U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

97–762PDF 2017

CYBERSECURITY FOR POWER SYSTEMS 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON ENERGY & 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY 

COMMITTEE ON SCIENCE, SPACE, AND 

TECHNOLOGY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

October 21, 2015 

Serial No. 114–43 

Printed for the use of the Committee on Science, Space, and Technology 

( 

Available via the World Wide Web: http://science.house.gov 
(II) 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

HON. LAMAR S. SMITH, Texas, Chair 

FRANK D. LUCAS, Oklahoma 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

DANA ROHRABACHER, California 

RANDY NEUGEBAUER, Texas 

MICHAEL T. MCCAUL, Texas 

MO BROOKS, Alabama 

RANDY HULTGREN, Illinois 

BILL POSEY, Florida 

THOMAS MASSIE, Kentucky 

JIM BRIDENSTINE, Oklahoma 

RANDY K. WEBER, Texas 

BILL JOHNSON, Ohio 

JOHN R. MOOLENAAR, Michigan 

STEVE KNIGHT, California 

BRIAN BABIN, Texas 

BRUCE WESTERMAN, Arkansas 

BARBARA COMSTOCK, Virginia 

GARY PALMER, Alabama 

BARRY LOUDERMILK, Georgia 

RALPH LEE ABRAHAM, Louisiana 

DARIN LAHOOD, Illinois 

EDDIE BERNICE JOHNSON, Texas 

ZOE LOFGREN, California 

DANIEL LIPINSKI, Illinois 

DONNA F. EDWARDS, Maryland 

SUZANNE BONAMICI, Oregon 

ERIC SWALWELL, California 

ALAN GRAYSON, Florida 

AMI BERA, California 

ELIZABETH H. ESTY, Connecticut 

MARC A. VEASEY, Texas 

KATHERINE M. CLARK, Massachusetts 

DON S. BEYER, JR., Virginia 

ED PERLMUTTER, Colorado 

PAUL TONKO, New York 

MARK TAKANO, California 

BILL FOSTER, Illinois 

SUBCOMMITTEE ON ENERGY

HON. RANDY K. WEBER, Texas, Chair 

DANA ROHRABACHER, California 

RANDY NEUGEBAUER, Texas 

MO BROOKS, Alabama 

RANDY HULTGREN, Illinois 

THOMAS MASSIE, Kentucky 

STEPHAN KNIGHT, California 

BARBARA COMSTOCK, Virginia 

BARRY LOUDERMILK, Georgia 

LAMAR S. SMITH, Texas 

ALAN GRAYSON, Florida 

ERIC SWALWELL, California 

MARC A. VEASEY, Texas 

DANIEL LIPINSKI, Illinois 

KATHERINE M. CLARK, Massachusetts 

ED PERLMUTTER, Colorado 

EDDIE BERNICE JOHNSON, Texas 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY

HON. BARBARA COMSTOCK, Virginia, Chair 

FRANK D. LUCAS, Oklahoma 

MICHAEL T. MCCAUL, Texas 

RANDY HULTGREN, Illinois 

JOHN R. MOOLENAAR, Michigan 

BRUCE WESTERMAN, Arkansas 

DAN NEWHOUSE, Washington 

GARY PALMER, Alabama 

RALPH LEE ABRAHAM, Louisiana 

LAMAR S. SMITH, Texas 

DANIEL LIPINSKI, Illinois 

ELIZABETH H. ESTY, Connecticut 

KATHERINE M. CLARK, Massachusetts 

PAUL TONKO, New York 

SUZANNE BONAMICI, Oregon 

ERIC SWALWELL, California 

EDDIE BERNICE JOHNSON, Texas 
(III) 

C O N T E N T S 

October 21, 2015 

Page 

Witness List ............................................................................................................. 2 

Hearing Charter ...................................................................................................... 3 

Opening Statements 

Statement by Representative Randy K. Weber, Chairman, Subcommittee on 

Energy, Committee on Science, Space, and Technology, U.S. House of Representatives ........................................................................................................... 8 

Written Statement ............................................................................................ 9 

Statement by Representative Suzanne Bonamici, Minority Ranking Member, 

Subcommittee on Environment, Committee on Science, Space, and Technology, U.S. House of Representatives ............................................................... 10 

Written Statement ............................................................................................ 12 

Witnesses: 

Mr. Brent Stacey, Associate Lab Director for National & Homeland Science 

and Technology, Idaho National Lab 

Oral Statement ................................................................................................. 13 

Written Statement ............................................................................................ 15 

Mr. Bennett Gaines, Senior Vice President, Corporate Services and Chief 

Information Officer, FirstEnergy Service Company 

Oral Statement ................................................................................................. 21 

Written Statement ............................................................................................ 23 

Ms. Annabelle Lee, Senior Technical Executive in the Power Delivery and 

Utilization Sector, Electric Power Research Institute 

Oral Statement ................................................................................................. 32 

Written Statement ............................................................................................ 34 

Mr. Greg Wilshusen, Director of Information Security Issues, Government 

Accountability Office 

Oral Statement ................................................................................................. 41 

Written Statement ............................................................................................ 43 

Discussion ................................................................................................................. 60 

Appendix I: Answers to Post-Hearing Questions 

Mr. Brent Stacey, Associate Lab Director for National & Homeland Science 

and Technology, Idaho National Lab .................................................................. 82 

Mr. Bennett Gaines, Senior Vice President, Corporate Services and Chief 

Information Officer, FirstEnergy Service Company .......................................... 86 

Mr. Greg Wilshusen, Director of Information Security Issues, Government 

Accountability Office ............................................................................................ 88 

Appendix II: Additional Material for the Record 

Statement submitted by Representative Barbara Comstock, Chairwoman, 

Subcommittee on Research and Technology, Committee on Science, Space, 

and Technology, U.S. House of Representatives ............................................... 94 

Statement submitted by Representative Lamar S. Smith, Chairman, Committee on Science, Space, and Technology, U.S. House of Representatives .... 96 
Page

IV 

Statement submitted by Eddie Bernice Johnson, Ranking Member, Committee on Science, Space, and Technology, U.S. House of Representatives .... 98 
(1) 

CYBERSECURITY FOR POWER SYSTEMS 

WEDNESDAY, OCTOBER 21, 2015 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON ENERGY & 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY, 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY, 

Washington, D.C. 

The Subcommittees met, pursuant to call, at 10:04 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. Randy Weber 

[Chairman of the Subcommittee on Energy] presiding. 
2 
3 
4 
5 
6 
7 
8 

Chairman WEBER. Good morning, and welcome to today’s joint 

Energy and Research and Technology Subcommittee hearing examining cyber threats to American energy systems. 

Today, we will hear from an expert panel on the growing threat 

of cyber attacks to the nation’s electric grid. Our witnesses today 

will also provide insight into how industry and the federal government are working together, or maybe in some instances not working together, to anticipate cyber threats, and improve the reliability 

and resiliency of our electric grid against those cyber attacks. 

The reliability of America’s power grid is one of our greatest economic strengths. I like to say, the things that make America great 

are the things that America makes, and how do we do that? With 

an affordable, reliable, dependable electricity supply. 

In my home State of Texas, reliable and affordable power serves 

a population that is increasing by more than 1,000 people a day, 

and it provides power to the energy-intensive industries that drive 

consumption. Texas is by far the nation’s largest consumer of electricity. Keeping the Texas power grid reliable and secure is key to 

continuing this economic growth. 

But as we established in a hearing on broad threats to the power 

supply earlier this year, utilities face significant threats to that 

same reliable delivery of power. Our electric grid is particularly 

vulnerable to growing cybersecurity threats as the grid is modernized, as distributed energy, electric vehicles, and modernized digital 

operating systems create more access points for cyber attacks. And 

while the nation’s industrial control systems for the grid are analog 

systems designed to last for decades, digital IT systems must constantly adapt to combat evolving cyber threats. 

Small-scale cyber and physical attacks to our electric grid are estimated to occur once every four days, and in over 300 cases of significant cyber and physical attacks since 2011, suspects have never 

been identified. Now, let me repeat that. In over 300 cases of significant cyber and physical attacks since 2011, no suspects have 

been identified. 

We often think of cybersecurity and other threats to the power 

grid at a macro scale, but these types of attacks can occur even at 

a local level. In 2011, the Pedernales Electric Co-op, a non-profit 

co-op that serves approximately 200,000 customers north of San 

Antonio, was struck by a cyberattack. While the attack thankfully 

did not disrupt power to consumers, it is a stark reminder that 

threats to the grid are real, and they are not going to go away anytime soon. 

Our nation’s power supply cannot be protected overnight, particularly as utilities struggle to adapt technology to manage a 

growing number of cybersecurity threats. Cyber threats to the 

power grid will continue to evolve, particularly as more interconnected smart technologies are incorporated into the electric grid. 

We call those smart meters back in Texas. And as protective technology improves, so does the capability and creativity of those who 

are conducting those cyber attacks, unfortunately. 

While we cannot predict every method of attack, the federal government can and should play a role in assisting industry with developing new technology and security safeguards. Accordingly, research and development efforts at the Department of Energy are 
9 

focused on providing industry with comprehensive tools to conduct 

internal analysis to identify and address cybersecurity weaknesses 

so that the industry can take the lead in addressing these same 

vulnerabilities. 

That is why testing facilities and cooperative research, like the 

Cyber Security Test Bed at Idaho National Lab, are valuable tools 

to combat cyber threats. At INL, industry can test control systems 

technology in real world conditions, reducing response time and 

risk for future attacks. 

I’d like to say in advance I want to thank the witnesses for testifying before the Committee today. I look forward to a discussion 

about cyber threats to our critical infrastructure, and how the federal government can provide industry with the tools and technology 

necessary to fight the next generation of cyber attacks. 

[The prepared statement of Chairman Weber follows:] 

PREPARED STATEMENT OF SUBCOMMITTEE ON ENERGY

CHAIRMAN RANDY K. WEBER

Good morning and welcome to today’s joint Energy and Research and Technology 

Subcommittee hearing examining cyber threats to American energy systems. Today, 

we will hear from an expert panel on the growing threat of cyber-attacks to the nation’s electric grid. 

Our witnesses today will also provide insight into how industry and the federal 

government are working together to anticipate cyber threats, and improve the reliability and resiliency of our electric grid against cyber-attacks. 

The reliability of America’s power grid is one of our greatest economic strengths. 

In my home state of Texas, reliable and affordable power serves a population that 

is increasing by more than 1,000 people per day, and provides power to the energy 

intensive industries that drive consumption. Texas is by far the nation’s largest consumer of electricity. Keeping the Texas power grid reliable and secure is key to continuing this economic growth. 

But as we established in a hearing on broad threats to the power supply earlier 

this year, utilities face significant threats to the reliability of power delivery. Our 

electric grid is particularly vulnerable to growing cybersecurity threats as the grid 

is modernized, as distributed energy, electric vehicles, and modernized digital operating systems create more access points for cyber-attacks. 

And while the nation’s industrial control systems for the grid are analogue systems designed to last for decades, digital IT systems must constantly adapt to combat evolving cyber threats. 

