Cybersecurity for Energy Delivery Systems: DOE Programs
Released: 2017-08-28T00:00:00

Introduction

The U.S. electric grid consists of over 700,000 miles of transmission lines and over 55,000 substations linking over 7,000 power plants to around 150 million customers. Likewise, the U.S. energy pipeline network is composed of over 2.9 million miles of pipeline transporting natural gas, oil, and hazardous liquids; the natural gas transmission pipelines feed approximately 1,400 local distribution systems serving over 67 million customers. These vast networks comprise the critical backbone of U.S. energy supply, supporting the vast majority of U.S. economic activity and playing a vital role in national defense. Consequently, the secure operation of both the power grid and pipelines are national priorities.

While physical threats to the U.S. power grid and pipelines have long worried policymakers, cyber threats to the computer systems that operate this critical infrastructure are an increasing concern. Especially over the past decade, cyber threats against energy infrastructure have grown in frequency and severity. While most of these threats have been against the electric subsector, pipeline systems have also faced growing risk to their information communications technology. Both the Departments of Energy and Homeland Security have been directed to assess impacts of a cyberattack against the energy sector. Furthermore, with ever greater physical interdependency between electricity generators and the natural gas pipelines which supply their fuel, many in Congress recognize that grid and pipeline cybersecurity are intertwined.

The Department of Energy (DOE) is the lead agency for the protection of electric power, oil, and natural gas infrastructure—cooperating with the Department of Homeland Security (DHS), the lead agency for pipelines. DOE's energy sector cybersecurity activities are led primarily by its Office of Electricity Delivery and Energy Reliability (OE). In 2015, the Fixing America's Surface Transportation Act (the FAST Act) provided the Secretary of Energy with additional authority to order measures to protect or restore the reliability of the power grid during a grid security emergency, including "a malicious act using electronic communication." The 115 th Congress is considering additional legislation to fund and expand DOE's cybersecurity programs, including appropriations in the Defense, Military Construction, Veterans Affairs, Legislative Branch, and Energy and Water Development National Security Appropriations Act, 2018 ( H.R. 3219 ) and the Energy and Water Development and Related Agencies Appropriations Act, 2018 ( S. 1609 ). The Energy and Natural Resources Act of 2017 (S. 1460) and the Enhancing State Energy Security Planning and Emergency Preparedness Act of 2017 ( H.R. 3050 ) would authorize additional DOE funding for cybersecurity research and assistance to states, respectively.

This report examines the energy sector cybersecurity program administered by DOE's Office of Electricity Delivery and Energy Reliability as it applies to the electric power and pipelines subsectors. The report summarizes risks to the computer-based control systems used in these subsectors, threats to those systems, and recent cyberattacks. The report reviews the legislative authorities and policy guidance that have directed OE's cybersecurity program and its activities, including its relationship to the national laboratories and other federal agencies with cybersecurity roles. The report concludes with a discussion of key policy issues for Congress.

Cybersecurity Risks

Federal security officials and industry analysts have long identified the grid and pipelines in the United States as potential targets for intentional disruption, although the nature and degree of cyber risk has been steadily evolving. For example, a 2011 DHS pipeline threat assessment concluded that "terrorist groups have discussed attacks on unspecified [supervisory control and data acquisition] systems, but it is uncertain whether al-Qa'ida or any other group has the capability to conduct a successful cyberattack on these systems." However, in 2016, the President of the Association of Oil Pipe Lines testified before a congressional committee that cybersecurity threats to pipelines were increasing and that "there is a great concern about … being prepared for cyber attacks" in the pipeline industry. In January 2017, the DOE similarly concluded that "Cybersecurity is a particular concern for national and homeland security.… Malicious cyber activity against the electricity system and its suppliers is growing in sophistication." While the threat of terrorist groups seeking to employ cyber tools against critical infrastructure persists, terrorist organizations have not yet demonstrated a capability to attack U.S. critical infrastructure in this manner.

Generally, the electricity grid and energy pipelines are under the same types of cybersecurity risks as other industries, such as financial services or transportation. However, different adversaries may choose to employ similar cyber tools to focus on different targets at different moments in time based on their unique motivations. Cybersecurity risks thus reflect both general threats to the energy sector as a whole and specific threats to industrial control systems as the focus of attack.

Industrial Control System Security Risks

Software-based industrial control systems (ICS) are used to monitor and control many aspects of network operation for railways, power grids, water and sewer systems, and pipeline networks. One category of ICS widely used in electric grid and pipelines networks—supervisory control and data acquisition (SCADA) systems—collect data (e.g., voltage, line pressure) in real time from sensors throughout a network, displaying those data to human operators in remote network control rooms. These operators can send computerized commands from SCADA workstations to control geographically dispersed equipment such as electric switches, pipeline valves, pumps, and many other network components. The SCADA system provides continuous feedback about conditions throughout the network, generating safety alarms when operating conditions fall outside prescribed levels. Communications links may employ dedicated telephone landlines, wireless communications (satellite, microwave, and radio), cellular telephone service, Wi-Fi, and the Internet. As SCADA technology has matured, system control has become more intelligent and more automated, requiring less human intervention.

