[House Hearing, 112 Congress]
[From the U.S. Government Publishing Office]



 
   CRITICAL INFRASTRUCTURE CYBERSECURITY: ASSESSMENTS OF SMART GRID 

                                SECURITY
=======================================================================



                                HEARING

                               BEFORE THE

              SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

                                 OF THE

                    COMMITTEE ON ENERGY AND COMMERCE

                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

                               __________

                           FEBRUARY 28, 2012

                               __________

                           Serial No. 112-120



      Printed for the use of the Committee on Energy and Commerce

                        energycommerce.house.gov




                  U.S. GOVERNMENT PRINTING OFFICE
76-641                    WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001


                    COMMITTEE ON ENERGY AND COMMERCE

                          FRED UPTON, Michigan
                                 Chairman

JOE BARTON, Texas                    HENRY A. WAXMAN, California
  Chairman Emeritus                    Ranking Member
CLIFF STEARNS, Florida               JOHN D. DINGELL, Michigan
ED WHITFIELD, Kentucky                 Chairman Emeritus
JOHN SHIMKUS, Illinois               EDWARD J. MARKEY, Massachusetts
JOSEPH R. PITTS, Pennsylvania        EDOLPHUS TOWNS, New York
MARY BONO MACK, California           FRANK PALLONE, Jr., New Jersey
GREG WALDEN, Oregon                  BOBBY L. RUSH, Illinois
LEE TERRY, Nebraska                  ANNA G. ESHOO, California
MIKE ROGERS, Michigan                ELIOT L. ENGEL, New York
SUE WILKINS MYRICK, North Carolina   GENE GREEN, Texas
  Vice Chairman                      DIANA DeGETTE, Colorado
JOHN SULLIVAN, Oklahoma              LOIS CAPPS, California
TIM MURPHY, Pennsylvania             MICHAEL F. DOYLE, Pennsylvania
MICHAEL C. BURGESS, Texas            JANICE D. SCHAKOWSKY, Illinois
MARSHA BLACKBURN, Tennessee          CHARLES A. GONZALEZ, Texas
BRIAN P. BILBRAY, California         JAY INSLEE, Washington
CHARLES F. BASS, New Hampshire       TAMMY BALDWIN, Wisconsin
PHIL GINGREY, Georgia                MIKE ROSS, Arkansas
STEVE SCALISE, Louisiana             JIM MATHESON, Utah
ROBERT E. LATTA, Ohio                G.K. BUTTERFIELD, North Carolina
CATHY McMORRIS RODGERS, Washington   JOHN BARROW, Georgia
GREGG HARPER, Mississippi            DORIS O. MATSUI, California
LEONARD LANCE, New Jersey            DONNA M. CHRISTENSEN, Virgin 
BILL CASSIDY, Louisiana              Islands
BRETT GUTHRIE, Kentucky              KATHY CASTOR, Florida
PETE OLSON, Texas
DAVID B. McKINLEY, West Virginia
CORY GARDNER, Colorado
MIKE POMPEO, Kansas
ADAM KINZINGER, Illinois
H. MORGAN GRIFFITH, Virginia

                                 7_____

              Subcommittee on Oversight and Investigations

                         CLIFF STEARNS, Florida
                                 Chairman
LEE TERRY, Nebraska                  DIANA DeGETTE, Colorado
SUE WILKINS MYRICK, North Carolina     Ranking Member
JOHN SULLIVAN, Oklahoma              JANICE D. SCHAKOWSKY, Illinois
TIM MURPHY, Pennsylvania             MIKE ROSS, Arkansas
MICHAEL C. BURGESS, Texas            KATHY CASTOR, Florida
MARSHA BLACKBURN, Tennessee          EDWARD J. MARKEY, Massachusetts
BRIAN P. BILBRAY, California         GENE GREEN, Texas
PHIL GINGREY, Georgia                DONNA M. CHRISTENSEN, Virgin 
STEVE SCALISE, Louisiana                 Islands
CORY GARDNER, Colorado               JOHN D. DINGELL, Michigan
H. MORGAN GRIFFITH, Virginia         HENRY A. WAXMAN, California (ex 
JOE BARTON, Texas                        officio)
FRED UPTON, Michigan (ex officio)

                                  (ii)


                             C O N T E N T S

                              ----------                              
                                                                   Page
Hon. Cliff Stearns, a Representative in Congress from the State 
  of Florida, opening statement..................................     1
    Prepared statement...........................................     4
Hon. Diana DeGette, a Representative in Congress from the State 
  of Colorado, opening statement.................................     6
Hon. Lee Terry, a Representative in Congress from the State of 
  Nebraska, opening statement....................................     7
Hon. Michael C. Burgess, a Representative in Congress from the 
  State of Texas, opening statement..............................     8
Hon. Marsha Blackburn, a Representative in Congress from the 
  State of Tennessee, opening statement..........................     8
Hon. Phil Gingrey, a Representative in Congress from the State of 
  Georgia, opening statement.....................................     9
Hon. Henry A. Waxman, a Representative in Congress from the State 
  of California, opening statement...............................     9

                               Witnesses

Gregory C. Wilshusen, Director, Information Security Issues, 
  Government Accountability Office...............................    11
    Prepared statement...........................................    13
David C. Trimble, Director, Natural Resources and Environment, 
  Government Accountability Office \1\...........................
    Prepared statement...........................................    13
Richard J. Campbell, Specialist, Energy Policy, Congressional 
  Research Service...............................................    31
    Prepared statement...........................................    33

----------
\1\ Mr. Trimble did not offer oral remarks for the record. Mr. 
  Trimble and Mr. Wilshusen submitted a joint statement.


                   CRITICAL INFRASTRUCTURE CYBERSECU-
                RITY: ASSESSMENTS OF SMART GRID SECURITY

                              ----------                              


                       TUESDAY, FEBRUARY 28, 2012

                  House of Representatives,
      Subcommittee on Oversight and Investigations,
                          Committee on Energy and Commerce,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:19 a.m., in 
room 2322 of the Rayburn House Office Building, Hon. Cliff 
Stearns (chairman of the subcommittee) presiding.
    Members present: Representatives Stearns, Terry, Myrick, 
Burgess, Blackburn, Gingrey, DeGette, and Waxman (ex officio).
    Staff present: Carl Anderson, Counsel, Oversight and 
Investigations; Todd Harrison, Chief Counsel, Oversight and 
Investigations; Katie Novaria, Legislative Clerk; Andrew 
Powaleny, Deputy Press Secretary; Alvin Banks, Democratic 
Investigator; Brian Cohen, Democratic Investigations Staff 
Director and Senior Policy Advisor; and Kiren Gopal, Democratic 
Counsel.

 OPENING STATEMENT OF HON. CLIFF STEARNS, A REPRESENTATIVE IN 
               CONGRESS FROM THE STATE OF FLORIDA

    Mr. Stearns. Good morning, everybody. I call the 
subcommittee's second hearing on cybersecurity and critical 
infrastructure protection to order.
    My colleagues, America's infrastructure systems have become 
more automated and more reliant on information systems and 
computer networks to operate. While our systems are more 
efficient, they also open the door to cyber threats and cyber-
attacks. Today, the subcommittee focuses on that part of the 
critical infrastructure known as smart grid, which refers to 
the information technology systems increasingly incorporated 
into the Nation's electricity networks.
    Smart grid technologies are designed to lower operation 
costs, reduce maintenance costs, and expand the flexibility of 
operational control relative to the current grid system. Their 
operational efficiency and improved asset use is driven by 
advanced communication and information technologies.
    I believe that we must update our electric grid with better 
technology integration, which is why I spearheaded the effort 
to secure funding for Energy Smart Florida, the largest smart 
grid demonstration project in the country. This initiative will 
invest hundreds of millions of dollars in smart grid technology 
and renewable energy in Florida and throughout the entire 
county. Energy Smart Florida will revolutionize how people use 
energy in their homes and enable them to make smarter choices 
about energy consumption and better control their carbon 
emissions. In addition, the widespread deployment of smart 
meters will provide Floridians with more reliable electrical 
service through an intelligent network that will be able to 
detect potential problems and automatically reconfigure the 
grid to minimize or eliminate outages.
    But ask any expert in the national security field and see 
what keeps them up at night. They would probably tell you, as 
they tell me, that it is the increased possibility of a 
devastating cyber-attack. This threat is real and is why it is 
virtually important--vitally important for us to do what we can 
to protect our critical infrastructure from these threats. We 
have seen in the past decade what impact both man-made and 
natural disasters have on our Nation's utility systems. Imagine 
the impact of a cyber-attack to the electrical grid. How many 
days could hospitals operate with onsite electric generation? 
How would metro rail systems operate, if at all? How would we 
recharge our smart phones or access the internet? The goal of 
the smart grid is to improve efficiency, reliability and 
interoperability. An equal goal, however, must be to improve 
upon the security controls and to minimize the impact from a 
man-made or natural disaster to ensure reliability and avoid 
such possibilities.
    Now, a recent report completed by the Pike Research company 
estimated that utilities' initiatives to secure their 
infrastructure will drive increasing investments to involve 
cybersecurity systems and total roughly $14 billion from now 
through the year 2018. While the Department of Energy has 
emphasized investment in technologies such as smart meters, 
among other technologies, we want to ensure that where there is 
investment, there is not a cybersecurity gap. We want to 
emphasize that there is also investment in securing control 
system segments including transmission upgrades, substation 
automation, and distribution automation systems.
    Protecting critical infrastructure is a complicated issue. 
We are talking about facilities and frameworks owned by private 
companies, and by Federal, State, and local governments. They 
are interconnected. Electricity powers water systems that cool 
nuclear reactors, for example. They are vulnerable to threats 
from a number of different sources, including nation-states, 
criminals, and hackers.
    The issues surrounding critical infrastructure protection 
and security are complex. To help analyze these complexities, I 
am pleased to be joined by our panel of experts in the field. 
Today, we will hear testimony from two witnesses at GAO: Mr. 
Gregory Wilshusen, Director of Information Security Systems, 
and Mr. David Trimble, Director of Natural Resources and the 
Environment. I look forward to their testimony, and getting a 
better understanding of their extensive work examining 
cybersecurity implications of the smart grid. I also would like 
to welcome Mr. Richard Campbell, of the Congressional Research 
Service, who has examined this very subject and we look forward 
to his contributions today.
    My colleagues, as I mentioned previously, this is the 
subcommittee's second hearing in this Congress on critical 
infrastructure protection and cybersecurity. The purpose of 
this hearing, in particular, is to get an overview of smart 
grid cybersecurity, and how it is working and what can be done 
better. It is my intention to call the Department of Energy and 
possibly other stakeholders to a future hearing for further 
consideration of smart grid security.
    I have enjoyed working with the Ranking Member, Ms. DeGette 
and the Minority in these matters and look forward to working 
with them on overseeing cybersecurity issues again. So I look 
forward to this hearing, the perspectives of our expert 
witnesses about the safety of this vital part of critical 
infrastructure, and whether we are taking the right steps to 
protect them from cybersecurity risks and threats.
    [The prepared statement of Mr. Stearns follows:]