Small scale cyber and physical attacks to our electric grid are estimated to occur 

once every four days. And in over 300 cases of significant cyber and physical attacks 

since 2011, suspects have never been identified. 

We often think of cybersecurity and other threats to the power grid at a macro 

scale, but these types of attacks can occur even at the local level. In 2011, the 

Pedernales Electric Co-op, a non-profit co-op that serves approximately 200,000 customers north of San Antonio, was struck by a cyberattack. While the attack thankfully did not disrupt power to consumers, it is a stark reminder that threats to the 

grid are real, and are not going away. 

Our nation’s power supply cannot be protected overnight, particularly as utilities 

struggle to adapt technology to manage a growing number of cybersecurity threats. 

Cyber threats to the power grid will continue to evolve, particularly as more interconnected smart technologies are incorporated into the electric grid. 

And as protective technology improves, so does the capability and creativity of 

those conducting attacks. 

While we cannot predict every method of attack, the federal government can and 

should play a role in assisting industry with developing new technology and security 

safeguards. 

Accordingly, research and development efforts at the Department of Energy are 

focused on providing industry with comprehensive tools to conduct internal analysis 

to identify and address cybersecurity weaknesses so that industry can take the lead 

in addressing these vulnerabilities. 
10 

That’s why testing facilities and cooperative research, like the Cyber Security Test 

Bed at Idaho National Lab, are valuable tools to combat cyber threats. At INL, industry can test control systems technology in real world conditions, reducing response time and risk for future attacks. 

I want to thank our witnesses for testifying before the Committee today. I look 

forward to a discussion about cyber threats to our critical infrastructure, and how 

the federal government can provide industry with the tools and technology necessary to fight the next generation of cyber-attacks. 

Chairman WEBER. I now recognize Ms. Bonamici. 

Ms. BONAMICI. Thank you very much, Chairman Weber, for holding this hearing, and thank you to our witnesses for participating. 

As many of you know, October is National Cyber Security Awareness Month, so it’s a fitting time for this hearing today. 

We’re all familiar with the increasing frequency of cyber attacks 

that compromise personal and business information. At the World 

Economic Summit earlier this year, cyber threats made the top 10 

list of the most likely global risks. Lloyd’s of London estimates that 

cyber attacks can cost businesses as much as $400 billion a year. 

What we’re focusing on today is a different kind of cybersecurity. 

It’s about securing the electric grid so that a cyber attack doesn’t 

affect grid operations, which could halt our daily lives and threaten 

our economic security. These attacks often gain entry through an 

information technology system, but, instead of taking corporate 

data, they directly target system operations that can cause havoc 

and chaos. 

In February of this year, an elite group of hackers broke through 

an electric utility’s firewall and gained access to their substation 

controls in just 22 minutes. Luckily the attack was a drill initiated 

at the request of the utility to test their system. But this example 

demonstrates what’s possible. 

The energy sector continues to report more cyber attacks to the 

Department of Homeland Security, more than any other critical infrastructure sector. In just one month the PJM Interconnection, 

which coordinates electricity transactions in 13 states and in D.C., 

experienced 4,090 documented cyber attempts to attack their system. That’s more than five and a half attacks on their electrical 

market system per hour. 

So far, no publically reported cyber events have resulted in an 

electricity outage in the United States but the sophistication of attacks on industrial controls systems is increasing. 

Utilities across our country are advancing energy efficiency 

through smart grids and programs like feed-in tariff systems. As 

we discuss ways to keep the grid safe, we also must be mindful of 

doing so without inhibiting innovation. 

Google, Wells Fargo, and Aetna are exploring ways to leverage 

employee behavior as a tool, instead of a vulnerability, to build a 

more secure system. From understanding how people swipe their 

phones, to the patterns they use when typing on a keyboard or 

walking, a better understanding of behavioral biometrics is opening 

the door to developing more cyber-secure components and processes. The more we understand about human and social behavior, 

the stronger our toolbox. Rather than resting the success of our cybersecurity efforts on programs that require changes in human behavior, we might have better success if we change our technology 

and processes to fit the behavior of people. And the more we under-
11 

stand the behavior of threat actors, the better we can design protections. 

So in addition to building a better technology-based firewall, we 

need to invest in developing a better human firewall. Our weakest 

link and our most resilient asset to meet the dynamic changing 

needs of the cyber arms race is us. 

I thank each of our witnesses for being here today, and I look 

forward to hearing what each of you has to say, and thank you for 

sharing your expertise. 

Thank you, Mr. Chairman. I yield back the remainder of my 

time. 

[The prepared statement of Ms. Bonamici follows:] 
12 

PREPARED STATEMENT OF SUBCOMMITTEE ON ENVIRONMENT

MINORITY RANKING MEMBER SUZANNE BONAMICI

Thank you, Chairman Weber and Chairwoman Comstock, for holding this hearing, and thank you to our witnesses for participating. As many of you know, October 

is National Cyber Security Awareness Month, so it’s a fitting time for this hearing. 

We are all familiar with the increasing frequency of cyber attacks that compromise personal and business information. 

At the World Economic Summit earlier this year, cyber threats made the top 10 

list of most likely global risks. Lloyd’s of London estimates that cyber attacks can 

cost businesses as much as $400 billion a year. 

What we are focusing on today, however, is a different kind of cyber security. It’s 

about securing the electric grid so a cyber attack doesn’t affect grid operations, 

which could halt our daily lives and threaten our economic security. These attacks 

often gain entry through an information technology system, but, instead of taking 

corporate data they directly target system operations that can cause havoc and 

chaos. 

In February of this year, an elite group of hackers broke through an electric utility’s firewall and gained access to their substation controls in 22 minutes. Luckily 

the attack was a drill initiated at the request of the utility to test their system. But 

this example demonstrates what’s possible. 

The energy sector continues to report more cyber attacks to the Department of 

Homeland Security than any other critical infrastructure sector. In just one month 

the PJM Interconnection, which coordinates electricity transactions in 13 states and 

DC, experienced 4,090 documented cyber attempts to attack their system. That’s 

more than five and a half attacks on their electrical market system per hour. 

So far no publically reported cyber events have resulted in an electricity outage 

in the U.S. But the sophistication of attacks on industrial controls systems is increasing. 

Utilities across our country are advancing energy efficiency through smart grids 

and programs like feed-in tariff systems. As we discuss ways to keep the grid safe, 

we must be mindful of doing so without inhibiting innovation. 

Google, Wells Fargo, and Aetna are exploring ways to leverage employee behavior 

as a tool, instead of a vulnerability, to build a more secure system. From understanding how people swipe their phones, to the patterns they use when typing on 

a keyboard or walking, a better understanding of behavioral biometrics is opening 

the door to developing more cyber-secure components and processes. 

The more we understand about human and social behavior, the stronger our toolbox. Rather than resting the success of our cybersecurity efforts on programs that 

require changes in human behavior, we might have better success if we change our 

technology and processes to fit the behavior of people. And the more we understand 

the behavior of threat actors, the better we can design protections. 

So in addition to building a better technology-based firewall, we need to invest 

in developing a better human firewall. Our weakest link and our most resilient 

asset to meet the dynamic changing needs of the cyber arms race is us. 

I thank each of our witnesses for being here today, and I look forward to hearing 

what each of you has to say. 

Thank you, Mr. Chairman, and I yield back my remaining time. 

Chairman WEBER. I thank the gentlelady from Oregon. 

Our first witness today is Mr. Brent Stacey, Associate Lab Director for National & Homeland Science and Technology at that Idaho 

National Laboratory. Mr. Stacey earned his bachelor’s degree from 

Idaho State University. 

Our next witness is Mr. Bennett Gaines, Senior Vice President 

of Corporate Services and Chief Information Officer for FirstEnergy 

Service Company. Mr. Gaines earned his bachelor’s degree in social 

sciences from Baldwin Wallace College and his master’s degree 

from the University of Phoenix. 

Next, we have Ms. Annabelle Lee, Senior Technical Executive in 

the Power Delivery and Utilization Sector for the Electric Power 

Research Institute. Ms. Lee received her B.A. from Stanford University and her master’s degree from Michigan State University. 

And our final witness today is Mr. Greg Wilshusen—is it—— 
13 

Mr. WILSHUSEN. Wilshusen. 

Chairman WEBER. Wilshusen. 

Mr. WILSHUSEN. Yes. 

Chairman WEBER. Okay. So the rest of the Committee is duly notified. Wilshusen, Director of Information Security Issues for the 

Government Accountability Office. Mr. Wilshusen received his 

bachelor’s degree in business administration from the University of 

Missouri and his master’s degree in information management from 

George Washington University School of Engineering and Applied 

Sciences. 

Welcome to all of you, and Mr. Stacey, you are recognized. 

TESTIMONY OF MR. BRENT STACEY, 

ASSOCIATE LAB DIRECTOR FOR NATIONAL & 

HOMELAND SCIENCE AND TECHNOLOGY, 

IDAHO NATIONAL LAB 

Mr. STACEY. Thank you, Chairmen Weber, Chairwoman Comstock, Ranking Member Grayson, Ranking Member Lipinski, and 

distinguished Members of the Committees. I want to thank you for 

holding this hearing and inviting testimony from Idaho National 

Laboratory, also known as INL. 

INL is acutely aware of the important national challenges facing 

critical infrastructure, especially the infrastructure vital to securing our energy supply. For over a decade, INL has developed and 

built capabilities focused on the control systems employed by our 

nation’s critical infrastructure. I’d like to highlight a few examples 

out of many which represent how INL teaming with others has 

contributed to the security of our infrastructure. 

First, the 2006/2007 Department of Homeland Security’s Aurora 

project test, destroying an electrical generator connected to INL’s 

power grid, was significant in proving a cyber-physical vulnerability in the electric power system. 

Second, for DOE Office of Electricity Distribution and Energy Reliability, as the lead laboratory along with Sandia National Laboratory for the National Supervisory Control and Data Acquisition 

Test Bed, INL completed more than 100 assessments on vendor 

and asset owner control systems to identify and resolve cyber 

vulnerabilities. For DHS, INL provides control systems and critical 

infrastructure experts in support of DHS programs including Industrial Control System Cyber Emergency Response Team, or ICS– 

CERT. 

INL remains committed to the complex national security challenges that face our nation. As we lean forward pushing the limits 

of science and engineering for control systems security, we see a 

number of trends that offer insight into the direction for future research and development. These insights include, one, the presumption that a control system is air-gapped is not an effective cybersecurity strategy. This has been demonstrated by over 600 assessments. Intrusion detection technology is not well developed for control system networks. The average length of time for detection of 

a malware intrusion is 4 months and typically identified by a third 

party. As the complexity and interconnectedness of control systems 

increase, the probability increases for unintended system failures of 

high consequence independent of malicious intent. The dynamic 
14 

threat is evolving faster than the cycle of measure and countermeasure, and far faster than the evolution of policy. And fifth, the 

demand for trained cyber defenders with control systems knowledge vastly exceeds the supply. 

In a world in which we are rapidly migrating to the Internet of 

Everything, these insights, and others, highlight a seemingly unmanageable, exponentially increasing burden of vulnerabilities, attack surfaces and interdependencies. 

