    [House Hearing, 115 Congress]
    [From the U.S. Government Publishing Office]

      THE ELECTRICITY SECTOR'S EFFORTS TO RESPOND TO CYBERSECURITY THREATS

    =======================================================================

                                    HEARING

                                   BEFORE THE

                             SUBCOMMITTEE ON ENERGY

                                     OF THE

                        COMMITTEE ON ENERGY AND COMMERCE
                            HOUSE OF REPRESENTATIVES

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                FEBRUARY 1, 2017

                                   __________

                                Serial No. 115-3

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

          Printed for the use of the Committee on Energy and Commerce
                            energycommerce.house.gov

                                      ______

                             U.S. GOVERNMENT PUBLISHING OFFICE

    24-845                         WASHINGTON : 2017
    -----------------------------------------------------------------------
      For sale by the Superintendent of Documents, U.S. Government Publishing
      Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
             DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
                              Washington, DC 20402-0001

                        COMMITTEE ON ENERGY AND COMMERCE

                              GREG WALDEN, Oregon
                                     Chairman
    JOE BARTON, Texas                    FRANK PALLONE, Jr., New Jersey
      Vice Chairman                        Ranking Member
    FRED UPTON, Michigan                 BOBBY L. RUSH, Illinois
    JOHN SHIMKUS, Illinois               ANNA G. ESHOO, California
    TIM MURPHY, Pennsylvania             ELIOT L. ENGEL, New York
    MICHAEL C. BURGESS, Texas            GENE GREEN, Texas
    MARSHA BLACKBURN, Tennessee          DIANA DeGETTE, Colorado
    STEVE SCALISE, Louisiana             MICHAEL F. DOYLE, Pennsylvania
    ROBERT E. LATTA, Ohio                JANICE D. SCHAKOWSKY, Illinois
    CATHY McMORRIS RODGERS, Washington   G.K. BUTTERFIELD, North Carolina
    GREGG HARPER, Mississippi            DORIS O. MATSUI, California
    LEONARD LANCE, New Jersey            KATHY CASTOR, Florida
    BRETT GUTHRIE, Kentucky              JOHN P. SARBANES, Maryland
    PETE OLSON, Texas                    JERRY McNERNEY, California
    DAVID B. McKINLEY, West Virginia     PETER WELCH, Vermont
    ADAM KINZINGER, Illinois             BEN RAY LUJAN, New Mexico
    H. MORGAN GRIFFITH, Virginia         PAUL TONKO, New York
    GUS M. BILIRAKIS, Florida            YVETTE D. CLARKE, New York
    BILL JOHNSON, Ohio                   DAVID LOEBSACK, Iowa
    BILLY LONG, Missouri                 KURT SCHRADER, Oregon
    LARRY BUCSHON, Indiana               JOSEPH P. KENNEDY, III,
    BILL FLORES, Texas                       Massachusetts
    SUSAN W. BROOKS, Indiana             TONY CARDENAS, California
    MARKWAYNE MULLIN, Oklahoma           RAUL RUIZ, California
    RICHARD HUDSON, North Carolina       SCOTT H. PETERS, California
    CHRIS COLLINS, New York              DEBBIE DINGELL, Michigan
    KEVIN CRAMER, North Dakota
    TIM WALBERG, Michigan
    MIMI WALTERS, California
    RYAN A. COSTELLO, Pennsylvania
    EARL L. ``BUDDY'' CARTER, Georgia
                             Subcommittee on Energy

                              FRED UPTON, Michigan
                                     Chairman
    PETE OLSON, Texas                    BOBBY L. RUSH, Illinois
      Vice Chairman                        Ranking Member
    JOE BARTON, Texas                    JERRY McNERNEY, California
    JOHN SHIMKUS, Illinois               SCOTT H. PETERS, California
    TIM MURPHY, Pennsylvania             GENE GREEN, Texas
    ROBERT E. LATTA, Ohio                MICHAEL F. DOYLE, Pennsylvania
    GREGG HARPER, Mississippi            KATHY CASTOR, Florida
    DAVID B. McKINLEY, West Virginia     JOHN P. SARBANES, Maryland
    ADAM KINZINGER, Illinois             PETER WELCH, Vermont
    H. MORGAN GRIFFITH, Virginia         PAUL TONKO, New York
    BILL JOHNSON, Ohio                   DAVID LOEBSACK, Iowa
    BILLY LONG, Missouri                 KURT SCHRADER, Oregon
    LARRY BUCSHON, Indiana               JOSEPH P. KENNEDY, III,
    BILL FLORES, Texas                       Massachusetts
    MARKWAYNE MULLIN, Oklahoma           G.K. BUTTERFIELD, North Carolina
    RICHARD HUDSON, North Carolina       FRANK PALLONE, Jr., New Jersey (ex
    KEVIN CRAMER, North Dakota               officio)
    TIM WALBERG, Michigan
    GREG WALDEN, Oregon (ex officio)

                                 C O N T E N T S

                                  ----------
                                                                       Page
    Hon. Fred Upton, a Representative in Congress from the State of
      Michigan, opening statement....................................     1
        Prepared statement...........................................     3
    Hon. Bobby L. Rush, a Representative in Congress from the State
      of Illinois, opening statement.................................     4
    Hon. Frank Pallone, Jr., a Representative in Congress from the
      State of New Jersey, opening statement.........................     5
        Prepared statement...........................................     7
    Hon. Greg Walden, a Representative in Congress from the State of
      Oregon, opening statement......................................     8
        Prepared statement...........................................    10

                                   Witnesses

    Gerry W. Cauley, President and CEO, North American Reliability
      Corporation....................................................    11
        Prepared statement...........................................    14
        Answers to submitted questions...............................   110
    Scott I. Aaronson, Executive Director, Security and Business
      Continuity, Edison Electric Institute, on behalf of Electricity
      Subsector Coordinating Council.................................    26
        Prepared statement...........................................    29
        Answers to submitted questions...............................   124
    Chris Beck, Chief Scientist and Vice President for Policy, The
      Electric Infrastructure Security Council.......................    45
        Prepared statement...........................................    47
        Answers to submitted questions...............................   135
    Barbara Sugg, Vice President for IT and Chief Security Officer,
      Southwest Power Pool, on behalf of ISO/RTO Council.............    62
        Prepared statement...........................................    64
        Answers to submitted questions...............................   142

                               Submitted material

    Statement of the Large Public Power Council......................   103
    Joint statement of the American Public Power Association and the
      National Rural Electric Cooperative Association................   108

      THE ELECTRICITY SECTOR'S EFFORTS TO RESPOND TO CYBERSECURITY THREATS

                                  ----------

                          WEDNESDAY, FEBRUARY 1, 2017

                      House of Representatives,
                                Subcommittee on Energy,
                              Committee on Energy and Commerce,
                                                        Washington, DC.
        The subcommittee met, pursuant to call, at 10:15 a.m., in
    room 2322 Rayburn House Office Building, Hon. Fred Upton
    (chairman of the subcommittee) presiding.
        Present: Representatives Upton, Olson, Barton, Shimkus,
    Murphy, Latta, Harper, McKinley, Johnson, Long, Flores, Mullin,
    Hudson, Cramer, Walberg, Walden (ex officio), Rush, McNerney,
    Peters, Doyle, Castor, Sarbanes, Welch, Tonko, Loebsack,
    Schrader, Kennedy, Butterfield, and Pallone (ex officio).
        Staff present: Will Batson, Legislative Clerk, E&P; Ray
    Baum, Staff Director; Jordan Davis, Director of Policy and
    External Affairs; Wyatt Ellertson, Research Associate, Energy/
    Environment; Adam Fromm, Director of Outreach and Coalitions;
    Tom Hassenboehler, Chief Counsel, Energy/Environment; Zach
    Hunter, Director of Communications; A.T. Johnston, Senior
    Policy Advisor/Professional Staff, Energy/Environment; Katie
    McKeough, Press Assistant; Brandon Mooney, Senior Policy
    Advisor, Energy; Mark Ratner, Policy Coordinator; Annelise
    Rickert, Counsel, Energy; Dan Schneider, Press Secretary; Peter
    Spencer, Professional Staff Member, Energy; Evan Viau, Staff
    Assistant; Jeff Carroll, Minority Staff Director; David
    Cwiertny, Minority Energy/Environment Fellow; Rick Kessler,
    Minority Senior Advisor and Staff Director, Energy; John
    Marshall, Minority Policy Coordinator; Alexander Ratner,
    Minority Policy Analyst; Andrew Souvall, Minority Director of
    Communications, Outreach and Member Services; Tuley Wright,
    Minority Energy and Environment Policy Advisor; and C.J. Young,
    Minority Press Secretary.

       OPENING STATEMENT OF HON. FRED UPTON, A REPRESENTATIVE IN
                  CONGRESS FROM THE STATE OF MICHIGAN

        Mr. Upton. The Subcommittee on Energy will now come to
    order. Apologize for the delay. There were some technical
    difficulties with the cameras but they are now working. So
    everybody looks good and in color.
        I recognize myself for 5 minutes. Today's hearing is going
    to examine what the electricity sector is currently doing to
    prepare for and respond to cybersecurity threats to the
    nation's electricity transmission systems.
        News reports bombard us almost daily about malware
    infections and portrayals of the harm from cyber-attacks. We've
    read alarming descriptions of what might happen if there is
    successful widespread attack on the critical infrastructure of
    the electricity system and the potential challenges to
    recovering from such an attack.
        It is unquestionable that ensuring the reliable supply of
    electricity is absolutely vital to our nation's security,
    economy, our health and welfare.
        In Michigan and across the country, electricity enables
    telecommunications, financial transactions, the transport and
    delivery of energy, food, everything. It powers the
    infrastructure that delivers our drinking water. It enables
    businesses and industry to make and provide the goods and
    services of our modern society and it powers our hospitals and
    our households.
        So cyber threats to reliability deserve our constant
    examination. But as we do so, we have to recognize that
    ensuring reliability is the central function of electricity
    grid operations, and a tremendously complex system has
    developed over time to ensure that the lights stay on. Given
    the unique nature of electricity, the system operates to
    address the occasional loss of transmission components and to
    avoid cascading failures. It doesn't always succeed, but large-
    scale blackouts have been rare for a reason.
        Nevertheless, new risks are emerging rapidly. The
    integration into the system of new technologies, especially
    digital technologies, that are essential for keeping up with
    the nation's energy needs constantly adds new vulnerabilities.
    Combine this with the rapid development of cyber-attacks and
    safeguarding transmission infrastructure becomes particularly
    challenging.
        In recent years, Congress has enhanced the ability of the
    electricity sector to address emerging cyber and physical
    threats. In the last Congress, this committee wrote provisions
    included in the FAST Act that sought to facilitate sharing of
    threat information between the private sector asset owners and
    the federal government. Other measures enhanced authorities for
    taking emergency action against cyber and physical attacks.
        At the same time, the NERC, operating through authorities
    authored by this committee, has been establishing and enforcing
    critical infrastructure protection standards and coordinating a
    number of other activities to confront these threats. Industry
    and federal authorities have been working to address those
    risks.
        We have taken testimony that outlines these activities in
    recent years, and I think that evidence shows that utilities
    and transmission operators are not sitting still.
        I don't think that anyone will dispute that improvements in
    operational practices, information sharing, defensive planning,
    supply chain controls, hardening of infrastructure remains
    necessary. And nobody will dispute that someday, an attack may
    succeed in taking down these components. So how does the
    industry plan to respond?
        This hearing will update the subcommittee on the state of
    the various NERC and industry activities to mitigate risks and
    respond to cyber-attacks. This will inform two objectives.
        First, this subcommittee's agenda for the Congress will
    include a close focus on the various structural, economic, and
    technological factors that are affecting development of the
    nation's electricity systems. We'll be examining policies that
    may need to be reformed to ensure this system adequately meets
    the demand of consumers in coming decades, and a key aspect of
    any of this work will certainly involve enhancing reliability
    in the evolving electricity system to meet the demands of the
    digital age.
        And second, we must continue to build a record about
    electric sector efforts to address cyber security threats. This
    will help us identify whether additional measures are
    necessary. In time, we will hear from DOE, FERC and other
    agencies, but developing a clear picture today about what the
    industry actually is doing will be critical to this ongoing
    effort.
        With that as a backdrop, let me welcome our witnesses. Our
    panel today provides a number of important perspectives. We
    will hear from NERC, the industry's reliability organization
    responsible for setting and enforcing standards. We will hear
    how the industry coordinates cybersecurity planning and
    response. We will hear perspective from a critical
    infrastructure expert, and we'll hear from someone responsible
    for cybersecurity in the actual operations of transmission
    systems.
        This panel this morning should help cover a range of topics
    from security standards to information sharing, recovery
    planning. It's going to help us understand where gaps may be
    going forward, and we welcome that testimony.
        [The prepared statement of Mr. Upton follows:]

