U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

24–845 2017

THE ELECTRICITY SECTOR’S EFFORTS TO 

RESPOND TO CYBERSECURITY THREATS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON ENERGY 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

FEBRUARY 1, 2017 

Serial No. 115–3 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

(II) 

COMMITTEE ON ENERGY AND COMMERCE 

GREG WALDEN, Oregon 

Chairman 

JOE BARTON, Texas 

Vice Chairman 

FRED UPTON, Michigan 

JOHN SHIMKUS, Illinois 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

GUS M. BILIRAKIS, Florida 

BILL JOHNSON, Ohio 

BILLY LONG, Missouri 

LARRY BUCSHON, Indiana 

BILL FLORES, Texas 

SUSAN W. BROOKS, Indiana 

MARKWAYNE MULLIN, Oklahoma 

RICHARD HUDSON, North Carolina 

CHRIS COLLINS, New York 

KEVIN CRAMER, North Dakota 

TIM WALBERG, Michigan 

MIMI WALTERS, California 

RYAN A. COSTELLO, Pennsylvania 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

FRANK PALLONE, JR., New Jersey 

Ranking Member 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

G.K. BUTTERFIELD, North Carolina 

DORIS O. MATSUI, California 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

JERRY MCNERNEY, California 

PETER WELCH, Vermont 

BEN RAY LUJA ́ N, New Mexico 

PAUL TONKO, New York 

YVETTE D. CLARKE, New York 

DAVID LOEBSACK, Iowa 

KURT SCHRADER, Oregon 

JOSEPH P. KENNEDY, III, Massachusetts 

TONY CA ́ RDENAS, California 

RAUL RUIZ, California 

SCOTT H. PETERS, California 

DEBBIE DINGELL, Michigan 

(III) 

SUBCOMMITTEE ON ENERGY

FRED UPTON, Michigan 

Chairman 

PETE OLSON, Texas 

Vice Chairman 

JOE BARTON, Texas 

JOHN SHIMKUS, Illinois 

TIM MURPHY, Pennsylvania 

ROBERT E. LATTA, Ohio 

GREGG HARPER, Mississippi 

DAVID B. MCKINLEY, West Virginia 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

BILL JOHNSON, Ohio 

BILLY LONG, Missouri 

LARRY BUCSHON, Indiana 

BILL FLORES, Texas 

MARKWAYNE MULLIN, Oklahoma 

RICHARD HUDSON, North Carolina 

KEVIN CRAMER, North Dakota 

TIM WALBERG, Michigan 

GREG WALDEN, Oregon (ex officio) 

BOBBY L. RUSH, Illinois 

Ranking Member 

JERRY MCNERNEY, California 

SCOTT H. PETERS, California 

GENE GREEN, Texas 

MICHAEL F. DOYLE, Pennsylvania 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

PETER WELCH, Vermont 

PAUL TONKO, New York 

DAVID LOEBSACK, Iowa 

KURT SCHRADER, Oregon 

JOSEPH P. KENNEDY, III, Massachusetts 

G.K. BUTTERFIELD, North Carolina 

FRANK PALLONE, JR., New Jersey (ex 

officio) 

(V) 

C O N T E N T S 

Page 

Hon. Fred Upton, a Representative in Congress from the State of Michigan, 

opening statement ................................................................................................ 1 

Prepared statement .......................................................................................... 3 

Hon. Bobby L. Rush, a Representative in Congress from the State of Illinois, 

opening statement ................................................................................................ 4 

Hon. Frank Pallone, Jr., a Representative in Congress from the State of 

New Jersey, opening statement .......................................................................... 5 

Prepared statement .......................................................................................... 7 

Hon. Greg Walden, a Representative in Congress from the State of Oregon, 

opening statement ................................................................................................ 8 

Prepared statement .......................................................................................... 10 

WITNESSES

Gerry W. Cauley, President and CEO, North American Reliability Corporation ........................................................................................................................ 11

Prepared statement .......................................................................................... 14 

Answers to submitted questions ...................................................................... 110 

Scott I. Aaronson, Executive Director, Security and Business Continuity, Edison Electric Institute, on behalf of Electricity Subsector Coordinating Council ........................................................................................................................... 26 

Prepared statement .......................................................................................... 29 

Answers to submitted questions ...................................................................... 124 

Chris Beck, Chief Scientist and Vice President for Policy, The Electric Infrastructure Security Council ................................................................................... 45 

Prepared statement .......................................................................................... 47 

Answers to submitted questions ...................................................................... 135 

Barbara Sugg, Vice President for IT and Chief Security Officer, Southwest 

Power Pool, on behalf of ISO/RTO Council ........................................................ 62 

Prepared statement .......................................................................................... 64 

Answers to submitted questions ...................................................................... 142 

SUBMITTED MATERIAL

Statement of the Large Public Power Council ...................................................... 103 

Joint statement of the American Public Power Association and the National 

Rural Electric Cooperative Association .............................................................. 108 

(1) 

THE ELECTRICITY SECTOR’S EFFORTS TO 

RESPOND TO CYBERSECURITY THREATS 

WEDNESDAY, FEBRUARY 1, 2017 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON ENERGY, COMMITTEE ON ENERGY AND COMMERCE, Washington, DC. 

The subcommittee met, pursuant to call, at 10:15 a.m., in room 

2322 Rayburn House Office Building, Hon. Fred Upton (chairman 

of the subcommittee) presiding. 

Present: Representatives Upton, Olson, Barton, Shimkus, Murphy, Latta, Harper, McKinley, Johnson, Long, Flores, Mullin, Hudson, Cramer, Walberg, Walden (ex officio), Rush, McNerney, Peters, 

Doyle, Castor, Sarbanes, Welch, Tonko, Loebsack, Schrader, Kennedy, Butterfield, and Pallone (ex officio). 

Staff present: Will Batson, Legislative Clerk, E&P; Ray Baum, 

Staff Director; Jordan Davis, Director of Policy and External Affairs; Wyatt Ellertson, Research Associate, Energy/Environment; 

Adam Fromm, Director of Outreach and Coalitions; Tom 

Hassenboehler, Chief Counsel, Energy/Environment; Zach Hunter, 

Director of Communications; A.T. Johnston, Senior Policy Advisor/ 

Professional Staff, Energy/Environment; Katie McKeough, Press 

Assistant; Brandon Mooney, Senior Policy Advisor, Energy; Mark 

Ratner, Policy Coordinator; Annelise Rickert, Counsel, Energy; Dan 

Schneider, Press Secretary; Peter Spencer, Professional Staff Member, Energy; Evan Viau, Staff Assistant; Jeff Carroll, Minority Staff 

Director; David Cwiertny, Minority Energy/Environment Fellow; 

Rick Kessler, Minority Senior Advisor and Staff Director, Energy; 

John Marshall, Minority Policy Coordinator; Alexander Ratner, Minority Policy Analyst; Andrew Souvall, Minority Director of Communications, Outreach and Member Services; Tuley Wright, Minority Energy and Environment Policy Advisor; and C.J. Young, Minority Press Secretary. 

OPENING STATEMENT OF HON. FRED UPTON, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. UPTON. The Subcommittee on Energy will now come to 

order. Apologize for the delay. There were some technical difficulties with the cameras but they are now working. So everybody 

looks good and in color. 

I recognize myself for 5 minutes. Today’s hearing is going to examine what the electricity sector is currently doing to prepare for 

and respond to cybersecurity threats to the nation’s electricity 

transmission systems. 

2 

News reports bombard us almost daily about malware infections 

and portrayals of the harm from cyber-attacks. We’ve read alarming descriptions of what might happen if there is successful widespread attack on the critical infrastructure of the electricity system 

and the potential challenges to recovering from such an attack. 

It is unquestionable that ensuring the reliable supply of electricity is absolutely vital to our nation’s security, economy, our 

health and welfare. 

In Michigan and across the country, electricity enables telecommunications, financial transactions, the transport and delivery 

of energy, food, everything. It powers the infrastructure that delivers our drinking water. It enables businesses and industry to make 

and provide the goods and services of our modern society and it 

powers our hospitals and our households. 

So cyber threats to reliability deserve our constant examination. 

But as we do so, we have to recognize that ensuring reliability is 

the central function of electricity grid operations, and a tremendously complex system has developed over time to ensure that the 

lights stay on. Given the unique nature of electricity, the system 

operates to address the occasional loss of transmission components 

and to avoid cascading failures. It doesn’t always succeed, but 

large-scale blackouts have been rare for a reason. 

Nevertheless, new risks are emerging rapidly. The integration 

into the system of new technologies, especially digital technologies, 

that are essential for keeping up with the nation’s energy needs 

constantly adds new vulnerabilities. Combine this with the rapid 

development of cyber-attacks and safeguarding transmission infrastructure becomes particularly challenging. 

In recent years, Congress has enhanced the ability of the electricity sector to address emerging cyber and physical threats. In 

the last Congress, this committee wrote provisions included in the 

FAST Act that sought to facilitate sharing of threat information between the private sector asset owners and the federal government. 

Other measures enhanced authorities for taking emergency action 

against cyber and physical attacks. 

At the same time, the NERC, operating through authorities authored by this committee, has been establishing and enforcing critical infrastructure protection standards and coordinating a number 

of other activities to confront these threats. Industry and federal 

authorities have been working to address those risks. 

We have taken testimony that outlines these activities in recent 

years, and I think that evidence shows that utilities and transmission operators are not sitting still. 

I don’t think that anyone will dispute that improvements in operational practices, information sharing, defensive planning, supply 

chain controls, hardening of infrastructure remains necessary. And 

nobody will dispute that someday, an attack may succeed in taking 

down these components. So how does the industry plan to respond? 

This hearing will update the subcommittee on the state of the 

various NERC and industry activities to mitigate risks and respond 

to cyber-attacks. This will inform two objectives. 

First, this subcommittee’s agenda for the Congress will include 

a close focus on the various structural, economic, and technological 

factors that are affecting development of the nation’s electricity 

3 

systems. We’ll be examining policies that may need to be reformed 

to ensure this system adequately meets the demand of consumers 

in coming decades, and a key aspect of any of this work will certainly involve enhancing reliability in the evolving electricity system to meet the demands of the digital age. 

And second, we must continue to build a record about electric 

sector efforts to address cyber security threats. This will help us 

identify whether additional measures are necessary. In time, we 

will hear from DOE, FERC and other agencies, but developing a 

clear picture today about what the industry actually is doing will 

be critical to this ongoing effort. 

With that as a backdrop, let me welcome our witnesses. Our 

panel today provides a number of important perspectives. We will 

hear from NERC, the industry’s reliability organization responsible 

for setting and enforcing standards. We will hear how the industry 

coordinates cybersecurity planning and response. We will hear perspective from a critical infrastructure expert, and we’ll hear from 

someone responsible for cybersecurity in the actual operations of 

transmission systems. 

This panel this morning should help cover a range of topics from 

security standards to information sharing, recovery planning. It’s 

going to help us understand where gaps may be going forward, and 

we welcome that testimony. 

[The prepared statement of Mr. Upton follows:] 

PREPARED STATEMENT OF HON. FRED UPTON

Today’s hearing will examine what the electricity sector is currently doing to prepare for and respond to cybersecurity threats to the nation’s electricity transmission 

systems. 

News reports bombard us almost daily about malware infections and portrayals 

of the harm from cyber attacks. We’ve read alarming descriptions of what might 

happen if there is successful, widespread attack on the critical infrastructure of the 

electricity system-and the potential challenges to recovering from such an attack. 

It is unquestionable that ensuring the reliable supply of electricity is absolutely 

vital to our nation’s security, economy, our health and welfare. 

In my home state of Michigan and across the country, electricity enables telecommunications, financial transactions, the transport and delivery of energy, food. 

It powers the infrastructure that delivers our drinking water. It enables business 

and industry to make and provide the goods and services of our modern society. It 

powers our hospitals, our households. 

So cyber threats to reliability deserve our constant examination. But as we do so, 

we should also recognize that ensuring reliability is the central function of electricity grid operations-and a tremendously complex system has developed over time 

to ensure our lights stay on. Given the unique nature of electricity, the system operates to address the occasional loss of transmission components and to avoid cascading failures; it doesn’t always succeed, but large scale blackouts have been rare 

for a reason. 

Nevertheless, new risks are emerging rapidly. The integration into the system of 

new technologies-especially digital technologies-that are essential for keeping up 

with our nation’s energy needs constantly add new vulnerabilities. Combine this 

with the rapid development of cyber threats and safeguarding transmission infrastructure becomes particularly challenging. 

In recent years, Congress has enhanced the ability of the electricity sector to address emerging cyber and physical threats. In the last Congress, this Committee 

wrote provisions included in the FAST Act that sought to facilitate sharing of threat 

information between private sector asset owners and the federal government. Other 

measures enhanced authorities for taking emergency action against cyber and physical attacks. 

At the same time, the North American Electric Reliability Corporation (NERC)— 

operating through authorities authored by this Committee-has been establishing 

4 

and enforcing critical infrastructure protection standards and coordinating a number of other activities to confront these threats. Industry and federal authorities 

have also been working to address risks. 

We’ve taken testimony that outlines these activities in recent years. And I think 

the evidence shows that utilities and transmission operators are not sitting still. 

But I don’t believe anybody will dispute that improvements in operational practices, information sharing, defensive planning, supply chain controls, hardening of 

infrastructure remain necessary. And nobody will dispute that someday, an attack 

may succeed in taking down critical components; how does the industry plan to respond to that? 

Today’s hearing will update the subcommittee on the state of the various NERC 

and industry activities to mitigate risks and respond to cyber attacks. This will inform two objectives: 

First, the energy subcommittee’s agenda for this Congress will include a close 

focus on the various structural, economic, and technological factors that are affecting development of the nation’s electricity system. 

We’ll be examining policies that may need to be reformed to ensure this system 

adequately meets the demands of consumers in coming decades. And a key aspect 

of any of this work will involve enhancing reliability in the evolving electricity system to meet the demands of the digital age. 

And second: we must continue to build a record about electric sector efforts to address cyber security threats. This will help the subcommittee identify whether additional measures, are necessary. In time, we will hear from DOE, FERC and other 

agencies, but developing a clear picture today about what the industry actually is 

doing will be critical to this ongoing effort. 

With that as a backdrop, let me welcome our witnesses. Our panel today provides 

a number of important perspectives: We’ll hear from NERC, the industry’s reliability organization responsible for setting and enforcing standards; we’ll hear how 

the industry coordinates cybersecurity planning and response; we’ll hear perspective 

from a critical infrastructure expert; and we’ll hear from somebody responsible for 

cybersecurity in the actual operations of transmission systems. 

The panel this morning should help cover a range of topics-from security standards to information sharing and recovery planning. It should help us discuss the 

various levels of cyber and related physical risks to electricity infrastructure and 

how they are addressed. And it should help us understand where gaps may be going 

forward. 

Mr. UPTON. At this point, I recognize the ranking member of the 

subcommittee, my friend from Chicago, Mr. Rush. 

OPENING STATEMENT OF HON. BOBBY L. RUSH, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

Mr. RUSH. I want to thank you, Mr. Chairman, for this opportunity and for this hearing. 

Mr. Chairman, this is an important hearing on the electricity 

sector’s efforts to respond to cybersecurity threats. Mr. Chairman, 

this is a very first step in examining the critical issue of a electricity sector cybersecurity. 

I look forward, Mr. Chairman, to engaging our distinguished 

panel of industry witnesses and their recommendations designed to 

protect the grid from external threats. 

However, Mr. Chairman, I am sure we will all agree that additional information is needed to truly appreciate the expanding host 

of challenges that could potentially threaten the U.S. electrical sector. 

Mr. Chairman, it is my understanding that you have committed 

to holding at least one additional hearing with agency stakeholders 

in the near future so that the members of this subcommittee will 

have a greater and a fuller appreciation for the security issues facing the grid. 

5 

The issue of external forces hacking into most public and private 

domestic targets is one that is front and center on the minds of 

most of the American people. 

If recent history is any indication, then it’s not a matter of if, Mr. 

Chairman, but, rather, when some threat, whether it be a national 

disturbance, an individual hacker, a rogue state or even a wellknown foreign power challenges the resiliency of our nation’s energy infrastructure. 

Mr. Chairman, we are all aware the cyber-attack in the Ukraine 

this past December that left over 225,000 people without power in 

Kiev as a result of suspected Russian hacking. 

While we have been fortunate, Mr. Chairman, to date in that we 

haven’t suffered any major cybersecurity attacks on our own grid, 

let us not become complacent and wait until an event occurs. 