INL views this burdensome and dynamic cyber-physical landscape, at its most basic level, as a three-tier pyramid of defense. 

The base level is hygiene: the foundation of our nation’s efforts 

composed of the day-to-day measure and countermeasure battle. 

Elements of this level include important routine tasks such as 

standards compliance and patching. The hygiene level is and has 

been primarily the role of industry. The second level of the pyramid 

is advanced persistent threat composed of the more sophisticated 

criminal and nation-states’ persistent campaigns. This requires a 

strategic partnership with industry and government. At this level, 

ICS–CERT provides critical surge response capacity and alerts. At 

the top of this pyramid are the high-impact low-frequency events: 

catastrophic and potentially cascading events that will likely require substantial time to assess, respond to, and recover from. This 

level is primarily the responsibility of government. 

At INL, we are focusing our future research on the top two levels, striving for a 2- to four-year research-to-deployment cycle. Our 

objective with this research is to achieve transformational innovations that improve the security of our power infrastructure by reducing complexity, implementing cyber-informed design, and integrating selected digital enhancements. 

In conclusion, I’d like to thank the Committee members for this 

opportunity to share our insights into the capabilities, experiences, 

and vision for cybersecurity and the protection of our nation’s 

power grid. Your interest in understanding cybersecurity threats 

with an emphasis on the reliability of our national power grid is 

commendable and gives me confidence that there is strong support 

from our legislators for research leading to innovative solutions. 

One of my intentions today is to instill reciprocal confidence that 

INL, in concert with DOE and DOE laboratories, will continue to 

apply our intellectual talent and research to address these challenges. 

In honoring the time allotted for my statement, I request that 

my full written statement be entered into the record. Thank you. 

Chairman WEBER. Without objection, so ordered. 

[The prepared statement of Mr. Stacey follows:] 
15 
16 
17 
18 
19 
20 
21 

Chairman WEBER. Mr. Gaines, you’re up. 

TESTIMONY OF MR. BENNETT GAINES, 

SENIOR VICE PRESIDENT, 

CORPORATE SERVICES AND 

CHIEF INFORMATION OFFICER, 

FIRSTENERGY SERVICE COMPANY 

Mr. GAINES. Good morning, Chairman Weber and Members of 

the Committee. I am Bennett Gaines, Senior Vice President, Corporate Services, Chief Information Officer for FirstEnergy. Our 10 

operating companies serve 6 million electrical customers in six 

states, and we control an interconnected network of power plants, 

transmission lines and distribution facilities. I am responsible for 

providing information technology services, ensuring the security of 

the company’s physical and cyber assets. 

Over the past few years, FirstEnergy has worked with the Department of Homeland Security, the Department of Energy, and 

Congress, sharing steps we are taking to address cyber threats as 

well as developing partnerships with the federal government in 

these efforts. 

In 2013, FirstEnergy was one of only a handful of utilities that 

entered into a cooperative research and development agreement, or 

CRADA, with Homeland Security, a relationship that has proven 

valuable to both us and the federal government. In 2014, we began 

working directly with the Department of Energy as one of the first 

utilities to deploy the Cybersecurity Risk Information Sharing Program, or CRISP, tool. We strongly believe that sharing this information of critical information is essential and should be actively 

supported moving forward. The fact is, although the cybersecurity 

efforts of electric utilities have been effective in addressing threats 

to date, we need to continually strengthen and build on these efforts to ensure they are up to the task of meeting the future cyberrelated challenges. 

Operational and technical advances have created roader surfaces 

that are more vulnerable to attacks. Companies continue to integrate remote access, mobile devices that increase exposure. Highvalue targets such as Supervisory Controlled Data, Acquisition, or 

SCADA systems, further entice attackers to take advantage of an 

organization. 

Cyber attacks are on the rise, and the behavior of cyberterrorists 

has become increasingly destructive. Many companies are doing an 

excellent job with prevention through layer defense, real-time alerting, operational monitoring, security awareness training, and other 

proven tactics. However, in light of today’s threats and 

vulnerabilities, we need to focus more of our attention on getting 

ahead of the threats rather than simply reacting to the threats. 

Toward that end, we need to take aggressive steps to mitigate 

vulnerabilities and minimize the damage and business losses that 

could result from potential compromises. 

At FirstEnergy, we’re evaluating cyber threats to our communications network by integrating more traditional data regarding 

physical access systems and the status of equipment and health 

and on our power systems. This process, called Threat Intelligence 
22 

Management, or TIM, provides a more comprehensive system-wide 

consistent picture that our Security Operations Center can use to 

improve our response to cyber attacks. While any information can 

be shared, it also must be aggregated, correlated, analyzed and distilled to be relevant and actionable. By supporting these essential 

functions, TIM helps us maintain a critical infrastructure that is 

both highly secure and resilient. The program analyzes a constant 

flow of information from every corner of the system to anticipate 

and detect threats. This data can be shared among government and 

industry partners to enhance awareness of threats and provide 

more warning information to better mitigate attacks. 

Simply put, TIM offers a better platform for information sharing. 

The program not only helps us better identify and analyze threats 

and attacks, it also supports more effective information sharing 

and great collaboration among all stakeholders. This results in 

more threat indicators, improved security, greater resilience of critical infrastructure, and ultimately more effective collaboration between industry and government. 

Finally, the TIM program provides enhanced visibility of the enterprise overall security posture. This is accomplished by coordinating the monitoring of cybersecurity, physical security, information technology, and operational technologies. Advanced analysis of 

these functions provide early warning of security incidents and 

rapid mitigation of vulnerabilities. 

In closing, we must continually improve our cybersecurity systems and processes to stay ahead of the bad actors. To give you a 

greater sense of the size and scope of the problem, I simply point 

out that during my brief time here today, FirstEnergy probably has 

defended itself from at least four cyber attacks. 

As you consider where to focus our efforts moving forward, I urge 

you to look towards greater research and funding in this area with 

a focus on aggregating, correlating, analyzing and distilling information in order to be relevant and actionable. I strongly believe 

that one of the best ways to achieve this goal is through an effective threat intelligence management program. 

Thank you very much for the time. 

[The prepared statement of Mr. Gaines follows:] 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 

Chairman WEBER. Thank you, Mr. Gaines. 

Ms. Lee, you’re now recognized. 

STATEMENT OF MS. ANNABELLE LEE, 

SENIOR TECHNICAL EXECUTIVE IN THE 

POWER DELIVERY AND UTILIZATION SECTOR, 

ELECTRIC POWER RESEARCH INSTITUTE 

Ms. LEE. Good morning, Chairmen and Members of the Subcommittees. 

The Electric Power Research Institute is an independent, nonprofit organization and conducts research and development relating 

to the generation, delivery, and use of electricity for the benefit of 

the public. 

The nation’s power system consists of both legacy and next-generation technologies. New grid technologies will operate in conjunction with legacy equipment that may be several decades old and 

provide new security controls. 

Traditional information technology—IT—devices typically have a 

lifespan of 3 to five years, and historically, IT has included computer systems, applications, communications technology and software typical for a business or enterprise. In contrast, operational 

technology, or OT, devices, have a lifespan of up to 40 years or 

longer and have historically focused on physical equipment technology that is commonly used to operate the energy sector. 

There’s some basic differences between the security requirements 

for IT and OT systems. For example, the focus for IT systems is 

confidentiality of information such as customer energy usage and 

privacy information. The focus for OT systems is availability and 

integrity to ensure that the reliability of the grid is maintained 

even in the event of a cybersecurity incident. 

With the increase in the use of digital devices and more advanced communications and IT, the overall attack surface has increased. These new devices include commercially available components as an alternative to proprietary solutions that are specific to 

the electric sector. Many of the commercially available solutions 

have known vulnerabilities that could be exploited when the solutions are installed in OT devices. 

The electric sector is addressing these attacks with various mitigation strategies. Cybersecurity must be included in all phases of 

the system development lifecycle and address deliberate attacks 

launched by disgruntled employees and nation-states as well as 

non-malicious cybersecurity events, for example, user errors or incorrect documentation. 

Risk assessment is a key planning tool for implementation of an 

effective cybersecurity program. EPRI, in conjunction with utilities, 

researchers, and vendors, developed a risk assessment methodology 

that is based on a typical IT methodology with impact and likelihood criteria that are specific to the electric sector. This work was 

performed as part of the National Electric Sector Cybersecurity Organization Resource, or NESCOR for short, project, DOE funded 

public-private partnership. Several utilities are implementing mitigation strategies at the enterprise level. One example is an Integrated Security Operations Center, or ISOC for short. An ISOC is 

designed to collect, integrate and analyze alarms and logs from tra-
33 

ditionally siloed organizations, providing much greater situational 

awareness to the utility’s security team. 

Two documents specifically address the electric sector and provide mitigation strategies. Both documents are used worldwide. 

The first is the National Institute of Standards and Technology 

Interagency Report Guidelines for Smart Grid Cyber Security. The 

development was led by NIST with a team of roughly 150 volunteers. A second document is the Electricity Subsector Cybersecurity 

Capability Maturity Model, which allows electric utilities and grid 

operators to assess their cybersecurity capabilities and prioritize 

their actions and investments to improve cybersecurity. Many utilities and EPRI map their R&D programs to the domain specified in 

this maturity model. 

With the modernization of the electric grid, new technologies and 

devices have been deployed to meet our current and future electric 

sector needs. With this new functionality comes new threats including cybersecurity threats. To take advantage of the new technology, 

these threats must be addressed. 

This concludes my statement. 

[The prepared statement of Ms. Lee follows:] 
34 
35 
36 
37 
38 
39 
40 
41 

Chairman WEBER. Thank you, Ms. Lee. 

Mr. Wilshusen, you are recognized for five minutes. 

STATEMENT OF MR. GREG WILSHUSEN, 

DIRECTOR OF INFORMATION SECURITY ISSUES, 

GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. WILSHUSEN. Chairman Weber, Representative Bonamici, and 

other Members of the Subcommittees, thank you for the opportunity to testify at today’s hearing on efforts by federal agencies 

and industry to mitigate cybersecurity threats to the U.S. power 

systems. 

As you know, the electric power industry is increasingly incorporating information and communications technologies into its existing infrastructure. The use of these technologies can provide 

many benefits such as greater efficiency and lower cost to consumers. However, if not implemented securely, modernized electricity grid systems will be vulnerable to attack and that could result in loss of electrical services essential to maintaining our national economy and security. 

Today, I’ll discuss actions taken and required to bolster cybersecurity of the nation’s power systems. Before I begin, if I may, I’d 

like to recognize several members of my team who were instrumental in developing my statement and performing the work underpinning it. With me today is Mike Gilmore, an Assistant Director, and Brad Becker, who led this effort. In addition, Lee 

McCracken, John Ludwigson, and Scott Pettis also made significant contributions. 

In 2011, we reported on a number of challenges that industry 

and government stakeholders faced in securing smart grid systems 

and networks against cyber threats. These challenges included taking a comprehensive approach to cybersecurity, ensuring that 

smart grid systems had built-in security measures, monitoring implementation of cybersecurity standards and guidelines, effectively 

sharing cybersecurity information, and establishing cybersecurity 

metrics. 

