Critical Infrastructure Protection: Federal Agencies Have Taken Actions to Address Electromagnetic Risks, but Opportunities Exist to Further Assess Risks and Strengthen Collaboration
Published: 2016-03-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Electromagnetic risks caused by a man-made EMP or a naturally occurring solar weather event could have a significant impact on the nation's electric grid as well as other infrastructure sectors that depend on electricity, such as communications. These risks could lead to power outages over broad geographic areas for extended durations.
GAO was asked to review federal efforts to address electromagnetic risks to the electric grid. This report examines (1) the extent to which key federal agencies have taken action to address electromagnetic risks and how these actions align with the 2008 EMP Commission report recommendations, and (2) what additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. GAO reviewed the EMP Commission report and federal program documents, and interviewed DHS, DOE, and FERC officials and relevant stakeholders who provided insights on key actions taken.
section_title: What GAO Found
paragraphs: Key federal agencies have taken various actions to address electromagnetic risks to the electric grid, and some actions align with the recommendations made in 2008 by the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken actions such as establishing industry standards and federal guidelines, and completing EMP-related research reports. GAO found that their actions aligned with some of the EMP Commission recommendations related to the electric grid. For example, DHS developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. Further, agency actions and EMP Commission recommendations generally align with DHS and DOE critical infrastructure responsibilities, such as assessing risks and identifying key assets.
Additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. Specifically, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. Doing so could provide additional awareness of related activities and help ensure more effective collaboration with other federal agencies and industry stakeholders. Moreover, although DHS components have independently conducted some efforts to assess electromagnetic risks, DHS has not fully leveraged opportunities to collect key risk inputs—namely threat, vulnerability, and consequence information—to inform comprehensive risk assessments of electromagnetic events. Within DHS, there is recognition that space weather and power grid failure are significant risk events, which DHS officials have determined pose great risk to the security of the nation. Better collection of risk inputs, including additional leveraging of information available from stakeholders, could help to further inform DHS assessment of these risks. DHS and DOE also did not report taking any actions to identify critical electrical infrastructure assets, as called for in the National Infrastructure Protection Plan. Although FERC conducted a related effort in 2013, DHS and DOE were not involved and have unique knowledge and expertise that could be utilized to better ensure that key assets are adequately identified and all applicable elements of criticality are considered. Finally, DHS and DOE, in conjunction with industry, have not established a coordinated approach to identifying and implementing key risk management activities to address EMP risks. Such activities include identifying and prioritizing key research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. Enhanced coordination to determine key research priorities could help address some identified research gaps and may help alleviate concerns voiced by industry regarding the costs and potential adverse consequences on grid reliability that may be caused by implementation of such equipment.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS identify internal roles to address electromagnetic risks, and collect additional risk inputs to further inform assessment efforts; that DHS and DOE collaborate to ensure critical electrical infrastructure assets are identified; and engage with industry stakeholders to identify and prioritize risk-management activities, such as research and development efforts, to address EMP risks to the grid. DHS and DOE concurred with our recommendations and identified planned actions to address the recommendations.

section_title: Letter
paragraphs: An electromagnetic pulse (EMP) or solar weather event could have a  debilitating impact on critical electrical infrastructure and communications  systems, as well as other key assets and infrastructure that depend on  electric utilities for power. EMP and solar weather events could potentially  lead to power outages over broad geographic areas, some of which could  last for an extended duration. Experts have also reported that long-term  power outages could result in significant economic disruption and adverse  impacts to public health and safety. Addressing these events necessitates  effective collaboration among multiple government agencies and industry  partners, and no single federal program or entity has sole responsibility  for addressing electromagnetic threats. However, the National  Infrastructure Protection Plan (NIPP) outlines the roles and  responsibilities of the Department of Homeland Security (DHS) and  applicable sector-specific agencies for each of the 16 critical  infrastructure sectors. DHS has the lead role in coordinating the overall  federal effort to promote the security and resilience of the nation’s critical  infrastructure, and the Department of Energy (DOE)—as the sector- specific agency for the energy sector, which includes critical electrical  infrastructure—shares responsibility with DHS.
In April 2008, the Commission to Assess the Threat to the United States  from Electromagnetic Pulse Attack (EMP Commission) issued a report  that included over 90 recommendations addressing the preparation for,  and protection and recovery from, a possible EMP attack against U.S.  critical infrastructure. The majority of these recommendations were made  to DHS and to DOE. According to the 2008 EMP Commission report, the  nine commission members, nominated by the Secretary of Defense and  the Federal Emergency Management Agency (FEMA) Administrator,  provided a wide range of experience—including senior management  experience in both civilian and military agencies, National Laboratories,  and in the corporate sector. Their expertise included management and  operation of national infrastructures as well as technical expertise in the  design of nuclear weapons, among other areas.
In July 2015, we testified before the Senate Homeland Security and  Governmental Affairs Committee and reported preliminary findings  regarding DHS’s efforts to address electromagnetic threats to the grid.  As 7 years have passed since the issuance of the 2008 commission  report, you asked us to review actions taken by key federal agencies,  such as DHS and DOE, to address electromagnetic risks. Our objectives  were to determine (1) the extent to which key federal agencies have  taken actions to address electromagnetic risks to the electric grid,  including how these actions align with selected recommendations from  the 2008 EMP Commission report and (2) the extent to which additional  opportunities, if any, exist to enhance federal efforts in addressing those  risks to the electric grid.
To address our first objective, we reviewed DHS, DOE, and Federal  Energy Regulatory Commission (FERC) program documents, research  reports, applicable risk assessments, and other supporting documentation  such as program briefings, strategy planning efforts, and after action  reports to identify actions these entities have taken to address  electromagnetic risks to the grid since the EMP Commission issued its  report in 2008. We also interviewed knowledgeable federal agency  officials to confirm our understanding of how their related actions address  electromagnetic risks to the electric grid. We focused our efforts on the  electric grid because of its foundational significance in providing electric  power to other key critical infrastructures, such as communications,  transportation, banking, and finance and its recognized vulnerability to  electromagnetic risks. To determine how DHS and DOE actions align with  the 2008 EMP Commission report recommendations, we reviewed EMP  Commission information and recommendations related to the electric grid,  as well as applicable laws, policies, and directives related to DHS’s and  DOE’s critical infrastructure protection responsibilities. We reviewed  descriptions of each of the actions that DHS and DOE identified to us and  made an initial determination of how their actions aligned with the  commission recommendations. Internally, we independently verified the  initial alignment decisions and general descriptions of DHS’s and DOE’s  actions and subsequently had them validated by DHS. To determine how  FERC’s actions align with the 2008 EMP Commission report  recommendations, we interviewed FERC officials and reviewed  documentation regarding FERC’s rulemaking on geomagnetic  disturbance (GMD) reliability standards.
To address the second objective, we interviewed multiple officials from  DHS components and other principal federal agencies addressing  electromagnetic risks, as well as industry associations, subject-matter  experts from research organizations, product manufacturers, and electric  utility operators to confirm our understanding of their additional efforts.  Specifically, we met with DHS officials from the National Protection and  Programs Directorate (NPPD), the Science and Technology Directorate  (S&T), Office of Intelligence and Analysis (I&A), DHS Office of Policy, and  the Federal Emergency Management Agency (FEMA), as well as federal  officials from DOE, FERC, the Department of Defense (DOD), and the  National Oceanic and Atmospheric Administration (NOAA). We also met  with industry association officials from the American Public Power  Association and Edison Electric Institute, subject-matter experts from the  Electric Power Research Institute and Metatech Corporation, and product  manufacturers and utility operators from ABB Group, EMPrimus,  Dominion Power, and PJM Interconnection. We identified the nonfederal  entities we interviewed—through discussions with federal officials and our  background research—as key stakeholders and subject-matter experts  within the electric power industry. While these interviews are not  generalizable to the entire industry, they provided valuable insights on  key issues and applicable coordination activities with the federal  government to address electromagnetic risks. In addition, we reviewed  program documentation and applicable reports, briefings, and other  materials related to DHS’s risk assessment and mitigation efforts,  including department-wide risk assessments, such as the Strategic  National Risk Assessment and the Homeland Security National Risk  Characterization process to better understand the department’s overall  efforts to address electromagnetic risks to the electric grid. We also  reviewed key strategy and planning documentation, including the NIPP,  the Energy Sector-Specific Plan, and the National Space Weather  Strategy and Action Plan. We compared the actions DHS and DOE took  against key risk-management criteria contained in the NIPP and Energy  Sector-Specific Plan, as well as applicable internal control standards.  Lastly, we reviewed relevant reports by federal agencies and industry  stakeholders to identify findings related to electromagnetic research and  development needs, and to assess the extent to which additional risk  management activities or collaboration could be beneficial. We assessed  the methodologies used in the relevant reports and determined them to  be sufficient for the purposes of this report.
