    [House Hearing, 114 Congress]
    [From the U.S. Government Publishing Office]

                          EXAMINING VULNERABILITIES OF
                             AMERICA'S POWER SUPPLY

    =======================================================================

                                 JOINT HEARING

                                   BEFORE THE

                          SUBCOMMITTEE ON OVERSIGHT &
                             SUBCOMMITTEE ON ENERGY

                  COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY
                            HOUSE OF REPRESENTATIVES

                        ONE HUNDRED FOURTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                               September 10, 2015

                                   __________

                               Serial No. 114-37

                                   __________

     Printed for the use of the Committee on Science, Space, and Technology

     [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

           Available via the World Wide Web: http://science.house.gov

                                   ____________

                           U.S. GOVERNMENT PUBLISHING OFFICE
    97-756PDF                      WASHINGTON : 2016

    ________________________________________________________________________________________
    For sale by the Superintendent of Documents, U.S. Government Publishing Office,
    http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
    U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
    E-mail, gpo@custhelp.com.

                  COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY

                       HON. LAMAR S. SMITH, Texas, Chair
    FRANK D. LUCAS, Oklahoma             EDDIE BERNICE JOHNSON, Texas
    F. JAMES SENSENBRENNER, JR.,         ZOE LOFGREN, California
        Wisconsin                        DANIEL LIPINSKI, Illinois
    DANA ROHRABACHER, California         DONNA F. EDWARDS, Maryland
    RANDY NEUGEBAUER, Texas              SUZANNE BONAMICI, Oregon
    MICHAEL T. McCAUL, Texas             ERIC SWALWELL, California
    MO BROOKS, Alabama                   ALAN GRAYSON, Florida
    RANDY HULTGREN, Illinois             AMI BERA, California
    BILL POSEY, Florida                  ELIZABETH H. ESTY, Connecticut
    THOMAS MASSIE, Kentucky              MARC A. VEASEY, Texas
    JIM BRIDENSTINE, Oklahoma            KATHERINE M. CLARK, Massachusetts
    RANDY K. WEBER, Texas                DON S. BEYER, JR., Virginia
    BILL JOHNSON, Ohio                   ED PERLMUTTER, Colorado
    JOHN R. MOOLENAAR, Michigan          PAUL TONKO, New York
    STEVE KNIGHT, California             MARK TAKANO, California
    BRIAN BABIN, Texas                   BILL FOSTER, Illinois
    BRUCE WESTERMAN, Arkansas
    BARBARA COMSTOCK, Virginia
    DAN NEWHOUSE, Washington
    GARY PALMER, Alabama
    BARRY LOUDERMILK, Georgia
    RALPH LEE ABRAHAM, Louisiana
                                    ----------

                           Subcommittee on Oversight

                     HON. BARRY LOUDERMILK, Georgia, Chair
    F. JAMES SENSENBRENNER, JR.,         DON BEYER, Virginia
        Wisconsin                        ALAN GRAYSON, Florida
    BILL POSEY, Florida                  ZOE LOFGREN, California
    THOMAS MASSIE, Kentucky              EDDIE BERNICE JOHNSON, Texas
    BILL JOHNSON, Ohio
    DAN NEWHOUSE, Washington
    LAMAR S. SMITH, Texas
                                    -----------

                             Subcommittee on Energy

                       HON. RANDY K. WEBER, Texas, Chair
    DANA ROHRABACHER, California         ALAN GRAYSON, Florida
    RANDY NEUGEBAUER, Texas              ERIC SWALWELL, California
    MO BROOKS, Alabama                   MARC A. VEASEY, Texas
    RANDY HULTGREN, Illinois             DANIEL LIPINSKI, Illinois
    THOMAS MASSIE, Kentucky              KATHERINE M. CLARK, Massachusetts
    STEVE KNIGHT, California             ED PERLMUTTER, Colorado
    BARBARA COMSTOCK, Virginia           EDDIE BERNICE JOHNSON, Texas
    BARRY LOUDERMILK, Georgia
    LAMAR S. SMITH, Texas
                                C O N T E N T S

                               September 10, 2015

                                                                       Page
    Witness List.....................................................     2

    Hearing Charter..................................................     3

                               Opening Statements

    Statement by Representative Barry Loudermilk, Chairman,
      Subcommittee on Oversight, Committee on Science, Space, and
      Technology, U.S. House of Representatives......................     8
        Written Statement............................................     8

    Statement by Representative Don Beyer, Ranking Minority Member,
      Subcommittee on Oversight, Committee on Science, Space, and
      Technology, U.S. House of Representatives......................     9
        Written Statement............................................     9

    Statement by Representative Randy K. Weber, Chairman,
      Subcommittee on Energy, Committee on Science, Space, and
      Technology, U.S. House of Representatives......................    10
        Written Statement............................................    10

    Statement by Representative Alan Grayson, Ranking Minority
      Member, Subcommittee on Energy, Committee on Science, Space,
      and Technology, U.S. House of Representatives..................    11
        Written Statement............................................    11

                                   Witnesses:

    Mr. Richard Lordan, Senior Technical Executive, Power Delivery &
      Utilization Sector, Electric Power Research Institute
        Oral Statement...............................................    12
        Written Statement............................................    14

    Ms. Nadya Bartol, Vice President of Industry Affairs and
      Cybersecurity Strategist, Utilities Telecom Council
        Oral Statement...............................................    19
        Written Statement............................................    21

    Dr. Daniel Baker, Distinguished Professor of Planetary & Space
      Physics; Moog-BRE Endowed Chair of Space Sciences; Director,
      Laboratory for Atmospheric and Space Physics, University of
      Colorado Boulder
        Oral Statement...............................................    29
        Written Statement............................................    31

    Dr. M. Granger Morgan, Hamerschlag University Professor,
      Departments of Engineering and Public Policy and of Electrical
      and Computer Engineering, Carnegie Mellon University
        Oral Statement...............................................    36
        Written Statement............................................    38

    Discussion.......................................................    48

                 Appendix I: Answers to Post-Hearing Questions

    Mr. Richard Lordan, Senior Technical Executive, Power Delivery &
      Utilization Sector, Electric Power Research Institute..........    68

    Ms. Nadya Bartol, Vice President of Industry Affairs and
      Cybersecurity Strategist, Utilities Telecom Council............    76

    Dr. Daniel Baker, Distinguished Professor of Planetary & Space
      Physics; Moog-BRE Endowed Chair of Space Sciences; Director,
      Laboratory for Atmospheric and Space Physics, University of
      Colorado Boulder...............................................    86

    Dr. M. Granger Morgan, Hamerschlag University Professor,
      Departments of Engineering and Public Policy and of Electrical
      and Computer Engineering, Carnegie Mellon University...........    91

                Appendix II: Additional Material for the Record

    Statement for the record titled ``Texas is Working to Protect the
      Electrical Grid Against Natural or Man-Made Electromagnetic
      Pulse,'' submitted by Lieutenant Colonel Allen B. West (U.S.
      Army, Ret), President and Chief Executive Officer, National
      Center for Policy Analysis.....................................    96

                 EXAMINING VULNERABILITIES OF AMERICA'S POWER SUPPLY

                                  ----------

                          THURSDAY, SEPTEMBER 10, 2015

                      House of Representatives,
                    Subcommittee on Oversight &
                                Subcommittee on Energy,
                   Committee on Science, Space, and Technology,
                                                       Washington, D.C.

        The Subcommittees met, pursuant to call, at 10:02 a.m., in
    Room 2318 of the Rayburn House Office Building, Hon. Barry
    Loudermilk [Chairman of the Subcommittee on Oversight]
    presiding.

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Chairman Loudermilk. The Subcommittee on Oversight and
    Energy will come to order.
        Without objection, the Chair is authorized to declare
    recess of the Subcommittee at any time.
        Good morning. I would like to thank our witnesses for being
    here today. I appreciate the witnesses' patience and
    understanding as we had to postpone this hearing from July. And
    I look forward to the testimony today that will help us examine
    the vulnerabilities of America's power supply.
        Welcome to today's joint subcommittee hearing entitled
    ``Examining the Vulnerabilities of America's Power Supply.''
    Due to time constraints and in the interest of allowing our
    witnesses to be heard and their questions answered, I will
    submit my opening statement for the record and I encourage
    others to do so as well.
        [The prepared statement of Chairman Loudermilk follows:]

                  Prepared Statement of Oversight Subcommittee
                           Chairman Barry Loudermilk

        Good morning. I would like to thank our witnesses for being here
    today to help us examine the vulnerabilities of America's power supply.
        The electricity infrastructure of the United States is aging, and
    the electric power industry is in the process of modernizing it with
    its transformation to the ``smart grid'' --the technology that provides
    an increased use of digital information and control technology to
    improve reliability, security, and efficiency of the electric grid.
        That process of modernization, however, introduces new
    vulnerabilities in addition to ones that have existed for over a
    century. This hearing will discuss those various threats to the
    national electric grid, including: severe weather or other natural
    events; cyber, physical, or coordinated attacks; space weather; and
    electromagnetic pulse (EMP) attacks.
        The blackout that darkened the Northeast in the summer of 2003
    opened many eyes to the vulnerability and age of our electrical system.
    In that case, a tree branch in Ohio coupled with software issues and
    human error left many in the dark for two days. In addition to natural
    events like this and Superstorm Sandy--which left millions of people
    without power, man-made physical threats exist.
        In 2013, unknown attackers coordinated an attack on a Pacific Gas &
    Electric Metcalf substation in California. Those attackers severed six
    underground fiber optic lines and fired over 100 rounds of ammunition
    at transformers. While the attack did not lead to any loss of power or
    life, it caused over $15 million in damage. The President and CEO of
    the American Public Power Association stated at a hearing last year
    that, ``shooting at substations, unfortunately, is not uncommon.''
        Just as troubling is the amount of attempted cyber-attacks to the
    nation's electric grid. An investigation completed by USA Today earlier
    this year found that the United States' power grid ``faces physical or
    online attacks approximately `once every four days.''' In addition, in
    2014, the National Security Agency (NSA) reported that it had tracked
    intrusions into industrial control systems by entities with the
    technical capability ``to take down control systems that operate U.S.
    power grids, water systems, and other critical infrastructure.'' We
    have also been examining cyber threats in the Homeland Security
    Committee, and this is an absolutely critical issue that must be taken
    seriously by Congress and the entire federal government.
        On top of these threats, we also have the potential threat of an
    electromagnetic pulse, which would disrupt or destroy electronic
    equipment after the detonation of a nuclear weapon. Geomagnetic
    disturbances can also be brought on by naturally occurring solar
    weather events, such as in 1989 when a geomagnetic disturbance caused
    millions of Canadians to lose their power for about nine hours.
        It is clear that there are many threats to our electric
    infrastructure, and we must therefore ensure that our federal systems
    are adequately protected, especially as we transition to the ``smart
    grid.'' We need to rethink how we protect our facilities from physical
    attacks, like the Metcalf incident where investigators were never even
    able to identify the criminals.
        In addition, as we have seen over the past few years, cybersecurity
    is an ever-evolving threat. The fact that we know of intrusions by
    entities with the capability to take down our control systems means
    that we must do everything in our power to be proactive rather than
    reactive in order to protect our grid and prevent such a take-down from
    happening.
        Mitigating these vulnerabilities and their potential consequences
    is ultimately essential for the safety and security of all Americans.
    Protecting our power supply is something that is crucial for day to day
    life activities and things that we take for granted--like heating and
    cooling a home or powering a business--as well as ensuring our national
    security.
        I look forward to today's hearing, where I hope to learn more about
    the various vulnerabilities of our grid as well as the extent of the
    threats that could potentially leave us in the dark.
        Thank you.

