According to experts, a nuclear EMP is the burst of electromagnetic radiation resulting from the detonation of a nuclear device, which can disrupt or destroy electronic equipment. Nonnuclear EMP weapons can also be designed to intentionally disrupt electronics, but these generally have short range and are not a threat to multiple assets. The threat focused on primarily by the EMP Commission, and specifically addressed in this report, is the high-altitude EMP (HEMP). A HEMP event is caused by the detonation of a nuclear device above the atmosphere, from about 40 to 400 kilometers (approximately 25 to 250 miles) above the earth’s surface. A HEMP attack is not intended to cause direct physical impacts at the earth’s surface, such as injury or damage directly from heat, blast, or radiation, but instead creates an intense electromagnetic pulse that can disrupt computers and damage electronics and insulators, and could cause significant damage to critical electrical infrastructure, such as transformers. The components of EMP—commonly identified as E1, E2, and E3—can cause disruption and damage to electronic systems and electrical infrastructure. For example, the E1 component, or fast pulse, primarily disrupts or damages electronic-based control systems, sensors, computers, and similar devices, but may also adversely affect long-line electrical systems; the E2 component, similar to lightning, has the similar ability to impair or destroy control features that are not protected from lightning; and the E3 component is a subsequent, slower-rising, longer- duration pulse that creates disruptive currents in transmission lines, which causes grid instability and increases heat in transformers. If the E3 pulse is high enough and long enough it can result in grid collapse and potentially damage transformers. In addition to manmade EMPs, naturally occurring solar weather events of sufficient intensity can also cause electromagnetic impacts similar to the E3 pulse that can adversely affect components of the commercial electric grid, as well as other infrastructure such as satellites and undersea cables. The resulting impact of solar weather is commonly referred to as a geomagnetic disturbance (GMD). In 1989, a GMD caused wide-scale impacts on the Hydro-Quebec power system in Canada which caused this regional electric grid to collapse within 92 seconds and left 6 million customers without power for up to 9 hours. See appendix I for additional information on GMD events. See table 1 for an overview of electromagnetic threats and their primary effects. As noted in Presidential Policy Directive 21 (PPD-21), the energy and communications sectors are uniquely critical due to the enabling functions they provide to other critical infrastructure sectors. The U.S. electric power delivery system is a highly complex network of substations and electric lines that transport electricity from generators to residential, commercial, and industrial consumers. The U.S. electric grid has three main components: generation (creation of electricity), transmission (long haul transport of electricity), and distribution (shorter distances connecting the electricity to the consumer/end user). In November 2015, FERC reported that there are over 24,000 substations nationwide, connected by over 430,000 miles of transmission lines. Given the interdependency among infrastructure sectors, an EMP or major GMD event that disrupts the electric grid could also result in potential cascading impacts on fuel distribution, transportation systems, food and water supplies, and communications and equipment for emergency services, as well as other communication systems that utilize the civilian electrical infrastructure. PPD-21 also recognizes that DHS has numerous responsibilities to protect critical infrastructure, including such things as analyzing threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure. Within DHS, NPPD is responsible for working with public and industry infrastructure partners, and leads the coordinated national effort to mitigate risk to the nation’s infrastructure through the development and implementation of the infrastructure protection program. NPPD has two principal offices with responsibilities to facilitate protection of critical infrastructure that could be at risk from EMP and GMD events—the Office of Infrastructure Protection (IP) and the Office of Cybersecurity and Communications (CS&C). In addition, FEMA and S&T have roles related to addressing potential impacts to the electric grid, which could include EMP and GMD threats. The offices of Cyber and Infrastructure Analysis and I&A also help support related departmental activities. DOE also has a significant role as the sector-specific agency for the energy sector, which includes critical infrastructure and key resources related to electricity. For example, DOE is responsible for developing an Energy Sector-Specific Plan—in collaboration with other stakeholders, including DHS and energy sector owners and operators—that applies the NIPP risk management model to critical infrastructure and key resources within the sector. Within DOE, the Office of Electricity Delivery and Energy Reliability leads national efforts to increase the security and reliability of the energy infrastructure and facilitate recovery from disruptions to the energy supply. Legislation enacted in December 2015 further authorizes the Secretary of Energy, upon submission by the president of a written directive or determination identifying an electrical grid emergency, to issue orders for emergency measures necessary to protect or restore the reliability of critical electric infrastructure or of defense critical infrastructure during such an emergency and establishes the Secretary of Energy as the lead sector-specific agency for cybersecurity for the energy sector. DOE national laboratories also provide research support and technical expertise to federal and industry stakeholders regarding EMP and GMD impacts. Other principal federal agencies working to address the threat of EMP and GMD include DOD and FERC, as well as NOAA, the U.S. Geological Survey (USGS), and the National Aeronautics and Space Administration (NASA). Electrical infrastructure is primarily operated by private industry, which owns approximately 85 percent of the nation’s critical electrical infrastructure. Industry entities are represented, in part, through membership in industry associations such as the American Public Power Association, Edison Electric Institute, and National Rural Electric Cooperative Association. The North American Electric Reliability Corporation (NERC) also has authority to develop reliability standards to address the protection and improvement of the reliability and security of the electrical infrastructure. DHS, DOE and FERC have taken various actions to address electromagnetic risks to the electric grid, which generally fall under four categories: (1) standards, guidelines, tools and demonstration projects; (2) research reports; (3) strategy development and planning; and (4) training and outreach. Because federal agencies generally do not own electric grid infrastructure, federal actions to address GMD risks are more indirect through such things as developing standards and guidelines, and conducting research that could benefit electric grid owners and operators. Federal agencies have also been involved in strategy development and planning, as well as training and outreach efforts, as a means of preparing federal officials and others to respond to both EMP and GMD events, and enhancing knowledge about electromagnetic risks. For example, DHS S&T led the design and development of a prototype transformer that can be more easily transported to another location to help restore electric power in a timelier manner. DHS has also participated in various training and outreach events to enhance understanding of an EMP and GMD event. DOE’s primary efforts include supporting research to enhance the understanding of the potential impacts to the electric grid from electromagnetic events. Overall, DHS and DOE have led most of the federal actions addressing protection and mitigation efforts. They were also the key participants, with the White House Office of Science and Technology Policy (OSTP) and NOAA, in developing the National Space Weather Strategy and Action Plan issued in October 2015 along with support from a variety of federal departments and agencies. Table 2 below summarizes the key actions taken by federal agencies—most of which were conducted since 2012—that help to address electromagnetic risks. More detailed information on these individual activities is also included in appendix II. The actions recommended by the EMP Commission generally align with existing authorities and responsibilities of DHS and DOE relating to the protection of critical infrastructure, such as identifying key assets and analyzing risks, and as discussed above, DHS and DOE have taken actions to address some risks to the electric grid from electromagnetic events. Although DHS and DOE did not report that any of their actions were taken in response to the commission report, actions taken by both agencies have aligned with some of the recommendations. Specifically, the EMP Commission made seven recommendations related to the electric grid, most of which were directed to DHS and DOE. Of these seven recommendations, some of the actions that DHS and DOE took aligned with four of them. The seven EMP Commission recommendations related to the electric grid include the following: 1. conducting research to better understand infrastructure systems and 2. expanding activities to address the vulnerability of control systems, 3. identifying clear authority and responsibility to respond to an EMP 4. engaging federal and industry entities to determine liabilities and 5. establishing monitoring efforts and defining testing standards and 6. providing capabilities to help protect the electric grid from an EMP attack and recover as rapidly and effectively as possible, and 7. utilizing industry and governmental institutions to assure cost effective outcomes. DHS and DOE