Critical Infrastructure Protection: Federal Efforts to Address Electromagnetic Risks
Published: 2016-05-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony summarizes the information contained in GAO's March 2016 report, entitled Critical Infrastructure Protection: Federal Agencies Have Taken Actions to Address Electromagnetic Risks, but Opportunities Exist to Further Assess Risks and Strengthen Collaboration , GAO-16-243 .
section_title: What GAO Found
paragraphs: Key federal agencies have taken various actions to address electromagnetic risks to the electric grid, and some actions align with the recommendations made in 2008 by the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken actions such as establishing industry standards and federal guidelines, and completing EMP-related research reports. GAO found that their actions aligned with some of the EMP Commission recommendations related to the electric grid. For example, DHS developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. Further, agency actions and EMP Commission recommendations generally align with DHS and DOE critical infrastructure responsibilities, such as assessing risks and identifying key assets.
Additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. Specifically, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. Doing so could provide additional awareness of related activities and help ensure more effective collaboration with other federal agencies and industry stakeholders. Moreover, although DHS components have independently conducted some efforts to assess electromagnetic risks, DHS has not fully leveraged opportunities to collect key risk inputs—namely threat, vulnerability, and consequence information—to inform comprehensive risk assessments of electromagnetic events. Within DHS, there is recognition that space weather and power grid failure are significant risk events, which DHS officials have determined pose great risk to the security of the nation. Better collection of risk inputs, including additional leveraging of information available from stakeholders, could help to further inform DHS assessment of these risks. DHS and DOE also did not report taking any actions to identify critical electrical infrastructure assets, as called for in the National Infrastructure Protection Plan. Although FERC conducted a related effort in 2013, DHS and DOE were not involved and have unique knowledge and expertise that could be utilized to better ensure that key assets are adequately identified and all applicable elements of criticality are considered. Finally, DHS and DOE, in conjunction with industry, have not established a coordinated approach to identifying and implementing key risk management activities to address EMP risks. Such activities include identifying and prioritizing key research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. Enhanced coordination to determine key research priorities could help address some identified research gaps and may help alleviate concerns voiced by industry regarding the costs and potential adverse consequences on grid reliability that may be caused by implementation of such equipment.

section_title: Letter
paragraphs: I am pleased to be here today to discuss our March 2016 report on  federal efforts to address electromagnetic risks to the electric grid.  Electromagnetic risks caused by a man-made electromagnetic pulse  (EMP) or a naturally occurring solar weather event could have a  significant impact on the nation's electric grid as well as other  infrastructure sectors that depend on electricity, such as communications.  The impact of these events could lead to power outages over broad  geographic areas for extended durations. Addressing these events  necessitates effective collaboration among multiple government agencies  and industry partners, as no single federal program or entity has sole  responsibility for addressing electromagnetic risks. In April 2008, the  Commission to Assess the Threat to the United States from  Electromagnetic Pulse Attack (EMP Commission) issued a report that  included over 90 recommendations addressing the preparation for, and  protection and recovery from, a possible EMP attack against U.S. critical  infrastructure. The majority of these recommendations were made to the  Department of Homeland Security (DHS) and to the Department of  Energy (DOE).
According to experts, a nuclear EMP is the burst of electromagnetic  radiation resulting from the detonation of a nuclear device, which can  disrupt or destroy electronic equipment. Nonnuclear EMP weapons can  also be designed to intentionally disrupt electronics, but these generally  have short range and are not a threat to multiple assets. In addition to  manmade EMPs, naturally occurring solar weather events of sufficient  intensity can also cause electromagnetic impacts that can adversely  affect components of the commercial electric grid, as well as other  infrastructure such as satellites and undersea cables. The resulting  impact of a solar weather event is commonly referred to as a  geomagnetic disturbance (GMD). In 1989, a GMD caused wide-scale  impacts on the Hydro-Quebec power system in Canada which caused  this regional electric grid to collapse within 92 seconds and left 6 million  customers without power for up to 9 hours.
The National Infrastructure Protection Plan (NIPP) outlines the roles and  responsibilities of DHS and applicable sector-specific agencies for each  of the 16 critical infrastructure sectors. DHS has the lead role in  coordinating the overall federal effort to promote the security and  resilience of the nation’s critical infrastructure and DOE—as the sector- specific agency for the energy sector, which includes critical electrical  infrastructure—shares responsibility with DHS. Other federal agencies  working to address the threat of EMP and GMD include the Department  of Defense (DOD) and the Federal Energy Regulatory Commission  (FERC), as well as the National Oceanographic and Atmospheric  Administration (NOAA), the U.S. Geological Survey (USGS), and the  National Aeronautics and Space Administration (NASA).
