Source: https://michaelmabee.info/tag/michael-mabee/
Timestamp: 2019-04-18 13:03:01+00:00

Document:
Consider this: The North American Electric Reliability Corporation (NERC) reported ZERO “Cybersecurity Incidents” for the last three years. But NERC is withholding the names of cyber violators from the public because of the “Cybersecurity Incidents” over the last three years.
So, not only does literally everybody in the U.S. pay an electric bill; not only do we all rely on the electric grid for everything necessary for life – but it seems the electric grid also thinks we are all stupid.
Seriously, here is the issue: Secret self-regulation does not work.
Disclosure is the cornerstone of a successful regulatory scheme in a free society. The Securities and Exchange Commission routinely publicizes the names of companies and individuals subject to regulatory actions under U.S. securities laws; the Food and Drug Administration routinely publicizes the names of companies whose food is being recalled due to public safety concerns; the National Transportation Safety Board routinely publicizes the names of companies responsible for airplane crashes. There are numerous other examples of appropriate disclosure. It is high irony that public disclosure has made food consumption and airline travel extremely safe for Americans while a far greater danger – the threat of long-term blackout for millions – has been neglected by the responsible federal regulator, FERC.
The Secure The Grid Coalition is fighting to fix the electric grid’s broken regulatory scheme that is endangering all of us. The fight is shaping up around the issue of a $10 million penalty NERC imposed on January 25, 2019 against unnamed companies that committed 127 violations of Critical Infrastructure Protection (CIP) standards over several years. The press has since outed Duke Energy Corp as the violator, but neither NERC or the U.S. government have acknowledged this. The coverup remains.
You can join us and be heard!
We need to all let the Federal Energy Regulatory Commission (FERC) know that the security of the electric grid is critical – secret regulation and coverups are unacceptable to the public. As a citizen, you have the right to file a “Motion to Intervene” in this docket and be heard! The deadline to file on this docket is March 29, 2019 so write your letter today and submit it online to FERC Docket Number NP19-4-000, or mail it in to FERC (Be sure to include the Docket Number in your letter).
Michael Mabee, a private citizen, requests the Commission’s leave to intervene in the above captioned docket, pursuant to 18 C.F.R. § 39.7(e)(4). I request that 1) the Commission review this Notice of Penalty (NOP) to ensure that it is in the public interest, and 2) that the name of the entities(s), the unredacted Notice of Penalty and the unredacted settlement agreement be released in the public docket. NERC has made redactions to the publicly available documents, alleging the identities and other identifying information about Critical Infrastructure Protection (CIP) standards violators must be kept from the public. The lack of transparency in this Notice of Penalty raise significant public interest concerns.
[T]he 127 violations collectively posed a serious risk to the security and reliability of the BPS (Bulk Power System). The Companies’ violations of the CIP Reliability Standards posed a higher risk to the reliability of the BPS because many of the violations involved long durations, multiple instances of noncompliance, and repeated failures to implement physical and cyber security protections.
The REs determined that the Companies allowed interactive remote access to the BCSs (Bulk Electric System Cyber Systems) inside the Companies ESP (Electronic Security Perimeter) without first going through an Intermediate System, utilizing encryption, and requiring multi-factor authentication.
The violated standard, CIP-005-5-2 R2, became effective in July 2015. Without the violator having fear of public scrutiny, it is apparent that even three and one-half years have not been sufficient time for “the Companies” to remedy this currently ongoing violation.
On February 1, 2019, trade publication EnergyWire disclosed that Duke Energy is the unnamed standards violator. Duke Energy is one of America’s largest utilities, with 7.2 million customers across seven states. Duke’s generation fleet includes six nuclear plants. A physical or cyber-attack on Duke could cause a long-term, wide-area blackout and result in release of radioactive contaminants. Nonetheless, the NERC standard enforcement regime, with its practice of hiding the names of violators under the guise of so-called Critical Energy/Electric Infrastructure Information (CEII), has failed to assure the protection of Americans depending on Duke for their electric power.
The NERC-imposed fine was $10 million, tiny in comparison to Duke’s 2017 net income of $3 billion.
NERC’s coverup of the identity of the violator (‘the Companies”), the identity of the regulator (the “Regional Entities” or “REs”), and settlement agreement are profoundly against the public interest. FERC should not tolerate this concealment by NERC. “The Companies” were subjected to a $10-million fine for 127 cybersecurity violations; the details of this compliance gap are of great public interest. The public must be able to cast scrutiny over the activities of NERC and its regulated entities for the self-regulatory scheme codified in Section 215 of the Federal Power Act to be effective.
Providing misleading interpretations of Commission orders.
18 CFR § 39.7 (b)(4) allows the “disposition of each violation” (or alleged violation) to be made nonpublic, but only if disclosure of the “disposition” would jeopardize security of the Bulk Power System. Again, the “name of the entity” is not part of “disposition” of the violation, so there is never an exemption of the violator’s name from public disclosure. Nor has NERC made a credible case that disclosure of the “disposition” of the Duke violations would jeopardize the security of the Bulk-Power System, especially when the violations do not involve bona fide Cybersecurity Incidents as defined in 18 CFR § 39.1.