    [GRAPHIC] [TIFF OMITTED] 76641.001
    
    [GRAPHIC] [TIFF OMITTED] 76641.002
    
    Mr. Stearns. And with that, I recognize the ranking member, 
Ms. DeGette.

 OPENING STATEMENT OF HON. DIANA DEGETTE, A REPRESENTATIVE IN 
              CONGRESS FROM THE STATE OF COLORADO

    Ms. DeGette. Thank you very much, Mr. Chairman, for holding 
this hearing on smart grid cybersecurity.
    Last year in July, representatives of the Department of 
Homeland Security came before this subcommittee to discuss 
their efforts to protect and deploy Federal resources and to 
coordinate with the private sector to prevent and respond to 
cyber attacks. This hearing, as you mentioned, is an important 
follow-up to that hearing.
    Protecting our critical infrastructure from cyber attacks 
is, of course, of vital importance. As our electric grid 
evolves, we become more and more dependent on so-called smart 
technologies to control, connect, and maintain this 
interconnected system. This is a good thing. It will make the 
grid more efficient and more reliable. For example, consumers 
will soon be able to track the price of electricity minute by 
minute and adjust electricity use accordingly, waiting, for 
example, until prices are right to do the laundry or start the 
dishwasher.
    However, these investments also expose us to new threats. 
These new technologies can be easy prey for hackers or 
terrorists who seek to bring down unprotected networks. As the 
smart grid becomes more interoperable, these attacks could have 
debilitating effects nationwide, as you mentioned, Mr. 
Chairman. In 2007, DHS ran a test known as Aurora, which 
showcases just how dangerous grid vulnerabilities can be. They 
used a dial-up modem to rewrite computer code and remotely 
detonate an industry-controlled system generator. That is why I 
am pleased we are having this hearing today. We as a Congress 
must do everything in our power to ensure that the grid remains 
safe and secure.
    The testimony we hear today will help us understand our 
successes and identify flaws in the current approach so that we 
can understand what else can be done to protect the smart grid. 
This hearing will also help us understand if Congress needs to 
provide more resources or more legislative authority for key 
cybersecurity agencies.
    The administration has made cybersecurity a priority, 
launching a comprehensive national cybersecurity initiative to 
protect the digital infrastructure. The President's 2013 budget 
includes $769 million to support the National Cybersecurity 
Division within the Department of Homeland Security. These 
funds are targeted at improving monitoring on Federal networks 
to respond to cyber threats, and supporting cyber attack 
responses for critical infrastructure owners and operators, and 
for State and local authorities.
    I commend this targeted focus on cybersecurity, but I am 
hoping that today our witnesses will help us learn more about 
any gaps in security that may still exist.
    Mr. Chairman, as I said, I appreciate that you are holding 
this hearing, and I am encouraged that you have announced that 
we are going to keep looking into other areas where we can work 
together in a bipartisan fashion. For example, we will hear 
from witnesses today the issue of cybersecurity goes well 
beyond the protection of the critical infrastructure. Consumers 
entrust important personal information on their banks--to their 
banks, their internet service providers, their credit card 
companies, and the retailers from whom they purchase items from 
online. These companies should ensure that they are protecting 
this information and Congress needs to be doing its oversight 
job to make sure that this is the case.
    Every day we hear stories about e-mail accounts being 
hacked, credit card information being hijacked, and Social 
Security numbers or other important personal information being 
stolen by cyber criminals. It has even happened to some of us 
who sit on this panel. The loss of this information can be 
costly and personally damaging. In September of last year, the 
internet security company, Symantec, issued the Norton Cyber 
Crime Report and calculated that cyber crimes cost companies 
and consumers $114 billion annually. That same report found 
that more than 2/3 of adults online had been victims of a cyber 
crime.
    As our use of internet services becomes more and more 
integrated, using the same internet services for e-mail, social 
networking, photo sharing, bill paying, and browsing and 
search, we have to be more vigilant in ensuring the protection 
of our personal information. Sites like Google, Yahoo, and 
Facebook will be targets for hackers, and if successful, these 
cyber attacks will have a major impact on the American public.
    For that reason, Mr. Chairman, in addition to investigating 
how the government can improve critical infrastructure 
cybersecurity, I think this subcommittee should also look 
closely at what the private sector is doing to prevent cyber 
attacks and keep consumers' personal information safe.
    I look forward to working with you on all of these issues, 
Mr. Chairman, and with that, I will yield back.
    Mr. Stearns. Thank the gentlelady and recognize the 
gentleman from Nebraska, Mr. Terry, for 2 minutes.

   OPENING STATEMENT OF HON. LEE TERRY, A REPRESENTATIVE IN 
              CONGRESS FROM THE STATE OF NEBRASKA

    Mr. Terry. Thank you, Mr. Chairman, for holding this 
important hearing. Of course, one of the cornerstone 
responsibilities of this Committee is finding--determining 
reliability of our electricity delivery system. In today's 
world, that means when we are protecting the grid, it means we 
have to look into the cyber attacks.
    Let me just give you one quick story from University of 
Nebraska at Omaha, PKI Institute of Information Assurance. They 
set up as a class project in their master's program an electric 
company fake Web site, and then tracked who would attack it. 
Within about 48 hours, there was probably about 50 hack 
attempts, most of them coming from a certain region in China, 
but all over the world. This just shows how vulnerable we are.
    Now as we move to more of a smart grid, that also means 
that we have more vulnerabilities, whether it is from EMPs or 
from cyber attacks. So looking at how we can strengthen our 
ability to defend from these attacks is just part of our core 
effort here.
    So at this time, I would like to yield the rest of my time 
to----
    Mr. Stearns. The gentleman yields back the balance of his 
time?
    Mr. Terry. Yes.
    Mr. Stearns. And so we have extra time here, and we 
recognize Dr. Burgess for a minute and a half to 2 minutes.

OPENING STATEMENT OF HON. MICHAEL C. BURGESS, A REPRESENTATIVE 
              IN CONGRESS FROM THE STATE OF TEXAS

    Mr. Burgess. Thank you, Mr. Chairman for the recognition. I 
want to thank our witnesses for being here today, because this 
is an issue of extreme importance. We are facing threats from 
around the world, and certainly, all of us want to remain 
vigilant.
    From hearings that we have had in previous Congresses in 
this subcommittee, and from talking to people who are charged 
with protecting our country, defending our country in an 
increasingly adverse cyber environment, we are well aware that 
every day from around the world, as Mr. Terry mentioned, are 
trying to break into our vital modes of infrastructure and 
technology, and not the least of that being the electric grid.
    We are also concerned about cost and that is why I am so 
grateful that some of the testimony today has focused on the 
effectiveness and the effectiveness of even the metrics that we 
use in order to assess how we are doing, and I think that is of 
critical importance, both as a consumer and certainly, it is 
clear that the utility companies themselves will be interested 
in knowing what the effectiveness of the measures that we are 
asking them to implement--they have to be interested in the 
effectiveness of those measures.
    We want these to be informed decisions. We do not want them 
to be emotional or political decisions, but we want them to be 
based on the best possible information, so that is why I am 
grateful, Mr. Chairman, that you called this hearing. I am 
grateful for our witnesses to be here, and I will yield back to 
the chairman.
    Mr. Stearns. Gentleman yields back and we recognize the 
gentlelady from Tennessee, Ms. Blackburn----
    Mrs. Blackburn. Thank you so much----
    Mr. Stearns [continuing]. For a minute and a half.

