Physical Security of the U.S. Power Grid: High-Voltage Transformer Substations
Released: 2015-07-02T00:00:00

Summary:
The U.S. electric power grid consists of over 200,000 miles of high-voltage transmission lines and hundreds of large transformer substations. High voltage (HV) transformer units make up less than 3% of U.S. transformers, but they carry 60%-70% of the nation's electricity. Because they serve as vital nodes, HV transformers are critical to the nation's electric grid. HV transformers are also the most vulnerable to damage from malicious acts.
For more than 10 years, the electric utility industry and government agencies have engaged in activities to secure HV transformers from physical attack and to improve recovery in the event of a successful attack. These activities include coordination and information sharing, spare equipment programs, security standards, security exercises, and other measures. There has been some level of physical security investment and an increasing refinement of voluntary security practices across the electric power sector for at least the last 15 years. However, recent grid security exercises, together with a 2013 physical attack on transformers in Metcalf, CA, have changed the way grid security is viewed and have focused congressional interest on the physical security of HV transformers. They have also prompted new grid security efforts by utilities and regulators.
On November 20, 2014, the Federal Energy Regulatory Commission (FERC) approved a new mandatory Physical Security Reliability Standard (CIP-014-1) proposed by the North American Electric Reliability Corporation (NERC). The new standards require certain transmission owners "to address physical security risks and vulnerabilities related to the reliable operation" of the power grid by performing risk assessments to identify their critical facilities, evaluate potential threats and vulnerabilities, and implement security plans to protect against attacks. Legislative proposals would expand federal efforts to prevent or recover from a physical attack on the U.S. grid. These include the Enhanced Grid Security Act of 2015 (S. 1241), the Critical Electric Infrastructure Protection Act (H.R. 2271), the Terrorism Prevention and Critical Infrastructure Protection Act of 2015 (H.R. 85), a House bill to establish a strategic transformer reserve program (H.R. 2244), and the Grid Modernization Act of 2015 (S. 1243).
There is widespread agreement among government agencies, utilities, and manufacturers that HV transformers in the United States are vulnerable to terrorist attack, and that such an attack potentially could have catastrophic consequences. But the most serious, multi-transformer attacks could require acquiring operational information and a certain level of sophistication on the part of potential attackers. Consequently, despite the technical arguments, without more specific information about potential targets and attacker capabilities, the actual risk of a multi-HV transformer attack remains an open question. As the electric power industry and federal agencies continue their efforts to improve the physical security of critical HV transformer substations, Congress may consider several issues as part of its oversight of the sector: identifying critical transformers, confidentiality of critical transformer information, adequacy of HV transformer protection, quality of federal threat information, recovery from HV transformer attacks, and the overall resiliency of the grid. Maintaining an integrated perspective on prevention, recovery, and resilience may help to promote an effective balance among industry investment, regulatory requirements, and federal oversight.

subsections: section_title: Introduction1
paragraphs: The electric utility industry operates as an integrated system of generation, transmission, and distribution facilities to deliver electric power to consumers. In the United States, this system consists of over 9,000 electric generating units connected to over 200,000 miles of high-voltage transmission lines strung between large towers and rated at 230 kilovolts (kV) or greater. This network is interspersed with hundreds of large electric power transformer substations whose function is to adjust electric voltage as needed to move power across the network ( Figure 1 ). High voltage (HV) transformer units make up less than 3% of transformers in U.S. power substations, but they carry 60% or more of the nation's electricity. Because they serve as vital transmission network nodes and carry bulk volumes of electricity, HV transformers are critical elements of the nation's electric power grid. 
The U.S. electric power grid has historically operated with such high reliability that any major disruption caused by weather, operational errors, or sabotage, makes news headlines. The various parts of the electric power system are all vulnerable to failure due to natural, operational, or manmade events. Such outages can have considerable negative impacts on business, government services, and daily life. Notwithstanding its high reliability overall, the U.S. power grid has periodically experienced major regional outages. Recent examples include the Northeast Blackout of 2003 (which affected 55 million customers in eight states and Canada) and extended outages in the New York/New Jersey area after Superstorm Sandy in 2012. For reasons discussed below, however, HV transformers are considered by many experts to be the most vulnerable to intentional damage from malicious acts. The physical security of HV transformers and associated policy issues are the subject of this report.
subsections: section_title: Congressional Interest
paragraphs: Congress has long been concerned about grid security in general, but recent security exercises, together with a 2013 physical attack on transformers in Metcalf, CA, have focused congressional interest on the physical security of HV transformers, among other specific aspects of the grid. They have also prompted new grid security initiatives by utilities and federal regulators. Legislative proposals including the Enhanced Grid Security Act of 2015 ( S. 1241 ), the Critical Electric Infrastructure Protection Act ( H.R. 2271 ), the Terrorism Prevention and Critical Infrastructure Protection Act of 2015 ( H.R. 85 ), a House bill to establish a strategic transformer reserve program ( H.R. 2244 ), and the Grid Modernization Act of 2015 ( S. 1243 ) would expand these activities by strengthening federal efforts to prevent or recover from a physical attack on the U.S. grid. 
section_title: HV Transformer Risks and Vulnerability
paragraphs: The main risk from a physical attack against the electric power grid—primarily towers and transformers—is a widespread power outage lasting for days or longer. Utilities regularly experience damage to transmission towers due to both weather and malicious activities; they are able to recover from this damage fairly rapidly. Thus, while occasionally causing blackouts, physical attacks on towers generally have not resulted in widespread or long-lasting outages. The power industry also has experienced mechanical failure of individual HV transformers within a single control area resulting in blackouts lasting hours. However, no region in the United States has experienced simultaneous failures of multiple HV transformers. Experts have long asserted that a coordinated and simultaneous attack on multiple HV transformers could have severe implications for reliable electric service over a large geographic area, crippling its electricity network and causing widespread, extended blackouts. Such an event would have serious economic and social consequences. This section discusses in more detail HV transformer characteristics and physical security risks associated with them.
subsections: section_title: High Voltage Power Transformers
paragraphs: Utility transformers control the voltage of electricity so that it can be synchronized with other power supplies, transmitted long distances, and distributed to customers. Transformers range in size from small, pole-mounted units that may serve a dozen homes to transmission units that serve an entire city. The larger the transformer, the higher the voltage the transformer can handle. Utility transformers, regardless of size, fundamentally consist of copper wire wrapped around a metallic "core" within an insulated protective housing covered with a 5/8 to 3/4-inch mild steel tank. They are linked to the power grid by protruding metal and (usually) ceramic connectors called "bushings" which resemble giant spark plugs. Larger transformers generate waste heat during operation (like all transformers), so they are cooled by a system comprised of internally circulating oil and external radiators, analogous to the cooling system in a car engine. Large transformers are located in network substations along with transmission lines, associated electric equipment, and system controls. These substations may be found in remote locations or near urban centers, depending upon regional transmission needs. Many are located alongside electric generation plants, linking those plants to the grid.
High-voltage transformers, especially units above 345 kV, are physically large and extraordinarily heavy. For example, Figure 3 shows a new 345 kV transformer many times larger than the pickup truck parked alongside. This transformer unit weighs 435 tons, including 29,000 gallons of cooling oil. (Note that the vertical bushings are not yet connected to transmission lines because the unit is being moved.) This is a three-phase unit, with one bushing for each of the three phases. Some substations alternatively employ separate single-phase transformers in sets of three. Generally, the higher the transformer's voltage, the larger the transformer. A three-phase 765kV transformer could be 45 feet tall and occupy a footprint of 2,200 square feet—about the size of an average new single-family house.
subsections: section_title: Manufacture and Cost
paragraphs: Most HV transformers are unique—designed and manufactured to custom specifications for a specific network application. In 2010, the lead time between an HV transformer order and delivery ranged from 5 to 12 months for U.S. manufacturers and 6 to 16 months for foreign manufacturers, although lead times well over 20 months could be required in certain situations. This process may include three to four months for the engineering design alone. Since manufacturing generally occurs on a single production line with just-in-time component supplies, advanced production scheduling is important for managing delivery. Physical assembly is labor intensive, requiring manual winding of the copper wire around the transformer core and frequent engineering checks during manufacturing. Extensive testing of completed units also contributes to HV transformer manufacturing time.