We conducted this performance audit from November 2014 to March  2016, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: According to experts, a nuclear EMP is the burst of electromagnetic  radiation resulting from the detonation of a nuclear device, which can  disrupt or destroy electronic equipment. Nonnuclear EMP weapons can  also be designed to intentionally disrupt electronics, but these generally  have short range and are not a threat to multiple assets. The threat  focused on primarily by the EMP Commission, and specifically addressed  in this report, is the high-altitude EMP (HEMP). A HEMP event is caused  by the detonation of a nuclear device above the atmosphere, from about  40 to 400 kilometers (approximately 25 to 250 miles) above the earth’s  surface. A HEMP attack is not intended to cause direct physical impacts  at the earth’s surface, such as injury or damage directly from heat, blast,  or radiation, but instead creates an intense electromagnetic pulse that  can disrupt computers and damage electronics and insulators, and could  cause significant damage to critical electrical infrastructure, such as  transformers. The components of EMP—commonly identified as E1, E2,  and E3—can cause disruption and damage to electronic systems and  electrical infrastructure. For example, the E1 component, or fast pulse,  primarily disrupts or damages electronic-based control systems, sensors,  computers, and similar devices, but may also adversely affect long-line  electrical systems; the E2 component, similar to lightning, has the similar  ability to impair or destroy control features that are not protected from  lightning; and the E3 component is a subsequent, slower-rising, longer- duration pulse that creates disruptive currents in transmission lines, which  causes grid instability and increases heat in transformers. If the E3  pulse is high enough and long enough it can result in grid collapse and  potentially damage transformers.
In addition to manmade EMPs, naturally occurring solar weather events  of sufficient intensity can also cause electromagnetic impacts similar to  the E3 pulse that can adversely affect components of the commercial  electric grid, as well as other infrastructure such as satellites and  undersea cables. The resulting impact of solar weather is commonly  referred to as a geomagnetic disturbance (GMD). In 1989, a GMD  caused wide-scale impacts on the Hydro-Quebec power system in  Canada which caused this regional electric grid to collapse within 92  seconds and left 6 million customers without power for up to 9 hours. See  appendix I for additional information on GMD events. See table 1 for an  overview of electromagnetic threats and their primary effects.
As noted in Presidential Policy Directive 21 (PPD-21), the energy and  communications sectors are uniquely critical due to the enabling functions  they provide to other critical infrastructure sectors. The U.S. electric  power delivery system is a highly complex network of substations and  electric lines that transport electricity from generators to residential,  commercial, and industrial consumers. The U.S. electric grid has three  main components: generation (creation of electricity), transmission (long  haul transport of electricity), and distribution (shorter distances connecting  the electricity to the consumer/end user). In November 2015, FERC  reported that there are over 24,000 substations nationwide, connected by  over 430,000 miles of transmission lines.
Given the interdependency among infrastructure sectors, an EMP or  major GMD event that disrupts the electric grid could also result in  potential cascading impacts on fuel distribution, transportation systems,  food and water supplies, and communications and equipment for  emergency services, as well as other communication systems that utilize  the civilian electrical infrastructure. PPD-21 also recognizes that DHS has  numerous responsibilities to protect critical infrastructure, including such  things as analyzing threats to, vulnerabilities of, and potential  consequences from all hazards on critical infrastructure.
Within DHS, NPPD is responsible for working with public and industry  infrastructure partners, and leads the coordinated national effort to  mitigate risk to the nation’s infrastructure through the development and  implementation of the infrastructure protection program. NPPD has two  principal offices with responsibilities to facilitate protection of critical  infrastructure that could be at risk from EMP and GMD events—the Office  of Infrastructure Protection (IP) and the Office of Cybersecurity and  Communications (CS&C). In addition, FEMA and S&T have roles  related to addressing potential impacts to the electric grid, which could  include EMP and GMD threats. The offices of Cyber and Infrastructure  Analysis and I&A also help support related departmental activities.
DOE also has a significant role as the sector-specific agency for the  energy sector, which includes critical infrastructure and key resources  related to electricity. For example, DOE is responsible for developing an  Energy Sector-Specific Plan—in collaboration with other stakeholders,  including DHS and energy sector owners and operators—that applies the  NIPP risk management model to critical infrastructure and key resources  within the sector. Within DOE, the Office of Electricity Delivery and  Energy Reliability leads national efforts to increase the security and  reliability of the energy infrastructure and facilitate recovery from  disruptions to the energy supply. Legislation enacted in December 2015  further authorizes the Secretary of Energy, upon submission by the  president of a written directive or determination identifying an electrical  grid emergency, to issue orders for emergency measures necessary to  protect or restore the reliability of critical electric infrastructure or of  defense critical infrastructure during such an emergency and establishes  the Secretary of Energy as the lead sector-specific agency for  cybersecurity for the energy sector. DOE national laboratories also  provide research support and technical expertise to federal and industry  stakeholders regarding EMP and GMD impacts.
Other principal federal agencies working to address the threat of EMP  and GMD include DOD and FERC, as well as NOAA, the U.S. Geological  Survey (USGS), and the National Aeronautics and Space Administration  (NASA).
Electrical infrastructure is primarily operated by private industry, which  owns approximately 85 percent of the nation’s critical electrical  infrastructure. Industry entities are represented, in part, through  membership in industry associations such as the American Public Power  Association, Edison Electric Institute, and National Rural Electric  Cooperative Association. The North American Electric Reliability  Corporation (NERC) also has authority to develop reliability standards to  address the protection and improvement of the reliability and security of  the electrical infrastructure.
section_title: Key Federal Agencies Have Taken Various Actions to Address Electromagnetic Risks to the Grid; Some Actions Align with the 2008 EMP Commission Recommendations
subsections: section_title: Federal Agencies Have Taken Actions to Address Electromagnetic Risks to the Grid
paragraphs: DHS, DOE and FERC have taken various actions to address  electromagnetic risks to the electric grid, which generally fall under four  categories: (1) standards, guidelines, tools and demonstration projects;  (2) research reports; (3) strategy development and planning; and (4)  training and outreach.
Because federal agencies generally do not own electric grid  infrastructure, federal actions to address GMD risks are more indirect  through such things as developing standards and guidelines, and  conducting research that could benefit electric grid owners and operators.  Federal agencies have also been involved in strategy development and  planning, as well as training and outreach efforts, as a means of  preparing federal officials and others to respond to both EMP and GMD  events, and enhancing knowledge about electromagnetic risks. For  example, DHS S&T led the design and development of a prototype  transformer that can be more easily transported to another location to  help restore electric power in a timelier manner. DHS has also  participated in various training and outreach events to enhance  understanding of an EMP and GMD event. DOE’s primary efforts include  supporting research to enhance the understanding of the potential  impacts to the electric grid from electromagnetic events. Overall, DHS  and DOE have led most of the federal actions addressing protection and  mitigation efforts. They were also the key participants, with the White  House Office of Science and Technology Policy (OSTP) and NOAA, in  developing the National Space Weather Strategy and Action Plan issued  in October 2015 along with support from a variety of federal departments  and agencies. Table 2 below summarizes the key actions taken by  federal agencies—most of which were conducted since 2012—that help  to address electromagnetic risks. More detailed information on these  individual activities is also included in appendix II.
section_title: Some Actions Taken by DHS and DOE Align with EMP Commission Recommendations
paragraphs: The actions recommended by the EMP Commission generally align with  existing authorities and responsibilities of DHS and DOE relating to the  protection of critical infrastructure, such as identifying key assets and  analyzing risks, and as discussed above, DHS and DOE have taken  actions to address some risks to the electric grid from electromagnetic  events. Although DHS and DOE did not report that any of their actions  were taken in response to the commission report, actions taken by both  agencies have aligned with some of the recommendations. Specifically,  the EMP Commission made seven recommendations related to the  electric grid, most of which were directed to DHS and DOE. Of these  seven recommendations, some of the actions that DHS and DOE took  aligned with four of them. The seven EMP Commission recommendations  related to the electric grid include the following:  1.  conducting research to better understand infrastructure systems and  2.  expanding activities to address the vulnerability of control systems,  3.  identifying clear authority and responsibility to respond to an EMP  4.  engaging federal and industry entities to determine liabilities and  5.  establishing monitoring efforts and defining testing standards and  6.  providing capabilities to help protect the electric grid from an EMP  attack and recover as rapidly and effectively as possible, and  7.  utilizing industry and governmental institutions to assure cost effective  outcomes.