As noted in Presidential Policy Directive 21, the energy and  communications sectors are uniquely critical due to the enabling functions  they provide to other critical infrastructure sectors. The U.S. electric  power delivery system is a highly complex network of substations and  electric lines that transport electricity from generators to residential,  commercial, and industrial consumers. Approximately 85 percent of the  nation’s critical electrical infrastructure is owned and operated by private  industry.
My statement today summarizes the findings from our March 2016 report,  and like the report, addresses (1) the extent to which key federal  agencies have taken actions to address electromagnetic risks to the  electric grid, including how these actions align with selected  recommendations from the 2008 EMP Commission report and (2) the  extent to which additional opportunities, if any, exist to enhance federal  efforts in addressing those risks to the electric grid. To conduct this work,  we reviewed program documents, research reports, applicable risk  assessments, and other supporting documentation related to  electromagnetic risks and interviewed agency officials at DHS, DOE,  DOD, FERC, and NOAA. We also interviewed officials from industry  associations, subject-matter experts from research organizations, product  manufacturers, and electric utility operators. More detailed information on  our scope and methodology can be found in our March 2016 report. We  conducted the work on which this statement is based in accordance with  generally accepted government auditing standards.
subsections: section_title: Federal Agencies Have Taken Various Actions to Address Electromagnetic Risks; Some Actions Align with the 2008 EMP Commission Recommendations
paragraphs: DHS, DOE and FERC have taken various actions to address  electromagnetic risks to the electric grid, and these actions generally fall  into four categories: (1) standards, guidelines, tools and demonstration  projects; (2) research reports; (3) strategy development and planning; and  (4) training and outreach. Additionally, some of the actions DHS and DOE  have taken generally aligned with recommendations made by the EMP  Commission.
Because federal agencies generally do not own electric grid  infrastructure, federal actions to address GMD risks are more indirect  through such things as developing standards and guidelines, and  conducting research that could benefit electric grid owners and operators.  Federal agencies have also been involved in strategy development and  planning, as well as training and outreach efforts, as a means of  preparing federal officials and others to respond to both EMP and GMD  events, and enhancing knowledge about electromagnetic risks. For  example, DHS’s Science and Technology Directorate (S&T) led the  design and development of a prototype transformer that can be more  easily transported to another location to help restore electric power in a  timelier manner. DHS has also participated in various training and  outreach events to enhance understanding of EMP and GMD events.  DOE’s primary efforts include supporting research to enhance the  understanding of the potential impacts to the electric grid from  electromagnetic events. More detailed information on key federal  agencies’ actions taken since 2008 to address electromagnetic risks can  be found in Appendix II of our March 2016 report.
Although DHS and DOE did not report that any of their actions were taken  in response to the EMP Commission recommendations, some actions  taken by both agencies have aligned with some of the recommendations.  Specifically, of the seven recommendations made by the EMP  Commission related to the electric grid, some of the actions that DHS  and DOE took aligned with four of them: conducting research to better  understand the interdependencies of critical infrastructures, addressing  the vulnerability of control systems to an EMP attack; identifying  responsibilities for responding to an EMP attack; and utilizing industry and  other governmental institutions to assure the most cost-effective  outcomes. For example, with respect to the recommendation on  conducting research to better understand interdependencies of critical  infrastructures, DHS’s Sector Resilience Report: Electric Power Delivery  includes some assessment of how various critical infrastructures— including the energy, communications, and transportation sectors, among  others—are interdependent in maintaining operations. For more detailed  information regarding how identified federal actions align with these  seven EMP Commission recommendations, see Appendix III of our  March 2016 report.
section_title: Additional Opportunities Exist To Enhance Federal Efforts to Address Electromagnetic Risks to the Electric Grid
subsections: section_title: DHS Has Not Clearly Identified Roles and Responsibilities for Addressing Electromagnetic Risks
paragraphs: In our March 2016 report, we found that DHS had not clearly identified  internal roles and responsibilities for addressing electromagnetic risks to  the electric grid or communicated these to external federal and industry  partners. While multiple DHS components and offices, including the  National Protection and Programs Directorate (NPPD), the Federal  Emergency Management Agency (FEMA), and S&T, had each conducted  independent activities addressing electromagnetic risks to the electric  grid, none had been tasked with lead responsibility for coordinating  related activities within the department or with federal and industry  stakeholders. As a result, during the course of our review for our March  2016 report, we experienced ongoing challenges in identifying applicable  DHS personnel and related departmental actions. For example, NPPD  officials had difficulty identifying their specific roles and activities  addressing electromagnetic risks to the electric grid, including efforts to  collect or synthesize available risk information to provide input into  department-wide risk assessments.