FERC has made no public order (or change in regulation) to allow NERC to withhold the “notice of penalty” for the Duke NOP (or any other NOP). If FERC has made a private directive to NERC to withhold the “disposition” of the violations in Duke NOP, and other NOPs, then the public interest demands that the text of this hidden FERC directive and its underlying legal rationale be promptly released by the Commission.
NERC’s “Cybersecurity Incident” Shell Game.
Cybersecurity Incident means a malicious act or suspicious event that disrupts, or was an attempt to disrupt, the operation of those programmable electronic devices and communications networks including hardware, software and data that are essential to the Reliable Operation of the Bulk-Power System.
There is no allegation in the NOP of a malicious act or suspicious event that disrupted or attempted to disrupt the Reliable Operation of the Bulk-Power System. This was simply a regulatory action after instances of noncompliance of CIP standards were discovered, either through self-reports or regulatory audits.
Yet somehow, in the Duke NOP NERC claims the name of “the Companies” must be withheld from public scrutiny since these are “cybersecurity incidents.” Since the violations described in the Duke NOP occurred over the same time period that NERC reported that there were no reportable “cybersecurity incidents”, the public is confused. Why is it we cannot have the name of the violator? In its State of Reliability report NERC says that there were no reportable cybersecurity incidents, but the Duke NOP contains descriptions of “cybersecurity incidents” so serious they must be redacted? NERC’s twisted logic defies all commonsense.
Further, to the extent that NERC attempts to argue that disclosure of the name of the regulated entity or the settlement agreement “would jeopardize the security of the Bulk-Power System if publicly disclosed”, their argument falls flat. In fact, it is misleading.
Nothing in this NOP credibly alleges that a “Cybersecurity Incident” as defined in 18 CFR § 39.1 has taken place. Moreover, NERC provides no evidence or argument, other than a conclusory statement, that disclosure of the redacted information would jeopardize Bulk-Power System security.
Consistent with the Commission’s statement, NERC is treating as nonpublic the identity of the Companies and any information that could lead to the identification of the Companies.
In other words, NERC is blaming FERC for the coverup by quoting this out of context passage and apparently misapplying federal regulations.
If NERC has direction from FERC allowing redaction of Notices of Penalty, the public interest demands that FERC release the text of this direction. If in fact there is no direction from FERC, the Commission should make this clear.
Perhaps NERC is somehow arguing that releasing any data that identifies any entity that is subject to a regulatory action (or even the identity of the regulator or “Regional Entity”) will endanger the Bulk-Power System. One way to read this argument is is that since our regulatory regime is so weak and ineffective, a coverup is necessary so the “malicious actors” don’t find out how vulnerable we are.
Newsflash: Our enemies already know.
NERC’s Abuse of the CEII Rule.
Presently, NERC as ERO, is improperly using the Critical Energy/Electric Infrastructure Information (CEII) rule to hide from public view the identities of entities that violate Critical Infrastructure Protection (“CIP”) Reliability Standards – even when the violation has been abated and there is no arguable security need to withhold this information. Essentially, NERC and the Regional Entities are misusing FERC’s authority to shield industry from public scrutiny. The Commission must not allow this practice repugnant to the public interest to continue.
NERC has for years been classifying the names of the violators and the settlement agreements as “nonpublic” and tries to argue that FERC also deems these documents as “nonpublic” – not so according to the regulations.
Finally, even the Commission’s own interpretation of the Critical Energy Infrastructure Information rules support disclosure. I note that FERC Order No. 833 holds that the Commission’s practice is that information that “simply give[s] the general location of the critical infrastructure” or simply provides the name of the facility is not Critical Energy Infrastructure Information (CEII).
The NERC Enforcement Regime is Broken and Endangers the U.S.
CIP regulations should protect the U.S. electric grid by holding “the Companies” accountable to protect the portion of the U.S. critical infrastructure that they own or operate. Instead, NERC has twisted this regulatory scheme into a sham where companies have no incentive to do more than the minimum. If caught violating a CIP standard, NERC and the Regional Entities will settle the matter privately with “the Companies,” negotiating a “penalty” that “the Companies” are willing to pay and will keep the matter from public view. A great deal for “the Companies” – not so much for the American people.
Malicious individuals already target the Companies’ operational personnel, seeking bits and pieces of data to map the Companies’ systems and identify possible attack vectors. The public disclosure of a single piece of redacted information may not, on its own, provide everything needed to exploit an entity and attack the electric grid. But, successive public disclosures of additional pieces of redacted information will increase the likelihood of a cyber-intrusion with a corresponding adverse effect on energy infrastructure. Each successive disclosure could fill in some knowledge gaps of those planning to do harm, helping to complete the maps of entity systems. Therefore, it is important to examine and evaluate the redacted information in the aggregate.
This is a generic argument that any information of any kind identifying “the Companies” would assist hackers. Therefore, according to NERC, hiding the names of the companies will somehow thwart the Chinese and Russian hackers.