efforts to protect the electrical grid aligned with the first three recommendations noted above: conducting research to better understand the interdependencies of critical infrastructures, addressing the vulnerability of control systems to an EMP attack; and identifying responsibilities for responding to an EMP attack. They also aligned with the seventh recommendation, which includes 15 subparts, on utilizing industry and other governmental institutions to assure the most cost- effective outcomes. For example, with respect to the recommendation on conducting research to better understand interdependencies of critical infrastructures, DHS’s Sector Resilience Report: Electric Power Delivery includes some assessment of how various critical infrastructures— including the energy, communications, and transportation sectors, among others—are interdependent in maintaining operations. With regard to the last multipart recommendation identified above, DHS and DOE took some actions that aligned with 5 of the 15 subparts of this recommendation. Some of the sub-parts include such efforts as developing national and regional restoration plans and assuring the availability of critical communication channels, among other efforts. For example, DHS and DOE have actions underway to develop a Power Outage Incident Annex plan, which, according to DHS officials, is intended to provide incident-specific information regarding how the federal government plans to respond to and recover from a loss of power resulting from deliberate acts of terrorism or natural disasters, including an EMP or GMD event. In addition, a DHS entity developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control elements, such as Supervisory Control and Data Acquisition (SCADA) systems, from an EMP attack. For more detailed information regarding how identified federal actions align with these seven EMP Commission recommendations, see appendix III. DHS has not clearly identified internal roles and responsibilities for addressing electromagnetic risks to the electric grid or communicated these to external federal and industry partners. While multiple DHS components and offices, including NPPD, FEMA, and S&T, have each conducted independent activities addressing electromagnetic risks to the electric grid, none have been tasked with lead responsibility for coordinating related activities within the department or with federal and industry stakeholders. As a result, we experienced ongoing challenges in identifying applicable DHS personnel and related departmental actions. For example, NPPD officials had difficulty identifying their specific roles and activities addressing electromagnetic risks to the electric grid, including efforts to collect or synthesize available risk information to provide input into department-wide risk assessments, such as the Homeland Security National Risk Characterization (HSNRC). An official within NPPD/CS&C subsequently provided information to us regarding applicable activities conducted as part of his role leading efforts to help safeguard communications and information/control system capabilities in the event of EMP-related attacks or disasters. However, this official was initially identified to us by a non-DHS stakeholder and several other DHS entities that we interviewed regarding related efforts to address electromagnetic events lacked awareness of these activities. Further, DHS officials did not identify any DHS representatives or offices as having broader designated responsibility for performing key oversight or coordination roles regarding electromagnetic risks within DHS’s overall infrastructure protection efforts, including activities intended to help address risks to the electrical grid. Furthermore, industry representatives and other federal officials told us it is not clear who within DHS is responsible for addressing electromagnetic risks. One major industry association reported that although senior DHS officials participated in some collaborative bodies, such as the Electricity Subsector Coordinating Council, association representatives were unable to identify applicable DHS representatives at a working level because there was generally limited engagement with industry on these issues. In contrast, industry representatives stated that other key agencies, including DOE and FERC, have recognized offices and points of contact that were knowledgeable about electromagnetic issues of concern to the industry. Some industry officials also commented that having clarity about the DHS contacts was critical because DHS may be best positioned to serve as a liaison between them and DOD, which generally does not interact directly with industry on these issues. DOE officials also indicated that they did not know whom at DHS they should contact with regard to requesting related information, such as specific DHS research reports related to electromagnetic risks. The Energy Sector-Specific Plan, which is guided by the NIPP, highlights the importance of identifying clear roles and responsibilities in achieving goals and objectives in security programs and emergency response planning. According to the Energy Sector-Specific Plan, stakeholders should clearly understand their respective roles and responsibilities, and plan to integrate their independently executed roles to achieve a common set of infrastructure protection outcomes. The 2008 EMP Commission report also recommended that DHS make clear its authority and responsibilities, as well as delineate the functioning interfaces with other governmental institutions, regarding EMP response efforts. Standards for Internal Control in the Federal Government also cite this principle, stating the importance of ensuring that authority and responsibility are clearly assigned throughout the organization. According to officials within the DHS Office of Policy, addressing EMP risks has generally been a lower priority compared to other risks due to a combination of differing opinions on the likelihood of these events and their expectation that other federal agencies will be involved in responding to an electromagnetic event. For example, DHS officials noted that the nature of an EMP attack would constitute an “act of war” that would generally be included within DOD’s mission. According to a senior DHS official, in the case of an EMP attack, it is likely that DOD would serve in the principal role of identifying our adversaries and taking applicable defensive or retaliatory actions; however, DHS and DOE are designated in the NIPP as the key federal entities responsible for efforts to protect the electric grid and recover from such an attack. DHS acknowledged this responsibility through its inclusion of EMP as a risk event in the 2015 update of the Strategic National Risk Assessment (SNRA), noting that damage from a deliberate attack on the grid could cause cascading impacts through other infrastructure systems, leading to economic disruption and the potential loss of life. The growing recognition of GMD as a significant risk event requiring the collaborative efforts of multiple federal agencies and industry stakeholders, to both prepare for and respond to, underscores the concerns that industry and other officials have raised about DHS’s roles and responsibilities being clearly designated. In recent years, there has been a growing consensus among federal agencies, industry representatives, and independent researchers that a major GMD event could have significant impacts on the nation’s electric grid and is probable enough to warrant federal action. For example, the recent National Space Weather Strategy and Action Plan, issued by the White House in October 2015, and ongoing development of the FERC GMD reliability standard further exemplify the growing recognition of GMD as a significant risk event that requires the collective expertise of multiple federal agencies, as well as applicable industry partners. Designating internal roles and responsibilities within DHS regarding electromagnetic risks and communicating these to federal and industry partners could provide additional awareness of related activities and help ensure more effective and coordinated engagement with other federal agencies and industry stakeholders. The lack of clarity regarding DHS activities to address electromagnetic risks also increases the risk of potential duplication, overlap, or fragmentation within the department or across federal agencies. Officials from the DHS Office of Policy agreed that enhanced internal coordination among DHS entities could be beneficial and noted that there are actions currently underway to establish a Cyber, Infrastructure, and Resiliency group within the Office of Policy that could potentially facilitate further coordination efforts. DHS and DOE have not taken actions to identify key electrical infrastructure assets as required given their respective critical infrastructure responsibilities under the NIPP. Specifically, as the two primary federal entities responsible for addressing key risk management objectives outlined in the NIPP related to the energy sector, DHS and DOE have important roles in determining the extent to which critical infrastructure assets are adequately identified and all applicable information is included in related analyses. For example, the NIPP explicitly states that to manage critical infrastructure risk effectively, partners must identify the assets, systems, and networks that are essential to their continued operation, considering associated dependencies and interdependencies of other infrastructure sectors. Further underscoring the importance of identifying critical electrical infrastructure assets, a DOE-sponsored November 2015 report developed by the Idaho National Laboratory also emphasizes the need to identify the grid facilities most critical to restoration and recovery to prioritize those assets which should be protected from EMP effects, citing that it is not feasible or cost-effective to protect all infrastructure assets across the electricity sector. The 2008 EMP Commission report also specifically recommended that DHS and DOE prioritize nodes that