By Rich Heidorn Jr.
WASHINGTON — The National Association of Regulatory Utility Commissioners ended its winter meetings Wednesday with NARUC President Travis Kavulla’s interview of broadcaster Ted Koppel, whose 2015 book “Lights Out” alleges the U.S. is unprepared for the threat of cyberattacks on the nation’s grid.
Critics have accused Koppel of sensationalizing the threat and omitting key facts. But one might not have known that from the gentle probing Koppel received from Kavulla.
The Montana regulator pressed Koppel on his contention that investor-owned utilities lack sufficient incentives to aggressively pursue cybersecurity. But he left unchallenged the author’s claim that the electric industry can block FERC from imposing reliability standards that receive less than a two-thirds NERC membership vote.
“It’s a unique situation where an industry, in effect, is granted the right to draw a line under any restrictive legislation that the federal government might want to impose upon it and say ‘Sorry, we don’t accept it,’” Koppel said. “You’re all aware of the fact that … if FERC proposes something to NERC, NERC takes a vote on it and unless there is a two-thirds majority of NERC members — of the 3,200 or so U.S. power companies — unless they have two-thirds majority vote in favor, it is not accepted. The federal government has no unilateral power to impose legislation on the power industry.”
NERC Responds
NERC CEO Gerry Cauley, who was in the audience, disputed Koppel’s statements in an interview afterward.
“He’s missing the part where FERC can direct us to do a standard,” Cauley said. “We have the physical security, upgrading the cybersecurity standard, the GMD standard [that were ordered by FERC]. So when they tell us to do a standard, it’s not optional. And we actually have a backstop in our procedures … which says if the industry fails to approve a standard by the majority vote that we’ve been directed to do, our board takes over and approves that standard.
“We would never let that fail. And it’s never failed at this point. … Our continued existence as the [Electric Reliability Organization] is dependent on being responsive.”
Cauley said allowing NERC members to vote on standards is “valuable because it shows their support, that it’s a practical standard, the costs being passed to the customer are reasonable and there’s not going to be any litigation around it once it’s done. … There’s a value-add for having a vote, but it’s not the end. There’s no veto power by industry.”
Koppel’s publisher, Crown, did not respond to requests for comment on the criticism. FERC declined to comment.
Kavulla: Precise Language Needed
In an interview Friday, Kavulla defended his questioning of Koppel and said he was aware of controversy over the book.
He said both Koppel and Cauley — who complained to the NARUC president after the session — need to be more precise in their language.
“I’m not defending Ted Koppel. It seems to me clear that when he said the federal government had no unilateral authority, I think technically that’s untrue,” Kavulla said. “But what Gerry Cauley has told you is inaccurate or at least slightly misleading. Mr. Cauley is defending an approach where industry works to write regulations that regulate itself under generic direction by FERC … and then you seem to have Ted Koppel arguing the opposite position: that this industry is too sensitive to leave it up to regulations written by industry and that the federal government should take a more proactive role. I don’t know which is right.”
Although FERC can order standards, “it doesn’t proscribe what the standard should include,” Kavulla continued.
“There is a so-called backstop in theory, but to be clear that has never actually happened. Gerry Cauley uses the present tense voice in saying ‘Our board takes over.’ The one thing Gerry Cauley isn’t telling you is that has never occurred.”
EEI Weighs In
One industry expert who was interviewed by Koppel for the book said the author seemed uninterested in any information that didn’t support his thesis.
“We’ve heard this trope before: It’s the fox guarding the henhouse,” Scott Aaronson, the Edison Electric Institute’s managing director for national security issues, said in an interview. “Every other piece of fact proves that’s not the case.”
Aaronson said the NERC standards drafting process follows American National Standards Institute rules. “It is an open process. Anyone can participate,” he said. “We think that the process works very, very well despite Mr. Koppel’s protestations.”
Aaronson said Koppel also ignores “the important partnership that has developed between the government and owners and operators of critical infrastructure,” including the Electricity Subsector Coordinating Council, which includes 30 CEOs of operating companies and trade groups that meet three times a year with senior federal government security officials.
“He came to this with a thesis,” said Aaronson, who acknowledged he had not read the entire book. “It was effectively that the government is inept, the industry is profit motivated and our only option is to buy canned goods.”
Cauley agreed that Koppel appeared to dismiss the industry’s preparations, particularly its plans for the grid’s recovery after an attack.