                     Prepared statement of Hon. Fred Upton

        Today's hearing will examine what the electricity sector is
    currently doing to prepare for and respond to cybersecurity
    threats to the nation's electricity transmission systems.
        News reports bombard us almost daily about malware
    infections and portrayals of the harm from cyber attacks. We've
    read alarming descriptions of what might happen if there is
    successful, widespread attack on the critical infrastructure of
    the electricity system-and the potential challenges to
    recovering from such an attack.
        It is unquestionable that ensuring the reliable supply of
    electricity is absolutely vital to our nation's security,
    economy, our health and welfare.
        In my home state of Michigan and across the country,
    electricity enables telecommunications, financial transactions,
    the transport and delivery of energy, food. It powers the
    infrastructure that delivers our drinking water. It enables
    business and industry to make and provide the goods and
    services of our modern society. It powers our hospitals, our
    households.
        So cyber threats to reliability deserve our constant
    examination. But as we do so, we should also recognize that
    ensuring reliability is the central function of electricity
    grid operations-and a tremendously complex system has developed
    over time to ensure our lights stay on. Given the unique nature
    of electricity, the system operates to address the occasional
    loss of transmission components and to avoid cascading
    failures; it doesn't always succeed, but large scale blackouts
    have been rare for a reason.
        Nevertheless, new risks are emerging rapidly. The
    integration into the system of new technologies-especially
    digital technologies-that are essential for keeping up with our
    nation's energy needs constantly add new vulnerabilities.
    Combine this with the rapid development of cyber threats and
    safeguarding transmission infrastructure becomes particularly
    challenging.
        In recent years, Congress has enhanced the ability of the
    electricity sector to address emerging cyber and physical
    threats. In the last Congress, this Committee wrote provisions
    included in the FAST Act that sought to facilitate sharing of
    threat information between private sector asset owners and the
    federal government. Other measures enhanced authorities for
    taking emergency action against cyber and physical attacks.
        At the same time, the North American Electric Reliability
    Corporation (NERC)--operating through authorities authored by
    this Committee-has been establishing and enforcing critical
    infrastructure protection standards and coordinating a number
    of other activities to confront these threats. Industry and
    federal authorities have also been working to address risks.
        We've taken testimony that outlines these activities in
    recent years. And I think the evidence shows that utilities and
    transmission operators are not sitting still.
        But I don't believe anybody will dispute that improvements
    in operational practices, information sharing, defensive
    planning, supply chain controls, hardening of infrastructure
    remain necessary. And nobody will dispute that someday, an
    attack may succeed in taking down critical components; how does
    the industry plan to respond to that?
        Today's hearing will update the subcommittee on the state
    of the various NERC and industry activities to mitigate risks
    and respond to cyber attacks. This will inform two objectives:
        First, the energy subcommittee's agenda for this Congress
    will include a close focus on the various structural, economic,
    and technological factors that are affecting development of the
    nation's electricity system.
        We'll be examining policies that may need to be reformed to
    ensure this system adequately meets the demands of consumers in
    coming decades. And a key aspect of any of this work will
    involve enhancing reliability in the evolving electricity
    system to meet the demands of the digital age.
        And second: we must continue to build a record about
    electric sector efforts to address cyber security threats. This
    will help the subcommittee identify whether additional
    measures, are necessary. In time, we will hear from DOE, FERC
    and other agencies, but developing a clear picture today about
    what the industry actually is doing will be critical to this
    ongoing effort.
        With that as a backdrop, let me welcome our witnesses. Our
    panel today provides a number of important perspectives: We'll
    hear from NERC, the industry's reliability organization
    responsible for setting and enforcing standards; we'll hear how
    the industry coordinates cybersecurity planning and response;
    we'll hear perspective from a critical infrastructure expert;
    and we'll hear from somebody responsible for cybersecurity in
    the actual operations of transmission systems.
        The panel this morning should help cover a range of topics-
    from security standards to information sharing and recovery
    planning. It should help us discuss the various levels of cyber
    and related physical risks to electricity infrastructure and
    how they are addressed. And it should help us understand where
    gaps may be going forward.

        Mr. Upton. At this point, I recognize the ranking member of
    the subcommittee, my friend from Chicago, Mr. Rush.

     OPENING STATEMENT OF HON. BOBBY L. RUSH, A REPRESENTATIVE IN
                  CONGRESS FROM THE STATE OF ILLINOIS

        Mr. Rush. I want to thank you, Mr. Chairman, for this
    opportunity and for this hearing.
        Mr. Chairman, this is an important hearing on the
    electricity sector's efforts to respond to cybersecurity
    threats. Mr. Chairman, this is a very first step in examining
    the critical issue of a electricity sector cybersecurity.
        I look forward, Mr. Chairman, to engaging our distinguished
    panel of industry witnesses and their recommendations designed
    to protect the grid from external threats.
        However, Mr. Chairman, I am sure we will all agree that
    additional information is needed to truly appreciate the
    expanding host of challenges that could potentially threaten
    the U.S. electrical sector.
        Mr. Chairman, it is my understanding that you have
    committed to holding at least one additional hearing with
    agency stakeholders in the near future so that the members of
    this subcommittee will have a greater and a fuller appreciation
    for the security issues facing the grid.
        The issue of external forces hacking into most public and
    private domestic targets is one that is front and center on the
    minds of most of the American people.
        If recent history is any indication, then it's not a matter
    of if, Mr. Chairman, but, rather, when some threat, whether it
    be a national disturbance, an individual hacker, a rogue state
    or even a well-known foreign power challenges the resiliency of
    our nation's energy infrastructure.
        Mr. Chairman, we are all aware the cyber-attack in the
    Ukraine this past December that left over 225,000 people
    without power in Kiev as a result of suspected Russian hacking.
        While we have been fortunate, Mr. Chairman, to date in that
    we haven't suffered any major cybersecurity attacks on our own
    grid, let us not become complacent and wait until an event
    occurs.
        Many of us, Mr. Chairman, still view Russia, among other
    countries, as a potential threat to the U.S. grid system and we
    cannot risk our safety and security on the whims of Putin or
    any other foreign leader who may try to do us harm.
        Quite the contrary, we must be prudent and proactive in
    securing our electrical grid and part of that strategy must
    include close cooperation and collaboration between the public
    and private sectors.
        As was noted, in the last quadrennial energy review
    conducted by the Obama administration in January 2014, there is
    still work to do to improve the information sharing processes
    between government and industry.
        Additionally, we must ensure that our grid is protected
    from some of the specific challenges of today's world. We must
    make certain that the electricity sector is secure, even in the
    place of an aging infrastructure and a changing energy
    portfolio.
        That would include more distributed energy, smart grid
    technologies and other advanced technologies. Mr. Chairman, it
    is vital that Congress examines the state of the grid and
    provides real leadership in regards to modernizing our grid and
    making sure that it's secure for the challenges of the 21st
    century.
        With that, I yield back.
        Mr. Upton. Thank you. I understand that Chairman Walden is
    on his way but he's not quite here. So we will go to Ranking
    Member Pallone for an opening statement.

    OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE
                IN CONGRESS FROM THE STATE OF NEW JERSEY

        Mr. Pallone. Thank you, Mr. Chairman. Greg was at the other
    hearing.
        I want to thank you for holding today's hearing evaluating
    the cybersecurity threats to the electricity sector in our
    country and, of course, I welcome you to this new role as
    chairman of the Energy Subcommittee.
        You and I accomplished a great deal together in the last
    Congress and I hope to work together with you, Mr. Rush, on
    critical energy policy in this Congress.
        This hearing is a good first step for our committee to look
    into the impacts of cybersecurity threats on the electricity
    grid.
        However, I believe that we need more hearings and a deeper
    analysis of the issue so members can truly understand the
    challenges and threats facing our grid and I appreciate the
    chairman's willingness to honor Ranking Member Rush's request
    to hold another hearing on this topic with federal government
    witnesses, especially from the Department Energy and the
    Federal Energy Regulatory Commission.
        Their perspective and experience on this issue will be
    vital to the committee's oversight efforts and I also believe
    that the committee should hold a closed-door hearing to look at
    the cybersecurity risk to our electricity grid.
        There are classified aspects of this issue that can't be
    discussed in a public hearing like this and members deserve the
    opportunity to be briefed on this high-level information in
    order to ensure we are adequately protecting the grid from
    threats.
        To date, the industry has done a commendable job of
    guarding electricity consumers against losses caused by cyber-
    attack. But make no mistake, the threats are out there.
        In December 2015, Russian state hackers successfully
    compromised the Ukraine's electric grid, shutting down multiple
    distribution centers and leaving more than 200,000 residents
    without power for their lights and heaters.
        That attack was premeditated and well-choreographed with
    groundwork that predated the full attack by many months. It was
    sophisticated and synchronized, taking down backup power
    supplies and jamming phone lines to keep operators unaware of
    the extent of damages. And to date, it stands as the only
    recognized cyber-attack to successfully take down a power grid.
        Certainly, there are vast differences between the system in
    the Ukraine and our own grid. So it's tempting to dismiss
    events in the Ukraine as something that could never happen
    here.
        But we owe it to the American people to ask whether
    anything about that attack could be replicated here, what
    lessons can we learn to make our electric grid more secure and
    utility workers more vigilant of cybersecurity threats.
        And what should be the priorities of this committee and
    this Congress to ensure that a successful cyber-attack on the
    electric grid never happens on American soil? If Russia hacked
    our election, what's to stop them from hacking our electricity
    grid?
        Now, our committee has not been idle when it comes to grid
    security. Last Congress, Chairman Upton, with my support and
    the support of many members of the committee, pushed through
    legislation to enhance the security of our group from cyber and
    other threats.
        I was pleased to see that signed into law by President
    Obama because I consider grid security to be a top tier
    national security concern.
        And yet, just days ago President Trump signed a
    presidential memorandum establishing the members of the
    National Security Council's principles committee and it appears
    that the Secretary of Energy, who Congress just made the lead
    federal official responsible for securing our electricity grid,
    has been booted off this significant interagency advisory
    panel, and this is incredibly troubling and I strongly urge the
    president to reconsider his decision to sideline DOE from the
    national security dialog.
        I would hope that my Republican colleagues would join me in
    asking the president to reverse this decision. It's
    inexcusable, in my opinion, that there no longer appears to be
    room at the top level of the National Security Council for the
    secretary of energy who also is in charge of nuclear security
    but there is a permanent slot for Steve Bannon, his chief
    strategist.
        Essentially, President Trump has chosen his top political
    security advisor over the nation's top energy security advisor
    and that's a recipe for disaster.
        I hope my colleagues will join me in conveying that view to
    the White House before something happens that endangers our
    economy and our people because the safety of our grid and our
    nuclear arsenal are too important.
        I don't know if anybody else wants my time. Otherwise, I'll
    yield back.
        [The prepared statement of Mr. Pallone follows:]

                 Prepared statement of Hon. Frank Pallone, Jr.

        Mr. Chairman, thank you for holding today's hearing
    evaluating the cybersecurity threats to the electricity sector
    in our country. I welcome you to this new role as Chairman of
    the Energy Subcommittee. You and I accomplished a great deal
    together in the last Congress, and I hope to work together with
    you and Mr. Rush on critical energy policy in this Congress.
        This hearing is a good first step for our committee to look
    into the impacts of cybersecurity threats on the electricity
    grid. However, I believe that we need more hearings and a
    deeper analysis of the issue so members can truly understand
    the challenges and threats facing our grid. I appreciate the
    Chairman's willingness to honor Ranking Member Rush's request
    to hold another hearing on this topic with federal government
    witnesses, especially from the Department of Energy and the
    Federal Energy Regulatory Commission. Their perspective and
    experience on this issue will be vital to the Committee's
    oversight efforts. I also believe that the Committee should
    hold a closed-door hearing to look at the cybersecurity risks
    to our electricity grid. There are classified aspects of this
    issue that cannot be discussed in a public hearing like this,
    and Members deserve the opportunity to be briefed on this high-
    level information in order to ensure we are adequately
    protecting the grid from threats.
        To date, the industry has done a commendable job of
    guarding electricity consumers against losses caused by a
    cyberattack. But make no mistake: the threats are out there.
        In December 2015, Russian state hackers successfully
    compromised the Ukraine's electric grid, shutting down multiple
    distribution centers and leaving more than 200,000 residents
    without power for their lights and heaters. That attack was
    premeditated and well-choreographed, with groundwork that pre-
    dated the full attack by many months. It was sophisticated and
    synchronized, taking down backup power supplies and jamming
    phone lines to keep operators unaware of the extent of damages.
    To date, it stands as the only recognized cyberattack to
    successfully take down a power grid.
        Certainly, there are vast differences between the system in
    the Ukraine and our own grid, so it's tempting to dismiss
    events in the Ukraine as something that could never happen
    here. But we owe it to the American people to ask whether
    anything about that attack could be replicated here. What
    lessons can we learn to make our electric grid more secure and
    utility workers more vigilant of cybersecurity threats? And,
    what should be the priorities of this Committee and this
    Congress to ensure that a successful cyberattack on the
    electric grid never happens on American soil? If Russia hacked
    our election, what's to stop them from hacking our electricity
    grid?
        Now, our Committee has not been idle when it comes to grid
    security. Last Congress, Chairman Upton, with my support and
    the support of many members of the Committee, pushed through
    legislation to enhance the security of our grid from cyber and
    other threats. I was pleased to see that signed into law by
    President Obama because I consider grid security to be a top
    tier national security concern. And yet, just days ago,
    President Trump signed a presidential memorandum establishing
    the members of the National Security Council's Principals
    Committee--and it appears the Secretary of Energy--who Congress
    just made the lead federal official responsible for securing
    our electricity grid--has been booted off this significant
    interagency advisory panel.
        This is incredibly troubling and I strongly urge the
    President to reconsider his decision to sideline DOE from the
    national security dialogue. I would hope that my Republican
    colleagues would join me in asking the President to reverse
    this decision. It is inexcusable that there no longer appears
    to be room at the top level of the National Security Council
    for the Secretary of Energy--who also is in charge of nuclear
    security--but there is a permanent slot for Steve Bannon, his
    chief strategist. Essentially, President Trump has chosen his
    top political security advisor over the nation's top energy
    security advisor--and that's a recipe for disaster. I hope my
    colleagues will join me in conveying that view to the White
    House before something happens that endangers our economy and
    our people. The safety of our grid and our nuclear arsenal are
    too important.
        I yield back.

        Mr. Upton. The gentleman yields back.
        I just want to tell the gentleman that we do anticipate
    having some classified hearings as to cyber. So I know everyone
    has signed a pledge, so look forward to having that happen.
        At this point, I'll yield 5 minutes to the full committee
    chairman, my friend, the gentleman from Oregon, Mr. Walden.
        Mr. Walden. Thank you, Mr. Upton.
        Mr. Upton. Welcome to your first appearance before the
    subcommittee as full committee chair.

