 
equipment that is to be protected, and whether the installation is new 
or a retrofit.
    With these issues and challenges in mind, the Commission has used a 
two-fold approach to help address the GMD and EMP threats, applying 
both regulatory and collaborative actions.
    First, with respect to regulatory actions, the Commission has 
directed NERC to propose 2 reliability standards on GMD. The Commission 
approved the first of NERC's proposals, a mandatory reliability 
standard that requires certain entities to implement operational 
procedures to mitigate the effects of GMD events. The Commission also 
has issued an order proposing to approve the second of NERC's 
proposals, a reliability standard that would establish requirements for 
certain entities to conduct initial and on-going assessments of the 
vulnerability of their transmission systems against a benchmark 
geomagnetic disturbance. The Commission has received comments on its 
proposed order and held a related technical conference in March. The 
Commission is currently reviewing this record to determine how to move 
forward.
    The Commission's regulatory authority with respect to rates also 
may be relevant to addressing these issues. For example, the Commission 
has issued 2 orders to provide clarity on how it will address services 
provided by Grid Assurance, a company recently created by several 
electric utilities and energy companies. Grid Assurance is intended to 
enhance grid resilience and protect customers from prolonged outages by 
providing electric utilities that subscribe to Grid Assurance with 
timely access to an inventory of emergency spare transmission 
equipment, including transformers, that otherwise can take months or 
longer to acquire.
    Second, with respect to collaborative actions, the Commission works 
closely with Federal agencies, State agencies, and industry members in 
many ways. In general, such collaboration has included efforts to 
identify key energy facilities; conduct physical and cyber threat 
briefings, including on GMD and EMP, to industry members; assist with 
the identification of best practices for mitigation; and cooperate with 
international partners to convey threat and mitigation information as 
well as encourage adoption of best practices for mitigation.
    Some of the Commission's collaborative actions are relevant to GMD 
and EMP threats. For example, in November 2014, the National Science 
and Technology Council (NSTC) created the Space Weather Operations, 
Research, and Mitigation (SWORM) Task Force to develop high-level 
strategic goals for enhancing National preparedness for a severe space 
weather event. This Task Force is co-chaired by members from the Office 
of Science and Technology Policy, DHS, and the National Oceanic and 
Atmospheric Administration. The Commission has participated in the 
SWORM Task Force's efforts from its inception.
    In addition, as required by the FAST Act, DOE, in consultation with 
the Commission and others, is developing a plan to establish a 
Strategic Transformer Reserve. The Strategic Transformer Reserve Plan 
is to identify the sufficient number, type, cost, and location of 
equipment needed to temporarily replace critically-damaged large power 
transformers and substations that are part of the critical electric 
infrastructure or that serve defense and military installations. 
Specific to the subject of today's hearing, the Strategic Transformer 
Reserve Plan will decrease vulnerabilities related to physical and 
cyber threats, including both EMP and GMD. The Strategic Transformer 
Reserve Plan is not limited to transformers, but is also to include 
other critical electric grid equipment as necessary to provide or 
restore sufficient resiliency.
    The Commission's efforts to date are consistent with the 
recommendations of the Government Accountability Office's recently-
released report on electromagnetic risks to the electric grid. I 
believe that building on previous collaboration among the Commission 
and other Federal agencies can enhance our collective response in 
addressing electromagnetic threats to the electric grid in the United 
States.
    Thank you again for the opportunity to testify today. I would be 
happy to answer any questions you may have.

    Mr. Perry. Thank you, Mr. McClelland.
    The Chair now recognizes Mr. Freed for his statement.

 STATEMENT OF JUDSON M. FREED, DIRECTOR, EMERGENCY MANAGEMENT 
 AND HOMELAND SECURITY, RAMSEY COUNTY, MINNESOTA, ON BEHALF OF 
              THE NATIONAL ASSOCIATION OF COUNTIES

    Mr. Freed. Thank you, Chairman Perry, Ranking Member Watson 
Coleman, and Members of the subcommittee, for this opportunity 
to testify today on Federal efforts addressing electromagnetic 
risks.
    My name is Judson Freed, and I serve as director of 
emergency management and homeland security in Ramsey County, 
Minnesota. I also serve the justice and public safety committee 
of the National Association of Counties, which represents all 
of America's 3,069 counties, parishes, and boroughs.
    As a large urban county located in the northern Midwest, 
Ramsey County faces perennial threats ranging from tornadoes 
and ice storms to train derailments and multi-location 
terrorist attacks. In my role as the county's emergency 
management director and homeland security director, I work to 
protect our local communities and their residents and their 
structures from the on-going threats posed by these and other 
disasters.
    Although all parts of government play a role in disasters, 
counties across the Nation often serve as the first line of 
defense before and after disaster strikes, and we are 
responsible for helping our communities recover in the 
aftermath. Any potential failing of our Nation's power grid and 
the cascading impacts that would follow would heavily impact 
local governments and require an immediate on-the-ground 
response by county emergency managers and a range of other 
local officials.
    With that said, Mr. Chairman, I respectfully submit 3 
principles for your consideration as you assess Federal efforts 
to mitigate against electromagnetic risks.
    First, the impact of Federal policy changes on local 
government should be closely considered, particularly when it 
comes to matters of emergency management. Local governments 
respond to the Federal Government's actions not just in our 
role as intergovernmental partners with Federal agencies but 
also because our constituents demand that their local leaders 
keep pace with the Federal Government's priorities and 
initiatives.
    Federal policy changes related to electromagnetic risks 
would impact local emergency management efforts. Consider the 
Critical Infrastructure Protection Act. The bill would require 
in part that the DHS Secretary conduct outreach to educate 
emergency response providers at all levels of government of the 
threat of electromagnetic pulse events. Requirements like this 
can accumulate quickly and have the potential to disrupt the 
on-going process of local emergency management planning and 
coordination.
    Second, electromagnetic risks should be viewed in the 
context of the whole wide variety of threats faced by our 
Nation and its local communities. Due to changes in things like 
weather patterns and population growth, especially in densely-
populated areas like Ramsey County, our Nation is facing an 
arguably unprecedented number of threats and disasters. 
According to NACo's analysis of data made available by FEMA, 92 
percent of counties across the Nation have had at least 1 
Presidential disaster declaration in the last 10 years.
    Further, due to globalization and advances in technology 
that have made us more interconnected than ever before, 
communities across the country also face novel cybersecurity 
threats from within and outside of the United States. We urge 
you to consider electromagnetic threats in the context of the 
full range of risks faced by our communities.
    Last, emergency management resources, both fiscal and 
administrative, are finite at all levels of government and 
should be allocated based on holistic and pragmatic risk 
assessment. Diverting limited resources from highly probable 
threats will make our Nation less prepared for the risks and 
disasters that have proven to be perennial visitors to all of 
our communities.
    In Ramsey County, we have worked hard to ensure that our 
emergency management decisions and policies are based on 
pragmatic and scientific risk assessment that takes into 
consideration both the potential consequences and the 
likelihood of various threats. This method of emergency 
management risk assessment is one that was promoted in the 2014 
Homeland Security QHSR and is widely accepted as a local best 
practice in counties Nation-wide.
    That said, we are by no means inattentive to the threats 
posed to our power grids. In my county, for example, we monitor 
space weather and provide weekly reports to our local public 
safety partners and leadership. We monitor the status of our 
region's power grid and include our utility providers in our 
oversight and planning workgroups.
    We assess transmission line protection in light of severe 
weather and flooding, as well as geomagnetic incidents, and 
large-scale power failures would present significant and 
cascading challenges to our emergency response systems. We 
consider these risks in our disaster response and coordination 
efforts, and we base them on our broader risk assessment 
strategies and work to mitigate these risks at every 
opportunity.