Many of us, Mr. Chairman, still view Russia, among other countries, as a potential threat to the U.S. grid system and we cannot 

risk our safety and security on the whims of Putin or any other foreign leader who may try to do us harm. 

Quite the contrary, we must be prudent and proactive in securing our electrical grid and part of that strategy must include close 

cooperation and collaboration between the public and private sectors. 

As was noted, in the last quadrennial energy review conducted 

by the Obama administration in January 2014, there is still work 

to do to improve the information sharing processes between government and industry. 

Additionally, we must ensure that our grid is protected from 

some of the specific challenges of today’s world. We must make certain that the electricity sector is secure, even in the place of an 

aging infrastructure and a changing energy portfolio. 

That would include more distributed energy, smart grid technologies and other advanced technologies. Mr. Chairman, it is vital 

that Congress examines the state of the grid and provides real 

leadership in regards to modernizing our grid and making sure 

that it’s secure for the challenges of the 21st century. 

With that, I yield back. 

Mr. UPTON. Thank you. I understand that Chairman Walden is 

on his way but he’s not quite here. So we will go to Ranking Member Pallone for an opening statement. 

OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE IN CONGRESS FROM THE STATE OF NEW JERSEY 

Mr. PALLONE. Thank you, Mr. Chairman. Greg was at the other 

hearing. 

I want to thank you for holding today’s hearing evaluating the 

cybersecurity threats to the electricity sector in our country and, of 

course, I welcome you to this new role as chairman of the Energy 

Subcommittee. 

You and I accomplished a great deal together in the last Congress and I hope to work together with you, Mr. Rush, on critical 

energy policy in this Congress. 

This hearing is a good first step for our committee to look into 

the impacts of cybersecurity threats on the electricity grid. 

6 

However, I believe that we need more hearings and a deeper 

analysis of the issue so members can truly understand the challenges and threats facing our grid and I appreciate the chairman’s 

willingness to honor Ranking Member Rush’s request to hold another hearing on this topic with federal government witnesses, especially from the Department Energy and the Federal Energy Regulatory Commission. 

Their perspective and experience on this issue will be vital to the 

committee’s oversight efforts and I also believe that the committee 

should hold a closed-door hearing to look at the cybersecurity risk 

to our electricity grid. 

There are classified aspects of this issue that can’t be discussed 

in a public hearing like this and members deserve the opportunity 

to be briefed on this high-level information in order to ensure we 

are adequately protecting the grid from threats. 

To date, the industry has done a commendable job of guarding 

electricity consumers against losses caused by cyber-attack. But 

make no mistake, the threats are out there. 

In December 2015, Russian state hackers successfully compromised the Ukraine’s electric grid, shutting down multiple distribution centers and leaving more than 200,000 residents without 

power for their lights and heaters. 

That attack was premeditated and well-choreographed with 

groundwork that predated the full attack by many months. It was 

sophisticated and synchronized, taking down backup power supplies and jamming phone lines to keep operators unaware of the 

extent of damages. And to date, it stands as the only recognized 

cyber-attack to successfully take down a power grid. 

Certainly, there are vast differences between the system in the 

Ukraine and our own grid. So it’s tempting to dismiss events in the 

Ukraine as something that could never happen here. 

But we owe it to the American people to ask whether anything 

about that attack could be replicated here, what lessons can we 

learn to make our electric grid more secure and utility workers 

more vigilant of cybersecurity threats. 

And what should be the priorities of this committee and this 

Congress to ensure that a successful cyber-attack on the electric 

grid never happens on American soil? If Russia hacked our election, what’s to stop them from hacking our electricity grid? 

Now, our committee has not been idle when it comes to grid security. Last Congress, Chairman Upton, with my support and the 

support of many members of the committee, pushed through legislation to enhance the security of our group from cyber and other 

threats. 

I was pleased to see that signed into law by President Obama because I consider grid security to be a top tier national security concern. 

And yet, just days ago President Trump signed a presidential 

memorandum establishing the members of the National Security 

Council’s principles committee and it appears that the Secretary of 

Energy, who Congress just made the lead federal official responsible for securing our electricity grid, has been booted off this significant interagency advisory panel, and this is incredibly troubling 

7 

and I strongly urge the president to reconsider his decision to sideline DOE from the national security dialog. 

I would hope that my Republican colleagues would join me in 

asking the president to reverse this decision. It’s inexcusable, in my 

opinion, that there no longer appears to be room at the top level 

of the National Security Council for the secretary of energy who 

also is in charge of nuclear security but there is a permanent slot 

for Steve Bannon, his chief strategist. 

Essentially, President Trump has chosen his top political security 

advisor over the nation’s top energy security advisor and that’s a 

recipe for disaster. 

I hope my colleagues will join me in conveying that view to the 

White House before something happens that endangers our economy and our people because the safety of our grid and our nuclear 

arsenal are too important. 

I don’t know if anybody else wants my time. Otherwise, I’ll yield 

back. 

[The prepared statement of Mr. Pallone follows:] 

PREPARED STATEMENT OF HON. FRANK PALLONE, JR. 

Mr. Chairman, thank you for holding today’s hearing evaluating the cybersecurity 

threats to the electricity sector in our country. I welcome you to this new role as 

Chairman of the Energy Subcommittee. You and I accomplished a great deal together in the last Congress, and I hope to work together with you and Mr. Rush 

on critical energy policy in this Congress. 

This hearing is a good first step for our committee to look into the impacts of cybersecurity threats on the electricity grid. However, I believe that we need more 

hearings and a deeper analysis of the issue so members can truly understand the 

challenges and threats facing our grid. I appreciate the Chairman’s willingness to 

honor Ranking Member Rush’s request to hold another hearing on this topic with 

federal government witnesses, especially from the Department of Energy and the 

Federal Energy Regulatory Commission. Their perspective and experience on this 

issue will be vital to the Committee’s oversight efforts. I also believe that the Committee should hold a closed-door hearing to look at the cybersecurity risks to our 

electricity grid. There are classified aspects of this issue that cannot be discussed 

in a public hearing like this, and Members deserve the opportunity to be briefed on 

this high-level information in order to ensure we are adequately protecting the grid 

from threats. 

To date, the industry has done a commendable job of guarding electricity consumers against losses caused by a cyberattack. But make no mistake: the threats 

are out there. 

In December 2015, Russian state hackers successfully compromised the Ukraine’s 

electric grid, shutting down multiple distribution centers and leaving more than 

200,000 residents without power for their lights and heaters. That attack was premeditated and well-choreographed, with groundwork that pre-dated the full attack 

by many months. It was sophisticated and synchronized, taking down backup power 

supplies and jamming phone lines to keep operators unaware of the extent of damages. To date, it stands as the only recognized cyberattack to successfully take down 

a power grid. 

Certainly, there are vast differences between the system in the Ukraine and our 

own grid, so it’s tempting to dismiss events in the Ukraine as something that could 

never happen here. But we owe it to the American people to ask whether anything 

about that attack could be replicated here. What lessons can we learn to make our 

electric grid more secure and utility workers more vigilant of cybersecurity threats? 

And, what should be the priorities of this Committee and this Congress to ensure 

that a successful cyberattack on the electric grid never happens on American soil? 

If Russia hacked our election, what’s to stop them from hacking our electricity grid? 

Now, our Committee has not been idle when it comes to grid security. Last Congress, Chairman Upton, with my support and the support of many members of the 

Committee, pushed through legislation to enhance the security of our grid from 

cyber and other threats. I was pleased to see that signed into law by President 

Obama because I consider grid security to be a top tier national security concern. 

8 

And yet, just days ago, President Trump signed a presidential memorandum establishing the members of the National Security Council’s Principals Committee—and 

it appears the Secretary of Energy—who Congress just made the lead federal official 

responsible for securing our electricity grid—has been booted off this significant 

interagency advisory panel. 

This is incredibly troubling and I strongly urge the President to reconsider his decision to sideline DOE from the national security dialogue. I would hope that my 

Republican colleagues would join me in asking the President to reverse this decision. It is inexcusable that there no longer appears to be room at the top level of 

the National Security Council for the Secretary of Energy—who also is in charge 

of nuclear security—but there is a permanent slot for Steve Bannon, his chief strategist. Essentially, President Trump has chosen his top political security advisor over 

the nation’s top energy security advisor—and that’s a recipe for disaster. I hope my 

colleagues will join me in conveying that view to the White House before something 

happens that endangers our economy and our people. The safety of our grid and our 

nuclear arsenal are too important. 

I yield back. 

Mr. UPTON. The gentleman yields back. 

I just want to tell the gentleman that we do anticipate having 

some classified hearings as to cyber. So I know everyone has signed 

a pledge, so look forward to having that happen. 

At this point, I’ll yield 5 minutes to the full committee chairman, 

my friend, the gentleman from Oregon, Mr. Walden. 

Mr. WALDEN. Thank you, Mr. Upton. 

Mr. UPTON. Welcome to your first appearance before the subcommittee as full committee chair. 

OPENING STATEMENT OF HON. GREG WALDEN, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF OREGON 

Mr. WALDEN. I am delighted to be here, and I am delighted 

you’re chairing this subcommittee. I wish you could have been 

downstairs for the beginning of the Health Subcommittee because 

we had a nice big University of Oregon ‘‘O’’ come up on the new 

screen there to match your green hearing room. 

Good morning, and I am pleased that the ranking member has 

such strong confidence in the new Secretary of Energy. We think 

he’s a good man, too, and look forward to working with him on this 

committee. 

One of the humbling responsibilities for members of the Energy 

and Commerce Committee is to fully appreciate the power we have 

to make policy changes that can have enormous and positive impacts on American consumers for decades to come. 

From health care, to manufacturing and trade, to telecommunications, transportation, and the delivery of energy, our goal is to 

identify how to position the United States to be able to harness the 

tremendous potential of digital communications for all sectors of 

the economy, while minimizing unintended side effects. 

We are witnessing the transformation of American commerce as 

advances in digital and information technology affect almost everything that we do in our daily lives. And we see how layering new 

digital ways of doing things onto existing practices and infrastructures creates new risks and potential harm. 

Who among us is not frequently seeking out a plug-in so we can 

keep our various electronic devices charged? We are really tethered. 

Never has the reliability of the electric grid been more important 

to everything in our lives. That also means never has the electric 

9 

grid been more of a potential target for disruption by nefarious actors. 

The hearing today concerns what is being done to address and 

respond to the cybersecurity threats to our nation’s electricity system. 

By any measure, the reliable supply of electricity is an essential 

part of almost everything that we do, and its loss—even for short 

periods of time—can have expensive and life-threatening consequences. 

Unfortunately, cyber threats in this sector are unavoidable, and 

they are growing. This is due to the dynamic nature of the information flows in the modern world as well as the increasing sophistication of hackers and adversaries. 

Threats in these flows will only grow as the instant information 

and communications enabled by digital technology become more essential for our electricity system to operate at increased levels of 

reliability. 

Looking forward, it’s clear the growth of digital technology will 

constantly introduce new avenues for cybersecurity threats. They 

must be managed effectively. 

Responsibility for addressing these threats, while harnessing the 

promise of digital technology, rests largely on the thousands of people involved in planning and operating our nation’s complex electricity transmission systems, as well as the organizations charged 

with ensuring reliability. 

This morning we will hear from industry and cybersecurity experts who can provide us a report on the state of cybersecurity 

planning and practices. 

Our witnesses will help us understand just what is being done 

to address cybersecurity threats and how the industry plans to confront new threats as they emerge. The hearing will help us begin 

to understand more fully where the electricity sector is and where 

it should be in terms of cybersecurity and related risk to electric 

reliability. 

This will lay the groundwork for closer scrutiny of the relevant 

policies necessary to ensure future reliability in an evolving electricity, and, frankly, digital sectors. 

There are many questions to pursue, such as, how is cybersecurity planning being embedded in procurement and other systems 

planning by the industry? What measures are being implemented 

to prepare for successful attacks, so that—just as with nature’s 

constant threats—if the lights do go out, can we get them back on 

quickly? 

And I know all of you run that grid test periodically and the 

tabletopping of it. So we will be interested to hear more about that. 

What’s being developed to address the truly high consequence of 

the low probability events that can have the most devastating impacts? And what more can be done? 

We really appreciate your testimony. I’ve read through it and we 

are enhanced by your counsel. We look forward to working with 

you. 

With that, Mr. Chairman, I yield back the balance of my time. 

[The prepared statement of Mr. Walden follows:] 

10 

PREPARED STATEMENT OF HON. GREG WALDEN

One of the humbling responsibilities for members of the Energy and Commerce 

Committee is to fully appreciate the power we have to make policy changes that can 

have enormous and positive impacts on American consumers for decades to come. 

From health care, to manufacturing and trade, to telecommunications, transportation, and the delivery of energy, our goal is to identify how to position the United 

States to harness the tremendous potential of digital communications for all sectors 

of the economy, while minimizing unintended side effects. 

We are witnessing the transformation of American commerce as advances in digital and information technology affect almost everything that we do in our daily 

lives. And we see how layering new digital ways of doing things onto existing practices and infrastructures creates new risks and potential harm. Who among us is 

not frequently seeking out a plug in so that we can keep our various electronic devices charged? Never has the reliability of the electric grid been more important to 

everything in our lives. That also means never has the electric grid been more of 

a potential target for disruption by nefarious actors. The hearing today concerns 

what is being done to address and respond to the cybersecurity threats to our nation’s electricity system. 

By any measure, the reliable supply of electricity is an essential part of almost 

everything we do, and its loss-even for short periods-can have expensive and life 

threatening consequences. Unfortunately, cyber threats in this sector are unavoidable and growing. 

This is due to the dynamic nature of the information flows in the modern world 

as well as the increasing sophistication of hackers and adversaries. Threats in these 

flows will only grow as the instant information and communications enabled by digital technology become more essential for our electricity system to operate at increased levels of reliability. 

Looking forward, it is clear the growth of digital technology will constantly introduce new avenues for cybersecurity threats that must be managed effectively. Responsibility for addressing these threats, while harnessing the promise of digital 

technology, rests largely on the thousands of people involved in planning and operating our nation’s complex electricity transmission systems, as well as the organizations charged with ensuring reliability. 

This morning we will hear from industry and cybersecurity experts who can provide us a report on the state of cybersecurity planning and practices. Our witnesses 

will help us understand just what is being done to address cybersecurity threats, 

and how the industry plans to confront new threats as they emerge. 

The hearing will help us begin to understand more fully where the electricity sector is and where it should be in terms of cybersecurity and related risks to electric 

reliability. This will lay the groundwork for closer scrutiny of the relevant policies 

necessary to ensure future reliability in an evolving electricity sector. 

There are many questions to pursue: How is cybersecurity planning being embedded in procurement and other systems planning by the industry? What measures 

are being implemented to prepare for successful attacks, so that—just as with nature’s constant threats-if the lights do go out, can we get them on quickly? What 

is being developed to address the truly high consequence but low probability events 

that can have the most devastating impacts? And what more can be done? 

As the committee implements its own energy policy agenda, the testimony we 

take will inform how we approach the future and how we best use innovation and 

technology to protect American consumers. 

Mr. UPTON. Thank you. The gentleman yields back. We are ready 

for our witnesses. 

We are joined by Gerry Cauley, President and CEO of the North 

American Electrical Reliability Corporation, NERC; Scott 

Aaronson, Executive Director for the Security and Business Continuity from EEI, Edison Electric, on behalf of the Electricity Subsector Coordinating Council; Barbara Sugg, Vice President for IT 

and Chief Security Officer of Southwest Power Pool on behalf of 

ISO/RTO Council; and Dr. Chris Beck, Chief Scientist and Vice 

President for policy from the Electric Infrastructure Council. 

I welcome you all. We appreciate you submitting your testimony 

early, so we are able to take it home on the last day or two. We 

11 

ask you to summarize it and take about 5 minutes in your presentation, at which time we will go to questions. 

Mr. Rush, yes. 

Mr. RUSH. Mr. Chairman, by way of announcements, we have a 

former member here, Mike Ross from Arkansas. 

Mr. UPTON. It is good to see your face, Mike. Welcome back. A 

good friend to all of us that served with you. Thank you. Thanks, 

Bobby. 

(Applause.) 

Mr. Cauley, you’re recognized for 5 minutes. 