The installed cost for an HV transformer depends heavily on its configuration and specific design requirements. New HV transmission substations can cost well in excess of $10 million, including the cost of transformers and other station equipment. According to the U.S. Department of Energy (DOE), the factory prices for HV transformers typically range from $2 million for a 230 kV unit to $7.5 million for a 765 kV unit, before transportation and installation costs.
section_title: U.S. Manufacturing Capability
paragraphs: From 1950 to 1970, utility construction of large generation plants and associated transmission networks fueled a robust U.S. manufacturing market for large transformers. During this period, the United States (and Canada) accounted for approximately 40% of global demand for such units. After 1970, however, utility investment in transmission infrastructure began falling off due to perceived overcapacity, public resistance to transmission siting, and greater regulatory scrutiny of capital expenditures. Beginning in the late 1980s, uncertainty about industry restructuring and the introduction of competition made grid owners even less willing to invest in new transmission. This decline in U.S. transmission investment greatly reduced domestic demand for large transformers, especially HV transformers. By the late 1990s, the United States and Canada accounted for only 20% of global large transformer sales. Demand in the United States has subsequently increased, however. For example, between 2005 and 2013, the total value of large transformers (including medium- and high-voltage units) imported to the United States more than doubled, from $284 million (363 units) to $676 million (496 units).
At the same time, global demand for transformers continued to grow and more foreign manufacturers entered the market. According to U.S. industry representatives, many of these foreign manufacturers benefited from dramatically lower labor costs, so they could underbid U.S. transformer makers for the remaining U.S. demand. Some of these foreign manufacturers may have been protected by import barriers which effectively closed their home markets to U.S. transformer imports. Today, there is limited manufacturing capacity in the United States for HV transformers. Five U.S. facilities state that they can manufacture transformers rated 345 kV or above, although it is not clear how many units in this range they have actually produced. Canada and Mexico have five additional HV manufacturing plants. While limited domestic HV transformer manufacturing may increase delivery time, utilities have not reported difficulty in obtaining needed equipment.
section_title: HV Transformer Sites in the United States
paragraphs: There are several thousand HV transformers operating in the United States. Approximately 2,100 are very large units rated 345 kV and above. Investor-owned utilities own most of these, although public utilities such as the Power Marketing Administrations (i.e., Bonneville Power Administration and Western Area Power Administration), Tennessee Valley Authority, and the Los Angeles Department of Water and Power own many HV transformers as well. HV transformer substations are distributed throughout the electric grid, as shown in Figure 1 , with the greatest number in the eastern part of the country.
section_title: Criticality of HV Transformers
paragraphs: Because HV transformers carry so much electricity, the destruction of even a small number could seriously reduce the transmission capacity of a regional electric power grid and lead to extended blackouts. The impact of such a failure would depend on the electricity flows in that part of the grid, congestion from major network bottlenecks, and the status of other key facilities such as power plants, transmission lines, and other substations. Power grid planners generally anticipate the possible loss of a single HV transformer substation and are prepared to reroute power flows as necessary to maintain regional electric service. But the simultaneous loss of multiple HV transformers, especially in a constrained transmission area, could exceed the capability of a regional network to reroute power through secondary lines.
Numerous publicly available studies have analyzed the risks from such a multiple failure. For example, the Congressional Office of Technology Assessment (OTA), in a 1990 report on the physical vulnerability of the electric power system, found that
In most cases, the nearly simultaneous destruction of two or three transmission substations would cause a serious blackout of a region or utility, although of short duration where there is an approximate balance of load and supply.... The destruction of more than three transmission substations would cause long-term blackouts in many areas of the country.
In such an emergency scenario, limited electric service could likely be restored in the short term by imposing "rolling" blackouts, rerouting transmission, and using portable transformers. Nonetheless, the loss of key HV substations would leave the regional network crippled and highly susceptible to further disturbance and cascading failure. According to power industry experts, certain parts of the U.S. transmission network are particularly vulnerable to HV substation disruption. These areas may have severely constrained transmission paths relying on a small number of HV transformers in extremely critical network locations. According to press accounts, a FERC power flow analysis in 2013 identified 30 such critical HV transformer substations across the continental United States; disabling as few as nine of these substations during a time of peak electricity demand reportedly could cause a "coast-to-coast blackout."
Notwithstanding the FERC study and similar claims by security analysts, the actual risk to the U.S. grid of extended blackouts due to a deliberate attack on multiple HV transformers is the subject of ongoing debate. An investigation by the Department of Energy's Office of Inspector General (IG) appears to discredit FERC's risk analysis. According to the IG investigation, officials at the department previously concluded that FERC's study was based on "highly unlikely assumptions" and that "loss of the critical substations identified in the analysis would not result in the consequence described in the analysis or any other consequence that could be reasonably expected to result in damage to national security." Due to the complexity of HV transmission networks and uncertainties about potential physical threats, a range of differing conclusions may be reached by industry experts on the potential severity and duration of a blackout from a multi-transformer attack. However, most analysts acknowledge that severe regional, if not national, power outages may be technically possible under certain conditions.
section_title: Physical Vulnerability of HV Transformers
paragraphs: The Department of Energy's recent Quadrennial Energy Review identifies HV transformers as one of the electric grid's "most vulnerable components." All HV transformers are designed to withstand operational risks such as lightning strikes, hurricanes, and network power fluctuations—but they are vulnerable to intentional physical attacks. Despite their great size and internal complexity, HV transformers of conventional design can be readily disabled or destroyed. According to one manufacturer, "if someone were to intentionally try ... it is a surprisingly simple task and there are a large number of ways to conceivably damage a transformer beyond repair." Transformer experts have asserted that a bad actor with basic knowledge of transformer design could inflict irreparable damage. Such attacks can cause massive electrical short circuits and oil fires that would destroy an HV transformer and damage surrounding infrastructure. One fire at a 345 kV substation in Texas, for example, destroyed the transformer and burned for five hours, causing "plumes of smoke that could be seen for miles." In addition to direct attacks on the transformers themselves, HV substations can be further disabled by damaging associated transmission lines or control centers that may be located on site.
Because HV transformers are so big and are connected to the largest overhead transmission towers, they are easily identified along major transmission corridors. High voltage transformers are usually housed in substations that are enclosed with a chain-link fence. Guards are not often stationed at these facilities under normal operating circumstances. Consequently, HV transformers are ordinarily easier to access than other critical electric facilities such as generation plants and control centers. Utilities use closed-circuit surveillance and other methods to detect intrusion. However, access to the substation may be achieved by either cutting or scaling the chain-link fence. Once inside, a saboteur could cause damage by accessing the control room or physically damaging the HV transformer. Penetrating the 5/8 to 3/4-inch steel tank with any device could short-circuit the windings and irreparably destroy the transformer. Alternatively, a saboteur could attempt to open a valve and drain the insulating oil. Igniting the oil might cause the transformer to arc and eventually explode. With a clear line of sight, an attacker could also disable transformers from a distance using conventional rifles. Other methods of disabling HV transformers have also been identified.
The vulnerability of individual transformer substations has been demonstrated by successful attacks in recent years. In the most serious case, a rifle attack occurred in April 2013 at PG&E's 500 kV substation in Metcalf, CA. In this attack, multiple individuals outside the substation reportedly shot at the HV transformer radiators with .30 caliber rounds, causing them to leak cooling oil, overheat, and become inoperative. In October 2013, the U.S. Justice Department charged an individual with attacks on the transmission grid in Arkansas, including a deliberate fire at Entergy's 500 kV substation in Lonoke County. The fire consumed the substation control house but electrical service was not interrupted. In 2005, at a Progress Energy substation in Florida, a rifle attack ruptured a transformer oil tank, ultimately causing an explosion and local blackout. Other incidents at substations have been reported with some regularity, although most have been attributed to vandals or careless hunters.
It is very difficult to restore a damaged HV transformer substation. As noted above, transmission experts assert that most HV transformers currently in service are custom designed and, therefore, cannot be generally interchanged. Furthermore, at $3-5 million per unit or more, maintaining large inventories of spare HV transformers solely as emergency replacements is prohibitively costly, so limited extras are on hand. The number of spares a utility maintains is increasingly sensitive information, but one regional transmission control area reported in 2007 that it maintained 29 spares for 188 transformers rated 500 kV on its system. Programs for the sharing of spare HV transformers among multiple utilities are discussed later in this report.