    In closing, I would like to thank you again for the 
opportunity to provide the local perspective in this important 
conversation on Federal efforts to address electromagnetic 
risks, and I will welcome any questions you may have.
    [The prepared statement of Mr. Freed follows:]
                 Prepared Statement of Judson M. Freed
                              May 17, 2016
    Thank you Chairman Perry, Ranking Member Watson Coleman, and 
Members of the Subcommittee on Oversight and Management Efficiency for 
this opportunity to testify.
    My name is Judson Freed and I have served as director of emergency 
management and homeland security in Ramsey County, Minnesota since 
2003. I am also vice chair of the Emergency Management Subcommittee of 
the National Association of Counties' Justice and Public Safety Policy 
Steering Committee.
                               about naco
    NACo is the only national organization that represents county 
governments in the United States, including Alaska's boroughs and 
Louisiana's parishes. Founded in 1935, NACo assists America's 3,069 
counties in pursuing excellence in public service to produce healthy, 
vibrant, safe, and resilient communities.
                        about america's counties
    Counties are highly diverse, not only in my State of Minnesota, but 
across the Nation, and vary immensely in natural resources, social and 
political systems, cultural, economic and structural circumstances, and 
public health and environmental responsibilities. If you've seen 1 
county, you've seen 1 county, and there are 3,068 more to go.
    Counties also often serve as our Nation's first line of defense 
before and after disasters strike. While State statutes and 
organizational structures vary, local emergency management 
responsibilities are most commonly vested in county governments. Many 
counties, including Ramsey County, are required to maintain an 
emergency management agency to coordinate all activities related to 
emergency and disaster situations. These responsibilities go well 
beyond the functions of public safety and emergency services and 
involve a community-wide effort before, during, and after a disaster or 
emergency incident occurs. Emergency managers are charged with 
preparing their communities for disasters so that when these events 
inevitably take place, their toll on our residents, homes, and public 
and private structures is minimized. Following a disaster, local 
emergency managers, on behalf of their elected officials, work to 
mitigate damage and save lives. In the aftermath of disasters, we 
coordinate and help fund clean-up, recovery, and rebuilding so that our 
residents can return to their lives as quickly as possible.
                     about ramsey county, minnesota
    Ramsey County is a large, fully urban county located near 
Minnesota's border with Wisconsin, and with a population of more than 
550,000, is the second-most populous county in Minnesota. It is also 
the smallest county in Minnesota, and with its large population, among 
the most densely populated counties in the Nation. St. Paul, the 
capital of Minnesota, is our county seat.
    As a large, urban county located in the northern Midwest, Ramsey 
County faces perennial threats ranging from tornadoes and ice storms to 
train derailments and multi-location terrorist attacks. In my role as 
the county's director of emergency management and homeland security, I 
work to protect our local communities and their residents and 
structures from the on-going threats posed by these disasters.
federal efforts to address electromagnetic risks: the local perspective
    Counties are not merely stakeholders in this conversation, but a 
pivotal part of the Federal-State-local partnership of governments that 
together share the responsibility of protecting our Nation and its 
residents from disasters. Any potential failing of our Nation's power 
grid--and the cascading impacts that would follow--would require an 
immediate on-the-ground response by county emergency managers, law 
enforcement, firefighters, EMS, 9-1-1 call centers, public health 
officials, and public records and code inspectors. As such, counties 
appreciate the potential threat posed by electromagnetic risks and 
commend the subcommittee for convening this hearing to assess Federal 
efforts to address these risks.
    Mr. Chairman, I will focus my remarks today on 3 principles that we 
believe the subcommittee should observe as you assess Federal efforts 
to mitigate against electromagnetic risks:
   First, the potential impact of Federal policy changes on 
        local governments should be closely considered, particularly 
        when it comes to emergency management. Counties are charged 
        with protecting local communities from threats both natural and 
        man-made, and Federal actions that change National priorities 
        can unintentionally compromise counties' ability to carry out 
        this responsibility and ultimately make our Nation less safe.
   Second, electromagnetic risks should be viewed in the 
        context of the wide variety of threats faced by our Nation and 
        its local communities. We must prepare for an arguably 
        unprecedented variety of risks--from hurricanes and tornadoes 
        to terrorism and cybersecurity threats--and should not lose 
        sight of this fact as we assess electromagnetic threats.
   Third, emergency management resources--both fiscal and 
        administrative--are finite at all levels of government and 
        should be allocated based on holistic and pragmatic risk 
        assessment. Diverting limited resources from highly-probable 
        threats will make our Nation less prepared for the risks and 
        disasters that have proven to be perennial visitors to our 
        communities.
    By observing these principles--which are elaborated upon below--as 
you assess Federal efforts to mitigate against electromagnetic risks, 
the subcommittee can lessen the likelihood that policy changes made 
leave our country more prepared for one particular threat while 
decreasing our overall preparedness for the many different risks that 
face our local communities at any given time.
    The potential impact of Federal policy changes on local governments 
should be closely considered, particularly when it comes to emergency 
management..--As outlined in the opening section, counties play a 
critical role in protecting our local communities from natural and man-
made threats. It has been said that ``disasters are local,'' and I can 
attest that a well-organized local emergency management structure is 
crucial to disaster preparation, mitigation, and recovery efforts.
    But many factors affect a local emergency manager's ability to 
perform his or her functions in a streamlined and efficient manner. De-
prioritization of emergency management efforts at the county level or 
insufficient support for emergency management from the State government 
are just 2 examples. Another example--most relevant to the conversation 
at hand--involves rapidly-changing priorities and policies at the 
Federal level. Counties respond to the Federal Government's actions, 
not just in our role as intergovernmental partners working with our 
Federal counterparts towards the shared goal of serving American 
residents, but also because our constituents demand that their local 
leaders keep pace with the Federal Government's priorities and 
initiatives.
    Policy changes related to electromagnetic risks would be no 
different in this regard. Consider the Critical Infrastructure 
Protection Act (H.R. 1073), which was passed by the House late last 
year. The bill would require, in part, that the Secretary of the U.S. 
Department of Homeland Security ``conduct outreach to educate . . . 
emergency response providers at all levels of government of the threat 
of [electromagnetic pulse] events.'' Imposing Federal requirements like 
this has the potential to disrupt the on-going process of local 
emergency management planning and coordination and could undermine our 
ability to preserve the safety of our communities. We urge Members to 
consider the cumulative impact of such requirements as Congress works 
to enact this legislation.
    Electromagnetic risks should be viewed in the context of the wide 
variety of threats faced by our Nation and its local communities.--Due 
to changes in weather patterns and population growth--especially in 
densely-populated areas like Ramsey County--our Nation is facing an 
arguably unprecedented number of threats and disasters. We must not 
lose sight of these various threats as we take on the work of assessing 
the risks posed by electromagnetic pulses and space weather events.
    According to NACo's analysis of data made available by the Federal 
Emergency Management Agency (FEMA), 92 percent of counties across the 
Nation have had at least one Presidential disaster declaration in the 
past 10 years. Overall, these disaster declarations are happening at 
unprecedented rates, and each disaster seems costlier than the last. 
Due to globalization and advances in technology that have made us more 
interconnected than ever before, communities across the country also 
face novel cybersecurity threats from within and outside the United 
States.
    While we appreciate the importance of protecting our Nation against 
a potentially devastating failure of our power grids resulting from an 
electromagnetic event, we urge you to consider this threat in the 
context of all of the risks and threats that we have been entrusted to 
protect our communities against, especially at a time when the full 
range of threats seems to be increasing year after year.