STATEMENTS OF GERRY W. CAULEY, PRESIDENT AND CEO, 

NORTH AMERICAN RELIABILITY CORPORATION (NERC); 

SCOTT I. AARONSON, EXECUTIVE DIRECTOR, SECURITY AND 

BUSINESS CONTINUITY, EDISON ELECTRIC INSTITUTE (EEI), 

ON BEHALF OF ELECTRICITY SUBSECTOR COORDINATING 

COUNCIL; CHRIS BECK, CHIEF SCIENTIST AND VICE PRESIDENT FOR POLICY, THE ELECTRIC INFRASTRUCTURE SECURITY COUNCIL (EIS COUNCIL); BARBARA SUGG, VICE PRESIDENT FOR IT AND CHIEF SECURITY OFFICER, SOUTHWEST 

POWER POOL (SPP), ON BEHALF OF ISO/RTO COUNCIL (IRC) 

STATEMENT OF GERRY W. CAULEY 

Mr. CAULEY. Good morning, Chairman Upton, Ranking Member 

Rush, Committee Chairman Walden, Ranking Member Pallone, 

and members of the subcommittee. 

Thank you for conducting this timely hearing this morning to assess the cybersecurity of the nation’s power grid. 

The threat of cyber-attack by nation states, terrorist groups and 

criminals is at an all-time high. In December, as has been mentioned, of 2015, a cyber-attack in the Ukraine left over 225,000 customers without power for several hours. 

This indicates that nation state adversaries have the cyber tools 

and now the will to disrupt the grid of other nations. 

More recently, in the U.S., although no effects were seen on the 

power grid, we saw a million electronic devices all part of the internet of things captured and used in a sudden denial of service attack against internet service providers. 

We’ve seen an increased presence of ransomware, data theft, and 

other criminal activities against all sectors of our economy. As defined by Congress, NERC’s role is to assure the reliability and security of the bulk power system through mandatory standards, enforcement, and through reliability assessments. 

Our independent board and staff are not affiliated with the 

power system owners and operators. FERC approves NERC’s 

standards and enforcement actions in the U.S. and has the authority to direct NERC to produce new standards or to revise existing 

standards. 

As a nation, we share a grid with our fellow countries to the 

north and south, which is why NERC is an international organization spanning the U.S., Canada and, of course, Mexico. 

Our cybersecurity standards, which are developed with the expertise of industry participating in that, provide a strong foundation for security practices across the industry. 

12 

As just a few examples, our standards require inventory of cyber 

assets and configuration management, security perimeters and 

physical access controls, effective passwords and authentication, 

the use of certified software and patches, background checks and 

training of personnel, incident reporting and recovery plans. 

NERC, along with our eight regional entities, has cyber experts 

that conduct hundreds of visits each year to assess cybersecurity 

controls at these companies. 

We are finding that power companies take cybersecurity very seriously with strong attention at the top from CEOs and from 

boards. 

Cyber assets used to operate the grid are separate and isolated 

from business systems and corporate systems, and also from the 

public internet. Utility personnel are screened and well trained. 

There is a strong culture of security across each company. Companies are using advanced third party services to identify 

vulnerabilities and threats, and to maintain their system’s secure. 

Most importantly, power companies know they must continually 

monitor and detect suspicious activity, isolate malware, and destroy it before anything happens. And this process is commonly 

known as the kill chain. 

As flexible and risk-based as our standards are, I firmly believe 

that we cannot win a cyber war with regulations and standards 

alone. Industry must be agile and continuously adapt to threats, 

and to do that we need robust sharing of information regarding 

threats and vulnerabilities. 

NERC operates the electric sector Information Sharing and Analysis Center, the E–ISAC. Our role is to assimilate intelligence and 

share trusted information with industry and government and to 

recommend specific actions. 

One of our most effective tools in this process is the Cybersecurity Risk Information Sharing Program, otherwise known as 

CRISP. Developed by the Department of Energy, CRISP has been 

adopted by NERC and deployed across wide areas of the U.S. grid 

to continuously monitor and detect malicious activity. 

Working with the U.S. government analysts at the classified 

level, we are able to detect problems early and get this information 

out to industry for action. 

When time is of the essence, NERC can also issue alerts to industry at three levels of urgency. The two highest levels of urgency 

require response from industry back to NERC. 

In addition to operating the E–ISAC, NERC conducts an annual 

security conference, training events and frequent classified briefings. As has been mentioned, we also conduct continent-wide cyber 

and physical security exercise called GridEx. 

Over 4,000 participants from industry and government organizations across North America engage for two days in a very severe 

massive cyber and physical attack on our grid. The exercise includes a tabletop which industry CEOs and senior government officials coordinate a national response including communications, deployment of resources, cyber mutual assistance, and other strategies. 

To date, there has not been a single cyber-attack in North America that has resulted in a power outage to a customer. This is an 

13 

exceptional record. However, we will never be complacent. We understand the risk is real. We have hard work to do every day and 

we will continue to do that. 

I thank the Committee for the time today and look forward to 

your questions. Thank you. 

[The statement of Mr. Cauley follows:] 

14 


24845.001
15 


24845.002
16 


24845.003
17 


24845.004
18 


24845.005
19 


24845.006
20 


24845.007
21 


24845.008
22 


24845.009
23 


24845.010
24 


24845.011
25 


24845.012
26 

Mr. UPTON. Thank you. 

Mr. Aaronson. 

STATEMENT OF SCOTT I. AARONSON 

Mr. AARONSON. Thank you, Chairman Upton, Ranking Member 

Rush, and members of the subcommittee. I am glad to be here 

today to discuss the security of the power grid. We appreciate you 

holding this important hearing and making it a priority for the 

subcommittee. 

As owners and operators of some of the nation’s most critical infrastructure, we share your commitment to ensuring the grid is secure and resilient. 

From some of the headlines and movie script scenarios out there 

you may be left with the impression that a month’s-long power outage is inevitable and the power sector is powerless to do anything 

about it. 

If there is one thing you take from my testimony it is this: Our 

industry is doing an extraordinary amount of work at all levels all 

the time to defend the grid and to respond to incidents. 

You have to remember we live and work in the communities that 

we serve and our infrastructure is our most important asset. We 

are motivated for many reasons to make security a major priority. 

Since these topics can be sensitive and, as was mentioned, sometimes classified, we may not talk about them a lot in public, but 

don’t take that as complacency or a lack of action. 

My written testimony has more extensive details on how electric 

companies address threats so I won’t read it to you. But, instead, 

I’d like to quickly focus on three areas that form the foundation for 

how the electric power industry approaches security. 

It’s three legs of the stool, effectively. So the first leg of the stool 

is standards. The electric industry has mandatory and enforceable 

critical infrastructure protections, or CIP, regulatory standards for 

both cyber and physical security that Mr. Cauley just mentioned. 

These are not lax lowest common denominator standards. These 

are rigorous requirements that improve the industry’s security posture. 

Failure to comply can cost companies more than a million dollars 

per infraction per day. So, suffice it to say, companies feel a strong 

incentive to comply. 

But compliance does not equal total security. So that brings me 

to the next leg of the stool, which is partnerships. Protection of critical infrastructure is a shared responsibility. 

In order to be prepared for an ever-changing threat environment, 

industry and government are partnering at an extremely high 

level. In addition to my role at EEI, I am also privileged to serve 

on the secretariat of the Electricity Subsector Coordinating Council, or ESCC. The ESCC is made up of all three segments of the 

industry as well as Canadians and independent power generators, 

the nuclear sector as well as the gas sector. 

It is made up of 31 CEOs from across the segments of the industry. Those CEOs meet regularly with senior government officials 

not to simply update each other but to set a strategic course that 

has helped the sector make extraordinary advances in grid security 

27 

in a very short amount of time by bringing together governmentindustry executive leadership. 

It’s also been recognized by the National Infrastructure Advisory 

Council, which advises the executive office of the president as the 

model for how critical infrastructure sectors can partner with government. 

So the ESCC focuses on four specific areas. The first is deploying 

tools and technology. The focus here has been moving governmentdeveloped tools to industry applications that improve situational 

awareness. And, again, Mr. Cauley mentioned the best example of 

this, the Cyber Risk Information Sharing Program, or CRISP. 

The second focus for the ESCC has been improving the flow of 

information. That is making sure the right people are getting the 

right information at the right time. 

From classified briefings for executives to actual intelligence for 

operators, government and industry are sharing threat information 

more easily and more often, and some of that has to do with some 

of the legislation that has been passed by committees like this to 

make information sharing more seamless between the public and 

private sectors. 

The third thing that we are doing in the ESCC is coordinating 

with other sectors. While electricity is often described as the most 

critical to critical, if we don’t have water, we can’t generate steam 

or cool our systems. If we don’t have transportation or pipelines, 

we can’t move fuel or our equipment. If we don’t have communications, we can’t operate. 

So to address interdependencies, the power sector is working 

across sectors, and most recently we are pursuing a partnership 

with the financial services and communication sectors to form a 

Strategic Infrastructure Coordinating Council, or SICC, that follows the model of the ESCC by bringing senior executives together 

to form a center of gravity that will help harmonize people, policies, 

and technologies across the sectors that form the foundation of civil 

society. 

Then the last area of focus for the ESCC also happens to be the 

third leg of the stool. So we have got regulations, we have got partnerships, and then we are preparing to respond and recover from 

incidents if there were ever a successful attack. Simply put, electric 

companies have to be right 100 percent of the time and the adversary has to be right once. 

Given those odds, preparing for incidents is just common sense. 

First of all, we have a history of working together to restore power 

after an incident through mutual assistant networks where workers from across the sector help affected companies. 

We also have a robust spare equipment sharing program including several bilateral and multilateral arrangements, one of them 

known as the Spare Transformer Equipment Program, or STEP. 

We exercise regularly, as Mr. Cauley noted. NERC’s GridEx series brings together thousands of operators and executives from 

across North America in the largest exercise of its kind, and we 

now are developing a cyber mutual assistance program to coordinate industry resources for companies affected by cyber incidents. 

As an example of how quickly the sector can implement new 

strategies under the ESCC, the CMA program was conceived in 

28 

January of 2016, just about a year ago, following GridEx III and 

the 2015 cyber-attack on Ukraine’s energy grid. 

In just the last year, this program went from a concept suggested 

by the CEOs of the ESCC to a program that currently has more 

than 80 participants and growing almost daily, a legal structure, 

a play book that has been exercised and even utilized in response 

to the Mirai botnet that affected internet services this past October. 

Bottom line is this: We are constantly working to manage risk, 

but also planning to address incidents because we understand we 

can’t fully eliminate risk. 

There isn’t enough money in the world to protect against every 

threat in every location, but we are working to prevent incidents 

from having long-term or devastating impacts. 

We understand that the service we provide is critical to the life, 

health, and safety of all Americans. From CEOs to operators, the 

power sector has shown it takes this responsibility very seriously 

and is committed to constantly improving its security posture as 

these threats evolve. 

Again, I appreciate the opportunity to be here and look forward 

to answering your questions. 

[The statement of Mr. Aaronson follows:] 

29 


24845.013
30 


24845.014
31 


24845.015
32 


24845.016
33 


24845.017
34 


24845.018
35 


24845.019
36 


24845.020
37 


24845.021
38 


24845.022
39 


24845.023
40 


24845.024
41 


24845.025
42 


24845.026
43 


24845.027
44 


24845.028
45 

Mr. UPTON. Thank you very much. 

Dr. Beck. 

STATEMENT OF CHRIS BECK 

Dr. BECK. Chairman Upton, Ranking Member Rush and members of the subcommittee, thank you for the opportunity to testify 

before you today on this important topic. 

EIS Council, a 501(c)(3) nonprofit, is, at its core, a public interest 

organization. Our chief mission is to do our part to ensure societal 

continuity for black sky hazards by hosting research and national 

and international collaboration focused on whole community resilience, response, and restoration planning. 

Black sky is increasingly becoming a term of art referring to 

threats that could cause extended and long-duration power outages 

covering many states and lasting more than a month, and the subsequent cascading failures of our other critical infrastructures. 

Six black sky threats have been identified as primary concerns. 

Three are naturally occurring and three are malicious, including a 

sophisticated cyber-attack—the subject of today’s hearing. 

The Ukrainian cyber-attack demonstrated that a blackout of electric power can be achieved through remote cyber means. Stuxnet 

and Aurora demonstrate that catastrophic damage to physical 

equipment can be accomplished through cyber-attack vectors on 

operational technology or industrial control systems, causing disruption, misoperation, or destruction of the hardware they control. 

The successful coupling of these two components could result in 

a black sky event. This would be the case if the damaged equipment were critical to grid operation and required a long period of 

time to repair or replace. 

It would also be the case if the disruption pushes restoration 

times past the point where cascading failures of other infrastructures began interfering with the restoration process. 

In the aftermath of a natural disaster, response activities typically commence once the immediate danger has passed. In a cyberattack scenario, it is possible or even likely that the attacker could 

launch subsequent attacks to disrupt response and recovery efforts 

or cause further damage. 

At the same time that the cyber threat is constantly evolving, the 

attack surface continues to grow with the ever-growing trend to 

computerize and allow remote access and control. 

An adversary may also infiltrate a utility not through a direct attack on the utility system itself, but through a trusted, maybe less 

secure third party connection, or by inserting malware into critical 

hardware or software at several points along that product’s production life cycle. 

Leading power utilities have taken positive action along the 

cyber-attack threat timeline or kill chain though there is certainly 

a large spread between the capabilities within the power utilities. 

Electric utilities also have a long history of providing mutual assistance, and the same concept is being applied by the ESCC for 

mutual support in response to cyber incidents though challenges 

unique to cyber must be taken into account. 

46 

Operational technology systems in particular vary greatly from 

utility to utility. IT and OT professionals are typically a limited resource. 

In a large enough attack, availability of such expertise will likely 

be too limited to address the need, and CEOs may be reluctant to 

flow personnel to assist others when they might be the next target 

themselves. 

To bolster electric sector mutual support, external support is also 

necessary. Government support for utilities is available at the federal and state levels. ICS–CERT and E–ISAC provide operational 

support and information sharing. 

A DOD USCYBERCOM may provide assistance through defense 

support to civil authority missions. DOE is the federal agency for 

emergency support function 12 for federal support to energy restoration, and the FAST Act provisions now provide broad authority 

under a grid security emergency declaration by the President. 

At the state level, National Guard units may assist electric utilities and state fusion centers in sharing information and including 

electric utilities in emergency planning and operations. 

These support options, however, might be overwhelmed by the 

scale of the attack. Another possibility would be expanding the concept of mutual assistance to bring IT and OT professionals from 

other private sectors including information technology, aerospace, 

water and waste water, telecommunications, manufacturing, and 

others. 

EIS Council is facilitating a process to explore this opportunity. 

Power grid restoration following a successful black sky cyber-attack 

will only be possible if broad multi-sector planning is in place for 

cross-sector support to that restoration process. 

Those plans must be continuously tested and improved through 

exercises such as GridEx and through training within each utility 

and across sectors. Cyber security enhancements ultimately require 

focused private and public sector leadership. 

When the CEO of a company takes security and resilience seriously, the company develops a culture of security and resilience. Inclusion of security and, specifically, cyber security principles in 

planning for expansion, equipment replacement and employee 

training are all essential to enhanced cyber security in the electric 

power sector. 

I thank you very much and look forward to your questions. 

[The statement of Dr. Beck follows:] 

47 


24845.029
48 


24845.030
49 


24845.031
50 


24845.032
51 


24845.033
52 


24845.034
53 


24845.035
54 


24845.036
55 


24845.037
56 


24845.038
57 


24845.039
58 


24845.040
59 


24845.041
60 


24845.042
61 


24845.043
62 

Mr. UPTON. Thank you. 

Ms. Sugg. 

STATEMENT OF BARBARA SUGG 

Ms. SUGG. Good morning, Chairman Upton, Ranking Member 

Rush and all members of the Energy Subcommittee. 

My name is Barbara Sugg. I am the Vice President of Information Technology and Chief Security Officer at Southwest Power 

Pool, which is headquartered in Little Rock, Arkansas. 

Southwest Power Pool is one of the nine independent system operators and regional transmission organizations—the term ISO/ 

RTO will be used henceforth—in North America. 

Collectively, these nine organizations serve two-thirds of the energy consumers in the United States and half in Canada. We are 

nonprofit organizations. We do not own generating plants or operate generating plant substations or transmission facilities. 

However, we do provide a number of various services from reliability coordination and balancing authority functions to transmission planning for future expansion of the transmission grid. 

We all have the common goal of ensuring sustainable, affordable, 

and reliable power with our wholesale energy markets. 

I am here today on behalf of the ISO/RTO Council, known as the 

IRC. The IRC has an executive committee, which includes the 

CEOs from each of these nine organizations and is made up of a 

number of committees and working groups focused on different 

areas of interest to the ISO/RTO community. 

I serve as a member of the IT committee, which brings together 

the chief information officers from each of those nine organizations, 

where we come together to share best practices, to collaborate on 

common interests, and to work on directives that may come from 

the executive committee. 