Within the United States, transportation of HV transformers is difficult. Due to their size and weight, most HV transformers are transported on special railcars, each with up to 36 axles to distribute the load. There are fewer than 20 of these railcars in the Unites States rated to carry 500 tons or more, which can present a logistical problem if they are needed in a transformer emergency. In some cases involving older transformers, adjacent rail lines are no longer in service, so replacement transformers may need to be transported by other means. Specialized flatbed trucks can also carry heavy transformer loads over public roadways, but the few such trucks that exist have less carrying capacity and greater route restrictions than the railcars because HV transformers may exceed highway weight limits. Transporting HV transformers, especially in an emergency, can create other logistical challenges as well, including the coordination of movement through ports and road constraints (e.g., tunnels and overpasses), special transportation permits, and police escort requirements.
section_title: Targeting of HV Transformers
paragraphs: Malicious individuals could, without significant training, identify critical HV transformer locations and time an attack for greatest effect. This could be accomplished with basic knowledge of transmission operations and regional network characteristics drawn from publicly available sources, including electric marketing data indicating constrained areas of the network. In 2014, a security services company published a summary of this kind of exercise, identifying 14 of the "most critical" transformer substations in the United States based on the company's criteria. As stated in a 2012 National Research Council report, "terrorists could selectively target key equipment, especially large transformers." The OTA report describes such a scenario:
[One] example is a city served by eight transmission substations spread along a 250-mile line and located in five States. A knowledgeable saboteur would be needed to identify and find the eight transmission substations. A highly organized attack would also be required. However the damage would be enormous, blacking out a four-State region, with severe degradation of both reliability and economy for months.
In 1997, the Irish Republican Army reportedly planned this kind of coordinated attack against six transmission substations in the United Kingdom. Although the attack was prevented, had it been successful it reportedly could have caused widespread power outages in London and the South East of England for months.
It is relatively easy to learn about HV transformer vulnerabilities from engineers and operators experienced with this technology, either domestically or abroad, since the same technology is used in power grids throughout the world. In the past, transformer experts have provided CRS with detailed descriptions of numerous "simple" ways terrorists could destroy HV transformers. General transformer sabotage information is also available on the Internet. One sabotage manual associated with white supremacist groups available online includes the following discussion:
The power generation and distribution systems of most major Western cities are surprisingly vulnerable.... Attacking during peak consumption times (Winter in cold climates and Summer in hot climates) will make power diversion impossible.... Arson, explosives or long-range rifle fire can be used to disable substations, transformers and suspension pylons. A simultaneous attack against a number of these targets can shut down power ... with the advantage that service cannot be quickly restored by diverting power from another source. Each broken link in the power grid must be repaired in order to fully restore service. An individual, equipped with a silenced rifle or pistol, could easily destroy dozens of power transformers in a very short period of time.
Security analysts and other industry officials acknowledge that the vulnerability of HV transformers in general is widely known, although understanding the criticality of particular assets within the power grid would require more dedicated effort.
section_title: Physical Security Measures for HV Transformers
paragraphs: Although HV transformers are relatively large and often exposed, frequently in rural areas, there are a number of measures available to help prevent an intentional physical attack against a transformer substation. Many of these measures are employed for public safety and to protect against theft, so they may serve multiple purposes. Although security measures appropriate for a particular substation vary depending upon its particular configuration and operating profile, such measures fall into a set of general categories:
Protecting information about critical HV substations, such as engineering drawings, power flow modeling runs, and site security information, which could be useful to a potential attacker. Surveillance and monitoring through the use of video cameras, motion detectors, imaging, acoustical monitors, aerial drones, and periodic inspection by security employees. Restricting physical access , such as limiting entry only to necessary employees, installing electronic locks and other access controls, and erecting physical barriers and controls for vehicle entry. Posting full-time guards may also be an option in some circumstances. Shielding assets from offsite attacks using visual barriers such as opaque or hardened fencing, erecting taller fences, or erecting protective walls. Modifying substation designs to make them more resistant to physical damage, for example, by strengthening transformer cooling systems or bushings. Reconfiguring substation layouts to limit asset visibility or limit the spread of fire may also be options.
Industry and federal efforts to promote the deployment of such physical security measures are discussed later in this report. In addition to these categories, other measures can help to mitigate the immediate effects of a successful attack ("resiliency"), or to speed full system recovery from such an attack. Measures to enhance the cybersecurity of substation information and control systems, especially supervisory control and data acquisition (SCADA) systems are an important component of power grid security and are usually coordinated with physical security measures.
section_title: Sector Initiatives for HV Transformer Security
paragraphs: Over the last decade or so the electric utility industry and government agencies have engaged in a number of initiatives to secure HV transformers from physical attack and to improve recovery in the event of a successful attack. These initiatives include coordination and information sharing, spare equipment programs, security standards, grid security exercises, and other measures discussed below.
subsections: section_title: Coordination and Information Sharing
paragraphs: The National Infrastructure Protection Plan (NIPP), initially published by the Department of Homeland Security in 2006, "outlines how government and private sector participants in the critical infrastructure community work together to manage risks and achieve security and resilience outcomes." The plan organizes critical infrastructure into distinct sectors, designating a federal department or agency as the lead coordinator for each sector—the Sector Specific Agency (SSA). Under the NIPP and Presidential Policy Directive 21 on Critical Infrastructure Security and Resilience, the Department of Energy (DOE) is designated as the SSA for the Energy Sector, which includes the electric utility industry (excluding nuclear power plants). As an SSA, the department is responsible for working with the Department of Homeland Security (DHS), other federal agencies, critical infrastructure owners, independent regulators, and other agencies to implement national policy on critical infrastructure security and resilience. The NIPP also established a sector partnership model including private and government coordinating councils:
The Electricity Subsector Coordinating Council (ESCC) , initially established in 2004, was organized and administered by companies in the electric power industry. It meets regularly to coordinate policy-related activities designed to "improve the reliability and resilience of the electricity subsector, including physical and cyber infrastructure." Through August 15, 2013, the ESCC was chaired by the North American Electric Reliability Corporation (NERC), the not-for-profit organization responsible for ensuring the reliability of the North American grid. The ESCC has since transitioned to a new structure led by electric utility industry executives, although NERC's chief executive officer remains on the ESCC steering committee. The Energy Sector Government Coordinating Council (EGCC), also established in 2004, is the government counterpart to the ESCC. The EGCC is chaired by the DOE and DHS, incorporating other agencies at all levels of government with interest in energy security. The EGCC plays a key role in implementing the Sector-Specific Plan (discussed below), collaborating with the ESCC to develop and prioritize security programs and initiatives.
In addition to these councils, other organizations have been established with more specific responsibilities related to grid security.
The Electricity Sector Information Sharing and Analysis Center (ES-ISAC), established in 1998, is the electricity sector's primary communications channel for security-related information, situational awareness, incident management, and coordination. The ES-ISAC is operated by NERC in collaboration with the DOE and ESCC. Members may anonymously share security-related incident information with the ES-ISAC by means of a secure Internet portal. Registered users receive information on security threats and alerts, remediation, task forces, events, and other security-specific resources. NERC's Critical Infrastructure Protection Committee (CIPC) coordinates NERC's security initiatives and advises NERC's Board of Trustees, its standing physical and cybersecurity committees, and the ES-ISAC. One of the CIPC's key functions is developing, reviewing, and revising security guidelines; and assisting in the development and implementation of NERC standards. In January 2015, NERC chartered the Physical Security Advisory Group (PSAG) —consisting of representatives from the electric power industry, DOE, DHS, and informed observers—to assist the ES-ISAC in the analysis of physical security threats. The PSAG is intended to offer advice on security plans, policy and procedure, security technology, training, incident response, and threat mitigation strategy to enhance grid physical security and reliability.
subsections: section_title: DOE's Energy Sector-Specific Plan
paragraphs: The 2006 National Infrastructure Protection Plan required each critical infrastructure sector to develop a Sector-Specific Plan (SSP) that describes strategies to protect its critical infrastructure, outlines a coordinated approach to strengthen its security efforts, and determines appropriate funding for these activities. The section of the DOE's Energy Sector-Specific Plan addressing electricity was developed in collaboration with the ESCC and EGCC. The plan identifies high-voltage transformers as an electric sector vulnerability due to their criticality to the power grid and the difficulty of replacing them in the event of a successful attack. Among other measures, the SSP established a goal of implementing "agreements that require participants to maintain transformers for possible sharing in the event of a terrorist act." The plan also identified the "need for a new type of emergency spare (recovery/mobile) high-voltage transformer that can be deployed and energized quickly to rapidly recover from outages caused by natural disasters and deliberate attacks."
section_title: ESCC's Critical Infrastructure Strategic Roadmap
paragraphs: In November 2010, the Electricity Subsector Coordinating Council published its Critical Infrastructure Strategic Roadmap report, to provide a framework for identifying risks that could seriously disrupt the grid and for promoting actions to enhance grid reliability and resilience. The report paid particular attention to "severe-impact risks with the potential to impact large portions of the grid, or disrupt service for an extended period of time." The report considered three principal risk scenarios, the first of which relates to physical attacks:
Scenario 1: Physical Attack on Significant Electricity System Equipment
A coordinated physical attack on key nodes of the bulk power system critically disables difficult to replace equipment in multiple generating stations or substations and could have a significant affect [sic] on the remainder of the system. A prolonged period of time is required to fully restore the bulk power system to normal operation.