Historically, SCADA systems employed highly customized proprietary software and were physically isolated from outside communications and computer networks. Because many of these systems were largely unique to a specific operator, it would have been difficult for malicious individuals outside the company to access a SCADA system and know what to do with it. However, due to advancements in computer technology and the ongoing development of communications and Internet-based control system applications, SCADA systems have become much more vulnerable to outside intrusion and manipulation. Specific SCADA security weaknesses include the adoption of standardized control system technologies with known vulnerabilities, increased connection to external networks, insecure communication connections, and the public availability of sensitive information about control systems and infrastructure.

Once accessible to a knowledgeable attacker, a SCADA system can be exploited in a number of specific ways to carry out a cyberattack:

issuing unauthorized commands to control equipment; sending false information to a control-system operator that initiates inappropriate actions; disrupting control system operation by delaying or blocking the flow of information through the control network; making unauthorized changes to control system software to modify alarm thresholds or other configuration settings; and rendering resources unavailable by propagating malicious software (e.g., a virus, worm, Trojan horse) through the control network.

Depending upon the configuration of a particular system, such cyberattacks could potentially disrupt service, cause a hazardous release into the environment, or damage equipment. An example of the latter was a proof-of-concept attack hosted by the DHS in 2007 known at the Aurora Project. In this experiment, researchers working with DHS sent two sets of commands to a diesel-fueled electric generator. The first set of commands told the generator to repeatedly open and then rapidly close circuits in a manner that would cause failure. The second set of commands sent outputs to the operator-readable control panel that the generator was operating normally. The result was that the generator spun in such a manner that it destroyed itself without the operators knowing.

Recently, reports of harmful software (malware) known as CrashOverride emerged as the latest example of destructive malware that can be used against the energy sector. CrashOverride reportedly includes capabilities allowing an attacker to disrupt ICS operations by opening and closing electric circuit breakers (degrading operations), denying access to communication ports on devices, and wiping modules to render devices inert. While there is no reported case of CrashOverride residing on U.S.-based systems, an updated version of the malware reportedly was used in a 2016 attack against the Ukrainian electric grid.

Most of the cyberattacks that have been made public in the past few years have been against electricity generation and delivery infrastructure. However, in March 2012, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) within DHS identified an ongoing series of cyber intrusions among U.S. natural gas pipeline operators dating back to December 2011. According to the agency, various pipeline companies described targeted spear-phishing attempts and intrusions into multiple natural gas pipeline sector organizations that were "positively identified … as related to a single campaign. "

In 2010, the Stuxnet computer worm was first identified as a threat to industrial control systems. The Stuxnet software initially spreads indiscriminately, but the software includes a highly specialized industrial process component targeting specific Siemens industrial SCADA systems. Furthermore, the capabilities demonstrated during the Aurora Project and the CrashOverride malware described above are also applicable against other ICS, including those for pipelines.

DOE's Authority in Energy Delivery Cybersecurity

DOE has authority and responsibilities for the cybersecurity of energy delivery systems from both presidential action memoranda and law. A chronologic perspective provides some insight on how energy security policy has evolved.

Federal Actions in Energy Infrastructure Cybersecurity

The Clinton Administration released Presidential Decision Directive 63 (PDD-63) in 1998. For the first time in executive branch operations, PDD-63 established national policy for critical infrastructure protection from both physical and cyber threats. The directive discussed using a public-private partnership to reduce vulnerability to critical infrastructure from attacks, with lead federal agencies responsible for coordinating government efforts for specific sectors. PDD-63 established 15 critical infrastructure sectors and four special functions. DOE was assigned responsibility for (1) the electric power, and (2) the oil and natural gas production and storage sector.

The George W. Bush Administration built on the work of PDD-63, superseding it in 2003 with Homeland Security Presidential Directive 7 (HSPD-7) on "Critical Infrastructure Identification, Prioritization, and Protection." HSPD-7 shifted the doctrine by removing "special functions" and expanding the sectors. In some cases, the expansion also included the addition of subsectors, as in transportation and energy. The transportation sector identified pipelines as a subsector; the energy sector identified an electric power subsector, and an oil and natural gas subsector. Lead agencies were replaced by Sector Specific Agencies (SSA), which had to collaborate with other federal agencies in a similar way as in PDD-63, but were also given responsibility for vulnerability assessments and assisting in risk management. In HSPD-7, DHS was named as the SSA for the transportation sector, including pipelines; DOE was assigned responsibility for the energy sector, as well as being the federal coordinator for all critical infrastructure protection efforts. In implementing HSPD-7, DHS pursued a risk-based approach to focus federal resources in areas of greatest risk, based on assessments as well as stakeholder (e.g., companies and state officials) input.