Since then, FERC has acted to implement our recommendations 

to assess these and other challenges in its ongoing cybersecurity efforts. However, it did not implement our recommendation to coordinate with state regulators and other groups to periodically evaluate 

the extent to which utilities and manufacturers are following voluntary cybersecurity guidelines. 

Other entities have acted to improve cybersecurity in the sector. 

For example, NERC has issued updates to its critical infrastructure 

protection standards for cybersecurity and has hosted an annual 

conference on grid security. In 2014, NIST updated its smart grid 

cybersecurity guidelines to address the threat of combined physicalcyber attacks. NIST also issued a framework for improving critical 

infrastructure protection and cybersecurity. The framework is intended to provide a flexible and risk-based approach for entities including those within the electricity subsector to protect their vital 

assets from cyber threats. 

The Departments of Homeland Security and Energy have efforts 

underway to promote the adoption of the framework by critical infrastructure owners and operators. These departments have also 
42 

developed cybersecurity risk management approaches and tools 

that are available for use by the electricity subsector. 

Nevertheless, given the increasing use of information and communications technologies to operate the electricity grid and other 

areas, continued attention to these and other areas is required to 

help mitigate the risk these threats pose to the electricity grid. 

In particular, assuring that security features are built into smart 

grid systems and that a comprehensive approach to cybersecurity 

is taken whereby utilities employ a defense in depth strategy based 

on sound risk management principles will be essential. Effectively 

sharing cyber threat vulnerability and incident information among 

federal, state and local governments as well as the private sector 

stakeholders in a timely manner is imperative to provide utilities 

with the information they need to protect their assets against cyber 

threats. 

Additionally, an effective mechanism for monitoring the implementation and effectiveness of the cybersecurity policies, practices 

and controls over U.S. power systems is paramount to ensure the 

resiliency and security of the electricity grid. 

To summarize, more needs to be done to meet the challenges facing the industry in enhancing security. Federal regulators and 

other stakeholders need to work closely with the private sector to 

address cybersecurity challenges as the generation, transmission 

and distribution of electricity come to rely more on emerging and 

interconnected technologies. 

Chairman Weber and Members of the Subcommittee, this concludes my statement. I’d be happy to answer your questions. 

[The prepared statement of Mr. Wilshusen follows:] 
43 
44 
45 
46 
47 
48 
49 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 

Chairman WEBER. Thank you, Mr. Wilshusen, and I now recognize myself for five minutes of questions. Wow, where do we start? 

Mr. Gaines, the Department of Energy’s Office of Electricity 

works with electric utilities on information sharing and encouraging utilities to learn from the challenges faced by their regional 

counterparts. The Department of Homeland Security also operates 

programs to facilitate the information sharing you referred to in 

your comments. What information do you feel is most important to 

share with each other and for the industry to share with regulators, and the third part to my question really is, in your comments I think you said information had to be actionable. 

Mr. GAINES. Correct. 

Chairman WEBER. Define what you mean by ‘‘actionable.’’ Let me 

reiterate. What information do you feel is most important for industry to share with each other and then to share with the regulators? It may be one and the same. And then define ‘‘actionable 

information’’ for us. 

Mr. GAINES. I’ll start out with your first questions in that we 

have spent the last two years working directly with both agencies 

and within the confines of the programs that they have, which are 

the CRISP tool and the enhanced cybersecurity tool, and they are 

very effective. The difficulty of both of those tools, they’re historical; they look back. They don’t look at real-time incidents, and in 

some cases, there can be a lag between three to six months from 

when an incident occurred. It’s not correlated on a timely manner 

as to what is going on with the rest of the industry so that we can 

take action on those events, and in some cases, you could have a 

dormant piece of malware sitting in your environment that you 

didn’t take action on but that was alerted months earlier. 

As it relates to actionable, it’s having real-time information, and 

a technical term—I don’t want to lose you—is the actual threat actors’ IP address and the specific information that’s time-framed 

within that window. An illustration of that would be—— 

Chairman WEBER. You’re not losing me. I was wondering about 

that earlier when you said up to 4 months since 2011, 300 attacks, 

and no suspects. 

Mr. GAINES. That’s correct. 

Chairman WEBER. Go ahead. 

Mr. GAINES. And that is the difficulty is that by the time the 

actor penetrates your environment, they’re not the actor that you 

see. There’s an alias that sits behind that wall and the difficulty 

is following that breadcrumb back to the original source, and one 

of the difficulties that we have in the industry is, is the information 

we get from the federal government is not timely, and so for us to 

take action on something that really we have no control over is 

very difficult. My suggestion would be to reverse that, is for us to 

provide across the industry real-time incidents, and it’s doable, and 

to be able to track not only the source but the actual follow-on activity that occurs from that event. 

One of the things that we don’t do is we don’t do a good 

diagnostics of what happens once the event occurs, and we move 

on to the next one. 

Chairman WEBER. Let me jump over to Mr. Wilshusen. You 

talked about having conferences, I think, you met around the coun-
61 

try, probably industry and I presume government as well. How 

often are those conferences held and how many attendees, and 

should we increase that frequency and are they sharing that information? 

Mr. WILSHUSEN. Well, what I referred to were conferences that 

were being held by NERC, which is the North American Electric 

Reliability Corporation, and they hold those annually, but to the 

extent that Mr. Gaines talked about in providing useful, actionable 

information in a timely manner, annual is not enough. They do 

talk about different threats—— 

Chairman WEBER. It would almost have to be daily or weekly. 

Mr. WILSHUSEN. Much more frequently. This has been—— 

Chairman WEBER. Absolutely. 

Mr. WILSHUSEN. Right. This has been—— 

Chairman WEBER. I’m talking about the sharing of the information. 

Mr. WILSHUSEN. Right, the sharing of the information, particularly between federal government and the private sector and even 

among private sector entities has been a longstanding problem and 

a challenge throughout all critical infrastructure sectors including 

the, electricity subsector. What we have found in the past is that 

there have been certain obstacles to doing that including from the 

government sector to private sector, making sure that those individuals at the private sector had the appropriate security clearances—that’s been a challenge—as well as having a secure mechanism to share that information timely. 

Chairman WEBER. Is there one office that oversees what you’re 

describing? Is there one office within your agency, for example, that 

oversees that? Who oversees that? 

Mr. WILSHUSEN. Well, overall, DHS has a responsibility across 

federal government for taking the lead in the—— 

Chairman WEBER. So does DHS—you may not know this—forgive me for interrupting, but does DHS have one office that allocates their time and manpower and resources to just this cybersecurity for energy companies alone? Do you know? 

Mr. WILSHUSEN. Well, it does have a group that’s responsible 

overall but the Department of Energy, known as the sector-specific 

agency, also has responsibility for interacting with the energy sector to include the electricity sector for sharing information and assisting that sector in securing its systems. 

Chairman WEBER. I am running out of time, but I have one last 

question. So what could be done better to help streamline this process? 

Mr. WILSHUSEN. Well, one of the requirements under the Executive Order 13–636 is for agencies and particularly I think it’s DOD 

and perhaps DHS to come up with a mechanism that will allow for 

faster sharing of information to the private sector. 

Chairman WEBER. All right. Thank you. 

I’m over time, and I yield to the gentlelady from Oregon. 

Ms. BONAMICI. Thank you very much, Mr. Chairman, and thank 

you to the witnesses for bringing your expertise on an important 

issue. 

I also serve on the Education and Workforce Committee, and I’m 

going to focus at first on some of the workforce issues making sure 
62 

that we have the workforce that we need to continue to address 

this serious issue, and I know Mr. Stacey, you said that the demand for trained cyber defenders with control systems knowledge 

vastly exceeds the supply. 

Now, my alma mater, the University Of Oregon, has just created 

an Oregon Center for Cybersecurity and Privacy. They received a 

federal—some federal funding, and a Center of Excellence designation, and they plan to begin enrolling students by next summer. 

But how can we incentivize more universities to support educating 

this workforce, and once we have a strong pipeline of students and 

get them into the workforce, how can we attract them to public 

service and government jobs when typically the private sector 

would pay more and be perceived as more innovative? 

So I’ll start with Ms. Lee and also ask Mr. Wilshusen and anybody who wants to weigh in. 

Ms. LEE. As I noted in my statement, I previously was in the federal government for 14 years. I think one of the real advantages 

of working in the federal government is the kind of work you can 

do and the impact that you have. I mentioned the guidelines for 

smart grid cybersecurity products that we developed. There were 

150 volunteers from around the world that participated in developing that document. These were senior-level people literally 

around the world. I kept getting asked, do you pay these people, 

and my response was no, these are volunteers. I think one thing 

in the federal government and working with the federal government for several decades, you can have an impact and influence 

that you don’t have anywhere else, and to me, that’s a real benefit 

for working in the public sector. Private sector does compete. It is 

difficult now. There’re very few—as mentioned earlier, there are 

not significant numbers of people who are in cybersecurity, and 

those who focus on control systems, and as I mentioned, there are 

some basic differences between cybersecurity for control systems 

and our IT systems. That community is even smaller. We need to 

beef up that workforce. There are controls that you don’t put on OT 

systems that are typical on IT systems, and we need to—we definitely need to grow this area. 

Ms. BONAMICI. And do you agree with Mr. Stacey that there’s a 

serious need, that we don’t have the workforce? 

Ms. LEE. We don’t have the workforce. 

Ms. BONAMICI. I want to follow up because I know the U of O 

Center is going to be working with the faculty from several different departments including computer and information science, 

philosophy, business, law. What role—you talked about the role of 

human behavior but how can we really capitalize on understanding 

human behavior to deal with the threats, and also hopefully to be 

out in front and prevent them. 

I’ll open it up to the panel. Ms. Lee, do you want to start? 

Ms. LEE. As you mentioned, I think human behavior is very important. Historically—and I’ve been doing cybersecurity now for almost three decades—the solution was, have longer passwords, and 

so what does everybody do? They write them down because you 

can’t remember 12- or 15-character passwords that you have to 

change every 3 or 4 months. 

Ms. BONAMICI. We’ve all done that. 
63 

Ms. LEE. Yeah. You write them down. That’s the only way you 

can remember them. Is to look at cybersecurity and the solution 

has to be yes, we need to figure it out. As I say, it’s a messy environment. 

If you look at the reality of cybersecurity, the devices that are 

out there, the controls you may need to implement. you can’t do. 

You either can’t afford them or they affect the performance. You 

need to figure out the solutions. And I think that’s the direction 

that cybersecurity needs to go. Historically—— 

Ms. BONAMICI. Thank you. I need to get a couple more questions 

in. 

Mr. Gaines, you talked about the TIM, the Threat Intelligence 

Management. That seems like a sound approach. What are the barriers to improving and expanding that approach? 

Mr. GAINES. The barriers are twofold. One, there are limitation 

that industry has today in communicating with the government 

vulnerabilities, and that is a real challenge in that we are limited 

to some extent because we hold the liability if there’s a breach or 

vulnerability to the network. I think that needs to looked at and 

in some cases eliminated so that we can share openly very specific 

information about vulnerabilities. 