DHS and DOE efforts to protect the electrical grid aligned with the first  three recommendations noted above: conducting research to better  understand the interdependencies of critical infrastructures, addressing  the vulnerability of control systems to an EMP attack; and identifying  responsibilities for responding to an EMP attack. They also aligned with  the seventh recommendation, which includes 15 subparts, on utilizing  industry and other governmental institutions to assure the most cost- effective outcomes. For example, with respect to the recommendation  on conducting research to better understand interdependencies of critical  infrastructures, DHS’s Sector Resilience Report: Electric Power Delivery  includes some assessment of how various critical infrastructures— including the energy, communications, and transportation sectors, among  others—are interdependent in maintaining operations.
With regard to the last multipart recommendation identified above, DHS  and DOE took some actions that aligned with 5 of the 15 subparts of this  recommendation. Some of the sub-parts include such efforts as  developing national and regional restoration plans and assuring the  availability of critical communication channels, among other efforts. For  example, DHS and DOE have actions underway to develop a Power  Outage Incident Annex plan, which, according to DHS officials, is  intended to provide incident-specific information regarding how the  federal government plans to respond to and recover from a loss of power  resulting from deliberate acts of terrorism or natural disasters, including  an EMP or GMD event. In addition, a DHS entity developed EMP  protection guidelines to help federal agencies and industry identify  options for safeguarding critical communication equipment and control  elements, such as Supervisory Control and Data Acquisition (SCADA)  systems, from an EMP attack. For more detailed information regarding  how identified federal actions align with these seven EMP Commission  recommendations, see appendix III.
section_title: Additional Opportunities Exist for Federal Agencies to Identify Responsibilities, Assess Risks, and Strengthen Collaboration with Partners to Address Electromagnetic Risks
subsections: section_title: DHS Has Not Identified Roles and Responsibilities for Addressing Electromagnetic Risks
paragraphs: DHS has not clearly identified internal roles and responsibilities for  addressing electromagnetic risks to the electric grid or communicated  these to external federal and industry partners. While multiple DHS  components and offices, including NPPD, FEMA, and S&T, have each  conducted independent activities addressing electromagnetic risks to the  electric grid, none have been tasked with lead responsibility for  coordinating related activities within the department or with federal and  industry stakeholders. As a result, we experienced ongoing challenges in  identifying applicable DHS personnel and related departmental actions.  For example, NPPD officials had difficulty identifying their specific roles  and activities addressing electromagnetic risks to the electric grid,  including efforts to collect or synthesize available risk information to  provide input into department-wide risk assessments, such as the  Homeland Security National Risk Characterization (HSNRC). An official  within NPPD/CS&C subsequently provided information to us regarding  applicable activities conducted as part of his role leading efforts to help  safeguard communications and information/control system capabilities in  the event of EMP-related attacks or disasters. However, this official was  initially identified to us by a non-DHS stakeholder and several other DHS  entities that we interviewed regarding related efforts to address  electromagnetic events lacked awareness of these activities. Further,  DHS officials did not identify any DHS representatives or offices as  having broader designated responsibility for performing key oversight or  coordination roles regarding electromagnetic risks within DHS’s overall  infrastructure protection efforts, including activities intended to help  address risks to the electrical grid.
Furthermore, industry representatives and other federal officials told us it  is not clear who within DHS is responsible for addressing electromagnetic  risks. One major industry association reported that although senior DHS  officials participated in some collaborative bodies, such as the Electricity  Subsector Coordinating Council, association representatives were unable  to identify applicable DHS representatives at a working level because  there was generally limited engagement with industry on these issues. In  contrast, industry representatives stated that other key agencies,  including DOE and FERC, have recognized offices and points of contact  that were knowledgeable about electromagnetic issues of concern to the  industry. Some industry officials also commented that having clarity about  the DHS contacts was critical because DHS may be best positioned to  serve as a liaison between them and DOD, which generally does not  interact directly with industry on these issues. DOE officials also indicated  that they did not know whom at DHS they should contact with regard to  requesting related information, such as specific DHS research reports  related to electromagnetic risks.
The Energy Sector-Specific Plan, which is guided by the NIPP, highlights  the importance of identifying clear roles and responsibilities in achieving  goals and objectives in security programs and emergency response  planning. According to the Energy Sector-Specific Plan, stakeholders  should clearly understand their respective roles and responsibilities, and  plan to integrate their independently executed roles to achieve a common  set of infrastructure protection outcomes. The 2008 EMP Commission  report also recommended that DHS make clear its authority and  responsibilities, as well as delineate the functioning interfaces with other  governmental institutions, regarding EMP response efforts. Standards for  Internal Control in the Federal Government also cite this principle, stating  the importance of ensuring that authority and responsibility are clearly  assigned throughout the organization.
According to officials within the DHS Office of Policy, addressing EMP  risks has generally been a lower priority compared to other risks due to a  combination of differing opinions on the likelihood of these events and  their expectation that other federal agencies will be involved in  responding to an electromagnetic event. For example, DHS officials noted  that the nature of an EMP attack would constitute an “act of war” that  would generally be included within DOD’s mission. According to a senior  DHS official, in the case of an EMP attack, it is likely that DOD would  serve in the principal role of identifying our adversaries and taking  applicable defensive or retaliatory actions; however, DHS and DOE are  designated in the NIPP as the key federal entities responsible for efforts  to protect the electric grid and recover from such an attack. DHS  acknowledged this responsibility through its inclusion of EMP as a risk  event in the 2015 update of the Strategic National Risk Assessment  (SNRA), noting that damage from a deliberate attack on the grid could  cause cascading impacts through other infrastructure systems, leading to  economic disruption and the potential loss of life.
The growing recognition of GMD as a significant risk event requiring the  collaborative efforts of multiple federal agencies and industry  stakeholders, to both prepare for and respond to, underscores the  concerns that industry and other officials have raised about DHS’s roles  and responsibilities being clearly designated. In recent years, there has  been a growing consensus among federal agencies, industry  representatives, and independent researchers that a major GMD event  could have significant impacts on the nation’s electric grid and is probable  enough to warrant federal action. For example, the recent National Space  Weather Strategy and Action Plan, issued by the White House in October  2015, and ongoing development of the FERC GMD reliability standard  further exemplify the growing recognition of GMD as a significant risk  event that requires the collective expertise of multiple federal agencies,  as well as applicable industry partners. Designating internal roles and  responsibilities within DHS regarding electromagnetic risks and  communicating these to federal and industry partners could provide  additional awareness of related activities and help ensure more effective  and coordinated engagement with other federal agencies and industry  stakeholders. The lack of clarity regarding DHS activities to address  electromagnetic risks also increases the risk of potential duplication,  overlap, or fragmentation within the department or across federal  agencies. Officials from the DHS Office of Policy agreed that enhanced  internal coordination among DHS entities could be beneficial and noted  that there are actions currently underway to establish a Cyber,  Infrastructure, and Resiliency group within the Office of Policy that could  potentially facilitate further coordination efforts.
section_title: DHS and DOE Have Not Fully Addressed NIPP Requirement to Identify Key Electrical Infrastructure Assets
paragraphs: DHS and DOE have not taken actions to identify key electrical  infrastructure assets as required given their respective critical  infrastructure responsibilities under the NIPP. Specifically, as the two  primary federal entities responsible for addressing key risk management  objectives outlined in the NIPP related to the energy sector, DHS and  DOE have important roles in determining the extent to which critical  infrastructure assets are adequately identified and all applicable  information is included in related analyses. For example, the NIPP  explicitly states that to manage critical infrastructure risk effectively,  partners must identify the assets, systems, and networks that are  essential to their continued operation, considering associated  dependencies and interdependencies of other infrastructure sectors.  Further underscoring the importance of identifying critical electrical  infrastructure assets, a DOE-sponsored November 2015 report  developed by the Idaho National Laboratory also emphasizes the need to  identify the grid facilities most critical to restoration and recovery to  prioritize those assets which should be protected from EMP effects, citing  that it is not feasible or cost-effective to protect all infrastructure assets  across the electricity sector. The 2008 EMP Commission report also  specifically recommended that DHS and DOE prioritize nodes that are  critical for the rapid recovery of other key sectors that rely upon electricity  to function, including those assets that must remain in service or be  restored within hours of an EMP attack.
Notwithstanding these responsibilities, DHS and DOE did not report any  actions taken to identify critical electrical infrastructure as part of risk  management efforts for the energy sector. In response to our July 2015  testimony citing limited DHS activities to identify applicable electrical  infrastructure assets, DHS stated that it was aware of a study that FERC  had conducted that identified critical electrical substations and cited  potential duplication as the reason for why DHS did not conduct any  additional related efforts. The study, which FERC staff conducted in 2013,  utilized network modeling to identify critical substations that FERC  deemed significant enough to produce wide area outages across the U.S.  power grid. According to FERC, the analysis was conducted, in part, to  engage with owners and operators of those facilities to encourage the use  of cyber and physical security best practices. While the FERC study  provided data that could help inform further analysis of critical electrical  infrastructure assets, FERC officials did not indicate their analysis was  intended to address specific critical infrastructure responsibilities laid out  in the NIPP.