are critical for the rapid recovery of other key sectors that rely upon electricity to function, including those assets that must remain in service or be restored within hours of an EMP attack. Notwithstanding these responsibilities, DHS and DOE did not report any actions taken to identify critical electrical infrastructure as part of risk management efforts for the energy sector. In response to our July 2015 testimony citing limited DHS activities to identify applicable electrical infrastructure assets, DHS stated that it was aware of a study that FERC had conducted that identified critical electrical substations and cited potential duplication as the reason for why DHS did not conduct any additional related efforts. The study, which FERC staff conducted in 2013, utilized network modeling to identify critical substations that FERC deemed significant enough to produce wide area outages across the U.S. power grid. According to FERC, the analysis was conducted, in part, to engage with owners and operators of those facilities to encourage the use of cyber and physical security best practices. While the FERC study provided data that could help inform further analysis of critical electrical infrastructure assets, FERC officials did not indicate their analysis was intended to address specific critical infrastructure responsibilities laid out in the NIPP. Moreover, while FERC’s study remains a positive step toward identifying select critical electrical infrastructure assets and addressing the EMP Commission’s recommendations, it did not solicit participation from other federal agencies, including DHS and DOE. Given the significant critical infrastructure responsibilities and expertise of these agencies, this lack of participation may have diminished the potential robustness of the study. For example, DOE officials stated that the FERC study did not include an analysis of “blackstart” capability, which DOE officials believe may be another important element that should be considered when analyzing the criticality of electrical generation facilities. Blackstart capability indicates that a facility can resume operations without reliance on external power sources—a capability that is important in the aftermath of an electrical grid shutdown. As the designated sector-specific agency, DOE has valuable expertise that could be useful based on their broad understanding of the bulk-power system, load factors, and specific asset characteristics that may be important to consider when determining the key elements of criticality that should be evaluated. In addition, DHS has specific expertise related to infrastructure dependencies that may be helpful to identify potential cascading impacts to other assets or systems resulting from electrical power outages that should be considered. Both DHS and DOE acknowledged that further collaborative efforts to assess critical electrical infrastructure could be beneficial; however, as of November 2015, neither DHS nor DOE have reported on any efforts to review the 2013 FERC study or collaborate further to jointly determine the key elements of criticality that they believe should be considered when evaluating the vast array of infrastructure assets constituting the U.S electric grid. The extensive size and scope of the electric power system necessitates collaboration among partners to ensure all individual expertise is effectively leveraged. For example, a senior FERC official testified in July 2015 that determining which of the substations nationwide are the most critical depends on the outcome one is pursuing. The official noted that if grid stability and continuity is the desired outcome, then a relatively small set of substations (in the hundreds) could be considered critical; however, if preserving power supply to specific DOD or nuclear power station is the desired outcome, then an additional collection of substations would need to be included. The NIPP also notes that critical infrastructure partners may view criticality differently, based on their unique situations, operating models, and associated risks. Leveraging additional DHS and DOE expertise could help to ensure that all key elements of criticality are reflected in the results of FERC’s study. Our work on federal agency collaboration supports this approach as well, noting that it is important to ensure that all of the relevant participants have been included in the collaborative effort. Reviewing FERC’s analysis and collaboratively determining the extent to which further assessment of critical electrical infrastructure may be needed would provide DHS and DOE an opportunity to contribute their unique knowledge and expertise, as well as better ensure that NIPP responsibilities are adequately addressed and all applicable elements of criticality are being considered. Although DHS components have independently conducted some efforts to assess electromagnetic risks as identified above, the department has not fully leveraged available risk information or conducted a comprehensive analysis of these risks. Within the DHS Office of Policy, there is recognition that “space weather” and “power grid failure” are significant risk events, which DHS officials have determined pose great risk to the security of the nation. However, these officials were unable to provide detailed information about the specific risk inputs—namely threat, vulnerability, and consequence information—that were used to assess how electromagnetic events compared to other risk events, or how they were used to inform DHS’s applicable risk-management priorities. Further, officials within NPPD were unable to identify any specific actions taken or plans to systematically collect or analyze risk information regarding electromagnetic impacts to the electric grid as part of department-wide risk assessment efforts. According to experts, with respect to threat, there is a distinction between GMD and EMP regarding the ability to assess the probability of occurrence. In the case of GMD, space weather researchers currently estimate a 6 to 12 percent chance that a Carrington class storm—a solar storm comparable in size to the largest on record—is likely to hit the earth in the next 10 years. The potential threat was recently illustrated in July 2012, when a Carrington class solar storm missed the earth by approximately 1 week, as the storm occurred on the far side of the sun facing away from the earth. In contrast, assessing the threat of an EMP attack remains more difficult given that analysts have to also account for human factors that can increase the level of uncertainty. Specifically, within the 2011 SNRA, DHS notes that incomplete knowledge of adversary capabilities and intent are sources of uncertainty regarding the frequency of some risks. Although DHS components identified multiple efforts to support the collection of information regarding the threat of GMD, DHS identified a more limited range of efforts to collect threat information regarding potential EMP attacks. I&A officials indicated that while there is no dedicated Center of Excellence within the Intelligence Community on EMP, there is subject-matter expertise available from analysts in related mission areas, such as chemical, biological, radiological, and nuclear issues. CS&C representatives further noted that a group of analysts in that office routinely monitor classified intelligence sources for EMP- related threat information, such as those available through the Joint Worldwide Intelligence Communications System. However, some additional opportunities may exist to leverage EMP threat information through I&A or direct collaboration with DOD, DOE, or other intelligence sources. For example, classified analytical products are available that address specific components of threat, such as assessment of EMP- related missile technologies, which could serve as an important input regarding adversary capabilities as part of DHS’s overall assessment of electromagnetic threats. Although I&A officials have direct access to these materials, neither I&A nor NPPD officials identified efforts to specifically leverage this information as part of any department-wide risk- assessment efforts. However, I&A officials noted that they remain well- positioned to pursue additional collection and analysis of EMP-related information through the Intelligence Community, if tasked to do so by NPPD. Acquiring more comprehensive information on potential EMP threats may be helpful because, as one EMP expert stated in recent testimony, there are misconceptions regarding the nature and impact of potential EMP attacks, which may have a negative effect on the ability of stakeholders to determine reasonable steps needed to protect critical infrastructure and mitigate potential impacts. One industry association further noted that the lack of threat information regarding EMP attacks makes it more difficult for their members to justify to their management, shareholders, or regulators the need for investments in EMP protective measures. DHS components have also conducted some research efforts to better understand the impacts to electrical infrastructure from EMP or GMD events; however, opportunities exist to leverage additional information through existing DHS programs and enhanced collaboration with federal partners. While the NPPD Office of Infrastructure Protection (IP) conducts various assessments to identify vulnerabilities, interdependencies, and potential cascading impacts across different sectors of the nation’s critical infrastructure, these have generally not been utilized to obtain specific information about vulnerabilities or consequences related to EMP or GMD events. Examples include the following: Infrastructure Survey Tool (IST). Through this program, IP administers survey questions to asset owners across all critical infrastructure sectors about key dependencies on utilities, including the supply of electric power. However, DHS officials did not identify any efforts to utilize this information to develop any specific consequence assessments associated with potential cascading impacts of a widespread power grid failure, which could