      OPENING STATEMENT OF HON. GREG WALDEN, A REPRESENTATIVE IN
                   CONGRESS FROM THE STATE OF OREGON

        Mr. Walden. I am delighted to be here, and I am delighted
    you're chairing this subcommittee. I wish you could have been
    downstairs for the beginning of the Health Subcommittee because
    we had a nice big University of Oregon ``O'' come up on the new
    screen there to match your green hearing room.
        Good morning, and I am pleased that the ranking member has
    such strong confidence in the new Secretary of Energy. We think
    he's a good man, too, and look forward to working with him on
    this committee.
        One of the humbling responsibilities for members of the
    Energy and Commerce Committee is to fully appreciate the power
    we have to make policy changes that can have enormous and
    positive impacts on American consumers for decades to come.
        From health care, to manufacturing and trade, to
    telecommunications, transportation, and the delivery of energy,
    our goal is to identify how to position the United States to be
    able to harness the tremendous potential of digital
    communications for all sectors of the economy, while minimizing
    unintended side effects.
        We are witnessing the transformation of American commerce
    as advances in digital and information technology affect almost
    everything that we do in our daily lives. And we see how
    layering new digital ways of doing things onto existing
    practices and infrastructures creates new risks and potential
    harm.
        Who among us is not frequently seeking out a plug-in so we
    can keep our various electronic devices charged? We are really
    tethered.
        Never has the reliability of the electric grid been more
    important to everything in our lives. That also means never has
    the electric grid been more of a potential target for
    disruption by nefarious actors.
        The hearing today concerns what is being done to address
    and respond to the cybersecurity threats to our nation's
    electricity system.
        By any measure, the reliable supply of electricity is an
    essential part of almost everything that we do, and its loss--
    even for short periods of time--can have expensive and life-
    threatening consequences.
        Unfortunately, cyber threats in this sector are
    unavoidable, and they are growing. This is due to the dynamic
    nature of the information flows in the modern world as well as
    the increasing sophistication of hackers and adversaries.
        Threats in these flows will only grow as the instant
    information and communications enabled by digital technology
    become more essential for our electricity system to operate at
    increased levels of reliability.
        Looking forward, it's clear the growth of digital
    technology will constantly introduce new avenues for
    cybersecurity threats. They must be managed effectively.
        Responsibility for addressing these threats, while
    harnessing the promise of digital technology, rests largely on
    the thousands of people involved in planning and operating our
    nation's complex electricity transmission systems, as well as
    the organizations charged with ensuring reliability.
        This morning we will hear from industry and cybersecurity
    experts who can provide us a report on the state of
    cybersecurity planning and practices.
        Our witnesses will help us understand just what is being
    done to address cybersecurity threats and how the industry
    plans to confront new threats as they emerge. The hearing will
    help us begin to understand more fully where the electricity
    sector is and where it should be in terms of cybersecurity and
    related risk to electric reliability.
        This will lay the groundwork for closer scrutiny of the
    relevant policies necessary to ensure future reliability in an
    evolving electricity, and, frankly, digital sectors.
        There are many questions to pursue, such as, how is
    cybersecurity planning being embedded in procurement and other
    systems planning by the industry? What measures are being
    implemented to prepare for successful attacks, so that--just as
    with nature's constant threats--if the lights do go out, can we
    get them back on quickly?
        And I know all of you run that grid test periodically and
    the tabletopping of it. So we will be interested to hear more
    about that.
        What's being developed to address the truly high
    consequence of the low probability events that can have the
    most devastating impacts? And what more can be done?
        We really appreciate your testimony. I've read through it
    and we are enhanced by your counsel. We look forward to working
    with you.
        With that, Mr. Chairman, I yield back the balance of my
    time.
        [The prepared statement of Mr. Walden follows:]

                     Prepared statement of Hon. Greg Walden

        One of the humbling responsibilities for members of the
    Energy and Commerce Committee is to fully appreciate the power
    we have to make policy changes that can have enormous and
    positive impacts on American consumers for decades to come.
    From health care, to manufacturing and trade, to
    telecommunications, transportation, and the delivery of energy,
    our goal is to identify how to position the United States to
    harness the tremendous potential of digital communications for
    all sectors of the economy, while minimizing unintended side
    effects.
        We are witnessing the transformation of American commerce
    as advances in digital and information technology affect almost
    everything that we do in our daily lives. And we see how
    layering new digital ways of doing things onto existing
    practices and infrastructures creates new risks and potential
    harm. Who among us is not frequently seeking out a plug in so
    that we can keep our various electronic devices charged? Never
    has the reliability of the electric grid been more important to
    everything in our lives. That also means never has the electric
    grid been more of a potential target for disruption by
    nefarious actors. The hearing today concerns what is being done
    to address and respond to the cybersecurity threats to our
    nation's electricity system.
        By any measure, the reliable supply of electricity is an
    essential part of almost everything we do, and its loss-even
    for short periods-can have expensive and life threatening
    consequences. Unfortunately, cyber threats in this sector are
    unavoidable and growing.
        This is due to the dynamic nature of the information flows
    in the modern world as well as the increasing sophistication of
    hackers and adversaries. Threats in these flows will only grow
    as the instant information and communications enabled by
    digital technology become more essential for our electricity
    system to operate at increased levels of reliability.
        Looking forward, it is clear the growth of digital
    technology will constantly introduce new avenues for
    cybersecurity threats that must be managed effectively.
    Responsibility for addressing these threats, while harnessing
    the promise of digital technology, rests largely on the
    thousands of people involved in planning and operating our
    nation's complex electricity transmission systems, as well as
    the organizations charged with ensuring reliability.
        This morning we will hear from industry and cybersecurity
    experts who can provide us a report on the state of
    cybersecurity planning and practices. Our witnesses will help
    us understand just what is being done to address cybersecurity
    threats, and how the industry plans to confront new threats as
    they emerge.
        The hearing will help us begin to understand more fully
    where the electricity sector is and where it should be in terms
    of cybersecurity and related risks to electric reliability.
    This will lay the groundwork for closer scrutiny of the
    relevant policies necessary to ensure future reliability in an
    evolving electricity sector.
        There are many questions to pursue: How is cybersecurity
    planning being embedded in procurement and other systems
    planning by the industry? What measures are being implemented
    to prepare for successful attacks, so that--just as with
    nature's constant threats-if the lights do go out, can we get
    them on quickly? What is being developed to address the truly
    high consequence but low probability events that can have the
    most devastating impacts? And what more can be done?
        As the committee implements its own energy policy agenda,
    the testimony we take will inform how we approach the future
    and how we best use innovation and technology to protect
    American consumers.

        Mr. Upton. Thank you. The gentleman yields back. We are
    ready for our witnesses.
        We are joined by Gerry Cauley, President and CEO of the
    North American Electrical Reliability Corporation, NERC; Scott
    Aaronson, Executive Director for the Security and Business
    Continuity from EEI, Edison Electric, on behalf of the
    Electricity Subsector Coordinating Council; Barbara Sugg, Vice
    President for IT and Chief Security Officer of Southwest Power
    Pool on behalf of ISO/RTO Council; and Dr. Chris Beck, Chief
    Scientist and Vice President for policy from the Electric
    Infrastructure Council.
        I welcome you all. We appreciate you submitting your
    testimony early, so we are able to take it home on the last day
    or two. We ask you to summarize it and take about 5 minutes in
    your presentation, at which time we will go to questions.
        Mr. Rush, yes.
        Mr. Rush. Mr. Chairman, by way of announcements, we have a
    former member here, Mike Ross from Arkansas.
        Mr. Upton. It is good to see your face, Mike. Welcome back.
    A good friend to all of us that served with you. Thank you.
    Thanks, Bobby.
        (Applause.)
        Mr. Cauley, you're recognized for 5 minutes.

        STATEMENTS OF GERRY W. CAULEY, PRESIDENT AND CEO, NORTH
      AMERICAN RELIABILITY CORPORATION (NERC); SCOTT I. AARONSON,
     EXECUTIVE DIRECTOR, SECURITY AND BUSINESS CONTINUITY, EDISON
     ELECTRIC INSTITUTE (EEI), ON BEHALF OF ELECTRICITY SUBSECTOR
      COORDINATING COUNCIL; CHRIS BECK, CHIEF SCIENTIST AND VICE
      PRESIDENT FOR POLICY, THE ELECTRIC INFRASTRUCTURE SECURITY
    COUNCIL (EIS COUNCIL); BARBARA SUGG, VICE PRESIDENT FOR IT AND
     CHIEF SECURITY OFFICER, SOUTHWEST POWER POOL (SPP), ON BEHALF
                        OF ISO/RTO COUNCIL (IRC)

                      STATEMENT OF GERRY W. CAULEY

        Mr. Cauley. Good morning, Chairman Upton, Ranking Member
    Rush, Committee Chairman Walden, Ranking Member Pallone, and
    members of the subcommittee.
        Thank you for conducting this timely hearing this morning
    to assess the cybersecurity of the nation's power grid.
        The threat of cyber-attack by nation states, terrorist
    groups and criminals is at an all-time high. In December, as
    has been mentioned, of 2015, a cyber-attack in the Ukraine left
    over 225,000 customers without power for several hours.
        This indicates that nation state adversaries have the cyber
    tools and now the will to disrupt the grid of other nations.
        More recently, in the U.S., although no effects were seen
    on the power grid, we saw a million electronic devices all part
    of the internet of things captured and used in a sudden denial
    of service attack against internet service providers.
        We've seen an increased presence of ransomware, data theft,
    and other criminal activities against all sectors of our
    economy. As defined by Congress, NERC's role is to assure the
    reliability and security of the bulk power system through
    mandatory standards, enforcement, and through reliability
    assessments.
        Our independent board and staff are not affiliated with the
    power system owners and operators. FERC approves NERC's
    standards and enforcement actions in the U.S. and has the
    authority to direct NERC to produce new standards or to revise
    existing standards.
        As a nation, we share a grid with our fellow countries to
    the north and south, which is why NERC is an international
    organization spanning the U.S., Canada and, of course, Mexico.
        Our cybersecurity standards, which are developed with the
    expertise of industry participating in that, provide a strong
    foundation for security practices across the industry.
        As just a few examples, our standards require inventory of
    cyber assets and configuration management, security perimeters
    and physical access controls, effective passwords and
    authentication, the use of certified software and patches,
    background checks and training of personnel, incident reporting
    and recovery plans.
        NERC, along with our eight regional entities, has cyber
    experts that conduct hundreds of visits each year to assess
    cybersecurity controls at these companies.
        We are finding that power companies take cybersecurity very
    seriously with strong attention at the top from CEOs and from
    boards.
        Cyber assets used to operate the grid are separate and
    isolated from business systems and corporate systems, and also
    from the public internet. Utility personnel are screened and
    well trained.
        There is a strong culture of security across each company.
    Companies are using advanced third party services to identify
    vulnerabilities and threats, and to maintain their system's
    secure.
        Most importantly, power companies know they must
    continually monitor and detect suspicious activity, isolate
    malware, and destroy it before anything happens. And this
    process is commonly known as the kill chain.
        As flexible and risk-based as our standards are, I firmly
    believe that we cannot win a cyber war with regulations and
    standards alone. Industry must be agile and continuously adapt
    to threats, and to do that we need robust sharing of
    information regarding threats and vulnerabilities.
        NERC operates the electric sector Information Sharing and
    Analysis Center, the E-ISAC. Our role is to assimilate
    intelligence and share trusted information with industry and
    government and to recommend specific actions.
        One of our most effective tools in this process is the
    Cybersecurity Risk Information Sharing Program, otherwise known
    as CRISP. Developed by the Department of Energy, CRISP has been
    adopted by NERC and deployed across wide areas of the U.S. grid
    to continuously monitor and detect malicious activity.
        Working with the U.S. government analysts at the classified
    level, we are able to detect problems early and get this
    information out to industry for action.
        When time is of the essence, NERC can also issue alerts to
    industry at three levels of urgency. The two highest levels of
    urgency require response from industry back to NERC.
        In addition to operating the E-ISAC, NERC conducts an
    annual security conference, training events and frequent
    classified briefings. As has been mentioned, we also conduct
    continent-wide cyber and physical security exercise called
    GridEx.
        Over 4,000 participants from industry and government
    organizations across North America engage for two days in a
    very severe massive cyber and physical attack on our grid. The
    exercise includes a tabletop which industry CEOs and senior
    government officials coordinate a national response including
    communications, deployment of resources, cyber mutual
    assistance, and other strategies.
        To date, there has not been a single cyber-attack in North
    America that has resulted in a power outage to a customer. This
    is an exceptional record. However, we will never be complacent.
    We understand the risk is real. We have hard work to do every
    day and we will continue to do that.
        I thank the Committee for the time today and look forward
    to your questions. Thank you.
        [The statement of Mr. Cauley follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Upton. Thank you.
        Mr. Aaronson.