    Emergency management resources--both fiscal and administrative--are 
finite at all levels of government and should be allocated based on 
holistic and pragmatic risk-assessment.--As disasters increase in both 
frequency and cost, we must be pragmatic in resource allocation, so 
that our limited emergency management resources go as far as possible 
in preserving lives, homes, and public and private structures in our 
local communities. Rather than creating new priorities or costly 
mandates, we urge you to view electromagnetic risks as one element in 
the portfolio of major risks we face.
    In Ramsey County, we have worked hard to ensure that our emergency 
management decisions and policies are based on pragmatic risk 
assessment that takes into consideration both the likelihood and 
potential consequences of various threats. This method of emergency 
management is one that was promoted in the United States. Department of 
Homeland Security's 2014 Quadrennial Homeland Security Review, and is 
widely accepted as a local best practice in counties throughout the 
country. Through this sort of risk assessment, we aim to make resource 
allocation decisions that will best protect our communities from 
threats and disasters. While low-priority events like electromagnetic 
pulses may be deprioritized in this way--and while we appreciate that 
these events are not unprecedented--we nonetheless believe that given 
our finite resources, we can best protect our residents, homes, and 
public and private structures through this manner of risk assessment.
    That said, we are by no means inattentive to the threats posed to 
our power grids. We monitor space weather reports and provide weekly 
reports to our public safety partners and leadership; we monitor the 
status of our region's power grid and include our utility providers in 
our oversight and planning workgroups. We assess transmission line 
protection in light of severe weather and flooding--as well as 
geomagnetic incidents. Whether through space weather, terrorist threat, 
or an ice storm or hurricane, large-scale power failures would present 
significant and cascading challenges to our emergency response systems, 
and we consider these risks in our disaster response and coordination 
efforts, and based on our broader risk-assessment strategies, work to 
mitigate these risks at every opportunity.
                                closing
    Thank you again Chairman Perry, Ranking Member Watson Coleman, and 
Members of the subcommittee for this opportunity to provide the local 
perspective in this important conversation on Federal efforts to 
address electromagnetic risks.

    Mr. Perry. Thank you, Mr. Freed.
    The Chair now recognizes himself for a few minutes of 
questioning. I am going to start out with Mr. McClelland from 
FERC.
    Sir, given that FERC liaisons with industry frequently, 
please provide the subcommittee with the industry perspective 
as you see it on the threat posed by EMP. For example, does 
industry feel they are well-prepared for an EMP event? Or do 
you think they are?
    Mr. McClelland. So that is a tough question to start.
    At this point, industry has been requesting better 
intelligence regarding the probability of an EMP strike. There 
isn't much doubt as far as the science behind the strike, what 
could happen to the power grid in the event that a strike 
occurs.
    The question from industry's perspective is, how do we rank 
this risk? How do we prioritize this assignment from the 
Federal Government? What is the probability that we will see a 
nation-state attack, a high-altitude electromagnetic pulse from 
a nuclear warhead?
    To follow up, because of that, there's been very little 
done by industry to prepare for this attack.
    Mr. Perry. Okay. Thank you.
    I am going to move on to Mr. Currie.
    How has the lack of a lead DHS office or official 
responsible for EMP impacted DHS's efforts? Has this led to 
inefficiencies or duplication? Can you enumerate?
    Mr. Currie. Sure.
    We didn't actually find any instances of duplication across 
the departments, but what we said in our report was that, 
certainly, because of the lack of a coordination lead, there is 
higher risk of potential overlap, fragmentation, and 
duplication.
    I don't think we really know, because there hasn't been a 
cross-departmental coordination effort to look at all the 
research that has been done, all the testing and development 
that has been done as part of a holistic plan. So we really 
don't know.
    But the lack of a lead, I think, has just led to a lot of 
confusion, especially in industry, as well, about who is 
responsible for this and what they are supposed to be doing to 
address it. Mr. McClelland hit that point. It is, who are we 
supposed to go to, to understand these risks, and who are we 
supposed to go to to understand the research behind how we 
protect against these risks?
    Mr. Perry. But you said that you don't know that it has led 
to any inefficiency or duplication? I just want to make sure I 
understand you.
    Mr. Currie. Yeah, we did not find--we looked across all the 
Departmental efforts--and, actually, I just want to say that, 
when you go talk to the Department about these issues, they 
don't have a list of EMP or electromagnetic actions. What we 
did is we looked across all the actions they were taking to 
protect critical infrastructure for the energy sector and we 
said, well, how does this apply to EMP and the EMP Commission? 
So we actually did that work.
    We didn't find duplication of effort, but what we found is 
little coordination between the departments of those efforts.
    Mr. Perry. Okay.
    You are still, obviously, recommending that there should be 
a lead, one individual that is the go-to person that is 
coordinating the effort where the buck stops, right?
    Mr. Currie. Absolutely. Within DHS, it is critical, I 
think, that there be a stop within DHS. We actually found in 
DOE and FERC that it was pretty clear who was responsible for 
this, just not within DHS.
    Mr. Perry. Okay. Thank you.
    Mr. Wales, an EMP attack can be carried out by detonating a 
nuclear device above the atmosphere or through the use of EMP 
weapons. If you know, what nations and/or hostile nation-states 
or actors currently have the capability to launch such an 
attack? What steps is DHS taking to specifically protect 
critical infrastructure from an EMP attack?
    Mr. Wales. Sure. Thank you, sir.
    So any country that has a nuclear capability would have the 
capacity to generate an electromagnetic pulse from the 
explosion of a nuclear weapon.
    With that being said, the Department relies heavily on the 
expertise of the broader U.S. intelligence community to provide 
us information on the capabilities and intent of our potential 
adversaries. In an open hearing, I don't think I am comfortable 
sharing the kind of information that they have provided to us 
in the past.
    But I will say that we are guided by the consensus view of 
the intelligence community as enumerated in the report released 
in 2014 on the threat posed by a high-altitude EMP event 
against the United States over the next 5 years.
    Mr. Perry. Let me just ask you, the steps that DHS is 
taking specifically to protect critical infrastructure, even if 
they are just recommendations for best practices, have you seen 
them? Do they seem adequate and appropriate to you?
    Mr. Wales. The question of whether the grid can withstand a 
large electromagnetic pulse today, I mean, clearly the answer 
is no. We are not prepared for that type of significant attack.
    I think that being said, industry does work to try to 
improve its overall level of resilience. The Department has, I 
think as I outlined in my testimony, provided information to 
help them make better decisions. Obviously, as outlined by GAO, 
there is more to be done, and we are committed to executing on 
GAO's recommendations. We think that will further help industry 
be prepared.
    But, ultimately, given the current authority at the 
Department and DOE and elsewhere, the ultimate burden for 
preparing for that type of event on the systems that operate 
our grid are going to be the utilities themselves. The work 
that we do is to help them be as prepared as they can be by 
providing them the kind of information that can help them make 
better decisions.
    Mr. Perry. Okay. Thank you.
    My time has expired. The Chair now recognizes the 
gentlelady, Mrs. Watson Coleman.
    Mrs. Watson Coleman. Thank you very much, Mr. Chairman.
    Mr. Currie, you indicated that you think that Homeland 
Security should be sort-of the coordinating agent, there should 
be someone there that is the go-to person for this whole issue. 
What component do you think should have that responsibility?
    Mr. Currie. So we didn't actually designate in the report 
who we thought it should be.
    I will tell you that, in law and Presidential Directive, it 
is pretty clear that NPPD, Mr. Wales' parent organization, is 
responsible for critical infrastructure protection.