Congress passed legislation on the cybersecurity of energy delivery systems during the George W. Bush Administration with the Energy Policy Act of 2005 (EPACT). EPACT included the Electricity Modernization Act of 2005, which directed the Federal Energy Regulatory Commission (FERC) to establish an "Electric Reliability Organization" (ERO, a role which the North American Electric Reliability Corporation [NERC] currently fulfills) to develop "reliability standards" for the "reliable operation" of the bulk power system. The authority allowed for standards to address "cybersecurity protection" and also defined a "cybersecurity incident" as a unique incident which disrupted the "programmable electronic devices and communications networks ... essential to the reliable operations of the bulk power system." FERC's authority under EPACT applies only to the bulk power system, and that authority is limited to review of the ERO's standards. FERC cannot author standards independently, but can remand ERO-drafted standards back for reconsideration. While FERC also has regulatory authority over interstate natural gas pipelines under the Natural Gas Act (P.L. 75-688), its role is limited to siting and rate regulation, not safety or security.

The Obama Administration superseded HSPD-7 with Presidential Policy Directive 21 (PPD-21) on "Critical Infrastructure Security and Resilience" in 2013. "Resilience" was a term adopted in the Obama Administration as a way of recognizing that critical infrastructure is inherently vulnerable and will be disrupted at some point (historically, by severe weather, and potentially by an intentional attack), and that the infrastructure's degree of resilience will affect response time and eventual recovery. PPD-21 sought to further integrate cybersecurity as part of critical infrastructure protection by clarifying federal roles for security and resilience; establishing baseline information exchange requirements; and integrating analysis to inform planning, operations, and critical infrastructure decisions. PPD-21 retained the SSAs from HSPD-7, with DOE continuing as the SSA for the energy sector (electric power, and oil and natural gas). DHS was named the co-chair with the Department of Transportation (DOT) on the transportation sector and its subsectors, including pipelines.

Congress further legislated on energy sector cybersecurity in 2015 with the Fixing America's Surface Transportation Act (FAST Act). Division F of the FAST Act on "Energy Security" included the designation of DOE as the SSA for cybersecurity for the energy sector. With this authority, DOE was directed to work with DHS in collaboration with electric infrastructure owners and operators for prioritization of activity, incident management, and vulnerability identification. While the law broadly states that DOE has a responsibility for the energy sector, the specific activities for collaboration refer only to the electricity subsector.

The Trump Administration has not released a presidential memorandum superseding PPD-21, so that directive remains in effect. However, on May 11, 2017, the Administration issued Executive Order 13800 (E.O. 13800) on "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure." E.O. 13800 requires DOE and DHS to assess U.S. readiness to manage the consequences of a prolonged power outage as a result of a significant cyber incident. DOE also worked on a similar plan in accordance with a FAST Act directive on strategic transformer reserve options, although that plan is not focused on a specific type of threat, addressing the effects of any disruption on power delivery.

Key Policy Guidance for Energy Delivery Cybersecurity

In addition to executive action and legislation, numerous federal policy documents over the last two decades from various presidential administrations have addressed cybersecurity for energy infrastructure. This policy guidance, together with the related presidential directives and executive orders discussed above, has resulted in DOE's energy delivery cybersecurity program in its current form. Key guidance documents over this period are briefly discussed below.

The comprehensive federal program for cybersecurity in energy delivery originated largely in 2000 under the National Plan for Information Systems Protection , which identified the electric power system and pipelines as critical infrastructure "that could be a target for significant cyber or physical attacks." In particular, the plan stated

The cyber nation of our infrastructures has created an intense reliance upon an underlying fabric of telecommunications and information networks. The infrastructures also rely heavily upon the Nation's energy production and distribution networks, especially through the I&C [information and communications] infrastructure's energy requirements.

It is noteworthy that this passage refers broadly to "energy distribution networks," although I&C energy requirements imply an emphasis on reliable electricity supply. The plan reiterated DOE's role as the lead agency under PDD-63 for protection of electric power and oil and gas production and storage infrastructure, and DOT as the lead agency for pipelines.

In 2003, the National Strategy to Secure Cyberspace also identified the energy sector (electric power, oil and gas production, storage, and pipelines) as critical infrastructures dependent upon computer systems and vulnerable to cyber threats, reaffirming the lead agency roles under PPD-63. The strategy placed a particular emphasis on securing digital control systems (DCS) and SCADA, which are particularly important in the electric power and pipeline sectors. Due to the ubiquity of these systems, the strategy explicitly called for coordination among DHS, DOE, other concerned agencies, and private industry in addressing DCS and SCADA cybersecurity.

In 2006, DOE and DHS released their jointly-developed Roadmap to Secure Control Systems in the Energy Sector to provide "a strategic framework for investment and action in industry and government." The Roadmap stated that the agencies were collaborating on energy sector critical infrastructure protection—citing specifically "the U.S. electric grid and oil and gas pipeline networks." The overarching energy sector vision stated in the Roadmap was as follows: "In 10 years, control systems for critical applications will be designed, installed, operated, and maintained to survive an intentional cyber assault with no loss of critical function."