One of the working groups that reports to us is the security 

working group. With this security working group, which has been 

in place for a very long time now, there are security experts that 

come together from each of our regions to share best practices, to 

work on incident response planning, and to understand our dependencies with each other. 

Cybersecurity is a top concern at the ISO/RTO. As Ranking 

Member Rush said earlier, it’s not a matter of if but when, and we 

recognize that. 

We have five core strategies to our cybersecurity framework. One 

of those is defense. Certainly, we have to be prepared to defend 

against attack. We do this through controls, through multiple layers of security and good practices to ensure that we stand ready to 

defend. 

The next is response. From advanced security monitoring and 

practicing incident response plans we stand ready to respond. And 

the third is recovery. You’ve heard us mention about the GridEx 

opportunities to practice our recovery drills. 

We do those every other year in a nationwide effort but we also 

do local, state, and regional exercises much more frequently to ensure that our recovery plans are ready to go. 

Partnership is the fourth key element of our strategy and these 

gentlemen talked a lot about all the of the information-sharing opVerDate Nov 24 2008 10:14 Apr 06, 2017 Jkt 037690 PO 00000 Frm 00068 Fmt 6633 Sfmt 6633 I:\MY DOCS\HEARINGS 115\HEARINGS\115-3 CHRIS
63 

portunities and the various government agencies that work with us 

to collaborate and provide cyber assistance. 

The fifth is education. We recognize the importance of every single ISO/RTO employee when it comes to protecting our systems 

and protecting our information, and so security awareness is high 

on our list. 

Over 10 years ago, the CIP standards to critical infrastructure 

protection standards came out. They’ve advanced quite a bit over 

the last decade and they serve as a base level of security for us. 

However, we have to get beyond the standards and recognize 

that a culture of compliance is important but even more so important is a culture of security. 

We look beyond the standards in a number of ways from developing, in advance of standards, security coding requirements for 

our control system vendors. And when I say we I am talking about 

the entire ISO/RTO community working together to make sure that 

we are equally protected. 

We have worked with the FERC energy infrastructure security 

office to do security architecture reviews, and to look for best practices and talk about evolving threats and current technologies. 

It’s very difficult for the standards to keep up with the evolving 

threats and so we must look beyond that. It’s also difficult with 

emerging technologies. 

Standards shouldn’t be so prescriptive that they limit us in our 

capability to develop new infrastructure and new architecture. And 

we work very closely with NERC and the rest of the community to 

ensure that those standards are secure enough for us without being 

overly prescriptive and limiting our capabilities to keep up with the 

evolving threats. 

I thank you for your time this morning and I look forward to answering your questions. 

[The statement of Ms. Sugg follows:] 

64 


24845.044
65 


24845.045
66 


24845.046
67 


24845.047
68 


24845.048
69 


24845.049
70 


24845.050
71 

Mr. UPTON. Well, thank you all. 

I think each of you mentioned that it is a daunting task. When 

you look at the power grid, 7,700 operating power plants that generate electricity from a variety of primary energy sources, 200,000 

miles of high-voltage transmission lines, 55,000 substations, fiveand-a-half million miles of local distribution lines. 

I think each of you mentioned that you have to be right every 

day. They just have to be right once for a catastrophe to happen. 

And as we all know, we passed, on a bipartisan basis, the FAST 

Act in the last Congress. 

Tell us how that has helped you on a bipartisan basis. Tell us 

specifically, Mr. Cauley and Mr. Aaronson, how has that helped 

protect consumers? 

Mr. CAULEY. Well, thank you very much for the question, Mr. 

Chairman. 

Two ways for me in particular. One is there was a lack of clarity 

around emergency authorities and I think providing those emergency authorities to the Department of Energy under an emergency 

declared by the President was helpful. 

I testified a number of times in the past about that potential gap. 

I think the other thing that’s extremely valuable to us and to consumers is it provided for greater protections of cybersecurity information. 

It’s very important that as companies report to us details that 

border on being classified, if not classified, that we are able to 

maintain the confidences and keep that secure. Particularly, allowing FERC to have procedures to secure information which we frequently exchange with them, but other controls around maintaining those confidences. 

Mr. UPTON. Mr. Aaronson. 

Mr. AARONSON. Echoing some of the things that Mr. Cauley just 

said, agree. And then in addition, I think it really speaks to the 

value of the partnership at a very high level, providing the Secretary of Energy, who oversees our sector-specific agency with some 

authorities in the midst of a grid security emergency, which was 

very well defined in the FAST Act. 

Further, it sort of solidifies that relationship in the midst of an 

incident. And the fact that it calls for coordination with the sector—where practicable—during such emergency ensures that the 

Secretary would be well informed on what to order. 

We are in the process of responding to the notice of proposed 

rulemaking from the Department of Energy that would outline 

some of the processes for how this authority would be used and we 

look forward to continuing that conversation. The joke has come 

up—there isn’t one phone number you can call, the Batphone, for 

the electric sector. 

So having a understanding of who would need to be coordinated 

with and contacted in the midst of such emergency is going to be 

a challenge. 

But, again, with the Sector Coordinating Council playing that 

role as a center of gravity with the ISO/RTO Council and other 

partners throughout the sector it gives us a good, high level set of 

entities to coordinate with should the unthinkable happen. 

72 

Mr. UPTON. Mr. Cauley, you talked a little bit in your testimony 

about the tabletop exercise. Can you elaborate a little bit more? 

The other thing I want to hear particularly, Mr. Aaronson, from 

you, as it relates to that, and I presume that you were involved, 

the STEP program. 

One of the concerns that a number of us have raised is if there 

was some issue where a transformer was taken down because of 

the lack of uniformity between a variety of different units that may 

be taken out of business. How long would it actually take to get 

new transformers into place and the mechanism that that would go 

about it? 

I presume that that was probably one of the issues that was engaged in a tabletop exercise that you had. 

Mr. CAULEY. The exercise in preparing for our fourth, now in November of this year, have intentionally gotten progressively more 

difficult and challenging to overcome, and the pattern is we build 

capability, we learn what we learn, and we get better each time. 

I think as we run the exercise in a way that’s two days and that 

it’s companies distributed across the U.S. and Canada participate 

locally in their state and local environment using their operating 

systems and people. People actually run out to stations. 

They call the FBI. They actually do it on the ground. Then there 

is a central exercise that we look at at the executive level with the 

top levels of government, and we have had FEMA, DHS, White 

House representatives and others. 

Mr. UPTON. Are the results of that in a classified setting? 

Mr. CAULEY. There is a public report for each of the exercises. 

What we found is that when we propose an exercise that destroys 

equipment, explosions, deaths, where the power could be out for 

weeks and potentially months, it really exceeds the capabilities 

that we have anticipated in the past, not just industry, but government. We never thought of it that way. 

We have to think differently in terms of unity of effort, how do 

we unite around these capabilities and bring the best of industry, 

best of government to overcome those situations. 

Mr. UPTON. I know my time is expired, but I have one quick 

question on that. Were the governors engaged in this tabletop exercise? 

Mr. CAULEY. We anticipate expanding that in GridEx IV in November but, yes, there were representatives from National Guard. 

The state of Wisconsin, I believe, was represented. And so we did 

engage some state-level representation at the table. 

But, obviously, we need to bring in a lot of state-level activity. 

A lot of the solution, in my mind, is going to be how do we handle 

the public situation and the issues on the ground during a crisis. 

And that really involves local and state governments to support it. 

Mr. UPTON. And Mr. Aaronson, just quickly to respond on the 

STEP program. 

Mr. AARONSON. So I appreciate you asked that. In addition to 

STEP, let me kind of go through a few of the resiliency programs. 

This goes to some of the things Gerry was just talking about with 

respect to having an exercise, understanding where your 

vulnerabilities are, and then implementing some solutions to fill 

those gaps. 

73 

In addition to this Spare Transformer Equipment Program which 

grew up about 10 years ago, a little bit more than that, that is a 

binding relationship between the companies that are a part of it. 

In the event of a presidentially-declared terrorist incident, there 

is a contractual obligation to share equipment during such incident. That’s a really high bar. 

Fortunately, STEP has been utilized beyond just in presidentially-declared terrorist activities but to be able to move these 

really important components that form the backbone of the system. 

In addition to STEP and its rigorous approach to Spare equipment, we also have something called SpareConnect, which is effectively a database of asset owners and asset managers for companies. 

If I am a company that has been impacted by something and I 

need to get one of these high-voltage transformers in place, I can 

create a bilateral agreement, call the person who has the equipment that I need, make an arrangement, and have it moved into 

place. 

There also are industry-led versions of this, something called 

Grid Assurance that has stood up. Again, companies come together 

to pool resources and a new program called Restore, which is a regional approach, along the same lines. 

Last thing I’ll say about this is having the equipment is one 

thing. Moving it is another. These things are quite literally hundreds of thousands of pounds and very hard to move. It has required us to work with other sectors, again, going to interdependencies across sectors, but rail and trucking in particular and then 

the riggers who actually get it onto the rail car, move it into place 

and then go the last mile to bring it to the location. 

We have both worked with the rail industry and exercised it 

through something called the Transformer Transportation Working 

Group. So, again, lessons learned from all of these incidents have 

really informed industry programs that are making us more resilient and more able to move equipment to where it’s needed. 

Mr. UPTON. Sorry it took so long. Thank you. 

Mr. Rush. 

Mr. RUSH. I want to thank you, Mr. Chairman. 

I want to touch on an area that we have been silent on—this 

hearing’s been silent on so far and that’s the area of the cybersecurity workforce. 

I think that’s a very critical concern on the plans or the technology—on the well-intentioned efforts of many of us we have come 

to know and we don’t have a sufficient, capable, and expert workforce. 

According to the IEEE, there are a million unfilled cybersecurity 

engineering jobs around the world with that number expected to 

grow by 1.5 million by 2019. In the U.S. alone there are only 67 

job seekers for every 100 open cybersecurity positions. 

I am wondering if this shortage of available workers is posing 

problems for electric companies seeking to fill cybersecurity jobs 

that protect our electricity grid. 

Mr. Aaronson, can you talk about the current situation in the 

electricity sector as it relates to cybersecurity jobs and is it indeed 

74 

true that companies are finding it difficult to find and hire skilled 

workers to fill these positions? 

Mr. AARONSON. So I think this is a refrain that you’ll hear, and 

I am sure there is others on the panel who have some experience 

actually trying to fill these positions. 

I will say I’ve heard from my membership and across the sector 

that this is a challenge. There are a lot of needs and not a lot of 

people to fill it. 

This is something that’s going to require a long-term concerted 

effort starting with STEM education and moving up to attracting 

a workforce to this particular critical infrastructure industry. 

I will say a couple of things. EEI in particular has a program 

known as Troops to Energy, and that helps to take people who 

have served in the military who have excellent skill sets and really 

do lend themselves to being a part of a critical infrastructure industry. 

So there is attraction there. There is also attraction among cyber 

workforce and cyber experts. This is a pretty cool industry to be in. 

You are the most critical infrastructure sector and we are quite literally defending against adversaries from near pure nation states 

all the way down to sort of the traditional proverbial hacker kid 

in his mom’s basement. 

Having that opportunity is something that is attractive but it 

doesn’t change the fact that we need to generate more of these people. 

Mr. RUSH. Ms. Sugg, would you want to add anything additionally? 

Ms. SUGG. That’s a great question and an interesting topic. I 

don’t find that we are having as much trouble filling those kinds 

of positions because we are working with the universities. 

STEM education is a big focus for us as well. At the university 

level we are working with a number of them on their curriculums, 

and what’s interesting is the Millenials are particularly skilled at 

this. 

This is new technology. It’s evolving threats and it’s something 

that the Millenials find really exciting and some of our most innovative thinkers, which is really what you need to think outside of 

the box on security, are coming out of the universities. 

There are a number of opportunities for experienced employees 

to get education and certifications in cybersecurity areas. 

So that’s been helpful as well and it is something people that 

have worked in other areas find interesting and perhaps want to 

change their careers because it is ever changing and good employees love a good challenge. 

The universities are producing some really skilled graduates that 

challenge our way of thinking about security in a very healthy way. 

Mr. RUSH. Is there a role for the federal government in terms of 

increasing the quality and quantity of the cybersecurity workforce? 

Ms. SUGG. I think there is an opportunity for the federal government to challenge the universities to think more broadly about the 

different types of cybersecurity in areas and sectors that are perhaps less secure, such as the internet, and maybe there are opportunities to fund research toward developing a more secure internet 

75 

and that would be something that would be very interesting at the 

academic level. 

Mr. RUSH. I want to thank you, Mr. Chairman. I yield back. 

Mr. UPTON. Thank you. The chair would like to recognize the 

chairman of the full committee, Mr. Walden, for 5 minutes. 

Mr. WALDEN. I thank the chair and thank our witnesses again 

for your testimony and your counsel. 

I listen to this and I think about your tests. I was in the radio 

business. We would do these emergency alert tests and drills from 

time to time, and we had one of these. You were talking about how 

you go out to the substation, you call the FBI, you do all that. We 

got the call into the radio station to announce that Bonneville 

Dam, one of the major dams crossing the Columbia River, and we 

were supposed to announce on air had been breached. 

Fortunately, I had a sort of retired announcer working that Saturday morning who said, ‘‘I think it’s probably not a good idea to 

actually go on the air and tell people that one of the Columbia 

River dams has been breached, but we will make a note here.’’ 

So you have to be careful when you do these exercises, but they 

are really important because emergencies do happen. I think back 

to what happened during Hurricane Katrina and how rapidly 

things disintegrated when there was no power. Because then there 

is no water, there is no sewage, there is no refrigeration. The 

ATMs don’t work. 

I talked earlier about how we are all connected to these digital 

devices. You can’t talk to your loved ones. You can’t make emergency calls. So the work you’re doing to push this and test this is 

really important. 

I know many of us have been in both classified and unclassified 

briefings on this matter about the reliability of the grid and the 

threats that are there. We are very cognizant of the cyber security 

issues, and the attempts by others to put hardware into our systems that have vulnerabilities in it, and to harness the internet of 

things to be a swarming attacking machine, basically. 

When you analyze the systems that are there, and I don’t mean 

the hardware systems—I mean the human systems to communicate 

and interact—what are we missing? What are you finding we need 

to improve on? 

Are you hamstrung by certain laws, too? We did six hearings, I 

think, on our telecommunications subcommittee on this topic of cybersecurity. Every witness on every panel said please do no harm. 

If you lock things in statute in terms of technology the bad guys 

will know what we have to do and you’ll misallocate our capital. 

Are there things like that locked in that we should review, either 

in a public setting or in a more secure setting? 

We want to make sure we have a reliable grid that can withstand any kind of issue whether it’s a solar flare or a bad actor. 

What are we missing here? Or is it all perfect? 

Mr. CAULEY. Well, I’ll just start the response. I think a lot of the 

framework that we have is really good. I think the idea of the industry participating in a standard setting and the standards being 

really focused on being adaptive and sort of driving solutions I 

think works. 

76 

So I think continuing to engage industry experts and leaders, 

and the process that we have to Section 215 in FERC and NERC 

I think is very helpful. 

There are some challenges that are difficult. Most of the challenges that we face are not limited to the electric system and I 

think, once we start talking about the kinds of existential threats 

that we are thinking about here, revolving a broad sweep of telecommunications and other industries, finance and others, I don’t 

ever expect there is going to be an attack that’s just only on the 

grid. 

So I think the ability to work cross sector and to engage multiple 

sectors together in a conversation and leadership is very helpful. I 

think we are challenged with supply chain and sort of the global 

picture that everything that we get and use from the system that’s 

digital is coming from somewhere in the world is a challenge. 

And the final thing I would say that we need to continue to work 

on together is strategic reserves around essential equipment and 

the ability to deploy that in a severe emergency. 

Mr. WALDEN. By the way, a side question—do you involve the 

amateur radio community in your emergency drills at all? I confess, 

I am one. But it also is a very dispersed—it’s like the original 

internet, right? 

Mr. CAULEY. We have not particularly sought after that, but I 

know Dr. Beck and his crew at EIS has had some work around the 

use of ham operators for emergencies. 

Mr. WALDEN. Yes, they are the only communication tool left. But 

go ahead, Mr. Aaronson. 

Mr. AARONSON. So a philosophical question but I won’t give a 

philosophical answer. I think the culture issue around, and you alluded to it, that people are very much tethered to their devices and 

very much reliant on this. 