    That was one of the key points in our report, is even 
though they didn't have to implement the Commission's 
recommendations--and, by the way, one of the Commission's 
recommendations was to establish roles and responsibilities and 
make that clear--they are already responsible for doing that 
under the National Infrastructure Protection Plan. So it would 
likely be in NPPD.
    Mrs. Watson Coleman. Okay. Thank you.
    Mr. Freed, as emergency management director, you are aware 
of a range of natural occurrences and threats impacting the 
homeland, in particular in your county. Please state the 
threats, the dangers, or the occurrences that are of specific 
concern in your district. Share with us, please, how does the 
EMP risk fit into this in the priority of areas?
    Mr. Freed. Thank you for that question.
    Under the methodology that DHS has worked to help us go 
forward on our risk assessment, we take a look at the various 
bad things that can happen in our county, their likelihood and 
impact, our capabilities to cope with those, and then basically 
look at the gaps between capability and worst case. We 
concentrate on worst-case, most-plausible events, and then go 
forward from there to kind-of develop the things that keep us 
up at night.
    We don't actually rank them, but there is sort-of the big 
group that does. Among that big group, of course, in the upper 
Midwest, you can imagine, tornados; you can imagine, winter 
storms. But prolonged power failure, particularly during the 
wintertime in the upper Midwest, is 1 of our 3 very big events. 
There is also hazardous materials incidents and terrorist 
attack are things that in urban areas such as ours we worry 
about.
    The impacts of a power failure, however, are the impacts of 
a power failure whether it is caused by a high-altitude EMP, a 
geomagnetic disturbance, an ice storm bringing down the power 
lines. If there is a surge that destroys one of those EHV 
transformers, we are going to rely on the transformer stockpile 
or some other method.
    So I certainly don't want to discount the absolute 
importance of the EMP and GMD preparedness; I just want to ask 
the committee to keep in mind that, you know, we need to 
address these things holistically. Preparing to cope with the 
threat to an EHV transformer, we can do that without increasing 
rules, regulations, training requirements for local government 
officials to make them all experts at E1, E2, and E3 effects of 
HEMP. I mean, that is sort-of where we look at it, is more 
holistically. That is, you know, our ask to the committee to 
consider.
    Mrs. Watson Coleman. So do you have a relationship with the 
Department of Homeland Security in sort-of discussing and 
developing this, sort-of, risk-based management? Tell me to 
what degree do you interact with the Department.
    Mr. Freed. Much better in recent years than in past.
    I teach--I am a risk geek----
    Mrs. Watson Coleman. I am sorry, I didn't hear that.
    Mr. Freed. I am a risk geek. I teach risk at the collegiate 
level, undergraduate collegiate level. Very often, the 
assessment of risk is extremely superficial and inaccurate. The 
vulnerability-times-consequences measure--that is TVC--it is 
not an effective way at looking at risk.
    Through programs like the Urban Areas Security Initiative 
and what is called the THIRA requirement, which is a Threat and 
Hazard Identification and Risk Assessment, we have started to 
now, Nation-wide, adopt some of the risk-geekiness application 
of measurement. So instead of, ``Well, that would be bad,'' we 
now look at why it would be bad, and what are potential causes?
    The problem comes that we can't prevent all of those 
causes, but we can mitigate widely against those events. 
Wherever possible, mitigating in a manner that protects us 
against multiple events is sort-of the key to doing this in an 
effective manner and an efficient manner as well.
    So that is what we try and do, is we try and take a look at 
those gaps and figure, if we do this training or buy this piece 
of equipment or implement this policy, procedure, or plan, can 
we cope with a lot of things or are we only protecting against 
one possibility?
    Mrs. Watson Coleman. Thank you, Mr. Freed.
    My time is up. I yield back.
    Mr. Perry. The Chair thanks the gentlelady.
    The Chair now recognizes the gentleman from Georgia, Mr. 
Loudermilk.
    Mr. Loudermilk. Thank you, Mr. Chairman.
    Thank you to all the witnesses being here today. It is a 
very important subject and one that, even on the Science, 
Space, and Technology Committee, that we have addressed some of 
these.
    I do have some more technical questions.
    Mr. Wales, when we talk about the potential of an EMP 
attack, what specific damage would be done to power generation? 
Can you address that? Or anyone? What I am looking at is what 
damage would be done to generation versus the distribution 
system?
    Mr. Wales. In an EMP event, because EMP generates multiple 
types of waves that will affect different systems in different 
ways, we would expect disruption to both generation and 
distribution systems--generation, transmission, and 
distribution systems. Any system that has industrial control 
systems could be affected by some parts of the EMP event. The 
transmission lines could be affected by others.
    The scale will obviously depend upon the unique type of 
what is generating the EMP pulse, where it is, how it is 
detonated--ground, air, et cetera. So there are a lot of 
factors.
    In part, this is why we have launched this new project with 
the Department of Energy to better bound what types of EMP 
events are going to potentially create the most amount of 
damage to the power systems and which ones are likely to 
generate less impacts.
    Obviously, the thing that we are concerned about most would 
be permanent damage to large equipment like the high-voltage 
transformers that have much longer lead times for replacement 
and are often built for specific purposes.
    Mr. Loudermilk. Okay. That is kind-of what I was getting 
at. I have heard several of you talk about these transformers, 
and stockpiling these transformers. But in case of an EMP 
attack on the United States, is predominantly the damage to the 
power generation going to be done in the microprocessors, the 
control systems? Or are we actually looking at the generators 
itself being fried, for lack of a more technical term?
    Mr. Wales. I think the issue would be more of a concern 
with the transmission substation being----
    Mr. Loudermilk. Okay. So hydroelectric dams, coal power 
facilities would still be able to generate power, it is just 
they wouldn't be able to----
    Mr. Wales. Possibly. Those would also be affected by the 
loss of their control systems from microprocessor disruptions 
from an EMP event.
    But I think the--we have a lot more generation in the 
country. We have a lot of excess generation that can be spooled 
up when we need it, and a lot of it is not on-line at any given 
moment. Therefore, the bigger concern is the transmission 
disruptions, the substations that could be damaged through an 
EMP.
    Mr. Loudermilk. Okay.
    Then my concern is around the protection of those 
replacement parts, per se. Is there a method of protecting--are 
we protecting, let's say, the transformers that we talked 
about? Stockpiling the transformers? What type of protection do 
we have to ensure that even those would not be damaged?
    Mr. Wales. So there is a small amount of extra transformers 
that are maintained by industry, and they have a program to 
share those in the midst of a disruption. That is obviously 
meant for smaller-scale disruptions. They can get those in 
place. At times, utilities will also maintain an extra spare on 
site that may not be activated at any given moment that could 
be brought back up on line.
    But this is also why the Department invested in this 
recovery transformer project through our Science and Technology 
Directorate that actually piloted a modular transformer that 
can be moved in and gotten up and running more quickly than 
traditional transformers. That project successfully 
demonstrated that that could be done with the Houston 
CenterPoint utility back in 2014. That was a project that was 
worked jointly with industry. So that demonstration project is 
now available should industry want to purchase transformers 
like those that can be brought up on-line very quickly and 
more----
    Mr. Loudermilk. Those could be protected if they are not 
actively on the grid?
    Mr. Wales. Correct. Generally, if a system is not in use, 
it has a much higher degree of surviving an electromagnetic 
pulse.
    Mr. Loudermilk. Okay.
    You mentioned the 1920s geomagnetic disturbance. Would 
something like that, if it were to happen today, have a world-
wide effect? Or would it be more limited to, what position the 
Earth was in, those that were facing the sun at the moment it 
happened?
