I 
111TH CONGRESS 
1ST SESSION H. R. 2195 
To amend the Federal Power Act to provide additional authorities to ade-
quately protect the critical electric infrastructure against cyber attack, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 30, 2009 
Mr. THOMPSON of Mississippi (for himself, Mr. KING of New York, Ms. 
CLARKE, Mr. DANIEL E. LUNGREN of California, Ms. JACKSON-LEE of 
Texas, Ms. LORETTA
SANCHEZ
of California, Ms. HARMAN, Mr. 
CUELLAR, Mr. CARNEY, Ms. ZOE LOFGREN of California, Mr. PASCRELL, 
Mr. LUJA´N, and Mr. LANGEVIN) introduced the following bill; which was 
referred to the Committee on Energy and Commerce, and in addition to 
the Committee on Homeland Security, for a period to be subsequently de-
termined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To amend the Federal Power Act to provide additional au-
thorities to adequately protect the critical electric infra-
structure against cyber attack, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. CRITICAL ELECTRIC INFRASTRUCTURE. 
(a) FINDINGS.— 
(1) The critical electric infrastructure of the 
United States and Canada has more than $1 trillion 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
in asset value, more than 200,000 miles of trans-
mission lines, and more than 800,000 megawatts of 
generating capability, serving over 300 million peo-
ple. 
(2) The effective functioning of this infrastruc-
ture is highly dependent on computer-based control 
systems that are used to monitor and manage sen-
sitive processes and physical functions. 
(3) These control systems are becoming increas-
ingly connected to open networks, such as corporate 
intranets and the Internet. According to the Depart-
ment of Homeland Security’s United States Com-
puter Emergency Readiness Team (‘‘US–CERT’’), 
this transition towards widely used technologies and 
open connectivity exposes control systems to the 
ever-present cyber risks that exist in the information 
technology world in addition to control system spe-
cific risks. 
(4) Malicious actors pose a significant risk to 
this infrastructure. The Federal Bureau of Inves-
tigation (‘‘FBI’’) has identified multiple sources of 
threats, including foreign nation states, domestic 
criminals and hackers, and disgruntled employees. 
(5) Intentional or naturally occurring Electro-
magnetic Pulse (‘‘EMP’’) events also threaten crit-
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
ical electric infrastructure. The Commission to As-
sess the Threat to the United States from EMP At-
tack reported in 2008 that an EMP attack could 
cause significant damage or disruption to critical 
electric infrastructure and other critical infrastruc-
ture due to the widespread use of Supervisory Con-
trol and Data Acquisition (‘‘SCADA’’) systems. The 
National Academy of Sciences also reported in 2008 
that Severe Space Weather Events could produce 
similar results. 
(6) The Department of Homeland Security’s 
Control Systems Security Program is designed to in-
crease the reliability, security, and resilience of con-
trol systems to guard against and enhance domestic 
preparedness for and collective response to a cyber 
attack by a terrorist or other person. This is done 
by developing voluntary cyber risk reduction prod-
ucts, supporting the Department of Homeland Secu-
rity’s Industrial Control Systems Computer Emer-
gency Response Team (‘‘ICS–CERT’’) in developing 
vulnerability mitigation recommendations and strate-
gies, and coordinating and leveraging activities for 
improving the Nation’s critical infrastructure secu-
rity posture. 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
(7) According to recent news reports, the elec-
tronic control systems of the electrical system in the 
United States have been routinely penetrated and 
compromised. According to current and former na-
tional security officials, cyber spies from China, Rus-
sia, and other countries have penetrated the United 
States electrical system in order to map the system, 
and have left behind software programs that could 
be used to disrupt and disable the system. 
(8) In the interest of national security, and to 
enhance domestic preparedness for and collective re-
sponse to a cyber attack by a terrorist or other per-
son, a statutory mechanism is necessary to protect 
the critical electric infrastructure against cyber 
threats. 
(9) In spite of existing mandatory cybersecurity 
standards, a report from the North American Elec-
tric Reliability Corporation (‘‘NERC’’) suggests that 
many utilities are underreporting their assets, poten-
tially to avoid compliance requirements. In April 
2009, NERC reported that only 23 percent of re-
sponding utilities identified a ‘‘Critical Cyber Asset’’ 
as required by NERC Reliability Standard 002–1. 
According to NERC, the results of this survey sug-
gest that utilities may not have identified certain 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
qualifying assets as ‘‘Critical’’. NERC requested 
that entities take a fresh, comprehensive look at 
their methodology in order to identify and secure 
more Critical Cyber Assets. 
(10) On May 21, 2008, in testimony before the 
House Committee on Homeland Security, Joseph 
Kelliher, then-Chairman of the Federal Energy Reg-
ulatory Commission (‘‘the Commission’’), stated that 
his agency is in need of additional legal authorities 
to adequately protect the electric power system 
against cyber attack. 