Furthermore, industry representatives and other federal officials told us it  is not clear who within DHS is responsible for addressing electromagnetic  risks. The 2008 EMP Commission report recommended that DHS make  clear its authority and responsibilities, as well as delineate the functioning  interfaces with other governmental institutions, regarding EMP response  efforts. We concluded that designating internal roles and responsibilities  within DHS regarding electromagnetic risks and communicating these to  federal and industry partners could provide additional awareness of  related activities and help ensure more effective and coordinated  engagement with other federal agencies and industry stakeholders, and  could help reduce the risk of potential duplication, overlap, or  fragmentation within the department or across federal agencies.
In our March 2016 report, we recommended DHS designate roles and  responsibilities within the department for addressing electromagnetic risks  and communicate these to federal and industry partners. DHS concurred  with our recommendation and reported that their Office of Policy is  coordinating across the department to identify and document applicable  roles and responsibilities regarding electromagnetic issues to ensure full  mission coverage while minimizing potential overlap or redundancy and  expects to complete this effort by December 2016. These actions, if  implemented effectively, should address the intent of our  recommendation.
section_title: DHS and DOE Have Not Fully Addressed NIPP Requirement to Identify Key Electrical Infrastructure Assets
paragraphs: In our March 2016 report, we found that DHS and DOE had not taken  actions to identify key electrical infrastructure assets as required given  their respective critical infrastructure responsibilities under the NIPP. The  NIPP explicitly states that to manage critical infrastructure risk effectively,  partners must identify the assets, systems, and networks that are  essential to their continued operation, considering associated  dependencies and interdependencies of other infrastructure sectors. The  2008 EMP Commission report also recommended that DHS and DOE  prioritize nodes that are critical for the rapid recovery of other key sectors  that rely upon electricity to function, including those assets that must  remain in service or be restored within hours of an EMP attack. Neither  DHS nor DOE reported any specific actions taken to identify critical  electrical infrastructure as part of risk management efforts for the energy  sector, including any systematic review of a 2013 FERC analysis of  critical substations, or any further collaboration to determine the key  elements of criticality that they believe should be considered when  evaluating the vast array of infrastructure assets constituting the U.S.  electric grid. The extensive size and scope of the electric power system  necessitates collaboration among partners to ensure all individual  expertise is effectively leveraged.
As a result, we recommended in our March 2016 report that DHS and  DOE direct responsible officials to review FERC’s electrical infrastructure  analysis and collaborate to determine whether further assessment is  needed to adequately identify critical electric infrastructure assets. DHS  and DOE each concurred with our recommendation. DHS reported that  NPPD is to collaborate with FERC to identify critical electrical  infrastructure assets beginning with the evaluation of critical substations  identified by FERC, and will explore elements of criticality that might not  have been considered by FERC, in coordination with DOE. DOE stated  that its Office of Electricity Delivery and Energy Reliability will review  FERC’s electrical infrastructure analysis and will work with FERC and  DHS to identify any additional elements of criticality and determine if  further assessment is needed. Both DHS and DOE expect to complete  these efforts by March 2017. These actions should address the intent of  our recommendation.
section_title: DHS Has Not Fully Leveraged Existing Opportunities to Collect and Analyze Information on Electromagnetic Risks
paragraphs: We found in March 2016 that although DHS components had  independently conducted some efforts to assess electromagnetic risks,  the department had not fully leveraged available risk information or  conducted a comprehensive analysis of these risks. Within the Office of  Policy, there is recognition that “space weather” and “power grid failure”  are significant risk events, which DHS officials have determined pose  great risk to the security of the nation. However, DHS officials were  unable to provide detailed information about the specific risk inputs— namely threat, vulnerability, and consequence information—that were  used to assess how electromagnetic events compared to other risk  events, or how these inputs were used to inform DHS’s applicable risk- management priorities. Further, officials within NPPD were unable to  identify any specific actions taken or plans to systematically collect or  analyze risk information regarding electromagnetic impacts to the electric  grid as part of department-wide risk assessment efforts.