                     STATEMENT OF SCOTT I. AARONSON

        Mr. Aaronson. Thank you, Chairman Upton, Ranking Member
    Rush, and members of the subcommittee. I am glad to be here
    today to discuss the security of the power grid. We appreciate
    you holding this important hearing and making it a priority for
    the subcommittee.
        As owners and operators of some of the nation's most
    critical infrastructure, we share your commitment to ensuring
    the grid is secure and resilient.
        From some of the headlines and movie script scenarios out
    there you may be left with the impression that a month's-long
    power outage is inevitable and the power sector is powerless to
    do anything about it.
        If there is one thing you take from my testimony it is
    this: Our industry is doing an extraordinary amount of work at
    all levels all the time to defend the grid and to respond to
    incidents.
        You have to remember we live and work in the communities
    that we serve and our infrastructure is our most important
    asset. We are motivated for many reasons to make security a
    major priority.
        Since these topics can be sensitive and, as was mentioned,
    sometimes classified, we may not talk about them a lot in
    public, but don't take that as complacency or a lack of action.
        My written testimony has more extensive details on how
    electric companies address threats so I won't read it to you.
    But, instead, I'd like to quickly focus on three areas that
    form the foundation for how the electric power industry
    approaches security.
        It's three legs of the stool, effectively. So the first leg
    of the stool is standards. The electric industry has mandatory
    and enforceable critical infrastructure protections, or CIP,
    regulatory standards for both cyber and physical security that
    Mr. Cauley just mentioned.
        These are not lax lowest common denominator standards.
    These are rigorous requirements that improve the industry's
    security posture.
        Failure to comply can cost companies more than a million
    dollars per infraction per day. So, suffice it to say,
    companies feel a strong incentive to comply.
        But compliance does not equal total security. So that
    brings me to the next leg of the stool, which is partnerships.
    Protection of critical infrastructure is a shared
    responsibility.
        In order to be prepared for an ever-changing threat
    environment, industry and government are partnering at an
    extremely high level. In addition to my role at EEI, I am also
    privileged to serve on the secretariat of the Electricity
    Subsector Coordinating Council, or ESCC. The ESCC is made up of
    all three segments of the industry as well as Canadians and
    independent power generators, the nuclear sector as well as the
    gas sector.
        It is made up of 31 CEOs from across the segments of the
    industry. Those CEOs meet regularly with senior government
    officials not to simply update each other but to set a
    strategic course that has helped the sector make extraordinary
    advances in grid security in a very short amount of time by
    bringing together government-industry executive leadership.
        It's also been recognized by the National Infrastructure
    Advisory Council, which advises the executive office of the
    president as the model for how critical infrastructure sectors
    can partner with government.
        So the ESCC focuses on four specific areas. The first is
    deploying tools and technology. The focus here has been moving
    government-developed tools to industry applications that
    improve situational awareness. And, again, Mr. Cauley mentioned
    the best example of this, the Cyber Risk Information Sharing
    Program, or CRISP.
        The second focus for the ESCC has been improving the flow
    of information. That is making sure the right people are
    getting the right information at the right time.
        From classified briefings for executives to actual
    intelligence for operators, government and industry are sharing
    threat information more easily and more often, and some of that
    has to do with some of the legislation that has been passed by
    committees like this to make information sharing more seamless
    between the public and private sectors.
        The third thing that we are doing in the ESCC is
    coordinating with other sectors. While electricity is often
    described as the most critical to critical, if we don't have
    water, we can't generate steam or cool our systems. If we don't
    have transportation or pipelines, we can't move fuel or our
    equipment. If we don't have communications, we can't operate.
        So to address interdependencies, the power sector is
    working across sectors, and most recently we are pursuing a
    partnership with the financial services and communication
    sectors to form a Strategic Infrastructure Coordinating
    Council, or SICC, that follows the model of the ESCC by
    bringing senior executives together to form a center of gravity
    that will help harmonize people, policies, and technologies
    across the sectors that form the foundation of civil society.
        Then the last area of focus for the ESCC also happens to be
    the third leg of the stool. So we have got regulations, we have
    got partnerships, and then we are preparing to respond and
    recover from incidents if there were ever a successful attack.
    Simply put, electric companies have to be right 100 percent of
    the time and the adversary has to be right once.
        Given those odds, preparing for incidents is just common
    sense. First of all, we have a history of working together to
    restore power after an incident through mutual assistant
    networks where workers from across the sector help affected
    companies.
        We also have a robust spare equipment sharing program
    including several bilateral and multilateral arrangements, one
    of them known as the Spare Transformer Equipment Program, or
    STEP.
        We exercise regularly, as Mr. Cauley noted. NERC's GridEx
    series brings together thousands of operators and executives
    from across North America in the largest exercise of its kind,
    and we now are developing a cyber mutual assistance program to
    coordinate industry resources for companies affected by cyber
    incidents.
        As an example of how quickly the sector can implement new
    strategies under the ESCC, the CMA program was conceived in
    January of 2016, just about a year ago, following GridEx III
    and the 2015 cyber-attack on Ukraine's energy grid.
        In just the last year, this program went from a concept
    suggested by the CEOs of the ESCC to a program that currently
    has more than 80 participants and growing almost daily, a legal
    structure, a play book that has been exercised and even
    utilized in response to the Mirai botnet that affected internet
    services this past October.
        Bottom line is this: We are constantly working to manage
    risk, but also planning to address incidents because we
    understand we can't fully eliminate risk.
        There isn't enough money in the world to protect against
    every threat in every location, but we are working to prevent
    incidents from having long-term or devastating impacts.
        We understand that the service we provide is critical to
    the life, health, and safety of all Americans. From CEOs to
    operators, the power sector has shown it takes this
    responsibility very seriously and is committed to constantly
    improving its security posture as these threats evolve.
        Again, I appreciate the opportunity to be here and look
    forward to answering your questions.
        [The statement of Mr. Aaronson follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Upton. Thank you very much.
        Dr. Beck.

                        STATEMENT OF CHRIS BECK

        Dr. Beck. Chairman Upton, Ranking Member Rush and members
    of the subcommittee, thank you for the opportunity to testify
    before you today on this important topic.
        EIS Council, a 501(c)(3) nonprofit, is, at its core, a
    public interest organization. Our chief mission is to do our
    part to ensure societal continuity for black sky hazards by
    hosting research and national and international collaboration
    focused on whole community resilience, response, and
    restoration planning.
        Black sky is increasingly becoming a term of art referring
    to threats that could cause extended and long-duration power
    outages covering many states and lasting more than a month, and
    the subsequent cascading failures of our other critical
    infrastructures.
        Six black sky threats have been identified as primary
    concerns. Three are naturally occurring and three are
    malicious, including a sophisticated cyber-attack--the subject
    of today's hearing.
        The Ukrainian cyber-attack demonstrated that a blackout of
    electric power can be achieved through remote cyber means.
    Stuxnet and Aurora demonstrate that catastrophic damage to
    physical equipment can be accomplished through cyber-attack
    vectors on operational technology or industrial control
    systems, causing disruption, misoperation, or destruction of
    the hardware they control.
        The successful coupling of these two components could
    result in a black sky event. This would be the case if the
    damaged equipment were critical to grid operation and required
    a long period of time to repair or replace.
        It would also be the case if the disruption pushes
    restoration times past the point where cascading failures of
    other infrastructures began interfering with the restoration
    process.
        In the aftermath of a natural disaster, response activities
    typically commence once the immediate danger has passed. In a
    cyber-attack scenario, it is possible or even likely that the
    attacker could launch subsequent attacks to disrupt response
    and recovery efforts or cause further damage.
        At the same time that the cyber threat is constantly
    evolving, the attack surface continues to grow with the ever-
    growing trend to computerize and allow remote access and
    control.
        An adversary may also infiltrate a utility not through a
    direct attack on the utility system itself, but through a
    trusted, maybe less secure third party connection, or by
    inserting malware into critical hardware or software at several
    points along that product's production life cycle.
        Leading power utilities have taken positive action along
    the cyber-attack threat timeline or kill chain though there is
    certainly a large spread between the capabilities within the
    power utilities.
        Electric utilities also have a long history of providing
    mutual assistance, and the same concept is being applied by the
    ESCC for mutual support in response to cyber incidents though
    challenges unique to cyber must be taken into account.
        Operational technology systems in particular vary greatly
    from utility to utility. IT and OT professionals are typically
    a limited resource.
        In a large enough attack, availability of such expertise
    will likely be too limited to address the need, and CEOs may be
    reluctant to flow personnel to assist others when they might be
    the next target themselves.
        To bolster electric sector mutual support, external support
    is also necessary. Government support for utilities is
    available at the federal and state levels. ICS-CERT and E-ISAC
    provide operational support and information sharing.
        A DOD USCYBERCOM may provide assistance through defense
    support to civil authority missions. DOE is the federal agency
    for emergency support function 12 for federal support to energy
    restoration, and the FAST Act provisions now provide broad
    authority under a grid security emergency declaration by the
    President.
        At the state level, National Guard units may assist
    electric utilities and state fusion centers in sharing
    information and including electric utilities in emergency
    planning and operations.
        These support options, however, might be overwhelmed by the
    scale of the attack. Another possibility would be expanding the
    concept of mutual assistance to bring IT and OT professionals
    from other private sectors including information technology,
    aerospace, water and waste water, telecommunications,
    manufacturing, and others.
        EIS Council is facilitating a process to explore this
    opportunity. Power grid restoration following a successful
    black sky cyber-attack will only be possible if broad multi-
    sector planning is in place for cross-sector support to that
    restoration process.
        Those plans must be continuously tested and improved
    through exercises such as GridEx and through training within
    each utility and across sectors. Cyber security enhancements
    ultimately require focused private and public sector
    leadership.
        When the CEO of a company takes security and resilience
    seriously, the company develops a culture of security and
    resilience. Inclusion of security and, specifically, cyber
    security principles in planning for expansion, equipment
    replacement and employee training are all essential to enhanced
    cyber security in the electric power sector.
        I thank you very much and look forward to your questions.
        [The statement of Dr. Beck follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Upton. Thank you.
        Ms. Sugg.