We have found, even in storms, while the industry has gotten 

considerably better at restoring more quickly, if you do a good job 

of preparing the general public ahead of time power will be out for 

a short period of time. This is what’s going on to restore it, I think 

helping people understand that it may not just be storms anymore 

but there are other sorts of threats whether cyber or physical or 

otherwise that may have an impact, and if they can be prepared 

and they understand that we are preparing I do think there is a 

really important public policy and public communication role that 

the Congress and federal policy makers in general can play. 

I’d also say just from cultural perspective, there has been this 

tendency to blame the victim when incidents do happen on critical 

infrastructure operators. Look at Sony, look at Target. 

Changing that dynamic a little bit so that people recognize when 

you’re talking about very sophisticated threat actors and near pure 

nation states who are targeting critical infrastructure, and I think, 

again, if people recognize there is a partnership between industry 

and government, that we are working on this, that we are heartening our systems, that we are more resilient, I think that can go 

a long way. 

One last quick note, I would say this, and you alluded to it a bit, 

this reliance on a culture of compliance. Security can never be a 

77 

check the box exercise, ‘‘OK, I’ve done X, Y, and Z and therefore 

I am secure.’’ 

No. Actually, it’s the opposite. You are complacent and, again, 

going back to culture, I think helping people understand that this 

is a journey without a destination, but it is one that we are all on, 

will help to prepare your constituents, our customers, for the new 

world that we live in. 

Dr. BECK. I would say, going to Scott’s point about the social aspect, to your question, Chairman Walden, that I don’t see any regulation currently that’s hamstrung the efforts, but they are challenged by two social structures: stovepipes and tunnels. 

Stovepipes we are more familiar with and those have to do with, 

for example, government agencies that can be one stovepipe or infrastructure sectors that we need to work on getting more discussion through those stovepipes or those silos. 

But the other one is tunnels, and what I mean by that is there 

is communication and common understanding at specific levels of 

decision making. So CEOs understand each other and they have a 

certain view of a situation. 

The engineers that work on cybersecurity have a different understanding of it. The CFOs, et cetera, and so we need to look at all 

of those, breaking down basically both silos and tunnels so that 

there is a common operating picture and mission. 

Ms. SUGG. There has been a lot of comments here that I could 

echo and I’ll save the time on that. Innovation is important. Working together through the ISACs, through multi-disciplined ISACs 

are important. 

Continuing to work closely with the Edison Institute. Their work 

is phenomenal and is benefitting the entire industry. And through 

NERC to evaluate what’s coming out of the government and how 

do we best prepare ourselves within the framework. 

I agree about it’s important not to vilify the company that does 

indeed get breached because we will all learn from it. Someone 

else’s detection is everyone else’s prevention. So thank you. 

Mr. UPTON. Mr. McNerney. 

Mr. MCNERNEY. Well, I thank the chairman and I am going to 

follow up on one of your questions with Mr. Aaronson. 

Do you think that transformer standards would help reduce the 

threat of transformer attack or do we need a strategic reserve of 

some kind? 

Mr. AARONSON. So I think as you know the electric grid grew up 

in fits and starts over, quite literally, the better part of a century 

and as a result there are these different voltage classes and sort 

of a mishmash of equipment across the sector. 

Interestingly, that’s not necessarily a bad thing. It does create 

some biodiversity, which in and of itself is a protection mechanism. 

So I think standardization within reason may be something 

worth at least exploring. With respect to a strategic reserve, I 

think this is one of those instances where government and industry 

have to be aligned. 

Industry, as I mentioned, has the Spare Transformer Equipment 

Program, has SpareConnect, has Grid Assurance, has Restore, has 

these other bilateral arrangements and multilateral arrangements 

across the sector. 

78 

Those are really useful and have grown up out of necessity and 

have been utilized. To the extent that there are opportunities for 

the federal government to provide additional backstop, additional 

spare equipment, not just limited transformers but are many other 

critical components and support for moving them. Filling the gaps 

that the industry observes, I think that’s a useful pursuit. 

Mr. MCNERNEY. Thank you. 

Mr. Cauley, do you feel that the trend toward distributed generation makes our electric system less or more vulnerable to cyber-attacks? 

Mr. CAULEY. Well, it’s a great challenge and a great dilemma 

that we face in front of us. In some respects it creates a system 

that’s more resilient because there is more resources and capabilities that are more distributed, and there are greater redundancies 

in the system and I think it enhances reliability and resilience. 

The challenge is that all those devices are going to be communicating with something else and in some cases they are much closer to the internet than the bulk power grid. 

So it’s going to create a much greater surface to attack and can 

create multipliers in the attack where you have common devices 

that are out there. Instead of there being three breakers of a certain model, there are 1.5 million devices that are exactly the same 

and can be simultaneously hacked. 

So it goes both ways and I am deeply concerned that we continue 

to focus on the distribution side in terms of getting security right 

and getting it built into those systems. 

Mr. MCNERNEY. Thank you. 

Ms. Sugg, how effective would cyber hygiene, education, and enforcement be in preventing successful cyber-attacks? 

Ms. SUGG. Cyber education is extremely important. Security 

awareness is important. We cover everything in our training and 

education from how to ensure that you don’t click on e-mails on to 

how to recognize an event within the systems at any given time 

using some of our advanced security monitoring. 

That awareness is required as part of the standards, which I 

think is a very healthy requirement for us. But we don’t just limit 

that to the people that work within the scope of the critical infrastructure. 

We expand that awareness and education to all of our employees, 

recognizing that each of them has an opportunity and a responsibility to help us protect all of our systems. 

Mr. MCNERNEY. Thank you. 

Mr. Beck, with the internet of things are there concerns about 

potential cyber threats from systems that are already in place but 

we haven’t seen incidents yet? 

Dr. BECK. Certainly, the question is the continued expansion of 

the internet of things or even going back to your question of Mr. 

Cauley about distributed generation. 

As things are introduced and connected into the grid, what is an 

important practice is, if we are going to try to stay ahead of the 

threat, to have it be a part of design philosophy when new devices 

or processes are put in place. 

We don’t want to connect things and then say oh, gosh, we forgot 

about cybersecurity—now we have got to do a bunch of patches and 

79 

things. Again, it’s more of a social issue of trying to get security 

practices baked in to new development as we go forward, and we 

can grow your way to greater security because the grid is always 

expanding, things are always being updated and replaced by new 

equipment, better processes and so on. And if that new equipment 

and better process includes security as a baseline feature of its design and implementation, we will be safer. 

Mr. MCNERNEY. Well, I’ve been involved in standards committees 

and I know how slow and deliberate they are. Are standards able 

to keep up with the threat in terms—even actually the definition 

of what cybersecurity and threats mean? 

Mr. CAULEY. Well, I think they certainly help provide a baseline 

even as the topic was just about distributed systems and internet 

of things. 

IEEE and other technical equipment standard-setting organizations could have standards built in to make those devices more 

equipment. The tendency to selling to consumers is to make them 

as easy as possible to plug in and set up, and that really creates 

a difficulty. 

So I think there is room for standards to set the baseline in 

terms of how protected individual equipment should be. 

Mr. AARONSON. If I could just piggyback on that. I think the answer is yes, but standards have a role. 

They cannot completely keep up with a very dynamic threat, and 

I wanted to just weigh in really quickly on the question about distributed resources. 

I think Mr. Cauley hit it on the head. It’s sort of a paradox. 

There is some resilience that can be brought from distributed resources, but it broadened the attack surface and, largely, these are 

consumer-grade electronic devices that do not have the same security standards, to bring it back to that question that may be necessary. 

Another challenge is visibility from the operators of the grid into 

these distributed resources. It’s a misnomer to think these distributed resources are not connected to the grid. 

In fact, they have to be. Having a rooftop solar panel if it’s not 

connected to the grid is like having a computer not connected to 

the internet. You need to be a part of that broader ecosystem. 

So ensuring that there is security baked in, not bolted on to 

those pieces, and that the owners-operators have visibility into the 

power that’s being generated is going to be critical to ensure reliability and resilience for the rest of the sector. 

Mr. MCNERNEY. Thank you. 

Mr. Chairman, I yield. 

Mr. OLSON. Gentleman’s time is expired. 

The chair calls upon the Vice Chairman of the full committee, 

Mr. Barton from Texas, for 5 minutes. 

Mr. BARTON. Thank you, Mr. Chairman, and I apologize for not 

being here at the beginning. 

I had, as some of the others, the hearing on the Medicaid program in the Health Subcommittee downstairs. So I am honored to 

be a part of this subcommittee also. 

I want to recognize former Congressman Ross out in the audience, a valuable member of this committee in the past, and I think 

80 

probably the subcommittee, and you’re looking very happy being a 

former member. So we are glad to have you. 

The purpose of the hearing today, Mr. Chairman, as you well 

know, is to discuss what we are doing and look at trying to protect 

our electrical grid from the threat of cybersecurity problems. 

We have the president of the organization responsible for protecting us, Mr. Cauley. So I am going to ask the other three witnesses, Mr. Aaronson, Dr. Beck and Ms. Sugg. 

Ms. Sugg, what kind of a job do you think he’s doing. Is he doing 

a good job? A bad job? What do we need to do to encourage him? 

Mr. AARONSON. And I am not saying this just because he is sitting right next to me, but I think he’s doing an extraordinary job 

and I think that the North American Electrical Reliability Corporation serves an exceedingly important role as the electrical reliability organization as directed by this committee and Congress 

through the Federal Power Act. 

It is a challenge to be sure, but I do think the role that they play 

between a regulatory body that is pushing standards and, regulators regulate—that’s their responsibility. But also then to organize the industry and ensure that the engineers and grid operators 

have a voice in the standards that have to be developed for reliability of the system to make sure that these standards: number 

one, keep up with technology; number two, are flexible enough, as 

Ms. Sugg referenced, and that they can apply to the smallest of the 

utilities—and the largest investor-owned utilities in the nation is 

a challenge but one that I think Gerry can pass. 

Mr. BARTON. You give him an A? 

Mr. AARONSON. I’ll give him an A. 

Mr. BARTON. Dr. Beck. 

Dr. BECK. I’ll second that, and I want to say that I appreciate 

that Mr. Cauley has been a support for EIS Council and that we 

have appreciated the fact that we have been able to have discussions with NERC regarding our shared areas of interest and he 

certainly didn’t have to do that. 

But we discovered that focusing on what we consider outside, 

and beyond just the professional realm of regulating the electric reliability, is fundamentally we are all interested in the security of 

our families and our fellow citizens and the nation as a whole, and 

I think that our shared commitment in that has allowed us to work 

together to share ideas and we appreciate that partnership. 

Mr. BARTON. OK. Ms. Sugg. 

Ms. SUGG. We appreciate the partnership with NERC as well. 

Our experience is that NERC is very collaborative. They listen. 

They ask a lot of questions. 

They hold us accountable for standards but more so, and I’ve 

heard Mr. Cauley mention this numerous times in other arenas, 

that it’s more important to focus on security and to shift that focus 

from just being focused on or worried about being compliant to 

being secure. 

The standards drafting teams that are led by NERC that pull together industry experts to develop the standards, to really understand how best to put a standard in place that doesn’t become overly restrictive, is very healthy for the industry. 

81 

And I also find that NERC is receptive to understanding or hearing additional conversation about standards that do exist that are 

already in place. Not just standards that need to be developed, but 

to understand the challenges that we have with them and ensure 

that they stay as robust as possible without limiting us in our technologies. I give him an A. 

Mr. BARTON. It’s very rare that Congress does something that, 

this system came from the Energy Policy Act of 2005, which I was 

chairman of the committee and the chairman of the conference 

committee. So I guess I’ll pat myself on the back. 

But I am going to give you the final word, Mr. Cauley. You’ve 

just gotten three As. That’s a pretty good report card. 

Is there something legislatively this subcommittee and full committee needs to do to improve what appears to be working or are 

you happy with the authority you have and just want to be left 

alone? 

Mr. CAULEY. I appreciate the question and the previous question 

and the responses. 

Mr. BARTON. They expect you to take them to dinner tonight because of their answers. 

Mr. CAULEY. Something along those lines. I think the testament 

to the legislation creating this framework that our data, not our 

view but our data that we collect from industry, is that reliability 

of the bulk power system has improved over the last 10 years and 

that’s the testament that we want to leave is that we are getting 

better on the bulk power system in terms of number of outages, frequency of outages, impact on customers. 

I think the framework works. Our relationship with FERC is excellent and when we have got to get something really important 

done, like they said, let’s do a physical security standard or a 

standard on GMD. We have a conversation. They direct us to do 

it and we do it and we meet their requirements. 

The one area where I think we continue, particularly in the area 

of security, or we need to continue to work on is the ability to share 

information between industry, NERC and the government, and 

sometimes we do it well and sometimes we don’t do it well. 

There is always the challenge of what’s classified, what’s secret, 

what’s sensitive to the military. But we crave information in industry to figure out what we need to do to protect the grid and to get 

that free flow of information. To have it be protected is essential 

for us. Thank you. 

Mr. BARTON. OK. Well, downstairs we are fighting like cats and 

dogs. But in this subcommittee on this issue we are hugging each 

other. 

I think we can work together if we need to and I want to thank 

the witnesses and thank the subcommittee vice chairman and the 

subcommittee ranking member for holding this hearing. 

Mr. UPTON. The gentleman’s time has expired. 

The chair calls upon the gentleman from California, Mr. Peters, 

for 5 minutes. 

Mr. PETERS. Thank you, Mr. Chairman. Thank you to the witnesses for being here. 

So in 2003, my wife and I took my two kids to New York. We 

thought we’d get some good food, visit some friends, see ‘‘The Lion 

82 

King’’ and we, of course, were there for the blackout. So we had a 

nice Italian meal the first night. The next night was salami and 

crackers and still never seeing ‘‘The Lion King.’’ 

But the impressive thing about that was that it all came from 

some glitch in Ohio. So I guess we are inferring from your comments about the reliability of bulk power that that sort of thing has 

been improved upon. 

But it did also make me think about distributed generation because one of the things that we have seen in San Diego in the defense sector is a development of micro grids. 

At Pendleton you see this all over, and it seems to me that for 

redundancy and reliability that offers some advantages. But I had 

the same question about the portals into the system for attackers. 

And you’ve sort of answered the question but Mr. Aaronson said 

something that I want to follow up on, which was you want security baked in to these devices, not bolted on. 

What can we do from this subcommittee to make sure that that 

happens? 

Mr. AARONSON. So let me refer to the ’03 blackout for a second, 

also. While that was not the best day in the history of the electric 

utility industry, and I think Ms. Sugg hit it on the head that someone’s detection is someone else’s protection. 

We learn from all of these experiences and in fact Congress 

learned from that experience and in its wisdom, as Mr. Barton was 

referring to. The Energy Policy Act gave way to the ERO and here 

we are. 

I think there is something to that, which is observing where 

these gaps in security may lie with distributed resources and ensuring that if they are going to be a part of the bulk electric system 

that they have a certain level of security that they are responsible 

for as well. 

Again, as owners/operators, who have bulk electrical system responsibilities, I think those who might be able to impact the bulk 

electric system should share in that responsibility. 

Again, it goes to my point about visibility, also. One of the things 

that was learned after ’03, it was a cascading blackout, but the system worked precisely the way it is supposed to. The system failed 

safe. 

Now, that doesn’t change the fact that you haven’t had a chance 

to see ‘‘The Lion King’’ but it does show that cascaded from Ohio 

up through Quebec into the northeast, stopped in New York, didn’t 

go down the entire Eastern seaboard. Spinning equipment was not 

damaged and we were able to restore power within a reasonable 

amount of time, 48 to 72 hours. 

Again, not the best moment in the utility industry’s history, but 

a show of how resilient the system is in fact. I want to make sure 

to maintain that resilience and don’t want to lose visibility or resilience because of a rapid proliferation of DER. 

Mr. PETERS. Talk about the distributor or the stuff that’s outside 

the bulk power system. So, maybe a military micro grid has better 

protections than the average household device. 

But I am thinking, now you have these home devices. You turn 

energy on and off. I assume that that is a point of vulnerability and 

what do we do to make sure that the security you talked about is, 

83 

as you said, baked in? What is it that we need to do? Is it standards or what would it be? 

Mr. AARONSON. I think it is standards and requirements. We 

talked earlier about the internet of things, and these are your devices like a thermostat, like a refrigerator, like a baby monitor, 

that are being put out at—I think about five and a half million per 

day and by 2020 we are going to have something like 20 billion of 

them connected to the internet. 

And these things have hardwired passwords that are default 

passwords. These things are easy to break, and if we are talking 

about things that have any relationship to critical infrastructure I 

think having that low a bar of security, that consumer-grade electronics tend to have, is a concern for us in the industry. 