Moreover, while FERC’s study remains a positive step toward identifying  select critical electrical infrastructure assets and addressing the EMP  Commission’s recommendations, it did not solicit participation from other  federal agencies, including DHS and DOE. Given the significant critical  infrastructure responsibilities and expertise of these agencies, this lack of  participation may have diminished the potential robustness of the study.  For example, DOE officials stated that the FERC study did not include an  analysis of “blackstart” capability, which DOE officials believe may be  another important element that should be considered when analyzing the  criticality of electrical generation facilities. Blackstart capability indicates  that a facility can resume operations without reliance on external power  sources—a capability that is important in the aftermath of an electrical  grid shutdown. As the designated sector-specific agency, DOE has  valuable expertise that could be useful based on their broad  understanding of the bulk-power system, load factors, and specific asset  characteristics that may be important to consider when determining the  key elements of criticality that should be evaluated. In addition, DHS has  specific expertise related to infrastructure dependencies that may be  helpful to identify potential cascading impacts to other assets or systems  resulting from electrical power outages that should be considered. Both  DHS and DOE acknowledged that further collaborative efforts to assess  critical electrical infrastructure could be beneficial; however, as of  November 2015, neither DHS nor DOE have reported on any efforts to  review the 2013 FERC study or collaborate further to jointly determine the  key elements of criticality that they believe should be considered when  evaluating the vast array of infrastructure assets constituting the U.S  electric grid.
The extensive size and scope of the electric power system necessitates  collaboration among partners to ensure all individual expertise is  effectively leveraged. For example, a senior FERC official testified in July  2015 that determining which of the substations nationwide are the most  critical depends on the outcome one is pursuing. The official noted that  if grid stability and continuity is the desired outcome, then a relatively  small set of substations (in the hundreds) could be considered critical;  however, if preserving power supply to specific DOD or nuclear power  station is the desired outcome, then an additional collection of substations  would need to be included. The NIPP also notes that critical infrastructure  partners may view criticality differently, based on their unique situations,  operating models, and associated risks. Leveraging additional DHS and  DOE expertise could help to ensure that all key elements of criticality are  reflected in the results of FERC’s study. Our work on federal agency  collaboration supports this approach as well, noting that it is important to  ensure that all of the relevant participants have been included in the  collaborative effort. Reviewing FERC’s analysis and collaboratively  determining the extent to which further assessment of critical electrical  infrastructure may be needed would provide DHS and DOE an  opportunity to contribute their unique knowledge and expertise, as well as  better ensure that NIPP responsibilities are adequately addressed and all  applicable elements of criticality are being considered.
section_title: DHS Has Not Fully Leveraged Existing Opportunities to Collect and Analyze Information on Electromagnetic Risks
paragraphs: Although DHS components have independently conducted some efforts  to assess electromagnetic risks as identified above, the department has  not fully leveraged available risk information or conducted a  comprehensive analysis of these risks. Within the DHS Office of Policy,  there is recognition that “space weather” and “power grid failure” are  significant risk events, which DHS officials have determined pose great  risk to the security of the nation. However, these officials were unable to  provide detailed information about the specific risk inputs—namely threat,  vulnerability, and consequence information—that were used to assess  how electromagnetic events compared to other risk events, or how they  were used to inform DHS’s applicable risk-management priorities.  Further, officials within NPPD were unable to identify any specific actions  taken or plans to systematically collect or analyze risk information  regarding electromagnetic impacts to the electric grid as part of  department-wide risk assessment efforts.
subsections: section_title: Threat
paragraphs: According to experts, with respect to threat, there is a distinction between  GMD and EMP regarding the ability to assess the probability of  occurrence. In the case of GMD, space weather researchers currently  estimate a 6 to 12 percent chance that a Carrington class storm—a solar  storm comparable in size to the largest on record—is likely to hit the earth  in the next 10 years. The potential threat was recently illustrated in July  2012, when a Carrington class solar storm missed the earth by  approximately 1 week, as the storm occurred on the far side of the sun  facing away from the earth. In contrast, assessing the threat of an EMP  attack remains more difficult given that analysts have to also account for  human factors that can increase the level of uncertainty. Specifically,  within the 2011 SNRA, DHS notes that incomplete knowledge of  adversary capabilities and intent are sources of uncertainty regarding the  frequency of some risks.
Although DHS components identified multiple efforts to support the  collection of information regarding the threat of GMD, DHS identified a  more limited range of efforts to collect threat information regarding  potential EMP attacks. I&A officials indicated that while there is no  dedicated Center of Excellence within the Intelligence Community on  EMP, there is subject-matter expertise available from analysts in related  mission areas, such as chemical, biological, radiological, and nuclear  issues. CS&C representatives further noted that a group of analysts in  that office routinely monitor classified intelligence sources for EMP- related threat information, such as those available through the Joint  Worldwide Intelligence Communications System. However, some  additional opportunities may exist to leverage EMP threat information  through I&A or direct collaboration with DOD, DOE, or other intelligence  sources. For example, classified analytical products are available that  address specific components of threat, such as assessment of EMP- related missile technologies, which could serve as an important input  regarding adversary capabilities as part of DHS’s overall assessment of  electromagnetic threats. Although I&A officials have direct access to  these materials, neither I&A nor NPPD officials identified efforts to  specifically leverage this information as part of any department-wide risk- assessment efforts. However, I&A officials noted that they remain well- positioned to pursue additional collection and analysis of EMP-related  information through the Intelligence Community, if tasked to do so by  NPPD. Acquiring more comprehensive information on potential EMP  threats may be helpful because, as one EMP expert stated in recent  testimony, there are misconceptions regarding the nature and impact of  potential EMP attacks, which may have a negative effect on the ability of  stakeholders to determine reasonable steps needed to protect critical  infrastructure and mitigate potential impacts. One industry association  further noted that the lack of threat information regarding EMP attacks  makes it more difficult for their members to justify to their management,  shareholders, or regulators the need for investments in EMP protective  measures.
section_title: Vulnerability and Consequence
paragraphs: DHS components have also conducted some research efforts to better  understand the impacts to electrical infrastructure from EMP or GMD  events; however, opportunities exist to leverage additional information  through existing DHS programs and enhanced collaboration with federal  partners. While the NPPD Office of Infrastructure Protection (IP) conducts  various assessments to identify vulnerabilities, interdependencies, and  potential cascading impacts across different sectors of the nation’s critical  infrastructure, these have generally not been utilized to obtain specific  information about vulnerabilities or consequences related to EMP or GMD  events. Examples include the following:  Infrastructure Survey Tool (IST). Through this program, IP  administers survey questions to asset owners across all critical  infrastructure sectors about key dependencies on utilities, including  the supply of electric power. However, DHS officials did not identify  any efforts to utilize this information to develop any specific  consequence assessments associated with potential cascading  impacts of a widespread power grid failure, which could be caused by  an electromagnetic event. According to DHS, over 300 IST’s have  been conducted at electrical substations since 2009 but, as of  November 2015, the survey does not include any questions to capture  the extent to which any specific protective equipment or mitigation  measures may have been employed to address electromagnetic  vulnerabilities.
Regional Resiliency Assessment Program (RRAP). DHS  identified three RRAP projects—of the 56 conducted since 2009—in  which an EMP or GMD risk was considered, among other risk events.  DHS used summary information it obtained from these assessments  (and other IP site visits) to inform products such as the June 2014  Sector Resiliency Report: Electric Power Delivery. However, NPPD  did not identify any efforts to utilize RRAP findings to develop more  rigorous vulnerability or consequence analyses. For example, RRAP  findings could help inform more detailed modeling of sector  interdependencies, as called for by the EMP Commission, or serve as  input to the identification of critical electrical infrastructure assets that  could be impacted by electromagnetic events. Further, our review of a  resiliency assessment from one of the three applicable RRAP projects  indicated that although an EMP or solar storm was used as one of  several threat scenarios that could disrupt the infrastructure assets of  focus, there was limited discussion about specific asset vulnerabilities  to such an event or identification of any additional information needed  to inform future analysis.
Defense Critical Infrastructure Program. This DOD program is  conducted to assess infrastructure and other key military assets in the  United States using a range of threat scenarios including EMP events.  Among other functions, these assessments identify critical assets and  identify vulnerabilities, including dependence on the commercial  electric grid. Such information could assist DHS in efforts to identify  critical substations supporting DOD facilities and further inform risk- assessment activities. Although DOD officials indicated some  collaboration with DHS Protective Security Advisors when RRAP  projects are conducted in areas with applicable defense assets or  installations, they reported that DHS and DOD had not coordinated to  review the results of DOD’s assessments under the Defense Critical  Infrastructure Program.