What would work better is if “the Companies” took the CIP regulations seriously and put effort in to thwart the malicious individuals. What would also help is if NERC became a regulator rather than an industry advocate. Public scrutiny of regulatory failings is the time-tested method to ensure accountability in a free society.
Russia has the ability to execute cyber attacks in the United States that generate localized, temporary disruptive effects on critical infrastructure—such as disrupting an electrical distribution network for at least a few hours—similar to those demonstrated in Ukraine in 2015 and 2016. Moscow is mapping our critical infrastructure with the long-term goal of being able to cause substantial damage.
Finally, NERC has no problem providing all this identifying information on its website on all active registered entities in its “NERC Active Compliance Registry Matrix” (NCR). Exhibit A is the most recent list of all the 1495 registered entities – with NRC ID and functions – pieces of information redacted in the NOP – and in all other NOP’s since July 6, 2010. I obtained this list from NERC’s public website on February 10, 2019. So this list apparently poses no information of interest to “malicious individuals” but somehow NERC argues that the name of the of the entity subjected to a regulatory action in every single CIP violation since July of 2010 somehow poses such a threat.
Since NERC began covering up the names of CIP violators – as they are continuing to do in this NOP – there has been less incentive to fix the grid security problems. That’s why disclosure is important. Why should utilities spend money to fix grave cybersecurity issues if they know that 1) if caught, their friendly regulator will “settle” the violation privately and the settlement agreement will be kept secret, 2) the utility can negotiate a trivial fine, and 3) the utility’s name will not be disclosed to the public?
On the surface, it is hard to understand why the industry has taken the lack of transparency approach to CIP regulation. However, upon closer historical examination, the industry has crafted its own favorable (to the industry) regulatory scheme whereby it implements whatever protections are convenient and inexpensive – but it can avoid any protections that the industry deems too “burdensome.” Simply put, the security of the electric grid is apparently optional – we depend on about 1,500 electric utility industry entities to do the right thing – but there is no strong requirement that they do the right thing.
A logical conclusion one can draw from this set of facts is that the industry seeks to avoid public exposure for their inaction on cyber security. Under the guise of protecting us (because we the public cannot be trusted with this sensitive information) private, secret regulation is ongoing, with back-room settlements and handshake penalties. Thus, “the Companies” and their shareholders avoid the embarrassment of being outed for a lack of action on Critical Infrastructure protection (CIP) standards. And NERC is not held accountable for their ineffective enforcement regime.
Meanwhile, after a decade of inaction, it is well known that our electric grid is vulnerable – and in fact, has been penetrated and probed. This regulatory scheme has not made us safer.
The federal regulations are very clear that the name of the entity on whom the NERC penalty is imposed must be disclosed, along with the settlement agreements and all documents necessary for public scrutiny of the regulatory transaction. FERC has failed to enforce its own regulations, with great harm to the public interest.
For all of the forgoing reasons, I request that the Commission fully review the Notice of Penalty in this docket and require that the identity of “the Companies”, names of the regional entities, the full text of the settlement agreement, and all other redacted information is promptly disclosed to the public.
If FERC’s practice of allowing NERC to hide the names of cybersecurity violators was going to help electric grid security, it should have worked over the past nine years. The Director of National Intelligence says that America’s electric grid is at grave risk of cyberattack—it is obvious that reform of this weak enforcement regime is long overdue.
 Sobczak, Blake and Behr, Peter. “Duke agreed to pay record fine for lax security — sources” E&E News, February 1, 2019. https://www.eenews.net/energywire/2019/02/01/stories/1060119265?fbclid (accessed February 5, 2019).
 See: https://www.nerc.com/pa/RAPA/PA/Performance%20Analysis%20DL/NERC_2018_SOR_06202018_Final.pdf (accessed February 20, 2019).
 It is noteworthy that on February 14, 2019 in a hearing before the Senate Committee on Energy and Natural Resources – a hearing attended by both the President and CEO of NERC as well as the Chairman of the Commission – Senator Angus King noted unequivocally that “the Russians are already in the grid.” See: https://michaelmabee.info/senate-cybersecurity-hearing/ (accessed February 20, 2019).
 18 CFR § 388.113, et seq.
 FERC Order No. 833 at pg. 17. Also see 18 C.F.R. §388.113(c)(1)(iv).
 Coats, Daniel R. “Worldwide Threat Assessment of the U.S. Intelligence Community” Senate Select Committee on Intelligence. January 29, 2019. https://www.dni.gov/files/ODNI/documents/2019-ATA-SFR—SSCI.pdf (accessed February 5, 2019).
 See: https://www.nerc.com/pa/comp/Pages/Registration.aspx (accessed February 10, 2019).
 We found there were 172 instances of the word “burden” in industry comments on FERC Docket RM17-13-000 (cyber security rulemaking) https://michaelmabee.info/grid-cybersecurity-comments-ferc/ (accessed February 10, 2019).

References: § 39
 § 39
 § 39
 § 39
 § 388
 §388