        Chairman Loudermilk. I now recognize the Ranking Member of
    the Oversight Subcommittee, the gentleman from Virginia, Mr.
    Beyer, for an opening statement.
        Mr. Beyer. Mr. Chairman, respecting your fine example, I
    will also submit mine for the record.
        [The prepared statement of Mr. Beyer follows:]

                  Prepared Statement of Oversight Subcommittee
                   Minority Ranking Minority Member Don Beyer

        Thank you Chairmen Loudermilk and Weber for holding this important
    hearing today.
        In September 1882 Thomas Edison flipped a switch that enabled the
    electricity generated from the Pearl Street power plant in lower
    Manhattan to power on 400 light bulbs for 82 customers living in a one-
    quarter square mile radius of each other, including 52 light bulbs at
    the New York Times. The electric grid was born and blossomed quickly,
    spreading across the country and around the world. Today the U.S. power
    grid is an intricate labyrinth of 200,000 miles of transmission lines,
    thousands of generating stations and hundreds of high voltage
    transformers.
        This complex and interconnected power system fuels our national and
    global economy. It plays a key role in our national security. It
    enables the delivery of critical healthcare services. It improves our
    lifestyles in a multitude of ways, and provides emergency services that
    save lives. When the electric grid goes down today it is more than a
    passing inconvenience. The elderly and very young alike may die from a
    lack of access to critical medical services or availability of adequate
    heating or air conditioning. Police, fire and emergency response
    capabilities may be hindered. Businesses close. Grocery stores and gas
    stations may cease to open or operate. Hospitals may be unable to fully
    function effectively.
        At the same time we have witnessed more and more severe weather
    events in the past few years that have disabled the grid, knocking down
    transmission lines and utility poles, flooding critical equipment and
    leaving customers without access to this critically important service
    for days on end. Reliant on the telecommunications infrastructure to
    operate and computer control systems to function the power grid has
    also become vulnerable to malicious cyber threats. Recent physical
    attacks on electrical power stations have highlighted the need to
    harden the grid against these kinds of threats. A successful,
    coordinated cyber and physical assault against key portions of the grid
    could leave cities or regions without power for long stretches of time.
    Geomagnetic Disturbances (GMDs), producing solar flares, can also
    disable portions of the grid and interfere with global navigation and
    communication systems. Electromagnetic Pulses (EMPs) intentionally
    produced by a weapon is one of the least likely, but most serious,
    threats to the power grid since its successful use would destroy
    critical electronic components that are vital for the grid's continued
    performance and could be difficult to replace quickly.
        Protecting the power grid against all of these variables and
    potential vulnerabilities is not a problem that can be, or should be,
    faced by the utility industry alone. The government has a key role to
    play in ensuring that our shared reliance on electricity is as
    resilient as possible. The electric industry and federal government
    also need to have detailed plans for recovery operations if, or when,
    the electrical grid is degraded by natural disasters or intentionally
    disabled by malicious actors.
        How we confront these multiple vulnerabilities and emerging threats
    is not straight-forward. There is no silver bullet to eradicating these
    threats. There is no cure-all for ensuring that the electric grid will
    never go down. It will--at times--as we have seen most recently due to
    the power of natural storms and the fragility of our aging electrical
    infrastructure. Ensuring that we are prepared to recover from these
    potential events in a timely manner and able to restore power to
    critical facilities, such as hospitals, quickly demands our collective
    attention, from industry, the Administration and Congress.
        Because I believe it is critically important that we are as
    prepared as possible to effectively deal with these potential incidents
    when they occur I asked the Government Accountability Office (GAO) to
    investigate these issues in a letter I sent to GAO yesterday. I would
    welcome other Members who are interested--on both sides of the aisle--
    to join me in this request. This is an important, non-partisan issue,
    and I am glad we are holding this hearing today.
        I look forward to learning more about these important issues from
    our witnesses and hearing about any recommended actions they have to
    help keep the lights on as long as possible and get them back on as
    quickly as possible should they go out--regardless of the reason why.
        I yield back.

        Chairman Loudermilk. Thank you, Mr. Beyer. I appreciate
    that.
        Now, I recognize the Chairman of the Energy Subcommittee,
    the gentleman from Texas, Mr. Weber, for an opening statement.
        Mr. Weber. Thank you. My opening statement is that I submit
    my opening statement for the record. Welcome.
        [The prepared statement of Mr. Weber follows:]

                  Prepared Statement of Subcommittee on Energy
                            Chairman Randy K. Weber

        Good morning and welcome to today's joint Oversight and Energy
    Subcommittee hearing examining vulnerabilities of America's power
    supply. Today, we will hear from a broad range of witnesses on the
    existing threats to the nation's electric grid, and the impact that
    potential attacks and incidents could have on our grid reliability and
    national security.
        Our witnesses today will also provide insight into how industry and
    the federal government can work together to harden our electric grid
    against ongoing and changing threats.
        The reliability of America's power grid is one of our greatest
    economic strengths. In my home state of Texas, reliable and affordable
    power serves a population that is increasing by more than 1,000 people
    per day, and provides power to the energy intensive industries that
    drive consumption. Texas is by far the nation's largest consumer of
    electricity. Keeping the Texas power grid reliable and secure is key to
    continuing this economic growth.
        But it is common knowledge that utilities face significant and
    diverse threats to the reliability of power delivery. Our electric grid
    is vulnerable to physical threats caused by damage to existing
    infrastructure and growing cybersecurity threats as the grid is
    modernized.
        Key infrastructure such as utility substations are often left
    completely exposed, with little more than a chain-link fence protecting
    the facilities that keep the lights on across the country. Small scale
    cyber and physical attacks to our electric grid are estimated to occur
    once every four days. And in over 300 cases of significant cyber and
    physical attacks since 2011, suspects have never been identified.
        Our power grid is also at risk from geomagnetic disturbances, which
    can be caused by space weather or an Electromagnetic Pulse, commonly
    known as E-M-P, which could be generated in a nuclear attack. These
    high energy pulses could severely impact the operation of the electric
    grid and electric power systems across the country, disabling and
    damaging equipment essential to providing reliable power that could be
    nearly impossible to replace on a large scale.
        We often think of cybersecurity and other threats to the power grid
    at a macro scale, but these types of attacks can occur even at the
    local level. In 2011, the Pedernales Electric Co-op, a non-profit co-op
    that serves approximately 200,000 customers north of San Antonio, was
    struck by a cyberattack. While the attack thankfully did not disrupt
    electric reliability, it is a stark reminder that threats to the grid
    are real, and are not going away.
        Our nation's power supply cannot be protected overnight,
    particularly as utilities struggle to adapt technology to manage a
    growing number of cybersecurity threats. Cyber threats to the power
    grid will continue to evolve, particularly as more interconnected smart
    technologies are incorporated into the electric grid. As protective
    technology improves, so does the capability and creativity of those
    conducting attacks.
        While we cannot predict every method of attack, the federal
    government can and should play a role in assisting industry with
    developing new technology and security safeguards.
        Accordingly, research and development efforts at the Department of
    Energy are focused on providing industry with comprehensive tools to
    conduct internal analysis to identify and address cybersecurity
    weaknesses so that industry can take the lead in addressing these
    vulnerabilities.
        I want to thank our witnesses for testifying before the Committee
    today, and I look forward to a discussion about the threats to
    America's reliable power supply and the federal government's role in
    helping to secure our electric grid.

        Chairman Loudermilk. Thank you, Chairman Weber.
        I now recognize the Ranking Member of the Subcommittee on
    Energy, the gentleman from Florida, Mr. Grayson, for an opening
    statement.
        Mr. Grayson. Ditto.
        [The prepared statement of Mr. Grayson follows:]

                  Prepared Statement of Subcommittee on Energy
                      Minority Ranking Member Alan Grayson

        Thank you, Chairman Loudermilk, and Chairman Weber, for holding
    this hearing today. Today's hearing is focused on our nation's electric
    grid, and the many threats facing it.We as a society are increasingly
    dependent on the services electricity provides, and the electric grid
    has quietly become the basis of our modern lives. However, our
    electrical system is under constant stress from severe weather,
    malicious acts, and age. The stress on the system is constantly
    increasing as we dramatically change how we want to use the grid now,
    verses what it was designed to do, when it was built.
        In 2000, the US experienced an average of 2.5 grid disruption
    events a month. Fourteen years later, in the first half of 2014, we had
    an average of 21.7 disruptions a month - a nearly nine-fold increase.
        Between 2003 and 2012, 80 percent of all outages were weather
    related and cost the US economy an inflation-adjusted annual average of
    between $18 billion to $33 billion.
        USA Today recently reported that physical and cyber attacks on the
    power grid occur about once every four days. In April of 2013, unknown
    snipers disabled 17 transformers with a .30 caliber assault rifle at
    the Pacific Gas & Electric Company's Metcalf substation outside of San
    Jose, California. The assailants fired 150 rounds and escaped
    undetected. They had cut a series of fiber-optic telecommunications
    cables prior to the attack hindering communication.
        From malware inserted in electrical components used to operate the
    power grid prior to purchase by utilities to traditional cyber attacks,
    disabling even a portion of the nation's power supply can have serious
    consequences for the health and safety of our citizens.
        Keep in mind, that the average age of a high voltage transformer in
    the United States is approximately 38 to 40 years old, with 70 percent
    of them 25 years or older. And that most high voltage transformers are
    custom built, and can take five to twenty months to design, build,
    deliver and install.
        One of our challenges is grappling with the reality that many of
    these threats to the grid are not easily predicted with current
    capabilities.
        High-impact low probability events are by definition, rare. We do
    not know when a large-scale malicious attack might happen, whether it's
    an electromagnetic pulse or a cyber attack. We have limited abilities
    to predict when a geomagnetic disturbance or extreme weather event will
    hit. And since these events rarely happen, we have little or no
    historical data to guide us.
        While we should certainly support efforts to significantly improve
    our grid security capabilities, we cannot assume that it is even
    possible to completely protect the grid from every possible risk.
        What we can do is increase our ability to estimate these risks. We
    can improve our ability to predict the impacts, even when we may not be
    able to predict the actual event. And we can take actions to improve
    our electric system's ability to withstand an event, and minimize the
    time it takes to recover from that event.
        This Committee has an important responsibility to authorize
    research that can dramatically improve the ability of the grid to
    handle whatever comes at it.
        Over the past 100 years we have incrementally created our electric
    grid, adding and subtracting equipment as the system expanded and
    became more interconnected. Our electrical system is considered one of
    the greatest engineering achievements of the 20th century by the
    National Academy of Engineering. We should be proud of this
    accomplishment.
        I look forward to working with my colleagues to identify and fund
    the research efforts needed to make sure our electrical system remains
    a great achievement.
        I thank each of our witnesses for being here today, and I look
    forward to hearing what each of you has to say.
        Thank you, Mr. Chairman, and I yield back my remaining time.