Dr. BECK. I would just add that, again, putting the baseline 

standards is necessary but it also needs to be customer driven. 

Customers need to say I am not going to buy a device that has 

hardwired passwords that I can’t change and it’s just the name of 

the company or the device. 

Mr. PETERS. On the other hand, just take it at the most basic 

level. Take someone who’s putting solar on their roof. They may 

not care. Why would they care about the larger grid? What is going 

to be incentive for an individual customer to talk about that? 

Dr. BECK. Well, I think, again, it’s trying to make everyone 

aware that when you’re this connected then your vulnerability becomes someone else’s problem, not just your own, right. 

So you can have negative impacts on your neighbors’ other systems if you don’t care. So we have to get, again, people to care 

about this in a broad sense. 

Mr. PETERS. All right. Well, I’ll look forward to working with 

that. My time is expired. Appreciate it. Thank you, Mr. Chairman. 

Mr. OLSON. Gentleman yields back. 

The chair calls upon himself for 5 minutes and welcome to our 

four witnesses. As a congressman from the state that consumes the 

most energy in America, Texas, cyber-attacks on our electric grid 

have caused me to lose sleep on occasion. 

We all know about Russia’s attack on Ukraine in December of 

2015. That was kind of easy. They have e-mails of employees are 

standard format, first name dot last name dot organization dot 

com, dot org, something like that. 

Got those, put attachments on those. Sent them back. Opened 

up, they deploy and they shut down some circuit breakers. 

As has happened charged said the response was all they could 

do was film the attack with cell phones. Film the attack with cell 

phones. 

Now, I know that we’re not like Ukraine. We are much more advanced. But in the Navy, I was a pilot for 9 years. They teach us 

to prepare for the worst, hope for the best. 

And so, Mr. Aaronson, along those lines, hypothetically, if the 

lights go out all over D.C. as this hearing ends—we are attacked, 

a cyber-attack—what chain of events does that start like that? 

Mr. AARONSON. So that has happened before and in fact not long 

ago there was a voltage dip that occurred because of a fire at a substation and the lights, in fact in D.C., did go out. And in that first 

84 

hour it was unclear why. We knew about some incidents around 

the greater metro area. But was it terrorism? 

This idea of fog of war in the midst of an outage, was it something typical like a voltage dip and those things happen? Was it 

an act of terrorism? Was it cyber? Was it physical? 

Getting ground truth on that is hard and attribution is hard. But 

having the mechanisms in place to talk to each other is important. 

So in that instance, and if there were something Ukraine-like to 

happen here in the U.S., it’s less about why the power went out 

and more about simply restoring at that moment. 

Ukraine was a great example, as are all of these incidents that 

happen all over the world and here domestically, to get us better 

at resilience and the idea is to take the lessons learned, apply them 

and get better. 

In the instance of your hypothetical, what would happen is there 

would be an immediate high level of coordination between the 

ESCC and CEOs in the industry along with senior government officials and including Mr. Cauley and his team from the Electricity 

Information Sharing Analysis Center. 

In the case of the voltage dip a few years back, that also resulted 

in a phone call with DHS on something known as the NICCL, the 

National Incident Communications Coordination Line, and that 

NICCL call actually had folks from both the affected utility and 

DHS and White House leadership. 

And what it allowed us to do was have White House leadership, 

at the time Josh Earnest was the White House press secretary, go 

to the podium from the most important podium in the land and say 

this was not a terrorist attack. We knew what was going on. 

So that really tight coordination between senior government officials and the industry proved itself to be just invaluable. 

Mr. OLSON. To recover how do you share those lessons learned 

with government and industry to make sure that we learn lessons 

from these attacks through incidents because that’s an important 

part of the whole process. 

We are attacked. Whatever happens learn from it. So how, Mr. 

Aaronson, how do we share that with industry, with the federal 

government?Mr. AARONSON. Those mechanisms exist and they are 

getting better all the time. I am particularly proud, again, as part 

of the secretariat for the Electricity Subsector Coordinating Council, the ESCC is a place where that happens. 

But, again, the E–ISAC and Gerry’s organization play a significant role. The sector as a whole, we operate one big machine with 

thousands of owners and operators. There is this shared responsibility. So when a thing happens we are particularly good at coming 

together, applying those lessons and making sure that in the future 

a similar incident would have either less impact or no impact at 

all. 

Mr. OLSON. Mr. Cauley, do you have an answer about recovery? 

Mr. CAULEY. Usually what we are doing is as quick as possible 

situation assessment, put the system back together. If we have 

damaged equipment or computers, we will isolate those and start 

putting the system back together as quickly as possible. 

85 

Why reliability has gotten better the last 10 years is because we 

are always learning from every single event, small, medium, and 

large, and we get the information out to industry. 

Mr. OLSON. Good. Dr. Beck, add anything to those line of questioning? 

Dr. BECK. I think there is challenge in learning lessons and protection of the herd because there is a natural tension between restoration and attribution. 

So to do attribution sort of like any crime scene, you don’t disturb the scene. You rope it off and then you analyze it and try to 

figure out what happened, but that crime scene is a broken down 

system that the operators want to restore. 

They don’t want to leave a mess that people can look through. 

It’s just a challenge. Nobody’s wrong. Both things are important, 

but coordinating on attribution could be important certainly for a 

very sophisticated attack that may be distributed and that we don’t 

know where all it is embedded. 

Mr. OLSON. Ms. Sugg, anything to add from your perspective, 

ma’am? 

Ms. SUGG. From the ISO/RTO perspective, certainly we are going 

to work closely with NERC and support the information-sharing 

opportunities that exist to learn from these events. 

In the midst of that crisis, our operators are going to be looking 

for what’s going on in a particular area of the footprint. I believe 

Washington, D.C. is in the PJM footprint. 

And so PJM operators are going to be looking for ways to contain 

a particular system outage to keep it from having broader cascading effects across their region. That’s just one of the responsibilities of reliability coordination within the ISO/RTO community. 

Mr. OLSON. Well, thank you. I’ll sleep better tonight, I guarantee 

you. 

One final question—you might know the incoming Secretary of 

Energy is a guy from Texas, Governor Rick Perry. He’s a friend, 

and Governor Perry asked me to ask of you all, in his new role over 

at Energy what is the one thing he can do, one thing, to help you 

make our grid more secure, from DOE’s perspective? Your perspective on DOE? 

Mr. AARONSON. I’ll say it again. ESCC, working as closely as possible with industry leadership, we have enjoyed a very fruitful relationship with the Department of Energy because of their senior 

leadership being committed to it and we look forward to and know 

that Secretary Perry will continue that tradition. 

Mr. OLSON. Anything else to add, Mr. Cauley? 

Mr. CAULEY. I will echo that. Just to get engaged with the industry leadership. We have several meetings a year with high-level 

folks from DOE, DHS and others, and we engage them in our exercise. 

We challenge them and make them uncomfortable, but we have 

grown together in the last couple years and I think with the 

change of administration we need to renew that. 

Mr. OLSON. Yes, sir. Dr. Beck, anything to add on that, sir? 

Dr. BECK. I would say, commensurate with the incoming administration’s emphasis on infrastructure that leadership be shown 

there, and to pay attention to the electric and fuel infrastructure 

86 

that supports it and, again, to ensure that security is part and parcel also with efficiency and reliability so that they are on equal 

footing and that those practices are embedded in any new infrastructure. 

Our infrastructure should always be getting more secure as it is 

upgraded. We can’t be introducing or reintroducing old 

vulnerabilities or introducing new ones. 

Mr. OLSON. Ms. Sugg, your comments. 

Ms. SUGG. I would encourage continued collaboration across the 

various industries that are dependent upon each other and I would 

also encourage the DOE to continue to focus on developing their cybersecurity frameworks that are made available to utilities to help 

ensure that we are thinking about security from soup to nuts and 

not just focused on the current threat or the current issue on the 

front page of the paper. 

Mr. OLSON. Well, thank you all. On behalf of Governor Perry, 

much obliged. 

And my time is expired. I now recognize the gentleman from 

Pennsylvania, Mr. Doyle, for 5 minutes. He has departed, so I 

guess it’s going to be Ms. Castor from Florida for 5 minutes. 

Ms. CASTOR. Thank you, Mr. Chairman. 

Good morning and thank you for being here today. Mr. Cauley, 

to date the power grid in the United States has not lost any service 

hours due to a cyber-attack, correct? 

Mr. CAULEY. Yes, ma’am. That is correct. 

Ms. CASTOR. OK. Nevertheless, the electricity sector has not been 

invulnerable to cyber-attacks. As recently as December a utility in 

Riverside, California experienced a cyber event that did not cause 

a blackout but potentially could have affected grid reliability, according to an account on file at the Department of Energy. 

The same month, suspicious activity was detected on laptop at a 

Vermont electric utility, which was not connected to the grid. 

Does NERC have data on cyber-attacks against utilities that 

have not resulted in a loss of power on the grid? 

Mr. CAULEY. Yes, ma’am. We track pretty much every incident 

and they are as small as incidents around a compromised laptop, 

which both of these cases were. 

They are connected to the corporate systems and the business 

systems of the enterprise and not to the electrical controls of the 

grid, and both of these were reported to us through our regular reporting capability. 

We understood what they were. Basically, the corporate side of 

each utility is as exposed to the outside world as any other business and you have to have that diligence around that and we are 

also subject to human frailties, people going onto a particular site 

so the idea is to continuously monitor, catch those and fix those. 

But both of those organizations reported to us. 

They did the right thing and we were able to distribute that information to the rest of the industry so that they could look for the 

same kind of issue. 

Ms. CASTOR. I think you’re right. Oftentimes the weakest components in security are the humans that have to interface with the 

systems. Spear-phishing attacks have resulted in major leaks when 

even savvy users relinquish their passwords. 

87 

And everyone is very concerned about what happened in the 

Ukraine and I—this was a good little article by security writer Kim 

Zetter. 

Everything we know about Ukraine’s power plant hack—that the 

end of December two power distribution companies in Ukraine said 

that hackers had hijacked their systems to cut power to more than 

80,000 people. 

The intruders also sabotaged operator work stations on their way 

out the digital door to make it harder to restore electricity to customers. 

The lights came back on in three hours in most cases but the 

hackers had sabotaged management systems and workers had to 

travel to substations to manually close breakers that hackers had 

remotely opened. 

And days after the outage Ukrainian officials appeared to blame 

Russians for the attack, saying that Ukraine’s intelligence service 

had detected and prevented an intrusion attempt by Russian special services against Ukraine’s energy infrastructure. 

Speaking at the S4 security conference, former NSA and CIA spy 

chief General Michael Hayden warned that the attacks were a harbinger of things to come for the U.S. and that Russia and North 

Korea were two of the most likely culprits if the U.S. power grid 

were ever hit. 

Now, what was interesting is utility operators in the Ukraine 

began experiencing small attacks 6 months prior to the main attack. 

These included e-mails to utility operators containing documents 

which installed malware. Could spear-phishing attacks and other 

similar intrusions represent a vulnerability to grid systems if hackers are able to identify information about grid systems by first infiltrating the personal and business information of the grid operators and what are we doing about that? 

Mr. CAULEY. Well, spear-phishing, going to malicious sites, picking up malware on a laptop or a computer is probably the greatest 

vulnerability that we have and the most challenging to manage. 

I am pretty sure that the situation in the Ukraine would not 

happen here, because they failed to really recognize between March 

of 2015 and December 2015 we would not allow that software to 

go unchecked and for the perpetrators to get elevated credentials 

so they could actually operate the system. 

Those are extreme violations of all our rules and all our checks 

and balances and the controls that we have in place. I don’t view 

what failed there is that an operator clicked on the wrong link. 

I feel that the organizational and institutional framework failed 

to have the rules in place to make sure that those are constantly 

checked. Humans will make mistakes. 

It should not last on a laptop more than hours or days before 

they get detected and fixed. It takes months to perpetrate a campaign like that, and it did in this case. But you got to use that time 

to figure out you’ve been compromised and fix it. 

Ms. CASTOR. I appreciate that and I appreciate how all of you 

today have expressed sincere understanding all of the security facets of this. 

88 

But please be cognizant that a lot of this can start with those innocuous looking smaller type of infiltrations and I hope that you’re 

talking with all of your personnel about that, too. 

I trust that you are. Thank you very much. 

Mr. OLSON. The gentlelady’s time has expired. 

The chair calls upon the gentleman from Pennsylvania, Mr. Murphy, for 5 minutes. 

Mr. MURPHY. Thank you, Mr. Chairman, and thank you to the 

panel, too. 

First of all, I want to make sure we know in the record as far 

as the Ukraine goes—a bigger threat to their grid is the fact that 

Russia has invaded them and Russia has taken their coal fields 

away and that Russia threatens every European nation that is 

under the boot of Gazprom and that’s what they do and they say 

if you don’t buy our gas from us and you don’t do this we are shutting off the pipes. 

So that’s a big concern, too. But doing it through a back door avenue of a cyber-attack is important, something we all should pay 

attention to and I hope that our new president establishes good negotiations with President Putin so we can get back to the work of 

doing other things. 

But I wanted to ask about another area here. When it comes to 

working with the cyber-attacks and prevention, et cetera, we know 

that—I think it was Home Depot was hacked and they were 

hacked because they went through some small level billing—an 

HVAC system that didn’t have the kind of protections. They 

worked their way through those channels to finally get into 

their—— 

Dr. BECK. That was Target. 

Mr. MURPHY. Oh, it was Target? OK. May have been they find 

some little area that doesn’t have strong defenses here. And so I 

am wondering also in the utility sector and the power grid sector 

what can the federal government do to help to enhance cybersecurity, noting that someone may come in through any door, any unprotected door in this. 

Does anybody have any ideas of how this could be? Any supplier 

to a power plant, any supplier that they could find some weak link 

there? Mr. Aaronson, do you have a thought on that? 

Mr. AARONSON. So a couple of observations, and it brings in Ms. 

Castor’s point about humans also. The weakest links, whether it is 

an unsavvy vendor, whether it is even a savvy user, there is always 

the joke. 

There is hardware vulnerabilities, there is software 

vulnerabilities and there is wetware vulnerabilities, and we are the 

wetware. 

I think, going back to my original testimony, as owners and operators we have to be right 100 percent of the time and the adversary 

has to be right once, I think looking at the weakest link shows that 

there are a lot of opportunities for the adversary to be right. 

But them being right does not have to be catastrophic. It goes 

to this idea that Mr. Cauley was talking about of the cyber kill 

chain. 

Seeing early precursors to potentially more nefarious or destructive activity, predictive analytics that help us to see those and 

89 

being more aggressive in that cyber kill chain to both prepare, protect, and defend but then also being able to respond and recover. 

And to bring this back to Ukraine, while I agree with Mr. Cauley 

that a similar attack in the United States is very unlikely, but not 

impossible, I do think that the lesson that we have learned from 

them is they were able to get their 200,000-plus customers back up 

and running within about 6 hours. They were operating in a degraded state but electricity was still flowing. 

Mr. MURPHY. Thank you. So let me ask this, though, because 

with regard to the grid, do any of the larger customers have any 

kind of other software and other controls that can pull off the grid 

and demand more? 

So if there was, obviously, not control of the power plant, but do 

they have any kind of links than can affect if they are not getting 

enough? 

Do all those controls have to go back through the original utility 

company and the power company on that grid if they experience 

some problems? 

Mr. CAULEY. I think the general answer is that the system is 

built to be very redundant and with excess capacity. So if something is damaged or not behaving correctly it can be removed and 

there is plenty of capacity to move energy around. 

Mr. MURPHY. Sure. I am wondering about the two-way communication. I am also looking for other back doors in there, too. 

Two of the things that we have in Pittsburgh—one is the Carnegie Mellon University computer emergency response—the global 

leader in this and also there’s another program there called the 

National Cyber Forensic Training Alliance, which is a room filled 

with lots of cubicles of businesses of every shape and form, and 

when one picks up something they announce it. It’s like the stock 

exchange. 

Someone says hey, I’ve got something here and they start looking 

back and forth and see where these back doors—channels are starting to probe—where’s the Trojan horse running, et cetera. 

And I am wondering that it’s one of the areas the federal government can look at because sometimes we will silo these off—let’s 

work on DoD, Navy’s going to do their thing, Army’s going to do 

their thing, Air Force is going to do their thing, Commerce is going 

to do their thing, maybe different parts of Energy. 

I am wondering do we have enough cooperation between different 

branches of the federal government and working at these things together so are we creating more inefficiencies in our system. 

Dr. Beck, go ahead. 

