Source: https://michaelmabee.info/category/grid-protection/
Timestamp: 2019-04-20 08:50:03+00:00

Document:
For almost 9 years, FERC has aided and abetted a massive coverup. Now they can choose to do the right thing—or not.
Commissioner Cheryl LaFleur is rightfully being shown the door.
In July of 2010 Cheryl LaFleur became a Commissioner with the Federal Energy Regulatory Commission (FERC). That same month, The North American Electric Reliability Corporation (NERC) began covering up the names of companies that endangered the electric grid. The coverup has continued unabated until the present.
Thankfully for America, Commissioner LaFleur, who for years has allowed this misbehavior by the electric industry, is getting the boot.
Now it is time for the remaining FERC Commissioners to clean up LaFleur’s mess.
The three remaining Commissioners are: Chairman Neil Chatterjee (on FERC since August 8, 2017), Commissioner Richard Glick (on FERC since November 29, 2017) and Commissioner Bernard L. McNamee (on FERC since December 11, 2018). Are they going to step up and fix the broken regulatory scheme that endangers the electric grid?
On April 2, 2019, there was a bad sign—FERC denied my FOIA request to release to the public the identities of the companies who endangered the electric grid. I have filed an appeal, which is available below.
Bottom line: NERC’s secret regulatory system of back-room settlements and handshake penalties for Critical Infrastructure Protection (CIP) standards violations has not worked and is not working (except for the Russians and the Chinese, for whom it is working quite well). We need immediate action.
The time for Mr. Nice Guy is over.
FERC – This is a national emergency!
Will Chairman Chatterjee step up?
The electric industry, including their purported regulator NERC and the other industry trade groups, have given cybersecurity and physical security only lip service for a decade. Meanwhile, our most critical of assets—the U.S. electric grid—is at grave risk.
We need to “Red Team” utilities that have challenges and help them fix themselves (to the extent that they are willing). DHS and DoD have the expertise to help—but only FERC has the authority to make this happen.
We need to “Black Hat” regulate chronic violators and hold them accountable with stiff penalties and public scrutiny.
—or accept responsibility when lots of Americans die in a massive power outage.
Yes, FERC Commissioners—it is your job.
There is no valid FOIA exemption that would prevent the release of this information.
It would enhance the security of the critical infrastructures to release this information to the public.
The names of violators in a regulatory regime overseen and approved by the United States government must be made available to the public. Legitimately sensitive and harmful information can be protected by exemptions to the FOIA, but disclosing the name of a company that is subject to a regulatory action does not harm national security. In fact, the opposite is true. When the names of violators are withheld from public scrutiny, the incentive for bad behavior is increased. Indeed, if national security is the true rationale for the FERC/NERC regulatory regime, then Congress and the public should have the right to know how this regime (or concealment scheme) is working.
On December 18, 2018 I submitted a FOIA request to the Federal Energy Regulatory Commission (FERC), Request FOIA-2019-19. I subsequently filed an amended FOIA request on January 4, 2019. The original and amended requests are attached hereto as Exhibit A.
On January 18, 2019 FERC sent a letter to the North American Electric Reliability Corporation (NERC) requesting their views on the release of the information I seek. This FERC letter is attached hereto as Exhibit B. Apparently, NERC, the industry Trade Associations and some individual companies responded, but their responses have not yet been provided to me and are presently the subject of a separate FOIA request (FOIA 2019-0056).
On February 28, 2019 FERC issued a “Notice of Intent to Release” letter to the parties, which is attached as Exhibit E. On March 18, 2019 FERC issued an “Initial Release Letter” to the parties which is attached as Exhibit F. FERC subsequently released the identity of the UREs in two of the 53 FERC dockets covered by my FOIA request.
On March 28, 2019 the Trade Associations disclosed their objections to this FOIA as well as a related FOIA request: FOIA 2019-0030 as exhibits to a Motion to Intervene on FERC Docket NP19-4-000. I have attached those responses as Exhibits C and D.