be caused by an electromagnetic event. According to DHS, over 300 IST’s have been conducted at electrical substations since 2009 but, as of November 2015, the survey does not include any questions to capture the extent to which any specific protective equipment or mitigation measures may have been employed to address electromagnetic vulnerabilities. Regional Resiliency Assessment Program (RRAP). DHS identified three RRAP projects—of the 56 conducted since 2009—in which an EMP or GMD risk was considered, among other risk events. DHS used summary information it obtained from these assessments (and other IP site visits) to inform products such as the June 2014 Sector Resiliency Report: Electric Power Delivery. However, NPPD did not identify any efforts to utilize RRAP findings to develop more rigorous vulnerability or consequence analyses. For example, RRAP findings could help inform more detailed modeling of sector interdependencies, as called for by the EMP Commission, or serve as input to the identification of critical electrical infrastructure assets that could be impacted by electromagnetic events. Further, our review of a resiliency assessment from one of the three applicable RRAP projects indicated that although an EMP or solar storm was used as one of several threat scenarios that could disrupt the infrastructure assets of focus, there was limited discussion about specific asset vulnerabilities to such an event or identification of any additional information needed to inform future analysis. Defense Critical Infrastructure Program. This DOD program is conducted to assess infrastructure and other key military assets in the United States using a range of threat scenarios including EMP events. Among other functions, these assessments identify critical assets and identify vulnerabilities, including dependence on the commercial electric grid. Such information could assist DHS in efforts to identify critical substations supporting DOD facilities and further inform risk- assessment activities. Although DOD officials indicated some collaboration with DHS Protective Security Advisors when RRAP projects are conducted in areas with applicable defense assets or installations, they reported that DHS and DOD had not coordinated to review the results of DOD’s assessments under the Defense Critical Infrastructure Program. Collecting and utilizing risk information obtained through the above programs could help DHS to better understand the specific consequences across different sectors that may result from long-term electrical power outages, and may contribute to efforts to identify critical electrical infrastructure and asset protection priorities. For example, further collection of information on sector interdependencies could help DHS to assess the potential economic consequences associated with long-term power outages. Assessment of direct and indirect economic consequences is currently limited but could be useful to help determine relative risk rankings and provide information to help assess the cost- effectiveness of various mitigation strategies. Further, a more comprehensive assessment of vulnerability and consequences may help inform broader DHS risk assessment efforts, including the HSNRC. These vulnerability and consequence inputs are key components to help ensure that the HSNRC can be effectively utilized to identify the relative rankings of various risk events, including other threats to the electrical grid, such as physical or cyberattack. According to officials within the DHS Office of Policy, the original HSNRC process conducted in 2012-2013 included estimates of broad consequences for 40 individual risk events. However, officials noted that certain categories, such as loss of life, were primary factors in designating selected risk events as priorities for further analysis. These officials also reported that given limited information about the specific consequences likely to result from an EMP event, DHS instead utilized proxy consequence information from an analytical study of a major regional earthquake that would be expected to cause damage to a wide range of critical infrastructure including electrical power operations. However, this postulated event—which included an estimate of approximately 86,000 injuries and fatalities across the 8-state study region—is unlikely to be on par with an EMP attack that, according to experts, could include the extended disruption of electric power and cascading impacts to other critical infrastructure across much of the United States. According to the NIPP, to assess risk effectively, critical infrastructure partners—including owners and operators, sector councils, and government agencies—need timely, reliable, and actionable information regarding threats, vulnerabilities, and consequences. Under the NIPP, DHS’s responsibilities include establishing and maintaining a comprehensive, multitiered, and dynamic information-sharing network designed to provide timely and actionable threat information, assessments, and warnings to public- and private-sector partners. In addition, the Quadrennial Energy Review specifically notes the importance of applicable threat information, stating that incomplete or ambiguous threat information may lead to inconsistency in physical security among grid owners, inefficient spending of limited resources at facilities, or deployment of security measures against the wrong threat. The Quadrennial Energy Review also states that, in regard to critical high- voltage transformers, current programs to address vulnerability may not be adequate to address the security and reliability concerns associated with simultaneous failures of multiple high-voltage transformers. Moreover, according to subject-matter experts, the impact to the electric grid from electromagnetic threats may vary substantially by location, network and operating characteristics, and other factors. For example, key reports on GMD indicate that high-voltage transformers located at higher latitudes in the United States are likely subject to increased potential for adverse impacts from GMD events than those at lower latitudes. However, this is not the case with EMP, which may have impacts equal to or greater than GMD in any latitude of the United States. Additionally, an EMP would subject infrastructure assets to a combination of E1, E2, and E3 effects compared to GMD which only produces impacts similar to the E3 effect. Federal and industry researchers have also noted that given these distinct effects and the different types of mitigation efforts necessary to protect against them, more comprehensive risk information may be necessary to evaluate their unique impacts to the electric grid. The electric grid remains vulnerable to other potential threats, such as physical and cyberattacks, which each present unique vulnerabilities to assess. Better collection of threat, vulnerability, and consequence information through existing DHS programs and strengthened collaboration with federal partners could help DHS better assess the relative risk ranking of electromagnetic events versus other risks and help determine potential protection priorities to address identified vulnerabilities. Key federal agencies, including DHS and DOE, as well as industry partners have not established a fully coordinated approach to identifying and implementing risk management activities to address EMP risks. According to the NIPP Risk Management Framework, such activities include identifying and prioritizing research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. The publication of the National Space Weather Action Plan in October 2015 identified many key federal activities in these areas regarding the GMD risk; however, no similar efforts have been proposed regarding EMP risks to the electric grid. There are several areas of EMP research highlighted in previous studies where coordinated federal involvement could help address identified gaps and further inform risk assessment efforts. For example, a recent effort funded by DOE—and conducted by Idaho National Laboratory (INL)— identified the need for updated research and analysis regarding the likely impacts of the E1, or early time pulse, of an EMP event. According to the report, most information sources on the impact of EMP E1 to electric power grids are decades old, include only observational information, and do not account for modern grid technologies and electronic control systems. For example, the report states that assessing the effectiveness of routinely recognized protective actions such as shielding equipment in faraday cages remains difficult given the limited experimentation data available, outside of DOD. As a result, the report notes that the electric power industry may not have sufficient information regarding EMP effects to design adequate protections. Overall, the report concludes that there are more unknowns than knowns regarding EMP effects and mitigation, and recommends that the government collect additional data on E1 threats, their impact to the electric grid, and potential mitigation measures. A 2013 white paper developed by a leading research organization for the electric industry also reported a lack of widespread and coordinated research and development efforts to protect and mitigate effects of EMP attacks against the commercial electric grid. Among the specific actions identified is a recommendation for stakeholders to define key characteristics of an EMP event—such as potential altitudes of detonation—for further study of corresponding impacts. According to this paper, and representatives from an individual utility we interviewed, the lack of more specific parameters for determining potential EMP effects makes it difficult to develop applicable protective guidelines and equipment design specifications. However, FERC officials noted that additional work is being done outside of the United States to further develop applicable standards and implement equipment designed to mitigate the effects of or protect against EMP risks. Further research and development efforts on EMP effects could also include evaluation of the impacts