The second is, is the actual technologies themselves. Today, we 

are one of only two utilities that have a completely integrated security operation center, and Ms. Lee spoke about that center. It’s a 

center that we integrate the physical, being badge access, building 

access. We integrate the IT, being the cyber component, and we integrate the operational, the SCADA systems together. All three of 

those systems are actually monitored, reviewed, and we take actions against events, and I’ll use a simple analogy so you can understand—— 

Ms. BONAMICI. I’m afraid my time’s going to expire. Can I just 

have a few more seconds, Mr. Chairman? 

Chairman WEBER. Without objection. 

Ms. BONAMICI. I want to get in a quick question for Mr. 

Wilshusen. You mentioned in your testimony that FERC was 

adopting standards from NIST’s efforts but according to FERC officials, the statute did not provide any authority to allow FERC to 

require the smart grid technologies to follow the standards and 

now it’s voluntary. How’s that working? 

Mr. WILSHUSEN. Well, it is voluntary. One of the problems that 

we noted is that FERC has not—because the standards are voluntary and have not been adopted, it has not gone out to examine 

the effectiveness or the extent to which those voluntary standards 

have been implemented. 

Ms. BONAMICI. Thank you, and I’m very over time. 

Thank you, Mr. Chairman. Yield back. 

Chairman WEBER. No problem. 

And now the Chairman is pleased to recognize for his first appearance in a hearing in this Committee, the gentleman from Illinois, Darin LaHood. Welcome. 

Mr. LAHOOD. Thank you, Mr. Chairman, very much. I appreciate 

it. Great to be part of this Subcommittee. 

I want to thank the witnesses for your testimony this morning. 
64 

I guess, Mr. Stacey, I wanted to just maybe see if you could highlight a couple examples of cyber attacks that maybe recently happened where systems have been compromised and maybe the cost 

to a particular company and how it affected citizens or customers. 

Mr. STACEY. Yes. Two of the most recent are BlackEnergy and 

Havex attacks. These have been to the human-machine interface 

associated with the industrial control systems. Near as we can tell, 

those are primarily associated with collecting information, trying to 

map out systems and see what they look like, although the payloads on those are dynamic. There’s been a very active response 

from DHS on this along with other entities, in fact, traveling 

around the country in briefings with the FBI and notifying people 

about that. 

As far as the costs associated with individual utilities in mitigating that, I don’t have insight into that, but I know the federal 

government and the laboratory took a very aggressive stance on notifying and making people aware of those particular malware. 

Mr. LAHOOD. And I guess as a follow-up maybe to Mr. Gaines, 

when we talk about cybersecurity and talk about really what these 

entities are engaged in is criminal activity, when we talk about deterring that, I mean, are there currently any active prosecutions by 

the federal government, either the U.S. Attorney’s Office or anybody that we can kind of use as examples to deter this behavior? 

Mr. GAINES. I don’t—I’m not aware of any criminal activity so I 

say that. I do know that there have been incidents that have been 

nation-state and/or in some cases domestic that probably warrant 

the investigation of that. A good example of that would’ve been the 

Metcalf incident that occurred in southern California in 2013. That 

substation lost 17 transformers. There were 127 rounds of ammunition that was shot into the substation and power had to be rerouted. 

To the Chairman’s point, though, that actor has not—and/or actors have not been found, and the evidence obviously is very clear 

that it was multiple actors very potentially. 

But to the extent that there has been prosecution, that has not 

occurred, to my knowledge. 

Mr. LAHOOD. And on that specific case with Metcalf, is there an 

ongoing investigation to try to determine who the perpetrator was? 

Mr. GAINES. There absolutely is, and following that incident, 

FERC issued a number of standards on physical security that the 

industry is now implementing, and a lot of that has to do with both 

the monitoring both of the physical asset and the cyber asset, and 

so we’ve learned from an industry but to the extent that we’ve seen 

that replicated or duplicated in industry, it has not. 

Mr. LAHOOD. In terms of becoming aware when a system is compromised, walk me through a little bit of, if a company is compromised, the reporting on that in terms of to the federal government. Is that something that’s made public, or who’s the repository 

of threats or compromises that happen, and then how does that get 

made public or is there some secrecy involved with that? I mean, 

I guess what I’m getting at, do companies, you know, in a competitive marketplace not want people to be aware that their systems 

were compromised for vulnerabilities? How is that addressed? 
65 

Mr. GAINES. I’ll give you a real-life example. At 11 o’clock yesterday afternoon, our systems were attempted to be penetrated by a 

denial of service, so they’re flooding your network. That flooding of 

the network slows down your network, and at that point we pick 

it up on our firewalls, we shut the traffic down, and then we do 

forensics on that. Within an hour, we report that to the ES ISAC. 

That ISAC is our sector group that we use to facilitate that type 

of information. Now, I go back to my original point that I made 

earlier. That happened to me. I venture to say that that same actor 

was scanning other networks and that that same DDoS attack was 

being attempted. At 4 o’clock, we get an acknowledgement back 

from the government that they received the information. As of 11 

o’clock, 24 hours later, I still don’t have a response back from the 

government. 

There’s a good example of the timeliness of information. If we 

could share that information real time within the industry, think 

about the potential of being able to collaborate very quickly and 

take action because most likely that actor has shut down their 

server and they’ve moved on, and so we have no time again to take 

any reasonable mitigation steps. The good news is, our security 

systems worked. To the extent that that threat I reported gets communicated, it does get communicated. Most likely it’ll be a few 

months from now. It’ll be watered down, and the real sad part 

about it is, it doesn’t have the level of detail to take any action on 

it. 

Mr. LAHOOD. Thank you. 

Thank you, Mr. Chairman. 

Chairman WEBER. Thank you. 

And before I go to the gentleman from New York, if I can just 

take one second here, so what you just described, Mr. Gaines, gets 

back to those conferences. If you could come in with that kind of 

information in real time to everybody that was in a like business 

and say expect this kind of attack, is that a doable deal? 

Mr. GAINES. I would—if I may—— 

Chairman WEBER. Sure. 

Mr. GAINES. I would argue slightly different. I have security 

clearance, and to the gentleman’s point, Homeland Security does 

offer briefings to those that have security clearance. They’re nonindustry-specific so they can be across any sector. And ironically, 

the same approaches that an actor uses in finance is very similar 

to an attempt that they would use in our industry. That’s still not 

soon enough. Those briefings occur once every three months. 

Chairman WEBER. But is there no platform to broadcast this information industry-wide? And let’s be energy industry specific. Is 

there no platform for that? 

Mr. GAINES. There is. My point being is, it’s not timely enough. 

There is, and it’s a very good tool. It’s not timely enough and it’s 

not detailed enough. 

Chairman WEBER. All right. Thank you. 

I appreciate the gentleman from New York’s indulgence. You’re 

recognized. 

Mr. TONKO. Thank you, Mr. Chairman. 

Welcome to our panelists. 
66 

The line between federal and state power has historically been 

drawn at the intersection between the high-voltage transmission 

system and the lower-voltage distribution system. However, the relevance of this distinction is less clear when it comes to cybersecurity, and Ms. Lee, you addressed some of that with the new technologies, but to both you and Mr. Gaines, Ms. Lee and Mr. Gaines, 

could the increase of smart grid and distributed energy technologies being deployed on the electrical distribution system increase those cybersecurity risks to the high-voltage transmission 

system. 

Ms. LEE. As I said in my statement, the increase in technology 

and the inclusion of IT and communications, the new technology, 

yes, that does increase the potential for cybersecurity events. I will 

add another one, and that is the interconnection of these systems. 

If we look at the new technology, our distributed energy resources, 

renewable devices where you transmit the electricity that may be 

generated in one state to another state, all of that increases the attack surface and the potential for cybersecurity events. 

On the other side, utilities, reliability is number one. Cybersecurity should support the reliability of the grid, and there are a number of tools and techniques that the electric sector has been using 

for decades to address reliability that can also be used to address 

cybersecurity. This is not a totally foreign area, and so it’s taking 

advantage of what they’re currently doing, and then looking at the 

techniques and technologies that the IT community uses to address 

these new threats. 

Mr. TONKO. Thank you. 

And Mr. Gaines, do you also concur that it increases risk here? 

Mr. GAINES. If I may, not to differ, I might add a different perspective—— 

Mr. TONKO. Okay. 

Mr. GAINES. —if I could, please? The distribution system and 

transmission system are two separate systems. The distribution 

system is a regional, local system and smart grid and/or tied to 

that smart grid is a meter. That’s an individual IP address. It’s an 

individual computer. Think of it like that. There are securities 

around that through a certificate and encryption, and in our design, that particular meter is not tied into our core distribution system. We have what we call a head-in system that sits outside of 

our company. 

So I would suggest to you that from a smart meter and smart 

grid perspective, the design and construct of that is secure. Is there 

a risk in our cases in Pennsylvania? We have two million customers, and I’m convinced given enough time with a bad actor, 

they could figure out how to be destructive with that. But to the 

extent that our design and configuration within the industry and 

our design and configuration is very similar to most smart grids 

and the technology is very similar. So there’s a risk but I don’t see 

it as a huge threat. 

Mr. TONKO. And no specific recommendations you would make to 

address that increased risk, either of you? 

Mr. GAINES. I would—the gentleman, Mr. Stacey, made some 

very good points. I think good hygiene is important, good engineering is important, and constant management. These devices are now 
67 

computers and so they have to be maintained. They don’t have the 

life of an existing meter, which is 20 to 30 years. These devices 

have a life of between five to seven years, and so the challenge that 

the industry is making sure they maintain their smart grid environment, not neglect it. 

Mr. TONKO. Ms. Lee? 

Ms. LEE. There are things that the industry, as Mr. Gaines said, 

is doing, and I mentioned in my testimony all utilities do risk assessments. They need to prioritize their system, prioritize the risks 

and vulnerabilities, and then make decisions about which ones they 

want to mitigate. They do not have unlimited resources. Utilities 

deal with many areas of risk. Cybersecurity is one area. And they 

need to prioritize and determine what they want to do for their 

mitigation strategies and then make decisions that way. 

Mr. TONKO. There was some exchange—thank you. There was 

some exchange over the role of forensics in cybersecurity. What do 

we need—this is to all of you. What is needed to adequately conduct a forensic analysis after a cyber event? What are the best—— 

Mr. GAINES. Directed to me, sir? 

Mr. TONKO. Any of the four. 

Mr. GAINES. Two things. First of all, there needs to be—I go back 

to what we can share and what we cannot share with the government during an incident. That’s a—there’s a lag that occurs there. 

If I have a major incident in my environment, I have to report that 

to several agencies. That can be days or weeks in some cases. Secondly, once we determine it truly was a cyber incident, then I have 

to put together a full investigative report, and then it goes through 

a very lengthy process of determining the actual degree or significance of that. I suggest to you that we cut all that or most of that 

away, and that if I truly know that I’ve been breached inside of my 

network, I think there’s an obligation that we work much closer 

with the federal government on a real-time basis of defining the 

problem first and then let’s go assess the penalties or determine 

who was at fault later, and that lag at times can be weeks and 

months before we actually get into the real forensics and do the 

real what I think are important things are mitigating it. And more 

importantly, that information is not shared with the industry in 

some cases for a year. 