On April 2, 2019 FERC issued a second determination letter in FOIA 2019-0019 denying my request for FERC to disclose the identities of the “UREs” who violated CIP regulations in FERC Docket Numbers NP14-30, NP14-37, and NP14-39.” FERC’s April 2, 2019 letter (entitled “FOIA FY19-19 (Rolling) Denial (NP14-30, NP14-37, and NP14-39)—Second Response Letter”) is attached as Exhibit G.
There is no apparent difference in law between the February 28 decision of FERC to release the identities of UREs and the April 2 decision of FERC to deny release of URE identities. In fact, the only apparent rationale is the intervening entreaties to FERC by the industry Trade Associations on March 28, 2019 in Docket NP19-4-000 to withhold the names of their misbehaving members from public scrutiny. In fact, the Trade Associations used their filing under Docket NP19-4-000 as an opposition to my FOIA requests.
Pressure on FERC by the Trade Associations is not an allowed FOIA exemption.
III. Withholding the names of CIP violators from the public has not made the electric grid more reliable and America more secure. In fact, the opposite is true.
NERC and the Trade Associations argue that the names of the CIP violators must be kept from the public in order to protect us. The record on this matter demonstrates that this clearly is not true. In fact, the evidence infers that the continued withholding of this information is placing the critical infrastructures, and the public, in more danger.
The practice of withholding the names of the CIP violators from the public began in July of 2010. If we take NERC at their word that the reason the names of CIP violators are being withheld from public scrutiny is to protect Americans, we should see some improvement in the security of our electric grid between 2010 and the present.
Russia has the ability to execute cyber attacks in the United States that generate localized, temporary disruptive effects on critical infrastructure, such as disrupting an electrical distribution network for at least a few hours, similar to those demonstrated in Ukraine in 2015 and 2016. Moscow is mapping our critical infrastructure with the long-term goal of being able to cause substantial damage.
In addition, as noted in a recent survey conducted by industry and the Center for Strategic and International Studies, more than half of the operators of power plants and other “critical infrastructure” components reported that their computer networks had been infiltrated by sophisticated adversaries. Furthermore, during recent testimony to Congress, the Director of National Intelligence stated that the cyber security threat was growing at an unprecedented rate and stressed the need for increased cooperation between government and industry to help alleviate the threats. The importance of implementing effective cyber security measures over the power grid was recently highlighted by the discovery of sophisticated malware within various industrial control systems. An industry expert also noted that there have been more than 125 industrial control system incidents resulting in impacts ranging from environmental and equipment damage to death.
When examining the Director of National Intelligence’s January 29, 2019 report quoted above, one thing is apparent: For eight years the Director of National Intelligence and other federal officials have warned that our grid has been penetrated by adversaries.
If keeping the names of the CIP violators from the public was going to make the grid more reliable and the nation more secure, it should have worked by now. Why is the public being kept in the dark? How does hiding the names of CIP violators protect America? In order to answer these questions, FERC must honor the spirit of the FOIA and release this information so the public can evaluate this regulatory scheme.
Specifically, the public needs to analyze whether the decade-long failure to secure the U.S. electric grid is a direct result of NERC’s enforcement regime that shields the identities of standard violators from public scrutiny.
The NERC coverup started in July 2010. (Previous to July 10, 2010, identities of standards violators were disclosed by both NERC and FERC.) The public must examine the incentives under this enforcement regime for electric utilities to implement meaningful cybersecurity protections. Will the industry devote only moderate attention to grid security while knowing any gaps will be kept hidden from ratepayers, investors, the U.S. Congress, and the public at large? In its consideration of this appeal, FERC now has the opportunity to end these practices injurious to national security and the public interest.