of additional devices intended to disrupt or destroy electrical infrastructure or control systems, such as intentional electromagnetic interference. Updated information on the specific electromagnetic effects of EMP events or intentional electromagnetic interference weapons could help ensure that protective and mitigation efforts are designed to be effective for multiple threat scenarios. Similarly, any proposed mitigation strategies resulting from efforts to address GMD, including the National Space Weather Action Plan, could also consider how effective these strategies might be against a potential EMP attack so that fully informed investment decisions can be made. For example, as one EMP expert noted in recent congressional testimony, if designing protective equipment to withstand specified levels of E3 effects from an EMP attack, there may be collateral benefits for providing protection against GMD effects; however, the reverse may not be true. That is, protecting against identified benchmark levels of GMD may not prove sufficient to protect against EMP E3 impacts. Another potential area for additional federal collaboration involves further research and evaluation of protective equipment intended to help mitigate the impacts of an EMP event. Such research, also identified in the 2008 EMP Commission report, may include further evaluation of EMP hardening or shielding strategies, as well as specific testing of commercial products intended to protect or mitigate the effects of EMP attacks on key infrastructure assets, such as transformers. Government and industry stakeholders cite potential adverse operational impacts that may result from the use of such devices as a reason for not retrofitting existing assets. According to one major electrical industry association, EMP impacts on the electric grid are not fully understood and many EMP mitigation techniques involve significant investment and remain unproven. Further evaluation of the effectiveness of these types of products may help to inform government and industry cost-benefit analyses and provide more sound estimates on the potential costs associated with implementation of various protective measures across the electric grid. A lead researcher within DOE stressed that sound science is required to help inform any federal efforts to establish standards and protective guidelines intended to address the potential impacts of EMP. DOE officials further stated that assessing the cost-effectiveness of select EMP or GMD protective measures could also help state public utility commissions determine whether the cost of such measures can be included in base utility rates. In addition to bringing additional information and expertise to the table, enhanced engagement by key federal agencies could present opportunities for stakeholders to jointly fund and develop collaborative research projects. Among a few potential examples identified by government and industry stakeholders would be additional research and testing conducted at DOE National Laboratories or even possible pilot projects performed at government-operated utilities. The NIPP calls for the implementation of risk-management activities, which includes research and development to reduce vulnerabilities that have proven difficult or expensive to address. Additionally, the Energy Sector-Specific Plan states that energy-sector partners such as DHS and DOE are to pursue a focused, coordinated management approach that aligns current activities to research and development goals and milestones, initiates specific projects to address critical gaps, and provides a mechanism for collaboration, project management, and oversight. This approach aims to develop clearly defined activities, projects, and initiatives with time-based deliverables that are tied to priority research and development requirements. Given the limited experimental data regarding EMP effects on the electric grid, additional collaboration among government agencies and industry regarding EMP- related research and development could help fill existing information gaps and help better understand EMP effects on the electrical grid. DHS officials and industry representatives noted that some discussion of EMP, including areas for additional research, has been conducted within forums such as the Electricity Subsector Coordinating Council, but that it has not surfaced as a key priority. In addition, DHS officials stated that an EMP attack generally remains a lower risk priority compared to other risk events with higher probability such as natural disasters or cyberattacks. However, as discussed previously, it is not clear that DHS has assessed all available risk inputs regarding EMP events to develop fully informed relative risk rankings. Officials also noted that efforts to comply with Office of Management and Budget Circular A-11—which calls for executive-branch departments to adopt an enterprise risk- management approach—contributes to decisions regarding which operational risks to address given limited resources. Officials stated that, as a result, operational risks, such as counterterrorism and counterdrug efforts, remain higher priorities for the department than EMP and solar weather events, because these events represent a better opportunity for DHS to maximize its return on investment. DOE officials also noted resource limitations and competing priorities as the key driver for not pursuing additional risk management activities specifically related to EMP events. However, DOE officials concurred that there is potential for enhanced collaboration with other federal agencies and industry stakeholders regarding identification of future research needs and priorities related to EMP. Even if an EMP attack is not determined to be among the highest resource priorities for DHS and DOE relative to other risk events, there are opportunities for enhanced collaboration among federal agencies and industry stakeholders to address identified gaps and help ensure that limited resources are more effectively coordinated and prioritized. Better identification and implementation of key risk-management activities, including collaborative identification and support of research and development priorities, may help close some of the gaps identified regarding EMP events and provide the groundwork necessary for a more robust research-based evaluation of additional protection and mitigation options. Given the foundational importance of electrical power to support other critical infrastructure sectors such as communications and transportation, not securing the electric grid from electromagnetic events could result in the loss of electrical services essential to maintaining our national economy and security. Recognizing this possibility, federal agencies have taken a range of actions since 2008—when the EMP Commission report was issued—to provide guidance, conduct research, develop strategies and plans, and participate in training, among other things, to address electromagnetic risks to the electric grid. Although DHS’s and DOE’s actions were not taken directly in response to the EMP Commission’s recommendations, they do align with their respective critical infrastructure protection responsibilities in law and policy, including under the NIPP. However, DHS could take additional actions to help address risks to the electric grid. Designating roles and responsibilities within DHS regarding electromagnetic risks could help ensure enhanced awareness of related activities within the department and improve coordination with other federal agencies and industry stakeholders. Once clear roles and responsibilities are established and communicated, DHS and other federal agencies will be better positioned to leverage their respective expertise to inform future actions. One area in particular, where this collective expertise could be more fully leveraged is in determining the nation’s critical electric infrastructure assets. Although FERC conducted a related analysis, it was completed without collaboration and input from DHS and DOE entities, and as a result opportunities may have been missed to leverage their unique knowledge and expertise. Additional collaboration to review FERC’s analysis and determine whether further assessment is needed could help ensure that all applicable elements of criticality are being considered. While DHS recognizes that both space weather and power grid failure are risk events that can affect the nation’s security, there are additional opportunities for DHS to collect key risk inputs, such as further collaboration with DOD to obtain applicable EMP threat, vulnerability, and consequence information. Additional data collection could also inform DHS’s broader risk-assessment efforts to better determine the relative risk ranking of electromagnetic threats compared to other potential risks— a key factor in ensuring that protection and resource allocation priorities are appropriately considered and resourced. Lastly, given the potentially significant impacts that an EMP attack would have on the electric grid and the potential cost of additional protective measures to mitigate against electromagnetic impacts, federal entities could better coordinate to identify and implement key EMP risk management activities. Such activities, including collaborative identification and support of research and development priorities, may help close some of the gaps identified regarding EMP events and provide the groundwork necessary for a more robust research-based evaluation of additional protective efforts. To enhance accountability for key risk-management activities and facilitate coordination with federal and industry stakeholders regarding electromagnetic risks, we recommend that the Secretary of Homeland Security designate roles and responsibilities within the department for addressing electromagnetic risks and communicate these to federal and industry partners. To more fully leverage critical infrastructure expertise and address responsibilities to identify critical electrical infrastructure assets as called for in the NIPP, we recommend that the Secretary of Homeland Security