In 2011, the Roadmap to Achieve Energy Delivery Systems Cybersecurity was published by the Energy Sector Control Systems Working Group (ESCSWG), sponsored by DOE as an update to the 2006 Roadmap . The infrastructure scope of the 2011 Roadmap encompassed the "electricity, oil, and natural gas sectors," specifically including the "production, transmission, distribution, and delivery of energy to consumers." The stated vision of the 2011 Roadmap includes a reference to resiliency similar to that of the 2006 report: "By 2020, resilient energy delivery systems are designed, installed, operated, and maintained to survive a cyber incident while sustaining critical functions." This vision statement also is directed at "energy delivery systems" as a specific type of infrastructure. Appendix D of the Roadmap defines "energy delivery systems" as:

A network of processes that produce, transfer, and distribute energy and the interconnected electronic and communication devices that monitor and control those processes. Energy delivery systems include control systems—the sensors and actuators that physically monitor and control the energy processes, the computer-based systems that analyze and store data, and the communication networks that interconnect the process and computer systems.

The Roadmap includes under this umbrella: generation, transmission, and distribution in the electric power sector, and drilling, processing, refining, and pipelines in the oil and natural gas sector.

Pipeline Cybersecurity at DOE

In 2015, DOE—in coordination with DHS—released its most recent Energy Sector-Specific Plan (SSP) "to help guide and integrate the sector's continuous effort to improve the security and resilience of its critical infrastructure." The SSP places an "increased emphasis on the Energy- and cross-sector interdependency issues and the integration of cyber and physical security efforts." Notably, the SSP defines the "Energy Sector" as:

three interrelated segments or subsectors—electricity, oil, and natural gas—to include the production, refining, storage, and distribution of oil, gas, and electric power, except for hydroelectric and commercial nuclear power facilities and pipelines.

This explicit exclusion of pipelines from the energy sector under the 2015 SSP appears to be a difference from the other DOE cybersecurity policy guidance discussed above. However, this divergence may be specific to the National Infrastructure Protection Plan (NIPP) under which the SSPs are derived, as pipelines are under the purview of the transportation sector in the NIPP. The SSP also states that DOE and DHS, as co-chairs of the Energy Government Coordinating Council, are engaged in the security and resilience efforts of "other" critical infrastructure sectors, including pipeline, maritime, chemical, and dams. The SSP also states that DOE and DHS work together with Canadian agencies "to coordinate matters related to pipeline safety and security." Based on these statements, the degree of DOE attention to pipeline cybersecurity is unclear but appears limited. Among the electricity subsector priorities stated in the SSP are "deploying proprietary government technologies on utility systems that enable machine-to-machine information sharing and improved situational awareness of threats to the grid" and implementing the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Other Cybersecurity Authorities

Along with the DOE, two other federal agencies play significant roles in cybersecurity for energy infrastructure. Both FERC and the Transportation Security Administration (TSA) have statutory authority to regulate cybersecurity for energy infrastructure under their relative jurisdictions, but they exercise it differently, due to different requirements underlying their respective authorities.

FERC's Bulk Power Cybersecurity Standards

The bulk electric power system has mandatory and enforceable standards for cybersecurity. As stated earlier, EPACT gave FERC authority over the reliability of the grid, with the power to approve mandatory cybersecurity standards proposed by the Electric Reliability Organization (ERO). The North American Electric Reliability Corporation (NERC) serves as the ERO. NERC therefore proposes reliability standards for critical infrastructure protection, which are updated based on the status of reliability and cybersecurity concerns for the grid. FERC views grid security as a high priority, having separately established the Office of Energy Infrastructure Security (OEIS) to deal with cyber and physical security. OEIS has a mission to provide expertise to FERC to "identify, communicate and seek comprehensive solutions to potential risks to FERC-jurisdictional facilities from cyberattacks and such physical threats as electromagnetic pulses."

TSA Pipeline Security Authority

The federal program for U.S. pipeline security began under DOT immediately after the terror attacks of September 11, 2001. The Aviation and Transportation Security Act of 2001 ( P.L. 107-71 ), which established the Transportation Security Administration within the DOT, authorized the agency "to issue, rescind, and revise such regulations as are necessary" to carry out its functions (§101). TSA was transferred to DHS, newly created under the Homeland Security Act of 2002 ( P.L. 107-296 ). HSPD-7 maintained DHS as the lead agency for pipeline security, and instructed DOT to "collaborate in regulating the transportation of hazardous materials by all modes (including pipelines)." The Implementing Recommendations of the 9/11 Commission Act of 2007 ( P.L. 110-53 ) directs TSA to promulgate pipeline security regulations and carry out necessary inspection and enforcement if the agency determines that regulations are appropriate (§1557(d)). Thus, TSA has primary responsibility and regulatory authority for the security of natural gas and hazardous liquid (e.g., oil, refined products, and carbon dioxide) pipelines in the United States.

Although DHS has regulatory authority for pipeline security, its activities to date have relied upon voluntary industry compliance with the agency's security guidance and best practice recommendations. Cybersecurity is also an element of voluntary security standards developed by the pipeline industry.