In sum, withholding of names of CIP violators has not worked to thwart our adversaries—the Russians and Chinese infiltrated the electric the grid for a decade. In fact, withholding violators’ names has made the grid less reliable and America less secure because the industry has little incentive to improve their Critical Infrastructure Protection (CIP) performance. This is exactly why the Russians and the Chinese are still in the grid, because information is being withheld from the public. If the truth was known, Congress could reasonably conclude that NERC’s enforcement of the CIP regulatory system has failed, and the system must be reformed.
FERC can make the country safer simply by releasing this regulatory information to the public. Public scrutiny through transparency and disclosure is the time-tested oversight for regulatory systems in a free society. Even if FOIA exemptions might be applicable, it is within FERC’s discretion to release the identity of standards violators. FERC is charged with serving the public interest; the public interest demands disclosure.
IV. The test that FERC devised for this FOIA request is too restrictive and violates FOIA.
A case-by-case assessment of each requested document must consider the following: the nature of the CIP violation; whether mitigation is complete; the content of the public and non-public versions of the Notice of Penalty; the extent to which the disclosure of the pertinent URE identity would be useful to someone seeking to cause harm; whether an audit has occurred since the violation(s); whether the violation(s) was administrative or technical in nature; and the length of time that has elapsed since the filing of the public Notice of Penalty. An application of these factors will dictate whether a particular FOIA exemption, including 7(F) and/or Exemption 3, is appropriate. See Garcia v. US. DOJ, 181 F. Supp. 2d 356, 378 (S.D.N.Y. 2002) (“In evaluating the validity of an agency’s invocation of Exemption 7(F), the court should within limits, defer to the agency’s assessment of danger.”) (citation and internal quotations omitted).
This test devised by FERC is too restrictive and does not comport with FOIA’s presumption of openness. This “test” appears to have been concocted as an attempt to bolster FERC’s improper uses of FOIA exemptions 3 and 7(F), neither of which apply in this case as is more fully set forth later.
At issue here is the disclosure of the names of regulatory violators. I would note that NERC already publishes a great deal of information on its website, including the identities of its regulated entities and their functions; for example, the “NERC Active Compliance Registry Matrix” and other files. But it somehow becomes a problem to use the name of the entity when they are associated with a CIP violation. Because there is no legitimate security argument to withhold all names of all CIP violators in perpetuity, as is the current practice, public scrutiny should be mandatory. It appears that the real reason for concealing the names of CIP standard violators is to avoid public scrutiny of electric utilities.
FERC’s Mr. Ortiz said identities are protected to honor confidentiality requests from the North American Electric Reliability Corp., called NERC, the federally appointed organization that crafts utility standards and audits compliance. It refers penalty cases to FERC for enforcement.
NERC’s “confidentiality requests” do not fall under an exemption under FOIA. If the potential “harm” of disclosure is the embarrassment of the entity subjected to a regulatory action, this is not a “harm” recognized by any exemption of the FOIA.
Finally, the burden of proof should not be on the public to prove that there is not a risk in the release of violators’ names; the burden should be on the business submitter (NERC) or government (FERC) to credibly demonstrate that release of the information would reasonably constitute a risk to the public.
I observe there is not a scintilla of public evidence over the last decade that there would be a security risk in releasing the names of CIP violators. There is ample evidence that the real danger here has been in the lack of disclosure in this failed regulatory scheme.
V. Exemption 7(F) does not apply to the names of CIP violators.
It is puzzling that FERC cites Exemption 7(F) as a basis for withholding the names of regulatory violators. This exemption generally allows an agency to protect the identities of law enforcement agents. This exemption is also valid in protecting the names and identifying information of non-law enforcement federal employees, local law enforcement personnel, and other third persons in connection with particular law enforcement matters.
The identities of companies who violate CIP standards and are subject to regulatory actions by the government simply don’t fit in any arguable way under Exemption 7(F).
VI. Exemption 3 does not apply to the names of CIP violators.
Neither of these requirements are met here. There is no law that NERC or FERC has cited that even arguably requires the withholding of the names of entities subject to regulatory actions under either prong of the exemption.