and the Secretary of Energy direct responsible officials to review FERC’s electrical infrastructure analysis and collaborate to determine whether further assessment is needed to adequately identify critical electric infrastructure assets, potentially to include additional elements of criticality that might be considered. To enhance federal efforts to assess electromagnetic risks and help determine protection priorities, we also recommend that the Secretary of Homeland Security direct the Under Secretary for NPPD and the Assistant Secretary for the IP to work with other federal and industry partners to collect and analyze key inputs on threat, vulnerability, and consequence related to electromagnetic risks—potentially to include collecting additional information from DOD sources and leveraging existing assessment programs such as the IST, RRAP, and DCIP. To facilitate federal and industry efforts to coordinate risk-management activities to address an EMP attack, we recommend that the Secretary of Homeland Security and the Secretary of Energy direct responsible officials to engage with federal partners and industry stakeholders to identify and implement key EMP research and development priorities, including opportunities for further testing and evaluation of potential EMP protection and mitigation options. We provided a draft of this report to DHS, DOE, DOD, NOAA, and FERC for their review and comment. DHS and DOE provided written comments, which are reproduced in appendices IV and V. In their comments, DHS and DOE concurred with each of the recommendations made to their respective departments and described actions underway or planned to address them, including applicable timeframes for completion. If fully implemented, these actions should address the intent of the recommendations and better position DHS and DOE to further support federal and industry efforts to help protect the U.S. electric grid from electromagnetic events. For example, in regards to designating applicable roles and responsibilities within the department, DHS noted that the Cyber, Infrastructure, and Resilience Policy Office within the DHS Office of Policy is currently developing its portfolio to further support electromagnetic risks. Specific actions identified to be completed by December 2016 include coordination across the department to identify and document applicable roles and responsibilities regarding electromagnetic issues to ensure full mission coverage while minimizing potential overlap or redundancy. In regards to engagement with industry stakeholders to identify and implement key research and development priorities, DHS and DOE each identified actions to convene applicable stakeholders to jointly determine mitigation options and conduct further testing and evaluation. DOE also identified that the department is working with EPRI to develop an EMP Strategy that lays out applicable goals and objectives. According to DOE, the EMP Strategy is scheduled for completion by August 31, 2016, and is to be followed by a more detailed action plan identifying R&D priorities and specific opportunities to test and evaluate EMP mitigation and protection measures. DHS, DOE, NOAA, and FERC also provided technical comments, which we incorporated as appropriate. DOD did not provide comments on this report. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretaries of Commerce, Defense, Energy, and Homeland Security, and the Chairman of the Federal Energy Regulatory Commission. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. According to research reports developed by subject-matter experts that we reviewed, geomagnetic disturbances (GMD) occur when the sun ejects charged particles that interact with and cause changes in the earth’s magnetic fields. These charged particles typically reach the earth within 18 to 96 hours and can cause currents to enter the power system through long conductors, such as transmission lines. These currents can disrupt the normal operation of the power system and, in some cases, damage equipment such as transformers. Specific characteristics of the U.S. electric grid also make it potentially more vulnerable to GMD impacts. For example, the grid is located in northern latitudes, which is closer to the aurora of a geomagnetic storm, and near oceans which are filled with conductive salt water. The Space Weather Prediction Center operated by the National Oceanic and Atmospheric Administration (NOAA) conducts continuous monitoring of solar activity and provides applicable watches, warnings, and alerts to stakeholders, including the electric power industry. If staff forecast that a coronal mass ejection is earth-bound, NOAA issues a watch that provides a 1 to 4 day notice that a geomagnetic storm is expected. Once the Deep Space Climate Observatory (DSCOVR) satellite—located 1 million miles from the earth—measures and provides data about the characteristics of the storm, forecasters can provide alerts between 15 to 60 minutes in advance of the storm hitting the Earth. These alerts may also include an index figure that describes the strength of the impending storm according to specific thresholds. Since 1859, scientists have observed GMD impacts on the earth. The following table describes notable GMD events and their respective impacts on electrical grid assets. Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken an array of actions aimed at addressing electromagnetic risks to the electric grid. Because federal agencies do not own electrical grid infrastructure, their actions to address geomagnetic disturbance (GMD) threats are more indirect through such things as developing standards and guidelines and utilizing tools and demonstration projects. Specifically, federal agencies have taken steps to develop standards and guidelines. For example, the North American Electric Reliability Corporation (NERC) has begun the process of developing GMD reliability standards for FERC to review, and DHS has developed electromagnetic pulse (EMP) protection guidelines to safeguard critical assets and facilities. Below is a summary of these efforts and other actions taken by DHS, DOE, and FERC since 2013. Collectively, these actions are intended to protect critical infrastructure from both EMP and GMD events. GMD Reliability Standards Rulemaking Process. In May 2013, FERC directed a two-phase approach for NERC to develop reliability standards that address the impact of GMD on reliable operation of the bulk-power system. For the first phase, NERC developed and FERC approved a reliability standard that requires responsible entities to develop and implement operational procedures to mitigate the effects of GMD on the bulk-power system. The second phase, which is ongoing, is intended to provide more comprehensive protections by requiring responsible entities to protect their facilities against a benchmark GMD event. On January 21, 2015, NERC submitted to FERC a proposed second stage reliability standard that included a definition of a benchmark GMD event against which industry would have to assess and mitigate vulnerabilities. On May 14, 2015, FERC issued a Notice of Proposed Rulemaking seeking comments on NERC’s proposal to approve, as well as its proposed modifications to the reliability standard, and other issues. Public comments on the Notice were due near the end of July 2015, and FERC extended the comment date two additional times in response to developments in the record. As of January 2016, FERC had not issued a final rule. EMP Protection Guidelines. In November 2014, DHS developed guidelines to help federal agencies and industry identify options to protect critical equipment, facilities, and communication and data centers from various forms of EMP attacks, including High-Altitude EMP (HEMP), ground burst Source Region EMP, solar geomagnetic disturbances, and other Intentional Electromagnetic Interference, such as from radio frequency weapons. These guidelines include four levels of protection that are based on using specific devices, such as EMP-capable surge arresters on power cords to mitigate EMP vulnerabilities. Solar Storm Mitigation. In 2014, DHS led an effort to develop a forecasting tool that will enable more localized and precise geomagnetic induced current (GIC) forecast levels. In coordination with the National Aeronautics and Space Administration (NASA) and National Oceanic and Atmospheric Administration (NOAA), among others, DHS intends to provide utility owners and operators with timely and accurate GIC forecast information, allowing them to make key operational decisions, such as shutting down, reducing power, or rerouting power to minimize the impact of a GIC event. DHS expects to complete this joint effort in fiscal year 2016. Installation of Magnetometers. In 2014, DOE funded an initiative to gather additional data on GIC and magnetic fields to help scientists validate models and develop more accurate estimations and modeling. As of October 2015, DOE reported plans to add 12 magnetometers to supplement the existing 6 that United States Geological Survey (USGS) has deployed nationwide. Two of those 12 will be fully funded by industry while 10 will be funded through a cost- share program between DOE and industry. These magnetometers are intended to provide owners and operators with real-time data on the expected currents that may impact their transformers. DOE officials added that this is a less costly alternative to deploying more monitors on transformers to measure actual currents during a GMD. Recovery Transformer (RecX). In 2012, DHS Science & Technology (S&T), with support from DOE and electricity sector representatives as part of the sector specific plan, partnered with industry to develop three prototype single-phase, extra-high-voltage transformers that could significantly reduce the time to transport, install, and energize a transformer to reduce recovery time from power outages associated with transformer failures from several months to less than 1 week. S&T, along with industry partners, piloted the RecX prototype for 2.5 years. DHS reported that RecX proved to be successful in an operational