        Chairman Loudermilk. Thank you, Mr. Grayson.
        And is Ms. Johnson not here? Okay.
        At this time I would like to introduce our witnesses. You
    don't have the option, okay, so--we wouldn't get anywhere if
    you guys follow suit, so we did this so you would have plenty
    of time.
        Our first witness is Richard Lordan. He is the Senior
    Technical Executive of the Power Delivery & Utilization Sector
    at the Electric Power Research Institute.
        Our next witness is Ms. Nadya Bartol--is the Vice President
    of Industry Affairs and Cybersecurity Strategist at Utilities
    Telecom Council where she works on UTC cybersecurity
    initiatives worldwide.
        Our next witness is Dr. Daniel Baker. He is the Director of
    the Laboratory for Atmospheric and Space Physics at the
    University of Colorado Boulder. He is a distinguished professor
    of planetary and space physics and the Moog-BRE. Is that
    proper? Okay. Endowed Chair of Space Sciences at the
    university.
        And our final witness is Dr. M. Granger Morgan. He is the
    Hamerschlag University Professor in the Department of
    Engineering and Public Policy at Carnegie Mellon University
    where he is also professor in the Department of Electrical and
    Computer Engineering.
        Thank you all for being here and I now recognize Mr. Lordan
    for five minutes to present his testimony.

            MR. RICHARD LORDAN, SENIOR TECHNICAL EXECUTIVE,

                  POWER DELIVERY & UTILIZATION SECTOR,

                   ELECTRIC POWER RESEARCH INSTITUTE

        Mr. Lordan. Good morning, Chairman Weber and Mr.
    Loudermilk, Vice Chairman Knight and Johnson, Ranking Members
    Mr. Beyer, and members of the subcommittees. I am Richard
    Lordan, Senior Technical Executive at EPRI Transmission. I'm
    pleased to testify today on vulnerabilities of the electric
    grid.
        For those of you who don't know, EPRI is a 501(c)(3)
    nonprofit organization that conducts research and development
    relating to generation, delivery, and use of electricity for
    the benefit of the public. EPRI's members represent
    approximately 90 percent of the electricity generated and
    delivered in the United States. International participation
    extends to over 30 countries.
        So my testimony is going to be kind of in two parts. One is
    on the general vulnerability of the grid and then I'm going to
    bore down on one threat which is electromagnetic pulse.
        When I talk about the vulnerability of the grid, I'm really
    talking about vulnerability to high-impact, low-frequency
    events. They called them HILF events, and they are rare but
    they have a high impact. And some of these things include
    natural events like severe weather, earthquakes, geomagnetic
    disturbances, and also manmade threats like physical security
    and EMP, which I'm going to talk about today.
        So you asked about the vulnerability of the grid, and there
    are inherent vulnerabilities in the grid to these threats
    because the severity is generally higher than the design basis
    for the system. To completely eliminate these vulnerabilities
    would be cost prohibitive. It would defeat the industry's
    objective of providing reliable, safe, environmentally
    acceptable, and affordable power.
        EPRI supports a prudent approach where you assess the
    vulnerabilities from all of these threats, calculate the impact
    should these events occur, and develop cost-effective
    countermeasures that improve transmission system resiliency.
        I'm now going to talk about EMP with a comparison to
    geomagnetic disturbance. EMP and GMD are often conflated but
    there are important differences that I'll highlight. Dr. Baker
    could probably add some more. EMP, electromagnetic pulse,
    refers to a very intense pulse of electromagnetic energy
    typically caused by the detonation of a nuclear device or other
    high-energy explosive device.
        There are three stages of an EMP and I'm pretty sure you
    know what they are but I'll do it again: E1, E2, and E3. The E1
    is characterized by an incredibly fast rise time high-energy
    pulse. It has the ability to destroy electronics in the power
    system, and it affects itself by the electric field itself or
    by coupling to wires that are attached to these devices.
        The E2 is similar to lightning and consequently can result
    in damage to electronics and potential flashover of
    distribution class insulation.
        E3 is characterized by a longer duration, low-frequency
    content similar to GMD, and that's why people talk about EMP
    and GMD together. But the E3 part of EMP is much shorter than a
    GMD, and therefore, it will not have the consequence of
    transformer overheating and failure. It does have the ability
    to saturate transformers and transformers will create
    harmonics. They'll consume reactive power and there may be
    voltage collapse on the system.
        With regard to risk management of these threats, so we
    talked about EMP and vulnerability. EPRI is leading an effort
    with the industry to characterize each of these threats,
    whether it's EMP, GMD, physical security or cyber, characterize
    the threat, then identify the key component--key components in
    the system and understand the vulnerability of those
    components, then assess the impact should this event happen.
    What's the effect on the system and what's the societal cost?
    Then we develop and assess mitigation strategies that will buy
    down that risk.
        And lastly, after we've done all the different threats one
    by one, we support looking sideways and seeing, hey, are there
    any mitigation strategies that also support multiple threat
    that would improve your business case by increasing
    transmission resiliency?
        So thank you again for inviting EPRI here today and I look
    forward to answering your questions.
        [The prepared statement of Mr. Lordan follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Chairman Loudermilk. I now recognize Ms. Bartol for five
    minutes to present her testimony.

                     TESTIMONY OF MS. NADYA BARTOL,

                   VICE PRESIDENT OF INDUSTRY AFFAIRS

                     AND CYBERSECURITY STRATEGIST,

                       UTILITIES TELECOM COUNCIL

        Ms. Bartol. Good morning, Mr. Chairman, and Members of the
    Subcommittee. My name is Nadya Bartol. I'm the Vice President
    of Industry Affairs and Cybersecurity Strategist at the
    Utilities Telecom Council. Thank you for the opportunity to
    testify today about the vulnerabilities of America's power
    supply.
        UTC is a global trade association for the communications
    and information technology interest of electric, gas, and water
    utilities; pipeline companies; and other critical
    infrastructure industries.
        Cybersecurity is a serious concern with respect to great
    vulnerability. It is a complex challenge that requires
    comprehensive process-driven solutions. It is and will remain a
    risk we must actively manage as long as society wants to have
    the conveniences of a modern world increasingly underpinned and
    enabled by smart interconnected technologies.
        Some of the variables in the complex cybersecurity grid
    vulnerability landscape are outside of our span of control.
    Although there are a number of variables within our control,
    there's no easy way to fix them either, as mitigating those
    variables to an acceptable level may take a long time.
        With respect to what is outside of our span of control, the
    grid is vulnerable to a variety of threats, including
    individual hackers, activist groups, cyber criminals, and
    nation states.
        With respect to what is within our span of control, those
    vulnerabilities are related to the shortage of qualified
    cybersecurity workforce, age of legacy infrastructure, lack of
    legal framework for information sharing, and evolving practices
    for assuring security in supplier products and services.
        The 2015 Global Information Security Workforce Study, an
    international survey of nearly 14,000 information security
    professionals published by ISC2, estimates the shortfall in the
    global information security workforce to reach 1.5 million by
    2020. This problem is exacerbated in the energy space because
    we have two different sets of systems: systems that run the
    grid, referred to as operational technology (OT) and business
    systems that we refer to as information technology (IT). These
    two sets of systems command a different set of priorities that
    are served by individuals with different backgrounds, different
    vocabularies, and different goals and objectives.
        We need to educate and train more people with a skill set
    blended across those two types of systems, IT and OT, in order
    to make a noticeable difference. This challenge impacts the
    energy utilities, numerous vendors that supply systems for the
    grid, as well as the integrators who design and integrate
    larger, more complex systems for utilities. The deficit of
    cybersecurity workforce permeates all levels of the energy
    utility organization, and the same is true for the entire
    energy utility ICS and ICT supply chain.
        The technology of the grid is in itself a cybersecurity
    concern. The grid is based on layers that have accumulated over
    time, and the legacy structure was not designed to be secured
    because security was not a concern when that infrastructure was
    implemented. And utilities have been utilizing a variety of
    technologies, methods, and techniques to help manage and
    mitigate some legacy infrastructure's vulnerabilities. However,
    this is an ongoing concern, and acquiring and implementing such
    technologies, modifying network architectures, or replacing
    legacy infrastructure takes time and resources.
        The energy sector suffers from inconsistent threat
    information throughout the sector. Progress has been made but
    we still need a legal framework for information sharing that
    would remove the barriers that remain. Building robust systems
    that can be resilient in the face of cybersecurity threats
    requires considering security from inception. Utilities rely on
    vendors for systems design, development, implementation, and
    maintenance and are working on their approaches to productively
    communicate their assurance needs and then monitor the
    underperformance against those.
        Recently published standards and best practices provide
    requirements, methods, and techniques that help address this
    challenge. This includes NIST Cybersecurity Framework which is
    broadly used in the energy space.
        Cybersecurity is a complex challenge that cannot be solved
    overnight or permanently. It does not lend itself to a cookbook
    of solutions, nor can we envision every possible scenario to
    mitigate. We're dealing with an asymmetric threat. However, we
    can act to reduce the cyber-related vulnerabilities of the
    grid. These actions include increasing supply of cybersecurity
    workforce that understands both IT and OT contexts, financially
    enable utilities to upgrade or phase out their legacy
    infrastructures, enacting information-sharing legislation that
    removes current barriers, and supporting industry-based
    standardization and NIST framework implementation to help
    integrate security considerations into current and future
    technologies.
        I look forward to further dialogue.
        [The prepared statement of Ms. Bartol follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Chairman Loudermilk. Thank you, Ms. Bartol.
        I now recognize Dr. Baker for five minutes to present his
    testimony.