The report recommended an assessment of current capability to prevent and respond to such a scenario as a "high priority." The report also recommended as "important" both a study of "options and practices to enhance physical protection of critical equipment requiring long recovery times (e.g., large high-voltage transformers)" and an initiative to "enhance the availability of critical spare equipment ... starting with high voltage transformers."
section_title: EEI's Threat Scenario Project
paragraphs: In 2011, the Edison Electric Institute (EEI), the main trade association for U.S. investor-owned electric utilities, initiated its Threat Scenario Project to identify security threats and practices utilities could take to mitigate these threats. While the project examined a wide range of potential threats, it included consideration of coordinated physical and cyberattacks. According to EEI, "the project established common elements for each threat scenario, including a description, likely targets, potential threat actors, specific attack paths, and likely impacts of a successful attack." The project is ongoing, with the goal of helping electric utilities "quickly identify areas where security measures are sufficient and where gaps may exist, and begin the dialogue about additional measures that can be taken to help detect, protect against, respond to, and recover from a range of potential threat scenarios."
section_title: DOE's Quadrennial Energy Review
paragraphs: As stated above, in April 2015, the DOE released its first Quadrennial Energy Review (QER), focusing on energy infrastructure, including "resilience, reliability, safety, and asset security for the electric grid." Among its considerations related to the electric grid, the report focuses specifically on the security of HV transformers.
The Administration has made it a priority to work with industry to identify challenges and create solutions for increasing the security and resilience of the electric grid, including the development of an integrated national plan to mitigate challenges pertaining to aging power transformers, the cyber and physical security of transformers, and the vulnerabilities of large power transformers. The Administration is working with trade association leadership and the private sector to improve the coordination of existing and planned transformer-sharing programs and to identify solutions for transformer replacement capabilities as part of its efforts to enhance the resilience of the Nation's electric grid.
The QER also specifically recommended that DOE should lead a multi-agency (federal and state) and industry initiative to mitigate the risks of HV transformer losses, including the development of additional transformer reserves as discussed below.
section_title: Transformer Equipment Programs
paragraphs: Consistent with the recommendations of the studies above, several programs have been instituted within the electric power sector to address the operational issues that could emerge due to the scarcity of spare HV transformers and associated equipment in the event of a physical attack or other grid emergency. 
subsections: section_title: DHS Recovery Transformer Program
paragraphs: In 2008, the Department of Homeland Security (DHS) initiated a program to develop a prototype "Recovery Transformer" (RecX) which could enable recovery from transformer failure within days rather than months or longer. The RecX transformer was intended to be adaptable to a range of common grid specifications as well as being smaller, lighter, easier to transport, and quicker to install than conventional HV transformers. The RecX prototype was designed to replace the most common HV transformers (345 kV) used in the U.S. grid. This design reportedly could be used to replace approximately one quarter of the 2,100 transformers in this voltage class currently deployed. In 2012, the only three single-phase RecX prototype units were installed in an operating 345 kV substation in Texas during a simulated emergency drill, where they remain in regular operation, having met or exceeded their service requirements. The RecX transformers have reliability and efficiency characteristics comparable to other 345 kV transformers, and are also comparably priced ($7.5 million each). Although t he manufacturer has received no orders for commercial production of these units as of May 2015, a few utilities have expressed interest in leveraging the concepts demonstrated by the RecX program for their own applications. Having successfully demonstrated the RecX concept, the DHS is no longer funding the RecX program, but the manufacturer has discussed continued development of the concept including higher kV ratings and "hardened" designs.
section_title: EEI Spare Transformer Equipment Program
paragraphs: In 2006, the Edison Electric Institute initiated its Spare Transformer Equipment Program (STEP) to strengthen "the sector's ability to restore the nation's transmission system more quickly in the event of a terrorist attack." The STEP program requires participating utilities to maintain (or acquire) a specific number of transformers up to 500 kV to be made available to other utilities in case of a critical substation failure. Sharing of transformers is mandatory based on a binding contract subject to a "triggering event"—a coordinated act of deliberate, documented terrorism resulting in the destruction or disabling of a transmission substation and the declaration of a state of emergency by the President. FERC granted blanket authorization for the transfer and cost recovery of transmission equipment under the STEP program in September 2006. State regulators with jurisdiction over participating utilities have also granted pre-approval for STEP transfers. The program is designed to deal with terrorist events, but it also provides a mechanism for voluntary sharing of transformers in other emergencies, although these may require additional regulatory approvals. EEI requires annual recertification and conducts a STEP program drill every summer to ensure the program and its members will be fully prepared to respond in the event of an actual triggering event.
section_title: NERC Spare Equipment Database
paragraphs: In 2012, NERC initiated its Spare Equipment Database (SED) program intended to serve as a tool to "facilitate timely communications between those needing long-lead time equipment damaged in a [high impact, low frequency] event and those equipment owners who may be able to share existing equipment being held as spares by their organization." The SED program is a confidential web-based catalog of spare transformers rated at 100 kV or higher. Only NERC and the equipment owners can see their spares data (although NERC can make high-level reports to FERC); requests for equipment disclose neither the requester nor provider (double-blind). Participation is voluntary and requires no commitment or mandatory sharing of spares. Unlike EEI's STEP program, however, the SED program has not been granted pre-approval from FERC or state regulators for equipment transfers. Thus, the ability to transfer the ownership of transformers from one company to another may require additional approvals, even during an emergency.
section_title: QER Transformer Reserve Proposal
paragraphs: The DOE's Quadrennial Energy Review states that the inventory of HV transformers under EEI's STEP program is too small to respond to a large, coordinated attack against critical substations, and that transformer design variations and logistics further limit the effectiveness of EEI's program. Accordingly, the QER recommends a DOE-led effort to develop one or more HV transformer reserves through a staged process involving: assessment of technical specifications for reserve transformers, where to locate transformers, how many would be needed, how they would be secured and maintained, how they might be transported, and whether new federal authorities or cost sharing would be necessary. Consistent with this recommendation, a House bill to establish a Strategic Transformer Reserve program ( H.R. 2244 ) introduced on May 8, 2015, would require the Secretary of Energy to submit to Congress "a plan to establish a Strategic Transformer Reserve for the storage, in strategically located facilities, of spare large power transformers in sufficient numbers to temporarily replace critically damaged large power transformers" (Sec. 1(c)(1)). Implementation and funding of such a plan would be subject to congressional approval.
section_title: Grid Assurance LLC
paragraphs: On June 10, 2015, a group of eight electric utilities and energy companies announced a new private sector joint venture company called Grid Assurance "to provide improved responses to major events affecting the electric transmission grid by giving transmission-owning entities access to domestically warehoused long lead-time critical equipment," including HV transformers. Grid Assurance would function as a service company open to other transmission companies via a standardized subscriber agreement. Subscription would be voluntary. In an associated filing with FERC, Grid Assurance states that it will
(1) maintain an optimized inventory of critical spare transformers, circuit breakers and related transmission equipment, 
(2) provide secure domestic warehousing of the inventory of spares in strategic locations, and
(3) release spare equipment to utility subscribers as needed to respond to emergencies.
The company believes its services will be complementary to, but significantly broader than, EEI's Spare Transformer Equipment Program. It will offer transformers in a wider range of voltage classes, other long-lead time equipment (e.g., circuit breakers, phase angle regulators, temporary towers), and greater logistical support, among other services. Grid Assurance has petitioned FERC for a declaratory order affirming that contracting with the company would be permissible as part of a physical security plan under NERC physical security regulations (discussed below), and that acquisition of equipment by utility subscribers from Grid Assurance would not require authorization under Section 203 of the Federal Power Act.
section_title: Grid Security Exercises and Simulations
paragraphs: NERC and FERC have conducted grid security computer simulations and exercises specifically incorporating hypothetical attacks on HV transformer substations.
subsections: section_title: GridEx and GridEx II
paragraphs: In 2011, NERC conducted GridEx 2011, its first electric sector-wide grid security exercise. The exercise assessed the readiness of utilities to respond to a cyberattack, strengthened their crisis response, and provided input for internal security program improvements. Although the exercise was focused on a cyberattack, it did involve physical incursions into power grid substations as well as aspects of grid monitoring and recovery that would be relevant to an attack on HV transformers. Among other findings, the exercise determined that "utilities took appropriate steps to secure the grid." Nonetheless, NERC recommended that "entities should ensure their response protocols address a coordinated threat," and that it would "facilitate and support the development of updated physical security guidance."