Department of Transportation

The Department of Transportation (DOT) regulates the safety of oil and natural gas pipelines under the Natural Gas Pipeline Safety Act of 1968 (P.L. 90-481) and the Hazardous Liquid Pipeline Act of 1979 ( P.L. 96-129 ). DOT's federal pipeline safety program is administered by the Pipeline and Hazardous Materials Safety Administration (PHMSA). Although DOT regulates safety, some aspects of its regulations, such as facility access requirements, can be related to pipeline security. In particular, the Pipeline Inspection, Protection, Enforcement, and Safety Act of 2006 ( P.L. 109-468 ) mandated new requirements for control room management—including human factors, response to SCADA alarms, and review of reportable incidents—which could have cybersecurity impacts.

DOE's Energy Delivery Security Program

As noted above, the DOE's energy delivery cybersecurity activities are led by its Office of Electricity Delivery and Energy Reliability (OE) within the Office of the Under Secretary for Science and Energy. A 2008 OE report stated that "OE's mission is to advance technology—in partnership with industry, government, academia, and the public—to meet America's need for a reliable, efficient, and resilient electric power grid." According to the agency's website, a current "top priority" for OE is:

to make the nation's electric power grid and oil and natural gas infrastructure resilient to cyber threats.… The vision of OE's cybersecurity program is that, by 2020, resilient energy delivery systems are designed, installed, operated, and maintained to survive a cyber incident while sustaining critical functions.

This vision and the OE programs supporting it are intended to align closely with the 2011 Roadmap to Achieve Energy Delivery Systems Cybersecurity with an apparent focus on electric power, as discussed below.

OE Cybersecurity Program Structure

The OE's cybersecurity program for energy delivery systems is structured around three areas: (1) cybersecurity preparedness; (2) cyber incident response and recovery; and (3) research, development, and demonstration.

Cybersecurity Preparedness

OE's activities in cybersecurity preparedness address situational awareness and information sharing (taken together) and risk analysis. For the former, OE works with energy sector companies "to better detect risks and mitigate them more rapidly by fostering industry assessment capabilities, developing operational threat analysis tools, and working with the intelligence community to better share actionable threat and intelligence information." A key component of these efforts is co-funding the Cybersecurity Risk Information Sharing Program (CRISP), a public-private partnership managed by the Electricity Information Sharing and Analysis Center (E-ISAC), to facilitate timely, two-way sharing of threat information and to develop situational awareness tools that enhance the sector's ability to identify, prioritize, and coordinate the protection of critical infrastructure and key resources. Another effort, OE's Cybersecurity for the Operational Technology Environment (CYOTE) pilot program, focuses on two-way data sharing and analysis for energy sector operational technology (OT). OE also supports the National Association of Regulatory Utility Commissioners in producing its cyber security primer for state utility regulators. With OE support, experts from national laboratories have trained over 2,300 employees from over 200 utilities in cybersecurity, including live test bed exercises.

OE's risk activities seek to develop better cyber risk analysis tools, practices, and guidelines for energy sector infrastructure. To this end, OE has worked with industry to develop the Cybersecurity Capability Maturity Model (C2M2), which helps infrastructure operators evaluate their cybersecurity capabilities and prioritize improvements. OE has released an initial version for the electricity sector, and a derivative version for the oil and natural gas sector. The latter applies to "the exploration, gathering, production, processing, storage, and transportation of petroleum liquids and natural gas," including pipelines. The C2M2 model has been used for over 40 self-assessments among electricity, oil, and natural gas companies since its release in 2012. In 2015, the agency also published guidance to help energy sector companies align their cyber risk management efforts with the NIST Cybersecurity Framework. The NIST Framework is voluntary guidance (based on existing standards, guidelines, and practices) to reduce critical infrastructure cybersecurity risk. Working with NIST and NERC, OE has also developed a cybersecurity Risk Management Process (RMP) guideline for the electricity sector "to provide a consistent and repeatable approach to managing cybersecurity risk across the electricity subsector."

Cyber Incident Response and Recovery

In the event of a cyber incident, two documents outline the framework under which the federal government will respond. Presidential Policy Directive 41 (PPD-41) on "United States Cyber Incident Coordination" establishes the policy of concurrent lines of effort in response. In these lines of effort, DHS leads asset response, which focuses on restoring the victim entity; the Federal Bureau of Investigation (FBI) leads threat response, which seeks to identify and respond to the culprit of the attack; and the Intelligence Community leads a supporting line of effort to assist DHS and the FBI with intelligence support. PPD-41 provided the policy for the National Cyber Incident Response Plan (NCIRP) along with additional detail for how that response will work following incident response and emergency management doctrine in the National Response Framework.