OPENING STATEMENT OF HON. MARSHA BLACKBURN, A REPRESENTATIVE IN 
              CONGRESS FROM THE STATE OF TENNESSEE

    Mrs. Blackburn. Thank you. I appreciate that. I do want to 
welcome our witnesses.
    We all know and we realize how very--how debilitating these 
attacks would be. Some of the reports that I have read indicate 
that we could see blackouts for 9 to 18 months in areas if we 
were hit with a cyber attack, and certainly last year as we 
have looked at the series of attacks known as Night Dragon and 
how the hackers broke into and stole proprietary information 
worth millions of dollars, we see how this has a direct impact 
on not only U.S. but European energy companies.
    I think that one of the things that concerns me is looking 
at what we have found out with the increase from '06 to '10 a 
650 percent increase in the number of attacks and the 
incidences that have been tracked. So we welcome you and we 
look forward to hearing what you have to say, and some of the 
accelerated planning issues that are in front of us.
    Thank you very much. Yield back.
    Mr. Stearns. Gentlelady yields back and I recognize the 
gentleman from Georgia, Mr. Gingrey, for 1 minute.

  OPENING STATEMENT OF HON. PHIL GINGREY, A REPRESENTATIVE IN 
               CONGRESS FROM THE STATE OF GEORGIA

    Mr. Gingrey. Mr. Chairman, I thank you for giving me a 
minute of time. I was looking for an e-mail on my iPhone, but I 
don't know how to use the iPhone so I couldn't pull up the e-
mail. But basically I received an e-mail on my iPhone just a 
couple of days ago, purportedly from literally my best friend, 
who happens to be of European descent, and it was this typical 
e-mail, ``I am contacting you with tears in my eyes. We went on 
vacation in Spain, we got mugged at the--we can't get home, 
could you please e-mail us or wire us 1,600 Euros? God bless 
you and thank you for your help.'' I mean, that kind of thing 
is amazing. It is the first time I have ever received one of 
those, but that is small potatoes, of course, compared to what 
we are talking about here, but it just is a small example of 
the seriousness of cyber attack on the smart grid, so I am 
really looking forward to hearing from the witnesses and 
learning more about this----
    Ms. DeGette. Will the gentleman yield? Maybe your iPhone 
doesn't work because you opened that e-mail from your friend 
and now they have destroyed all your network.
    Mr. Gingrey. I have been attacked.
    Ms. DeGette. Yes.
    Mr. Gingrey. Thank you, Ms. DeGette.
    Ms. DeGette. You are welcome.
    Mr. Stearns. All right, our side is complete. With that, 
recognize the Ranking Member of the Full Committee, the 
gentleman from California for 5 minutes.

OPENING STATEMENT OF HON. HENRY A. WAXMAN, A REPRESENTATIVE IN 
             CONGRESS FROM THE STATE OF CALIFORNIA

    Mr. Waxman. Thank you, Mr. Chairman. I appreciate your 
holding this hearing, and I want to say, this is exactly the 
type of oversight this subcommittee should be conducting, 
ensuring that our government uses its resources wisely, and 
that the private sector is taking appropriate steps to 
guarantee the safety and security of our Nation's critical 
infrastructure.
    Today's hearing will give us an opportunity to learn about 
the key challenges to ensuring the security of this Nation's 
electric grid. As the grid becomes more technologically 
advanced, it becomes more exposed to hackers, terrorists, and 
foreign enemies. As the grid becomes more interoperable, the 
potential effect of a cybersecurity breach becomes more 
widespread.
    The smart grid offers tremendous potential benefits. 
Modernizing the grid will make electricity cheaper, more 
efficient, more reliable, but at the same time, we must take 
appropriate action to protect the electric grid and to improve 
services and access for citizens across the Nation.
    In 2007, Congress and then-President Bush approved the 
Energy Independence and Security Act of 2007. This legislation 
authorized the Smart Grid Investment Grant Program and the 
smart grid Demonstration Program. The 2009 Recovery Act amended 
these programs and provided funding to ensure their 
implementation.
    The first program, the Smart Grid Demonstration Program, 
funded 32 projects to verify the viability of smart grid 
technology and quantify the costs and benefits of these 
improvements. The second program, the Smart Grid Investment 
Grant Program, awarded grants for smart grid technology 
updates. These grants have allowed the installation of smart 
meters in millions of homes, implementation of automatic peak 
pricing, response for commercial and industrial customers, and 
the development of comprehensive demand response programs. 
These programs provided 99 grants to recipients in 42 States, 
the District of Columbia, and Guam. In total, the Energy 
Department invested $3.4 billion in grants, which was matched 
by $4.6 billion in private investments, for a total public 
private investment of over $8 billion.
    Today will give us an opportunity to evaluate what is 
working and what can be improved in these programs. The 
Department of Energy's Inspector General recently issued a 
report on the Smart Grid Grant Program and identified some 
reimbursement issues and concerns about approval of some 
cybersecurity plans. Today's hearing will allow us to explore 
those issues.
    Beyond oversight, we must also do our part in protecting 
the electrical grid. Both GAO and the DOE Inspector General 
have acknowledged that Federal Energy Regulatory Commission has 
only limited authority to ensure the grid is truly secure. In 
fact, the Inspector General found that FERC does not have the 
authority to develop its own standards or mandatory alerts, 
even when new threats are identified. This gap in authority 
creates serious potential risks.
    Last May, the Subcommittee on Energy and Power held a 
hearing to discuss the bipartisan Grid Reliability and 
Infrastructure Defense Act, a bill that would give FERC 
additional authority to protect the electric grid from 
potentially dangerous vulnerabilities. Today's hearing will 
again demonstrate why we need to act on this legislation 
without further delay. We must continue to invest in making our 
electric grid the best in the world. That includes investing in 
standards and technologies so that the electric grid is secure 
in the face of unexpected terror attacks or hacking attempts. 
This hearing is an important step in identifying what can be 
done to ensure that the electric grid is protected.
    I have focused my opening statement on the electric grid, 
but I hope this hearing produces some ways for members to learn 
how to use their iPhones, and to be able to realize that when 
they get e-mails asking for money, they had better think twice 
about it. I nearly fell for that one myself. A good friend was 
evidently not able to afford to leave Paris. Things could be 
worse, but they wanted something worse, they wanted my money. 
This shows that our security of our technology is very 
important objective, and I think it is worthwhile for our 
hearing to do it.
    I am sure, since I have 19 second left, I want to comment 
that I am sure by the end of this hearing, whatever we find we 
don't like, the Republicans will blame on President Obama. Such 
is life. But I think this is a good hearing and I compliment 
the chairman for holding it. I will yield back my second.
    Mr. Stearns. The gentleman yields back his second, and I 
point out that sometimes we hear on your side everything is 
blamed on Bush, so----
    Mr. Waxman. Too late for that.
    Mr. Stearns. All right. Let me direct my comments to our 
witnesses this morning. As you know, the testimony that you are 
about to give is subject to Title 18 Section 1001 of the United 
States Code. When holding an investigative hearing, this 
Committee has a practice of taking testimony under oath. Do you 
have any objection to testifying under oath?
    The Chair then advises you that under the rules of the 
House and the rules of this Committee, you are entitled to be 
advised by counsel. Do you desire to be advised by counsel 
during your testimony today? If not, would you please rise and 
raise your right hand?
    [Witnesses sworn.]
    Mr. Stearns. You may now give your 5-minute summary of your 
written statement, and Mr. Wilshusen, you are first.

   TESTIMONY OF GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION 
SECURITY ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE, ACCOMPANIED 
     BY DAVID C. TRIMBLE, DIRECTOR, NATURAL RESOURCES AND 
 ENVIRONMENT, GOVERNMENT ACCOUNTABILITY OFFICE; AND RICHARD J. 
  CAMPBELL, SPECIALIST, ENERGY POLICY, CONGRESSIONAL RESEARCH 
                            SERVICE