                       STATEMENT OF BARBARA SUGG

        Ms. Sugg. Good morning, Chairman Upton, Ranking Member Rush
    and all members of the Energy Subcommittee.
        My name is Barbara Sugg. I am the Vice President of
    Information Technology and Chief Security Officer at Southwest
    Power Pool, which is headquartered in Little Rock, Arkansas.
        Southwest Power Pool is one of the nine independent system
    operators and regional transmission organizations--the term
    ISO/RTO will be used henceforth--in North America.
        Collectively, these nine organizations serve two-thirds of
    the energy consumers in the United States and half in Canada.
    We are nonprofit organizations. We do not own generating plants
    or operate generating plant substations or transmission
    facilities.
        However, we do provide a number of various services from
    reliability coordination and balancing authority functions to
    transmission planning for future expansion of the transmission
    grid.
        We all have the common goal of ensuring sustainable,
    affordable, and reliable power with our wholesale energy
    markets.
        I am here today on behalf of the ISO/RTO Council, known as
    the IRC. The IRC has an executive committee, which includes the
    CEOs from each of these nine organizations and is made up of a
    number of committees and working groups focused on different
    areas of interest to the ISO/RTO community.
        I serve as a member of the IT committee, which brings
    together the chief information officers from each of those nine
    organizations, where we come together to share best practices,
    to collaborate on common interests, and to work on directives
    that may come from the executive committee.
        One of the working groups that reports to us is the
    security working group. With this security working group, which
    has been in place for a very long time now, there are security
    experts that come together from each of our regions to share
    best practices, to work on incident response planning, and to
    understand our dependencies with each other.
        Cybersecurity is a top concern at the ISO/RTO. As Ranking
    Member Rush said earlier, it's not a matter of if but when, and
    we recognize that.
        We have five core strategies to our cybersecurity
    framework. One of those is defense. Certainly, we have to be
    prepared to defend against attack. We do this through controls,
    through multiple layers of security and good practices to
    ensure that we stand ready to defend.
        The next is response. From advanced security monitoring and
    practicing incident response plans we stand ready to respond.
    And the third is recovery. You've heard us mention about the
    GridEx opportunities to practice our recovery drills.
        We do those every other year in a nationwide effort but we
    also do local, state, and regional exercises much more
    frequently to ensure that our recovery plans are ready to go.
        Partnership is the fourth key element of our strategy and
    these gentlemen talked a lot about all the of the information-
    sharing opportunities and the various government agencies that
    work with us to collaborate and provide cyber assistance.
        The fifth is education. We recognize the importance of
    every single ISO/RTO employee when it comes to protecting our
    systems and protecting our information, and so security
    awareness is high on our list.
        Over 10 years ago, the CIP standards to critical
    infrastructure protection standards came out. They've advanced
    quite a bit over the last decade and they serve as a base level
    of security for us.
        However, we have to get beyond the standards and recognize
    that a culture of compliance is important but even more so
    important is a culture of security.
        We look beyond the standards in a number of ways from
    developing, in advance of standards, security coding
    requirements for our control system vendors. And when I say we
    I am talking about the entire ISO/RTO community working
    together to make sure that we are equally protected.
        We have worked with the FERC energy infrastructure security
    office to do security architecture reviews, and to look for
    best practices and talk about evolving threats and current
    technologies.
        It's very difficult for the standards to keep up with the
    evolving threats and so we must look beyond that. It's also
    difficult with emerging technologies.
        Standards shouldn't be so prescriptive that they limit us
    in our capability to develop new infrastructure and new
    architecture. And we work very closely with NERC and the rest
    of the community to ensure that those standards are secure
    enough for us without being overly prescriptive and limiting
    our capabilities to keep up with the evolving threats.
        I thank you for your time this morning and I look forward
    to answering your questions.
        [The statement of Ms. Sugg follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Upton. Well, thank you all.
        I think each of you mentioned that it is a daunting task.
    When you look at the power grid, 7,700 operating power plants
    that generate electricity from a variety of primary energy
    sources, 200,000 miles of high-voltage transmission lines,
    55,000 substations, five-and-a-half million miles of local
    distribution lines.
        I think each of you mentioned that you have to be right
    every day. They just have to be right once for a catastrophe to
    happen. And as we all know, we passed, on a bipartisan basis,
    the FAST Act in the last Congress.
        Tell us how that has helped you on a bipartisan basis. Tell
    us specifically, Mr. Cauley and Mr. Aaronson, how has that
    helped protect consumers?
        Mr. Cauley. Well, thank you very much for the question, Mr.
    Chairman.
        Two ways for me in particular. One is there was a lack of
    clarity around emergency authorities and I think providing
    those emergency authorities to the Department of Energy under
    an emergency declared by the President was helpful.
        I testified a number of times in the past about that
    potential gap. I think the other thing that's extremely
    valuable to us and to consumers is it provided for greater
    protections of cybersecurity information.
        It's very important that as companies report to us details
    that border on being classified, if not classified, that we are
    able to maintain the confidences and keep that secure.
    Particularly, allowing FERC to have procedures to secure
    information which we frequently exchange with them, but other
    controls around maintaining those confidences.
        Mr. Upton. Mr. Aaronson.
        Mr. Aaronson. Echoing some of the things that Mr. Cauley
    just said, agree. And then in addition, I think it really
    speaks to the value of the partnership at a very high level,
    providing the Secretary of Energy, who oversees our sector-
    specific agency with some authorities in the midst of a grid
    security emergency, which was very well defined in the FAST
    Act.
        Further, it sort of solidifies that relationship in the
    midst of an incident. And the fact that it calls for
    coordination with the sector--where practicable--during such
    emergency ensures that the Secretary would be well informed on
    what to order.
        We are in the process of responding to the notice of
    proposed rulemaking from the Department of Energy that would
    outline some of the processes for how this authority would be
    used and we look forward to continuing that conversation. The
    joke has come up--there isn't one phone number you can call,
    the Batphone, for the electric sector.
        So having a understanding of who would need to be
    coordinated with and contacted in the midst of such emergency
    is going to be a challenge.
        But, again, with the Sector Coordinating Council playing
    that role as a center of gravity with the ISO/RTO Council and
    other partners throughout the sector it gives us a good, high
    level set of entities to coordinate with should the unthinkable
    happen.
        Mr. Upton. Mr. Cauley, you talked a little bit in your
    testimony about the tabletop exercise. Can you elaborate a
    little bit more?
        The other thing I want to hear particularly, Mr. Aaronson,
    from you, as it relates to that, and I presume that you were
    involved, the STEP program.
        One of the concerns that a number of us have raised is if
    there was some issue where a transformer was taken down because
    of the lack of uniformity between a variety of different units
    that may be taken out of business. How long would it actually
    take to get new transformers into place and the mechanism that
    that would go about it?
        I presume that that was probably one of the issues that was
    engaged in a tabletop exercise that you had.
        Mr. Cauley. The exercise in preparing for our fourth, now
    in November of this year, have intentionally gotten
    progressively more difficult and challenging to overcome, and
    the pattern is we build capability, we learn what we learn, and
    we get better each time.
        I think as we run the exercise in a way that's two days and
    that it's companies distributed across the U.S. and Canada
    participate locally in their state and local environment using
    their operating systems and people. People actually run out to
    stations.
        They call the FBI. They actually do it on the ground. Then
    there is a central exercise that we look at at the executive
    level with the top levels of government, and we have had FEMA,
    DHS, White House representatives and others.
        Mr. Upton. Are the results of that in a classified setting?
        Mr. Cauley. There is a public report for each of the
    exercises. What we found is that when we propose an exercise
    that destroys equipment, explosions, deaths, where the power
    could be out for weeks and potentially months, it really
    exceeds the capabilities that we have anticipated in the past,
    not just industry, but government. We never thought of it that
    way.
        We have to think differently in terms of unity of effort,
    how do we unite around these capabilities and bring the best of
    industry, best of government to overcome those situations.
        Mr. Upton. I know my time is expired, but I have one quick
    question on that. Were the governors engaged in this tabletop
    exercise?
        Mr. Cauley. We anticipate expanding that in GridEx IV in
    November but, yes, there were representatives from National
    Guard. The state of Wisconsin, I believe, was represented. And
    so we did engage some state-level representation at the table.
        But, obviously, we need to bring in a lot of state-level
    activity. A lot of the solution, in my mind, is going to be how
    do we handle the public situation and the issues on the ground
    during a crisis. And that really involves local and state
    governments to support it.
        Mr. Upton. And Mr. Aaronson, just quickly to respond on the
    STEP program.
        Mr. Aaronson. So I appreciate you asked that. In addition
    to STEP, let me kind of go through a few of the resiliency
    programs.
        This goes to some of the things Gerry was just talking
    about with respect to having an exercise, understanding where
    your vulnerabilities are, and then implementing some solutions
    to fill those gaps.
        In addition to this Spare Transformer Equipment Program
    which grew up about 10 years ago, a little bit more than that,
    that is a binding relationship between the companies that are a
    part of it.
        In the event of a presidentially-declared terrorist
    incident, there is a contractual obligation to share equipment
    during such incident. That's a really high bar.
        Fortunately, STEP has been utilized beyond just in
    presidentially-declared terrorist activities but to be able to
    move these really important components that form the backbone
    of the system.
        In addition to STEP and its rigorous approach to Spare
    equipment, we also have something called SpareConnect, which is
    effectively a database of asset owners and asset managers for
    companies.
        If I am a company that has been impacted by something and I
    need to get one of these high-voltage transformers in place, I
    can create a bilateral agreement, call the person who has the
    equipment that I need, make an arrangement, and have it moved
    into place.
        There also are industry-led versions of this, something
    called Grid Assurance that has stood up. Again, companies come
    together to pool resources and a new program called Restore,
    which is a regional approach, along the same lines.
        Last thing I'll say about this is having the equipment is
    one thing. Moving it is another. These things are quite
    literally hundreds of thousands of pounds and very hard to
    move. It has required us to work with other sectors, again,
    going to interdependencies across sectors, but rail and
    trucking in particular and then the riggers who actually get it
    onto the rail car, move it into place and then go the last mile
    to bring it to the location.
        We have both worked with the rail industry and exercised it
    through something called the Transformer Transportation Working
    Group. So, again, lessons learned from all of these incidents
    have really informed industry programs that are making us more
    resilient and more able to move equipment to where it's needed.
        Mr. Upton. Sorry it took so long. Thank you.
        Mr. Rush.
        Mr. Rush. I want to thank you, Mr. Chairman.
        I want to touch on an area that we have been silent on--
    this hearing's been silent on so far and that's the area of the
    cybersecurity workforce.
        I think that's a very critical concern on the plans or the
    technology--on the well-intentioned efforts of many of us we
    have come to know and we don't have a sufficient, capable, and
    expert workforce.
        According to the IEEE, there are a million unfilled
    cybersecurity engineering jobs around the world with that
    number expected to grow by 1.5 million by 2019. In the U.S.
    alone there are only 67 job seekers for every 100 open
    cybersecurity positions.
        I am wondering if this shortage of available workers is
    posing problems for electric companies seeking to fill
    cybersecurity jobs that protect our electricity grid.
        Mr. Aaronson, can you talk about the current situation in
    the electricity sector as it relates to cybersecurity jobs and
    is it indeed true that companies are finding it difficult to
    find and hire skilled workers to fill these positions?
        Mr. Aaronson. So I think this is a refrain that you'll
    hear, and I am sure there is others on the panel who have some
    experience actually trying to fill these positions.
        I will say I've heard from my membership and across the
    sector that this is a challenge. There are a lot of needs and
    not a lot of people to fill it.
        This is something that's going to require a long-term
    concerted effort starting with STEM education and moving up to
    attracting a workforce to this particular critical
    infrastructure industry.
        I will say a couple of things. EEI in particular has a
    program known as Troops to Energy, and that helps to take
    people who have served in the military who have excellent skill
    sets and really do lend themselves to being a part of a
    critical infrastructure industry.
        So there is attraction there. There is also attraction
    among cyber workforce and cyber experts. This is a pretty cool
    industry to be in. You are the most critical infrastructure
    sector and we are quite literally defending against adversaries
    from near pure nation states all the way down to sort of the
    traditional proverbial hacker kid in his mom's basement.
        Having that opportunity is something that is attractive but
    it doesn't change the fact that we need to generate more of
    these people.
        Mr. Rush. Ms. Sugg, would you want to add anything
    additionally?
        Ms. Sugg. That's a great question and an interesting topic.
    I don't find that we are having as much trouble filling those
    kinds of positions because we are working with the
    universities.
        STEM education is a big focus for us as well. At the
    university level we are working with a number of them on their
    curriculums, and what's interesting is the Millenials are
    particularly skilled at this.
        This is new technology. It's evolving threats and it's
    something that the Millenials find really exciting and some of
    our most innovative thinkers, which is really what you need to
    think outside of the box on security, are coming out of the
    universities.
        There are a number of opportunities for experienced
    employees to get education and certifications in cybersecurity
    areas.
        So that's been helpful as well and it is something people
    that have worked in other areas find interesting and perhaps
    want to change their careers because it is ever changing and
    good employees love a good challenge.
        The universities are producing some really skilled
    graduates that challenge our way of thinking about security in
    a very healthy way.
        Mr. Rush. Is there a role for the federal government in
    terms of increasing the quality and quantity of the
    cybersecurity workforce?
        Ms. Sugg. I think there is an opportunity for the federal
    government to challenge the universities to think more broadly
    about the different types of cybersecurity in areas and sectors
    that are perhaps less secure, such as the internet, and maybe
    there are opportunities to fund research toward developing a
    more secure internet and that would be something that would be
    very interesting at the academic level.
        Mr. Rush. I want to thank you, Mr. Chairman. I yield back.
        Mr. Upton. Thank you. The chair would like to recognize the
    chairman of the full committee, Mr. Walden, for 5 minutes.
        Mr. Walden. I thank the chair and thank our witnesses again
    for your testimony and your counsel.
        I listen to this and I think about your tests. I was in the
    radio business. We would do these emergency alert tests and
    drills from time to time, and we had one of these. You were
    talking about how you go out to the substation, you call the
    FBI, you do all that. We got the call into the radio station to
    announce that Bonneville Dam, one of the major dams crossing
    the Columbia River, and we were supposed to announce on air had
    been breached.
        Fortunately, I had a sort of retired announcer working that
    Saturday morning who said, ``I think it's probably not a good
    idea to actually go on the air and tell people that one of the
    Columbia River dams has been breached, but we will make a note
    here.''
        So you have to be careful when you do these exercises, but
    they are really important because emergencies do happen. I
    think back to what happened during Hurricane Katrina and how
    rapidly things disintegrated when there was no power. Because
    then there is no water, there is no sewage, there is no
    refrigeration. The ATMs don't work.
        I talked earlier about how we are all connected to these
    digital devices. You can't talk to your loved ones. You can't
    make emergency calls. So the work you're doing to push this and
    test this is really important.
        I know many of us have been in both classified and
    unclassified briefings on this matter about the reliability of
    the grid and the threats that are there. We are very cognizant
    of the cyber security issues, and the attempts by others to put
    hardware into our systems that have vulnerabilities in it, and
    to harness the internet of things to be a swarming attacking
    machine, basically.
        When you analyze the systems that are there, and I don't
    mean the hardware systems--I mean the human systems to
    communicate and interact--what are we missing? What are you
    finding we need to improve on?
        Are you hamstrung by certain laws, too? We did six
    hearings, I think, on our telecommunications subcommittee on
    this topic of cybersecurity. Every witness on every panel said