The NCIRP dictates that, in response to a cybersecurity incident, a Cyber Unified Coordination Group (Cyber UCG) will be established at the direction of the National Security Council to manage the incident and coordinate the delivery of federal resources and capabilities to victim entities. The Cyber UCG is a body consisting of federal, state and local, private sector, and other relevant parties with an appropriate role for the specific incident's response activities. The Cyber UCG is to form at DHS's National Cybersecurity and Communications Integration Center (NCCIC) and operate there or virtually, depending on the incident. In the event that such a significant cyber incident occurs in the energy sector, OE is likely to play a large role in the Cyber UCG, given its FAST Act authorities. However, CRS is not aware of any public record of a Cyber UCG standing up and operating for a cyber incident in the energy sector, so the concept of operations prescribed in the NCIRP appears still untested in real-world response.

Specific to pipeline security, DOE works with TSA and PHMSA to monitor flows and throughput of pipelines and facilitate information sharing among the federal government and private sector entities. This is in accordance with the "Pipeline Security and Incident Recovery Protocol Plan" which TSA drafted in response to the Implementing Recommendations of the 9/11 Commission Act of 2001. However, the plan is from 2010 and has not been updated to conform to PPD-41 or the NCIRP for cyber incidents.

Research, Development, and Demonstration

OE administers a cybersecurity research, development, and demonstration (RD&D) program aligned with the 2011 Roadmap "to assist the energy sector asset owners by developing cybersecurity solutions for energy delivery systems." One of the program's principal activities is co-funding selected RD&D projects with National Laboratories, universities, and industry partners. The agency has invested over $210 million since 2010 on 35 projects and other efforts related to cybersecurity tools and technology (see Appendix ). These projects span many aspects of cybersecurity, including control system hardening, monitoring, software maintenance, cyber incident response, and overall system design. The OE-funded projects appear to be predominantly focused on electric power applications (based on the specific technologies involved, industry partners, or stated objectives) but a number of them could also involve oil, natural gas, or pipeline-specific applications.

In addition to the focused RD&D projects, OE funds the National SCADA Test Bed (NSTB) in partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories to address control system security challenges in the energy sector. Among other things, the NSTB offers testing and research facilities and advanced visualization and modeling tools in facilities that recreate real-world energy delivery control systems, infrastructures, and networks. A key service of the NSTB has been the cyber security assessment of over 30 commercial SCADA systems in the electricity sector since 2003. The NSTB's FY2009 Work Plan listed several pipeline operators among its technical advisors for specific projects, although pipeline company participation more recently is not reported. OE is investing in an expansion of the power grid test bed at Idaho National Laboratory that is to increase its capabilities to support technology research, testing, and demonstration for electric transmission and substation cyber threats. In cooperation with the DHS Science and Technology Directorate (S&T), OE also funds collaborative teams of academic institutions to develop and implement multidisciplinary cybersecurity tools and technologies to be shared with the energy sector through academic outreach. For example, the Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) focuses on the trustworthy operation of low-level devices, communications, and data systems in the power grid.

OE's Pipeline-Related Cyber Activities

Asset owners across the electricity, oil, natural gas, and pipeline sectors often have similar operational and network communication needs—in some cases using the same types of hardware and software systems (e.g., SCADA) to meet them. Thus, cybersecurity programs, tools, and technologies developed in one sector have potential applicability to the others. However, effectively transferring general cyber practices or technology across sectors typically requires consideration or adaptation of cyber capabilities to fit the distinctive needs of a particular sector—such as "smart grid" metering requirements in electric power, or providing real-time operating pressure data in refineries and pipelines. Such sector customization, in turn, usually involves program participation by asset owners in a given sector, and pilot projects or demonstration in sector-specific installations.

Industry representatives have asserted that natural gas pipeline companies "work closely" in cybersecurity with DOE as the Energy SSA, which "actively engages with government and industry partners to develop cybersecurity practices, tools, and guidelines that address relevant cybersecurity risks and threats."

Although OE's cybersecurity focus appears to be primarily on the electric power sector, CRS is aware of some OE-funded projects with explicit pipeline sector participation in development or application. As noted above, OE modified a version of its C2M2 model specifically for use in oil, gas, and pipeline operations. The Safe Active Scanning for Energy Delivery Systems (SASEDS) project included the pipeline sector in its literature survey. Pipeline companies have participated in certain SCADA projects at the NSTB. Other OE-funded projects (e.g., Chess Master , a research and development program to identify next generation cybersecurity tools) have been led by technology developers serving multiple energy delivery sectors or in collaboration with industry partners that own multiple types of assets (e.g., the San Diego Gas & Electric utility company). In such cases, new technology may be transferred from the electric sector to the oil and gas or pipeline sectors by the vendor as a commercial product or service, or could potentially be transferred from the electric side of a utility to its natural gas operations. Because references to pipelines in the OE-related published material are few and anecdotal, CRS is unable to better determine the extent of such transfer to the pipeline sector.