Mr. TONKO. Thank you very much. 

Mr. Chair, I yield back. 

Chairman WEBER. I thank the gentleman. 

And now the gentleman from Arkansas, Mr. Westerman, is recognized for five minutes. 

Mr. WESTERMAN. Thank you, Mr. Chairman, and thank you, 

panel, for your insight today. 

Mr. Wilshusen, I’ll direct this question to you, but others may 

wish to add in on it. I’ve visited several power-generating facilities, 

and I was pleased to find out that the control systems inside the 

power plants are totally isolated from the outside world in the facilities I’ve visited, so the chance of a cyber attack on the actual 

generating facilities is pretty much mitigated unless a bad actor 

got into the facility and messed with the control system, which 

could cause a huge issue. So when we’re talking about a cyber attack, what physically are the risks there since these power plants 
68 

are basically just getting a demand signal from the grid? What 

kind of destruction do you anticipate could happen from a cyber attack? 

Mr. WILSHUSEN. Well, first of all, I would first ask about your 

premise that the industrial control systems networks are indeed 

isolated and separated from other external networks or company 

communications networks. What we have found and what I have 

seen reported through ICS–CERT and others is that often companies believe their industrial control systems networks may be airgapped, if you will, but are surprised to find when in fact they are 

not. With the increasing introduction of information and communications technologies, we’re finding, increasingly, that these networks are indeed interconnected with other networks. That’s one 

thing. But given that, if they are air-gapped, it does provide an additional level of security certainly to where remote access may not 

be available and where an attacker may have to have physical access to the device. But to be sure that’s something that if they are 

air-gapped, that is an improvement and a control over it, but—and 

that’s what has been historically but increasingly we’re finding on 

what’s being reported is that they are being interconnected with internal and external networks, thereby as Ms. Lee mentioned, increasing the attack surface and increasing the likelihood of a potential incident over those industrial control systems networks. 

Mr. WESTERMAN. So is that the main concern with cyber attacks 

is getting into those power-generating facilities’ control systems or 

is it more to protect the distribution and transmission systems? 

Mr. WILSHUSEN. Well, I think you have that probably at multiple 

sections throughout the entire electricity grid, depending upon 

where the control systems or the sensors are located. If they are 

indeed interconnected to external networks, there’s an increased 

likelihood that they may be vulnerable to attack if they’re not sufficiently hardened. Of course, there are actions that an entity can 

take to better secure those connections and to better secure those 

devices. If those are being done, that will help, but historically, 

that always hasn’t been done for a number of reasons. 

Mr. WESTERMAN. It just seems like it would be a good operating 

protocol to have those industrial control systems isolated from the 

outside world as far as having the best way to keep a cyber attack 

from happening on one of those facilities. 

Mr. WILSHUSEN. Yes, that’s correct, but often they’re interconnecting in order to provide greater efficiency and usefulness, if 

you will, and so there’s always that balance, but yes, it would be 

better from a security perspective to keep them isolated. 

Mr. WESTERMAN. So when we talk about the role that smart grid 

technology plays in creating cyber vulnerabilities, does the fact that 

the smart grid relies on two-way communication make the grid 

more susceptible to cyber attacks, and if so, how is that? 

Mr. WILSHUSEN. Well, potentially, and that would be as Mr. 

Gaines mentioned more at the distribution level rather than the 

power-generating and transmission level where there could be attacks against individual smart meters. Indeed, I believe there have 

been reported attacks against smart meters, but more for the purpose of committing fraud and addressing some of the programming 

that is in those smart meters, but the threat potentially is, and 
69 

again, absent other controls that may now be in place, is that collectively as millions of smart meters out there could that have an 

impact on the larger electricity grid, and that’s something that 

there potentially could. 

Mr. WESTERMAN. And when you talk about smart meters, are 

you talking about the meters that give the feedback or just the 

ones that the meter reader can drive through the neighborhood and 

read the meters without getting out of the vehicle? Are those—— 

Mr. WILSHUSEN. Yeah, those would be included in that, yes. 

Mr. WESTERMAN. I think I’m out of time, Mr. Chairman. 

Chairman WEBER. Okay. The gentleman yields back. 

The gentlelady from Connecticut, Ms. Esty, is recognized. 

Ms. ESTY. Thank you, Mr. Chairman and to our Ranking Members for today’s very important hearing. 

In Connecticut, we’re very focused on grid reliability just actually 

from natural disasters we’ve been coping with, and certainly the 

cybersecurity threat has gotten us all to pay much closer attention. 

I have two quick questions. First for Ms. Lee and Mr. Gaines. 

Can you explain a little bit more how we should address the challenges between the difference in lifespan of operational technology 

and information technology? All of us who know, who have any of 

those devices in our pockets, and if you’ve got teenagers, you really 

know within a year they want a new one, and yet we’re looking at 

overall systems on the utility side that are decades long. What do 

we know about from prior history that can help us in Congress 

think about how to meld together these two systems, one of which 

is highly capital-intensive over decades and another which is 

changing constantly? 

Mr. GAINES. Ms. Lee, go ahead. 

Ms. LEE. Thank you. Yes, as I mentioned earlier, the difference 

in lifecycle—and it’s amazing when you think our device if it’s a 

year old, it’s ancient. 

What needs to be done, and talking about the modernization of 

the grid, and I think of that more than just a smart grid. If you 

want to talk about all of the domains—generation, transmission 

and distribution—the new devices are using commercially available 

operating systems and applications rather than the proprietary solutions that were used historically, and so when you look at these 

devices, yes, they may have a lifespan of 30 or 40 years but you 

have Windows, you have your internet protocols. It’s having the 

two communities, and Mr. Gaines talked about that, having the 

communities, the IT and OT communities together, figure out the 

best solutions, and a lot of utilities are putting them in the same 

room and addressing these difficulties because when you get away 

from the proprietary solutions, you need to figure out how do you 

do it with all of these commercially available products. 

Mr. GAINRS. I would add to that two things you heard me in the 

testimony. We have and are converging both the operational side 

of our business and the IT side of our business, and we’re doing 

it a lot with technology first of all. Inside of a substation, 15 years 

ago it was an analog substation and it was not two-way communication. What sits in a substation now is a communications network, and so we are building out with inside substations a very 

protected, secure network inside of that substation, and it comes 
70 

with us—it comes with cyber risk but it also comes with the ability 

to monitor that substation. And so that is the piece that some of 

those in industry are doing. We are thinking of that substation as 

a physical asset as well as a logical asset. And so when I actually 

manage our substations, I think of them as a computer. I think of 

them as an asset in transmitting and/or transferring energy, and 

in one place we look at both of those. We don’t separate those two. 

We don’t separate the operational side of our business from the 

cyber side or the technology side. And as more communication devices go into substations, that’s going to be required. 

Ms. ESTY. Thank you. That is very helpful. 

And just a quick question for anyone who wants to chime in. 

Part of what we do is direct research dollars from this Committee, 

and if you had to divide up the federal research dollars between on 

cybersecurity, in prevention, detention, mitigation, and recovery, at 

this stage of the game, what do you think for us—those of us who 

sit here in Congress as we’re allocating funds and we all know we 

should have more funds, but with the not enough money that we 

have, as I think about it, how should we think about dividing those 

up? 

Mr. GAINES. Mine would be prevention. It has the greatest opportunity to be able to share, and I think the greatest opportunity to 

expand and grow. 

Mr. STACEY. Yes. Thank you for the question. 

I would offer that we’re spending an awful lot today on the measure-countermeasure. The threats and the daily bombardment is 

consuming most of our resources. We need to make sure that we’re 

investing a significant amount of our research dollars in how do we 

take some of these critical assets off the table with either some 

kind of disruption zone—which is now a terminology that’s being 

used where you put some kind of a—— 

Chairman WEBER. A firewall? A firewall? 

Mr. STACEY. Well, it’s not quite as sophisticated as a firewall. It’s 

an analog circuit that allows the electrons to go in and only do one 

thing, and it requires the cyber hacker to have physical access to 

the other side. And so research associated with trying to help define the critical assets and then we create an environment to take 

some of these critical assets off the table. 

So to answer your question shortly, I believe more needs to be 

done to get us out of this paradigm of measure-countermeasure and 

how we’re going to solve this long term because, frankly, the resources aren’t scalable. Thank you. 

Ms. ESTY. Thank you. That’s very helpful, yes. 

We all remember Mad Men and Spy versus Spy. I think you’re 

right. We need to be removing assets from vulnerability. It makes 

a lot of sense. 

Thank you all very much. 

Chairman WEBER. The gentlelady yields back. 

I now recognize the gentleman from Alabama, Mr. Palmer. 

Mr. PALMER. Thank you, Mr. Chairman, and thank you to the 

witnesses for coming in this morning. It’s extremely important. 

Mr. Gaines, the National Institute for Standards and Technology 

has developed voluntary guidelines for smart grid cybersecurity, 

and the Federal Energy Regulatory Commission continues to ap-
71 

prove cybersecurity standards. How helpful are these types of 

standards to the industry? 

Mr. GAINES. The standards are invaluable. They create a baseline. However, I suggest to you that’s just what they are is a baseline, and that the threats that we see today are going forward, 

they’re not going back. And so we identify most of the 

vulnerabilities associated with those standards and things that 

happen to us, not what things are going to happen to us. And I 

don’t think that you can regulate or put standards in this to control 

every vulnerability. What I think you have to have is a collaborative effort across industry and government to address some of the 

issues that we have. 

Mr. PALMER. Part of my concern is that these are industry standards, and James Clapper, the Director of National Intelligence, said 

the greatest threat to our national security is cyber attacks. I think 

he identified 140 attacks against U.S. corporations by China, and 

it appears to me that we’re in the middle of a digital arms race in 

terms of cyber attacks, and specifically my concern right now is 

with our energy infrastructure and how devastating it would be if 

we had a cyber attack against our infrastructure that shut it down. 

Do you think industry standards alone are enough or does the government need to take a more active role in this, particularly in developing the technology to protect us against cyber attacks? 

Mr. GAINES. First of all, to answer your first question, are the 

standards adequate, they are adequate, and I repeat again, they 

create a baseline. If you would suggest, though, that could more be 

done, I do, and I apologize. I don’t remember the member’s name. 

More research needs to be put into technology, number one, and it 

can be on any one of those three fronts. Prevention is the area that 

I suggest. Information sharing is a big piece of that, how we can 

be more collaborative and develop tools between government and 

industry to share and within industry, and so I would suggest 

where the management can be a major player is, they have access 

to information we don’t and vice versa, and the idea is, how can 

we get that to be a timely sharing of information and a more detailed level of sharing of information. That’s the area that I suggest 

that we put more emphasis on, not necessarily standards. 

Mr. PALMER. Well, in regard to the timeliness, Mr. Stacey, in 

your testimony, you mentioned that intrusion detection technology 

is not well developed for control system networks and that it can 

often take months before malware is detected. What are the factors 

that account for such a significant amount of time that elapses before detection? 