“It’s a very serious area of concern — cyberattacks can happen. Our systems are particularly well guarded, but you can never say it won’t happen,” Cauley said. “I think he’s just not as aware of the things that have been done in preparation. … There are playbooks that exist that talk about roles and responsibilities. We exercise them thoroughly. The Grid Ex III, the exercise we went through for two days [in November], was actually more severe than his scenarios and we learned a lot. We found out what we had, what we didn’t have. We iterate on that every two years to keep getting better.” (See Two-Day GridEx III Tests Vulnerability to Terrorist Attacks.)
“Whoever [Koppel] got to talk to, he needs to talk to some more people to get the whole story.”
Bigger Question?
In an earlier session, retired Gen. Keith Alexander, former director of the National Security Agency, said the federal government needs to increase its information sharing, and the speed at which it does so, to address cybersecurity threats. “The government [has to] share what it knows about these threats. My experience in dealing with industry is they knew about 25% of what the government did. That’s insufficient. We’ve got to address that.”
Marcus Sachs, NERC’s chief security officer and the head of the Electricity Information Sharing and Analysis Center, agreed. “The offense needs to inform the defense. There’s a lot of really good national capabilities that are locked up [inside the] classified world. But those techniques need to be known to the defenders.”
Kavulla said the issue of NERC’s voting rules shouldn’t distract from the broader policy debate: Is it better to have stakeholders write standards subject to federal oversight, or should regulators write the rules subject to stakeholder feedback?
“How different would the standards look,” he asked, “if they were not subject to a two-thirds vote?”
Maryland Gov. Larry Hogan’s administration said it intends to appeal a permit approved by Virginia regulators that would allow Dominion Virginia Power to release 215 million gallons of treated coal ash water into Quantico Creek, which empties into the Potomac River.
Entergy Arkansas says a projected decrease in fuel costs would help offset the customer impact of a requested 8% base-rate increase before the Public Service Commission.
The United Illuminating Co. and Eversource Energy have submitted proposals to the Department of Energy and Environmental Protection for pilot projects to better integrate renewable energy into the electric distribution system.
A local attorney and his wife are challenging a recent settlement between Duke Energy and several parties concerning the Edwardsport coal gasification project. The agreement with the state’s Office of Utility Consumer Counsel and industrial customers would limit rates and provide money for solar projects and low-income customers.
An administrative law judge questioned whether state regulators should allow the $4.9 billion sale of Cleco Power to a consortium of Canadian and Australian investors, citing a provision that allows buyers to pocket about $30 million in taxes collected from the utility’s customers.
A legislative panel supports the idea of giving utilities the ability to reserve storage space in a proposed LNG facility, which would hold the equivalent of 1 billion cubic feet of gas for customers during peak winter heating months.
EPA’s recent designation of St. Charles and Franklin counties as areas where sulfur dioxide levels are too high could force Ameren Missouri to install more pollution control equipment on its Labadie Plant on the Missouri River.
Six of the 10 bills in the state legislature that would have complicated Kinder Morgan’s controversial Northeast Energy Direct pipeline project are already dead, and the other four also seem imperiled.
The staff of the Utilities Commission appears poised to recommend approval of Duke Energy Progress’ plan to replace a coal-fired plant at Lake Julian in Asheville with two natural gas units.
ETRACOM and its principal trader Michael Rosenberg said last week they will seek a de novo review of FERC’s allegations that they manipulated the CAISO energy market in a scheme that allegedly netted $315,000 in profits. That would mean a federal court would decide all issues of fact and law in the beginning of the case, rather than the company potentially appealing an unfavorable FERC ruling afterward.
EPA has tentatively determined that sulfur dioxide in the air around Luminant’s coal-fired Big Brown, Martin Lake and Monticello plants violates federal standards.
Entergy’s Pilgrim nuclear station is coming under increased oversight from Nuclear Regulatory Commission inspectors following a performance review of the Massachusetts station. The commission said the scrutiny is a result of reviews of issues the plant has had with safety relief valves.
The Nuclear Regulatory Commission said it found five safety violations at the Salem and Hope Creek nuclear plants but characterized the violations as low significance. The three-reactor complex is operated by PSEG Nuclear.
Citing a lower-than-expected load-growth forecast, the Tennessee Valley Authority has decided against building two new units at its Bellefonte nuclear plant and is considering selling the two incomplete units, where construction halted in the 1980s.