               TESTIMONY OF GREGORY C. WILSHUSEN

    Mr. Wilshusen. Thank you, Mr. Chairman.
    Chairman Stearns, Ranking Member DeGette, and members of 
the subcommittee, thank you for the opportunity to testify 
today at today's hearing on cybersecurity for the smart grid. I 
am joined today by David Trimble, who is the Director for GAO's 
Natural Resources and Environment team. In addition, Mr. 
Chairman, if I may, I would like to recognize John Logoson, 
Mike Gilmore, and especially Lee McCracken for their efforts--
--
    Mr. Stearns. Ask them to raise their hand. We are not 
sure----
    Mr. Wilshusen. For their efforts in developing our written 
statement that we submitted today.
    As you know, the electric power industry is increasingly 
incorporating information technology systems and networks into 
its existing infrastructure as it modernizes the electricity 
grid. In 2007, the Energy Independence and Security Act 
established that it is Federal policy to support this 
modernization. Known as a smart grid, these nationwide efforts 
are aimed at improving the reliability and efficiency of the 
grid, and facilitating the use of alternative energy sources. 
Smart grid technologies include smart meters that enable two 
way communications between utilities and customers, smart 
components that provide system operators with detailed data on 
the conditions of transmission and distribution systems, and 
advanced methods for controlling equipment. The use of these 
systems may have a number of benefits, such as fewer and 
shorter outages of electrical service, lower electricity rates, 
and an improved ability to respond to attacks on the electric 
grid.
    However, the increased reliance on IT systems and networks 
also exposes the grid to cybersecurity vulnerabilities. For 
nearly a decade, GAO has identified the protection of systems 
supporting our Nation's critical infrastructures as--which 
include the electric grid--as a government-wide high risk area. 
Mr. Chairman, the threats to these systems supporting these 
infrastructures are evolving and growing. They include both 
unintentional and intentional threats, and may come in the form 
of equipment failure, as well as targeted and untargeted 
attacks from our adversaries.
    The interconnectivity between information systems, the 
internet, and other infrastructures can amplify the impact of 
these threats, potentially affecting the operations of critical 
infrastructures, the security of sensitive information, and the 
flow of commerce.
    In January 2011, GAO reported on a number of key challenges 
to securing smart grid systems and networks. For example, the 
Federal Energy Regulatory Commission, or FERC, which has 
responsibility for adopting cybersecurity and other standards 
it deems necessary to ensure grid functionality and 
interoperability, had not developed a coordinated approach with 
other regulators to monitor industry compliance with voluntary 
standards. In addition, we reported other challenges affecting 
industry efforts to secure the smart grid. Specifically, the 
electricity industry had not consistently built security 
features under certain smart grid devices, established an 
effective mechanism for our sharing cybersecurity information, 
and created a set of metrics for evaluating the effectiveness 
of cybersecurity controls.
    GAO made several recommendations to FERC aimed at 
addressing these challenges, and the Commission agreed with our 
recommendations.
    To summarize, Mr. Chairman, the electricity industry is in 
the midst of a major transformation as a result of smart grid 
initiatives. While these initiatives hold the promise of 
significant benefits, including a more resilient electric grid, 
lower energy costs, and the ability to tap alternative sources 
of power, the prevalence of cyber threats aimed at the Nation's 
critical infrastructure and the cyber vulnerabilities arising 
from the use of new technologies highlight the importance of 
securing smart grid systems. In particular, it will be 
important for Federal regulators and other stakeholders to work 
closely with the private sector to address key cybersecurity 
challenges posted by the transition--posed by the transition to 
smart grid technology. While no system can be made 100 percent 
secure, proven security strategies could help reduce risks to a 
manageable and acceptable level.
    Chairman Stearns, Ranking Member DeGette, and other members 
of the subcommittee, this completes my statement, and David and 
I would be happy to answer your questions.
    [The prepared statement of Mr. Wilshusen and Mr. Trimble 
follows:]
[GRAPHIC] [TIFF OMITTED] 76641.003

[GRAPHIC] [TIFF OMITTED] 76641.004

[GRAPHIC] [TIFF OMITTED] 76641.005

[GRAPHIC] [TIFF OMITTED] 76641.006

[GRAPHIC] [TIFF OMITTED] 76641.007

[GRAPHIC] [TIFF OMITTED] 76641.008

[GRAPHIC] [TIFF OMITTED] 76641.009

[GRAPHIC] [TIFF OMITTED] 76641.010

[GRAPHIC] [TIFF OMITTED] 76641.011

[GRAPHIC] [TIFF OMITTED] 76641.012

[GRAPHIC] [TIFF OMITTED] 76641.013

[GRAPHIC] [TIFF OMITTED] 76641.014

[GRAPHIC] [TIFF OMITTED] 76641.015

[GRAPHIC] [TIFF OMITTED] 76641.016

[GRAPHIC] [TIFF OMITTED] 76641.017

[GRAPHIC] [TIFF OMITTED] 76641.018

[GRAPHIC] [TIFF OMITTED] 76641.019

[GRAPHIC] [TIFF OMITTED] 76641.020

    Mr. Stearns. All right, and I understand, Mr. Campbell, 
your opening statement is welcome.

                TESTIMONY OF RICHARD J. CAMPBELL

    Mr. Campbell. Good morning, Chairman, Ranking Member, and 
members of the subcommittee, my name is Richard Campbell. I am 
a Specialist in Energy Policy for the Congressional Research 
Service. On behalf of CRS, I would like to thank the Committee 
for inviting me to testify here today. I would like to request 
that my written testimony be entered into the record.
    Mr. Stearns. By unanimous consent, so ordered.
    Mr. Campbell. My testimony will provide background on the 
development of the smart grid, the Department of Energy's 
vision for the smart grid, and plans for the cybersecurity of 
the smart grid. I should note that CRS does not advocate policy 
or take a position on specific legislation.
    The electrical grid in the United States comprises all of 
the power plants generating electricity, together with the 
transmission and distribution systems which bring power to end-
use customers. The grid also connects the many public and 
private electricity companies and power companies throughout 
the United States. The modernization of the grid to accommodate 
today's power flows, serve reliability needs, and meet future 
projected uses is leading to the incorporation of the 
electronic intelligence capabilities for power control and 
operations monitoring. The smart grid is the name given to this 
evolving intelligent electricity network. While these 
intelligent components may enhance the efficiency of grid 
operations, they also potentially increase the susceptibility 
of the grid to cyber, that is, computer-generated, attack, 
since they are built around microprocessor devices controlled 
by software programming. The potential for a major disruption 
or widespread damage to the Nation's power system from a large-
scale cyber attack has increased focus on the cyber security of 
the smart grid.
    The Department of Energy summarized its view of the 
potential of the smart grid by the year 2030 as a fully 
automated power delivery network that monitors and controls 
every customer and node, ensuring a two-way flow of electricity 
and information between the power plant and the appliance, and 
all points in between.
    Federal funding has been provided to help develop concepts 
and technologies for the smart grid. The American Recovery and 
Reinvestment Act of 2009 provided $4.5 billion in funding to 
the DOE for projects to modernize the grid. DOE's Smart Grid 
Investment Grant program received $3.5 billion of these funds 
with the expressed purpose of stimulating the rapid deployment 
of advanced digital technologies needed to modernize the grid.
    The SGIG is a cost-shared program, meaning recipients of 
grants were to provide as much as 50 percent of a project's 
total costs.
    According to a recent report from the DOE's Office of 
Inspector General, all the available grant funds from the SGIG 
program have been awarded to 99 recipients, with awards ranging 
in value from $397,000 to $200 million. An approach to 
cybersecurity was required as part of the SGIG application 
process. Recipients of awards were required to submit a 
detailed plan addressing specific cybersecurity elements and 
concerns. The DOEIG report observed that DOE approved these 
cybersecurity plans even though weaknesses in the plans were 
identified and not fully addressed. The DOE responded to the 
report saying that it will require award recipients to update 
their cybersecurity plans later this year.
    The DOE funded the development of the recently released 
Roadmap to Achieve Energy Delivery Systems Cybersecurity. This 
Roadmap provides a plan to improve the cybersecurity of the 
electricity, oil, and natural gas sectors.
    The Roadmap recognizes the changing landscape of 
cybersecurity, and the continuing need to seek out and address 
cybersecurity gaps, and includes an implementation strategy for 
cybersecurity built on milestones to be achieved by the year 
2020.
    The DOE has recently begun to update its vision for the 
smart grid, focusing on three key attributes it sees as 
desirable for the smart grid of the future: a seamless, cost-
effective electricity system; a system capable of accommodating 
all generation choices; a system which enables customer choice.
    According to this updated vision, the smart grid will still 
see regional diversity in power choices, while allowing for the 
development of a national framework. According to DOE, a 
reliable, secure, and resilient grid will be the key to 
achieving this vision.
    In conclusion, it is the very features which can add 
seamless integration and utility to the smart grid that also 
add cyber vulnerabilities to electricity networks. Some assert 
that the smart grid and cybersecurity systems will have to 
develop along parallel but interconnected paths if the electric 
grid of the future is to develop in a manner that can enhance, 
and not impair, future economic development.
    Congress could provide funding for research and development 
of systems to bridge gaps in cybersecurity and build the smart 
grid. Federal funding could also be used to bring government 
and industry together in forums to address the needs and 
directions of these developing systems.
    Congress may also provide for a regulatory framework which 
could achieve a basic level of cybersecurity. But due to the 
constantly changing nature of cyber threats, it is unlikely 
that effective cybersecurity of the grid will be achieved by 
regulation alone. Some assert that electric utilities must be 
focused on cybersecurity as keenly as they are on their current 
obligation to serve or to provide shareholder value.
    Thank you for the invitation to appear today. I will be 
pleased to address any questions you may have.
    [The prepared statement of Mr. Campbell follows:]
    [GRAPHIC] [TIFF OMITTED] 76641.021
    