I further note that FERC failed to properly disclose to the U.S. Attorney General and Congress its use of Exemption 3 in 2018 for another of my FOIA requests—more evidence of FERC’s non-compliance with the most basic aspects of FOIA law. Agencies are required in their annual FOIA reports each year to list all Exemption 3 statutes that they relied upon during that year. Disturbingly, FERC’s annual FOIA reports from 1998 to 2018 reveals that for the past 21 years, all the years reports are available, FERC claims to have never used Exemption 3 in such a manner as it has here.
From 1998-1999 FERC only used Exemption 3 under 41 U.S.C. § 253b(m)—Proposals submitted by unsuccessful contract bidders.
From 2000-2001 FERC only used Exemption 3 under 16 U.S.C. 470hh(a)—Information pertaining to the nature and location of certain archaeological resource.
In 2002 FERC did not use Exemption 3.
From 2003-2018 FERC only used Exemption 3 under 16 U.S.C. 470hh(a)—Information pertaining to the nature and location of certain archaelogical [sic] resource.
However, FERC did use Exemption 3 in 2018 for my FOIA No. FY18-75 and failed to disclose the relevant statute, 16 U.S.C. 824o-1(d)(1), in its 2018 Annual Freedom of Information Act Report.
FOIA Exemption 3 protects information “specifically exempted from disclosure by statute.” Here, CEII is specifically exempted from disclosure under the Fixing America’s Surface Transportation Act, Pub. L. No. 118-94, § 61003 (2015).
This use of an Exemption 3 statute is not disclosed in FERC’s annual FOIA report.
Apparently, the undisclosed argument is that the names of the entities subject to regulatory actions constitute “Critical Electric Infrastructure Information” (CEII) exempt from disclosure, This argument fails under FOIA and under FERC’s own interpretive regulations and orders.
B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.
Since neither prong is met, Exemption 3 does not apply. However, to the extent that anybody still wants to argue prong “B”, let’s dig deeper into the “criteria” for withholding information determined to be CEII.
NERC has for years been classifying the names of the violators and the settlement agreements as “nonpublic” and tries to argue that FERC also deems these documents as “nonpublic”—but this presumption is not in compliance with the clear requirements of the CFR.
24. In response to the Trade Associations’ comments seeking clarification if a name or location of a facility should be protected as CEII, the Commission’s current practice is that information that “simply give[s] the general location of the critical infrastructure” or simply provides the name of the facility is not CEII. [FN 40] However, under certain circumstances, information regarding the location of infrastructure or its name that is not already publicly known could be CEII. [FN 41] Therefore, we clarify that, while as a general matter the location or name of infrastructure is not CEII, a submitter of information to the Commission may ask that non-public information about the location, or the name, of critical infrastructure be treated as CEII. The submitter would have to provide a justification for the request and explain why the information is not already publicly known.
FN 40 18 CFR 388.113(c)(1)(iv).
FN 41 For example, the location of an operating transformer is likely publicly known. However, the location of a spare transformer housed in a central location may not be publicly known and, therefore, may qualify as CEII.
Particularly instructive is the footnote 41 example of what may qualify as CEII.
Notably, NERC has not provided legally valid justification for keeping the names of violators secret. And the reason “the information is not already publicly known” is FERC’s noncompliance with its own regulations.
36. The Commission does not agree that the scope of CEII should be modified, as suggested by the Trade Associations, to encompass information “related to compliance with the Reliability Standards.” The Trade Associations’ proposal is unduly broad and inconsistent with the FAST Act because it could lead to all infrastructure information, whether critical or not, being treated as CEII. For the same reason, we do not agree that the blanket presumption that information relating to compliance with Reliability Standards is CEII, proposed by the Trade Associations, is appropriate. Like other forms of CEII, however, information on compliance with Reliability Standards may be treated as CEII if the submitter justifies its treatment as CEII under the Commission’s regulations.