Collecting and utilizing risk information obtained through the above  programs could help DHS to better understand the specific consequences  across different sectors that may result from long-term electrical power  outages, and may contribute to efforts to identify critical electrical  infrastructure and asset protection priorities. For example, further  collection of information on sector interdependencies could help DHS to  assess the potential economic consequences associated with long-term  power outages. Assessment of direct and indirect economic  consequences is currently limited but could be useful to help determine  relative risk rankings and provide information to help assess the cost- effectiveness of various mitigation strategies.
Further, a more comprehensive assessment of vulnerability and  consequences may help inform broader DHS risk assessment efforts,  including the HSNRC. These vulnerability and consequence inputs are  key components to help ensure that the HSNRC can be effectively  utilized to identify the relative rankings of various risk events, including  other threats to the electrical grid, such as physical or cyberattack.  According to officials within the DHS Office of Policy, the original HSNRC  process conducted in 2012-2013 included estimates of broad  consequences for 40 individual risk events. However, officials noted that  certain categories, such as loss of life, were primary factors in designating  selected risk events as priorities for further analysis. These officials also  reported that given limited information about the specific consequences  likely to result from an EMP event, DHS instead utilized proxy  consequence information from an analytical study of a major regional  earthquake that would be expected to cause damage to a wide range of  critical infrastructure including electrical power operations. However, this  postulated event—which included an estimate of approximately 86,000  injuries and fatalities across the 8-state study region—is unlikely to be on  par with an EMP attack that, according to experts, could include the  extended disruption of electric power and cascading impacts to other  critical infrastructure across much of the United States.
According to the NIPP, to assess risk effectively, critical infrastructure  partners—including owners and operators, sector councils, and  government agencies—need timely, reliable, and actionable information  regarding threats, vulnerabilities, and consequences. Under the NIPP,  DHS’s responsibilities include establishing and maintaining a  comprehensive, multitiered, and dynamic information-sharing network  designed to provide timely and actionable threat information,  assessments, and warnings to public- and private-sector partners. In  addition, the Quadrennial Energy Review specifically notes the  importance of applicable threat information, stating that incomplete or  ambiguous threat information may lead to inconsistency in physical  security among grid owners, inefficient spending of limited resources at  facilities, or deployment of security measures against the wrong threat.  The Quadrennial Energy Review also states that, in regard to critical high- voltage transformers, current programs to address vulnerability may not  be adequate to address the security and reliability concerns associated  with simultaneous failures of multiple high-voltage transformers.
Moreover, according to subject-matter experts, the impact to the electric  grid from electromagnetic threats may vary substantially by location,  network and operating characteristics, and other factors. For example,  key reports on GMD indicate that high-voltage transformers located at  higher latitudes in the United States are likely subject to increased  potential for adverse impacts from GMD events than those at lower  latitudes. However, this is not the case with EMP, which may have  impacts equal to or greater than GMD in any latitude of the United States.  Additionally, an EMP would subject infrastructure assets to a combination  of E1, E2, and E3 effects compared to GMD which only produces impacts  similar to the E3 effect. Federal and industry researchers have also noted  that given these distinct effects and the different types of mitigation efforts  necessary to protect against them, more comprehensive risk information  may be necessary to evaluate their unique impacts to the electric grid.  The electric grid remains vulnerable to other potential threats, such as  physical and cyberattacks, which each present unique vulnerabilities to  assess. Better collection of threat, vulnerability, and consequence  information through existing DHS programs and strengthened  collaboration with federal partners could help DHS better assess the  relative risk ranking of electromagnetic events versus other risks and help  determine potential protection priorities to address identified  vulnerabilities.
section_title: Federal Agencies Have Not Fully Coordinated Efforts to Implement Key EMP Risk Management Activities
paragraphs: Key federal agencies, including DHS and DOE, as well as industry  partners have not established a fully coordinated approach to identifying  and implementing risk management activities to address EMP risks.  According to the NIPP Risk Management Framework, such activities  include identifying and prioritizing research and development efforts, and  evaluating potential mitigation options, including the cost-effectiveness of  specific protective equipment. The publication of the National Space  Weather Action Plan in October 2015 identified many key federal  activities in these areas regarding the GMD risk; however, no similar  efforts have been proposed regarding EMP risks to the electric grid.
subsections: section_title: EMP Research and Development
paragraphs: There are several areas of EMP research highlighted in previous studies  where coordinated federal involvement could help address identified gaps  and further inform risk assessment efforts. For example, a recent effort  funded by DOE—and conducted by Idaho National Laboratory (INL)— identified the need for updated research and analysis regarding the likely  impacts of the E1, or early time pulse, of an EMP event. According to the  report, most information sources on the impact of EMP E1 to electric  power grids are decades old, include only observational information, and  do not account for modern grid technologies and electronic control  systems. For example, the report states that assessing the effectiveness  of routinely recognized protective actions such as shielding equipment in  faraday cages remains difficult given the limited experimentation data  available, outside of DOD. As a result, the report notes that the electric  power industry may not have sufficient information regarding EMP effects  to design adequate protections. Overall, the report concludes that there  are more unknowns than knowns regarding EMP effects and mitigation,  and recommends that the government collect additional data on E1  threats, their impact to the electric grid, and potential mitigation  measures.
A 2013 white paper developed by a leading research organization for the  electric industry also reported a lack of widespread and coordinated  research and development efforts to protect and mitigate effects of EMP  attacks against the commercial electric grid. Among the specific actions  identified is a recommendation for stakeholders to define key  characteristics of an EMP event—such as potential altitudes of  detonation—for further study of corresponding impacts. According to this  paper, and representatives from an individual utility we interviewed, the  lack of more specific parameters for determining potential EMP effects  makes it difficult to develop applicable protective guidelines and  equipment design specifications. However, FERC officials noted that  additional work is being done outside of the United States to further  develop applicable standards and implement equipment designed to  mitigate the effects of or protect against EMP risks.
Further research and development efforts on EMP effects could also  include evaluation of the impacts of additional devices intended to disrupt  or destroy electrical infrastructure or control systems, such as intentional  electromagnetic interference. Updated information on the specific  electromagnetic effects of EMP events or intentional electromagnetic  interference weapons could help ensure that protective and mitigation  efforts are designed to be effective for multiple threat scenarios.
Similarly, any proposed mitigation strategies resulting from efforts to  address GMD, including the National Space Weather Action Plan, could  also consider how effective these strategies might be against a potential  EMP attack so that fully informed investment decisions can be made. For  example, as one EMP expert noted in recent congressional testimony, if  designing protective equipment to withstand specified levels of E3 effects  from an EMP attack, there may be collateral benefits for providing  protection against GMD effects; however, the reverse may not be true.  That is, protecting against identified benchmark levels of GMD may not  prove sufficient to protect against EMP E3 impacts.
section_title: Evaluation of Protective Equipment
paragraphs: Another potential area for additional federal collaboration involves further  research and evaluation of protective equipment intended to help mitigate  the impacts of an EMP event. Such research, also identified in the 2008  EMP Commission report, may include further evaluation of EMP  hardening or shielding strategies, as well as specific testing of  commercial products intended to protect or mitigate the effects of EMP  attacks on key infrastructure assets, such as transformers. Government  and industry stakeholders cite potential adverse operational impacts that  may result from the use of such devices as a reason for not retrofitting  existing assets. According to one major electrical industry association,  EMP impacts on the electric grid are not fully understood and many EMP  mitigation techniques involve significant investment and remain unproven.  Further evaluation of the effectiveness of these types of products may  help to inform government and industry cost-benefit analyses and provide  more sound estimates on the potential costs associated with  implementation of various protective measures across the electric grid.  A lead researcher within DOE stressed that sound science is required to  help inform any federal efforts to establish standards and protective  guidelines intended to address the potential impacts of EMP. DOE  officials further stated that assessing the cost-effectiveness of select EMP  or GMD protective measures could also help state public utility  commissions determine whether the cost of such measures can be  included in base utility rates.
In addition to bringing additional information and expertise to the table,  enhanced engagement by key federal agencies could present  opportunities for stakeholders to jointly fund and develop collaborative  research projects. Among a few potential examples identified by  government and industry stakeholders would be additional research and  testing conducted at DOE National Laboratories or even possible pilot  projects performed at government-operated utilities.
The NIPP calls for the implementation of risk-management activities,  which includes research and development to reduce vulnerabilities that  have proven difficult or expensive to address. Additionally, the Energy  Sector-Specific Plan states that energy-sector partners such as DHS and  DOE are to pursue a focused, coordinated management approach that  aligns current activities to research and development goals and  milestones, initiates specific projects to address critical gaps, and  provides a mechanism for collaboration, project management, and  oversight. This approach aims to develop clearly defined activities,  projects, and initiatives with time-based deliverables that are tied to  priority research and development requirements. Given the limited  experimental data regarding EMP effects on the electric grid, additional  collaboration among government agencies and industry regarding EMP- related research and development could help fill existing information gaps  and help better understand EMP effects on the electrical grid.