Mr. STACEY. Well, first, let me characterize, as Ms. Lee did, the 

difference between IT technology and OT. With IT technology, 

we’re fairly mature now in proactively managing systems. We have 

configurations and patchings that we use to manage these systems. 

Operational technology, or industrial control systems, may manage several hundreds or even thousands of points a minute, and if 

you try to proactively manage that network, you can do a denialof-service attack on yourself. And so the tools today are basically 

passive monitoring—watching for things in and out—and the sophisticated hackers are aware of that and can go slow and low. And 

so the detection oftentimes, as I said, comes from a third party. 
72 

And this is another research area that could be invested in is the 

detection technology for industrial control systems. Thank you. 

Mr. PALMER. Is that, in your opinion, where we need to go in 

terms of improving the detection time? 

Mr. STACEY. Correct. 

Mr. PALMER. Mr. Chairman, I yield the balance of my time. 

Chairman WEBER. I thank the gentleman. 

The gentleman from California is now recognized. 

Mr. SWALWELL. Thank you, Mr. Chairman, and thank you to our 

panelists. 

This issue, it just—it seems to evolve faster than we can stay 

pace with it, whether it’s hacks or breaches that occur on the private sector side or hacks and breaches that we’re seeing at OPM 

or other federal agencies that have, you know, certainly compromised millions of people’s personal information, and so I guess 

my first question is, if one of our power grids went down tomorrow 

in a major metropolitan area because of a cyber attack, would anyone here be surprised? Just a yes or no up and down. Mr. Stacey, 

yes or no? 

Mr. STACEY. It’s certainly possible. 

Mr. SWALWELL. But would you be surprised if it happened? If 

you learned tomorrow that, say, the San Francisco Bay area was 

out of power because of a cyber attack, would that surprise you? 

Mr. STACEY. No. 

Mr. SWALWELL. Mr. Gaines? 

Mr. GAINES. Yes, it would. 

Mr. SWALWELL. Ms. Lee? 

Ms. LEE. Yes. 

Mr. SWALWELL. And Mr. Wilshusen? 

Mr. WILSHUSEN. Yes. 

Mr. SWALWELL. Okay. And so for those who said—well, let me 

start with you, Mr. Stacey. Why would it not surprise you? 

Mr. STACEY. I just believe—because our monitoring and detection 

for those kinds of events is not sophisticated enough for me to give 

an answer of yes. 

Mr. SWALWELL. Do you believe that we have made the necessary 

investments across our country in protecting against cyber attacks, 

and not just the investments but is our workforce trained in a way 

that our cyber hygiene is good enough to prevent this from happening? 

Mr. STACEY. Yes, I think we have invested properly. I think 

there’s a lot of work being done both in the utility sector and within the government sector. I think we’re short of staff certainly and 

we’re working on that in a number of areas with universities, et 

cetera. But we’ve heard from several leaders within the federal 

government that we likely have people inside the infrastructure, 

and these are very complex systems and the complexity even independent of a malware attack, adds a level of vulnerability. 

Mr. SWALWELL. Thank you. 

And for the three who said they would be surprised if they 

learned tomorrow that a major metropolitan area had been hit, can 

you just maybe elaborate briefly on why it would surprise you? Mr. 

Gaines? 

Mr. GAINES. I’ll give you a fact-based answer. 
73 

Mr. SWALWELL. Sure. 

Mr. GAINES. And I certainly know that there are vulnerabilities 

that exist in every network, but I would suggest to you at 

FirstEnergy, I feel we have done the right things to secure our 

company and that component of the grid. 

The other thing that’s unique to the grid is, we have the interconnects, in our case, PJM, and so in this case, we would work very 

hard with PJM given that if our company was breached, to minimize that impact across the network. Is it possible? Yes, but your 

black-and-white answer is, would I be surprised? Yes, I would be. 

And it’s because of those two specific entities, and I would suggest 

to you the peers around me that are on PJM and the grid probably 

have the same level of confidence that their business, their company is secure also. 

Mr. SWALWELL. Great. Thank you. 

Ms. Lee? 

Ms. LEE. Yes, I will agree completely with Mr. Gaines on that, 

and just add to that, if you look at—and it was referenced earlier 

the Metcalf attack, that their end result was no power failure. The 

reliability of the grid is paramount, and as he mentioned, working 

with the interconnections and the different utilities, the intent is 

to maintain the reliability of the grid. So yes, it is a hypothetical 

possibility but if you look at all that’s in place to ensure the reliability, it still is a very stable system. 

Mr. SWALWELL. And then can you tell me who you fear an attack 

would come from if it came—if it was—if it occurred? Do you think 

it would be a state actor or a non-state actor? Which one would be 

more likely based on your experience and what you’ve learned? Mr. 

Wilshusen? 

Mr. WILSHUSEN. I think initially I would say it’s probably going 

to be a non-state actor but I think also I’ve been reading where 

there could be state actors involved too. But certainly terrorists 

and groups that may wish to do us harm would do so. I think state 

actors are probably, depending on the state, also are relying on the 

electricity and our national economy to support them as well. 

Mr. SWALWELL. And Mr. Gaines, are you cleared? Do you have 

a security clearance? 

Mr. GAINES. I do have a security clearance. 

Mr. SWALWELL. Do you feel that enough people in your company 

are cleared to work with the federal government on the threats or 

could we do a better job of bringing more people in? 

Mr. GAINES. I don’t think it’s the volume; it’s the quality. And 

I would suggest that today I have secret that it would be beneficial 

to move a smaller group to top secret, and the difference there is 

this, and it gets back to the timeliness and the level of detail, and 

for the sensitivity of my clearance, I just have to leave it at that, 

is that it would be much more beneficial to see things on a timely 

basis and at a much deeper level to be able to take action, but I 

feel at this point it’s adequate but could be improved. 

Mr. SWALWELL. Great. Thank you. 

And Mr. Chair, I yield back. 

Chairman WEBER. Well, thank you, and I appreciate your bringing that up. 
74 

Back to Mr. Stacey’s lack of surprise at an attack, I was talking 

with the Ranking Member here, and it’s kind of like a lot of terrorism. What is it we say, that we have to be 100 percent vigilant, 

diligent all the time; they have to be lucky one time. 

So I now recognize the gentleman from Michigan, Mr. Moolenaar. 

Mr. MOOLENAAR. Thank you, Mr. Chairman. 

Mr. Gaines, I wanted to follow up with you one some of your 

comments. You had talked about the area of prevention and thinking about what we could do to complement the efforts you’re doing 

in the industry, and you talked about, you know, prevention investments maybe could be—there could be benefits across industries. 

Can you describe that a little bit more? 

Mr. GAINES. Across the industry? 

Mr. MOOLENAAR. Across the industry. 

Mr. GAINES. Across the industry itself? 

Mr. MOOLENAAR. Yes. 

Mr. GAINES. And I do have to come back to this issue, and I 

know it’s uncomfortable maybe to repeat it again, but we do have 

in the industry a set of standards, and those standards hold us to 

a level, and if we’re not compliant, then there’s liability, and I 

think that has to be looked at first because there is the—there’s 

not the lack of interest in wanting to be able to share from an industry but there’s certainly a level of hesitancy at times at what 

level we share. So I remind us of that. 

To that point, though, I don’t think it can be done on a voluntary 

basis. I think that there has to be an open, collaborative environment between the government, and I speak of probably two or 

three agencies that I think we could all do a better job, and I start 

out with Homeland because they own the infrastructure. I start out 

with DOE because they are our sector control. Those are two. The 

third would be the FBI because they become the investigative arm 

in the event that something happens. I do believe that there is a 

way with the industry to be able to collaborate real-time threat 

analysis information, and it isn’t a voluntary but rather a requirement that should occur, but it does start with the issue of our ability to be able to manage that directly industry to government. 

Mr. MOOLENAAR. So it sounds to me like some of the effort, 

you’re talking about people getting together in a room and meeting 

and discussing this. You aren’t talking about major investments in 

infrastructure or some kind of—— 

Mr. GAINES. Both. 

Mr. MOOLENAAR. —technology. You are talking about both? 

Mr. GAINES. I am talking about both. I’m talking about the industry being able to have the necessary technology within their 

company to be able to provide that level of information, and I’m 

talking about the government being able to have and being a recipient and being able to use it, so it’s technology and it’s also skills 

and resources. 

Mr. MOOLENAAR. And do you think that when you think about 

prevention, you know, you prevent one threat but that another 

threat emerges that you weren’t aware of? How long are the benefits from that kind of an investment? You know, how long does that 

last? 
75 

Mr. GAINES. I think that’s one of the things Ms. Lee talked about 

is that becomes a priority, where do we focus on first. I don’t think 

you can deal with every single threat. There’s a lot of work that’s 

being done in the industry right now to define what a critical asset 

is, and it’s very good work. The gentleman asked me, are the 

standards good. They’re really good. They create baseline. I can tell 

you within our company, what are by definition the critical substations that have an impact on our entire network. Now, if I start 

there just alone with those critical assets and you multiply that 

times 120 investor-owned utilities, that’s pretty valuable information. And so—and again, I don’t want to give you any idea how 

many that is other than to say it is a manageable number. 

Mr. MOOLENAAR. And just, it was mentioned earlier this idea of 

improving early detection, and I don’t know if that was you, Mrs. 

Lee, or who it was that talked about the importance of that. Is that 

where we should be focusing? 

Ms. LEE. I will add, I think early detection is important. One of 

the difficulties, and I believe it’s been discussed here, is when you 

have an event, it can be very difficult to determine whether it’s a 

cybersecurity event. I’ve done exercises with utilities and their 

frustration was, I didn’t know it was a cybersecurity event. So it’s 

a matter of, we talked about on the protection side but also as 

we’ve all discussed, using commercially available products. They 

have built-in vulnerabilities. The utilities are—as they’re developing their mitigation strategies, you have to assume your systems 

at some point are going to be compromised, and so you take that 

as a given, maybe not significant but you use that when you develop your mitigation strategies. So I think it’s a combination of 

looking at it from the protection side but then what do you do if 

there is a cybersecurity event. You want the electricity to continue 

to flow. 

Mr. MOOLENAAR. Mr. Wilshusen? 

Mr. WILSHUSEN. Yes, I would agree with that too because I know 

there’s been a lot of discussion about the standards out there, and 

that’s fine and they may be adequate, but what also needs to happen is the implementation of those standards consistently over 

time throughout the enterprise, and in our work at federal agencies 

and other entities, that often does not occur. Vulnerabilities exist 

because standards aren’t being implemented consistently over time 

across the enterprise. And so it’s through that that attacks often 

occur. So the aspect of monitoring the effectiveness of the security 

controls is also going to be a key part of the overall defense—indepth strategy. 

Mr. MOOLENAAR. Thank you, and thank you, Mr. Chairman. I 

yield back. 

Chairman WEBER. The gentleman yields back. 

I now recognize the gentleman from Louisiana, Dr. Abraham. 

Mr. ABRAHAM. Thank you, Mr. Chairman. 

Mr. Stacey, let me start with you at kind of the 30,000-foot view. 