It is clear and unambiguous that the industry wanted the names of violating entities to be always considered CEII but the Commission specifically denied this in rulemaking. Where did NERC justify treatment as CEIII of the names of standard violators for each NOP submitted? Nowhere. In retrospect, it is clear that the NERC did the industry’s bidding, and FERC allowed this behavior on a wholesale basis.
VII. FERC regulations require disclosure.
There is no allegation in these NOPs of a malicious act or suspicious event that disrupted or attempted to disrupt the Reliable Operation of the Bulk-Power System. These were simply regulatory actions after instances of noncompliance of CIP standards were discovered, either through self-reports or regulatory audits. Nor has NERC provided an explanation of how the security of the Bulk Power System would be jeopardized if the names of CIP standard violators were to be publicly disclosed.
18 CFR § 39.7 (b)(4) allows the “disposition of each violation” (or alleged violation) to be made nonpublic, but only if disclosure of the “disposition” would jeopardize security of the Bulk Power System. Again, the “name of the entity” is not part of “disposition” of the violation, so there is never an exemption of the violator’s name from public disclosure. Nor has NERC made a credible case that disclosure of the “disposition” of these NOPs would jeopardize the security of the Bulk-Power System, especially when the violations do not involve bona fide Cybersecurity Incidents as defined in 18 CFR § 39.1.
FERC has made no public order (or change in regulation) to allow NERC to withhold the “notice of penalty” for these NOPs. If FERC has made a private directive to NERC to withhold the “disposition” of the violations in Duke NOP, and other NOPs, then the public interest demands that the text of this hidden FERC directive and its underlying legal rationale be promptly released by the Commission.
Even information that some may deem innocuous—such as revealing the names of UREs involved in a remediated NOP—can result in unintended consequences. For example, in some instances, a URE may have remediated a particular instance of regulatory noncompliance. However, that URE may have experienced a pattern of similar noncompliance—not because of a lack of will to fix, but because there are significant other factors at play. In addition, UREs face challenges in integrating modern information technology systems with older operational technology systems that were never designed with modern cybersecurity needs in mind. Sophisticated bad actors, like the ones discussed above, may be able to discern points of attack and vulnerabilities in publicly disclosed UREs based on their patterns of NOPs. The Trade Associations recognize that public access to information is important, and appreciate the goal of FOIA, but believe the line must be drawn where a requested disclosure might risk the security of the Bulk-Power System.
Might disclosing the names of the violators lead the public and Congress to assess how well the regulatory system is working?
Might this information inform the public and Congress as to whether the current regulatory system has adequately thwarted threats to the grid?
Also, might this information lead the public and Congress to conclude that better investment in the critical infrastructures is necessary?
These are public policy questions, not CEII.
Interestingly, NERC, the Trade Associations and the companies themselves put a lot of information about the companies and the industry as a whole on their websites. By their defective rationale, all information “in the aggregate” should be CEII. In fact, any information whatsoever about any of the 1,500 regulated entities by this bogus argument should be considered CEII. All websites should be shut down, and even our electric bills should not list the name of the company we are paying, lest these small pieces of “information in the aggregate” leads hackers to realize which utility is operating in that area, and thus helps to narrow the hacker’s target list.
Obviously, the forgoing illustration of the industry argument is ridiculous as is ultimately the industry argument itself. Why? Because there is only one piece of information that the industry is fighting vehemently to keep from the public: The names of regulatory violators.
Why is this one piece of information so sensitive to the industry? Because the name of a standard violator is the most essential piece of information to hold that utility accountable.
Public disclosure of the identity of law-breakers is a purpose of FOIA. The public has the right and Congress the obligation to examine this failed enforcement regime.