DHS officials and industry representatives noted that some discussion of  EMP, including areas for additional research, has been conducted within  forums such as the Electricity Subsector Coordinating Council, but that it  has not surfaced as a key priority. In addition, DHS officials stated that  an EMP attack generally remains a lower risk priority compared to other  risk events with higher probability such as natural disasters or  cyberattacks. However, as discussed previously, it is not clear that DHS  has assessed all available risk inputs regarding EMP events to develop  fully informed relative risk rankings. Officials also noted that efforts to  comply with Office of Management and Budget Circular A-11—which calls  for executive-branch departments to adopt an enterprise risk- management approach—contributes to decisions regarding which  operational risks to address given limited resources. Officials stated that,  as a result, operational risks, such as counterterrorism and counterdrug  efforts, remain higher priorities for the department than EMP and solar  weather events, because these events represent a better opportunity for  DHS to maximize its return on investment. DOE officials also noted  resource limitations and competing priorities as the key driver for not  pursuing additional risk management activities specifically related to EMP  events. However, DOE officials concurred that there is potential for  enhanced collaboration with other federal agencies and industry  stakeholders regarding identification of future research needs and  priorities related to EMP.
Even if an EMP attack is not determined to be among the highest  resource priorities for DHS and DOE relative to other risk events, there  are opportunities for enhanced collaboration among federal agencies and  industry stakeholders to address identified gaps and help ensure that  limited resources are more effectively coordinated and prioritized. Better  identification and implementation of key risk-management activities,  including collaborative identification and support of research and  development priorities, may help close some of the gaps identified  regarding EMP events and provide the groundwork necessary for a more  robust research-based evaluation of additional protection and mitigation  options.
section_title: Conclusions
paragraphs: Given the foundational importance of electrical power to support other  critical infrastructure sectors such as communications and transportation,  not securing the electric grid from electromagnetic events could result in  the loss of electrical services essential to maintaining our national  economy and security. Recognizing this possibility, federal agencies have  taken a range of actions since 2008—when the EMP Commission report  was issued—to provide guidance, conduct research, develop strategies  and plans, and participate in training, among other things, to address  electromagnetic risks to the electric grid. Although DHS’s and DOE’s  actions were not taken directly in response to the EMP Commission’s  recommendations, they do align with their respective critical infrastructure  protection responsibilities in law and policy, including under the NIPP.  However, DHS could take additional actions to help address risks to the  electric grid. Designating roles and responsibilities within DHS regarding  electromagnetic risks could help ensure enhanced awareness of related  activities within the department and improve coordination with other  federal agencies and industry stakeholders. Once clear roles and  responsibilities are established and communicated, DHS and other  federal agencies will be better positioned to leverage their respective  expertise to inform future actions.
One area in particular, where this collective expertise could be more fully  leveraged is in determining the nation’s critical electric infrastructure  assets. Although FERC conducted a related analysis, it was completed  without collaboration and input from DHS and DOE entities, and as a  result opportunities may have been missed to leverage their unique  knowledge and expertise. Additional collaboration to review FERC’s  analysis and determine whether further assessment is needed could help  ensure that all applicable elements of criticality are being considered.  While DHS recognizes that both space weather and power grid failure are  risk events that can affect the nation’s security, there are additional  opportunities for DHS to collect key risk inputs, such as further  collaboration with DOD to obtain applicable EMP threat, vulnerability, and  consequence information. Additional data collection could also inform  DHS’s broader risk-assessment efforts to better determine the relative  risk ranking of electromagnetic threats compared to other potential risks— a key factor in ensuring that protection and resource allocation priorities  are appropriately considered and resourced.
Lastly, given the potentially significant impacts that an EMP attack would  have on the electric grid and the potential cost of additional protective  measures to mitigate against electromagnetic impacts, federal entities  could better coordinate to identify and implement key EMP risk  management activities. Such activities, including collaborative  identification and support of research and development priorities, may  help close some of the gaps identified regarding EMP events and provide  the groundwork necessary for a more robust research-based evaluation  of additional protective efforts.
section_title: Recommendations for Executive Action
paragraphs: To enhance accountability for key risk-management activities and  facilitate coordination with federal and industry stakeholders regarding  electromagnetic risks, we recommend that the Secretary of Homeland  Security designate roles and responsibilities within the department for  addressing electromagnetic risks and communicate these to federal and  industry partners.
To more fully leverage critical infrastructure expertise and address  responsibilities to identify critical electrical infrastructure assets as called  for in the NIPP, we recommend that the Secretary of Homeland Security  and the Secretary of Energy direct responsible officials to review FERC’s  electrical infrastructure analysis and collaborate to determine whether  further assessment is needed to adequately identify critical electric  infrastructure assets, potentially to include additional elements of  criticality that might be considered.
To enhance federal efforts to assess electromagnetic risks and help  determine protection priorities, we also recommend that the Secretary of  Homeland Security direct the Under Secretary for NPPD and the  Assistant Secretary for the IP to work with other federal and industry  partners to collect and analyze key inputs on threat, vulnerability, and  consequence related to electromagnetic risks—potentially to include  collecting additional information from DOD sources and leveraging  existing assessment programs such as the IST, RRAP, and DCIP.
To facilitate federal and industry efforts to coordinate risk-management  activities to address an EMP attack, we recommend that the Secretary of  Homeland Security and the Secretary of Energy direct responsible  officials to engage with federal partners and industry stakeholders to  identify and implement key EMP research and development priorities,  including opportunities for further testing and evaluation of potential EMP  protection and mitigation options.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS, DOE, DOD, NOAA, and FERC  for their review and comment. DHS and DOE provided written comments,  which are reproduced in appendices IV and V. In their comments, DHS  and DOE concurred with each of the recommendations made to their  respective departments and described actions underway or planned to  address them, including applicable timeframes for completion. If fully  implemented, these actions should address the intent of the  recommendations and better position DHS and DOE to further support  federal and industry efforts to help protect the U.S. electric grid from  electromagnetic events.
For example, in regards to designating applicable roles and  responsibilities within the department, DHS noted that the Cyber,  Infrastructure, and Resilience Policy Office within the DHS Office of Policy  is currently developing its portfolio to further support electromagnetic  risks. Specific actions identified to be completed by December 2016  include coordination across the department to identify and document  applicable roles and responsibilities regarding electromagnetic issues to  ensure full mission coverage while minimizing potential overlap or  redundancy. In regards to engagement with industry stakeholders to  identify and implement key research and development priorities, DHS and  DOE each identified actions to convene applicable stakeholders to jointly  determine mitigation options and conduct further testing and evaluation.  DOE also identified that the department is working with EPRI to develop  an EMP Strategy that lays out applicable goals and objectives. According  to DOE, the EMP Strategy is scheduled for completion by August 31,  2016, and is to be followed by a more detailed action plan identifying R&D  priorities and specific opportunities to test and evaluate EMP mitigation  and protection measures.
DHS, DOE, NOAA, and FERC also provided technical comments, which  we incorporated as appropriate. DOD did not provide comments on this  report.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretaries of  Commerce, Defense, Energy, and Homeland Security, and the Chairman  of the Federal Energy Regulatory Commission. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Overview of Geomagnetic Disturbance and Historical Events
paragraphs: According to research reports developed by subject-matter experts that  we reviewed, geomagnetic disturbances (GMD) occur when the sun  ejects charged particles that interact with and cause changes in the  earth’s magnetic fields. These charged particles typically reach the earth  within 18 to 96 hours and can cause currents to enter the power system  through long conductors, such as transmission lines. These currents can  disrupt the normal operation of the power system and, in some cases,  damage equipment such as transformers. Specific characteristics of the  U.S. electric grid also make it potentially more vulnerable to GMD  impacts. For example, the grid is located in northern latitudes, which is  closer to the aurora of a geomagnetic storm, and near oceans which are  filled with conductive salt water.