                     TESTIMONY OF DR. DANIEL BAKER,

                       DISTINGUISHED PROFESSOR OF

                       PLANETARY & SPACE PHYSICS;

               MOOG-BRE ENDOWED CHAIR OF SPACE SCIENCES;

                  DIRECTOR, LABORATORY FOR ATMOSPHERIC

                           AND SPACE PHYSICS,

                     UNIVERSITY OF COLORADO BOULDER

        Dr. Baker. Thank you, Mr. Chairman.
        Extreme space weather events pose a threat to all forms of
    modern high technology, particularly the backbone provided by
    the electric power grid. The occurrence of severe space weather
    impacting our nation's infrastructure is not a question of
    ``if'' but ``when.'' My group studied a powerful solar storm
    that occurred just three years ago on the 23rd of July 2012.
    This solar eruption produced a coronal mass ejection that moved
    from the sun's to the distance of Earth orbit in only about 15
    hours. This is among the very fastest-moving solar blasts ever
    witnessed in the space age. It was a ferocious disturbance that
    fortunately was directed somewhat away from Earth. We realized
    that a direct hit by such an extreme coronal mass ejection
    would cause widespread power blackouts, disabling everything
    that uses electricity.
        According to a 2009 study from the U.S. National Academies,
    the total economic impact from an event of this sort could
    exceed $2 trillion or 20 times greater than the cost of
    Hurricane Katrina. Multi-ton power grid transformers disabled
    by such a storm could take years to repair or replace.
        The current capability of our technological society to
    predict space weather is primitive. Through programs supported
    by the National Science Foundation, NASA, NOAA, we observe the
    sun, and we can see the general properties of the expansion of
    the solar atmosphere and powerful solar storms heading in our
    general direction. However, the measurements at the first
    Lagrangian point provide only about 4five minutes of warning at
    best as to what will impact Earth. This is insufficient time
    for implementing most mitigation strategies.
        I spent two sobering days on the 20th and 21st of July at
    the 6th Electric Infrastructure Security Summit here on Capitol
    Hill. Representatives from over 20 world nations attended the
    EIS Summit. CEOs from key electric power utilities and leaders
    from the U.S. military and several federal agencies spent time
    grappling with the immense challenges that would result if
    nuclear EMP or geomagnetic disturbances were to take down the
    North American power grid. In the EIS world, such events are
    termed ``Black Sky'' days. The 100-plus EIS delegates
    acknowledged that the collapse of the power system would be
    devastating, and that industry, government, and academia must
    all work together to the greatest degree possible to minimize
    the impact when such a Black Sky day occurs.
        In space weather, as in many things, forewarned is
    forearmed. Many studies have shown that improved prediction of
    space weather would have important economic impacts on our
    society in the same way that improved terrestrial weather
    forecasts have greatly improved our economic wellbeing and the
    quality of daily lives.
        Is our problem of improving space weather forecasting
    hopeless? Absolutely not. But it will require a substantially
    increased and dedicated government research program.
    Government-funded programs must be chosen to advance our
    civilization, our strategic importance in the world. In fact,
    efforts that would result in sufficient space weather
    prediction capability would be among our highest national--
    should be among our highest national priorities. Unfortunately,
    today's federal investments and policies are not aligned with
    this set of space weather needs.
        The U.S. National Academies published a Decadal Survey in
    Solar and Space Physics in 2012. I was privileged to chair that
    activity. The Decadal Survey established the priorities for
    research relevant for space weather and basic research for NASA
    and NSF in the years 2013 to 2022. However, to date, NASA has
    not requested, nor has Congress funded, any of the significant
    initiatives recommended by the Decadal Survey.
        The Heliophysics Division of NASA, which has the main
    responsibility for the research required to improve space
    weather predictions, is NASA's smallest science division. NSF
    space weather activities are only a small part of the
    geosciences division with many high priorities for other
    research areas. NOAA has the responsibility for making the
    actual space weather forecasts through the Boulder space-
    based--Space Weather Prediction Center, but these forecasts can
    only be based upon larger research efforts supported by the NSF
    and NASA.
        A very substantial program was envisioned in the Decadal
    Survey that would build on the--a true operational 24/7
    national space weather program. This would be a large
    investment but is essential for our nation's future. A key
    activity now underway is--by the federal agencies to address
    the Federal Space Weather Framework, as identified by the
    acronym SWORM with funding appropriately above the Decadal
    minimum level, the Decadal plan and the SWORM implementation
    plan could yield the required predictions in sufficient time.
        The existential threat to our society represented by severe
    space weather events, especially to the national power grid,
    demand a similar national commitment even in these times of
    fiscal constraint. The nation should issue a challenge to the
    space research community to provide the predictive capability
    for space weather sufficient to make our economy more resilient
    and to reduce to an acceptable level our national
    vulnerabilities. The nation should recognize that this is a
    pressing challenge and that substantial resources will be
    required. In return, the space research community must give its
    common pledge that it will deliver what the nation requires. I
    would respectfully suggest that the time for budgetary and
    policy action is now.
        Thank you very much.
        [The prepared statement of Dr. Baker follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Chairman Loudermilk. Thank you, Dr. Baker.
        I now recognize Dr. Morgan for five minutes to present his
    testimony.