    Mr. Wales. There are going to be some effects that may be 
global. So, as it scintillates satellites, it could affect 
multiple parts of our constellations. Depending on the length 
and intensity of a geomagnetic event, it could have wider-scale 
impacts.
    In general, I think the specifics of a geomagnetic event 
are going to determine the effect it has both on the country 
and any of our neighbors. In general, we assume that the higher 
latitudes are going to be more directly affected than lower 
latitudes, but it also will depend upon things like the geology 
of those areas, how much they will carry geomagnetic effects.
    So these are some of the factors that need to be evaluated 
when trying to understand the impacts of a geomagnetic event on 
a country.
    Mr. Loudermilk. Okay. Thank you.
    Mr. Chairman, may I just add in closing that a 
Congressional investigation on the attack of Pearl Harbor 
determined that the Government felt that the Japanese attacking 
Pearl Harbor was possible but not probable. The same with the 
9/11 attacks, that the terrorists hijacking aircraft and flying 
them into Government buildings and buildings in the United 
States was possible but was not probable.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes the gentlelady from California, 
Mrs. Torres.
    Mrs. Torres. Thank you, Mr. Chairman.
    I have a question for Director McClelland.
    National electrical systems for countries across the globe 
are structured in many different ways. Mitigation for 
geomagnetic disturbances will have to be tailored to specific 
countries' needs.
    Are you aware of any plans to propose international 
standards, given that there are so many different and 
individualized systems that will need specialized mitigation?
    Who would oversee such an effort? I am trying to understand 
this issue. Is this an issue unique to the United States, or is 
this an issue that we should be working with our partners 
across the world?
    Mr. McClelland. Thank you for the question.
    Currently, there are many independent initiatives 
internationally. So the United Kingdom, Norway, Quebec have all 
initiated, not to mention other countries as named in the--
there is a Congressional research report for Congress in, I 
will say, March 26, 2008, that specifically mentions mitigation 
efforts in, for instance, Russia from both GMD and EMP.
    So, independently, these nations are moving forward. They 
are protecting the most critical--they are identifying and 
prioritizing infrastructure, energy infrastructure, to protect 
their population, and they are moving forward with mitigation 
efforts.
    To date, the United States has coordinated and has shared 
information with other nations, but there is no international 
standards development and nothing compulsory that is being 
shared across the nations. But, as I said, the United States is 
falling behind. Other nations are moving ahead for mitigation 
on geomagnetic disturbances and, in some cases, electromagnetic 
pulse.
    Mrs. Torres. So, back to my question, who do you think 
should oversee those efforts? Is that something that the United 
States solely should continue to pursue? Or is that something 
that should fall under U.N.-specific standards? Should there be 
a specific commission related to this issue? How broad is it 
and how much of a global impact, given our trade agreements and 
all of that that could impact our communities across the world?
    Mr. McClelland. I do think international collaboration will 
be important. I think that the large storms--1859, 1921--they 
occurred over a period of days, so the entire Earth was 
affected by these storms, but no one had the interconnectedness 
of the power grids that they have today and, arguably, the 
vulnerability of the equipment.
    Traditionally, it has not been FERC. FERC is not an agency 
that works across those lines internationally. It would be the 
Department of Energy and the Department of Homeland Security. 
So I would defer to my colleague from the Department of 
Homeland Security to better describe what could be done 
internationally.
    Mr. Wales. DHS works on a number of issues collaboratively 
with international partners related to terrorism, cyber 
threats. I don't think in any of those are we attempting to 
organize the international community in terms of a leadership 
role in taking certain action. But I think, as Joe indicated, 
our goal is to build collaborative ties with those countries, 
share information, and to make sure that, to the extent 
possible, we are implementing good, consistent actions.
    I would say it is a little bit different in the case of 
Canada, where we have, obviously, a shared electric power grid. 
There is far more collaboration there in attempting to 
implement pretty joint activities associated with power grid 
security and resilience.
    Mrs. Torres. Okay. Thank you.
    Also, the electric grid doesn't produce energy out of thin 
air. We all know that the electric sector is highly dependent 
on telecommunications, especially fuel supply and delivery 
infrastructure. These key independencies must be identified, 
understood, and prioritized.
    How would you prioritize fuel supply and delivery security 
as opposed to other infrastructure priorities? I don't know if 
Mr. McClelland could answer that or if that would be----
    Mr. Wales. I will help out Joe here.
    Mr. McClelland. Thank you.
    Mr. Wales. I don't know that you can segment out some of 
those critical dependencies and interdependencies amongst 
infrastructure such as power generation, natural gas/petroleum 
movement, you know, communications, transportation. In many 
cases, you need all of them working together to successfully 
deliver the critical services that they provide to the American 
people, our economy, and our way of life.
    In many cases, when we are looking at the aftermath of a 
major disruption or major disaster, a Hurricane Sandy, we are 
trying to figure out how best to get most of those capabilities 
up together so they can be mutually reinforcing and allow the 
services to continue flowing.
    But I think the ones that you named are those kind of core 
set of lifeline services that we need and that we would 
prioritize in the aftermath of any type of disruption or for 
protection in preparedness activities.
    Mrs. Torres. Thank you, Mr. Chairman. I am out of time.
    Mr. Perry. The Chair thanks the gentlelady.
    The Chair now recognizes the gentleman from Georgia, Mr. 
Carter.
    Mr. Carter. Thank you, Mr. Chairman.
    Thank each being of you for being here. This is a very 
important subject, something that we are obviously all 
concerned about.
    Mr. Wales, I will start with you. In response to the GAO's 
findings, DHS has responded many times that it has not taken 
the EMP threat seriously. Can you explain to me why it is a low 
priority? It would seem to me that this should be a top 
priority. Am I missing something here?
    Mr. Wales. I would not characterize DHS's position that we 
are treating this as a low priority. As I think I have outlined 
in my statement, there is activity occurring across DHS that in 
some cases is directly focused on addressing EMP-related 
threats and their risks.
    When you look at the activity that DHS co-chaired with the 
Office of Science and Technology Policy at the White House that 
developed a Space Weather Action Plan that applies across the 
interagency, I think that demonstrates that the Department is 
extremely focused on doing what it can to help improve the 
security and resilience against that issue.
    But I would also----
    Mr. Carter. Well, now that you mention that, one of the 
findings in the report is there was no central entity within 
DHS that was concentrating on that. Have you identified a 
central entity yet?
    Mr. Wales. So, in response to the GAO recommendations, the 
Department of Homeland Security identified its Office of 
Policy--the Cyber Infrastructure Resilience Policy Office will 
serve as the lead for coordinating DHS actions on EMP.
    That being said, the complexity of the issue means that the 
various components, the operational components, of the 
Department need to bring to bear its specialized skills and 
execution to address this issue. The work that FEMA does is not 
going to be done by other parts of the Department. The work 
that S&T does to sponsor research and develop prototypes is not 
going to be done by other parts of the Department. The work 
that we do in NPPD to work with industry, conduct studies, that 
is not going to be done by other parts of the Department. 
Policy's job is to make sure that all of our efforts are 
aligned and moving in a common direction.
    I will just say one other thing on the, kind-of, initial 
question, and that is, as I think has been outlined by a number 
of people today, we have to view EMP in terms of the broader 
array of risks that we face as a country in our critical 
infrastructure. When we devote resources to one topic, that 
means that we are sacrificing focus and attention on other 
topics.
    Mr. Carter. We understand that. We certainly understand 
that. But, again, it just seems that the Department is making 
this a low priority when it would appear to us that it needs to 
be a high priority and a top priority.
    Let me ask Mr. McClelland.