The Space Weather Prediction Center operated by the National Oceanic  and Atmospheric Administration (NOAA) conducts continuous monitoring  of solar activity and provides applicable watches, warnings, and alerts to  stakeholders, including the electric power industry. If staff forecast that a  coronal mass ejection is earth-bound, NOAA issues a watch that provides  a 1 to 4 day notice that a geomagnetic storm is expected. Once the Deep  Space Climate Observatory (DSCOVR) satellite—located 1 million miles  from the earth—measures and provides data about the characteristics of  the storm, forecasters can provide alerts between 15 to 60 minutes in  advance of the storm hitting the Earth. These alerts may also include an  index figure that describes the strength of the impending storm according  to specific thresholds. Since 1859, scientists have observed GMD  impacts on the earth. The following table describes notable GMD events  and their respective impacts on electrical grid assets.
section_title: Appendix II: Summary of Key Federal Agency Actions Addressing Electromagnetic Risks to the Electric Grid
subsections: section_title: Standards, Guidelines, Tools, and Demonstration Projects
paragraphs: Since 2008, the Department of Homeland Security (DHS), the  Department of Energy (DOE), and the Federal Energy Regulatory  Commission (FERC) have taken an array of actions aimed at addressing  electromagnetic risks to the electric grid. Because federal agencies do not  own electrical grid infrastructure, their actions to address geomagnetic  disturbance (GMD) threats are more indirect through such things as  developing standards and guidelines and utilizing tools and  demonstration projects. Specifically, federal agencies have taken steps to  develop standards and guidelines. For example, the North American  Electric Reliability Corporation (NERC) has begun the process of  developing GMD reliability standards for FERC to review, and DHS has  developed electromagnetic pulse (EMP) protection guidelines to  safeguard critical assets and facilities. Below is a summary of these  efforts and other actions taken by DHS, DOE, and FERC since 2013.  Collectively, these actions are intended to protect critical infrastructure  from both EMP and GMD events.
GMD Reliability Standards Rulemaking Process. In May 2013,  FERC directed a two-phase approach for NERC to develop reliability  standards that address the impact of GMD on reliable operation of the  bulk-power system. For the first phase, NERC developed and FERC  approved a reliability standard that requires responsible entities to  develop and implement operational procedures to mitigate the effects  of GMD on the bulk-power system. The second phase, which is  ongoing, is intended to provide more comprehensive protections by  requiring responsible entities to protect their facilities against a  benchmark GMD event. On January 21, 2015, NERC submitted to  FERC a proposed second stage reliability standard that included a  definition of a benchmark GMD event against which industry would  have to assess and mitigate vulnerabilities. On May 14, 2015, FERC  issued a Notice of Proposed Rulemaking seeking comments on  NERC’s proposal to approve, as well as its proposed modifications to  the reliability standard, and other issues. Public comments on the  Notice were due near the end of July 2015, and FERC extended the  comment date two additional times in response to developments in  the record. As of January 2016, FERC had not issued a final rule.
EMP Protection Guidelines. In November 2014, DHS developed  guidelines to help federal agencies and industry identify options to  protect critical equipment, facilities, and communication and data  centers from various forms of EMP attacks, including High-Altitude  EMP (HEMP), ground burst Source Region EMP, solar geomagnetic  disturbances, and other Intentional Electromagnetic Interference, such  as from radio frequency weapons. These guidelines include four  levels of protection that are based on using specific devices, such as  EMP-capable surge arresters on power cords to mitigate EMP  vulnerabilities.
Solar Storm Mitigation. In 2014, DHS led an effort to develop a  forecasting tool that will enable more localized and precise  geomagnetic induced current (GIC) forecast levels. In coordination  with the National Aeronautics and Space Administration (NASA) and  National Oceanic and Atmospheric Administration (NOAA), among  others, DHS intends to provide utility owners and operators with timely  and accurate GIC forecast information, allowing them to make key  operational decisions, such as shutting down, reducing power, or  rerouting power to minimize the impact of a GIC event. DHS expects  to complete this joint effort in fiscal year 2016.
Installation of Magnetometers. In 2014, DOE funded an initiative to  gather additional data on GIC and magnetic fields to help scientists  validate models and develop more accurate estimations and  modeling. As of October 2015, DOE reported plans to add 12  magnetometers to supplement the existing 6 that United States  Geological Survey (USGS) has deployed nationwide. Two of those 12  will be fully funded by industry while 10 will be funded through a cost- share program between DOE and industry. These magnetometers are  intended to provide owners and operators with real-time data on the  expected currents that may impact their transformers. DOE officials  added that this is a less costly alternative to deploying more monitors  on transformers to measure actual currents during a GMD.
Recovery Transformer (RecX). In 2012, DHS Science & Technology  (S&T), with support from DOE and electricity sector representatives  as part of the sector specific plan, partnered with industry to develop  three prototype single-phase, extra-high-voltage transformers that  could significantly reduce the time to transport, install, and energize a  transformer to reduce recovery time from power outages associated  with transformer failures from several months to less than 1 week.  S&T, along with industry partners, piloted the RecX prototype for 2.5  years. DHS reported that RecX proved to be successful in an  operational environment and could potentially reduce the impact of  power outages.
Resilient Electric Grid (REG). In 2007, S&T partnered with industry  to develop a fault current limiting high temperature superconducting  cable that allows power substations to interconnect and share power  in an internet-like fashion enabling multiple paths for power to flow  while mitigating the risk of cascading fault currents. The cable system  enables re-architecting urban area distribution grids to allow power to  be rerouted in emergencies and will facilitate rapid and resilient  recovery for grid outages. A prototype cable will be deployed in the  grid in New York for a pilot demonstration. S&T is also evaluating a  commercial scale deployment of the technology in downtown  Chicago.
section_title: Research Reports
paragraphs: Key federal agencies, specifically DHS and DOE, have developed  research reports to better understand the potential impacts of  electromagnetic threats. Since 2007, DHS and DOE have developed or  commissioned 17 key research reports addressing both EMP and GMD  events. Some of the DHS-commissioned reports, authored by external  industry experts, focused primarily on analyzing the impacts of EMP  threats, including HEMP and Source Region EMP, while others assessed  the potential impact of GMD events, including solar superstorms.  Specifically, one DHS-commissioned report identified three main  approaches to lessen the impact of a severe geomagnetic storm. That  report concluded that thorough research, testing, and cost analysis will be  required to determine the best approach. Three of DHS’s additional  research reports are highlighted below.
Electromagnetic Pulse Impacts on Extra High Voltage Power  Transformers. This 2010 report analyzed the potential impact of an  EMP on extra high voltage transformers—focusing primarily on  transformer equipment designs and identifying specific mitigation  efforts such as blocking devices that minimize the impact of GIC on  the electric grid. The report concluded that the similarity of EMP  effects, regardless of source, indicates that solar weather provide a  useful basis for transformer impact analysis and that selective  installation of blocking devices would minimize the impacts of GIC on  transformers, among other findings.
Impacts of Severe Space Weather on the Electric Grid. This 2011  report assessed the impacts of space weather on the electric grid,  seeking to understand how previous solar storms have affected some  electric grids, and what cost-effective mitigation efforts are available to  protect the electric grid, among other topics. Some of the key findings  and recommendations include the need for a rigorous risk  assessment to determine how plausible a worst-case scenario may be  and additional research to better understand how transformers may  be impacted by electromagnetic risks. This report also recommended  the potential installation of blocking devices to minimize the impacts of  GIC.
Sector Resilience Report: Electric Power Delivery. This 2014  report summarizes an analysis of key electric power dependencies  and interdependencies, such as communications, transportation, and  other lifeline infrastructure systems. The report included an  assessment of, and best practices for, improving infrastructure  resilience such as: modeling to identify potential vulnerabilities,  conducting a cost-benefit analysis of alternative, technology-based  options, and installing protective measures and hardening at-risk  equipment, among others.
Federal agencies have also sponsored research studies and identified  risk information regarding electromagnetic risks. Below is a summary of  key studies identified that address possible EMP mitigation and protective  measures, the procurement and supply environment of large power  transformers, susceptibility of transformers to GMD events, and the  potential impact of a GMD event.
Six Technical Reports Addressing EMP Impacts on the U.S.
Power Grid. In January 2010, the Oak Ridge National Laboratory  (ORNL) developed six technical reports—authored by external  industry experts—for DOE, DHS, and FERC, that examined the EMP  threats and their potential impacts, and analyzed potential solutions  for preventing and mitigating their effects. Some of the reports key  findings and recommendations include efforts to develop, test, and  deploy mitigation technologies to automatically protect the power grid  from costly damage, and to improve reporting and monitoring of GMD  and power grid events.
Idaho National Laboratory Study on EMP. In November 2015,  DOE’s Idaho National Laboratory released a study to identify and  describe possible EMP mitigation and protection measures, to  examine the measures’ cost effectiveness, and to provide some  potential strategies and solutions to reduce the effects of EMP on the  commercial bulk electric grid. The report also discusses protection  strategies for the electric grid and identifies future actions to be taken  by both government and industry to enhance the security of the  energy infrastructure.
Large Power Transformer Study. In April 2014, DOE updated its  2012 report on Large Power Transformers and the U.S. Electric Grid  that assessed the procurement and supply environment of large  power transformers. In this research report, DOE examined the  characteristics and procurement of large power transformers, and the  availability of global and domestic suppliers, and assessed the  potential risks facing these transformers, among others. The DOE  report also updates the prior 2012 study and discusses new  government and industry efforts to augment risk management options  for critical infrastructure, including power transformers.