Cybersecurity Collaboration with Other Agencies

As discussed above, FERC and TSA have statutory authority to regulate cybersecurity in the bulk power and pipeline systems, respectively. Although OE participates in some of the same high-level groups as these two agencies (e.g., Energy Sector Government Coordinating Council), there is little discussion in published materials as to what extent OE collaborates directly with FERC or TSA on specific cybersecurity RD&D programs in their respective infrastructure sectors. OE's statement before FERC's 2016 Reliability Technical Conference does not mention RD&D collaboration, although it does discuss OE's leadership of electric grid emergency preparedness exercises, such as North American Electric Reliability Corporation's Grid Ex III. OE also stated that it views grid reliability standards, including security standards, as "a topic that is not ultimately part of OE's portfolio, and is best addressed by NERC and FERC."

Although OE collaborates with DHS S&T on grid cybersecurity, the ongoing level of cooperation between OE and TSA in the area of pipeline security is difficult to determine from published materials. In 2016 testimony before a congressional committee regarding its cybersecurity activities, a TSA official did not specifically mention working with DOE (although the official did mention coordination with FERC). A 2014 presentation by TSA's pipeline security director mentioned coordination "with DHS and DOE to harmonize existing cybersecurity risk management programs" as well as TSA and DOE cooperative participation in security assessments of six cross-border pipelines. A 2010 Government Accountability Office (GAO) report stated that TSA and DOE "worked closely on pipeline security issues, programs, and activities, such as efforts to enhance reliability and resiliency." In 2007, GAO reported that the national laboratories coordinated activities funded through the DHS Control Systems Security Program with those funded by DOE through the NSTB, including vendor SCADA assessments and site assessments. The report states that the DOE-funded assessments were in the electricity sector, but provides no further information about the DHS-funded ones.

In 2016, DOT issued an Advisory Bulletin recommending that pipeline companies monitor their SCADA systems for abnormal operations, unauthorized access, or interference with safe operations. DOT stated that it had "coordinated with several components within DHS and the Department of Energy" on the bulletin. CRS has not found more specific documentation of collaboration between OE and DOT. Although DOT administers its own pipeline safety RD&D program, its recent projects do not involve direct work in control systems, SCADA, or cybersecurity.

Pending Legislation

On July 27, 2017, the House passed the Defense, Military Construction, Veterans Affairs, Legislative Branch, and Energy and Water Development National Security Appropriations Act, 2018 ( H.R. 3219 ), providing appropriations for DOE for the fiscal year ending September 30, 2018. The bill would appropriate $218,500,000 for OE, available until expended, except for $27,500,000 to be available until September 30, 2019 for program direction (Title III). The corresponding Senate bill, the Energy and Water Development and Related Agencies Appropriations Act, 2018 ( S. 1609 ), reported by the Committee on Appropriations on July 20, 2017, would appropriate $213,141,000 for OE, available until expended, except for $27,000,000 to be available until September 30, 2019 for program direction (Title III).

Cybersecurity of energy infrastructure is addressed in Title II of S. 1460 , the Energy and Natural Resources Act of 2017. Although titled "Enhanced Grid Security," Section 2002 of the bill also addresses security for other energy infrastructure.

It would establish a program for energy sector cybersecurity RD&D to be carried out by DOE, in consultation with other agencies, states, and the energy sector, for advanced applications to identify and mitigate cyber vulnerabilities. A key focus would be on the interdependencies of critical infrastructure sectors. The bill would authorize appropriations of $65 million for each fiscal year from FY2018 through FY2026 for the program. The cybersecurity of devices and third-party control systems in the supply chain would also be a central focus of the proposed RD&D efforts. The bill would authorize appropriations of $65 million for each fiscal year from FY2018 through FY2026 for the program. Additionally, S. 1460 would require DOE to provide operational support for a cyber-resilience program, to enhance and periodically test the emergency response capabilities of DOE and the Electricity Sector Information Sharing and Analysis Center and their ability to monitor the status of the energy sector. The bill would authorize appropriations of $10 million for each fiscal year from FY2018 through FY2026 for this program. DOE would also develop modeling and risk assessment tools for a cyber-resilience program to secure energy networks, including electric, natural gas, and oil exploration, transmission, and delivery. The bill would authorize appropriations of $10 million for each fiscal year from FY2018 through FY2026 for the development of tools to advance energy sector security risk management and resiliency from human threats and natural hazards (including electromagnetic pulse and geomagnetic disturbances) programs.

Under the provisions in S. 1460 , the proposed programs would need to leverage existing programs and be consistent with goals of the 2011 Roadmap to Achieve Energy Delivery Systems Cybersecurity for developing a resilient energy sector infrastructure by 2020.

On July 18, 2017, the House passed the Enhancing State Energy Security Planning and Emergency Preparedness Act of 2017 ( H.R. 3050 ), which would authorize DOE to provide states $90 million in financial assistance annually through FY2022 to assess cybersecurity threats to energy infrastructure, among other possible uses of funding. The act would offer governors information and technical assistance in the development, implementation, or revision of a state energy security plan. Supporting such plans, especially with respect to cybersecurity, could fall under OE's purview.

Possible Issues for Congress

Several key issues related to OE's energy delivery cybersecurity program have been included in legislative proposals or have otherwise been the subject of congressional oversight and debate. These issues are summarized below.