    Mr. McClelland, what changes would you suggest to be made 
immediately? I mean, if we are going to be better prepared, 
what do we need to do immediately, not only for perhaps a man-
made but even a natural disaster?
    Mr. McClelland. The first order of business would be to 
prioritize the assets. I know that DHS has done work in that 
area. With 55,000 substations across the United States, I think 
the argument legitimately back from industry would be, ``We 
can't protect every one of these facilities from EMP. It is 
simply too difficult and it is too expensive.''
    However, if the assets were prioritized around 
functionality--for instance, what do you need to provide 
skeletal service to major urban areas? What facilities does DOD 
absolutely have to have in service in order to remain mission-
ready? What might be critical infrastructure service, such as 
off-site service to nuclear power plants? Identify those 
criticalities. It won't be near 55,000 stations. It may just 
end up being a few hundred stations.
    Then from there, provide threat briefings and critical 
intelligence to the owners and operators of those facilities, 
because the Government can't do it without them. We don't own 
the facilities, and we have no authority to compel them to take 
action.
    Mr. Carter. Understood. Understood.
    Mr. McClelland. Provide intelligence, and then provide cost 
recovery as well as best practices to----
    Mr. Carter. Okay.
    Mr. Freed, best practices. Are there any best practices out 
there?
    Mr. Freed. Best practices specific to protection against an 
electromagnetic incident?
    Mr. Carter. Protection and response to a problem.
    Mr. Freed. The short answer is not really, not that has 
been promulgated down to us at the local level, but--not 
specifically, I guess, rather than not really. What there are 
best practices are in exactly what Mr. McClelland was saying, 
which is prioritizing--we refer to it as CIKR, Critical 
Infrastructure and Key Resources--prioritizing what is 
energized by which power substation; how are things 
transmitted? Then our mitigation efforts are also--there are 
best practices for that, the problem being that a lot of those 
repairs or those mitigation efforts are extremely, extremely 
expensive and time-consuming. For instance, if you bury a 
transmission line and then something happens to it, the cost of 
fixing it is significantly greater. So the private industries 
kind-of have to weigh the chances of that transmission line 
failing for some reason versus the cost of fixing it when it 
does.
    Mr. Carter. So there are things that counties and 
municipalities can be doing to prepare for this?
    Mr. Freed. There are things that we are currently planning 
around. We do not own those transmission lines either. So I 
live in an area that gets ice storms and severe summer storms 
and floods on a regular basis. That has direct impact on our 
power transmission systems. Working on ways to mitigate against 
those in general and specifically protecting those power lines 
is something we can and do.
    Mr. Carter. Thank you. Just one last point, Mr. Wales. I 
hope the Department is taking this seriously and considers this 
a top priority because I certainly think the impression you get 
and the message you get from this panel today is that we are 
taking it very seriously.
    Thank you, Mr. Chairman. I yield back.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes the gentleman from Florida, Mr. 
Clawson.
    Mr. Clawson. Thank you for your time today, gentlemen.
    Following along this line of questioning, let's see if my 
logic is right. The electrical grid and the power market is a 
private market in the United States: Heavy regulation, private 
shareholders, customers, suppliers, et cetera. Normally, in our 
country, when there is a technical or security issue that 
overlaps with the private sector--Y2K comes to mind 
immediately. At least a couple, 2 or 3 of you all, are old 
enough to remember that. I certainly do. One or 2 of you 
probably aren't. We didn't wait around for the Government. We 
were involved in fixing it for our own enterprise, and 
moreover, there were plenty of consulting companies and others 
that were involved in the fix in order to solve the problem 
because everybody had a profit incentive, which is normally 
what creates innovation and solution, as opposed to Government 
involvement.
    So, therefore, give me a summary here. I mean, the one 
thing--and I missed a lot of what has gone on today because I 
had constituents in my office, but nonetheless, if this is a 
real deal--and there seems to be some debate about it--but if 
there is a real deal, why isn't there a real market response? 
Or is there a real market response, not just in terms of 
suppliers of product but also consultants and technical folks 
and all the people that would be working on this if it is the 
real deal? What is going on with the private sector, to anyone 
that would like to answer?
    Mr. McClelland. I can start. There are really 2 aspects 
here. There is geomagnetic disturbance, which is inevitable. 
That is going to happen. It is just a matter of the timing of 
when it occurs and the magnitude that will occur. An impact 
from a geomagnetic disturbance has been debated. So the 
Commission, along the agencies, Department of Energy and 
Department of Homeland Security, put out a report by Oak Ridge 
National Lab that said that, considering the current 
configuration of the system, if we took a 1921 storm, the 
impacts would be devastating. We will see over 300 transformers 
that could be potentially damaged or destroyed. These have a 
year-long lead time, in many cases custom-built for the site 
that they are installed with no spares.
    Mr. Clawson. By the way, if you have an incident, that 1-
year lead time is going to go to 3 or 4.
    Mr. McClelland. Correct.
    Mr. Clawson. Because you don't have enough capacity to make 
that, I mean, obviously.
    Mr. McClelland. You could even add to that that it is 
probably going to be a global event. The United States does not 
own or control the production facilities, so those transformers 
may go to the international host where the factory is first, 
and then if there is any left over, the United States gets on 
the production list.
    Industry, however, conducted its own study and said that 
the grid would collapse before there would be problems to the 
transformers. There would be wide-spread blackouts, but the 
grid would collapse. It has been the subject of some back-and-
forth through an iterative process that the Commission 
exercises. The bottom line conclusion, though, is even if the 
grid collapsed--in 1989, Quebec collapsed. It was 90 seconds; 7 
million people were out of power for 9 hours. Relatively little 
damage, but the estimated cost for that 1 collapse was $1 
billion, $1-2 billion. If we use the lower number and we put in 
mitigation techniques to protect against it, we could protect 
2,000 transformers for an incident that was relatively minor 
impact. By the way, Quebec has now mitigated against 
geomagnetic disturbances. So, even with inevitability, there is 
still debate about what should be done and the costs that could 
be incurred, which the Commission can reimburse those costs.
    On the EMP side, it is even more debatable because industry 
would need--they want--some sort of a risk analysis: How likely 
is it that some of these countries, and Brandon explained it--
anyone that has nuclear capability would conceivably have an 
ability to propagate an EMP attack--how likely is it we are 
going to see this, and which facilities should we protect? The 
approach the Commission has used is to prioritize--along with 
DHS--is to prioritize those assets and, for a relatively small 
number of assets, encourage best practices, not pass more 
regulation but encourage best practices along with cost 
recovery to protect against these threats.
    Mr. Wales. I will only add that the science of hardening 
things against EMP is well-known. The military has been doing 
it since the dawn of the nuclear age when they wanted to harden 
their own systems to be able to withstand EMP in the event of 
war with Russia, the Soviet Union. So the science is there on 
how to protect themselves. This is just an issue of whether it 
is a sufficient priority for industry to make the investment, 
and then what is the best way for them to fund that, since they 
would have to go ask permission for every State utility 
commission to recover the cost that it would take to put in 
place those mitigation measures?
    Mr. Clawson. I guess the only thing I would say is if I am 
in the private sector and I have some savvy investors, I might 
be thinking of an innovation that puts your science that you 
are talking about on its head. What innovators do is they find 
the next iteration of a more cost-effective solution so that we 
don't sit around saying, ``This is too expensive,'' right? It 
just seems to me that somebody is out there doing something. If 
this is as big a deal as you say, there has got to be some X, 
Y, or Z company that is doing something for profit incentive to 
come up with a cheaper solution.
    I am out of time, so you can take me back.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes our guest, Mr. Franks from 
Arizona.
    Mr. Franks. Thank you, Mr. Chairman.