IX. The CEII Designation has expired in 195 of the 243 dockets in FOIAs 2019-0019 and 2019-0030.
18 CFR § 388.113(d)(1)(i) also provides that: “Failure to provide the justification or other required information could result in denial of the designation and release of the information to the public.” Because NERC has failed to seek re-designation for CEII on a timely basis for these 194 dockets, FERC should rule, as a matter of both current and future policy, that NERC has waived any purported interest in CEII re-designation.
X. The violations have long been mitigated; the names of the violators should be disclosed.
Once CIP standard violations have been mitigated, there can be no legitimate rationale for withholding names of the violators. If compliance with CIP standards truly protects electric grid systems, then the identities of utilities that have mitigated violations is evidence of security, not vulnerability.
Specifically, related to FERC’s April 2, 2019 FOIA denial letter, Exhibit N is the information on the violations relevant to this FOIA denial from NERC’s public website. Each of the CIP violations for NP14-30-000, NP14-37-000 and NP14-39-000 have long been mitigated (see the highlighted “Mitigation Completion Date” column), and FERC has issued a final order (see “Notice of No Further Review Issued” column).
These cases are long ago closed and mitigated. There is no plausible argument that releasing the name of the violator would now be a threat to security.
XI. The specifics of the three denied NOPs do not support CEII designation of violators’ names.
The locations and capacities of equipment are not disclosed.
The vendors used by the utilities are not disclosed.
Network configurations and IP addresses are not disclosed.
The description of the violations is idiosyncratic to the violating utilities and cannot be reasonably extended to other utilities.
All violations have long ago been mitigated (see Section X above and Exhibit N).
In summary, the apparent purpose of the NOPs is to support the assessment of NERC fines, and therefore technical details that could aid attackers, have not been included.
XII. All settlements are required to be disclosed including the names of violators.
FERC made a public commitment in Order 672 that “settlement agreements will be public”; this is inconsistent with NERC’s claim that settlement agreements are “privileged” or “CEII.” For Docket No. NP19-4-000 specifically, a redacted settlement agreement that would perpetually omit the identity of the standard violators will never be “public” in any meaningful way and therefore is in apparent violation of FERC Order 672.
CEII is defined by FERC as “specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure (physical or virtual) that…could be useful to a person planning an attack on critical infrastructure.” FERC has not given the public an explanation why the disposition of corrected standards violations should be classified as “CEII.” Standard violations that have been corrected by means of a settlement agreement do not fall within a commonsense interpretation of the CEII definition, because a corrected standard violation should be of minimal usefulness in planning an attack, or not useful at all.
This further rebuts the argument by the industry that 1) FERC has “told them” to omit the names of the CIP violators, and 2) that the names of standards violators are CEII. The CEII exemption simply does not apply and time after time, FERC orders have correctly concluded that the public is entitled to information on standards violators, and time after time, the industry has ignored the Commission’s orders. Unfortunately, up to now, the Commission has allowed this misbehavior.
Be a captive regulator of an industry that has put America’s security at grave risk.
I await the Commission’s decision.
 Specifically, FERC denied my request to supply the names of the entities that were subject to regulatory actions in FERC Docket Numbers NP14-30, NP14-37, and NP14-39. Note, my FOIA request was for specific documents. I requested: “the ’NERC Full Notice of Penalty’ version which includes the name of the registered entity (and which has been previously withheld from the public). In the instances where there was a ‘Spreadsheet NOP’ I request a copy of the spreadsheet that lists the name(s) of the entity subject to the regulatory action.” After negotiation with the FERC staff, and in order to reduce the staff’s burden, I agreed to accept the first page of the public version of the NOP with the name of the entity and the docket number entered onto the page.
 https://www.foia.gov/about.html (accessed April 12, 2019).
 While the determination letter dated April 2, 2019 makes no reference to my fee waiver request, I assume it was granted. If the issue must be revisited for any reason, I hereby incorporate my fee waiver request of December 18, 2018 by reference.