(b) RESEARCH ON CYBER COMPROMISE OF CRITICAL 
ELECTRIC INFRASTRUCTURE.—(1) Pursuant to section 
201 of the Homeland Security Act of 2002 (6 U.S.C. 121) 
and in furtherance of domestic preparedness for and col-
lective response to a cyber attack by a terrorist or other 
person, the Secretary of Homeland Security, working with 
other national security and intelligence agencies, shall con-
duct research and determine if the security of federally 
owned programmable electronic devices and communica-
tion networks (including hardware, software, and data) es-
sential to the reliable operation of critical electric infra-
structure have been compromised. 
(2) The scope of the research referred to in para-
graph (1) shall include: the extent of compromise, identi-
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
fication of attackers, the method of penetration, ramifica-
tions of the compromise on future operations of critical 
electric infrastructure, secondary ramifications of the com-
promise on other critical infrastructure sectors and the 
functioning of civil society, ramifications of compromise 
on national security, including war fighting capability, and 
recommended mitigation activities. 
(3) The Secretary of Homeland Security shall report 
the findings to the appropriate committees of Congress, 
including the Committee on Homeland Security of the 
House of Representatives and the Homeland Security and 
Governmental Affairs Committee of the Senate. The re-
port may contain a classified annex. 
(c) FEDERAL POWER ACT AMENDMENT.—Part II of 
the Federal Power Act (16 U.S.C. 791a and following) 
is amended by adding the following new sections at the 
end thereof: 
‘‘SEC. 224 CRITICAL INFRASTRUCTURE. 
‘‘(a) DEFINITIONS.—For purposes of this section: 
‘‘(1) CRITICAL ELECTRIC INFRASTRUCTURE.— 
The term ‘critical electric infrastructure’ means sys-
tems and assets, whether physical or cyber used for 
the generation, transmission, distribution, or meter-
ing of electric energy that, in the determination of 
the Commission, in consultation with the Secretary 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
of Homeland Security and other national security 
agencies, are so vital to the United States that the 
incapacity or destruction of such systems and assets, 
either alone or in combination with the failure of 
other assets, would cause significant harm to the se-
curity, national or regional economic security, or na-
tional or regional public health or safety. 
‘‘(2) CRITICAL ELECTRIC INFRASTRUCTURE IN-
FORMATION.—The term ‘critical electric infrastruc-
ture information’ means critical infrastructure infor-
mation related to critical electric infrastructure. 
‘‘(3) CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the same meaning as is given that term in sec-
tion 212(3) of the Critical Infrastructure Informa-
tion Act of 2002 (6 U.S.C. 131(3)). 
‘‘(4) CYBER THREAT.—The term ‘cyber threat’ 
means any act by a terrorist or other person that 
disrupts, attempts to disrupt, or poses a significant 
risk of disruption to the operation of programmable 
electronic devices and communication networks (in-
cluding hardware, software, and data) essential to 
the reliable operation of critical electric infrastruc-
ture. 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
‘‘(5) CYBER VULNERABILITY.—The term ‘cyber 
vulnerability’ means any weakness that, if exploited 
by a terrorist or other person, poses a significant 
risk of disruption to the operation of programmable 
electronic devices and communication networks (in-
cluding hardware, software, and data) essential to 
the reliable operation of critical electric infrastruc-
ture. 
‘‘(b) ASSESSMENT, REPORT, 
AND
DETERMINA-
TION.— 
‘‘(1) IN GENERAL.—Pursuant to section 201 of 
the Homeland Security Act of 2002 (6 U.S.C. 121), 
the Secretary of Homeland Security shall assess 
cyber vulnerabilities or threats to critical infrastruc-
ture, including critical electric infrastructure and ad-
vanced metering infrastructure, on an ongoing basis 
and produce reports, including recommendations, on 
a periodic basis for the purposes of homeland secu-
rity, including the enhancement of domestic pre-
paredness for and collective response to a cyber at-
tack by a terrorist, nation-state, or other person, 
and for other purposes. 
‘‘(2) ELEMENTS OF THE REPORT.—The Sec-
retary shall— 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
‘‘(A) include in the reports under this sec-
tion findings regarding a cyber vulnerability or 
terrorist threat or potential terrorist threat, and 
a nation-state threat or potential threat to crit-
ical electric infrastructure; and 
‘‘(B) provide recommendations regarding 
actions that may be performed to enhance indi-
vidualized and collective domestic preparedness 
and response to the cyber vulnerability or ter-
rorist or nation-state. 
‘‘(3) TRANSMITTAL
OF
REPORT.—The Sec-
retary of Homeland Security shall transmit reports 
prepared in response to the cyber vulnerability or 
threat to the Commission and the appropriate com-
mittees of Congress, including the Committee on 
Homeland Security of the House of Representatives 
and the Homeland Security and Governmental Af-
fairs Committee of the Senate, of the Secretary’s de-
terminations under this section. Each such report 
may contain a classified annex. 