    I especially want to express gratitude just for the 
privilege of being your guest here today. The Chairman has, 
throughout the debate here for a number of years, been a 
champion in this area, and I am grateful. I suppose that it is 
not a small thing that the Chairman, in other venues or forums, 
is recognized as General Perry. When we discussed our military, 
their response, there has never been an argument with the 
military. We have spent billions of dollars hardening some of 
our critical military assets, our critical defense assets. That 
is telling in my mind, because the military does depend upon 
the civilian grid in CONUS for about 99 percent of its 
electricity needs, without which, even according to their own 
perspective, they cannot effect their mission. So I think that 
is a telling point, and I appreciate the whole panel here. A 
lot of very good questions.
    I am encouraged. I know that this is a subject that is 
rather daunting. The Israelis now have begun to harden their 
grid. They said that this is an attractive problem. You ask 
them, ``What does that mean?'' and they say, ``Well, it is an 
existential issue for us.'' I am not sure how that makes it 
attractive. But they said, ``This is one we can fix,'' which is 
kind-of an unusual situation for them.
    I am almost more encouraged about the testimony that I have 
heard from Mr. Currie and Mr. Wales and some of the acumen and 
the very learned perspective that they have brought forth 
because that hasn't been the case in the past. I say that with 
all due respect. It gives me some hope.
    I think there are 2 things that are critical that we do. 
Other than making sure that we have properly done the research 
that is necessary and things of that nature going forward, I 
think CIPA in the Senate has a good chance of precipitating 
some of that research, and I hope that political considerations 
or gridlock does not prevent that, because if it gets a fair 
vote, it goes forward. But I really am truly encouraged by the 
testimony that I have heard today.
    Of course, Mr. Chairman, I consider Joe McClelland a 
National treasure. He has, ever since the EMP Commission first 
reported to the Armed Services Committee years ago, been a lone 
voice in many ways, and now his voice, of course, has been 
confirmed in so many different ways, and I am grateful for 
that.
    If we can do 2 things, if we can come up with a National 
standard at which we should harden our grid, that we can all 
come to the conclusion based on sound science, and then use 
hardware-based solutions, which is what the SHIELD Act attempts 
to do, I think we can disincentivize either a particular enemy 
or certainly protect against a natural impact. If an enemy 
recognizes the potential danger here, it has always been, at 
least historically speaking, their tendency to try to exploit 
that.
    Yes, I agree this is a low-probability, high-impact issue, 
but if one just does a cursory glance at history, you realize 
that those are the very kinds of things that we always find 
regret in not finding insight to at least prepare for them, 
because as we are now, I think we have an open invitation to 
some of our worst enemies if they choose to exploit that.
    So, with that, I am just going to ask one question and 
again express the sincerest gratitude to you, Mr. Chairman, to 
everyone here, and to the panel, again, for the encouraging 
things that I am hearing.
    So, Mr. McClelland, I will ask the question to you, sir, 
and it has been asked in different ways. But in terms of what 
should be done and what is being done--that is probably the one 
element I would add to--right now, what do you think is being 
done, and where are we? Are we making progress? Are we seeing 
people expand their understanding of this issue?
    Again, thank you, Mr. Chairman.
    Mr. McClelland. Let's start with what is being done. The 
Commission has established threshold standards, so foundational 
practices for geomagnetic disturbances. They are based, though, 
on operator actions. So that assumes 2 things: That the 
operators have sufficient warning--and in the case of a solar 
flare, it is assumed that they would have sufficient warning--
to take precautions to reconfigure the power grid to cause 
minimal impact to the power grid itself. That depends on the 
operator not making an error and, again, the forecast. But that 
would not be sufficient for an electromagnetic pulse attack.
    On the electromagnetic pulse side, more studies are being 
conducted by the industry. They are doing some research. They 
are now just starting to receive threat briefings, but very 
little has been done to protect the power grid and the other 
infrastructure against an electromagnetic pulse in the United 
States.
    Mr. Perry. Well, thank you, Mr. Franks.
    I guess this is going to remain a work in progress. 
Gentlemen, we appreciate your time here today. We can see that 
there are some places for improvement within the context of 
this. In some people's minds, I imagine this is an imminent 
threat; in other people's minds, it is something less than 
that. Also, in the context that it is hard-to-tell industry, I 
think, to move forward when you don't have your own house in 
order, right? So we have got to do the best we can, whether it 
is FERC, whether it is the Department of Energy, whether it is 
Homeland Security, to make sure our ducks are in a row before 
we go to industry and say, ``This is what we would like to 
see,'' and then help them get there one way or another. So we 
have got to keep all that in context. Again, I think this is 
just going to be a continuing issue we will have to revisit to 
see that the benchmarks are being met and we keep moving 
forward to make sure that the grid is adequately protected and 
we are prepared for the eventuality of the, in some cases, 
imminent; the naturally occurring; or the maybe not-so-
imminent, the other.
    With that, the Chair thanks the witnesses for their 
valuable testimony and the Members for their questions. Members 
may have some additional questions for the witnesses, and we 
will ask you to respond to these in writing. Pursuant to 
committee Rule VII(e), the hearing record will remain open for 
10 days.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 11:17 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

        Questions From Chairman Scott Perry for Chris P. Currie
    Question 1a. The EMP Commission made 7 recommendations related to 
the electric grid which were mainly focused on DHS and DOE. GAO has 
reported that of those 7 recommendations, DHS and DOE have taken ``some 
action'' on 4 recommendations. In what ways have DHS and DOE further 
addressed those 4 recommendations?
    Question 1b. Do DHS and DOE intend to address the remaining 3?
    Answer. It is important to note that the actions DHS and DOE have 
taken to address electromagnetic risks are not part of a dedicated 
effort to implement the EMP Commission recommendations. Through our 
work, we identified actions taken by both agencies that aligned with 
some of the recommendations. Specifically, of the 7 recommendations 
made by the EMP Commission related to the electric grid, some of the 
actions that DHS and DOE took aligned with 4 of them:
    1. Conducting research to better understand the interdependencies 
        of critical infrastructures,
    2. Addressing the vulnerability of control systems to an EMP 
        attack,
    3. Identifying responsibilities for responding to an EMP attack, 
        and
    4. Utilizing industry and other governmental institutions to assure 
        the most cost-effective outcomes--(5 of 15 subparts).
    However, while some of DHS's and DOE's actions have aligned with 4 
of the EMP Commission's recommendations, this does not mean that each 
component of these 4 recommendations has been completed. Examples of 
some of the actions DHS and DOE have taken include the following:
   Developing National and regional restoration plans and 
        assuring the availability of critical communication channels.--
        DHS and DOE are in the process of developing the Power Outage 
        Incident Annex (POIA) Plan. Although it's not finalized--
        (expected completion is in 2016)--the POIA is intended to 
        provide incident-specific information regarding how the Federal 
        Government intends to respond to and recover from a loss of 
        power resulting from deliberate acts of terrorism or natural 
        disasters, including an EMP or geomagnetic disturbances (GMD) 
        event.
   Implementing efforts outlined in the National Space Weather 
        Strategy and Action Plan.--DHS and DOE, among other Federal 
        agencies, are in the process of identifying efforts and taking 
        actions as outlined in the National Space Weather Strategy and 
        Action Plan from October 2015. The strategy identifies goals 
        and establishes the principles that will guide space weather 
        efforts in both the near and long term, while the Action Plan 
        identifies specific activities, outcomes, and time lines that 
        the Federal Government will pursue accordingly. Specifically, 
        the Action Plan calls for Federal agencies to establish 
        benchmarks for space weather events and to improve protection 
        and mitigation efforts, among other actions.