After the Metcalf attack in 2013, NERC conducted a second, more expansive grid security exercise, GridEx II. The exercise scenario, developed using open-source techniques, included a cyberattack on the grid coupled with a coordinated physical attack against a subset of transmission and generation assets—including HV transformer substations. Among other conclusions, NERC's after-action report stated:
While the electricity industry has experienced occasional acts of sabotage or vandalism, a well-coordinated physical attack also presents particular challenges for how the industry restores power.... The extreme challenges posed by the Severe Event scenario provided an opportunity for participants to discuss how the electricity industry's mutual aid arrangements and inventories of critical spare equipment may need to be enhanced.
NERC did not publicly report details about the overall impacts to the grid or outages in particular regions due to the sensitive nature of such information. Utilities and other agencies participating in the exercise viewed it a useful tool for utilities to test their readiness and preparedness for attacks on the grid. NERC is in the process of preparing for GridExIII to be conducted in November 2015.
section_title: FERC "Electrically Significant Locations" Study
paragraphs: In early 2013, prior to the Metcalf attack, then-FERC Chairman John Wellinghoff directed FERC staff to prepare an analysis identifying critical HV substations in the North American power grid. Using power flow analysis software to model the impacts to the transmission system from the loss of specific grid assets, FERC staff compiled a list of "Electrically Significant Locations (ESLs)" within the grid. Neither details of the ESL study methodology nor its results have been released publicly by FERC or other agencies, although some findings have been reported in the press and discussed publicly by federal officials. According to the Wall Street Journal , the FERC analysis identified 30 critical transformer substations; in FERC's simulation, losing nine of these substations (in various combinations) as the result of a coordinated attack reportedly was found to cause a nationwide blackout for an extended time. As noted above, however, DOE officials have questioned the validity of FERC's analysis.
Members of Congress were highly critical of both the Wall Street Journal and FERC officials for inappropriately releasing what was perceived to be highly sensitive information about power grid physical vulnerability. The study was not initially designated as security sensitive by commission staff. A subsequent investigation by the Department of Energy's Inspector General concluded that FERC's handling of the ESL study findings was improper. The protection of information about grid security is further discussed in a later section of this report.
section_title: HV Transformer Security Standards
paragraphs: Several grid security guidelines or standards have been developed or proposed to address the physical security of the grid, including HV transformers. These standards have been promulgated by NERC as voluntary best practices since at least 2002, with subsequent revisions. However, in the wake of the Metcalf incident, FERC ordered the imposition of mandatory physical security standards in 2014. Current industry-wide standards are discussed in the following sections.
subsections: section_title: IEEE Substation Security Standard
paragraphs: In 2000, the Institute of Electrical and Electronics Engineers (IEEE), a technical professional society, published its first standards for electric power substation physical and electronic security. The voluntary standard addressed "security issues related to human intrusion upon electric power supply substations" and various methods to mitigate them. The original standard, and subsequent revisions, call for the development of security assessments and, for "high-risk areas," increased security measures such as motion detectors, perimeter/area detection systems, security cameras, physical barriers, and posted guards. However, according to the IEEE, the standard is intended to address security issues related to unauthorized access, theft, and vandalism. The IEEE states that "attacks against the substation for the purpose of destroying its capability to operate, such as explosives, projectiles, vehicles, etc. are beyond the scope of this standard."
section_title: NERC Physical Security Guidance
paragraphs: In June 2002, NERC published its initial guidance for physical response to security alerts from the federal government. This alert system was revised in October 2002 to correspond to DHS's new color-coded threat level system. NERC's guidance was voluntary, intended to provide "examples of security measures that electric utility organizations may consider taking, based on the Alerts issued." NERC's guidance included 35 specific security measures for the five threat DHS levels. These measures ranged from "occasional" workforce awareness programs and annual security plan reviews during times of low threat (green) to continuous monitoring of critical facilities, potentially with armed guards, during times of highest threat (red). Along with this guidance, NERC published initial guidelines for vulnerability and risk assessment to help identify critical facilities and countermeasures to mitigate threats.
In November 2005, NERC published a third version of its physical security guidelines, to provide "examples of security measures that other electricity sector organizations should consider when responding to threat level alerts" [emphasis added]. Thus, while still voluntary, these measures appear to have been intended as recommendations rather than considerations as stated in the earlier versions. The 2005 document included 55 measures, including new measures and existing measures expanded or described more specifically. New measures during times of low threat included, for example, annual audits of critical facility access programs and identifying critical facility long-term and short-term security measures (e.g., vulnerability assessments and security barriers).
The Energy Policy Act of 2005 ( P.L. 109-58 ) mandated the implementation of electric grid reliability standards under new authority granted to the Federal Energy Regulatory Commission. FERC subsequently designated NERC as the Electric Reliability Organization certified by the commission to establish and enforce reliability standards for the U.S. electric transmission grid, subject to commission review. In 2008, FERC approved NERC's initial reliability standards for critical infrastructure; however, these standards were developed primarily to address transmission grid cybersecurity, not physical security. Subsequent NERC standards have expanded these cybersecurity requirements.
In October 2013, NERC published its most recent revision to its physical security guidance, Security Guideline for the Electricity Sub-sector: Physical Security Response , providing to electricity sector members "actions they should consider when responding to the threat alerts" issued by the DHS. Continuing its voluntary (rather than regulatory) approach to physical security, NERC's guidance states that "each organization decides the risk it can accept and the practices it deems appropriate to manage its risk." This version of NERC's guidance lays out 77 distinct security measures corresponding to three levels of threat: (1) Normal Operations/Best Practices, (2) Elevated, and (3) Imminent.
section_title: FERC Physical Security Best Practices
paragraphs: In 2013, FERC staff along with staff from the Federal Bureau of Investigation (FBI), DOE, DHS, and NERC participated in a number of meetings with utilities and law enforcement agencies to discuss immediate findings and recommendations stemming from the Metcalf substation attack. As part of these meetings, FERC staff shared with utilities a list of best practices for physical security. Although the list has not been made public, it reportedly included prescriptive security measures (e.g., outward-facing video surveillance) focused on security threats similar to that experienced at the Metcalf substation. In 2014, DHS, in coordination with FERC, the ES-ISAC, NERC, the FBI, and industry experts, convened another series of regional briefings across North America with utilities and law enforcement officials to follow up on the initial outreach regarding substation physical security.
section_title: NERC Physical Security Regulations
paragraphs: On March 7, 2014, FERC ordered NERC to submit to the commission within 90 days proposed reliability standards requiring certain transmission owners "to take steps or demonstrate that they have taken steps to address physical security risks and vulnerabilities related to the reliable operation" of the power grid. In its order FERC stated that physical security standards were necessary because "the current Reliability Standards do not specifically require entities to take steps to reasonably protect against physical security attacks." According to FERC's order, the new reliability standards were to require transmission owners or operators to perform a risk assessment of their systems to identify their "critical facilities," evaluate the potential threats and vulnerabilities to those identified facilities, and develop and implement a security plan designed to protect against attacks to those identified critical facilities. The order required that each of these steps be verified by NERC or another third party qualified to review them.
On May 23, 2014, NERC filed with FERC its proposal for mandatory physical security standards. On November 20, 2014, FERC approved the proposed standard, with minor changes, as NERC's new Physical Security Reliability Standard (CIP-014-1). The standard applies to transmission owners with assets operating at 500 kV or higher as well as owners with substations operating between 200 kV and 499 kV if they meet certain interconnection or load-carrying criteria. The standard consists of six principal requirements (R1-R6), summarized as follows:
R1. Risk assessments by transmission owners to identify critical transmission facilities;
R2. Independent third party verification of risk assessments conducted under R1;
R3. Requirement for transmission owners with critical facilities identified under R1 but not under their operational control to notify the transmission operator of these facilities;
R4. Mandatory threat and vulnerability assessments for critical facilities conducted by transmission owners and operators; 
R5. Development, documentation, and implementation of physical security plans to protect critical facilities; and
R6. Independent third party review of the threat and vulnerability assessments performed under R4 and security plans developed under R5.