                  TESTIMONY OF DR. M. GRANGER MORGAN,

                   HAMERSCHLAG UNIVERSITY PROFESSOR,

                     DEPARTMENTS OF ENGINEERING AND

                    PUBLIC POLICY AND OF ELECTRICAL

                       AND COMPUTER ENGINEERING,

                       CARNEGIE MELLON UNIVERSITY

        Dr. Morgan. Good morning. And thanks very much to Chairman
    Smith, Loudermilk, and Weber, and Ranking Members Johnson,
    Beyer, and Grayson for the opportunity to testify today.
        As you heard, my name is Granger Morgan. I'm a professor at
    Carnegie Mellon, where I work on issues in engineering and
    public policy, including issues in the power system, often with
    the National Academy of Sciences, of which I'm a member.
        Unlike food and water, none of us consume electricity
    directly. Rather, we consume the services that electricity
    makes possible, and those services have become ever more
    critical to the safe, effective, and productive functioning of
    our lives as individuals and to our society and hence also to
    our national security.
        Today, I'll talk about three things: 1) Strategies to avoid
    physical disruption of the power system; 2) Strategies to speed
    the process of putting the system back together after physical
    disruption; and 3) Strategies to assume the continued provision
    of critical social services when grid electricity is not
    available.
        Because the power system is spread out across the
    landscape, it's inherently vulnerable to both natural and
    intentional physical damage. In addition to space weather,
    natural hazards include wildfires, tornadoes, floods,
    earthquakes, tsunamis, hurricanes, and ice storms.
        We all know about the devastation that Hurricanes Sandy and
    Katrina caused to the power system. Ice storms can be equally
    devastating. The 1998 ice storm in Quebec and Ontario is a
    vivid illustration of the power system's vulnerability to
    natural hazards. It collapsed miles of high-voltage power lines
    blacking out over 2-1/2 million customers in Canada and the
    United States, caused damages of over $2-1/2 billion, involved
    28 deaths in Canada and 17 in the United States, and left some
    people without power in the dead of winter for many weeks.
        Of course, we can't avoid hurricanes and ice storms but we
    can make the high-voltage power system much more resilient.
    Twenty-five years ago, a report by the Congressional Office of
    Technology Assessment noted that the power system is vulnerable
    to attackers using ``just high-powered rifles.'' A terrorist
    organization that wanted to cause a massive disruption to the
    U.S. power system could order rifles and armor-piercing bullets
    on the internet, place sharpshooters in the back of station
    wagons like the 2002 Washington snipers, and from a distance
    put holes in carefully selected sets of critical high-voltage
    power transformers. The 2013 rifle attack on the 500 kV
    substation in Congresswoman Lofgren's district vividly
    illustrates the risk.
        In a National Academy report I chaired on terrorism and the
    power system, we recommended replacing chain-link fences that
    surrounded many large substations with robust and opaque
    barriers, as well as a variety of other steps to limit access,
    increase security, and to harden the system. Progress has been
    made, but more is needed.
        Our Academy report also recommended that the Department of
    Homeland Security and the Department of Energy develop a
    stockpile of emergency replacement transformers, an idea first
    studied years ago by EPRI. Between 2012 and 2014, DHS
    demonstrated this idea, but there's an urgent need to move
    beyond demonstration to implement a stockpile.
        Earlier this month, Paul Parfomak at CRS prepared an
    excellent report on power transformers and I urge the Committee
    to give his comprehensive summary a careful reading.
        The power industry is well organized to deal with damage
    from a range of normal disasters. However, there's a need to
    better address recovery from larger events. In my written
    testimony I've elaborated on options and on efforts by several
    groups to reduce vulnerabilities.
        Equally important, the nation should take steps to assure
    that critical social services can continue to operate when the
    power system goes down, whatever the cause. Key strategies
    include: LED traffic lights with solar cell and battery backup
    so that traffic doesn't snarl and block emergency vehicles in
    key transportation corridors; more systematic and reliable use
    of backup generators; cell phone and other communication
    systems that will remain intact and continue to operate not
    just for hours but for days; and greater use of smart meters
    and microgrids to allow local islands of power to continue to
    support key social services.
        I've run two meetings at the National Academy on power
    system resilience, the more recent under the auspices of the
    Resilient America Roundtable that I chair. Web addresses for
    the video of those meetings are provided in my written
    testimony.
        Thanks very much for your attention.
        [The prepared statement of Dr. Morgan follows:]
        [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        Chairman Loudermilk. First of all, let me thank the
    witnesses for their testimony. This is a very, very important
    issue to both of these subcommittees.
        And Members are reminded that the committee rules limit
    questioning to five minutes, and the Chair recognizes himself
    for the first five minutes.
        Ms. Bartol, I want to focus on you because I spent 30 years
    in the IT industry prior to coming to Congress, and as part of
    that, I actually worked with a lot of small utilities,
    municipal-owned utilities in automating a lot of their SCADA
    systems, providing fiberoptic connectivity and allowing them to
    be more automated in the control of substations, et cetera.
        You had mentioned supply chain as part of your testimony,
    which is one of the areas of the concern with me. And I think
    you also mentioned a standardization. Is there any standard as
    far as configuration, what infrastructure components for a
    network looking at the cybersecurity side gateways, routers,
    security devices? Do you know, is there an industry standard or
    an accepted product list that we know that if a utility
    implements this type of product or this type of configuration,
    then it's approved, it would be more likely to be secure or
    that something that's lacking? And what's your comment as far
    as is what we need in standardization?
        Ms. Bartol. I don't believe there's a list as you're
    describing, and it really--what's needed depends on each
    individual utility's configuration and architecture. There are
    standards that provide a set of processes and so to say rules
    that help organizations think through how to do this well, to
    help them think through putting together processes and
    relationships with suppliers that are more robust than
    otherwise. And those--there's--in this document--there's an
    international ISO document specifically just for security and
    supply relationships. There's an IEC document for control
    systems. So there's a number of standards. They tend to look at
    the process more than specific configuration because it all
    depends on individual----
        Chairman Loudermilk. Right. Is there a vulnerability there?
    And I'm coming from the equipment side because I know many of
    the especially small utilities will build the SCADA systems
    where they can control substations and different elements
    within that EMC or within that municipality. Then they'll
    connect it to the internet so their technicians can respond
    remotely without coming in.
        We have seen that that's a huge vulnerability. When I was
    in the military, we had an approved products list that have
    been tested that says if you're going to do this--which that
    are going to happen, you know, given that's going to happen--if
    you use this product with this configuration, then you're going
    to more likely be secured, but I know that there's numbers of
    small utilities out there that can easily be--I know they are
    very vulnerable the nation.
        Would a standardized equipment list that has been tested--
    because we also know that a lot of these guys go in and they
    will buy their equipment from eBay or wherever they can get it
    cheaper and I know at one time some foreign-made hardware is
    actually encoded in the firmware with holes, backdoors to allow
    people to get in. Is that something that you feel is needed?
    And also, I'd like Dr. Morgan to answer--I see that you're
    trying to respond.
        Ms. Bartol, would you comment on that? Is that something
    that you feel is something that we should look at?
        Ms. Bartol. A list of approved tested equipment would be
    tremendously helpful. My only reservation here is that, once
    you put a list in stone, if it's hard to get on it, then it
    would stifle innovation. So it can be done, it should be done,
    it needs to be done carefully, and there are several groups
    trying to work on this kind of a concept right now.
        Chairman Loudermilk. Thank you. Dr. Morgan?
        Dr. Morgan. Well, on the cyber issue, I mean your comment
    about interconnecting to the internet of course was critical.
    You might think in terms of not so much of specific equipment
    but in terms of architectures or system designs because that's
    the big issue. I mean if I do silly things like have wireless
    systems in substations that somebody from the outside can hack
    or if I have an internet connection for my SCADA, then I'm just
    sort of asking for problems.
        I might say one other thing on the cyber issue, and that is
    I know how to really cause a lot of disruption and
    inconvenience with cyber attacks. There haven't actually been
    any successful ones that I'm aware of, but I don't know how to
    cause large-spread physical damage.
        In contrast to the sort of thing that Dr. Baker was talking
    about or the sort of physical events that I was describing,
    which could, you know, if we got caught without appropriate
    preparation, could result in disruptions that came--that lasted
    for months or maybe longer----
        Chairman Loudermilk. Right.
        Dr. Morgan. --as opposed to, you know, days or weeks, which
    a cyber attack clearly could cause.
        Chairman Loudermilk. Yeah. Thank you. One last question,
    Ms. Bartol. You talked about legacy systems, and I've recently
    read that there's a physical or online attack once every four
    days, and I assume that is accurate. But when we are talking
    about going from a legacy system, which really what we're doing
    now is we're putting new technology on top--layering on top of
    the legacy system. When you're talking about going to a legacy
    system, I'm assuming you're talking about a smart grid type
    system. And part of that is the smart meters. Is there a
    vulnerability of having smart meters at home and what type of
    information are we gathering from that?
        Ms. Bartol. To my knowledge, the information gathered from
    the smart meters is information about electricity usage.
    Nothing that qualifies as personal information is gathered. The
    vulnerability lies in the fact that this is smart technology,
    this is IP internet protocol-accessible technology and lots of
    access points, a lot more access points than before. So the
    Swiss cheese is bigger and you have more opportunity to come
    in. That's the vulnerability really.
        Chairman Loudermilk. Okay. Thank you.
        And I apologize to the Committee; I exceeded my time. I now
    recognize the gentleman from Virginia, Mr. Beyer.
        Mr. Beyer. Thank you, Mr. Chairman.
        And thank all of you very much for coming and talking with
    us.
        Dr. Baker, in talking about severe space weather events and
    black sky days, number one, how frequent are these? Are these
    something that we can see once in our lifetime or once in 200
    years or once every five years? Is it realistic to think that
    we can extend the warning time from the 45 minutes at Lagrange
    1 to something much longer than that? And then as dramatic as
    these are, are there really mitigation efforts we can take that
    will make a difference?
        And by the way, are they limited to solar events or are
    there other extreme space events that we should be concerned
    about?
        Dr. Baker. With respect to the latter, there could be some
    other extreme events, but the most probable is really a solar-
    driven event of the sort we're talking about. How frequently
    these occur is the subject of continuing investigation, but the
    largest of these events are probably like equivalent of a 1-in-
    100-year kind of flood or something like that. But we are
    learning more about the sun all the time and recognizing that
    these could be occurring more on the time scale of every decade
    or two, every solar cycle.
        The--I--the other part of your question I guess----
        Mr. Beyer. Extending the warning period----
        Dr. Baker. Extending the warning period----
        Mr. Beyer. --the 4five minutes we have now.
        Dr. Baker. Yes, that's one of the key things that is under
    research right now. By looking at the sun, we can see that
    coronal mass ejections are being emitted from the sun. This can
    give us perhaps warning of 12 to 14 hours, something like that.
    If we knew what the conditions inside of that material that was
    expelled from the sun were, whether that was going to be
    extremely harmful or relatively benign, has largely to do with
    the interplanetary magnetic field. If we could do that, then we
    could give perhaps eight to ten hours of warning. That would be
    extremely beneficial for many who are trying to prepare
    themselves for the largest of these events that are coming.
        Mr. Beyer. All right. Thank you, Dr. Baker.
        And Ms. Bartol, you talked about the need for information-
    sharing legislation. Can I take it from that that information-
    sharing right now is prohibited by state or federal law? And
    are you aware of any initiatives or any proposals right now in
    play to make that information-sharing legal?
        Ms. Bartol. It's not prohibited but it is difficult due to
    various unclarities and restrictions that do exist. We--you
    know, the industry appreciates two bills passed by the House
    before summer, and we hope that the Senate will pass the
    information-sharing bill. It's about giving liability
    protections to organizations that need to share and it's mostly
    about the threat indicators. There's--it sort of made of data
    that comes in and you put in your system. That's what's being--
    --
        Mr. Beyer. I know all of us on the committee would love to
    pursue that in a constructive way.
        And, Dr. Morgan, you talked about the ice storms. You lead
    with that. As long as I've been paying attention, they've been
    bringing down power lines throughout the Northeast and Canada.
    Is there new engineering out there to make the overhead power