Dr. BECK. Well, it’s still a challenge. So I talked about the silos 

before. But I would say no but it is improving. The information 

sharing needs to be done with regard to sharing research, with regard to what are the problems you’re trying to solve. 

Mr. MURPHY. This may be part of the lesson to take back to the 

new secretary of energy, that people have to be willing to play together in the same sandbox and share their toys. 

Dr. BECK. Right. So you have DOE labs and you have DoD labs 

and they don’t talk to each other very much, but they could with 

leadership and they end up working on similar problems and find 

out later wow, we have a military application. We had a problem 

90 

here but 90 percent of that problem might be relevant for a civilian 

electric power grid. 

It takes the ability to share information at least at a high level 

and then be able to dig in and share that possibly if it’s classified 

but at a more technical level as well. 

Mr. MURPHY. Thank you. I appreciate that. I yield back, Mr. 

Chairman. 

Mr. OLSON. Gentleman’s time has expired. The chair calls upon 

the gentleman from New York, Mr. Tonko, for 5 minutes. 

Mr. TONKO. Thank you, Mr. Chair. 

Welcome to our panelists. This subcommittee heard from Secretary Moniz about the interdependence of our critical infrastructure. 

And from what we heard this morning, it sounds like there is 

agreement that the security of our grid infrastructure is particularly important because of so many other sectors relying upon it. 

Is that a fair assessment? 

Mr. CAULEY. Yes, sir, and we drive that out when we do our exercise and we break everything down. Financial sector, transportation, telecommunications, water—we are as dependent on them 

as they are on us. 

Mr. TONKO. OK. Thank you. And while I appreciate the focus on 

increasing security and mitigating cyber risks, I am also interested 

in knowing more about procedures in case there is a major cyberattack. 

So, thankfully, our country has not had any major cyber incidents that have needed response but we have had major natural 

disasters. I would cite as an example in my home state of New 

York we dealt with Superstorm Sandy in 2012. 

What specific lessons have been learned from the response to 

major natural disasters that may be applicable to a future cyberrelated response effort? 

Mr. AARONSON. So I think it’s fair to say that the lessons in coordination, because we have not had an opportunity outside of exercises to necessarily exercise and stretch those muscles with respect to a cyber incident. They have grown up with respect to natural disasters and a couple physical security incidents as well. 

That partnership is invaluable. I look at the role that the Electricity Information Sharing Analysis Center plays. I look at the role 

that the Sector Coordinating Council plays in coordinating with the 

highest levels of the industry. 

I look at our partnership with DOE, who operates under emergency support function 12. Not only are they our sector-specific 

agency, but they are the electric sector’s entre into the rest of the 

federal government enterprise, working closely with DHS, working 

closely with FEMA, working closely with the Department of Defense. 

A great example was Superstorm Sandy, when we did have the 

opportunity not just to help inform but actually be in the interagency room and help to direct resources where they needed to be 

directed. So taking information from affected utilities and feeding 

it into the government and taking information from the government and feeding it back to affected utilities, that same battle 

rhythm would be seen in the event of a cyber incident as well. 

91 

Mr. TONKO. So the intercommunication is important and I see 

you all kind of nodding in regard to that. So do you feel the procedures, the equipment, the personnel are in place in order to respond to a major cyber incident today? 

Mr. AARONSON. I think the proper answer is it depends. That’s 

always the proper answer. No, I mean, to give some modicum of 

comfort, yes. I think these relationships and these processes and 

these exercises have really informed and these experiences have 

really informed the industry’s not just security posture, but response posture. 

I do think there is the added complication with cyber of data assurance, knowing that the data you are reacting to is the right information or has not been compromised in some way. So we are 

very cognizant of those challenges. 

But I do think just simply having that underlying foundation of 

partnership and response capabilities makes us fairly well prepared and getting better all the time. That’s the goal. 

Mr. TONKO. OK. Dr. Beck, did you want to say something? 

Dr. BECK. I would say I largely agree with that but, again, with 

particular respect to cybersecurity, there are additional challenges 

to expanding mutual assistance, which the industry has a long history of. 

When it’s a physical system—your example of Superstorm Sandy, 

those were mostly downed poles and lines. The equipment was 

standard. The repair techniques and knowledge was standard. 

Within any utility’s OT system you’re going to see more variation 

than you are between poles and lines. And couple that with Mr. 

Rush’s point earlier about a smaller cyber workforce. It’s a resource 

challenge. I applaud ESCC for taking it up. 

But it is more challenging than traditional mutual assistance. 

Mr. TONKO. Let me just quickly get this in. You all partner with 

the Departments of Energy and Homeland Security and, obviously, 

they provide a lot of expertise. 

But can you discuss your relationship with state and local governments? And I would just throw the caveat out of New York, 

again, working to develop their own cybersecurity capabilities. 

They’ve done this with the National Guard. 

Both New York and New Jersey National Guards have created 

a partnership to form a cyber protection team. Just your response 

to that, please. 

Mr. AARONSON. So I was remiss in not mentioning, as Dr. Beck 

did, the cyber mutual assistance program and agree completely 

with his assessment that it is in its nascent stages and mutual assistance in its traditional form was born under the crucible of lots 

and lots of incidents of natural disasters over the years. 

The same will be true of cyber, and to bring it to your question 

about state and local, a state chief information officer once said to 

me states are the consequence people. And you certainly see experiences where governors and the local, national, and the state National Guard work very closely with their utilities. 

Those partnerships are in place. The cyber mutual assistance 

program is leveraging those relationships for two reasons: one, 

states are the consequence people; two, the National Guard has 

some extraordinary capabilities that can help augment and comVerDate Nov 24 2008 10:14 Apr 06, 2017 Jkt 037690 PO 00000 Frm 00097 Fmt 6633 Sfmt 6633 I:\MY DOCS\HEARINGS 115\HEARINGS\115-3 CHRIS
92 

plement and supplement the capabilities that the industry brings 

to bear with its cyber mutual assistance program. 

So I would say working closely with governors at the highest 

level, I would say working with operators and helping to bolster 

the cyber mutual assistance program with the Guard and then I 

would say sharing information at the local level through fusion centers. 

And, again, there are 73 fusion centers across the country. The 

joke has always been if you’ve seen one fusion center you’ve seen 

one fusion center, but they are increasingly better at coordinating 

amongst each other at the state level and giving us yet one more 

tool to share information and better respond in the event of an incident. 

Mr. TONKO. Thank you very much. I yield back, Mr. Chair. 

Mr. OLSON. Gentleman’s time has expired. The chair calls upon 

the gentleman from Mississippi, Mr. Harper, for 5 minutes. 

Mr. HARPER. Thank you, Mr. Chairman, and thanks to each of 

you for being here. This is such an important topic as we go forward so I appreciate all the input each of you have given. 

Mr. Cauley, if I may ask you a couple of questions here. Is the 

North American Electric Reliability Corporation’s alert system 

working as intended to provide the concise actionable security information to the electric industry? 

Mr. CAULEY. Yes, sir, it is, and we are able to get out information 

very quickly if needed, within an hour if needed, and it gets to all 

of the owners and operators of the system with the specific information and they have access to it directly. 

So we are always looking to make it better. I think in the 

Ukraine and the internet of things incident that we saw in the last 

12 months we have learned to scale. 

We can get thousands of people now on a conference call and let 

them know immediately what’s going on, including the CEOs and 

others. 

Mr. HARPER. What are the threats outside the bulk power system? 

Mr. CAULEY. The threats to the grid outside the bulk power system? 

Mr. HARPER. Yes. 

Mr. CAULEY. Well, I think we touched on it earlier. There are 

much more electronic digital devices that exist in the distribution 

system and then customer systems that I think are going to increasingly have an influence on the overall grid. 

Mr. HARPER. Let me just follow up just a little bit. As you previously stated, the North American Electric Reliability Corporation 

uses an alert system to notify the electricity industry of the issues 

or problems. 

You note that North American Electric Reliability Corporation 

determines the appropriate alert notification based on the risk to 

the bulk power system. How do you determine the risk or the level 

of that risk? 

Mr. CAULEY. We have expert folks on both the cyber side as well 

as the operational side of the grid to know what the potential impacts might be and this is actually one of the particular values that 

we add in our relationship with Department of Energy, DHS, and 

93 

the FBI is they often ask us what does this mean and how would 

it affect the grid if it actually happened. 

So we have both sides of that expertise and we have people who 

work in classified space to interpret what it means and what the 

potential downside could be if this actually happened. 

Mr. HARPER. OK. Obviously, other business sectors depend upon 

electricity. We have discussed that. But can you explain how the 

electric sector is dependent and reliant on other sectors and what 

is the industry doing to reach out and address these interdependencies for better cybersecurity? 

Mr. CAULEY. Well, we are reaching out to the other sectors. I 

think the dominant one is the telecommunications industry because a lot of our control systems, the ones I mentioned earlier, 

were so essential that we want to protect the most run over communications networks. 

The majority of those are privately owned by us through services 

with some of the major vendors. But if those systems go down, and 

you look at the example of Hurricane Sandy when some of the 

major telecommunication suppliers had vaults in buildings in Manhattan that were flooded with water, we depended very much on 

those communications capabilities. 

Water, transportation—finance is one you might not think about 

but if there is a severe enough event utilities need the liquidity to 

get everything done and recover and pay their folks and pay for the 

emergency housing and things like that. 

So there are a lot of dependencies that we are working on 

through the expanded relationship that Mr. Aaronson had talked 

about of getting the same level of CEO support that we have in the 

electricity industry. 

We want to get with those other sectors and get them all in the 

room with the government folks that we need to work with to make 

sure we are communicating and coordinating and planning together. 

Mr. HARPER. Well, I want to commend each of you on the level 

of cooperation and communication that you share and appreciate 

the effort that you’re making. 

Thank you. I yield back. 

Mr. OLSON. The gentleman from Maryland, Mr. Sarbanes, for 5 

minutes. 

Mr. SARBANES. Thank you, Mr. Chairman. I want to thank the 

panel. 

I am trying to get my head around how much of these efforts to 

protect the grid from cyber threats and so forth is an exercise in 

kind of retrofitting what we have versus trying to build these protections in as new technologies and new components of the grid are 

rolled out. And I don’t know if there is any way you can quantify 

or address it in some other fashion. Yes. 

Ms. SUGG. So you’re right. The bulk of the standards and requirements are retrofitting to mitigate risks and identify and manage vulnerabilities and what not. 

I applaud NERC’s efforts to get ahead of the supply chain challenges that we have to develop standards. You know, the industry 

itself has moved forward. 

94 

The ISO/RTO council has put specific requirements in place for 

our control system vendors ahead of there being a standard that 

says you should have some secure coding practices for your control 

system vendors. 

But it’s not just software vendors. It’s also hardware vendors. 

And then a comment made earlier about, I think it was Dr. Beck, 

about the importance of educating the consumer on those smaller 

devices. 

I think we should put more emphasis on the manufacturers as 

well and really hold them accountable for developing things that 

are easy to maintain security with, not things that you just plug 

in and forget about, with the control systems and all of the systems 

within our organizations, not just those that NERC has put some 

mandated controls around but for all of those systems. 

We have a responsibility and accountability to keep them current 

and to address vulnerabilities at all times. But that doesn’t exist, 

to my knowledge, when you get outside of the industry. 

And so I think we have to go back to the manufacturers and perhaps the equipment needs to be certified or—— 

Mr. SARBANES. Is it feasible to think in terms of, in a sense, 

cordoning off some of the consumer component of this internet of 

all things grid that’s developing from more of the traditional infrastructure as a practical matter? 

Do we just have to accept the notion that somebody’s thermostat 

somewhere in their house can be a path all the way to shutting 

down some regional generator or something? 

Mr. CAULEY. I think to a large extent we do that already because 

the most critical assets are in the bulk power system. 

So you can picture a grid with the major control center and a lot 

of substations. We are trying to firewall it off, import multiple layers of protection. 

So the image that comes to my mind is sort of a shuttle going 

through space and it’s just getting bombarded all the time. So we 

are getting bombarded all the time and they are usually hitting the 

shield. 

And as was mentioned earlier, sometimes the frailty is a human 

being enables something to get through. But so we are doing that. 

A long-term question as a country that you’re kind of raising, 

which is a lot of the electronics comes with huge capabilities. We 

used to buy a relay for the system and it would just be a couple 

of contacts and a coil of copper wire. 

Now you get a box and it has 10,000 lines of code because it can 

do anything and everything that you want. Well, that philosophy 

really permeates everything in the consumer side, in the distribution systems and in the bulk power system. 

We are getting electronics that can do everything. The difficulty 

there is then it can be reprogrammed to do anything anyone else 

wants. 

All right. So I think we have to think about long-term partnership with suppliers, vendors, and manufacturers in terms of building better security into systems, making sure we are able to manage a purpose and have those be beneficial purposes and not adverse purposes. 

95 

Mr. SARBANES. Right. You have kind of a bundling problem. Get 

this thing and it can do all of this neat stuff that I don’t necessarily 

need and could introduce a vulnerability that I won’t notice because I never use that feature. 

Mr. AARONSON. Just to sort of piggyback on some of that, I think 

we don’t have the luxury of doing the ostrich thing and putting our 

heads in the ground. 

Smarter energy infrastructure is here to stay and it serves a 

really important purpose and I think customers and consumers 

want it and are going to deploy and, again, utility scale and just 

industry in general sees the value. 

We talked about distributed resources, having a impact on resiliency. They are both a good one and a bad one, and I think instead 

of trying to fully cordon off I think the most critical assets instead 

we need to look at segmentation and awareness of the 

vulnerabilities that are introduced and additional resilience to ensure that a problem at one node is not a catastrophic problem, 

more broadly. 

And again, I think some of the standards that are already in 

place and some of the approaches to the promulgation of distributed resources are going in the right direction. 

Mr. SARBANES. I yield back. Thanks. 

Mr. OLSON. The gentleman yields back. The chair calls upon the 

gentleman from West Virginia, Mr. McKinley, for 5 minutes. 

Mr. MCKINLEY. Thank you, Mr. Chairman. 

This issue has come up literally every year since I’ve been in this 

committee for the last 6 years and I keep being told that everything is going to be fine, that we have got things under control. 

Two years ago we had Tom Siebel with C3 Energy testify before 

us and Mr. Siebel said, it was kind of shocking to me, he said, I 

could—any hostile country—and he said as a matter of fact I could 

take 10 engineers from U.C. Berkeley and I could shut down the 

electric grid between Boston and New York within four days. 

Now, that was after all the testimony about all the safeguards 

we had in place. So is Mr. Siebel wrong? 

Mr. AARONSON. So I guess I’d push back on the premise a bit. 

He is not wrong in that, and I don’t think any of us today are saying it’s 100 percent under control. 

I think, as I mentioned, it is an ongoing effort to continue to improve our defenses to respond to incidents internationally and domestically and to apply those here. You have two options. 

You can be a good example or you can be a cautionary tale and, 

fortunately, there are a lot of cautionary tales out there about how 

a sophisticated, well-informed threat actor with a purpose can have 

an impact on grid operations. 

I think what I would say is while an attack that has an impact 

is always within the realm of the possible, the resilience and redundancy that has grown up and the ability to respond that continues to evolve makes me a lot more comfortable in our ability to 

deal with these. 

Mr. MCKINLEY. We took that theme, that concept back—we had 

a cybersecurity summit back in West Virginia and we had some 

180 people attending, almost 200 people, in panels from all across 

the country, people coming in. 

96 

They all agree that we are still very vulnerable. This exercise 

that we go through, talking about and telling us we are OK. They 

are saying from the inside we are not. 

So I am still going to remain uncomfortable—it goes back a little 

bit to what Johnny Wooden used to say when he was coaching the 

UCLA Bruins, that we often in America confuse effort with accomplishment. And I am afraid we are doing an awful lot of effort. 

We are showing up daily, talking about it. But I am not comfortable yet and neither were the other people on the panel that 

we hosted. 

So if I could now go to Ms. Sugg. One of the other testimony we 

had not too long ago here was from PJM and they said notwithstanding the problems that we have with cybersecurity but the bigger issue that we have with our electric grid is the electric magnetic pulse, EMP. 

Do you agree with that, that it’s as much of a threat as cyber, 

or worse? 

Ms. SUGG. I think the probability of that occurring is much 

lower. However, the impact of it, if it were to happen, is much larger than a cyber-attack. So it is a concern. 

We are working with the vertically integrated utilities who actually own the physical equipment to understand what sort of protections and redundancies and things that they need to have in place. 

Our dependency on the telecommunication industry is certainly 

a concern there because if there were a significant EMP event it 

would take out the telecommunications. 