According to the NIPP, to assess risk effectively, critical infrastructure  partners—including owners and operators, sector councils, and  government agencies—need timely, reliable, and actionable information  regarding threats, vulnerabilities, and consequences. Additionally, the  electric grid remains vulnerable to other potential threats, such as  physical and cyberattacks. We concluded that better collection of threat,  vulnerability, and consequence information through existing DHS  programs and strengthened collaboration with federal partners could help  DHS better assess the relative risk ranking of electromagnetic events  versus other risks and help inform asset protection priorities. Moreover,  according to subject-matter experts, the impact to the electric grid from  electromagnetic threats may vary substantially by location, network and  operating characteristics, and other factors. For example, key reports on  GMD indicate that high-voltage transformers located at higher latitudes in  the United States are likely subject to increased potential for adverse  impacts from GMD events than those at lower latitudes. Further collection  of information on sector interdependencies could also help DHS to  assess the potential economic consequences associated with long-term  power outages and provide information to help assess the cost- effectiveness of various mitigation strategies.
In our March 2016 report, we recommended that DHS’s NPPD and Office  of Infrastructure Protection (IP) work with other federal and industry  partners to collect and analyze key inputs on threat, vulnerability, and  consequences related to electromagnetic risks. DHS concurred with our  recommendation and reported that the department has initiated efforts to  assess electromagnetic risk and help determine priorities. For example,  DHS stated the Department has a joint study with DOE underway that will  analyze the hazard environments, impacts, and consequences of different  sources of EMP and GMD on the electric grid to determine events of  concern and potential means of mitigation. DHS expects to implement  these efforts by December 2016 and if implemented effectively, should  address the intent of our recommendation.
section_title: Federal Agencies Have Not Fully Coordinated Efforts to Implement EMP Risk Management Activities
paragraphs: We also found in March 2016 that key federal agencies, including DHS  and DOE, as well as industry partners had not established a fully  coordinated approach to identifying and implementing risk management  activities to address EMP risks. According to the NIPP Risk Management  Framework, such activities include identifying and prioritizing research  and development efforts, and evaluating potential mitigation options,  including the cost-effectiveness of specific protective equipment. The  publication of the National Space Weather Action Plan in October 2015  identified many key federal activities in these areas regarding the GMD  risk; however, no similar efforts had been proposed regarding EMP risks  to the electric grid.
DHS officials stated an EMP attack generally remains a lower risk priority  compared to other risk events with higher probability such as natural  disasters or cyberattacks. DOE officials also noted resource limitations  and competing priorities as the key driver for not pursuing additional risk  management activities specifically related to EMP events. However, we  found that even if an EMP attack is not determined to be among the  highest resource priorities for DHS and DOE relative to other risk events,  there are opportunities for enhanced collaboration among federal  agencies and industry stakeholders to address identified gaps and help  ensure that limited resources are more effectively coordinated and  prioritized. For example, recent reports issued by DOE and a leading  research organization for the electric industry identified gaps in the  information available regarding likely EMP impacts to modern grid  technologies and electronic control systems. They noted that such  information remains important for developing applicable protective  guidelines and equipment design specifications.
In our March 2016 report, we recommended that DHS and DOE engage  with federal partners and industry stakeholders to identify and implement  key EMP research and development priorities, including opportunities for  further testing and evaluation of potential EMP protection and mitigation  options. DHS and DOE concurred with our recommendation and each  identified actions to convene applicable stakeholders to jointly determine  mitigation options and conduct further testing and evaluation. DHS stated  S&T will work with DOE and the Electricity Subsector Coordinating  Council to develop a joint government and industry approach to identify  options for mitigating the consequences of an EMP event. DHS expects  to implement this effort by September 2016. In addition, DOE stated it is  working with the Electric Power Research Institute to develop an EMP  Strategy that is scheduled for completion by August 31, 2016, and the  strategy is to be followed by a more detailed action plan identifying  research and development priorities and specific opportunities to test and  evaluate EMP mitigation and protection measures. If implemented  effectively, DHS and DOE’s actions should address the intent of our  recommendation.
We will continue to monitor DHS and DOE actions taken to address our  March 2016 recommendations and have also recently initiated two  additional reviews. One is evaluating the electromagnetic event  preparedness of U.S. electricity providers and the other is a technical  assessment of protective equipment designed to mitigate the potential  impacts of a GMD on electrical infrastructure. We expect these projects to  be completed by mid-2017.
Chairman Perry, Ranking Member Watson Coleman, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.
section_title: GAO Contact and Staff Acknowledgements
paragraphs: If you or your staff members have any questions concerning this  testimony, please contact Chris Currie, Director, Homeland Security and  Justice at (404) 679-1875 or CurrieC@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. GAO staff who made key contributions  include Dawn Hoff, Assistant Director; Chuck Bausell, Kendall Childers,  Josh Diosomito, Ryan Lambert, Tom Lombardi, Steven Putansu, John  Rastler, and Cody Raysinger.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.