If we have a full-scale cyber attack, what does it do to the nation’s 

economy and to the nation’s security infrastructure? 

Mr. STACEY. It would be significant. All the other infrastructures 

run off the energy infrastructure. 
76 

Mr. ABRAHAM. And that leads me to the next question. How often 

is a cyber attack or an attempted attack tried on our nation’s 

power grid? 

Mr. STACEY. What I can tell you is that from ICS–CERT, they’re 

seeing a 32 percent increase in fiscal year 2014 of target attacks 

on the energy sector. I don’t have the specific number for the grid. 

Mr. ABRAHAM. But it has increased in the last—— 

Mr. STACEY. It is increasing. 

Mr. ABRAHAM. And I read something in USA Today that the U.S. 

power grid faces physical or online attacks approximately once 

every four days. Is that a fairly accurate statement? 

Mr. STACEY. That’s fair. 

Mr. ABRAHAM. Okay. That’s all, Mr. Chairman. I yield back. 

Chairman WEBER. Thank you. The gentleman yields back. 

The gentleman from Georgia, Mr. Loudermilk, is recognized. 

Mr. LOUDERMILK. Thank you, Mr. Chairman, and I appreciate all 

of the witnesses being here. I apologize that I wasn’t here for the 

earlier testimony but we also have Homeland Security issues going 

on. I’m doing the ping pong between the committees. 

But prior to coming to Congress, I spent 30 years in the IT industry. Twenty of that time, I had my own business, and a good 

portion of our business was going into smaller utility systems and 

helping them automate. So I have some background in this, predominantly smaller municipal co-op systems to where we would put 

fiber optics into the city to tie the different SCADA systems together, pump stations, substations, et cetera, so they can more effectively monitor—getting more to a smart grid. During that time, 

many of those smaller operations saw the value of bringing in revenue, especially in small utilities, of selling the interconnectivity to 

businesses that had multiple locations within their jurisdiction. 

That also led to bringing in high-speed internet, which allowed 

them to connect and sell internet services on the same backbone 

or the same infrastructure that was also running their devices. 

Now, of course, we put in a lot of technology to segregate those networks, but at the same time, they also saw the functionality of 

being able to monitor and manage and respond without having to 

be in the office to an incident that happened within the utility system through the use of the internet. 

So as we were trying to implement these new technologies to 

allow them to be more efficient in operating their utility, and many 

of those provide electricity throughout their cities or their area of 

responsibility, it did help a lot, but then there was the concern that 

we had of someone from the outside being able to get in. And so 

what we would do is, we would do a lot of research, and one of the 

things that we did not have was an approved products list that we 

could go to, that the government had said all right, if you use this 

type of gateway, use this firewall, use this type of filter, then we 

know it’ll be secure. So we did a lot of research. We went to a lot 

of vendors and we would get what we believed was the most secure, put that into place, and in most cases we were under contract 

to maintain it and make sure the security updates were done, the 

patches, et cetera, et cetera. 

The next progression was to then put in the other elements of 

the smart grid for meter reading and all this. So some of the things 
77 

we started looking at were points of access, points of failure, points 

of vulnerability, which growed—which grew exponentially once we 

started adding the more technology. 

In a previous committee, I brought up the lack of an approved 

products list that vendors such as myself or these smaller electric 

utilities can go to that has standards, equipment standards, standards of practice, operation, et cetera. Now, I understand the Department of Energy is working on that, and I applaud that effort. 

But I do believe, and I know that there is a lot of vulnerability accessing the grid, you may say, through smaller electric utility systems. Some of those that we put equipment in, we went out and 

spent a lot looking at security aspect of it to make sure that they 

could operate securely. Because of budget cuts, many of them 

would cut our contract and manage it themselves, and then some 

of them would actually go and buy parts off of eBay because they 

were cheaper, but I would try to emphasize to them, there’s a reason that part is on eBay is probably because it has been discontinued for security reasons. 

Can any of you that would like to comment on where we are, 

where we’re going and if you feel that there is a need to have a 

standard set of standards for equipment, for upgrade, for maintenance, and operation with the smaller utilities as well as large. 

Mr. GAINES. Well, I’ll speak as a large utility. I can’t speak for 

a small utility. That would not be accurate for me to do. 

Mr. LOUDERMILK. You may be able to opine as far as how vulnerability of the small utilities affect the larger utility. 

Mr. GAINES. Well, I’ll try to answer your question directly, 

though, regarding standards associated with equipment, software 

technologies. I think there certainly has to be some level of 

verification, validation of equipment. To the extent that you could 

create a universal standards for every type of equipment that sits 

inside of a network, I think it would be very difficult, and the question is, who would monitor and manage that. That is the challenge, 

and it ranges from software to hardware. I do think there are some 

validation points, though, that you can put in. Do you have—are 

you building software or are you building equipment—a method of 

configuring it so that it could be personal to the company versus 

a standard set of passwords that are set in a piece of software, as 

an example. Those are things that you could do to design into the 

technology. As it relates to the vulnerability between a small utility, municipal or not, we work together very well in the industry 

between our industry association, EEI, groups like EPRI who do research for us, and so I would tell you that there’s very little distinction about what the expectations are on a small utility versus a 

large utility. 

Mr. STACEY. Thank you for the question. I’d offer this perspective. Right now, vendors are offering equipment with as much flexibility as they can, with as much functionality as they can. And 

that’s adding to the complexity. If as a sector there was work done 

on how do I minimize the functionality to really what I need— that 

the valve only opens and closes as fast as I need for an emergency 

response, and that sensors on the pipe managing flow only have 

the fidelity for managing the flow, as we reduce that complexity, 

initially that would cost more because you’re asking for something 
78 

that’s different, but as an industry, as they worked on reducing the 

complexity and trying to find components that did the minimum 

functionality required to manage within an industrial control system, I think there’d be some benefits to that. 

Mr. LOUDERMILK. Is there currently a rating system or an evaluation that is used as far as how secure a utility is in their operation? 

Mr. GAINES. In terms of vendor equipment? 

Mr. LOUDERMILK. The whole footprint, the entire topology. Is 

there a method that some independent organization or the government can come in and evaluate and give some type of security rating? 

Mr. GAINES. Yes, there is. The CIPS, the Critical Infrastructure 

Protection Standards, are a set of standards that originated in 

2005. We’re on version 5 right now. And they baseline the transmission system and the security around that through those standards and then they are auditable. And to the extent there is remediation associated with those audits, they’re managed accordingly. 

FERC administers those through NERC. 

Chairman WEBER. Does the gentleman yield back? 

Mr. LOUDERMILK. I’m out of time, Mr. Chairman, so I will yield 

back the time I don’t have remaining. 

Chairman WEBER. All right. The gentleman yields. 

Mr. Johnson, you’re recognized. 

Mr. JOHNSON. Thank you, Mr. Chairman, and I want to thank 

my colleagues on the Committee for allowing me to sit in on this 

today. It’s an area of extreme interest and importance in my regard. 

I spent nearly 30 years as an information technology professional, part of that time, a large part of that time, in the Department of Defense being concerned about the security of data systems 

that support our special opreations folks and things like that. I feel 

very, very strongly that cybersecurity is an issue across the spectrum. It’s getting a lot of talk but it’s not getting a lot of focused 

attention to address the issue. It’s an issue—and I don’t know if 

the four of you agree or not. It’s not something that’s got a finish 

line. You know, this is not something that we’re going to solve and 

then we’re going to move on to the next big problem. As long as 

the world is connected with computing systems and networks, 

you’re going to have those with the wherewithal, some of them because they can, some of them because they desire to create chaos 

with malicious or criminal intent are going to try to get into our 

networks and our energy systems and our power grids are one of 

those areas that would wreak havoc on America’s economy, and I 

think we can all agree with that. 

Mr. Gaines, what in your mind does the integration of IT systems and supervisory control and data acquisition systems have in 

increasing the risk to grid operations? 

Mr. GAINES. First of all, Mr. Johnson, hello. It’s good seeing you 

again. 

Mr. JOHNSON. Good to see you, sir. 

Mr. GAINES. Thank you. 

I would like to start out by saying I don’t think it’s if; it’s when. 

The OT operational systems technologies and the IT technologies 
79 

are merging and they go back to exactly what I suggested, that in 

a substation now, it looks like a small communications network. 

It’s got a device in it that communicates with most of the assets, 

transformers, that determine the health and in fact the condition 

of those transformers. That’s all communicated back to the SCADA 

system into the IT systems. Secondly, the IT systems are tied to 

our power grid and actually help us manage and monitor that from 

a generation perspective. I think the industry is moving to converge those, not necessarily manage them as you would manage 

them on the grid as an operator but manage that space so that one, 

they understand the health of it, they understand the reliability of 

it, and the impacts that cyber, specifically cyber, has on it. 

I go back to the Metcalf incident. There were three things that 

occurred within an hour: the cutting of a communication line, the 

actual assault on the location itself, and then the loss of load. 

Those all three were done within an hour, and they were in the 

space that if you would’ve had monitoring and the ability to alert 

and manage that, I wouldn’t suggest that you could avoid but you 

could have mitigated some of the issues. 

Mr. JOHNSON. Can you talk specifically about what FirstEnergy 

is doing to mitigate this vulnerability? 

Mr. GAINES. Yes. We in fact have over the past 12 months built 

a security operations center, and we manage all three of those from 

one center, so I manage the operations and the health of those 

physical assets. We look at that from an IT perspective and overlay 

IT to that, and then I physically monitor the station through cameras, video and X-ray. And so I see that single pane—as we define 

it, I single that single pane of our critical assets, and that’s not dispersed around the company. I don’t have a physical security desk, 

I don’t have an operating center, and I don’t have a cyber center. 

I have one operations center that looks at that, and they’re not 

looking at it on multiple systems; they’re looking at it on one system. We are one of the first in the industry. We’ve worked with 

EPRI very hard so the industry gets it, and there’s a lot of work 

being done there. 

Mr. JOHNSON. Okay. Well, thank you very much. 

I had other questions but I think I’ve exhausted my time. Thank 

you, Mr. Chairman, for your indulgence. 

Chairman WEBER. The gentleman yields back. 

Well, I want to thank the witnesses for their valuable testimony 

and the Members for their questions. The record will remain open 

for two weeks for additional comments and written questions from 

Members. 

This meeting is adjourned. 

[Whereupon, at 11:40 a.m., the Subcommittees were adjourned.] 

(81) 

Appendix I 

ANSWERS TO POST-HEARING QUESTIONS
82 

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Brent Stacey 
83 
84 
85 
86 

Responses by Mr. Bennett Gaines 
87 
88 

Responses by Mr. Greg Wilshusen 
89 
90 
91 

(93) 

Appendix II 

ADDITIONAL MATERIAL FOR THE RECORD
94 

STATEMENT SUBMITTED BY SUBCOMMITTEE CHAIRWOMAN BARBATA COMSTOCK
95 
96 

STATEMENT SUBMITTED BY CHAIRMAN LAMAR SMITH
97 
98 

STATEMENT SUBMITTED BY RANKING MEMBER EDDIE BERNICE JOHNSON

Æ