 The American Public Power Association (APPA), the Edison Electric Institute (EEI), and the National Rural Electric Cooperative Association (NRECA).
 I filed a separate, but related FOIA request on January 12, 2019 for Notices of Penalty on an additional 190 docket numbers. FOIA 2019-0030.
 FERC Docket 19-4-000. “Motion to Intervene and Protest of The American Public Power Association, The Edison Electric Institute, and The National Rural Electric Cooperative Association.” March 28, 2019. Page 11.
 Gorman, Siobhan. “Electricity Grid in U.S. Penetrated By Spies.” Wall Street Journal. April 8, 2009. https://www.wsj.com/articles/SB123914805204099085 (accessed April 12, 2019). Also, see a decade later: Smith, Rebecca. “America’s Electric Grid Has a Vulnerable Back Door—and Russia Walked Through It.” Wall Street Journal. January 10, 2019. https://www.wsj.com/articles/americas-electric-grid-has-a-vulnerable-back-doorand-russia-walked-through-it-11547137112 (accessed April 12, 2019).
 U.S. Department of Energy Office of Inspector General. “Federal Energy Regulatory Commission’s Monitoring of Power Grid Cyber Security.” January 2011. https://www.ferc.gov/industries/electric/indus-act/reliability/cybersecurity/doe-ig-report.pdf?csrt=4870345339811568870 (accessed April 12, 2019).
 See for example, the summary of the industry’s opposition to increased cybersecurity measures in my filing under Docket No. RM17-13-000 (Supply Chain Risk Management Reliability Standards) FERC Accession Number 20180326-5018. March 25, 2018.
 Available at: https://www.nerc.com/pa/comp/Pages/Registration.aspx (accessed April 12, 2019).
 Smith, Rebecca. “PG&E Among Utilities Cited for Failing to Protect Against Cyber and Physical Attacks.” Wall Street Journal. April 9, 2019. https://www.wsj.com/articles/pg-e-among-utilities-cited-for-failing-to-protect-against-cyber-and-physical-attacks-11554821337 (accessed April 12, 2019).
 David Ortiz, Deputy Director, FERC Office of Electric Reliability.
 Exhibit H is the U.S. Department of Justice Guide to the Freedom of Information Act, Exemption 7(F), page 653, et seq.
 Exhibit I is the U.S. Department of Justice Guide to the Freedom of Information Act, Exemption 3, page 207, et seq.
 Located at: https://www.ferc.gov/legal/ceii-foia/foia/ann-rep.asp (accessed April 12, 2019).
 157 FERC ¶ 61,123. Pg. 17.
 157 FERC ¶ 61,123. Pg. 24.
 Sobczak, Blake and Behr, Peter. “Duke agreed to pay record fine for lax security — sources” E&E News, February 1, 2019. https://www.eenews.net/energywire/2019/02/01/stories/1060119265?fbclid (accessed April 15, 2019).
 See Exhibits C and D which the Trade Associations filed as exhibits to their Motion to Intervene in FERC Docket NP19-4-000.
 “Searchable NOP Spreadsheet” available at: https://www.nerc.com/pa/comp/CE/Pages/Enforcement-and-Mitigation.aspx (accessed April 15, 2019).
A: We became vulnerable gradually. We realized it suddenly.
In 1850 – nine years before the Carrington Event and 12 years before the Civil War – the population of the United States was 23 million people. At the end of 2018, the population of the U.S. stood at 328 million people. What enabled our population to increase by 305 million people? The answer at first would seem complex but it is actually quite simple. Numerous new technologies allowed our population to increase. Advances in medicine, advances in agricultural methods, the ability to transport food across the country (and across the world), new sources and uses of energy, an industrial revolution, advances in many areas of technology… I can go on and on but there is no need to. All of it is tied to one thing: the advent of the electric grid.