Oak Ridge National Laboratory Study on the Susceptibility of  Transformers to GMD. In November 2015, DOE officials reported  initiating a study by ORNL to quantify the risks associated with GMD  on electric power system reliability. The study plans to identify power  lines and their associated transformers within the eastern section of  the power grid and to determine those that are most susceptible to the  effects of GMD. DOE officials expect the study to be completed in July  2016.
Pacific Northwest National Laboratory Study on Geomagnetic  Storms and Long-Term Impact on Power Systems. In December  2011, DOE’s Pacific Northwest National Laboratory conducted a study  to determine the potential impact of a severe GIC event on the  western U.S.-Canada power grid, referred to as the Western  Interconnection. The study results indicated that the Western  Interconnection was not substantially at risk to GIC because of the  relatively small number of transmission lines that did not include  series capacitors. The report recommended that the electric power  industry consider the adoption of new protective relaying approaches  that will prevent GIC events from damaging transformers.
section_title: Strategy Development and Planning
paragraphs: Since 2008, key federal agencies have taken actions to develop strategic  plans to address the impact of GMD events to the electric grid.  Specifically, DHS and DOE have developed key planning efforts that  identify specific goals and outline key activities addressing  electromagnetic risks. Below is a summary of DHS’s efforts.
National Space Weather Strategy and Action Plan. In October  2015, the White House Office of Science and Technology Policy  (OSTP), DHS, and NOAA, in collaboration with DOE and other key  federal agencies, issued the National Space Weather Strategy and  Action Plan. As a co-chair of the Space Weather Operations,  Research and Mitigation Task Force, DHS was jointly responsible for  developing a strategy to achieve several goals, including efforts to  establish benchmarks for space weather events, enhance response  and recovery capabilities, improve protection and mitigation efforts,  and improve assessment, modeling, and prediction of impacts on  critical infrastructure, among other goals. The strategy identifies goals  and establishes the principles that will guide these efforts in both the  near and long term, while the Action Plan identifies specific activities,  outcomes, and timelines that the federal government will pursue  accordingly.
Power Outage Incident Annex. In 2014, FEMA, in coordination with  DOE, began developing a Power Outage Incident Annex to provide  incident-specific information in support of the National Response and  National Disaster Recovery Frameworks. Although not specific to  addressing electromagnetic events, such as EMP and solar weather,  according to FEMA officials, the incident annex will describe the  process and organizational constructs that the federal government will  utilize to respond to and recover from loss of power resulting from  deliberate acts of terrorism or natural disasters. Among other tasks,  the incident annex is designed to identify key federal government  capabilities and resources, prioritize core capabilities, and outline  response and recovery resource requirements. FEMA officials  reported that the incident annex is scheduled to be completed by mid- 2016.
Below is a summary of DOE’s strategy development and planning efforts.
National Transformer Strategy. In 2015, DOE developed a draft  national strategy to reduce the risk to grid reliability posed by the loss  of critical large power transformers. As drafted, the National Strategy  for Reducing Risk from the Loss of Large Power Transformer focuses  on protecting the bulk electric system—a system of 9,000 electric  generating units connected across over 200,000 miles of high-voltage  transmission lines—and ensuring the nation’s supply of electricity  remains resilient. To achieve these efforts, the draft national strategy  focuses on three areas: (1) understanding and mitigating current and  future risks to transformers, (2) enhancing protection of transformers,  and (3) ensuring transformer replacement equipment is available. The  draft national strategy also calls upon federal government entities, to  partner with electricity operators, equipment manufacturers, and state  and local authorities to develop risk assessments and modeling tools  to guide their efforts and prioritize activities. As of December 2015,  DOE officials reported that the strategy is undergoing ongoing review.
Quadrennial Energy Review. In April 2015, the White House   Quadrennial Energy Review Task Force, with support from DOE and  other federal agencies, issued its first installment of the Quadrennial  Energy Review, which addresses infrastructure for energy  transmission, storage, and distribution. A key chapter of this report  focuses on a broad range of challenges and how the electric grid is  vulnerable, specifically transformers, to a range of potential risks,  including solar storms and EMP events. The report acknowledges that  the federal government can fill gaps in creating data sets, tools, and  assessments that provide a more complete and robust analytical  approach towards measuring resilience needs and investments.  Furthermore, the report recommends that DOE, in collaboration with  DHS and others, develop common analytical frameworks, tools, and  data to assess the resilience of energy infrastructures and to mitigate  the risks associated with the loss of transformers.
section_title: Training and Outreach
paragraphs: Key federal agencies, such as DHS, DOE, and FERC, have also  developed training and outreach efforts that could help address the  potential impact of power outages caused by electromagnetic threats,  such as a GMD event. Specifically, since 2012, DHS has reported  participating in several briefings before conferences and training  workshops that addressed electromagnetic threats, including EMP and  solar weather events. Several of the briefings summarized the findings  identified by previously issued DHS-commissioned research reports. For  example, DHS gave presentations on multiple occasions about the  potential impacts of an EMP event, including likely impacts on regional  communication systems within major U.S. cities. DHS officials reported  that as a result of these briefings, DHS has subsequently developed EMP  protection guidelines to help federal agencies identify options for  safeguarding critical equipment, facilities, and communication centers.  These guidelines include four levels of protection that are based on using  specific devices, such as EMP-capable surge arresters on power cords to  mitigate EMP vulnerabilities. Below is a summary of DHS’s additional  training and outreach efforts.
GridEx II. In November 2013, DHS and DOE, along with the Federal  Bureau of Investigation, and other relevant government agencies,  participated in an industry-wide exercise assessing the readiness of  the electric industry to respond to a physical or cyberattack on the  bulk-power system. The key goals of GridEx II were to review existing  command, control, and communication plans and tools, incorporate  lessons learned from a previous exercise, and to identify potential  improvements in cyber and physical security plans and programs.  Upon completing the exercises, participants identified key lessons  learned, which included the need for enhanced information sharing,  and clarification of roles and responsibilities during a physical or  cyberattack.
Secure Grid. In October 2011, DHS, along with multiple federal  agencies and industry representatives, participated in a 2-day security  exercise to assess the federal government’s response to an extreme  solar weather event. The exercise entailed a crisis simulation with the  goal of exploring how private and government agencies would  respond to a solar storm causing widespread power outages and  damage to the electric grid, how they might cooperate during such a  crisis, and to explore what steps could be taken to mitigate such  severe events. Two of the key findings, among others, cite the need to  develop a national strategy to determine the costs of hardening the  electric grid against space weather events, and the need to conduct a  comprehensive study to assess the cascading effects of a widespread  and long-term shutdown of the electric grid caused by a space  weather event.
Below is a summary of DOE and FERC’s training and outreach efforts.
Space Weather Workshops. In 2015, DOE conducted multiple  training workshops addressing space weather issues and its potential  impact on the electric grid. For example, in February 2015, DOE  cosponsored a North Atlantic Space Weather workshop with the  White House and international representatives from the United  Kingdom, the Republic of Ireland, and Canada. DOE officials reported  that the primary focus on the workshop was discussing the potential  impact of space weather on power grids. In March 2015, DOE also  co-sponsored a workshop with its Canadian counterpart, Natural  Resources Canada. Similarly, in April and June 2015, DOE  participated in training workshops with the Idaho National Laboratory  and Electric Power Research Institute and discussed the potential  impact that space weather and EMP events may have on the electric  grid.
GMD Technical Conference. On April 30, 2012, FERC held a  technical conference to discuss issues related to the reliability of the  bulk-power system as affected by GMD events and to explore the  risks and impacts from GIC to transformers and other equipment on  the bulk-power system, as well as options for addressing or mitigating  the risks and impacts. Participants included members from federal  agencies, industry stakeholders, and academia. Panelists agreed that  a collective effort is needed to protect the electric grid and that a  national standard would be beneficial to assure effective and  consistent protection. FERC officials we interviewed familiar with the  technical conference stated that many participants agreed that there  could be a cascading series of effects of a GMD event and there is a  need to address this risk to help prevent a grid collapse. On March 1,  2016, FERC convened a second technical conference on GMD to  discuss issues related to the proposed Reliability Standard for  Transmission System Planned Performance for Geomagnetic  Disturbance Events.
section_title: Appendix III: Summary of Alignment between 2008 EMP Commission Recommendation and Key Federal Agency Actions
section_title: Appendix IV: Comments from the Department of Energy
section_title: Appendix V: Comments from the Department of Homeland Security
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Chris Currie, (404) 679-1875 or CurrieC@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Dawn Hoff (Assistant Director)  and Ryan Lambert (Analyst-in-charge) managed this assignment. Chuck  Bausell, Kendall Childers, Katherine Davis, Josh Diosomito, Leah  English, Tom Lombardi, John Rastler, and Steven Putansu made key  contributions to this report.