    lines less susceptible? They're burying all the power lines in
    new projects around Virginia, for example.
        Dr. Morgan. Yeah, they're burying lower-voltage power
    lines. You're not likely to want to bury 500 and 765 kV
    transmission lines or the DC (direct current) lines that come
    down from La Grande in Quebec. But you can do things like build
    more robust towers. I mean one of the problems in the Quebec
    example that I gave was that there was a lot of collapsing of
    towers, and actually California has passed legislation that
    says that every so many towers you've got to put a robust tower
    that can--that won't collapse. I mean it's much cheaper to
    build towers that are just guide and held up by the wires but
    then you can get a domino collapse.
        So there are things like that you can do. They cost a bit
    more and you have to find regulatory strategies to pay for it,
    but the California example is one case where it's been done.
        Mr. Beyer. Great. Thank you.
        And Mr. Lordan, it's fascinating with the E1, E2, E3
    questions. On GMD and time to respond, how best do we expand
    that time to respond? What--on the E1, E2, E3--are these only
    coming from nuclear weapons? And is there something we can do
    on arms control and nonproliferation to guard against that?
        Mr. Lordan. So let's do E1, E2, E3 warning first.
    Typically--the EMP is a nuclear device. Typically, a nuclear
    device or some high-powered device, the fast rise time for the
    E1 is the most important part and a nuclear device is the way
    to go for that. We assume no warning for that, and so we've--we
    believe operational strategies are inapplicable for EMP, a
    nuclear attack. Are there things that DOD can do to give us
    warning, to mitigate attack? Certainly, but that's outside of
    my purview.
        And if I could go on to GMD----
        Mr. Beyer. Yeah, please.
        Mr. Lordan. --for warning. Okay, so the average storm is
    about four days. Dr. Baker says there's fast ones. So we can
    observe the sun and we can tell when it's coming, and there's
    things that you can do in that four day period even though you
    know that it's kind of vague but you're not sure exactly how
    big and you're pretty sure it's going to hit you but you're not
    exactly sure. There's things you can do. You can defer
    maintenance on your transmission line so you have more
    capacity, you can back off generation so that you have a little
    bit of room to add voltage support. So there's things like that
    you can do.
        And we are doing studies with NASA where they're trying to
    improve the accuracy of the observations of the sun in the
    first four days before it reaches DSCOVR satellite, yes.
        Mr. Beyer. Thank you. Thank you, Mr. Chairman.
        Chairman Loudermilk. Thank you.
        The Chair now recognizes the Chairman of the Energy
    Subcommittee, the gentleman from Texas, Mr. Weber.
        Mr. Weber. Thank you.
        Mr. Lordan, a friend of mine likes to say that nothing is
    faster than the speed of light, and if you don't believe that,
    try opening the refrigerator door before the light comes on.
        An NNEMP, a nonnuclear electromagnetic pulse device, now
    you talked about the sun flare. I was astounded by that and did
    a little math. The sun is 93 million miles from Earth or 94.5
    at its aphelion. So at 186,000 miles an hour, how long do you
    anticipate it would take an event like the solar flare to hit
    us?
        Mr. Lordan. The storm is fast but not as fast as the speed
    of light. It travels about a million miles an hour, the typical
    one. And there's faster ones. So 93 million miles will get you
    there in about 96 hours is 4 days, so that's an easy way of
    doing it. And then the Lagrange 1 point where Dr. Baker
    referred, we have a satellite there. There's an A satellite,
    there's a DSCOVR satellite, and then when it reaches that
    point, you get a lot better information, but unfortunately, the
    gravitational Lagrange point is only one hour away from Earth.
    There's only--one million miles away.
        Mr. Weber. Okay. And my study, I know that the NNEMP,
    nuclear electromagnetic pulse weapons, there's a lot of
    discussion. There's nonnuclear electromagnetic pulse weapons,
    and they talk about capacitor banks.
        Mr. Lordan. Um-hum.
        Mr. Weber. So I owned an air-conditioning company for 34
    years and we're used to a lot of power, you know, calculations
    on a house being built, the size of a wire and all that kind of
    stuff needed, so I pay close attention to it. And of course
    being from Texas we have the ERCOT, Electric Reliability
    Council of Texas. We have our own grid, about 85 percent of the
    State. So we pay real close attention to that.
        But from the nonnuclear weapon standpoint, the capacitor
    banks that could go on the end of a missile, are you familiar
    with those?
        Mr. Lordan. Yes, sir. And there are smaller devices that
    are more accessible to more parties so we're trying to figure
    out the risk spectrum, the folks who can supply high-altitude
    nuclear device and have the missile capacity to get it here.
    It's small--
        Mr. Weber. Okay.
        Mr. Lordan. --and the effect is high. These intentional
    electromagnetic interference, which is what you're referring
    to, these are more accessible to more folks. The thing about
    those devices is that they provide a local impact, and
    therefore, you'd need to have a coordinated attack to make a
    big impact. And so I think this group is talking more about
    high impact--
        Mr. Weber. Right, and we're going to discuss that grid. I
    think it was Dr. Morgan who might have said you wouldn't want
    to put high-voltage underground. And one way to harden the grid
    would be to have most of your utilities underground. But when
    you say small, back to the NNEMPs, define small, 4 feet, 6
    feet, 2 feet.
        Mr. Lordan. I think--I'm going to say--I'm not sure
    exactly. I think I see things in a bread truck is what I
    usually see the picture of--
        Mr. Weber. Okay.
        Mr. Lordan. --but I think they can be they can be smaller
    than that.
        Mr. Weber. Okay. So let's go on to what I think Dr. Morgan
    said. You wouldn't want to put high-voltage wire underneath the
    ground, and a lot of utilities in a lot of States require--a
    lot of subdivisions require that utilities come into the
    neighborhood now underground, whether it's--you know, of course
    obviously water, sewer, electricity, phone, that kind of stuff,
    as opposed to the aerial overhead. How high does voltage have
    to be before you think you wouldn't want to put it underground?
        Dr. Morgan. Well, it's a matter of cost. I mean you can put
    a 500 kV line underground. I mean we run 500 kV lines across
    things like, you know, oceans with--
        Mr. Weber. Sure.
        Dr. Morgan. --cables but it's really expensive, and so--
        Mr. Weber. So you're not talking about from an engineering
    perspective----
        Dr. Morgan. I'm saying--I'm not saying you can't do it--
        Mr. Weber. --just the dollar amount?
        Dr. Morgan. --I'm saying it's excluded.
        Mr. Weber. Right.
        Dr. Morgan. On the issue of EMP, he's right. I could take
    out a substation with a small homemade EMP device. And I could
    also take--
        Mr. Weber. Now, let's define small. Is that three feet, two
    feet?
        Dr. Morgan. Something that would fit in the back of a
    pickup truck.
        Mr. Weber. Okay, so a truck bomb?
        Dr. Morgan. Well, yeah, I mean if you want to think of it
    that way.
        Mr. Weber. Okay.
        Dr. Morgan. On the other hand, you know, I could also take
    it out with a rifle, and so it's not clear to me that EMP--
        Mr. Weber. Okay.
        Dr. Morgan. --is the sensible--
        Mr. Weber. Well, let's go there. You talked about--one of
    you talked about the snipers from 2002.
        Dr. Morgan. Yeah.
        Mr. Weber. So transformer is a set of coils, and again we
    dealt with transformers, high-voltage, low-voltage in the air-
    conditioning business with oil in it, a light oil----
        Dr. Morgan. Right, in a big steel box.
        Mr. Weber. That's right. Why don't they just make the steel
    thicker and less----
        Dr. Morgan. Well, that's one of the things that's being
    talked about. Another thing, of course, that's being talked
    about is--I mean, you know, you can buy armor-piercing bullets
    on the internet, and so it's--there is--you really have to make
    it quite a bit thicker. But the other thing I can do is things
    like simply making it hard to see from the outside.
        Mr. Weber. Sure. Well----
        Dr. Morgan. I mean at the moment--
        Mr. Weber. You betcha.
        Dr. Morgan. --it's behind a chain-link fence.
        Mr. Weber. And, Mr. Lordan, you wanted to weigh in.
        Mr. Lordan. Just real quick. I mean you can make the tank
    thicker but the radiator where you're trying to dispel the heat
    is--
        Mr. Weber. You've got to have a way to get the heat out.
    Yeah.
        Mr. Lordan. And the attack in 2013 that you alluded to,
    they shot the tank a few times but what they really shot was
    the radiators--
        Mr. Weber. Well, a really good sniper can take the
    insulators out and bring the wires off down in contact with
    metal structure so----
        Dr. Morgan. Yeah, but that one's easier to fix. It's if I
    actually fry the transmitter--
        Mr. Weber. Oh, absolutely. You know, let a squirrel get
    across a couple of those things, it doesn't do the squirrel a
    lot of good and I've seen quite a number of transformers blown.
    Okay. Well, thank you. I yield.
        Dr. Morgan. May I say one last thing, and that is if I'm a
    terrorist and I have a nuclear weapon, it seems most unlikely
    I'm going to use it to do an EMP. You know, unfortunately, it's
    true. I'm going to put it in a major metropolitan area.
        Yeah.
        Mr. Weber. We had that discussion in my office this morning
    with my staffer in this area because I said, look, you're going
    to want to have death and destruction that shows up on TV.
    You're going to put it in a football stadium, for example.
        Dr. Morgan. Exactly. And EMP at that point is the last of
    our worries.
        Mr. Weber. Yeah, good point. Thank you. I yield back.
        Chairman Loudermilk. The Chair now recognizes Mr. Grayson,
    who is the Ranking Member on the Energy Subcommittee.
        Mr. Grayson. All right. I'm going to be asking Dr. Morgan a
    couple of questions based upon what would have been able to
    avoid major blackouts in the past, what kind of research and
    other efforts we should be undertaking now to avoid things that
    have already happened. Here's an interesting list. These are
    the 12 largest blackouts in history and what caused them. The
    first one I lived through, it was in New York in 1965. It was
    caused by the tripping of a 230 kilovolt transmission line and
    a domino effect that followed that; 1978, Thailand, the
    generators failed; 1989, Canada, a geomagnetic storm; 1999 in
    Brazil, a lightening struck an electricity substation near
    Itaipu; 2001, India, failure of a substation; 2003, in the
    United States and Canada there was a high-voltage power line
    that brushed against some overgrown trees; 2003, Italy, two
    internal lines overloaded; 2005, Indonesia, failure of a 500
    kilovolt transmission line; 2006 in Europe, a power company
    switched off a power line in order to let a cruise ship pass;
    2008, China, winter storms; 2009, Brazil, the Itaipu generator
    failed for a while; 2012, India, the largest in history, 670
    million people lost electricity and three power grids collapsed
    because circuit breakers tripped.
        So going through this list, clearly most of them were
    internal to the grid. Most of them were not caused by external
    events. There's not any instance in that list of cybersecurity
    issue, there's not any instance in that list of an
    electromagnetic pulse, not any instance of a terrorist attack,
    not any instance of any squirrel attack, and only one instance
    of space weather. So I think this can help us to focus what
    really would matter in this case, which is how do you avoid
    blackouts? Dr. Morgan?
        Dr. Morgan. Well, I certainly agree with that assessment. I
    would say one other thing first, which is the blackouts that
    most of us experience on an annual basis are not caused by the
    sort of large-scale blackouts that you just described but
    they're caused by, you know, people crashing their truck into a
    utility pole or a branch coming down on a line in a
    thunderstorm or something like that.
        For the big ones that you did discuss, there are obviously
    several things one can do. One needs much better training and
    supervisory controls so that you don't take steps that put the
    system into a vulnerable state. And there's a lot of research
    going on at DOE and elsewhere and within the industry on how to
    provide better control and also how to better train operators.
    Up until recently, it's been really hard to analyze the dynamic
    flows in a power system in real-time. Computers are getting to
    the point that you can get close to doing that. The strategy in
    the past has been think of all the contingencies that could
    override arise, analyze them all and figure out what I ought to
    do in each of those cases, and keep people prepared to move on
    those things. So the answer is, yes, there's a lot that can be
    done and much of it is being done.
        Mr. Grayson. Well, if you had to pick one single thing that
    would make blackouts like the ones that I described, the large-
    scale blackouts less likely, one form of research or
    development, what would that be?
        Dr. Morgan. Better supervisory status control, that is
    knowing what--how close to the edge I am and what my
    vulnerabilities are so if an event does--I mean all of these
    things are triggered by some event like, you know, an operator
    making a mistake or an ice storm or a flood or something, but I
    need to know what the status of the system is and have
    operators prepared to back off or do other things to take
    contingency--or to consider contingencies.
        Up until recently we've always used the sort of N minus 1
    rule, that is the rule that if one thing goes, the system ought
    to continue to operate okay. And we're getting sufficiently
    tight in terms of the capacity with which we're stressing the
    system that probably that's not a sufficiently conservative
    rule anymore and so people need to do analysis to figure out
    where they are at and what sorts of failures could cause what
    kinds of problems.
        Mr. Grayson. So are there national federal programs or even
    utility company programs along the lines of what you described
    or is it basically ad hoc at this point?
        Dr. Morgan. No, there are--it's not basically ad hoc. There
    are serious research programs at a number of the national labs
    like PNNL and EPRI and others on the industry side are also
    actively engaged in this sort of work. This is an issue that