The standard also lays out a process for compliance monitoring and assessment including audits, self-certifications, spot checking, violation investigations, self-reporting, and handling complaints. The new standard will be enforced by NERC or another Regional Entity under a penalty review policy for mandatory reliability standards approved by FERC subject to the Commission's enforcement authority and oversight under P.L. 109-58 . According to NERC, the CIP-014-1 physical security standard has staggered enforcement dates with compliance obligations beginning on October 1, 2015.
section_title: Company-Specific Initiatives
paragraphs: Electric utilities have long had an ongoing responsibility to ensure grid reliability, in part through operating practices and investments related to grid safety and security. As the standards discussed in the previous section suggest, there has been some level of physical security investment and an increasing refinement of grid security practices across the electric power sector for at least the last 15 years. Nonetheless, several major transmission owners have announced significant new investment initiatives specifically to improve the physical security of critical transformer substations in light of the Metcalf attack. Other utilities have included new substation security investments in broader initiatives for company security. The following examples illustrate the types of security changes announced by these grid owners. Note that other major utilities have not publicly announced similar new security initiatives, or have kept the details of their security initiatives confidential. A comprehensive review or comparison of physical security plans among all major grid owners in the United States is beyond the scope of this report.
subsections: section_title: The Tennessee Valley Authority
paragraphs: In February 2012, the Tennessee Valley Authority (TVA) announced that it was "realigning its operations and structure to enhance security at TVA's non-nuclear power facilities ... focusing more of our non-nuclear security resources on our critical infrastructure," including HV substations. The realignment included ending uniformed patrols in favor of installing more security technology, and the stationing of contract guards 24 hours a day at critical facilities. Together with local law enforcement cooperation, the shift to contract guards was intended to provide a more persistent security presence and faster incident response at key locations. Among the security technologies reportedly deployed by TVA are "surveillance, infrared cameras, video analytics for alarm verification and assessment, virtual perimeters, card readers, [and] automated gates." TVA's security initiatives in 2012 appear to have been motivated primarily by security concerns such as copper theft, but would be applicable to more serious security risks such as terror attacks.
In February 2014, after the Metcalf incident, TVA reportedly stated that it was "intensifying efforts" to educate local law enforcement about the importance of substations, including taking police on site visits to see substations during normal operations. The utility also began canvassing residents near TVA property asking them to report unusual activity around grid facilities. TVA officials have not publicly released details of the authority's physical security program, but the authority reportedly "takes significant steps, both physically and procedurally, to protect its transmission infrastructure," employing "several layers of protection." TVA's Budget Proposal and Management Agenda for FY2016 discusses $25 million to $35 million in cybersecurity investments but does not discuss investments specifically for physical security. The authority's quarterly report states that "TVA continues to evaluate measures that may be required for compliance" with FERC's new physical security standard "but costs cannot be estimated at this time."
section_title: Pacific Gas and Electric (PG&E)
paragraphs: In February 2014, in response to the attack on its Metcalf substation, PG&E announced that it would be investing approximately $100 million over three years to improve substation security. Physical security measures mentioned by the company included new perimeter barriers, shielding for certain equipment, more cameras (inside and outside the fence), and clearing vegetation. For its most critical facilities, the company was "studying advanced detection technology such as night vision and thermal imaging." Other security measures mentioned in news reports about PG&E included enhanced lighting, 24-hour security guards, and increased patrols by local law enforcement agencies. Initial implementation of these measures was inadequate, however, as the Metcalf substation experienced another significant security incident in August 2014, during which thieves breached a perimeter fence and stole several pieces of construction equipment. According to PG&E, human error was a factor because "fence detection alarms received in security operations were not appropriately addressed."
section_title: Dominion
paragraphs: In February 2014, Dominion Virginia Power, an operating company of Dominion, announced plans to spend up to $500 million over five to seven years "to harden its transmission substations and other critical infrastructure against man-made physical threats and natural disasters, as well as stockpile crucial equipment for major damage recovery." Dominion reportedly began to increase substation security efforts in 2013, focusing first on substations at greatest risk. Among the security measures identified by the utility are physical barriers, additional access control, equipment design/hardening, polymer bushing installation, additional spare equipment, and relocation of spare equipment to off-site storage areas. Other measures reportedly include dual-perimeter "no man zones" around substations and installing systems for key-card access to substation yards. As of February 2015, Dominion had begun implementing a series of new physical measures including new risk assessment models, modifications to substation equipment, and improved off-site monitoring.
section_title: Bonneville Power Administration
paragraphs: In its 2014 draft Security Asset Management Strategy , the Bonneville Power Administration (BPA) proposed approximately $37 million in additional capital spending through FY2020 for physical security measures at approximately 60 critical transformer substations. BPA's Strategy stated that, over the prior 13 years, the utility had "conducted hundreds of security and risk assessments using several industry accepted methodologies," and began implementing security improvements based on these risk assessments beginning in 2001. The administration's 2015 "2 nd Quarter Capital Project Status Report" includes $49.9 million in capital spending to acquire five 500 kV spares and relocate two existing transformers to be used as spares placed strategically across the BPA system. BPA has 105 single-phase transformers (35 banks) rated at 500kV in service.
section_title: New York Power Authority
paragraphs: The New York Power Authority (NYPA) in January 2015 requested authorization from its trustees for $42.5 million in capital expenditures primarily for physical security upgrades at critical substation in its transmission system. Planned upgrades include fence intrusion detection systems, modification of physical security perimeters, installing key card access systems, surveillance cameras, laser detection systems, and associated control and monitoring systems, among other measures.
section_title: Pepco Holdings
paragraphs: In May 2014, Pepco Holdings reportedly announced a $40 million project to upgrade physical security at various substations in the company's transmission system. The company states that it has established a physical security working group, has conducted on-site physical security assessments, and has been collaborating with other entities to focus on the best security improvement opportunities. Pepco's physical security measures include guarded facilities for spare equipment, enclosing substations, improving communications connectivity, maintaining spare equipment, and considering physical security when evaluating new facilities. 
section_title: Issues for Congress
paragraphs: The recent transformer substation incidents, together with federal grid security exercises, have focused attention on the vulnerability of HV transformer substations to organized physical attacks. As the electric power industry and federal agencies continue their efforts to improve the physical security of critical HV transformer substations, Congress may consider several key issues as part of its oversight of the sector.
subsections: section_title: Identifying Critical Transformers
paragraphs: A fundamental consideration regarding HV transformer security is a clear and stable understanding of which transformers are "critical." The USA PATRIOT Act of 2001 defines "critical infrastructure" in the most general sense as "systems and assets ... so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." In its 2009 guidelines for identifying critical assets specifically in the electricity sector, NERC defines critical assets as those "that if destroyed, degraded, compromised (e.g., misused) or otherwise rendered unavailable would unacceptably affect the reliability or operability of the [bulk-power system] as a whole.... " FERC's 2014 order mandating physical security standards for the grid defines a "critical facility" as "one that, if rendered inoperable or damaged, could have a critical impact on the operation of the interconnection through instability, uncontrolled separation or cascading failures on the Bulk-Power System." All three definitions associate "criticality" with a failure event of national significance, although none provides a more prescriptive basis for identifying such assets.
In its physical security order, FERC does not require that a "mandatory" number of critical facilities be identified under the standards. Determination of whether a specific HV transformer is "critical" will be based on each individual asset owner's "objective analysis, technical expertise, and experienced judgment." In its physical security standards, NERC requires transmission owners with HV assets meeting prescriptive criteria to examine whether they may have critical transformers, but it is up to the owners to determine themselves if any of their assets are critical through a periodic risk assessment based on their own respective transmission analyses, subject to independent validation. Thus, grid owners could have considerable latitude in determining which of their transformer substations (if any) are critical and therefore subject to the requirements of the new standard. 
Although there are many candidate transformer substations in the grid, relatively few are likely to be of national significance. As discussed above, of the numerous HV transformer substations in the United States, FERC's 2013 power flow analysis identified only 30 as being critical to the national grid (although each of these substations may contain multiple HV transformers). Whether the number of critical transformer substations under FERC's definition above turns out to be higher or lower than 30, it will likely be only a small fraction of the total asset base. This conclusion is consistent with FERC's expectation that under NERC's new standard "the number of facilities identified as critical will be relatively small.... For example, of the many substations on the Bulk-Power System, our preliminary view is that most of these would not be 'critical' as the term is used in this order." Consistent with this view, the NERC working group responsible for drafting the proposed physical security standard likewise expected the number of critical facilities to be "small and that many Transmission Owners that meet the applicability of this standard will not actually identify any such Facilities."