And while we have a lot of redundancy in telecommunications, 

if it were all to go out then we’d have to relinquish the controls 

that we have back to the utilities themselves to help manage the 

grid. 

But I know Dr. Beck is an expert on the EMP. I’ll be interested 

in his additional comments. 

Mr. MCKINLEY. If you could. We are running out of time on this. 

Dr. BECK. Sure. Well, just quickly, they are both definitely an 

issue. We will just say on the one hand we have cyber-attacks, 

which are happening right now while we are having this conversation, right, versus EMP attacks getting the bullet for the EMP attack is difficult whereas getting the bullet for a cyber-attack you 

can go out and buy it right now on any criminal hacker web site. 

So there is a much different proliferation concern. The footprints 

could be quite similar. You can distribute a cyber-attack quite 

broadly as you could with an HEMP attack and also the similarity 

in that similar types of systems can be attacked. Any computer network could be susceptible to any EMP. It could be susceptible to 

cyber. 

Mr. MCKINLEY. In respect for the time I had some other questions. Let me just close with a—I would hope, given the confusion 

out there, that we could possibly just show us what accomplishments, if periodically we get briefed on different terrorism attacks. 

If 56 were stopped last month or somehow to show that whatever 

you’re doing on cybersecurity is working. Because when I have 

these panels they don’t think it is. 

So I need to have something back to be able to support that. 

Thank you. I yield back. 

97 

Mr. OLSON. Gentleman yields back. 

The chair calls upon the gentleman from Ohio, Mr. Johnson, for 

5 minutes. 

Mr. JOHNSON. Thank you, Mr. Chairman, and I want to thank 

the panel for being here with us today. 

Mr. Aaronson, some have expressed concern that the recent episode with the electric utility in Vermont will cause industry officials to avoid or think twice about sharing information with the 

government in fear that it could be leaked. 

Trust, as we all know, is a two-way street, and while we need 

to ensure that industry officials are properly implementing and carrying out federal cybersecurity standards and regulations, the government must be a trustful cooperative partner. 

What can be done, in your opinion, if anything, to improve this 

relationship and build trust, moving forward? 

Mr. AARONSON. I appreciate the question. The first thing I’ll say 

is it would be helpful if sensitive information shared in confidence 

was not shared then with the media. 

Mr. JOHNSON. Hope you’re better at it than we are here. Go 

ahead. 

Mr. AARONSON. Well, I will say up to the moment that there was 

a front-page article in the Washington Post, I would suggest that 

the information sharing associated with the Vermont incident went 

perfectly. 

There was actionable intelligence from government officials, 

shared with the Sector Coordinating Council. We brought together 

more than 30 CEOs onto a phone call within about 4 hours. 

That information was then cascaded broadly throughout the sector at a very senior level and at the operative level both through 

the Sector Coordinating Council and the E–ISAC. Utilities across 

the sector took that information, compared it against their systems 

and what do you know, some potential indicators of compromise 

were found. That is exactly the way it’s supposed to happen. 

To answer your question about will this have a chilling effect on 

information sharing, I don’t believe it will. I think because of the 

industry’s commitment to and responsibility to help each other as 

we operate this one big machine together, there is a sense of responsibility to continue to share information even in the face of potential breach of or a potential disclosure to public sources. 

But we are looking at what happened at the end of last year as 

a teachable moment and one that we hope isn’t replicated. And I 

will give the Burlington Electric Department a ton of credit. They 

said in their statement that they would not let this episode chill 

their intent to continue to share information. 

Mr. JOHNSON. OK. Good. Well, thank you for that. Anybody else 

want to comment on that? I’ve got a couple of other questions. OK. 

Let’s talk about information sharing a little bit and we will just 

go down the line for any that want to respond. 

Why do you think situational awareness and information sharing 

is so necessary to enhance the electricity sector’s ability to prepare 

for and respond to cyber and physical threats and vulnerabilities? 

So why is situational awareness and information sharing so necessary? Mr. Cauley. 

98 

Mr. CAULEY. I think the main reason is that one company’s only 

going to view their own experience and what they see. So if a company has one laptop compromised they think, well, that laptop got 

compromised, somebody must have pushed the wrong button. 

But we are able to put together hundreds of specific instances, 

look at patterns over time and I think one of the capabilities we 

have through CRISP and through our analytics is to see patterns 

of connection points of internet locations, signatures of compromise, 

and things like that. 

We can see a pattern over 3 months, 6 months, 18 months in 

some cases and you can see what they are doing. You can actually 

watch what’s evolving in a very big picture. 

So I think that’s really the multiplier effect of being able to get 

everybody’s data and to be able to share. We share through the 

DOE lab. We work the CRISP program. 

On the back end of that is the Pacific Northwest lab. They have 

people working classified space, helping us analyze the data. So for 

us to be able to get that, what does it mean, what are people trying 

to do to us, what should we look for, we turn around and give that 

back to industry. 

Mr. JOHNSON. OK. 

Mr. AARONSON. In the interest of time, I will say Gerry is spot 

on and I would just add one more thing Ms. Sugg said earlier 

which is, I love this quote, I wrote it down: ‘‘Someone’s detection 

is someone else’s protection.’’ 

And I think everything that happens is a lesson for the rest of 

the industry. Applying it helps make us all more secure. 

Mr. JOHNSON. See something, say something. 

Mr. AARONSON. There it is. 

Mr. JOHNSON. There you go. 

Dr. BECK. I think situational awareness, even in the broadest 

terms, is important. So whether knowing about a certain attack at 

a certain utility, that whether or not it needs to be defended 

against by a different utility it’s just important to have visibility 

to those reports to understand, this situation is happening or the 

frequency of attacks or that people are reporting it I think that just 

raises the consciousness of keeping your eye on this particular ball. 

Mr. JOHNSON. OK. Ms. Sugg. 

Ms. SUGG. Very quickly, the NERC alert system certainly has 

picked up in frequency of alerting. As Mr. Cauley mentioned earlier, given the understanding that we need to be thinking about 

events at any level no matter how small, one of the things that 

makes it particularly useful to us, I believe, is the accountability 

to respond to it. 

So it’s not just a matter of, oh, I received some information and 

maybe I’ll study that someday. But NERC puts requirements 

around—you must read this, you must look at these things and you 

must report back, and I think that that helps to ensure that if 

there are vulnerabilities somewhere that some utility has found 

that they are responsible for addressing those and reporting that 

back to NERC. 

Mr. JOHNSON. OK. Great. Mr. Chairman, I yield back. Thanks for 

indulging. 

99 

Mr. OLSON. Gentleman yields back. The chair calls upon the gentleman from Michigan, Mr. Walberg, for 5 minutes. 

Mr. WALBERG. Thank you, Mr. Chairman, and thanks to the 

panel for being here. 

Coming from Michigan and my district, bordering Canada, I was 

just interested to know that since this grid is a North American 

grid, could you please describe, Mr. Aaronson, how utility industry 

coordinates with our northern neighbors on cyber and grid security. 

Mr. AARONSON. Sure, and I’ll rely on Gerry a little bit, too, given 

NERC’s responsibility as the North American Electrical Reliability 

Corporation. 

For the Sector Coordinating Council, the Canadian Electricity 

Association has been a integral part of that relationship as has the 

Canadian government. We have had not just the Department of 

Energy and Department of Homeland Security here in the United 

States but Natural Resources Canada and Public Safety Canada, 

their counterparts respectively north of the border. 

Given that this is a North American grid, we are all operating 

the same machine together, number one. Number two, you’ve seen 

in instances of particularly natural disasters where it’s not just 

crews and bucket trucks from the United States descending on affected areas but from north of the border as well. 

And then also with our nascent, but growing cyber mutual assistance program, there have been Canadian utilities as part of that 

relationship also. 

Mr. WALBERG. Mr. Cauley. 

Mr. CAULEY. So to us they are equally engaged in all of our programs. We actually have representation on the coordinating council 

at the CEO level. 

They participated in the ISAC. They follow our standards and so 

they are equal partners. We share information with them. They’ve 

had some things happen in Canada that we have not seen, like an 

airplane flying over lines and dropping wire on line. 

So somebody was disgruntled and decided to launch their own attack out of an airplane. But we share that among ourselves and we 

are able to basically learn from each other and they are equal partners and I think all the ISOs in Canada are run highly competent 

systems with the similar controls we have on the U.S. systems. 

Mr. WALBERG. Continuing on, Mr. Cauley, with some concerns 

about the relationships with Canada and ourselves from my state 

specifically, there is a growing number of interdependencies between power generation and natural gas, pipelines included. 

The two industries are similar but are different in some ways. 

How are you addressing power generation resilience to avoid single 

points of failure and what opportunities do you see, moving forward? 

Mr. CAULEY. It’s a very timely topic for us. We have actually 

been doing some recent analysis and we are in the processing of 

publishing a report to look at key parts of the gas infrastructure 

system that we depend on. 

We have now three of our eight regions that have more than 50 

percent of the power supplied by natural gas. And so pipelines and 

storage facilities do create vulnerabilities and I think not just from 

a physical perspective in terms of competition with retail gas cusVerDate Nov 24 2008 10:14 Apr 06, 2017 Jkt 037690 PO 00000 Frm 00105 Fmt 6633 Sfmt 6633 I:\MY DOCS\HEARINGS 115\HEARINGS\115-3 CHRIS
100 

tomers in extreme weather but also from a cyber perspective where 

physical attack disruptions could cascade over into electric power. 

So it’s high on our list of priorities and the one thing we do encourage is diversity in fuel and we encourage infrastructure and I 

think this is the partnership between us and Canada and the growing partnership with the infrastructure in Mexico which we are involved in will help us ensure our energy security through exchange 

of gas and electricity and renewables and all kinds of resources. 

Mr. WALBERG. And, hopefully, along with that concept, moving 

back to a more robust standard of all of the above in generation 

and fuels. 

I know there has been a push that’s pushed, at least in my district, the energy district of the state, away from having that robust 

opportunity for an all above standard. 

Mr. Cauley, let me just in the remaining few seconds here, how 

is NERC and the industry working to develop policies to encourage 

use of system components that will be less vulnerable to attack? 

And follow that up, what the Department of Energy is doing in 

this front as well and how you’re working with them? 

Mr. CAULEY. Well, our standards, and I think the experience that 

we are learning with feeding back industry encourage better protection. 

One of the things that we are seeing directly is greater diversity 

of equipment and basically reducing the criticality of an individual 

station or piece of equipment and creating redundancies in the system to make us less vulnerable. 

So I think there is a lot of examples like that where people are 

reacting to being more secure and building it into the architecture 

and design of their systems. 

Mr. WALBERG. I yield back. 

Mr. OLSON. The gentleman yields back. 

We saved the best for last. The chair calls upon the gentleman 

from Ohio, Mr. Latta, for 5 minutes. 

Mr. LATTA. Well, thank you very much, Mr. Chairman, and to 

the panel thanks very much for being here today. It’s very, very informative. 

I know that the other juries that we have had in the past year 

and two, I should say, that you know, this is a very, very important 

topic. 

It’s a very, very serious topic, and if I could start with you, Mr. 

Aaronson, if I could ask this. You mentioned in your testimony that 

you’re working with DOE to determine the scope and process for 

emergency orders. 

Would you expand on that conversation and provide insight as to 

whether there would be further action from Congress at this time? 

Mr. AARONSON. I don’t know about further action from Congress 

yet. I mentioned earlier that the notice of proposed rulemaking was 

put out a few months ago. 

We have a due date actually of this coming Monday, February 

6th, to get comments in. Those comments are helping to inform the 

process of what an emergency order from the Secretary of Energy 

might look like. 

101 

I think the most important thing, and it is built into the NOPR, 

is this idea of consultation. The law said consultation with the sector where practicable. 

Practicable to us is a little concerning, given that any emergency 

order that doesn’t take into account how grid operators actually operate the system could have unintended consequences. 

So that is a point that we are making in this response to the 

rulemaking to help inform the process. But I do think that given 

all of the great relationship we have with the secretary of energy 

and, frankly, just the Department of Energy in general as our sector-specific agency we are confident that they understand us, we 

understand them and think we can work productively with them 

to implement that emergency authority. 

Mr. LATTA. OK. Thank you. Let me follow up, and this has been 

touched on a little bit before. You said something kind of interesting that I wrote down. 

You mentioned earlier about the vulnerabilities that the—that 

are potentially a concern through the internet of things, and if you 

could expand a little bit on that work and also with the electricity 

infrastructure sharing and analysis center and beginning to fix 

those risks. 

But then you said this. I thought, this is kind of interesting. You 

said you were on a journey without a destination. That’s not real 

comforting as we are going down that road. 

Mr. AARONSON. Maybe I should pick a better cliche. 

Mr. LATTA. I write those things down. 

Mr. AARONSON. But the point I am getting across is there is no 

such thing as 100 percent security. So we are constantly evolving 

and I think that is a good thing. 

If we became stagnant and just relied on this culture of compliance and, yes, we are secure, we would not be able to be responsive 

to new and emerging threats. 

So, it’s the old joke—I don’t have to be faster than the bear, I 

just have to be faster than the other guy. There is another cliche 

to add to that—the hit list. 

But what we were doing is constantly trying to stay ahead of the 

adversary and they have intent and capabilities but we do too. 

And I think I am particularly proud of the industry’s culture of 

constantly reinventing and looking at its security posture, seeing 

where there are gaps, using exercises like GridEx, using observations from things that happen overseas and here at home and 

learning from those and then applying them to make us better. 

And to Mr. McKinley who I am sorry isn’t here, I agree I love 

the wooden quote of effort does not equal accomplishment. 

But I would say there have been a number of accomplishments 

from putting in place spare equipment programs to creating a 

cyber mutual assistance program to doing a better job of sharing 

information to developing the cyber risk information sharing program and applying it from a DOE lab into a commercial application. 

So a lot of stuff that is happening in a very short amount of time 

because of the CEO leadership of the Sector Coordinating Council. 

Mr. LATTA. Thank you. Ms. Sugg, if I could go back to what you 

also said. You said that innovation is important. Are we meeting 

102 

that innovation to make sure we keep up the standards to make 

sure that we meet these potential threats? 

Ms. SUGG. Well, innovation is certainly changing faster than the 

standards are changing, hence my comments about ensuring that 

the standards are not overly prescriptive but are more focused on 

the risk. 

Innovation is important whether it be trying to understand the 

threat avenues from our attackers or understanding the newer and 

more interesting technologies that are coming to bear that may 

provide some additional securities for us beyond what we have 

today. 

We don’t ever want to be really comfortable with our architecture 

that we have in place. We need to continue to look at opportunities 

to strengthen it, depending on what technologies are available and 

matching that up with where the threats seem to be coming in and 

how we can try to get ahead of that. 

Mr. LATTA. Thank you. 

Mr. Chairman, my time has expired and I yield back. 

Mr. OLSON. Gentleman yields back and the chair would like to 

have one invitation for the witnesses. 

If you want to see a robust grid security in action at a small 

level, come to Houston, Texas this weekend. There is this big football game called Super Bowl 51. It’s not a power grid, but as you 

can imagine, if the power goes down right as the Falcons are about 

to score that touchdown to beat the Patriots, there will be a riot 

of biblical proportions. Invitation does not come with tickets, and 

that’ll cost you a pretty penny. 

But seeing no further members wishing to ask questions, I want 

to thank all of our witnesses for your participation in today’s hearing. 

And pursuant to committee rules, I remind members that they 

have 10 business days to submit additional questions for the record 

and ask the witnesses to submit their responses in 10 business 

days upon receipt of the questions. 

Mr. Rush, before you leave I ask for uanimous consent that a 

statement for the record from the Large Public Power Council and 

a statement from the American Public Power Association and 

NRECA be put in the record. 

Without objection, the subcommittee is adjourned. 

[Whereupon, at 12:49 p.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

103 


24845.090
104 


24845.091
105 


24845.092
106 


24845.093
107 


24845.094
108 


24845.088
109 


24845.089
110 


24845.051
111 


24845.052
112 


24845.053
113 


24845.054
114 


24845.055
115 


24845.056
116 


24845.057
117 


24845.058
118 


24845.059
119 


24845.060
120 


24845.061
121 


24845.062
122 


24845.063
123 


24845.064
124 


24845.065
125 


24845.066
126 


24845.067
127 


24845.068
128 


24845.069
129 


24845.070
130 


24845.071
131 


24845.072
132 


24845.073
133 


24845.074
134 


24845.075
135 


24845.076
136 


24845.077
137 


24845.078
138 


24845.079
139 


24845.080
140 


24845.081
141 


24845.082
142 


24845.083
143 


24845.084
144 


24845.085
145 


24845.086
146 

Æ 


24845.087