    the industry really does understand and is working hard to
    address.
        I might say one other thing, and that is that the sort of
    replacement transformer issue that I mentioned addresses not
    just the kinds of destruction that could happen from terrorism
    or from natural events of the sort that you described but also
    the sort of thing that Dr. Baker talked about. I mean there are
    multiple reasons why one would like to have standby equipment,
    and transformers are just really big and hard to move and
    expensive, and so we ought to be doing better there.
        Mr. Grayson. Thanks. I yield back.
        Chairman Loudermilk. The Chair now recognizes the gentleman
    from Florida, Mr. Posey.
        Mr. Posey. Thank you very much, Mr. Chairman.
        Thank you, witnesses, for appearing today. And, Mr.
    Chairman, I thank you especially for holding this hearing. This
    issue is so vitally important to the national security of our
    country and I think possibly ultimately the survival of our
    species.
        The New York Times had a bestseller for a while. It's
    called ``One Second After'' by William Forstchen. I assume you
    all have read that before?
        Mr. Morgan. No.
        Mr. Posey. Well, my next question was going to be could you
    find any inconsistencies with the reality in the book? The book
    allegedly was written based on a Congressional intelligence
    report on the EMP threat. And it's staggering.
        Mr. Lordan. Would you want me to----
        Mr. Posey. Yes, sir.
        Mr. Lordan. Yeah. Do you want me to answer that----
        Mr. Posey. Yes.
        Mr. Lordan. --question? Okay. So, yeah, it was a novel, and
    so there were liberties taken and they did base this on
    classified information, which I don't have access to. But when
    we analyzed what the impact would be, and this is what we call
    a high-altitude electromagnetic pulse, detonated seven, ten
    miles above the Earth, we know that there were some relays are
    going to be affected but not all. We know that some computers,
    some communication systems are going to be impacted but not
    all. And it is possible and likely that there could be
    blackouts, but then there's a recovery and there's things you
    can do to recover more quickly.
        Mr. Posey. Okay. Dr. Baker mentioned the solar flare that
    we avoided. I think it crossed the path of our orbit about two
    weeks--if we had been about two weeks further ahead, it would
    have been very serious consequences. You talked about it being
    in trillions of dollars. Could you quantify that just in a
    couple of brief sentences, the kind of impact that would have
    had on everyday life?
        Dr. Baker. Well, I think--yes, it was--missed the Earth by
    about one week, about seven days, six or seven days. If it had
    occurred about a week earlier, so--it would have certainly hit
    the Earth. That would have been the kind of scenario that we
    think we would most dread. It would be a huge impact on the
    power grid. It would stand the chance of knocking out a number
    of the large, extremely high-voltage transformers on the
    backbone. We don't know how many, we don't know exactly the
    failure modes, but the $2 trillion really comes from looking at
    if one is without electrical power for weeks or months or
    extending into the timescale of a year or so, that this really
    then starts to be in the trillion of dollars kind of cost.
        Mr. Posey. What kind of damage do you think it would have
    been to our satellite systems?
        Dr. Baker. Well, that's the other component of this, which
    I'm glad to have the chance to respond to here is that it's not
    just the effects on the power grid directly; it's also the
    effects on satellites, the timing that we get from the global
    positioning systems which feeds into the other systems, it's
    the communication, it's all the things that we rely on. If all
    of those start to collapse and they start to collapse in
    sequence, then we are facing I think a kind of a society that
    we haven't seen for decades or 100 years or sent back to very
    primitive kind of conditions.
        Mr. Posey. I commend to you the book ``One Second After''--
    --
        Dr. Baker. I will----
        Mr. Posey. --and----
        Dr. Baker. Yes.
        Mr. Posey. The consequence, if it takes out enough
    satellites, you know, you don't have a weather report, you
    don't have a news report, you don't have a cell phone, you
    don't have a laptop----
        Dr. Baker. Absolutely.
        Mr. Posey. --you don't have a car that works, you don't
    have--I mean you're just out of business----
        Dr. Baker. Absolutely.
        Mr. Posey. --and it is very, very, very primitive. And the
    threat is real, as you mentioned. It's incredibly real.
        Dr. Baker. That's right.
        Mr. Posey. Are any of you aware of any technology to more
    or less have a super--for lack of a better term--circuit
    breaker that can detect an EMP threat in advance and shut this
    system down whether it be on a satellite or on a generator? Are
    any of you aware of that?
        Mr. Lordan. I'd say the--if you get hit with an EMP, the
    rise time of that impact is faster than any electronics device
    could respond to, I assert.
        Mr. Posey. Okay.
        Dr. Morgan. A couple of things. We were sort of disparaging
    about the technology in some earlier Soviet fighters until we
    figured out that the reason they were using vacuum tubes rather
    than solid state was precisely to be EMP-resilient.
        We have an annual doctoral qualifying exam in our
    department and we used a 2X Carrington event--Carrington event
    was the largest measured solar mass ejection--as the subject
    for the exam this past year, and the focus was on the
    resilience of emergency communication. You know, if you're
    using fiberoptics and you've hardened stuff at both ends, the
    fiberoptics are going to be resilient to this, so it really is
    a matter of looking carefully across the system for potential
    vulnerabilities. And as you heard in the case of the first
    testimony, if I back off the loading of the transformers, for
    example, so the cores are not saturated, I'm far less likely to
    fry them and I can do other things like capacitive coupling and
    some other----
        Mr. Posey. There is some----
        Dr. Morgan. --so the answer is there are strategies.
        Mr. Posey. There are people who now are working on a high-
    speed technology to detect it and super high-speed react to it
    but there just seems to be, believe it or not, no demand for
    it, which kind of amazes me but----
        Dr. Morgan. Well, to just say again what I said before,
    which is to get a widespread EMP from a nuclear device, it has
    to be a high-altitude burst and it--if we have an adversary
    that engages in a high-altitude burst, I think EMP may be the
    least of our problems because I presume it'll be combined with
    a whole lot of surface burst, which will----
        Mr. Posey. Sure.
        Dr. Morgan. I mean only a major nuclear exchange is likely
    to lead us to that point.
        Mr. Posey. Thank you, Mr. Chairman. I'm out of time so
    thank you for your graciousness.
        Chairman Loudermilk. The Chair recognizes the gentleman
    from Colorado, Mr. Perlmutter.
        Mr. Perlmutter. Thanks, Mr. Chair. You know, the purpose of
    this is we're a very connected society obviously, and that
    connectedness is great for comfort, for convenience, for
    efficiency, but it has an obvious downside, which is a
    potential domino effect of it all failing at once, whether it's
    a nuclear device, it's cybersecurity, it's space weather, it's
    just some huge planetary Earth kind of weather thing.
        So, Dr. Baker, I want to start with you real quick and then
    to you, Ms. Bartol, and then I'm going to yield the balance of
    my time to Mr. Takano.
        Given where we are, if you had your wish list, what would
    be the things we could do to predict better and more quickly
    the space weather events you talked about to minimize the
    damage that might come from a big event?
        Dr. Baker. I think what we really need to have is a 24 by 7
    very dedicated kind of program to look at the sun from sort of
    all directions and to be able to, as soon as possible, assess
    whether the disturbances coming from the sun are going to be
    harmful or relatively benign. If we could do that, we would
    then be much better positioned to react appropriately and to
    probably minimize the impacts.
        The difference is that we--right now--light travels at
    186,000 miles per second, 8 minutes warning that something is
    happening on the sun, but the fastest of these events can be at
    Earth in 12 or 14 hours.
        Mr. Perlmutter. And you would suggest that we invest some
    more to avoid what could be----
        Dr. Baker. That's right.
        Mr. Perlmutter. --potentially unbelievable costs
        Dr. Baker. That's right. I think the----
        Mr. Perlmutter. Okay.
        Dr. Baker. --investment in such an observing program would
    be dwarfed by the cost society would face if we don't do those
    things.
        Mr. Perlmutter. Okay. Ms. Bartol, what would you suggest
    that we do today to minimize the potential for cyber attacks
    that bring down the system?
        Ms. Bartol. We need to educate the society about their
    behavior on the internet and educate specifically in the case
    of energy industry the people who work in the utility, from
    executives to people on the ground, boots on the ground,
    especially the small utilities that the Chairman discussed.
    They have one IT guy or maybe a security guy at the same time.
    It's a matter of expertise; it's a matter of knowledge. There
    may be technologies and techniques they might not know. So
    education is huge here.
        Mr. Perlmutter. I yield the balance of my time to the
    gentleman from California.
        Mr. Takano. Dr. Morgan, what are microgrids and would they
    be useful--a useful tool that could be--that could enable
    communities to withstand and recover faster from high-impact
    events?
        Dr. Morgan. A microgrid is a small collection of local
    generators, perhaps combined heat and power systems, which are
    interconnected and then also usually connected to the grid. The
    big difficulty we have with--and so every presentation you go
    to, you'll see--at DOE, at EPRI, and others, you'll see all
    this proliferation of new technology on the demand side, that
    is, on the distribution system side. What those don't typically
    talk about is who's going to own all that stuff. And most U.S.
    States have rules that provide exclusive service territories to
    utilities, which means the only entity that can own one of
    those things is a utility, and pardon my EPRI friends; I've
    advised them a lot--I would not rank the distribution utilities
    as the most innovative firms in the country. And so I think
    there needs to be some strategy to allow small-scale private
    players to get--we've deregulated much of the supply side. We
    need to do a bit more on the demand side to allow small-scale
    players to come in underneath the distribution system to build
    these sorts of systems because they can provide very
    considerable resilience in--for critical social services in the
    event that the large-scale system goes down.
        I'm not talking about getting off the grid. And I'm talking
    about tariffs that are symmetric so they recognize the cost
    that you impose on the big system and vice versa. When the
    United States--when the Congress passed law that said I must--
    if I build a generator, the utility must interconnect me, that
    was a federal law and now that's true all across the country.
    On the other hand, if I try to sell some of that power to Dr.
    Baker next door, that's in most States not legal yet, and so I
    don't know if this has got to be solved 50 times for different
    States or if it could be solved once for the nation as a whole
    in the same way that interconnection for single generators was
    solved. But I think it's an issue that would be worth your
    exploring.
        Mr. Takano. Yeah, my time is up. I yield back. Thank you. I
    thank the gentleman from Colorado for yielding.
        Chairman Loudermilk. Thank you. I recognize Mr.
    Rohrabacher----
        Mr. Perlmutter. Mr. Chair, just a second. Did you recognize
    that Dr. Baker was from Colorado?
        Chairman Loudermilk. I believe we did in the very
    beginning, yes.
        Mr. Perlmutter. Okay. Thank you. Thank you. I meant to
    mention that. I'm sorry.
        Chairman Loudermilk. Oh, thank you. I recognize the
    gentleman from California, Mr. Rohrabacher.
        Mr. Rohrabacher. Thank you very much. And, again, Mr.
    Chairman, I appreciate your leadership on this issue. This is
    an issue that is vital to our country's safety and security,
    and frankly, this is the first detailed hearing I've been to on
    it. I congratulate you for stepping up and providing that
    leadership.
        And I'd also like to associate myself with Mr. Takano's
    line of questioning, which was right on target. And--but I
    would like to disassociate myself with Mr. Grayson's line of
    questioning.
        Mr. Grayson. I appreciate that. Feel free to disassociate
    yourself at any time from any questions I ask. I feel good
    about that.
        Mr. Rohrabacher. He wanted me to do that to help him in his
    Senatorial campaign.
        The discussion that we're looking at here is, as far as I
    can see, there's low probability of certain types of
    disruptions but with high-impact, very high-impact, but then we
    have other vulnerabilities that you've outlined that have lower
    impact. Where should our emphasis be? Should it be on this--
    basically a solar storm in trying to make sure that we are
    lined up for that and have a few days' notice and then being
    able to turn off our machines and in the meantime to sort of
    minimize the effect, or should we be looking at these various
    things that you're talking about, adding steel so that the
    terrorist squirrels don't get to us?
        Dr. Baker. Let me first say that I think this is a very
    active topic of research trying to understand what lower--you
    know, higher-frequency, lower-impact kind of events are doing
    to our systems. We can--it's very useful for us to think about
    the most extreme events and how we would inure ourselves to
    their effects. If we did that, we'd probably make ourselves
    better for the lower frequent--for the lower-impact events as
    well. But right now I think we don't know exactly where the
    sweet spot is, and investment versus, you know, the cost of
    doing things versus the impact that we might have.
        Mr. Rohrabacher. Well, we just were treated to some
    information about possibilities that utilities and that being
    one of the roadblocks to--and, by the way, it's just not
    utilities; it's also politics in the local area which determine
    what the policies of those utilities will be. Let me just ask
    this. In terms of--aren't we really talking about de-griding
    the country? Isn't that really the long-term concepts? No,
    perhaps we have reached a stage where my colleagues on the