Although the new NERC physical security standards were approved by FERC after extensive utility and public comments, some stakeholders take issue with specific requirements and methodology in the standards. For example, some analysts have objected to NERC's standards as focusing too narrowly on a limited number of substations evaluated individually. They argue this approach fails to adequately consider potential impacts from a planned, multi-substation attack. They assert that NERC's approach may overlook transformers that are "critical" in the context of such an attack. FERC has rejected these arguments (for the time being) arguing that "by protecting individual critical facilities, responsible entities will necessarily protect critical facilities against simultaneous attacks." FERC states that it is not prepared "to expand the scope of covered facilities to include those not individually critical ... at this early stage of industry experience with the new requirements. Our priority at this time is to have responsible entities protect the most critical facilities." However, the commission also states that it remains "open to a different approach in the future as industry continues to gain experience in this area and as risks may evolve." 
Properly identifying which HV transformer substations are critical is a key issue. Otherwise, the electricity sector risks the possibility of hardening too many substations, hardening the wrong substations, or both. Either outcome could increase ultimate costs to electricity consumers without commensurate security benefits, and could potentially divert limited security resources from other important grid priorities (e.g., cybersecurity). Hardening too few substations could leave the grid exposed to unacceptable levels of risk. Independent verification is intended to validate utility assessments of substation criticality, but the standard's reliance on company-by-company assessments may still allow for important differences in analytic methodology or assumptions, and thus inconsistent conclusions about transformer criticality. Furthermore, company-specific studies may not align with a "top down" assessment of asset criticality like that performed by FERC in its Electrically Significant Location (ESL) analysis. Congress may examine whether company-specific assessments of transformer criticality could differ from national-level assessments or assessments using other analytic approaches, and what implications, if any, such differences might have on overall grid security and company efforts to protect particular substations.
section_title: Confidentiality of Critical Transformer Information
paragraphs: Ensuring the confidentially of critical infrastructure information has been a long-standing concern across all critical infrastructure sectors. It is a key reason for the establishment of sector Information Sharing and Analysis Centers (ISACs), including the Electricity Sector ISAC, discussed above. Confidentiality also factors into the administration of the industry's spare transformer programs and other activities related to critical infrastructure. FERC has established policies for the protection of critical energy infrastructure information (CEII) through a series of orders, beginning with Order 630, issued February 21, 2003. The order (§27) defines CEII as information that "must relate to critical infrastructure, be potentially useful to terrorists, and be exempt from disclosure under the Freedom of Information Act [FOIA]." It also establishes procedures and responsibilities for determining what information qualifies as CEII and handling CEII requests. FERC's 2014 order mandating physical security standards also requires procedures to ensure confidential treatment of sensitive information.
Press articles in the wake of the Metcalf attacks, notably in the Wall Street Journal , cited specific details about FERC's 2013 ESL analysis, reportedly from a copy of a FERC presentation obtained by the paper. Notwithstanding FERC's orders on CEII, Members of Congress and FERC officials have expressed concern that the release of the presentation by FERC staff and the publication of details in the press potentially compromised grid security. Others reportedly have disputed this concern, including the former FERC Commissioner responsible for commissioning and presenting the ESL study findings at industry meetings. In April 2014, the DOE Inspector General issued a management alert which concluded that the FERC presentation in question "should have been classified and protected from release" and "that the Commission may not possess adequate controls for identifying and handling classified national security information." The Acting Chairman of FERC testified at the time that the commission was adopting the Inspector General's recommendations to improve its handling of CEII and requested additional authority from Congress for exemption from FOIA.
On January 30, 2015, the DOE Inspector General released a follow up inspection report related to the IG's earlier examination of CEII handling by FERC. The report concluded that
the Commission's controls, processes and procedures for protecting nonpublic information were severely lacking. Specifically, we found that staff inconsistently handled and shared Commission-created analyses that identified vulnerability of the Nation's electric grid without ensuring that the data was adequately evaluated for sensitivity and classification.
The IG report noted that FERC's actions to remediate its CEII lapses since the IG's earlier Management Alert were "a good start," but that additional measures were recommended. According to the IG, FERC's comments and additional plans in response to the new report were generally responsive to the report's findings and recommendations.
FERC staff may be taking steps to improve the way CEII is safeguarded in response to the Inspector General's reports, but securing CEII may continue to be an issue if NERC's new physical security regulations are approved by the commission. NERC's regulations would require independent risk assessments by multiple grid owners and 3 rd party validation of those assessments. This process, by construction, would cause considerable new CEII to be created (e.g., multiple Midwest power flow models) and shared among utilities, RTOs, and consultants in ways that may be new to the industry. Ensuring that CEII generated and transferred among these entities remains secure could require special attention. As FERC's improper management of the ESL study information shows, having strong CEII policies in the context of NERC's new physical security regulations may not guarantee that those policies will be correctly and uniformly followed—even by the agency that created them.
The Critical Electric Infrastructure Protection Act ( H.R. 2271 §2(a)) would strengthen federal protections for critical electric infrastructure information. Among other provisions, the bill would exempt such information from disclosure under the Freedom of Information Act or any state, tribal, or local law requiring such disclosure. The bill would also require FERC to promulgate regulations, issue orders, provide standards, and specify sanctions to ensure appropriate sharing of critical electric infrastructure information and prevent its unauthorized release. The bill would allow federal officials to grant temporary access to classified information to key personnel of entities subject to grid security emergency measures, further discussed below.
section_title: Adequacy of HV Transformer Protection
paragraphs: The electric power sector has had physical security guidelines in place for well over a decade, as discussed above. These voluntary guidelines have been updated and expanded periodically to reflect industry experience, changes in the security environment, and new technologies. Prior to 2014, however, it appears that the physical security initiatives among grid owners were focused primarily on preventing vandalism and theft (of copper wire) rather than a terrorist attack. As the recent substation attacks in California, Arkansas, and Florida have shown, many other security measures available to grid owners were not implemented—even at critical HV substations.
A grid owner's focus on vandalism and theft may be understandable because such incidents have occurred frequently and their associated costs are tangible and well-understood. Investing in security against a terrorist attack presents a greater challenge in terms of costs and benefits. As a 2006 report from the Electric Power Research Institute states, 
Security measures, in themselves, are cost items, with no direct monetary return. The benefits are in the avoided costs of potential attacks whose probability is generally not known. This makes cost-justification very difficult.
Note that cost-justification requires not only the approval of utility management, but also of FERC and potentially state public utility commissions which regulate the rates grid owners may charge for electric transmission and distribution service. Regulators are responsible for ensuring that electricity rates are just and reasonable. They must be convinced that any new grid security capital costs and expenses are necessary and prudent before they will allow them to be passed through to ratepayers. 
The Metcalf incident and GridEx exercises have provided the electric sector with valuable new information about the potential threat, vulnerability, and consequence of a coordinated attack on HV transformers. Risk assessments incorporating this information presumably would justify (with or without a new NERC standard) increased security investments at critical substations to prevent intentional attacks. The spending plans announced in 2014-2015 at PG&E, Dominion, BPA, and other utilities for HV substation security appear to reflect such risk and cost-benefit reassessments. Nonetheless, there continues to be considerable uncertainty about the risk of terror attacks on the power grid, and what measures are economically justified in addressing them. PG&E, BPA, and the other utilities announcing large security investments have already decided to make such investments. Other major owners of critical HV transformers have not publicly announced similar plans, in some cases because they have not yet completed security evaluations under NERC's new standards, so they are unsure what new measures they will require. For example, based upon a security gap analysis after the Metcalf incident, Florida Power and Light (FPL) identified multiple potential security enhancements, but has only implemented some of them; other measures have been delayed for comparison to requirements under NERC's new standards.
NERC's proposed standards for power grid physical security would ensure considerable consistency in the analytic process utilities must undertake to identify critical substations and develop plans to secure them. However, the standard may not ensure consistency among the various security plans nor in the specific measures the individual asset owners will choose to implement to reduce the risk of intentional attacks. Apart from the physical aspects of their assets, a number of factors may lead to differences in security implementation among grid owners, including differences in organization, ratemaking, accounting, and management capability. In particular, how physical security is managed within a corporate structure can influence the effectiveness of physical security programs. For example, a 2014 corporate memo from PG&E leaked to the press states that "due to the existing structure and limited authority of CSD [Corporate Security Division], little has changed relative CSD's abilities to make significant and intended security improvements." How capital is allocated and accounted for can also be a barrier to physical security implementation and verification. In a 2014 report to Florida regulators, FPL stated that
not all security costs are contained within the Corporate Security budget. Some physical security costs are shared with appropriate operational business units. For example, the cost of security equipment for new substations is rolled into the cost of the substation. Not all physical security costs are budgeted and tracked in separate line items. Therefore, difficulties exist estimating total costs of FPL's physical security efforts.