    please do no harm.
        If you lock things in statute in terms of technology the
    bad guys will know what we have to do and you'll misallocate
    our capital. Are there things like that locked in that we
    should review, either in a public setting or in a more secure
    setting?
        We want to make sure we have a reliable grid that can
    withstand any kind of issue whether it's a solar flare or a bad
    actor. What are we missing here? Or is it all perfect?
        Mr. Cauley. Well, I'll just start the response. I think a
    lot of the framework that we have is really good. I think the
    idea of the industry participating in a standard setting and
    the standards being really focused on being adaptive and sort
    of driving solutions I think works.
        So I think continuing to engage industry experts and
    leaders, and the process that we have to Section 215 in FERC
    and NERC I think is very helpful.
        There are some challenges that are difficult. Most of the
    challenges that we face are not limited to the electric system
    and I think, once we start talking about the kinds of
    existential threats that we are thinking about here, revolving
    a broad sweep of telecommunications and other industries,
    finance and others, I don't ever expect there is going to be an
    attack that's just only on the grid.
        So I think the ability to work cross sector and to engage
    multiple sectors together in a conversation and leadership is
    very helpful. I think we are challenged with supply chain and
    sort of the global picture that everything that we get and use
    from the system that's digital is coming from somewhere in the
    world is a challenge.
        And the final thing I would say that we need to continue to
    work on together is strategic reserves around essential
    equipment and the ability to deploy that in a severe emergency.
        Mr. Walden. By the way, a side question--do you involve the
    amateur radio community in your emergency drills at all? I
    confess, I am one. But it also is a very dispersed--it's like
    the original internet, right?
        Mr. Cauley. We have not particularly sought after that, but
    I know Dr. Beck and his crew at EIS has had some work around
    the use of ham operators for emergencies.
        Mr. Walden. Yes, they are the only communication tool left.
    But go ahead, Mr. Aaronson.
        Mr. Aaronson. So a philosophical question but I won't give
    a philosophical answer. I think the culture issue around, and
    you alluded to it, that people are very much tethered to their
    devices and very much reliant on this.
        We have found, even in storms, while the industry has
    gotten considerably better at restoring more quickly, if you do
    a good job of preparing the general public ahead of time power
    will be out for a short period of time. This is what's going on
    to restore it, I think helping people understand that it may
    not just be storms anymore but there are other sorts of threats
    whether cyber or physical or otherwise that may have an impact,
    and if they can be prepared and they understand that we are
    preparing I do think there is a really important public policy
    and public communication role that the Congress and federal
    policy makers in general can play.
        I'd also say just from cultural perspective, there has been
    this tendency to blame the victim when incidents do happen on
    critical infrastructure operators. Look at Sony, look at
    Target.
        Changing that dynamic a little bit so that people recognize
    when you're talking about very sophisticated threat actors and
    near pure nation states who are targeting critical
    infrastructure, and I think, again, if people recognize there
    is a partnership between industry and government, that we are
    working on this, that we are heartening our systems, that we
    are more resilient, I think that can go a long way.
        One last quick note, I would say this, and you alluded to
    it a bit, this reliance on a culture of compliance. Security
    can never be a check the box exercise, ``OK, I've done X, Y,
    and Z and therefore I am secure.''
        No. Actually, it's the opposite. You are complacent and,
    again, going back to culture, I think helping people understand
    that this is a journey without a destination, but it is one
    that we are all on, will help to prepare your constituents, our
    customers, for the new world that we live in.
        Dr. Beck. I would say, going to Scott's point about the
    social aspect, to your question, Chairman Walden, that I don't
    see any regulation currently that's hamstrung the efforts, but
    they are challenged by two social structures: stovepipes and
    tunnels.
        Stovepipes we are more familiar with and those have to do
    with, for example, government agencies that can be one
    stovepipe or infrastructure sectors that we need to work on
    getting more discussion through those stovepipes or those
    silos.
        But the other one is tunnels, and what I mean by that is
    there is communication and common understanding at specific
    levels of decision making. So CEOs understand each other and
    they have a certain view of a situation.
        The engineers that work on cybersecurity have a different
    understanding of it. The CFOs, et cetera, and so we need to
    look at all of those, breaking down basically both silos and
    tunnels so that there is a common operating picture and
    mission.
        Ms. Sugg. There has been a lot of comments here that I
    could echo and I'll save the time on that. Innovation is
    important. Working together through the ISACs, through multi-
    disciplined ISACs are important.
        Continuing to work closely with the Edison Institute. Their
    work is phenomenal and is benefitting the entire industry. And
    through NERC to evaluate what's coming out of the government
    and how do we best prepare ourselves within the framework.
        I agree about it's important not to vilify the company that
    does indeed get breached because we will all learn from it.
    Someone else's detection is everyone else's prevention. So
    thank you.
        Mr. Upton. Mr. McNerney.
        Mr. McNerney. Well, I thank the chairman and I am going to
    follow up on one of your questions with Mr. Aaronson.
        Do you think that transformer standards would help reduce
    the threat of transformer attack or do we need a strategic
    reserve of some kind?
        Mr. Aaronson. So I think as you know the electric grid grew
    up in fits and starts over, quite literally, the better part of
    a century and as a result there are these different voltage
    classes and sort of a mishmash of equipment across the sector.
        Interestingly, that's not necessarily a bad thing. It does
    create some biodiversity, which in and of itself is a
    protection mechanism.
        So I think standardization within reason may be something
    worth at least exploring. With respect to a strategic reserve,
    I think this is one of those instances where government and
    industry have to be aligned.
        Industry, as I mentioned, has the Spare Transformer
    Equipment Program, has SpareConnect, has Grid Assurance, has
    Restore, has these other bilateral arrangements and
    multilateral arrangements across the sector.
        Those are really useful and have grown up out of necessity
    and have been utilized. To the extent that there are
    opportunities for the federal government to provide additional
    backstop, additional spare equipment, not just limited
    transformers but are many other critical components and support
    for moving them. Filling the gaps that the industry observes, I
    think that's a useful pursuit.
        Mr. McNerney. Thank you.
        Mr. Cauley, do you feel that the trend toward distributed
    generation makes our electric system less or more vulnerable to
    cyber-attacks?
        Mr. Cauley. Well, it's a great challenge and a great
    dilemma that we face in front of us. In some respects it
    creates a system that's more resilient because there is more
    resources and capabilities that are more distributed, and there
    are greater redundancies in the system and I think it enhances
    reliability and resilience.
        The challenge is that all those devices are going to be
    communicating with something else and in some cases they are
    much closer to the internet than the bulk power grid.
        So it's going to create a much greater surface to attack
    and can create multipliers in the attack where you have common
    devices that are out there. Instead of there being three
    breakers of a certain model, there are 1.5 million devices that
    are exactly the same and can be simultaneously hacked.
        So it goes both ways and I am deeply concerned that we
    continue to focus on the distribution side in terms of getting
    security right and getting it built into those systems.
        Mr. McNerney. Thank you.
        Ms. Sugg, how effective would cyber hygiene, education, and
    enforcement be in preventing successful cyber-attacks?
        Ms. Sugg. Cyber education is extremely important. Security
    awareness is important. We cover everything in our training and
    education from how to ensure that you don't click on e-mails on
    to how to recognize an event within the systems at any given
    time using some of our advanced security monitoring.
        That awareness is required as part of the standards, which
    I think is a very healthy requirement for us. But we don't just
    limit that to the people that work within the scope of the
    critical infrastructure.
        We expand that awareness and education to all of our
    employees, recognizing that each of them has an opportunity and
    a responsibility to help us protect all of our systems.
        Mr. McNerney. Thank you.
        Mr. Beck, with the internet of things are there concerns
    about potential cyber threats from systems that are already in
    place but we haven't seen incidents yet?
        Dr. Beck. Certainly, the question is the continued
    expansion of the internet of things or even going back to your
    question of Mr. Cauley about distributed generation.
        As things are introduced and connected into the grid, what
    is an important practice is, if we are going to try to stay
    ahead of the threat, to have it be a part of design philosophy
    when new devices or processes are put in place.
        We don't want to connect things and then say oh, gosh, we
    forgot about cybersecurity--now we have got to do a bunch of
    patches and things. Again, it's more of a social issue of
    trying to get security practices baked in to new development as
    we go forward, and we can grow your way to greater security
    because the grid is always expanding, things are always being
    updated and replaced by new equipment, better processes and so
    on. And if that new equipment and better process includes
    security as a baseline feature of its design and
    implementation, we will be safer.
        Mr. McNerney. Well, I've been involved in standards
    committees and I know how slow and deliberate they are. Are
    standards able to keep up with the threat in terms--even
    actually the definition of what cybersecurity and threats mean?
        Mr. Cauley. Well, I think they certainly help provide a
    baseline even as the topic was just about distributed systems
    and internet of things.
        IEEE and other technical equipment standard-setting
    organizations could have standards built in to make those
    devices more equipment. The tendency to selling to consumers is
    to make them as easy as possible to plug in and set up, and
    that really creates a difficulty.
        So I think there is room for standards to set the baseline
    in terms of how protected individual equipment should be.
        Mr. Aaronson. If I could just piggyback on that. I think
    the answer is yes, but standards have a role.
        They cannot completely keep up with a very dynamic threat,
    and I wanted to just weigh in really quickly on the question
    about distributed resources.
        I think Mr. Cauley hit it on the head. It's sort of a
    paradox. There is some resilience that can be brought from
    distributed resources, but it broadened the attack surface and,
    largely, these are consumer-grade electronic devices that do
    not have the same security standards, to bring it back to that
    question that may be necessary.
        Another challenge is visibility from the operators of the
    grid into these distributed resources. It's a misnomer to think
    these distributed resources are not connected to the grid.
        In fact, they have to be. Having a rooftop solar panel if
    it's not connected to the grid is like having a computer not
    connected to the internet. You need to be a part of that
    broader ecosystem.
        So ensuring that there is security baked in, not bolted on
    to those pieces, and that the owners-operators have visibility
    into the power that's being generated is going to be critical
    to ensure reliability and resilience for the rest of the
    sector.
        Mr. McNerney. Thank you.
        Mr. Chairman, I yield.
        Mr. Olson. Gentleman's time is expired.
        The chair calls upon the Vice Chairman of the full
    committee, Mr. Barton from Texas, for 5 minutes.
        Mr. Barton. Thank you, Mr. Chairman, and I apologize for
    not being here at the beginning.
        I had, as some of the others, the hearing on the Medicaid
    program in the Health Subcommittee downstairs. So I am honored
    to be a part of this subcommittee also.
        I want to recognize former Congressman Ross out in the
    audience, a valuable member of this committee in the past, and
    I think probably the subcommittee, and you're looking very
    happy being a former member. So we are glad to have you.
        The purpose of the hearing today, Mr. Chairman, as you well
    know, is to discuss what we are doing and look at trying to
    protect our electrical grid from the threat of cybersecurity
    problems.
        We have the president of the organization responsible for
    protecting us, Mr. Cauley. So I am going to ask the other three
    witnesses, Mr. Aaronson, Dr. Beck and Ms. Sugg.
        Ms. Sugg, what kind of a job do you think he's doing. Is he
    doing a good job? A bad job? What do we need to do to encourage
    him?
        Mr. Aaronson. And I am not saying this just because he is
    sitting right next to me, but I think he's doing an
    extraordinary job and I think that the North American
    Electrical Reliability Corporation serves an exceedingly
    important role as the electrical reliability organization as
    directed by this committee and Congress through the Federal
    Power Act.
        It is a challenge to be sure, but I do think the role that
    they play between a regulatory body that is pushing standards
    and, regulators regulate--that's their responsibility. But also
    then to organize the industry and ensure that the engineers and
    grid operators have a voice in the standards that have to be
    developed for reliability of the system to make sure that these
    standards: number one, keep up with technology; number two, are
    flexible enough, as Ms. Sugg referenced, and that they can
    apply to the smallest of the utilities--and the largest
    investor-owned utilities in the nation is a challenge but one
    that I think Gerry can pass.
        Mr. Barton. You give him an A?
        Mr. Aaronson. I'll give him an A.
        Mr. Barton. Dr. Beck.
        Dr. Beck. I'll second that, and I want to say that I
    appreciate that Mr. Cauley has been a support for EIS Council
    and that we have appreciated the fact that we have been able to
    have discussions with NERC regarding our shared areas of
    interest and he certainly didn't have to do that.
        But we discovered that focusing on what we consider
    outside, and beyond just the professional realm of regulating
    the electric reliability, is fundamentally we are all
    interested in the security of our families and our fellow
    citizens and the nation as a whole, and I think that our shared
    commitment in that has allowed us to work together to share
    ideas and we appreciate that partnership.
        Mr. Barton. OK. Ms. Sugg.
        Ms. Sugg. We appreciate the partnership with NERC as well.
    Our experience is that NERC is very collaborative. They listen.
    They ask a lot of questions.
        They hold us accountable for standards but more so, and
    I've heard Mr. Cauley mention this numerous times in other
    arenas, that it's more important to focus on security and to
    shift that focus from just being focused on or worried about
    being compliant to being secure.
        The standards drafting teams that are led by NERC that pull
    together industry experts to develop the standards, to really
    understand how best to put a standard in place that doesn't
    become overly restrictive, is very healthy for the industry.
        And I also find that NERC is receptive to understanding or
    hearing additional conversation about standards that do exist
    that are already in place. Not just standards that need to be
    developed, but to understand the challenges that we have with
    them and ensure that they stay as robust as possible without
    limiting us in our technologies. I give him an A.
        Mr. Barton. It's very rare that Congress does something
    that, this system came from the Energy Policy Act of 2005,
    which I was chairman of the committee and the chairman of the
    conference committee. So I guess I'll pat myself on the back.
        But I am going to give you the final word, Mr. Cauley.
    You've just gotten three As. That's a pretty good report card.
        Is there something legislatively this subcommittee and full
    committee needs to do to improve what appears to be working or
    are you happy with the authority you have and just want to be
    left alone?
        Mr. Cauley. I appreciate the question and the previous
    question and the responses.
        Mr. Barton. They expect you to take them to dinner tonight
    because of their answers.
        Mr. Cauley. Something along those lines. I think the
    testament to the legislation creating this framework that our
    data, not our view but our data that we collect from industry,
    is that reliability of the bulk power system has improved over
    the last 10 years and that's the testament that we want to
    leave is that we are getting better on the bulk power system in
    terms of number of outages, frequency of outages, impact on
    customers.
        I think the framework works. Our relationship with FERC is
    excellent and when we have got to get something really
    important done, like they said, let's do a physical security
    standard or a standard on GMD. We have a conversation. They
    direct us to do it and we do it and we meet their requirements.
        The one area where I think we continue, particularly in the
    area of security, or we need to continue to work on is the
    ability to share information between industry, NERC and the
    government, and sometimes we do it well and sometimes we don't
    do it well.
        There is always the challenge of what's classified, what's
    secret, what's sensitive to the military. But we crave
    information in industry to figure out what we need to do to
    protect the grid and to get that free flow of information. To
    have it be protected is essential for us. Thank you.
        Mr. Barton. OK. Well, downstairs we are fighting like cats
    and dogs. But in this subcommittee on this issue we are hugging
    each other.
        I think we can work together if we need to and I want to
    thank the witnesses and thank the subcommittee vice chairman
    and the subcommittee ranking member for holding this hearing.
        Mr. Upton. The gentleman's time has expired.
         The chair calls upon the gentleman from California, Mr.
    Peters, for 5 minutes.
        Mr. Peters. Thank you, Mr. Chairman. Thank you to the
    witnesses for being here.
        So in 2003, my wife and I took my two kids to New York. We
    thought we'd get some good food, visit some friends, see ``The
    Lion King'' and we, of course, were there for the blackout. So
    we had a nice Italian meal the first night. The next night was
    salami and crackers and still never seeing ``The Lion King.''