    other side of the aisle have been trying to push me for a long
    time into basically having independent generation of
    electricity by solar power and things such as that, individual
    homes de-grided? Go right ahead, sir.
        Dr. Morgan. I think we're always going to need a grid. I
    think you're right that there will be much more dispersal of
    generation but, you know, the sun doesn't shine at night, and
    at the moment, storage technologies are very expensive, and
    there are some broader reasons as well that you really want to
    have a high-voltage backbone. And the wind doesn't blow all the
    time either. For example, in the Bonneville Power
    Administration some years ago there was a period of ten days
    when not a single wind machine put out a single bit of
    electricity. So you've got to have strategies to deal with
    that.
        On your earlier question, though, what's the appropriate
    balance between smaller-scale stuff and the very large things?
    I mean I think you've got to have a bit of both and you've got
    to figure out how to strike the appropriate balance. You can't
    go off the deep end and put all your energies into worrying
    about the rare events that could cause nationwide or large
    regional blackouts and not worry at all about local and
    smaller-scale stuff of the sort that hurricanes or others can
    do, and so you need a balance.
        There's one other thing I might say on that, and that is,
    given that you don't know which utility is going to get into
    trouble, there is a problem of sort of the commons. I mean no
    single--especially for terrorism, no single utility can really
    justify in economic terms making the investments for something
    like a transformer stockpile. On the other hand, the nation as
    a whole ought to have it because there is a good chance that
    somewhere, sometime we are going to wish we had it.
        Mr. Rohrabacher. Mr. Chairman, let me just note that the
    storage of electricity is a major part of this whole concept of
    how we're going to deal with this. There is a lot of research
    going on right now. There are some people who are working on
    what could be breakthrough technologies in the storage of
    electricity, and this, too, might be an interesting discussion
    for the Committee. Thank you.
        Chairman Loudermilk. Thank you. We'll keep that in
    consideration.
        I now recognize the gentleman from Ohio, Mr. Johnson.
        Mr. Johnson. Thank you, Mr. Chairman.
        Again, I agree this is a very, very important topic and I
    appreciate our panel being here with us today.
        Dr. Baker, you know, in 1989 a geomagnetic disturbance
    brought on by a solar weather event caused millions of
    Canadians to lose their power for approximately nine hours. The
    grid in that situation collapsed within 92 seconds of the
    geomagnetic disturbance event. If a similar event occurred
    today almost 30 years later, would there be more of a warning?
    Would we know about it in advance?
        Dr. Baker. I think what would probably be the biggest
    difference between now and 30 years ago is how interconnected--
    Congressman Perlmutter mentioned the interconnectedness of
    society. I think that we are much more tightly coupled now. The
    impacts would propagate more--further and I think more rapidly
    and probably more seriously. And so----
        Mr. Johnson. So it could be a more negative impact?
        Dr. Baker. It could be a more negative impact by far I
    believe, and that's one of the things that I guess I've been
    most struck by in my recent examination of these issues is how
    interconnected society is and how interconnected our
    technologies are. We've surrounded ourselves, as we like to
    say, in a cyber electric cocoon that is----
        Mr. Johnson. Sure.
        Dr. Baker. --much more tightly coupled now than it was 30
    years ago.
        Mr. Johnson. Yeah, I share your concern. As a 30-year-plus
    IT professional, I have a great concern about the
    interconnectivity. There's great benefit to it but there's also
    tremendous risk associated with it. So in that vein, is there
    technology available to help us contain or limit the impact and
    should we be looking at that kind of technology?
        Dr. Baker. I think we should be going into this with our
    eyes much more open than they are. I think many, many times we
    develop technologies in one sector without thinking about how
    they relate to other sectors and how dependent we become.
    Again, the timing signals that come from the global positioning
    system are playing into many other kind of technologies, and we
    at least should be aware of that. I believe we ought to be much
    more careful about what the interconnectedness that we build
    into our systems and--now and into the future.
        Mr. Johnson. Well, yeah, I agree with you. It certainly
    gives us pause to stop and think. You know, we should do a
    risk-benefit analysis to determine whether or not the risk of a
    particular----
        Dr. Baker. Right.
        Mr. Johnson. --system interconnectivity is an issue or not.
        How often do other events affect everyday life like high-
    frequency radio communications, our space travelers' health,
    satellite function, and aircraft electronic systems?
        Dr. Baker. I think when you think about the broad sweep of
    space weather and all those dimensions that you're talking
    about, it probably affects us, you know, all the time, and on a
    daily basis there can be things. But when the sun becomes more
    active especially, then I think that this becomes something
    that can affect all those sectors and sometimes simultaneously.
        So as we talked about before, there's a lot of focus on the
    most extreme events and the rarity of those extreme events, but
    as we build these more capable systems, the threshold for
    effective search go down and I think it becomes not a matter of
    every ten years or every five years, but it probably becomes
    almost a daily occurrence that someone somewhere is going to be
    suffering the effects of the environment on their technological
    system.
        Mr. Johnson. Yeah. Well, I mean we saw things like the
    Carrington event back in the early 1900s or earlier----
        Dr. Baker. Yes.
        Mr. Johnson. --1900s. Is there technology available today
    to increase the warning time of those types of events?
        Dr. Baker. Yes. As we talked about, by observing the sun
    that we could probably have an idea that a solar storm is
    coming our way. That Carrington event occurred in 1860. The
    internet of the Victorian age was the telegraph system. That
    was about the only technology that could really sense the
    effects of this.
        Mr. Johnson. Has anything of the magnitude of the
    Carrington event occurred since then?
        Dr. Baker. I mentioned in my testimony that there was an
    event that occurred in 2012 that was probably two or three
    times stronger than the Carrington event, that it missed the
    Earth by about a week or so, that had that occurred, I had
    contended--I guess we can debate this point--we'd probably
    still be picking up the pieces had that event had occurred a
    week earlier.
        Mr. Johnson. Is that right? Wow. How concerned are you
    about an extreme space weather event taking place during our
    lifetime? And you just said that, 2012, a couple of weeks'
    difference and we'd be still picking up the pieces. What do you
    mean by picking up the pieces? What would have been the
    potential implications of that?
        Dr. Baker. Well, as Dr. Morgan talked about, we don't have
    a lot of transformers lying around ready to reinstall into our
    power grid. We don't have a lot of the kinds of backup systems
    and so on ready----
        Mr. Johnson. I don't know. In Marietta, Ohio, the squirrels
    knockout transformers all the time and----
        Dr. Baker. Yeah, that's right. Yeah. But I believe that,
    again, if we think about the worst kind of case scenario and
    how this would propagate through not only the power grid but
    other aspects of technology, I mean that we would probably
    still be trying to recover fully from the effects of those
    kinds of--you know, the incidents of events.
        Mr. Johnson. Well, it's amazing how many things like this
    are out there that we--that--I daresay that many people have no
    clue how precipitously close we are to a disaster of
    magnanimous proportions and we don't even know about it. It's
    happening almost right under our noses and we don't know it.
        Dr. Baker. I think that's what's most alarming is the
    vulnerability that we have and how unaware we typically are
    about that, yes.
        Mr. Johnson. Okay. All right. Well, Mr. Chairman, I've
    exceeded my time. I yield back.
        Chairman Loudermilk. Well, this is a very important topic,
    and so we also have a gentleman from California, Mr. Takano,
    who is not a member of the subcommittee, but we appreciate his
    interest in being here. He's a member of the committee, and so
    I recognize you for the final five minutes.
        Mr. Takano. Thank you, Mr. Chairman. I thank my colleague
    from California, Mr. Rohrabacher, for commenting--saying
    something about the topic I brought up, the line of
    questioning.
        Dr. Morgan, am I to conclude that--with my question
    regarding microgrids that--and the--your comment about the
    emphasis--the heretofore emphasis on distribution and not
    enough attention maybe on the other side of the equation on
    diversifying the generation----
        Dr. Morgan. The reverse?
        Mr. Takano. Excuse me. Go ahead. Clarify what you're----
        Dr. Morgan. The reverse. We have restructured the supply
    side. We have not done too much to restructure the demand side,
    that is the distribution system and the microgrids that might
    be down under the distribution.
        Mr. Takano. Thank you. Thank you for clarifying. Okay.
        So my question is--and I want to follow up on what Mr.
    Rohrabacher suggested at the end of his comments about battery
    technology and--where--how could the federal government--or
    what would be the appropriate role in terms of emphasizing more
    research in this area? There's a lot of breakthrough. I just
    recently visited a vanadium battery company. How could this
    be--is this a potential game-changer if we were to make
    breakthroughs in various types of battery technology and how
    this would help alleviate our vulnerability?
        Dr. Morgan. Yeah, battery technology is important, and of
    course in California there's actually mandates to try to get
    some more batteries installed to begin to get practice and to
    drive things down the experience curve. The--I mean and there
    are a bunch of emerging new technologies. Jay Whitacre, for
    example, on my faculty has built a company called Aquion, which
    has a very nontoxic battery that's basically you can drink the
    electrolyte that could be--yeah, it really is. It's just a----
        Mr. Perlmutter. I'll stick to beer.
        Dr. Morgan. Yeah. But--and the DOE is--has some major
    research in that space. Actually, if you allow me 30 seconds to
    come back to the earlier line of questioning----
        Mr. Takano. Sure.
        Dr. Morgan. --with respect to interconnectedness, solar
    mass ejections is--are a high-latitude event. That is you'll
    notice that all of the examples were at, you know, in Canada or
    in South Africa, but if you have an event like that and it
    causes a big disruption, the power system is interconnected, so
    another thing you can do to limit the propagation of a problem
    is to be concerned about how do you avoid propagating
    disturbances if you take out, say, the power system across the
    northern tier of the United States and Canada? How do you avoid
    that then subsequently propagating through the rest of the
    Eastern interconnect or the Western interconnect? More likely,
    the Eastern interconnect given the geology. I'm sorry. Go
    ahead.
        Mr. Takano. What can we do more to--I know the DOE supports
    the battery research, but could we be doing more? And is this a
    wise place to kind of do more--provide more support?
        Dr. Morgan. Well, I mean I mentioned Jay Whitacre. That
    work has largely been supported with venture monies, and so you
    want to make sure that you continue to provide a hospitable
    environment for those sorts of investments. But I think almost
    anybody today who has a really good battery idea and has begun
    to demonstrate it in the laboratory isn't going to have a lot
    of problems finding substantial capital to build a firm.
        Mr. Takano. Well, great. But related to the entire topic of
    today's hearing, better battery storage, energy storage
    technologies could also be part of a strategy to address----
        Dr. Morgan. Yes. I mean it's clear there is no one-size-
    fits-all. As we restructure the system, we're going to need a
    portfolio of strategies and technologies, and support for the
    critical issues all across that space are important.
        The Office of Electricity at the DOE has, for reasons I've
    never quite understood, long been rather neglected and has been
    modestly funded, and so that would be one place to start. And I
    don't know why it is, but OMB has always often sort of
    neglected it as well. I think that's a mistake and I think that
    this committee maybe ought to explore that or these committees
    ought to maybe--subcommittees should explore it a bit more.
        Mr. Takano. Mr. Chairman, I would endorse that suggestion,
    also my colleague's suggestion, Mr. Rohrabacher's suggestion
    about more work on what's going on in the private sector and
    the public sector in battery storage and energy storage
    technology.
        Chairman Loudermilk. I thank the gentleman. And I mean this
    needs to be an ongoing discussion that we're having.
        And again, I thank the witnesses for taking time here today
    and for the Members being with us. We do have another briefing
    to get to regarding energy and the threats that we're facing.
        So, as we've seen, as America's aging electric grid
    transitions to the smart grid, we must make sure that we are
    effectively protecting it, and as we've seen, we've got a long
    way to go. And as I've heard today, while the grid has been
    resilient, vulnerabilities remain. Given the importance of the
    electric grid in everyday life, addressing these
    vulnerabilities is paramount to ensuring the safety and
    security of our nation.
        To the Members, the record will remain open for two weeks
    for additional comments and written questions from Members. The
    witnesses are excused and the hearing is adjourned. Again,
    thank you.
        [Whereupon, at 11:22 a.m., the Subcommittees were
    adjourned.]

                                   Appendix I

                                  ----------

                       Answers to Post-Hearing Questions

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                  Appendix II

                                  ----------

                       Additional Material for the Record

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                     [all]