As FERC continues to implement its policy of regulating physical security of the power grid, Congress may examine whether company-specific security initiatives appropriately reflect the risk profiles of their particular assets, and whether additional security measures across the grid uniformly reflect terrorism risk from a national perspective. Examining the extent to which the corporate structures and accounting functions support company-specific physical security programs may be of particular interest as grid owners adapt to evolving threats and physical security requirements.
section_title: Quality of Federal Threat Information
paragraphs: The power industry's physical security risk assessments rely upon information about security threats provided by the federal government, among other sources, communicated through the ISAC, during DHS and other agency briefings, or through other channels. The quality and timeliness of this threat information is a key determinant of what grid owners need to be protecting against and what security measures to take. Incomplete or ambiguous threat information—especially from the federal government—may lead to inconsistency in physical security among grid owners, inefficient spending of limited security resources at facilities (e.g., that may not really be under threat), or deployment of security measures against the wrong threat. For example, prior to FERC's physical security order, the head of NERC, which initially opposed mandatory physical security standards, stated? 
I am concerned that a rule-based approach for physical security would not provide the flexibility needed to deal with the widely varying risk profiles and circumstances across the North American grid and would instead create unnecessary and inefficient regulatory burdens and compliance obligations.
Differences in the interpretation or application of threat information, as discussed in the previous section, may be a reason why some large utilities have announced major new substation security initiatives while others have not.
Concerns about the quality and specificity of federal threat information have long been an issue across all critical infrastructure sectors. Threat information continues to be an uncertainty in the case of power grid physical security. For example, the PJM regional transmission organization employs probabilistic models to assess risks to the grid due to equipment malfunction and severe weather, but its model has not incorporated an assessment of a physical attack due to insufficient data. 
Some federal officials reportedly have characterized the Metcalf incident as a domestic terrorist attack, potentially a "dry run" for a more destructive attack on multiple HV transformer substations, while the Federal Bureau of Investigation has stated that it does not believe Metcalf was a terrorist incident. Because the perpetrators have not been identified, it is impossible to know for certain, but the ambiguity has significant implications for HV substation security going forward. Although there is wide consensus that the Metcalf attack was extremely serious, some industry analysts have opined that FERC's physical security order may be an "overreaction" to Metcalf. By contrast, former DHS Secretary Michael Chertoff has predicted that "the sophistication and resulting damage of the Metcalf attack will ... be exceeded" in a future attack. Still others have expressed concern that FERC's physical security concerns may be too heavily focused on another Metcalf-type scenario (the last threat) rather than a wider range of potential future threats (the next threat).
There is widespread agreement among government, utilities, and manufacturers that HV transformers in the United States are vulnerable to terrorist attack, and that such an attack potentially could have catastrophic consequences. But the most serious, multi-transformer attacks could require acquiring operational information and a certain level of sophistication on the part of potential attackers. Consequently, despite the technical arguments, without more specific information about potential targets and attacker capabilities, the true vulnerability of the grid to a multi-HV transformer attack remains an open question. As Congress seeks to establish the best policies to address HV transformer vulnerability relative to other infrastructure security priorities, understanding this vulnerability in the context of specific demonstrable threats may become increasingly important. To this end Congress may examine how federal threat information is developed and used by grid owners, and how limitations and uncertainty of this information may affect the HV transformer physical security among electric utilities.
section_title: Recovery from HV Transformer Attacks
paragraphs: Physical security for HV transformer substations has the primary purpose of preventing successful attacks against these critical assets within the power grid. However, in the event of a successful attack, measures to minimize its effect on the overall grid are equally important so that the loss of any particular transformer remains a local event. To this end the electric power industry emphasizes its strategy of "defense-in-depth," which includes incident response and recovery in addition to preparation and prevention. Industry initiatives to enhance grid resiliency, including incident recovery programs such as the DHS recovery transformer program and EEI's spare transformer program, contribute to the power grid's ability to sustain a terrorist attack without widespread grid failure. Indeed, some analysts have pointed to the Metcalf incident as a successful demonstration of grid resiliency; electric service was not interrupted despite the loss of a critical substation in the San Francisco Bay area. Nonetheless, some policymakers have proposed additional federal authorities to respond to physical incidents affecting grid critical infrastructure, including HV transformers.
Some stakeholders, including FERC officials, have asserted that the commission's current grid reliability authority under the Federal Power Act (§215) does not provide FERC with adequate authority for emergency action in the event of an attack on the grid. A House bill to amend the Federal Power Act with respect to critical electric infrastructure security ( H.R. 2271 ) would allow the President to authorize the Secretary of Energy to order emergency measures to protect grid reliability during a "grid security emergency" (§(b)(1)). The director of FERC's electric reliability office has testified in support of the bill that FERC's existing "procedures ... for the development and approval of reliability standards do not provide an effective and timely means of addressing urgent cyber or other national security risks to the bulk power system." NERC's president likewise has testified that he generally supports legislation clarifying federal authority during grid emergencies, as long as they focus clearly on "national, catastrophic instances" and do not conflict with the existing system of ongoing measures in place to protect the grid. Utility industry representatives also support facilitation of industry-government coordination in the event of an attack on the grid. As consideration of H.R. 2271 or similar legislation continues, Congress may focus on specific language related to consultation, duration of emergency measures, grid recovery activities, and other details to ensure that they align with a complex industry structure while achieving the bill's objectives in the event of a future security incident.
As discussed above, the DOE's Quadrennial Energy Review calls for federal efforts to develop one or more critical HV transformer reserves. H.R. 2244 would mandate a DOE plan for how such a reserve program could be carried out. Some in the utility industry support the policy intentions of such a reserve, as already demonstrated by the industry's own spare HV transformer programs and planned expansion of those programs, but they believe stakeholders "will be better served by allowing the industry to create the structure, cost responsibility and pricing for [transformer] sparing services as opposed to a top-down government solution." They believe federal assistance would be most helpful if limited to funding the startup of a transformer reserve program administered by the asset owners themselves. The Grid Assurance sparing service appears consistent with a private sector-driven approach to expand existing spare transformer initiatives. 
Others have questioned the cost-effectiveness of a new national HV transformer reserve program, asserting that—had it been in place—the reserve program envisioned by H.R. 2244 would not have been called upon by any grid incident over the last ten years. As Congress considers any plans for a federally administered strategic transformer reserve, it may consider the relationship of such a program to ongoing industry efforts to maintain HV transformer spares, the relationship between federal and state administrators of such a program, its cost-effectiveness, and its practical requirements (e.g., size, location, and transportation).
section_title: Electric Grid Resilience
paragraphs: In addition to measures focused on the protection of critical HV transformers from physical attack, analysts have advocated policies to reduce the criticality of individual HV assets by enhancing the overall "resiliency" of the electric power grid. As a report from the Executive Office of the President states, 
Grid resilience ... includes hardening, advanced capabilities, and recovery/reconstitution. Although most attention is placed on best practices for hardening, resilience strategies must also consider options to improve grid flexibility and control. Resilience includes reconstitution and general readiness such as pole maintenance, vegetation management, use of mobile transformers and substations, and participation in mutual assistance groups.
A number of federal, state, and industry initiatives exist to address various aspects of electric power grid resiliency. While many of these initiatives have been motivated by weather-related events such as the Northeast Blackout of 2003 and electric grid failure during Superstorm Sandy, policies to improve grid resilience also have benefits in the context of intentional physical attacks. For example, an official from PJM has reportedly stated, 
You can only harden a substation so much. If someone wants to attack a substation, they will.... That leads us to the resilience piece. Maybe the best way to make a substation less critical is to build more transmission. A substation is critical basically because we're pushing too much power through it.
Grid scale energy storage, distributed generation, smart grid technology, and other measures to redistribute or optimize transmission system power flows may also increase grid resiliency and reduce vulnerability to physical security threats.
The Enhanced Grid Security Act of 2015 ( S. 1241 ) would require the Secretary of Energy develop an advanced energy security program to increase the "functional preservation" of the electric grid in the face of both natural and human-made threats and hazards (§7(b)). The objectives of the program would explicitly include both "security and resiliency" through vulnerability assessment, modeling, exercises, research, and technical assistance (§7(c)). The Grid Modernization Act of 2015 ( S. 1243 ) would likewise encourage greater grid resilience, including modelling, research, and investment in grid modernization and new technologies—including tools to increase physical security (§101(3)(E)). Other legislation related to power grid resilience or efficiency would also likely have physical security implications. As Congress continues its examination of physical security policy, maintaining an integrated perspective on prevention, recovery, and resilience may help to promote an effective balance among industry investment, regulatory requirements, and federal oversight.