    [GRAPHIC] [TIFF OMITTED] 76641.022
    
    [GRAPHIC] [TIFF OMITTED] 76641.023
    
    [GRAPHIC] [TIFF OMITTED] 76641.024
    
    [GRAPHIC] [TIFF OMITTED] 76641.025
    
    [GRAPHIC] [TIFF OMITTED] 76641.026
    
    [GRAPHIC] [TIFF OMITTED] 76641.027
    
    [GRAPHIC] [TIFF OMITTED] 76641.028
    
    Mr. Stearns. Thank you, Mr. Campbell. I will start with my 
questions.
    Let us see if we get something that is current here. A 2011 
bulletin by the Department of Homeland Security titled 
``Insider Threats to Utilities'' stated that ``based on the 
reliable reporting of previous incidents, we have a high 
confidence in our judgment that insiders and their actions pose 
a significant threat to the infrastructure and information 
systems of the United States facilities,'' vis-`-vis the grid. 
Mr. Wilshusen, are you aware of any specific power outage or 
threat to the electric grid that has transpired in such a way 
that is talked about in this Homeland Security report from 
2011?
    Mr. Wilshusen. You mean specifically from an insider 
threat?
    Mr. Stearns. Yes.
    Mr. Wilshusen. I can't say I know of a specific incident 
where that occurred; however, certainly insider threats are 
very important and a threat that our agencies and entities need 
to consider, because insiders typically have advanced knowledge 
and even access to the systems and the types of systems that 
contain information that they could have the ability then to 
perpetrate, if they have malicious intent to cause disruptions 
and damage. And it is not just those with malicious intent, but 
also insiders who may be careless or who may be untrained that 
conduct activities that also impair or harm their systems and 
networks. But clearly, that is a key threat.
    Mr. Stearns. Are you aware of any outsiders soliciting 
people in the smart grid viable areas? Are you aware of any 
outsiders that are trying to do this?
    Mr. Wilshusen. In terms of corrupting----
    Mr. Stearns. Yes.
    Mr. Wilshusen [continuing]. And using insider threats? I 
can't say I know of specific examples of where that occurs--
that occurred.
    Mr. Stearns. Can you describe the controls and checks in 
place at utilities to prevent these kinds of attacks?
    Mr. Wilshusen. Well, clearly one of the key controls that 
utilities and, indeed, agencies should do is background checks 
on their employees and those----
    Mr. Stearns. Are they doing the background checks, in your 
opinion, adequately?
    Mr. Wilshusen. We haven't examined the--how the securities 
are----
    Mr. Stearns. So there has been no examination of how those 
background checks have been done and how they have been 
corroborated, or the credibility of those checks?
    Mr. Wilshusen. No, we have not assessed that as part of our 
review.
    Mr. Stearns. Do you think that should be done?
    Mr. Wilshusen. Well certainly it should be monitored and 
checked, because I do believe that individuals that have 
sensitive positions and hold--and have sensitive access to 
systems should have some level of background investigation 
performed. And there are other controls, too, that should be in 
place to help restrict and limit insiders, either careless or 
untrained insiders, as well as malicious from performing these 
types of acts, and that includes by limiting their access to 
only that level needed for them to perform their jobs, as 
opposed to giving them broader access to systems.
    Mr. Stearns. The MacAfee Corporation did a report in early 
2011, another current report, in which they surveyed about 200 
executives from critical electricity infrastructure across the 
United--across the world, in fact. That found that 85 percent 
had experienced network infiltrations, and 80 percent had faced 
a large scale denial of service attack. Do you think that 
number is correct? That is quite large, 80 percent of both 
network infiltrations and 80 percent faced a large scale denial 
of service attack. Do you think those figures are accurate?
    Mr. Wilshusen. I have no basis to form whether they are 
accurate or not, but I will say as it relates to Federal 
Government agencies----
    Mr. Stearns. Is that typical?
    Mr. Wilshusen. In terms of those that have reported 
security incidents, yes, most Federal agencies have done that 
and as the Congresswoman mentioned earlier, the number of 
reported security incidents within the Federal Government has 
risen by 650 percent from 2006 through 2010.
    Now, what one disparity or inconsistency with that comment 
that you made, the statistics in that MacAfee report is that 
within the Federal Government, there was only about 1 percent 
or so of the reported security incidents were considered to be 
denial of service attacks, which would be those that would 
disrupt the----
    Mr. Stearns. So I assume you reviewed the MacAfee report 
yourself?
    Mr. Wilshusen. No, I have not.
    Mr. Stearns. How do these people get into cause these 
infiltrations? I mean, do you have any idea how it actually 
happens?
    Mr. Wilshusen. Well, there are a number of different attack 
patterns----
    Mr. Stearns. Just give me two quick, the most prevalent.
    Mr. Wilshusen. Well, one would be, for example, if they put 
malicious software on a thumb drive and then an employee of 
that corporation----
    Mr. Stearns. Puts that thumb drive into the computer?
    Mr. Wilshusen. Pardon?
    Mr. Stearns. He puts that thumb drive in the software?
    Mr. Wilshusen. Puts the thumb drive into the computer and 
then downloads the malicious software onto the computer. That 
is one way.
    Mr. Stearns. To the hard disk, yes.
    Mr. Wilshusen. Another way would be if the attacker would 
set up a malicious Web site and which would also then entice 
employees of the service center to--or wherever--to go to that 
Web site and download what appears to be an innocuous or an 
attractive program, when in fact, that too contains malicious 
code that could then allow----
    Mr. Stearns. Could the facility put software in place to 
prevent both of those from occurring?
    Mr. Wilshusen. They can, and disable certain functions--
physical ports on the laptop or on the desktop to prevent that 
from happening. And indeed, the Department of Defense had such 
an attack on their networks based upon a thumb drive that led 
them to disable the thumb drives on the vast majority of 
their----
    Mr. Stearns. Last question. Has the Department of Homeland 
Security or the Department of Energy issued any guidance to the 
electricity sector on best practices that we just talked about 
in these two cases?
    Mr. Wilshusen. Well, as part of the Energy Independence and 
Security Act, NIST, the National Institute of Standards and 
Technology, had responsibilities for developing security 
guidelines in connection with input from a number of different 
organizations that were then to be provided to FERC at 
Department of Energy to either approve if there is a consensus 
on those, and some of those controls would help to prevent such 
attacks, or could.
    Ms. DeGette. Thank you. Mr. Wilshusen, were those controls, 
in fact, promulgated by FERC?
    Mr. Wilshusen. No.
    Ms. DeGette. Why not?
    Mr. Wilshusen. It determined that there wasn't a consensus 
on those--development of those standards and cybersecurity 
guidelines, and under the Act, there--in the process are 
required to develop a consensus for----
    Ms. DeGette. So now what? Are they developing standards?
    Mr. Wilshusen. My understanding is that NIST is working to 
gain such a consensus.
    Ms. DeGette. OK. I want to talk with you a minute more 
about FERC, because what I am wondering is if they need extra 
authorities to protect the electric grid from these potentially 
dangerous vulnerabilities.
    Can you just give us a quick example of the types of 
security flaws that might leave the grid vulnerable to hackers?
    Mr. Wilshusen. One would be if they do not appropriately 
assess the risk to those various different components of the 
smart grid and implement the appropriate security controls over 
that. For example, if the access controls are not appropriately 
applied to different components of the grid, that could 
potentially allow a path into----
    Ms. DeGette. And of course, the development of this smart 
grid increases this risk because it is more and more 
computerized, correct?
    Mr. Wilshusen. Yes, the increased use of IT systems and 
networks provide additional paths and access points for 
potential attackers to gain access to it. In addition, the 
increasing interconnectivity of these systems and networks also 
allow potential attackers broader range and access to other 
devices.
    Ms. DeGette. And yet at the same time that there is broader 
vulnerability, the increased interconnection and the smart--
development of the smart grid, it is a really valuable part of 
our system because it gives us--number one, it gives us more 
efficiency so consumers can get better prices, and number two, 
it allows us to use some of these renewable technologies that 
the chairman was talking about in his opening statement, 
correct?
    Mr. Wilshusen. Yes.
    Ms. DeGette. And so here is my question. The GAO and others 
have said that there could be gaps in the FERC's regulatory 
authority to deal with development of these standards to 
respond to new vulnerabilities. Can you talk about that for a 
minute?
    Mr. Wilshusen. Well in our recent report that we issued 
back in January of 2011, we identified that FERC did not have 
appropriate authorities, that their authorities were pretty 
much--since they didn't have the appropriate authorities, their 
authorities were limited to basically adopting and approving 
standards that were developed by others for the smart grid, and 
then primarily just at the bulk power level and bulk power 
supply level, not necessarily at the distribution level where 
certain smart grid investments and devices are being 
implemented. And we made the recommendation to NERC that they 
need to really work with these other parties and stakeholders 
to include the State public utility commissions that do have 
such authorities and responsibilities to monitor the 
implementation of any standards that it adopts.
    Ms. DeGette. So----
    Mr. Wilshusen. And it had not done that.
    Ms. DeGette. So do they have the authority to do that, or 
does Congress need to give them more authority to coordinate 
with those other operators?
    Mr. Wilshusen. Well, they have the authority to coordinate 
with the other operators----
    Ms. DeGette. OK.
    Mr. Wilshusen [continuing]. And utility commissions at the 
State level----
    Ms. DeGette. OK.
    Mr. Wilshusen [continuing]. But they don't have the 
authority to mandate particular cybersecurity standards.
    Ms. DeGette. Do you think they need that authority?
    Mr. Wilshusen. We do not make that recommendation or really 