        But the impressive thing about that was that it all came
    from some glitch in Ohio. So I guess we are inferring from your
    comments about the reliability of bulk power that that sort of
    thing has been improved upon.
        But it did also make me think about distributed generation
    because one of the things that we have seen in San Diego in the
    defense sector is a development of micro grids.
        At Pendleton you see this all over, and it seems to me that
    for redundancy and reliability that offers some advantages. But
    I had the same question about the portals into the system for
    attackers.
        And you've sort of answered the question but Mr. Aaronson
    said something that I want to follow up on, which was you want
    security baked in to these devices, not bolted on.
        What can we do from this subcommittee to make sure that
    that happens?
        Mr. Aaronson. So let me refer to the '03 blackout for a
    second, also. While that was not the best day in the history of
    the electric utility industry, and I think Ms. Sugg hit it on
    the head that someone's detection is someone else's protection.
        We learn from all of these experiences and in fact Congress
    learned from that experience and in its wisdom, as Mr. Barton
    was referring to. The Energy Policy Act gave way to the ERO and
    here we are.
        I think there is something to that, which is observing
    where these gaps in security may lie with distributed resources
    and ensuring that if they are going to be a part of the bulk
    electric system that they have a certain level of security that
    they are responsible for as well.
        Again, as owners/operators, who have bulk electrical system
    responsibilities, I think those who might be able to impact the
    bulk electric system should share in that responsibility.
        Again, it goes to my point about visibility, also. One of
    the things that was learned after '03, it was a cascading
    blackout, but the system worked precisely the way it is
    supposed to. The system failed safe.
        Now, that doesn't change the fact that you haven't had a
    chance to see ``The Lion King'' but it does show that cascaded
    from Ohio up through Quebec into the northeast, stopped in New
    York, didn't go down the entire Eastern seaboard. Spinning
    equipment was not damaged and we were able to restore power
    within a reasonable amount of time, 48 to 72 hours.
        Again, not the best moment in the utility industry's
    history, but a show of how resilient the system is in fact. I
    want to make sure to maintain that resilience and don't want to
    lose visibility or resilience because of a rapid proliferation
    of DER.
        Mr. Peters. Talk about the distributor or the stuff that's
    outside the bulk power system. So, maybe a military micro grid
    has better protections than the average household device.
        But I am thinking, now you have these home devices. You
    turn energy on and off. I assume that that is a point of
    vulnerability and what do we do to make sure that the security
    you talked about is, as you said, baked in? What is it that we
    need to do? Is it standards or what would it be?
        Mr. Aaronson. I think it is standards and requirements. We
    talked earlier about the internet of things, and these are your
    devices like a thermostat, like a refrigerator, like a baby
    monitor, that are being put out at--I think about five and a
    half million per day and by 2020 we are going to have something
    like 20 billion of them connected to the internet.
        And these things have hardwired passwords that are default
    passwords. These things are easy to break, and if we are
    talking about things that have any relationship to critical
    infrastructure I think having that low a bar of security, that
    consumer-grade electronics tend to have, is a concern for us in
    the industry.
        Dr. Beck. I would just add that, again, putting the
    baseline standards is necessary but it also needs to be
    customer driven.
        Customers need to say I am not going to buy a device that
    has hardwired passwords that I can't change and it's just the
    name of the company or the device.
        Mr. Peters. On the other hand, just take it at the most
    basic level. Take someone who's putting solar on their roof.
    They may not care. Why would they care about the larger grid?
    What is going to be incentive for an individual customer to
    talk about that?
        Dr. Beck. Well, I think, again, it's trying to make
    everyone aware that when you're this connected then your
    vulnerability becomes someone else's problem, not just your
    own, right.
        So you can have negative impacts on your neighbors' other
    systems if you don't care. So we have to get, again, people to
    care about this in a broad sense.
        Mr. Peters. All right. Well, I'll look forward to working
    with that. My time is expired. Appreciate it. Thank you, Mr.
    Chairman.
        Mr. Olson. Gentleman yields back.
        The chair calls upon himself for 5 minutes and welcome to
    our four witnesses. As a congressman from the state that
    consumes the most energy in America, Texas, cyber-attacks on
    our electric grid have caused me to lose sleep on occasion.
        We all know about Russia's attack on Ukraine in December of
    2015. That was kind of easy. They have e-mails of employees are
    standard format, first name dot last name dot organization dot
    com, dot org, something like that.
        Got those, put attachments on those. Sent them back. Opened
    up, they deploy and they shut down some circuit breakers.
        As has happened charged said the response was all they
    could do was film the attack with cell phones. Film the attack
    with cell phones.
        Now, I know that we're not like Ukraine. We are much more
    advanced. But in the Navy, I was a pilot for 9 years. They
    teach us to prepare for the worst, hope for the best.
        And so, Mr. Aaronson, along those lines, hypothetically, if
    the lights go out all over D.C. as this hearing ends--we are
    attacked, a cyber-attack--what chain of events does that start
    like that?
        Mr. Aaronson. So that has happened before and in fact not
    long ago there was a voltage dip that occurred because of a
    fire at a substation and the lights, in fact in D.C., did go
    out. And in that first hour it was unclear why. We knew about
    some incidents around the greater metro area. But was it
    terrorism?
        This idea of fog of war in the midst of an outage, was it
    something typical like a voltage dip and those things happen?
    Was it an act of terrorism? Was it cyber? Was it physical?
        Getting ground truth on that is hard and attribution is
    hard. But having the mechanisms in place to talk to each other
    is important.
        So in that instance, and if there were something Ukraine-
    like to happen here in the U.S., it's less about why the power
    went out and more about simply restoring at that moment.
        Ukraine was a great example, as are all of these incidents
    that happen all over the world and here domestically, to get us
    better at resilience and the idea is to take the lessons
    learned, apply them and get better.
        In the instance of your hypothetical, what would happen is
    there would be an immediate high level of coordination between
    the ESCC and CEOs in the industry along with senior government
    officials and including Mr. Cauley and his team from the
    Electricity Information Sharing Analysis Center.
        In the case of the voltage dip a few years back, that also
    resulted in a phone call with DHS on something known as the
    NICCL, the National Incident Communications Coordination Line,
    and that NICCL call actually had folks from both the affected
    utility and DHS and White House leadership.
        And what it allowed us to do was have White House
    leadership, at the time Josh Earnest was the White House press
    secretary, go to the podium from the most important podium in
    the land and say this was not a terrorist attack. We knew what
    was going on.
        So that really tight coordination between senior government
    officials and the industry proved itself to be just invaluable.
        Mr. Olson. To recover how do you share those lessons
    learned with government and industry to make sure that we learn
    lessons from these attacks through incidents because that's an
    important part of the whole process.
        We are attacked. Whatever happens learn from it. So how,
    Mr. Aaronson, how do we share that with industry, with the
    federal government?Mr. Aaronson. Those mechanisms exist and
    they are getting better all the time. I am particularly proud,
    again, as part of the secretariat for the Electricity Subsector
    Coordinating Council, the ESCC is a place where that happens.
        But, again, the E-ISAC and Gerry's organization play a
    significant role. The sector as a whole, we operate one big
    machine with thousands of owners and operators. There is this
    shared responsibility. So when a thing happens we are
    particularly good at coming together, applying those lessons
    and making sure that in the future a similar incident would
    have either less impact or no impact at all.
        Mr. Olson. Mr. Cauley, do you have an answer about
    recovery?
        Mr. Cauley. Usually what we are doing is as quick as
    possible situation assessment, put the system back together. If
    we have damaged equipment or computers, we will isolate those
    and start putting the system back together as quickly as
    possible.
        Why reliability has gotten better the last 10 years is
    because we are always learning from every single event, small,
    medium, and large, and we get the information out to industry.
        Mr. Olson. Good. Dr. Beck, add anything to those line of
    questioning?
        Dr. Beck. I think there is challenge in learning lessons
    and protection of the herd because there is a natural tension
    between restoration and attribution.
        So to do attribution sort of like any crime scene, you
    don't disturb the scene. You rope it off and then you analyze
    it and try to figure out what happened, but that crime scene is
    a broken down system that the operators want to restore.
        They don't want to leave a mess that people can look
    through. It's just a challenge. Nobody's wrong. Both things are
    important, but coordinating on attribution could be important
    certainly for a very sophisticated attack that may be
    distributed and that we don't know where all it is embedded.
        Mr. Olson. Ms. Sugg, anything to add from your perspective,
    ma'am?
        Ms. Sugg. From the ISO/RTO perspective, certainly we are
    going to work closely with NERC and support the information-
    sharing opportunities that exist to learn from these events.
        In the midst of that crisis, our operators are going to be
    looking for what's going on in a particular area of the
    footprint. I believe Washington, D.C. is in the PJM footprint.
        And so PJM operators are going to be looking for ways to
    contain a particular system outage to keep it from having
    broader cascading effects across their region. That's just one
    of the responsibilities of reliability coordination within the
    ISO/RTO community.
        Mr. Olson. Well, thank you. I'll sleep better tonight, I
    guarantee you.
        One final question--you might know the incoming Secretary
    of Energy is a guy from Texas, Governor Rick Perry. He's a
    friend, and Governor Perry asked me to ask of you all, in his
    new role over at Energy what is the one thing he can do, one
    thing, to help you make our grid more secure, from DOE's
    perspective? Your perspective on DOE?
        Mr. Aaronson. I'll say it again. ESCC, working as closely
    as possible with industry leadership, we have enjoyed a very
    fruitful relationship with the Department of Energy because of
    their senior leadership being committed to it and we look
    forward to and know that Secretary Perry will continue that
    tradition.
        Mr. Olson. Anything else to add, Mr. Cauley?
        Mr. Cauley. I will echo that. Just to get engaged with the
    industry leadership. We have several meetings a year with high-
    level folks from DOE, DHS and others, and we engage them in our
    exercise.
        We challenge them and make them uncomfortable, but we have
    grown together in the last couple years and I think with the
    change of administration we need to renew that.
        Mr. Olson. Yes, sir. Dr. Beck, anything to add on that,
    sir?
        Dr. Beck. I would say, commensurate with the incoming
    administration's emphasis on infrastructure that leadership be
    shown there, and to pay attention to the electric and fuel
    infrastructure that supports it and, again, to ensure that
    security is part and parcel also with efficiency and
    reliability so that they are on equal footing and that those
    practices are embedded in any new infrastructure.
        Our infrastructure should always be getting more secure as
    it is upgraded. We can't be introducing or reintroducing old
    vulnerabilities or introducing new ones.
        Mr. Olson. Ms. Sugg, your comments.
        Ms. Sugg. I would encourage continued collaboration across
    the various industries that are dependent upon each other and I
    would also encourage the DOE to continue to focus on developing
    their cybersecurity frameworks that are made available to
    utilities to help ensure that we are thinking about security
    from soup to nuts and not just focused on the current threat or
    the current issue on the front page of the paper.
        Mr. Olson. Well, thank you all. On behalf of Governor
    Perry, much obliged.
        And my time is expired. I now recognize the gentleman from
    Pennsylvania, Mr. Doyle, for 5 minutes. He has departed, so I
    guess it's going to be Ms. Castor from Florida for 5 minutes.
        Ms. Castor. Thank you, Mr. Chairman.
        Good morning and thank you for being here today. Mr.
    Cauley, to date the power grid in the United States has not
    lost any service hours due to a cyber-attack, correct?
        Mr. Cauley. Yes, ma'am. That is correct.
        Ms. Castor. OK. Nevertheless, the electricity sector has
    not been invulnerable to cyber-attacks. As recently as December
    a utility in Riverside, California experienced a cyber event
    that did not cause a blackout but potentially could have
    affected grid reliability, according to an account on file at
    the Department of Energy.
        The same month, suspicious activity was detected on laptop
    at a Vermont electric utility, which was not connected to the
    grid.
        Does NERC have data on cyber-attacks against utilities that
    have not resulted in a loss of power on the grid?
        Mr. Cauley. Yes, ma'am. We track pretty much every incident
    and they are as small as incidents around a compromised laptop,
    which both of these cases were.
        They are connected to the corporate systems and the
    business systems of the enterprise and not to the electrical
    controls of the grid, and both of these were reported to us
    through our regular reporting capability.
        We understood what they were. Basically, the corporate side
    of each utility is as exposed to the outside world as any other
    business and you have to have that diligence around that and we
    are also subject to human frailties, people going onto a
    particular site so the idea is to continuously monitor, catch
    those and fix those. But both of those organizations reported
    to us.
        They did the right thing and we were able to distribute
    that information to the rest of the industry so that they could
    look for the same kind of issue.
        Ms. Castor. I think you're right. Oftentimes the weakest
    components in security are the humans that have to interface
    with the systems. Spear-phishing attacks have resulted in major
    leaks when even savvy users relinquish their passwords.
        And everyone is very concerned about what happened in the
    Ukraine and I--this was a good little article by security
    writer Kim Zetter.
        Everything we know about Ukraine's power plant hack--that
    the end of December two power distribution companies in Ukraine
    said that hackers had hijacked their systems to cut power to
    more than 80,000 people.
        The intruders also sabotaged operator work stations on
    their way out the digital door to make it harder to restore
    electricity to customers.
        The lights came back on in three hours in most cases but
    the hackers had sabotaged management systems and workers had to
    travel to substations to manually close breakers that hackers
    had remotely opened.
        And days after the outage Ukrainian officials appeared to
    blame Russians for the attack, saying that Ukraine's
    intelligence service had detected and prevented an intrusion
    attempt by Russian special services against Ukraine's energy
    infrastructure.
        Speaking at the S4 security conference, former NSA and CIA
    spy chief General Michael Hayden warned that the attacks were a
    harbinger of things to come for the U.S. and that Russia and
    North Korea were two of the most likely culprits if the U.S.
    power grid were ever hit.
        Now, what was interesting is utility operators in the
    Ukraine began experiencing small attacks 6 months prior to the
    main attack.
        These included e-mails to utility operators containing
    documents which installed malware. Could spear-phishing attacks
    and other similar intrusions represent a vulnerability to grid
    systems if hackers are able to identify information about grid
    systems by first infiltrating the personal and business
    information of the grid operators and what are we doing about
    that?
        Mr. Cauley. Well, spear-phishing, going to malicious sites,
    picking up malware on a laptop or a computer is probably the
    greatest vulnerability that we have and the most challenging to
    manage.
        I am pretty sure that the situation in the Ukraine would
    not happen here, because they failed to really recognize
    between March of 2015 and December 2015 we would not allow that
    software to go unchecked and for the perpetrators to get
    elevated credentials so they could actually operate the system.
        Those are extreme violations of all our rules and all our
    checks and balances and the controls that we have in place. I
    don't view what failed there is that an operator clicked on the
    wrong link.
        I feel that the organizational and institutional framework
    failed to have the rules in place to make sure that those are
    constantly checked. Humans will make mistakes.
        It should not last on a laptop more than hours or days
    before they get detected and fixed. It takes months to
    perpetrate a campaign like that, and it did in this case. But
    you got to use that time to figure out you've been compromised
    and fix it.
        Ms. Castor. I appreciate that and I appreciate how all of
    you today have expressed sincere understanding all of the
    security facets of this.
        But please be cognizant that a lot of this can start with
    those innocuous looking smaller type of infiltrations and I
    hope that you're talking with all of your personnel about that,
    too.
        I trust that you are. Thank you very much.
        Mr. Olson. The gentlelady's time has expired.
        The chair calls upon the gentleman from Pennsylvania, Mr.
    Murphy, for 5 minutes.
        Mr. Murphy. Thank you, Mr. Chairman, and thank you to the
    panel, too.
        First of all, I want to make sure we know in the record as
    far as the Ukraine goes--a bigger threat to their grid is the
    fact that Russia has invaded them and Russia has taken their
    coal fields away and that Russia threatens every European
    nation that is under the boot of Gazprom and that's what they
    do and they say if you don't buy our gas from us and you don't
    do this we are shutting off the pipes.
        So that's a big concern, too. But doing it through a back
    door avenue of a cyber-attack is important, something we all
    should pay attention to and I hope that our new president
    establishes good negotiations with President Putin so we can