   Conducting research on the susceptibility of transformers to 
        geomagnetic disturbances (GMD).--In November 2015, DOE reported 
        initiating a study by the Oak Ridge National Laboratory to 
        quantify the risks associated with GMD on electric power system 
        reliability. The study plans to identify power lines and their 
        associated transformers within the eastern section of the power 
        grid and to determine those that are most susceptible to the 
        effects of GMD. DOE officials expect the study to be completed 
        in July 2016.
   Developing a National Transformer Strategy.--DOE developed a 
        draft National strategy in 2015 to reduce the risk to grid 
        reliability posed by the loss of critical large power 
        transformers. The draft National strategy focuses on 3 areas: 
        (1) Understanding and mitigating current and future risks to 
        transformers, (2) enhancing protection of transformers, and (3) 
        ensuring transformer replacement equipment is available. It 
        also calls upon Federal Government entities, to partner with 
        electricity operators, equipment manufacturers, and State and 
        local authorities to develop risk assessments and modeling 
        tools to guide their efforts and prioritize activities. As of 
        December 2015, DOE officials reported that the strategy is 
        undergoing review.
    DHS and DOE intent to address the remaining 3 EMP Commission 
recommendations remains unclear. There are some indications though that 
issues included in the recommendations are being given consideration. 
For example, both departments acknowledged the importance of providing 
capabilities to recover rapidly from an EMP attack--which is 
encompassed in 1 of the 3 remaining recommendations. In addition, DOE 
officials also identified ``black start capabilities''--the ability to 
restart power at a generation plant that has lost power without having 
to use an external energy source--as an example of how to restart 
energy production. This capability is also discussed in 1 of the 
Commission's recommendations where some action has been taken but 
several actions remain incomplete. DHS officials have agreed that an 
analysis of black start capabilities is warranted.
    Question 2a. A recent Idaho National Laboratory study found that 
updated research and analysis on the effects of the early time pulse of 
an EMP event is needed. In your estimation, how much of the other 
existing EMP research is outdated?
    Question 2b. Given that research projects can take a lot of time to 
complete, what steps can the Federal Government take to fill any 
existing knowledge gaps caused by outdated information?
    Answer.
   A key knowledge gap is in understanding how an EMP will 
        affect the U.S. electric grid. The INL report noted that most 
        information sources about the impact of EMP E1 on electric 
        power grids are decades-old and do not account for modern grid 
        technologies and electronic control systems. While we have been 
        told that the DOD and the intelligence community have updated 
        information on the EMP threat, additional opportunities may 
        exist to leverage EMP threat information through I&A or direct 
        collaboration with DOD, DOE, or other intelligence sources. For 
        example, Classified analytical products are available that 
        address specific components of threat, such as assessment of 
        EMP-related missile technologies, which could provide an 
        important input regarding adversary capabilities as part of 
        DHS's overall assessment of electromagnetic threats. Although 
        I&A officials have direct access to these materials, neither 
        I&A nor NPPD officials identified efforts to specifically 
        leverage this information as part of any Department-wide risk 
        assessment efforts. Acquiring more comprehensive information on 
        potential EMP threats may be helpful because, as one EMP expert 
        stated in recent testimony, there are misconceptions regarding 
        the nature and impact of potential EMP attacks, which may have 
        a negative effect on the ability of stakeholders to determine 
        reasonable steps needed to protect critical infrastructure and 
        mitigate potential impacts. Additionally, as we reported, while 
        the NPPD Office of Infrastructure Protection conducts various 
        assessments to identify vulnerabilities, interdependencies, and 
        potential cascading impacts across different sectors of the 
        Nation's critical infrastructure, these have generally not been 
        utilized to obtain specific information about vulnerabilities 
        or consequences related to EMP or GMD events. Given the lack of 
        comprehensive EMP-related information on the vulnerability of 
        and consequences to the U.S. electric grid, further R&D to 
        understand the effects, and techniques to protect against or 
        mitigate the effects of EMP attacks is needed. In our report, 
        we recommended that the Secretaries of Homeland Security and of 
        Energy engage with Federal partners and industry stakeholders 
        to identify and implement key EMP R&D priorities.
   As we also stated in our report, a 2013 white paper 
        developed by the Electric Power Research Institute also noted a 
        lack of wide-spread and coordinated research and development 
        efforts to protect the commercial electric grid against EMP 
        attacks and mitigate their effects. The institute recommended 
        that stakeholders define key characteristics of an EMP event--
        such as potential altitudes of detonation--for further study of 
        corresponding impacts, as the lack of more specific parameters 
        for determining potential EMP effects makes it difficult to 
        develop applicable protective guidelines and equipment design 
        specifications. However, according to Federal Energy Regulatory 
        Commission officials, additional work is being done outside of 
        the United States to further develop applicable standards and 
        implement equipment designed to mitigate the effects of or 
        protect against EMP risks. Given the on-going nature of this 
        work, U.S. officials may have an opportunity to investigate how 
        they might be able to coordinate with researchers outside the 
        United States already conducting this work to determine if 
        working jointly could speed the completion of this research for 
        the benefit of both parties.
   Similarly, any proposed mitigation strategies resulting from 
        efforts to address GMD, including the National Space Weather 
        Action Plan, could also be reviewed to determine how effective 
        they might be against a potential EMP attack so that fully-
        informed investment decisions can be made. For example, as one 
        EMP expert noted in recent Congressional testimony, if 
        designing protective equipment to withstand specified levels of 
        E3 effects from an EMP attack, there may be collateral benefits 
        for providing protection against GMD effects; however, the 
        reverse may not be true.
   We also reported that Federal agencies should improve their 
        efforts to identify and prioritize key research and 
        development, including an evaluation of protective equipment 
        intended to help mitigate the impacts of an EMP event. As we 
        recommended in our report, Federal agencies and industry 
        stakeholders should work together to identify and implement key 
        EMP research and development priorities, including EMP 
        protection and mitigation options. Coordinating their efforts 
        can also help to better ensure that limited resources are more 
        effectively targeted toward the highest-priority research.
         Questions From Chairman Scott Perry for Brandon Wales
    Question 1. According to GAO's report, actions are underway to 
establish a Cyber, Infrastructure, and Resiliency group within the 
Office of Policy. How will this group differ from other offices, such 
as NPPD's Office of Cybersecurity and Communications or Office of Cyber 
and Infrastructure Analysis, which have already performed work in 
regard to EMP threats?
    Answer. Response was not received at the time of publication.
    Question 2. Is DHS reviewing those EMP Commission recommendations 
that have not been addressed? If so, what is being done to address 
them?
    Answer. Response was not received at the time of publication.
    Question 3. GAO recommended that DHS increase its collection and 
analysis of threat, vulnerability, and consequence information related 
to electromagnetic risks. GAO also provided a variety of methods 
through which this can be accomplished, including closer collaboration 
with DOD and leveraging existing assessment tools, such as the 
Infrastructure Survey Tool. What has DHS done to increase its 
collection and analysis of electromagnetic threat information?
    Answer. Response was not received at the time of publication.
        Question From Chairman Scott Perry for Joseph McClelland
    Question. Has FERC assessed the potential costs of mitigating 
critical electric assets to withstand a GMD or EMP? If so, what are 
they and are there funding streams that could be shifted for some of 
these costs?
    Answer. FERC has not itself assessed the potential costs of 
mitigating critical electric assets to withstand a GMD or EMP event. A 
study conducted by the Oak Ridge National Laboratory in 2010, sponsored 
by FERC and other Federal agencies and to which I referred in my 
prepared testimony, includes some estimates of such costs.

                                 [all]
```