go there. We just actually made the recommendation to FERC that 
it determined whether, you know, what gaps overlaps exist, so--
--
    Ms. DeGette. Yes, so if FERC determined that, they could 
come to us----
    Mr. Wilshusen. Right.
    Ms. DeGette [continuing]. And ask for that authority.
    Mr. Wilshusen. That is correct.
    Ms. DeGette. Now, there are some--do you know how many of 
these local and State authorities there are that FERC would 
need to be coordinating with?
    Mr. Trimble. Well, you are--FERC is----
    Ms. DeGette. Mr. Trimble?
    Mr. Trimble. Yes, sorry.
    Ms. DeGette. That is OK.
    Mr. Trimble. FERC is--has jurisdiction over the bulk power 
system, but once it gets into the distribution system at the 
State level or at the local level, it falls to the State 
utilities. So the----
    Ms. DeGette. There are thousands of them, right?
    Mr. Trimble. Right, so you are talking about 50 States plus 
those that aren't under State control or under minimal State 
control.
    Ms. DeGette. Right, and then there is other agencies like 
Homeland Security, Energy and National Security Agency that 
also have oversight responsibilities over the critical 
electrical infrastructure, correct?
    Mr. Trimble. Um-hum.
    Ms. DeGette. So all of those individual utilities would 
have to work together to really address this, right?
    Mr. Trimble. That is correct.
    Ms. DeGette. OK. Now, one last question, Mr. Chairman. I 
have got a lot more questions in this line, but maybe I will 
have an opportunity to ask then, but the Energy Independence 
and Security Act of 2007 directed the National Institute of 
Standards and Technologies to develop those standards, but 
those standards haven't been adopted for the reasons Mr. 
Wilshusen just explained, right?
    Mr. Trimble. Right.
    Mr. Wilshusen. That is correct.
    Ms. DeGette. And do we have any sense when they are going 
to be adopted, now that it has gone back to the agency?
    Mr. Trimble. We have not seen a timeline.
    Ms. DeGette. OK, thank you.
    Mr. Stearns. The gentlelady from Tennessee is recognized 
for 5 minutes.
    Mrs. Blackburn. I thank you all and appreciate so much the 
time that you are giving us today, and continuing to work with 
us through this issue.
    I have found it so interesting, as we have worked through 
these hearings, how our constituents are paying attention to 
this, and how they come back to us, those constituents that are 
working in informatics or in energy delivery systems, and they 
have different things they want to add to the discussion that 
we are having.
    One question I do have on the smart meters that are out 
there. Is there a way that someone's proprietary information is 
being tracked or pulled or hacked into--what are the 
protections that are on these meters? Can you give me just a 
little bit of information on that, because some of our 
constituents--and Ms. DeGette talked about this when she said 
people can watch and find out when the electricity is going to 
cost them less and then do chores at that time, but our 
customers are saying now wait a minute. Is this--while it is 
giving me information, is this going to be giving--what are the 
protections, the privacy protections that are going to exist to 
the consumer about protecting that virtual presence and 
knowledge of themselves?
    Mr. Wilshusen. Right, that is certainly an area of concern 
insofar as that those meters need to have the appropriate 
cybersecurity, information security controls built into them. 
We convened a panel of cybersecurity experts as part of our 
review that we issued a report back in January of 2011, and 
they identified that there are control deficiencies in some of 
those meters, to include not having the appropriate login 
capabilities, which would help and--or the forensics 
capabilities to determine how and whether an attack had 
occurred.
    Mrs. Blackburn. OK, then let me ask you this. With those 
meters, would it be easy just to--is it very easy just to hack 
into them? Should people consider there to be so much 
transparency in these that they are not protecting their usage? 
Help me with that.
    Mr. Wilshusen. Well, I would just say that it really 
depends upon the facts and circumstances of each individual 
type of meter----
    Mrs. Blackburn. OK.
    Mr. Wilshusen [continuing]. And the security 
vulnerabilities or strengths relative to the individual meters.
    Mrs. Blackburn. OK. Mr. Wilshusen, I want to ask you, May 
'08 you made some comments about TVA's corporate network 
contains security weaknesses that could lead to disruption of 
their control systems, and of course, for those of us in the 
Tennessee Valley and TVA as the main power generator, we are 
very concerned about that. You had 19 specific recommendations 
that you had for the TVA at that point in time. In your follow 
ons, has TVA implemented these? Have they been responsive to 
putting these controls in place? How are we doing with 
tightening that system up?
    Mr. Wilshusen. Yes, TVA has been responsive in implementing 
not only the 19 recommendations that were made in the public 
report, but also we made a number of other recommendations in a 
limited distribution report----
    Mrs. Blackburn. Exactly, yes.
    Mr. Wilshusen [continuing]. That dealt more with the 
technical controls over their networks and their industrial 
control system networks. TVA has been responsive, has 
implemented most, if not all, of our recommendations and we 
have closed them out.
    Mrs. Blackburn. Thank you. With that, I will yield back.
    Mr. Stearns. Gentlelady yields back. Ms. Myrick is 
recognized for 5 minutes.
    Mrs. Myrick. Thank you, and really, this is for any of you, 
but it concerns giving the cybersecurity threats and the 
weaknesses that were identified in the GAO report and in the 
Inspector General for the Department of Energy's report. It 
seems to be that cybersecurity is not a real high priority with 
some companies today, and given the wealth of information that 
is out there about the threats that exist--I am also on Intel 
and we deal with this all the time. And it just seems apparent 
to me that we--that companies really aren't taking this as 
seriously as they should. Not just companies, of course, 
dealing with the electric grid, but other companies as well 
when it comes to how they fit into the big picture in the 
country.
    Is it because they don't feel that there is any incentive 
for them to do it in any way? I am at a little of a loss, I 
guess, because some of them just seem to be kind of blase about 
it, even though they are so vulnerable. It is unreal and then 
it affects the rest of us from a national security standpoint.
    Mr. Trimble. I would answer in two ways. One, from our 
expert panel that we convened one of the concerns that they had 
was confusion and uncertainty over who is in charge in terms 
of----
    Mrs. Myrick. OK.
    Mr. Trimble [continuing]. Where the guidance was given, the 
complexity of the regulatory oversight. From--if you are 
putting yourself in the producer of the utilities perspective, 
they are faced with--so the standards haven't been adopted, 
even though--even when they are adopted, they are voluntary, 
and then if you are a producer under State control, you don't 
have anything from the States. To recover those costs, to make 
those investment decisions, those costs have to be recoverable. 
There is no necessary guarantee that you will recover those 
costs if you make those investments in this uncertainty.
    So again, this goes back to our recommendation as to when 
you adopt, you need to closely monitor to what extent these 
standards are being followed and to what extent they are 
effective, and make changes quickly. So it really, you know, 
sort of asking the system something it hasn't done necessarily 
in the past, which is act quickly and sort of more nimbly than 
it has. But I think part of the answer is really I would just 
put yourself in the shoes of the utility when faced with making 
those decisions and trying to balance the cost and benefits and 
risks that you are looking at.
    Mr. Wilshusen. And I want to add to that. Also in some 
instances these utilities may or may not be fully aware of some 
of the threats and risks that are there, particularly certain 
incidents. In many cases, some of the most actionable and alert 
information may not necessarily be able to be shared with the 
utilities because it is classified.
    Mrs. Myrick. Right.
    Mr. Wilshusen. And so the information sharing equation is 
also a factor in terms of the agency--or the utilities 
receiving timely and actionable information.
    We issued a report a year ago or 2 years ago that dealt 
with the expectations and the delivery of those expectations 
between the public-private partnership model that is currently 
in use, and many--this is not only just the electricity 
industry, but also across other critical infrastructure 
sectors, in that most of the respondents on the private sector 
side indicated that--in fact, 98 percent of them said that 
receiving timely, actionable, alert and threat information was 
very important to them, but only 27 percent of them responded 
and said that their Federal partners were greatly or moderately 
providing that information to them.
    Mrs. Myrick. So it is not a resistance or lack of 
understanding on the part of the companies from your 
perspective and what you are seeing, it is really that they--
that this aspect of who is in charge and who they report to and 
how they get the information and what information they get is 
really the problem?
    Mr. Wilshusen. It is a contributing factor.
    Mrs. Myrick. OK. Anybody else wish to comment?
    Then I yield back, Mr. Chairman. Thank you.
    Mr. Stearns. Gentlelady yields back. The gentleman from 
Georgia, Mr. Gingrey, is recognized for 5 minutes.
    Mr. Gingrey. Thank you, Mr. Chairman, and I am going to 
address my first question to all three of you, and I think I 
will start with Mr. Campbell.
    Each of you mentioned in the January 2012 report issued by 
the Department of Energy's Inspector General that 36 of the 99 
grant recipients did not have the sufficient security plans in 
place to provide further risk determent, despite the fact that 
the Federal Government has spent, I think you said $3.5 billion 
in taxpayer money for this Smart Grid Investment Grant Program. 
Now while I am disappointed that for scheduling purposes it 
prevented the DOE Inspector General from being here today, I 
would like to ask each of you your thoughts on these three 
questions, and I will start with Mr. Campbell. What are the 
potential implications of these insufficient security controls?
    Mr. Campbell. Well basically smart grid devices are being 
developed that may not have full cybersecurity mechanisms built 