In 1850, the country could not have supported a human population of 328 million. We simply did not have technology and resources to support that many people. Our plows were drawn by horse or mule. Much of our population worked hard just to survive the winter – if you didn’t preserve food that you grew and chop wood to keep warm, you simply couldn’t survive. Even in the cities, limitations in technology (e.g., coal mining techniques, transportation, ability to store food) limited the number of people that could be supported by the agriculture and technology of the time.
The electric grid is an amazing human accomplishment. It is the largest machine in the history of the world, built piece by piece over many generations. It arguably started on September 4, 1882 with Thomas Edison’s Pearl Street Station in Manhattan – which initially had had 82 customers and an electric load of 400 lamps. After “the war of the currents” between Edison’s direct current (“DC”) and George Westinghouse’s alternating current (“AC”), More and more areas began to have electric power available.
So the electric grid that exists today has been built gradually over the last century. The electric grid advanced life in every way imaginable and literally made the impossible possible. The population of the U.S. between 1930 and 2018 increased by over 200 million.
At some point, gradually, we lost the self reliance we had in the 1800s and became completely reliant on all these things that the power grid made possible. New ways to heat (oil, gas, steam electricity, etc.) meant we didn’t have to chop our own wood. Farms were made exponentially more efficient and that meant less of us had to farm.
Better transportation meant that food and goods could be transported long distances. Today, you can get oranges and bananas in New Hampshire – even though they are grown thousands of miles away. This isn’t even a novelty, but something we depend on. We actually get annoyed if there are no bananas in our northern grocery stores.
Gradually, we became dependent on our ability to get food that is produced elsewhere. Most people don’t preserve food for the winter anymore. Gradually, we became dependent on goods such as vehicles and medications that were made possible by electricity. Water and sanitation systems are now completely dependent on electricity – gone are dug wells and outhouses. Our entire financial system has become electronic. You don’t even get paper stock certificates any more – everything is digital.
And then suddenly, we realized that we are vulnerable.
Today, we are literally on life support, plugged into the electric grid. The lives of hundreds of millions of people depend on the things the electric grid provides. Without it, we would literally have what we had in 1850 – except we no longer have the requisite skills and most of us do not own a horse or mule.
So what happens when a society grows dependent on the electric grid and suddenly, it is unplugged? There are some recent cautionary tales.
The March-April 2019 blackouts in Venezuela serve as another disturbing example. Within a short period of time, people had to resort to getting water from the sewage canals, cities experienced anarchy, hospitals had no power or water and food rotted without refrigeration.
To most of us, our experience with power outages is that they last a few hours, or a few days at most. The cavalry is coming. We can bring in utility trucks from Illinois. Somebody will rescue us. We have become complacent.
What if the cavalry is not coming?
There are 35,000 towns and cities in the United States. If substantially all of them are the “disaster area” in a national-scale power outage, where is “help” going to come from? Remember, we have NEVER experienced a national-scale disaster in this country – even Hurricane Katrina and Hurricane Maria were regional in scale and we could bring in massive resources from elsewhere in the country (i.e., from outside the “disaster area”).
If substantially the whole country is the disaster area, your town will be on its own for a long period of time. Perhaps weeks, perhaps months or longer. But today, we are generations removed from adversity, generations removed from self reliance. Generations removed from having to worry about surviving the winter.
We have become extremely vulnerable.
Americans have accomplished great things. We built the transcontinental railroad. We invented airplanes. We landed humans on the moon. We invented much of the industry and technology that exists today. Through sacrifice , grit and determination, our “Greatest Generation” won World War II. We do not have to be helpless. And we can no longer ignore the threats. Remember the Americans? They took action.
Hold our federal and state governments accountable for protecting the electric grid.
Prepare our communities for catastrophic disasters by building a culture of preparedness in the U.S.
You can take action. If enough of us take action, we can make a difference. Visit the TAKE ACTION page to see what you can do.

References: v. 

V. 
 § 253
 § 61003
 § 39
 § 39
 § 388