environment and could potentially reduce the impact of power outages. Resilient Electric Grid (REG). In 2007, S&T partnered with industry to develop a fault current limiting high temperature superconducting cable that allows power substations to interconnect and share power in an internet-like fashion enabling multiple paths for power to flow while mitigating the risk of cascading fault currents. The cable system enables re-architecting urban area distribution grids to allow power to be rerouted in emergencies and will facilitate rapid and resilient recovery for grid outages. A prototype cable will be deployed in the grid in New York for a pilot demonstration. S&T is also evaluating a commercial scale deployment of the technology in downtown Chicago. Key federal agencies, specifically DHS and DOE, have developed research reports to better understand the potential impacts of electromagnetic threats. Since 2007, DHS and DOE have developed or commissioned 17 key research reports addressing both EMP and GMD events. Some of the DHS-commissioned reports, authored by external industry experts, focused primarily on analyzing the impacts of EMP threats, including HEMP and Source Region EMP, while others assessed the potential impact of GMD events, including solar superstorms. Specifically, one DHS-commissioned report identified three main approaches to lessen the impact of a severe geomagnetic storm. That report concluded that thorough research, testing, and cost analysis will be required to determine the best approach. Three of DHS’s additional research reports are highlighted below. Electromagnetic Pulse Impacts on Extra High Voltage Power Transformers. This 2010 report analyzed the potential impact of an EMP on extra high voltage transformers—focusing primarily on transformer equipment designs and identifying specific mitigation efforts such as blocking devices that minimize the impact of GIC on the electric grid. The report concluded that the similarity of EMP effects, regardless of source, indicates that solar weather provide a useful basis for transformer impact analysis and that selective installation of blocking devices would minimize the impacts of GIC on transformers, among other findings. Impacts of Severe Space Weather on the Electric Grid. This 2011 report assessed the impacts of space weather on the electric grid, seeking to understand how previous solar storms have affected some electric grids, and what cost-effective mitigation efforts are available to protect the electric grid, among other topics. Some of the key findings and recommendations include the need for a rigorous risk assessment to determine how plausible a worst-case scenario may be and additional research to better understand how transformers may be impacted by electromagnetic risks. This report also recommended the potential installation of blocking devices to minimize the impacts of GIC. Sector Resilience Report: Electric Power Delivery. This 2014 report summarizes an analysis of key electric power dependencies and interdependencies, such as communications, transportation, and other lifeline infrastructure systems. The report included an assessment of, and best practices for, improving infrastructure resilience such as: modeling to identify potential vulnerabilities, conducting a cost-benefit analysis of alternative, technology-based options, and installing protective measures and hardening at-risk equipment, among others. Federal agencies have also sponsored research studies and identified risk information regarding electromagnetic risks. Below is a summary of key studies identified that address possible EMP mitigation and protective measures, the procurement and supply environment of large power transformers, susceptibility of transformers to GMD events, and the potential impact of a GMD event. Six Technical Reports Addressing EMP Impacts on the U.S. Power Grid. In January 2010, the Oak Ridge National Laboratory (ORNL) developed six technical reports—authored by external industry experts—for DOE, DHS, and FERC, that examined the EMP threats and their potential impacts, and analyzed potential solutions for preventing and mitigating their effects. Some of the reports key findings and recommendations include efforts to develop, test, and deploy mitigation technologies to automatically protect the power grid from costly damage, and to improve reporting and monitoring of GMD and power grid events. Idaho National Laboratory Study on EMP. In November 2015, DOE’s Idaho National Laboratory released a study to identify and describe possible EMP mitigation and protection measures, to examine the measures’ cost effectiveness, and to provide some potential strategies and solutions to reduce the effects of EMP on the commercial bulk electric grid. The report also discusses protection strategies for the electric grid and identifies future actions to be taken by both government and industry to enhance the security of the energy infrastructure. Large Power Transformer Study. In April 2014, DOE updated its 2012 report on Large Power Transformers and the U.S. Electric Grid that assessed the procurement and supply environment of large power transformers. In this research report, DOE examined the characteristics and procurement of large power transformers, and the availability of global and domestic suppliers, and assessed the potential risks facing these transformers, among others. The DOE report also updates the prior 2012 study and discusses new government and industry efforts to augment risk management options for critical infrastructure, including power transformers. Oak Ridge National Laboratory Study on the Susceptibility of Transformers to GMD. In November 2015, DOE officials reported initiating a study by ORNL to quantify the risks associated with GMD on electric power system reliability. The study plans to identify power lines and their associated transformers within the eastern section of the power grid and to determine those that are most susceptible to the effects of GMD. DOE officials expect the study to be completed in July 2016. Pacific Northwest National Laboratory Study on Geomagnetic Storms and Long-Term Impact on Power Systems. In December 2011, DOE’s Pacific Northwest National Laboratory conducted a study to determine the potential impact of a severe GIC event on the western U.S.-Canada power grid, referred to as the Western Interconnection. The study results indicated that the Western Interconnection was not substantially at risk to GIC because of the relatively small number of transmission lines that did not include series capacitors. The report recommended that the electric power industry consider the adoption of new protective relaying approaches that will prevent GIC events from damaging transformers. Since 2008, key federal agencies have taken actions to develop strategic plans to address the impact of GMD events to the electric grid. Specifically, DHS and DOE have developed key planning efforts that identify specific goals and outline key activities addressing electromagnetic risks. Below is a summary of DHS’s efforts. National Space Weather Strategy and Action Plan. In October 2015, the White House Office of Science and Technology Policy (OSTP), DHS, and NOAA, in collaboration with DOE and other key federal agencies, issued the National Space Weather Strategy and Action Plan. As a co-chair of the Space Weather Operations, Research and Mitigation Task Force, DHS was jointly responsible for developing a strategy to achieve several goals, including efforts to establish benchmarks for space weather events, enhance response and recovery capabilities, improve protection and mitigation efforts, and improve assessment, modeling, and prediction of impacts on critical infrastructure, among other goals. The strategy identifies goals and establishes the principles that will guide these efforts in both the near and long term, while the Action Plan identifies specific activities, outcomes, and timelines that the federal government will pursue accordingly. Power Outage Incident Annex. In 2014, FEMA, in coordination with DOE, began developing a Power Outage Incident Annex to provide incident-specific information in support of the National Response and National Disaster Recovery Frameworks. Although not specific to addressing electromagnetic events, such as EMP and solar weather, according to FEMA officials, the incident annex will describe the process and organizational constructs that the federal government will utilize to respond to and recover from loss of power resulting from deliberate acts of terrorism or natural disasters. Among other tasks, the incident annex is designed to identify key federal government capabilities and resources, prioritize core capabilities, and outline response and recovery resource requirements. FEMA officials reported that the incident annex is scheduled to be completed by mid- 2016. Below is a summary of DOE’s strategy development and planning efforts. National Transformer Strategy. In 2015, DOE developed a draft national strategy to reduce the risk to grid reliability posed by the loss of critical large power transformers. As drafted, the National Strategy for Reducing Risk from the Loss of Large Power Transformer focuses on protecting the bulk electric system—a system of 9,000 electric generating units connected across over 200,000 miles of high-voltage transmission lines—and ensuring the nation’s supply of electricity remains resilient. To achieve these efforts, the draft national strategy focuses on three areas: (1) understanding and mitigating current and future risks to transformers, (2) enhancing protection of transformers, and (3) ensuring transformer replacement equipment is available. The draft national strategy also calls upon federal government entities, to partner with electricity operators, equipment manufacturers, and state and local authorities to develop risk assessments and modeling tools to guide their efforts and prioritize activities. As of December 2015, DOE officials reported that the strategy is undergoing ongoing review. Quadrennial Energy Review. In April 2015, the White