in. So if these devices do actually make it to market, there 
could be problems with cybersecurity of the devices going 
forward.
    Mr. Gingrey. Mr. Trimble?
    Mr. Trimble. Yes, I will--what I would add to that, and I 
will defer to my colleague on the cyber aspect of this, that 
one of the downsides if you end up with devices that don't meet 
the standards or aren't sufficiently protected and then the 
utility has to pull those out, you have created a problem in 
terms of who is going to pay for that mistake, because they 
will go to the public utility to recover those costs, the 
public is not going to want to pay for the mistake, and so you 
will have a very contentious situation.
    Mr. Wilshusen. Yes, I would agree with both Mr. Trimble and 
Mr. Campbell in that it could create opportunities where key 
controls are not being implemented into these devices or not 
being implemented in whatever the initiative and grant 
initiative had was developing. One thing that was noted by the 
IG is that these were approved even though the Department had 
requested that the plans be updated, which they were, but not 
in all instances were those key controls addressed and the 
Department has to approve that.
    According to the IG report, if I read that correctly--
again, I defer to the DOEIG on that--is that there was 
apparently an emphasis on the part of the Department to make 
sure that these grants were approved and gotten out.
    Mr. Gingrey. We--as the chairman said in his opening 
remarks, we had hoped to have the IG from DOE here today, and 
hopefully we will schedule another hearing and hear from him.
    But going back to Mr. Campbell, throughout the life of the 
grant, is it feasible that these problems that exist could 
still be corrected?
    Mr. Campbell. The DOE's office has responded that it will 
require the applicant grantees to update their cybersecurity 
plans, I believe it is by April of this year.
    Mr. Gingrey. All right, Mr. Trimble and Mr. W., you all 
have some comments on that as well?
    Mr. Wilshusen. Yes. I would just also add that in the 
report, the IG indicated that the Department was also going to 
be, as part of their annual review process of these grant 
initiatives, were to review the recipient's implementation of 
those cybersecurity controls in their plans.
    Mr. Gingrey. And then the last part of this question, and I 
see I am probably only going to get one question in in the 
allotted 5 minutes, but with this report in mind, the DOE 
Inspector General report, do you know of any instances in which 
the smart grid for which the grant program was supposed to 
bolster has been compromised from a security standpoint? Mr. 
Campbell, any specifics there?
    Mr. Campbell. I am not aware of any specifics.
    Mr. Gingrey. Mr. Trimble?
    Mr. Trimble. No, sir.
    Mr. Wilshusen. No, sir.
    Mr. Gingrey. OK. I do have a little bit of time left. Let 
me go--let us see, back to--well that is all right. I will just 
save that if there is a second round.
    Mr. Chairman, I yield back the balance of my time.
    Mr. Stearns. All right, gentleman yields back. We will do a 
second round and I will start.
    Mr. Wilshusen, in your testimony you stated that Department 
of Energy Inspector General found that under the Smart Grid 
Investment Grant Program, recipients were not always complete 
or lacked sufficient detail in security controls in their 
submissions to Department of Energy. Is that correct?
    Mr. Wilshusen. Yes, sir.
    Mr. Stearns. Is that a big deal?
    Mr. Wilshusen. Yes, it can be.
    Mr. Stearns. And why, specifically?
    Mr. Wilshusen. Well, if those----
    Mr. Stearns. Why is it a big deal?
    Mr. Wilshusen. Well, if it is----
    Mr. Stearns. I think it is a big deal, but I just want you 
to confirm it.
    Mr. Wilshusen. If those plans are incomplete and do not 
identify key controls that should be implemented on as part of 
these smart grid initiatives, that could lead to vulnerable 
devices and therefore, may subject those devices to increased 
risk of being compromised.
    Mr. Stearns. So you have a smart meter device being 
purchased with government grant money that lacks the proper 
security features and if the guarantees don't have specific or 
detailed security plans when installing them into the 
customer's homes, isn't that it?
    Mr. Wilshusen. That could be a possibility.
    Mr. Stearns. Mr. Trimble, is it conceivable that during the 
life of the grant period, that these security plans are not 
complete, are not implemented properly, unless made a condition 
of the grantee to receive the funding? Should we do that?
    Mr. Trimble. I believe that should have been a requirement 
or----
    Mr. Stearns. Do you have your mic on?
    Mr. Trimble. I believe that is what the IG indicated, but 
that was not our work so I can't speak authoritatively.
    Mr. Stearns. Do you know of any specific examples that I 
could hear from you, or Mr. Wilshusen?
    Mr. Wilshusen. Well in the IG report, they identified three 
of the five security plans that it reviewed. These were the 
plans that had already been initially identified by the 
Department as having deficient or shortcomings in the security 
programs, and then updated by the recipient or the grantee 
recipients, and they identified that three of the five still 
had the shortcomings and did not contain complete information. 
And some of that information dealt, as I recall, with the 
auditing and some of the technical security controls associated 
with those initiatives. But as far as more detailed 
information, I did not review or have access to the work papers 
supporting the report by the IG.
    Mr. Stearns. Is this all primarily in the smart meter 
technology? Is that where all this concern is?
    Mr. Wilshusen. With the IG's report, I don't think it was 
specific to that. I don't recall if it was specifically 
mentioned.
    Mr. Stearns. Isn't that where most of the investment is?
    Mr. Wilshusen. That also I don't know.
    Mr. Stearns. Yes, Mr. Trimble?
    Mr. Trimble. I believe it was in a broader range. I thought 
the bulk of the money was into other systems like phase 
measurement units and things like that, but again, we haven't 
done work in that area.
    Mr. Stearns. Mr. Campbell, how many, in your opinion, smart 
grid cyber incidents have there been?
    Mr. Campbell. I am not familiar with the total number, but 
from I have heard in discussion there has been quite a few 
cybersecurity incidents.
    Mr. Stearns. Under 10, under 100?
    Mr. Campbell. Probably more than that.
    Mr. Stearns. Under 1,000?
    Mr. Campbell. I couldn't say with any specific.
    Mr. Stearns. So you have no knowledge of how many specific 
system cyber attacks there have been, incidents, then?
    Mr. Campbell. No, sir.
    Mr. Wilshusen. Mr. Chairman----
    Mr. Stearns. Yes, sure.
    Mr. Wilshusen [continuing]. If I might add, I am not even 
sure if there is a monitoring process or reporting mechanism in 
place for that information to be reported and collected.
    Mr. Stearns. Mr. Campbell, do you think that waiting 3 
years for the grant recipients to implement vigorous 
cybersecurity plans could lead to cybersecurity gaps and 
subsequent compromises in the system integrity?
    Mr. Campbell. It is my opinion----
    Mr. Stearns. If you might pull the mic just a little 
closer.
    Mr. Campbell. It is my opinion that during the 3-year 
period for development, there should be adequate time for the 
DOE to take a look at the requirements in regard to 
cybersecurity, but we should also note that cyber threats are 
continuing to change, so any regulations that you may put in 
place may not be adequate when the final product rolls out.
    Mr. Stearns. OK. My last question, Mr. Wilshusen, are there 
different cybersecurity challenges that are vulnerabilities for 
government-run utility services, such as the Bonneville Power 
Administration versus privately-run utility services?
    Mr. Wilshusen. We haven't looked at the specific security 
controls at private utilities. We have looked at them at TVA, 
and identified a number of security vulnerabilities----
    Mr. Stearns. At TVA?
    Mr. Wilshusen. At TVA, yes, as this was the report that was 
referred to earlier. But my understanding is, it is probably 
likely that what we found at TVA will probably be--could be 
found at other public utilities as well, you know, of a similar 
type of electrical power generation and some transmission.
    Mr. Stearns. Mr. Trimble, anyone else, do you have any 
comments in reference to the private versus government-run 
utilities?
    Mr. Trimble. No, I would defer to Greg on that.
    Mr. Stearns. Mr. Campbell, any suggestions?
    Mr. Campbell. No, that seems to be a reasonable response. 
Private utilities seem to have many of the same systems that 
public utilities have.
    Mr. Wilshusen. And one--if I may just add more broadly, 
when we looked at other sectors, for example, we looked at 
communications network operated by private sector 
organizations, we found vulnerabilities in their networks that 
were similar to the vulnerabilities that we find in the 
networks of Federal agencies. Now while that is not exactly 
electricity industry, but I would be fairly confident to say 
that vulnerabilities identified in government systems are going 
to probably be found in private sector systems in some respects 
because the Federal Government security standards and 
guidelines typically are as robust, if not more robust, than 
private sector guidelines in many cases.
    Mr. Stearns. Thank you. My concluding comment is if it hits 
one sector, it hit government utility versus private utility, 
it is probably the same kind of statistic.
    Mr. Wilshusen. I would agree with that comment, which is 
all the more reason why there should be an effective and robust 
information sharing capability between the public and private 
sectors.
    Mr. Stearns. With that, my time is expired.
    Ms. DeGette. Thank you. Thank you, Mr. Chairman.
    I want to follow up on the chairman's question about 
reporting, because I think I shared his concern. Mr. Campbell 
and Mr. Wilshusen, both of you--all three of you said we don't 
have any kind of specific knowledge as to how many cyber 
attacks there have been. And Mr. Wilshusen, you said that we 
don't really have a systematic approach to reporting. Would it 
be possible to develop that kind of systematic approach, and if 
we did, how would it look, who would be in charge of it, et 
cetera?
    Mr. Wilshusen. Well, we haven't done the work to come up 
and just say definitively, but there are some reporting 
mechanisms in place now. For example, the Department of 
Homeland Security and the U.S. Cert Federal agencies are 
required to report their security incidents that occur at their 