‘‘(4) TIMELY DETERMINATION.—If, in carrying 
out the assessment required under paragraph (1), 
the Secretary of Homeland Security determines that 
a significant cyber vulnerability or threat to critical 
electric infrastructure has been identified, the Sec-
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
retary of Homeland Security shall communicate such 
a determination to the Commission in a timely man-
ner. The Secretary of Homeland Security may incor-
porate intelligence or information received from 
other national security or intelligence agencies in 
making such determination. 
‘‘(c) COMMISSION AUTHORITY.— 
‘‘(1) ISSUANCE OF RULES OR ORDERS.—Fol-
lowing receipt of a finding under subsection (b), the 
Commission shall issue (and from time to time 
thereafter amend) such rules or orders as are nec-
essary to protect critical electric infrastructure 
against vulnerabilities or threats. 
‘‘(2) EMERGENCY PROCEDURES.—The Commis-
sion may issue, in consultation with the Secretary of 
Homeland Security, a rule or order under this sec-
tion without prior notice or hearing if it determines 
the rule or order must be issued immediately to pro-
tect critical electric infrastructure from an imminent 
threat or vulnerability. 
‘‘(d) DURATION
OF EMERGENCY RULES
OR OR-
DERS.—Any rule or order issued by the Commission with-
out prior notice or hearing under subsection (c)(2) shall 
remain effective for not more than 90 days unless, during 
such 90 days, the Commission gives interested persons an 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
opportunity to submit written data, views, or arguments 
(with or without opportunity for oral presentation) and af-
firms, amends, or repeals the rule or order. 
‘‘(e) JURISDICTION.—Notwithstanding section 201, 
the provisions of this section shall apply to any entity that 
owns, controls, or operates critical electric infrastructure, 
and such entities shall be subject to the jurisdiction of the 
Commission for purposes of carrying out this section and 
for purposes of applying the enforcement authorities of 
this Act with respect to such provisions, but shall not 
make an electric utility or any other entity subject to the 
jurisdiction of the Commission for any other purposes. 
‘‘(f) PROTECTION OF CRITICAL ELECTRIC INFRA-
STRUCTURE INFORMATION.—The provisions of section 
214 of the Homeland Security Act of 2002 (6 U.S.C. 133) 
shall apply to critical electric infrastructure information 
submitted to the Commission under this section to the 
same extent that they apply to critical infrastructure in-
formation voluntarily submitted to the Department of 
Homeland Security under that Act (6 U.S.C. 101 and fol-
lowing). 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
‘‘SEC. 
224B. 
PROTECTION 
AGAINST 
KNOWN 
CYBER 
VULNERABILITIES 
OR 
THREATS 
TO 
THE 
CRITICAL ELECTRIC INFRASTRUCTURE. 
‘‘(a) INTERIM MEASURES.—After notice and oppor-
tunity for comment, the Commission shall establish, in 
consultation with the Secretary of Homeland Security, by 
rule or order, within 120 days of enactment of this section, 
such mandatory interim measures as are necessary to pro-
tect against known cyber vulnerabilities or threats to the 
reliable operation of the critical electric infrastructure in 
the United States. Such interim reliability measures: 
‘‘(1) shall serve to supplement, replace, or mod-
ify cybersecurity reliability standards that, as of the 
date of enactment of this section, were in effect pur-
suant to section 215, but that are determined by the 
Commission, in consultation with the Secretary of 
Homeland Security and other national security agen-
cies, to be inadequate to address known cyber 
vulnerabilities or threats; and 
‘‘(2) may be replaced by new cybersecurity reli-
ability standards that are developed and approved 
pursuant to section 215 following the date of enact-
ment of this section. 
‘‘(b) PLANS.—The rule or order issued under this 
subsection may require any owner, user or operator of crit-
ical electric infrastructure in the United States to develop 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS
a plan to address cyber vulnerabilities or threats identified 
by the Commission and to submit such plan to the Com-
mission for approval.’’. 
SEC. 2. EVALUATION OF EXISTING AUTHORITIES. 
Section 214 of title II, subtitle B of the Homeland 
Security Act of 2002 (6 U.S.C. 133(i)) is amended by add-
ing at the end the following: 
‘‘(i) REVIEW OF AUTHORITIES TO PROTECT CRIT-
ICAL INFRASTRUCTURE.—The Secretary of Homeland Se-
curity shall evaluate the capacity and authority of the De-
partment of Homeland Security and other Federal agen-
cies to ensure the security and resilience of electronic de-
vices and communication networks essential to each of the 
critical infrastructure sectors identified pursuant to 
Homeland Security Presidential Directive 7 against a 
cyber attack by a terrorist, nation-state, or other person, 
for the purpose of enhancing domestic preparedness for, 
and collective response to, a cyber attack by a terrorist, 
nation-state, or other person and to enhance the Nation’s 
homeland security posture.’’. 
Æ 
VerDate Nov 24 2008 
03:24 May 02, 2009
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H2195.IH
H2195
jbell on PROD1PC69 with BILLS