House Quadrennial Energy Review Task Force, with support from DOE and other federal agencies, issued its first installment of the Quadrennial Energy Review, which addresses infrastructure for energy transmission, storage, and distribution. A key chapter of this report focuses on a broad range of challenges and how the electric grid is vulnerable, specifically transformers, to a range of potential risks, including solar storms and EMP events. The report acknowledges that the federal government can fill gaps in creating data sets, tools, and assessments that provide a more complete and robust analytical approach towards measuring resilience needs and investments. Furthermore, the report recommends that DOE, in collaboration with DHS and others, develop common analytical frameworks, tools, and data to assess the resilience of energy infrastructures and to mitigate the risks associated with the loss of transformers. Key federal agencies, such as DHS, DOE, and FERC, have also developed training and outreach efforts that could help address the potential impact of power outages caused by electromagnetic threats, such as a GMD event. Specifically, since 2012, DHS has reported participating in several briefings before conferences and training workshops that addressed electromagnetic threats, including EMP and solar weather events. Several of the briefings summarized the findings identified by previously issued DHS-commissioned research reports. For example, DHS gave presentations on multiple occasions about the potential impacts of an EMP event, including likely impacts on regional communication systems within major U.S. cities. DHS officials reported that as a result of these briefings, DHS has subsequently developed EMP protection guidelines to help federal agencies identify options for safeguarding critical equipment, facilities, and communication centers. These guidelines include four levels of protection that are based on using specific devices, such as EMP-capable surge arresters on power cords to mitigate EMP vulnerabilities. Below is a summary of DHS’s additional training and outreach efforts. GridEx II. In November 2013, DHS and DOE, along with the Federal Bureau of Investigation, and other relevant government agencies, participated in an industry-wide exercise assessing the readiness of the electric industry to respond to a physical or cyberattack on the bulk-power system. The key goals of GridEx II were to review existing command, control, and communication plans and tools, incorporate lessons learned from a previous exercise, and to identify potential improvements in cyber and physical security plans and programs. Upon completing the exercises, participants identified key lessons learned, which included the need for enhanced information sharing, and clarification of roles and responsibilities during a physical or cyberattack. Secure Grid. In October 2011, DHS, along with multiple federal agencies and industry representatives, participated in a 2-day security exercise to assess the federal government’s response to an extreme solar weather event. The exercise entailed a crisis simulation with the goal of exploring how private and government agencies would respond to a solar storm causing widespread power outages and damage to the electric grid, how they might cooperate during such a crisis, and to explore what steps could be taken to mitigate such severe events. Two of the key findings, among others, cite the need to develop a national strategy to determine the costs of hardening the electric grid against space weather events, and the need to conduct a comprehensive study to assess the cascading effects of a widespread and long-term shutdown of the electric grid caused by a space weather event. Below is a summary of DOE and FERC’s training and outreach efforts. Space Weather Workshops. In 2015, DOE conducted multiple training workshops addressing space weather issues and its potential impact on the electric grid. For example, in February 2015, DOE cosponsored a North Atlantic Space Weather workshop with the White House and international representatives from the United Kingdom, the Republic of Ireland, and Canada. DOE officials reported that the primary focus on the workshop was discussing the potential impact of space weather on power grids. In March 2015, DOE also co-sponsored a workshop with its Canadian counterpart, Natural Resources Canada. Similarly, in April and June 2015, DOE participated in training workshops with the Idaho National Laboratory and Electric Power Research Institute and discussed the potential impact that space weather and EMP events may have on the electric grid. GMD Technical Conference. On April 30, 2012, FERC held a technical conference to discuss issues related to the reliability of the bulk-power system as affected by GMD events and to explore the risks and impacts from GIC to transformers and other equipment on the bulk-power system, as well as options for addressing or mitigating the risks and impacts. Participants included members from federal agencies, industry stakeholders, and academia. Panelists agreed that a collective effort is needed to protect the electric grid and that a national standard would be beneficial to assure effective and consistent protection. FERC officials we interviewed familiar with the technical conference stated that many participants agreed that there could be a cascading series of effects of a GMD event and there is a need to address this risk to help prevent a grid collapse. On March 1, 2016, FERC convened a second technical conference on GMD to discuss issues related to the proposed Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events. Chris Currie, (404) 679-1875 or CurrieC@gao.gov. In addition to the individual named above, Dawn Hoff (Assistant Director) and Ryan Lambert (Analyst-in-charge) managed this assignment. Chuck Bausell, Kendall Childers, Katherine Davis, Josh Diosomito, Leah English, Tom Lombardi, John Rastler, and Steven Putansu made key contributions to this report.

Summary: Electromagnetic risks caused by a man-made EMP or a naturally occurring solar weather event could have a significant impact on the nation's electric grid as well as other infrastructure sectors that depend on electricity, such as communications. These risks could lead to power outages over broad geographic areas for extended durations. GAO was asked to review federal efforts to address electromagnetic risks to the electric grid. This report examines (1) the extent to which key federal agencies have taken action to address electromagnetic risks and how these actions align with the 2008 EMP Commission report recommendations, and (2) what additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. GAO reviewed the EMP Commission report and federal program documents, and interviewed DHS, DOE, and FERC officials and relevant stakeholders who provided insights on key actions taken. Key federal agencies have taken various actions to address electromagnetic risks to the electric grid, and some actions align with the recommendations made in 2008 by the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken actions such as establishing industry standards and federal guidelines, and completing EMP-related research reports. GAO found that their actions aligned with some of the EMP Commission recommendations related to the electric grid. For example, DHS developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. Further, agency actions and EMP Commission recommendations generally align with DHS and DOE critical infrastructure responsibilities, such as assessing risks and identifying key assets. Additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. Specifically, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. Doing so could provide additional awareness of related activities and help ensure more effective collaboration with other federal agencies and industry stakeholders. Moreover, although DHS components have independently conducted some efforts to assess electromagnetic risks, DHS has not fully leveraged opportunities to collect key risk inputs—namely threat, vulnerability, and consequence information—to inform comprehensive risk assessments of electromagnetic events. Within DHS, there is recognition that space weather and power grid failure are significant risk events, which DHS officials have determined pose great risk to the security of the nation. Better collection of risk inputs, including additional leveraging of information available from stakeholders, could help to further inform DHS assessment of these risks. DHS and DOE also did not report taking any actions to identify critical electrical infrastructure assets, as called for in the National Infrastructure Protection Plan. Although FERC conducted a related effort in 2013, DHS and DOE were not involved and have unique knowledge and expertise that could be utilized to better ensure that key assets are adequately identified and all applicable elements of criticality are considered. Finally, DHS and DOE, in conjunction with industry, have not established a coordinated approach to identifying and implementing key risk management activities to address EMP risks. Such activities include identifying and prioritizing key research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. Enhanced coordination to determine key research priorities could help address some identified research gaps and may help alleviate concerns voiced by industry regarding the costs and potential adverse consequences on grid reliability that may be caused by implementation of such equipment. GAO recommends that DHS identify internal roles to address electromagnetic risks, and collect additional risk inputs to further inform assessment efforts; that DHS and DOE collaborate to ensure critical electrical infrastructure assets are identified; and engage with industry stakeholders to identify and prioritize risk-management activities, such as research and development efforts, to address EMP risks to the grid. DHS and DOE concurred with our recommendations and identified planned actions to address the recommendations.