sites to U.S. Cert, and then U.S. Cert collects that 
information and makes reports on it, summarizes it, identified 
trends, and also then provides alerts to other Federal 
agencies.
    Private sector organizations can also report through to the 
U.S. Cert, although in terms of having something formal and 
required, that is--presently does not exist.
    Mr. DeGette. Well, so there is a structure that perhaps you 
could do it, there is just no requirement to do it, is that 
what you are saying?
    Mr. Wilshusen. It may be a model that could be considered 
if one was to develop such a reporting structure.
    Ms. DeGette. Do you think it would be important to have 
some sense of incidences of cyber attacks?
    Mr. Wilshusen. Oh, I certainly do, yes.
    Ms. DeGette. What do you think, Mr. Campbell?
    Mr. Trimble. What I would--I am sorry, what I would just 
jump in on this point is when we convened our expert panel, one 
of the challenges and problems that the experts identified was 
the lack of information sharing among the utilities and the 
generators and the government on precisely these issues, the 
cyber attacks, successful or not.
    Ms. DeGette. So did--so now we have identified--and Mr. 
Campbell, would you agree there is a problem?
    Mr. Campbell. Yes, but I would also think confidentiality 
of reporting would be a key factor in any system that is 
developed.
    Ms. DeGette. Right, so who would develop that system? I 
mean, we are super good at identifying problems, but now how do 
we move towards a solution? Anyone?
    Mr. Wilshusen. Well, within the Federal Government, you 
know, DHS has the overriding responsibility as the focal point 
for protecting critical infrastructures. Each of the 18 
critical sectors--infrastructure sectors have sector-specific 
agencies that monitor it for that particular----
    Ms. DeGette. Yes, I understand all this, so you would say 
it would probably be DHS to develop this?
    Mr. Wilshusen. They have a model in place where Federal 
agencies are required to. It would be a likely place to start.
    Ms. DeGette. OK, thank you.
    Mr. Campbell, I want to follow up on the point about 
privacy that you just raised, because I don't know if the three 
of you saw the story in ``The Washington Post'' today where 
what it talked about was the National Security Agency is 
pushing to expand its role in protecting private sector 
computer networks from cyber attacks. The White House has been 
concerned about privacy concerns, and then the story said ``The 
most contentious issue was a legislative proposal last year 
that would have required hundreds of companies that provide 
such critical services as electricity generation to allow their 
internet traffic to be continuously scanned using computer 
threat data provided by the spy agency. Companies would have 
been expected to turn over evidence of potential cyber attacks 
by the government.'' So this really is an issue about how you 
balance security versus privacy. We have been debating this 
pretty much since September 11, 2001.
    And so maybe, Mr. Campbell, you can talk to me if you have 
some perspective on the tradeoff of cybersecurity versus 
privacy.
    Mr. Campbell. Well, I would say that cybersecurity versus 
privacy is a key issue. Other than that, I would say that we--
CRS is looking at the issue and we would be happy to talk to 
you about it at a later time.
    Ms. DeGette. And you released--CRS released a report on 
privacy and cybersecurity concerns earlier this month, did it 
not?
    Mr. Campbell. Yes.
    Ms. DeGette. And so let me ask you, what information can 
smart meters collect about the people in the households who 
have them? I mean, what is the security issue?
    Mr. Campbell. Well, smart meters collect information on the 
use of electricity, and so the idea is that smart meters 
conceivably could develop a profile of the use of electricity 
within the home. Now if the information is accumulated at a 
high enough level, then individual use of information could be 
lost, but that is an issue that is under development and I 
think in various States there are various rules concerning 
smart meter----
    Ms. DeGette. And that information, it could determine the 
behavioral patterns of the residents in the home, correct?
    Mr. Campbell. Correct.
    Ms. DeGette. So like burglar could figure out--could use a 
smart meter to figure if a family was on vacation or not, 
right?
    Mr. Campbell. If they were sophisticated enough to access 
the information.
    Ms. DeGette. Or a marketer could even use information about 
what appliances a consumer might be using to target that 
consumer, right?
    Mr. Campbell. Possibly.
    Ms. DeGette. So that--I mean, we wouldn't naturally think 
that there would be security issues relating to these meters, 
but that is something we need to consider and balance out, 
right?
    Mr. Campbell. Correct.
    Ms. DeGette. Thank you, Mr. Chairman.
    Mr. Stearns. Gentleman from Georgia is recognized for 5 
minutes.
    Mr. Gingrey. Thank you, Mr. Chairman.
    You know, as I sit here and think about this program and 
the $3.5 billion worth of grant money going towards these 
companies, grantees, 99 of them to help develop the smart grid, 
I also think about the $19 billion that was in the stimulus 
money for fully developing health information technology, you 
know, the Offices of National Coordinator and his salary and 
all the employees there to make sure that people, companies 
small and large that got grants from that $19 billion pot to 
help develop health information technology that is fully 
coordinated, it just makes me concerned that these grantees 
under this program to develop the smart grid are not following 
the guidelines that they should follow and in the final 
analysis 3 years from now we will have wasted a lot of money.
    I want to ask you specifically, you mentioned--and maybe 
some of my colleagues had asked a question about NIST's 
involvement, the National Institute of Standards and 
Technology, the 850-3 program as compared, let us say, to the 
North American Electric Reliability Corporation's critical 
infrastructure protection standards. Now how do those two 
compare and are they overlapping? Are they similar? Is one 
better than the other? What standards should we require of 
these grantees as they develop these programs with taxpayer 
money? Mr. Campbell?
    Mr. Campbell. My knowledge that the NERC reliability 
critical infrastructure standards are just applied to those on 
the bulk electric system, so when we are talking about the 
Smart Grid Investment Grant Program, that is looking at 
developing products, so I think what we are talking about is 
two different types of requirements.
    Mr. Gingrey. Mr. Trimble and Mr. Wilshusen?
    Mr. Wilshusen. I will field that one. Also there is--we 
actually compared the NERC's eight cyber--critical 
infrastructure protections cybersecurity reliability standards 
to the controls that are identified and NIST Special 
Publication 850-3, and we found that of the 198 controls in 
850-3 that the NIST or the NERC standards had about 151 of 
those. One of the issues that the IG reported on in its report, 
also in addition to what Mr. Campbell said, is that those 
standards apply only to the bulk electricity supply, but there 
further only apply to those assets that the entities within 
that sector have designated as a critical asset. And so if the 
entity has not identified any critical assets, then those 
standards would not necessarily apply.
    And the IG report also indicated that back in 2009, the 
former chief information security officer of NERC did a survey 
and identified that about, I think it was 36 percent of the 
power generators, or those entities with power generation and 
about 67 percent of those responsible for transmitting bulk 
power had identified only--at least one critical asset. So that 
left a fair number of--or at least a fair percentage of 
entities that produce power or transmit it that did not 
identify any critical assets.
    Mr. Gingrey. Mr. Trimble?
    Mr. Trimble. I would just--my expertise is not cyber, so I 
will--so to simplify that, the issue as I sort of have come to 
understand it is the NERC CIP standards apply to--for critical 
infrastructure protection but it is limited because it is just 
bulk power and it is just those that the industry have 
identified as being critical assets. But industry self-
identification has not been exactly--has been identified as 
comprehensively as it could be.
    The NIST standards that we are talking about for cyber 
pursuant to ISA are voluntary, primarily focused on 
interoperability and cyber threats. The limitation there is 
that FERC's sort of bailiwick is, again, bulk power so it 
doesn't get into anything beyond sort of interstate 
transmission, if you will. If you are getting into the State 
level, those guidelines, those standards, even though 
voluntary, don't kick in. If you get down to the city level, 
like New York, they don't kick in. So you have got this 
patchwork where there is a whole bunch of places with no 
standards that kick in.
    Mr. Gingrey. My time is expired, but I just want to say 
that, you know, it is pretty much green eyeshades sort of 
stuff, but hugely important, and of course, you are bringing 
important information to us, the members of the subcommittee, 
and I think this is very beneficial. I deeply appreciate you 
being here today, and thank you for your testimony.
    Mr. Chairman, I yield back.
    Mr. Stearns. Thank the gentleman and we are getting ready 
to conclude the hearing, and I, as chairman, have the 
opportunity to give a closing remark. I would say it has been 
brought up here and also I remember in our July hearing. 
Department of Homeland Security fields all this information 
dealing with cybersecurity and then gives it to U.S. Cert 
agency, and they offer the documentation, as I understand it, 
to the private industry, so it sort of filters down that way. 
Is that correct?
    Mr. Wilshusen. I believe it is, yes.
    Mr. Stearns. Well, my concern is, just like the 9/11 
Commission said, there was not full communication between all 
the government agencies as well as private industries on what--
to alert them of possible information it could have thwarted 
and stopped the 9/11 attack. I see it is clear here today in 
the conversation that there is not really full adequate 
communication between the private sector and the government 
sector dealing with utilities with cybersecurities, and I think 
this is a warning that we should all take into effect or we 
might be sitting here at a later date with something that is 
very serious.
    I want to thank the witnesses for their time and effort, 
and the subcommittee is adjourned.
    [Whereupon, at 11:37 a.m., the subcommittee was adjourned.]

                                 
