By Rich Heidorn Jr.

WASHINGTON — Former NERC executive Brian Harrell, now assistant director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, last week lamented the federal government’s tardy response to the security threat drones pose to utilities.

While many utilities are using drones in storm response and in monitoring vegetation growth along transmission lines, drones equipped with explosives could threaten utility operations.

“This is not an emerging threat. It was emerging five years ago,” Harrell told attendees of the NERC Reliability Leadership Summit on Thursday. “We’re clearly cognizant of the fact that you do not own the airspace above your generating facilities, the airspace above … your transmission substations. And right now, the laws are such that the federal government isn’t being as helpful as it should be.”

Last July, Yemen’s Houthi movement claimed it had used a drone to attack a Saudi Aramco refinery in Riyadh. The company acknowledged a fire at the plant but attributed it to “an operational incident.” In August, explosive-carrying drones were used in an attack during a speech by Venezuelan President Nicolás Maduro.

Harrell, who formerly served as director of the Electricity Information Sharing and Analysis Center (E-ISAC) and director of NERC’s Critical Infrastructure Protection Programs, said the federal government has only limited authority over drones but that DHS is preparing a report on security issues posed by the devices.

“I have strongly advocated that whatever recommendations come out of this report must impact, must touch, the private sector,” he said.

A former security director for Duke Energy, Harrell also cautioned utilities on purchasing drones for their own use.

“If you are using foreign-manufactured drones at your facilities, you potentially are incurring risk. So be very, very mindful of that. … Data loss and prevention is [a real threat].”

In 2017, a leaked memo from Homeland Security’s Immigration and Customs Enforcement bureau (ICE) alleged that Chinese drone-maker DJI was “providing U.S. critical infrastructure and law enforcement data to the Chinese government.” DJI, which has been estimated to hold a 70% global market share, responded that the report was based on “clearly false and misleading claims from an unidentified source.”

Harrell said China is “the most active strategic competitor for cyber espionage against the U.S. government, our corporations and our allies. They are stealers of information. Whereas Russia is a … nuisance in one sense, China is actually taking data for their own use.”