OE Cybersecurity Funding

The Trump Administration's FY2018 budget request for OE appropriations was $123 million, approximately 41% less than the agency's estimated direct obligations of $208 million in FY2017. Within OE, the budget request would fund Cybersecurity for Energy Delivery Systems at $42 million compared to an estimated $62 million in FY2017, a reduction of approximately 32%. Given recent assertions by federal agencies (including DOE) and the private sector about an increase in energy sector cybersecurity risks, some analysts have expressed concern about this proposed reduction in OE's cybersecurity budget.

As noted above, the House and Senate appropriations bills would fund OE at $218.5 million and $213.1 million, respectively, both an increase from FY2017 funding. If OE's appropriation is enacted above its current level, the agency presumably could continue its current cybersecurity program on its current trajectory—and potentially fund some additional cybersecurity activities if they emerge as agency priorities. Additional authorizations under S. 1460 and H.R. 3050 , if enacted and funded, would significantly expand resources for DOE's energy delivery cybersecurity initiatives beyond historical levels. Given the ever-changing cybersecurity environment in the energy sector, Congress may continue to examine OE's cybersecurity resources to ensure that they are adequate and being deployed appropriately to address the most important energy delivery risks.

FAST Act Implementation

As discussed earlier, the FAST Act includes a variety of provisions concerning the general security of energy systems. These provisions include considerations for cyber as well as physical attacks and electromagnetic pulse attacks. The provisions include requirements for the Secretary of Energy to examine the strategic transformer reserve, coordinate energy sector security as the SSA, and prepare for energy supply disruptions. Congress may consider how effectively DOE is implementing the law, and whether additional authorities or changes to the law may be needed.

The FAST Act does not require the DOE Inspector General (IG), the Comptroller General, or another agency to review the implementation of DOE's authorities and its progress in carrying out the direction of Congress. However, Congress may still oversee DOE's efforts by holding hearings, requiring new reports from the IG or Comptroller General, or requesting specific reports or information from the agency itself. With DOE-provided or independently provided information, Congress may have a more-informed basis for considering whether to adjust the provisions of the FAST Act or clarify, expand, or contract the authorizations it contains.

Gas-Electric Cyber Interdependency

The operational interdependency of the electric power and natural gas sectors, especially with respect to reliability and cybersecurity, has been a growing concern among many federal agencies, Members of Congress, and industry groups. The second installment of DOE's Quadrennial Energy Review (QER), published in January 2017, states that

the electricity sector's increasing reliance on natural gas raises serious concerns regarding the need to secure natural gas pipelines against emerging cybersecurity threats. Thus, the adequacy of cybersecurity protections for natural gas pipelines directly impacts the reliability and security of the electric system.

Among its recommendations, the QER calls for assessment of natural gas and electricity infrastructure interdependencies to cybersecurity protection. Likewise, some Members of Congress have expressed concern about the increased interdependency of electric power and natural gas in the security context. The president of NERC reportedly also has expressed concern about the possibility of multiple natural gas facilities being intentionally disrupted, and the associated effects on the electric system.

Executive Order 13636 (§9) directs DHS, in consultation with the SSAs (e.g., DOE) and other relevant agencies, to examine and identify critical infrastructure at risk of causing a catastrophic impact due to a cybersecurity incident. It is not clear, however, whether the required risk analysis would only account for direct impacts to an infrastructure experiencing a cyberattack, or would include impacts to infrastructure with which it is interdependent. While a single electric or natural gas facility may not meet the criteria to be considered critical and vulnerable to a catastrophic cyber disruption, it is possible that the combination of direct and indirect impacts could elevate the potential risks associated with that facility. How OE's cybersecurity programs and expertise in energy delivery systems could best be used to inform such analysis may be of interest to Congress.

Energy Cybersecurity Coordination

In addition to DOE, other federal agencies, notably FERC and DHS (particularly TSA), state regulators, and energy companies have roles and responsibilities for the cybersecurity of the energy sector. However, federal coordination for sector cybersecurity appears fragmented among these entities depending on the nature of a given scenario. For instance, DHS is the lead for overall critical infrastructure protection and national cybersecurity incident coordination; it also has statutory authority to regulate pipeline security. However, DOE is the SSA for the energy sector, part of which is regulated by FERC and state agencies. Additionally, it is the private sector which adopts trade practices for ICS technology and contracts with ICS vendors for cybersecurity products and services. The effect of the dispersed cybersecurity responsibility at the federal level has been the subject of congressional interest, but has not been studied to understand the effect on all energy cybersecurity stakeholders. Congress may examine how OE's cybersecurity activities fit in, and coordinate with, the other various roles in energy cybersecurity for electricity, oil and natural gas pipelines, and other related energy infrastructure. In particular, Congress may examine how OE's RD&D programs and other work with the National Labs in electric power sector cybersecurity supports federal and private sector efforts in pipeline cybersecurity.

Appendix. Cybersecurity RD&D Projects