    get back to the work of doing other things.
        But I wanted to ask about another area here. When it comes
    to working with the cyber-attacks and prevention, et cetera, we
    know that--I think it was Home Depot was hacked and they were
    hacked because they went through some small level billing--an
    HVAC system that didn't have the kind of protections. They
    worked their way through those channels to finally get into
    their----
        Dr. Beck. That was Target.
        Mr. Murphy. Oh, it was Target? OK. May have been they find
    some little area that doesn't have strong defenses here. And so
    I am wondering also in the utility sector and the power grid
    sector what can the federal government do to help to enhance
    cybersecurity, noting that someone may come in through any
    door, any unprotected door in this.
        Does anybody have any ideas of how this could be? Any
    supplier to a power plant, any supplier that they could find
    some weak link there? Mr. Aaronson, do you have a thought on
    that?
        Mr. Aaronson. So a couple of observations, and it brings in
    Ms. Castor's point about humans also. The weakest links,
    whether it is an unsavvy vendor, whether it is even a savvy
    user, there is always the joke.
        There is hardware vulnerabilities, there is software
    vulnerabilities and there is wetware vulnerabilities, and we
    are the wetware.
        I think, going back to my original testimony, as owners and
    operators we have to be right 100 percent of the time and the
    adversary has to be right once, I think looking at the weakest
    link shows that there are a lot of opportunities for the
    adversary to be right.
        But them being right does not have to be catastrophic. It
    goes to this idea that Mr. Cauley was talking about of the
    cyber kill chain.
        Seeing early precursors to potentially more nefarious or
    destructive activity, predictive analytics that help us to see
    those and being more aggressive in that cyber kill chain to
    both prepare, protect, and defend but then also being able to
    respond and recover.
        And to bring this back to Ukraine, while I agree with Mr.
    Cauley that a similar attack in the United States is very
    unlikely, but not impossible, I do think that the lesson that
    we have learned from them is they were able to get their
    200,000-plus customers back up and running within about 6
    hours. They were operating in a degraded state but electricity
    was still flowing.
        Mr. Murphy. Thank you. So let me ask this, though, because
    with regard to the grid, do any of the larger customers have
    any kind of other software and other controls that can pull off
    the grid and demand more?
        So if there was, obviously, not control of the power plant,
    but do they have any kind of links than can affect if they are
    not getting enough?
        Do all those controls have to go back through the original
    utility company and the power company on that grid if they
    experience some problems?
        Mr. Cauley. I think the general answer is that the system
    is built to be very redundant and with excess capacity. So if
    something is damaged or not behaving correctly it can be
    removed and there is plenty of capacity to move energy around.
        Mr. Murphy. Sure. I am wondering about the two-way
    communication. I am also looking for other back doors in there,
    too.
        Two of the things that we have in Pittsburgh--one is the
    Carnegie Mellon University computer emergency response--the
    global leader in this and also there's another program there
    called the National Cyber Forensic Training Alliance, which is
    a room filled with lots of cubicles of businesses of every
    shape and form, and when one picks up something they announce
    it. It's like the stock exchange.
        Someone says hey, I've got something here and they start
    looking back and forth and see where these back doors--channels
    are starting to probe--where's the Trojan horse running, et
    cetera.
        And I am wondering that it's one of the areas the federal
    government can look at because sometimes we will silo these
    off--let's work on DoD, Navy's going to do their thing, Army's
    going to do their thing, Air Force is going to do their thing,
    Commerce is going to do their thing, maybe different parts of
    Energy.
        I am wondering do we have enough cooperation between
    different branches of the federal government and working at
    these things together so are we creating more inefficiencies in
    our system.
        Dr. Beck, go ahead.
        Dr. Beck. Well, it's still a challenge. So I talked about
    the silos before. But I would say no but it is improving. The
    information sharing needs to be done with regard to sharing
    research, with regard to what are the problems you're trying to
    solve.
        Mr. Murphy. This may be part of the lesson to take back to
    the new secretary of energy, that people have to be willing to
    play together in the same sandbox and share their toys.
        Dr. Beck. Right. So you have DOE labs and you have DoD labs
    and they don't talk to each other very much, but they could
    with leadership and they end up working on similar problems and
    find out later wow, we have a military application. We had a
    problem here but 90 percent of that problem might be relevant
    for a civilian electric power grid.
        It takes the ability to share information at least at a
    high level and then be able to dig in and share that possibly
    if it's classified but at a more technical level as well.
        Mr. Murphy. Thank you. I appreciate that. I yield back, Mr.
    Chairman.
        Mr. Olson. Gentleman's time has expired. The chair calls
    upon the gentleman from New York, Mr. Tonko, for 5 minutes.
        Mr. Tonko. Thank you, Mr. Chair.
        Welcome to our panelists. This subcommittee heard from
    Secretary Moniz about the interdependence of our critical
    infrastructure.
        And from what we heard this morning, it sounds like there
    is agreement that the security of our grid infrastructure is
    particularly important because of so many other sectors relying
    upon it. Is that a fair assessment?
        Mr. Cauley. Yes, sir, and we drive that out when we do our
    exercise and we break everything down. Financial sector,
    transportation, telecommunications, water--we are as dependent
    on them as they are on us.
        Mr. Tonko. OK. Thank you. And while I appreciate the focus
    on increasing security and mitigating cyber risks, I am also
    interested in knowing more about procedures in case there is a
    major cyber-attack.
        So, thankfully, our country has not had any major cyber
    incidents that have needed response but we have had major
    natural disasters. I would cite as an example in my home state
    of New York we dealt with Superstorm Sandy in 2012.
        What specific lessons have been learned from the response
    to major natural disasters that may be applicable to a future
    cyber-related response effort?
        Mr. Aaronson. So I think it's fair to say that the lessons
    in coordination, because we have not had an opportunity outside
    of exercises to necessarily exercise and stretch those muscles
    with respect to a cyber incident. They have grown up with
    respect to natural disasters and a couple physical security
    incidents as well.
        That partnership is invaluable. I look at the role that the
    Electricity Information Sharing Analysis Center plays. I look
    at the role that the Sector Coordinating Council plays in
    coordinating with the highest levels of the industry.
        I look at our partnership with DOE, who operates under
    emergency support function 12. Not only are they our sector-
    specific agency, but they are the electric sector's entre into
    the rest of the federal government enterprise, working closely
    with DHS, working closely with FEMA, working closely with the
    Department of Defense.
        A great example was Superstorm Sandy, when we did have the
    opportunity not just to help inform but actually be in the
    interagency room and help to direct resources where they needed
    to be directed. So taking information from affected utilities
    and feeding it into the government and taking information from
    the government and feeding it back to affected utilities, that
    same battle rhythm would be seen in the event of a cyber
    incident as well.
        Mr. Tonko. So the intercommunication is important and I see
    you all kind of nodding in regard to that. So do you feel the
    procedures, the equipment, the personnel are in place in order
    to respond to a major cyber incident today?
        Mr. Aaronson. I think the proper answer is it depends.
    That's always the proper answer. No, I mean, to give some
    modicum of comfort, yes. I think these relationships and these
    processes and these exercises have really informed and these
    experiences have really informed the industry's not just
    security posture, but response posture.
        I do think there is the added complication with cyber of
    data assurance, knowing that the data you are reacting to is
    the right information or has not been compromised in some way.
    So we are very cognizant of those challenges.
        But I do think just simply having that underlying
    foundation of partnership and response capabilities makes us
    fairly well prepared and getting better all the time. That's
    the goal.
        Mr. Tonko. OK. Dr. Beck, did you want to say something?
        Dr. Beck. I would say I largely agree with that but, again,
    with particular respect to cybersecurity, there are additional
    challenges to expanding mutual assistance, which the industry
    has a long history of.
        When it's a physical system--your example of Superstorm
    Sandy, those were mostly downed poles and lines. The equipment
    was standard. The repair techniques and knowledge was standard.
        Within any utility's OT system you're going to see more
    variation than you are between poles and lines. And couple that
    with Mr. Rush's point earlier about a smaller cyber workforce.
    It's a resource challenge. I applaud ESCC for taking it up.
        But it is more challenging than traditional mutual
    assistance.
        Mr. Tonko. Let me just quickly get this in. You all partner
    with the Departments of Energy and Homeland Security and,
    obviously, they provide a lot of expertise.
        But can you discuss your relationship with state and local
    governments? And I would just throw the caveat out of New York,
    again, working to develop their own cybersecurity capabilities.
    They've done this with the National Guard.
        Both New York and New Jersey National Guards have created a
    partnership to form a cyber protection team. Just your response
    to that, please.
        Mr. Aaronson. So I was remiss in not mentioning, as Dr.
    Beck did, the cyber mutual assistance program and agree
    completely with his assessment that it is in its nascent stages
    and mutual assistance in its traditional form was born under
    the crucible of lots and lots of incidents of natural disasters
    over the years.
        The same will be true of cyber, and to bring it to your
    question about state and local, a state chief information
    officer once said to me states are the consequence people. And
    you certainly see experiences where governors and the local,
    national, and the state National Guard work very closely with
    their utilities.
        Those partnerships are in place. The cyber mutual
    assistance program is leveraging those relationships for two
    reasons: one, states are the consequence people; two, the
    National Guard has some extraordinary capabilities that can
    help augment and complement and supplement the capabilities
    that the industry brings to bear with its cyber mutual
    assistance program.
        So I would say working closely with governors at the
    highest level, I would say working with operators and helping
    to bolster the cyber mutual assistance program with the Guard
    and then I would say sharing information at the local level
    through fusion centers.
        And, again, there are 73 fusion centers across the country.
    The joke has always been if you've seen one fusion center
    you've seen one fusion center, but they are increasingly better
    at coordinating amongst each other at the state level and
    giving us yet one more tool to share information and better
    respond in the event of an incident.
        Mr. Tonko. Thank you very much. I yield back, Mr. Chair.
        Mr. Olson. Gentleman's time has expired. The chair calls
    upon the gentleman from Mississippi, Mr. Harper, for 5 minutes.
        Mr. Harper. Thank you, Mr. Chairman, and thanks to each of
    you for being here. This is such an important topic as we go
    forward so I appreciate all the input each of you have given.
        Mr. Cauley, if I may ask you a couple of questions here. Is
    the North American Electric Reliability Corporation's alert
    system working as intended to provide the concise actionable
    security information to the electric industry?
        Mr. Cauley. Yes, sir, it is, and we are able to get out
    information very quickly if needed, within an hour if needed,
    and it gets to all of the owners and operators of the system
    with the specific information and they have access to it
    directly.
        So we are always looking to make it better. I think in the
    Ukraine and the internet of things incident that we saw in the
    last 12 months we have learned to scale.
        We can get thousands of people now on a conference call and
    let them know immediately what's going on, including the CEOs
    and others.
        Mr. Harper. What are the threats outside the bulk power
    system?
        Mr. Cauley. The threats to the grid outside the bulk power
    system?
        Mr. Harper. Yes.
        Mr. Cauley. Well, I think we touched on it earlier. There
    are much more electronic digital devices that exist in the
    distribution system and then customer systems that I think are
    going to increasingly have an influence on the overall grid.
        Mr. Harper. Let me just follow up just a little bit. As you
    previously stated, the North American Electric Reliability
    Corporation uses an alert system to notify the electricity
    industry of the issues or problems.
        You note that North American Electric Reliability
    Corporation determines the appropriate alert notification based
    on the risk to the bulk power system. How do you determine the
    risk or the level of that risk?
        Mr. Cauley. We have expert folks on both the cyber side as
    well as the operational side of the grid to know what the
    potential impacts might be and this is actually one of the
    particular values that we add in our relationship with
    Department of Energy, DHS, and the FBI is they often ask us
    what does this mean and how would it affect the grid if it
    actually happened.
        So we have both sides of that expertise and we have people
    who work in classified space to interpret what it means and
    what the potential downside could be if this actually happened.
        Mr. Harper. OK. Obviously, other business sectors depend
    upon electricity. We have discussed that. But can you explain
    how the electric sector is dependent and reliant on other
    sectors and what is the industry doing to reach out and address
    these interdependencies for better cybersecurity?
        Mr. Cauley. Well, we are reaching out to the other sectors.
    I think the dominant one is the telecommunications industry
    because a lot of our control systems, the ones I mentioned
    earlier, were so essential that we want to protect the most run
    over communications networks.
        The majority of those are privately owned by us through
    services with some of the major vendors. But if those systems
    go down, and you look at the example of Hurricane Sandy when
    some of the major telecommunication suppliers had vaults in
    buildings in Manhattan that were flooded with water, we
    depended very much on those communications capabilities.
        Water, transportation--finance is one you might not think
    about but if there is a severe enough event utilities need the
    liquidity to get everything done and recover and pay their
    folks and pay for the emergency housing and things like that.
        So there are a lot of dependencies that we are working on
    through the expanded relationship that Mr. Aaronson had talked
    about of getting the same level of CEO support that we have in
    the electricity industry.
        We want to get with those other sectors and get them all in
    the room with the government folks that we need to work with to
    make sure we are communicating and coordinating and planning
    together.
        Mr. Harper. Well, I want to commend each of you on the
    level of cooperation and communication that you share and
    appreciate the effort that you're making.
        Thank you. I yield back.
        Mr. Olson. The gentleman from Maryland, Mr. Sarbanes, for 5
    minutes.
        Mr. Sarbanes. Thank you, Mr. Chairman. I want to thank the
    panel.
        I am trying to get my head around how much of these efforts
    to protect the grid from cyber threats and so forth is an
    exercise in kind of retrofitting what we have versus trying to
    build these protections in as new technologies and new
    components of the grid are rolled out. And I don't know if
    there is any way you can quantify or address it in some other
    fashion. Yes.
        Ms. Sugg. So you're right. The bulk of the standards and
    requirements are retrofitting to mitigate risks and identify
    and manage vulnerabilities and what not.
        I applaud NERC's efforts to get ahead of the supply chain
    challenges that we have to develop standards. You know, the
    industry itself has moved forward.
        The ISO/RTO council has put specific requirements in place
    for our control system vendors ahead of there being a standard
    that says you should have some secure coding practices for your
    control system vendors.
        But it's not just software vendors. It's also hardware
    vendors. And then a comment made earlier about, I think it was
    Dr. Beck, about the importance of educating the consumer on
    those smaller devices.
        I think we should put more emphasis on the manufacturers as
    well and really hold them accountable for developing things
    that are easy to maintain security with, not things that you
    just plug in and forget about, with the control systems and all
    of the systems within our organizations, not just those that
    NERC has put some mandated controls around but for all of those
    systems.
        We have a responsibility and accountability to keep them
    current and to address vulnerabilities at all times. But that
    doesn't exist, to my knowledge, when you get outside of the
    industry.
        And so I think we have to go back to the manufacturers and
    perhaps the equipment needs to be certified or----
        Mr. Sarbanes. Is it feasible to think in terms of, in a
    sense, cordoning off some of the consumer component of this
    internet of all things grid that's developing from more of the
    traditional infrastructure as a practical matter?
        Do we just have to accept the notion that somebody's
    thermostat somewhere in their house can be a path all the way
    to shutting down some regional generator or something?
        Mr. Cauley. I think to a large extent we do that already
    because the most critical assets are in the bulk power system.
        So you can picture a grid with the major control center and
    a lot of substations. We are trying to firewall it off, import
    multiple layers of protection.
        So the image that comes to my mind is sort of a shuttle
    going through space and it's just getting bombarded all the
    time. So we are getting bombarded all the time and they are
    usually hitting the shield.
        And as was mentioned earlier, sometimes the frailty is a
    human being enables something to get through. But so we are
    doing that.
        A long-term question as a country that you're kind of
    raising, which is a lot of the electronics comes with huge
    capabilities. We used to buy a relay for the system and it
    would just be a couple of contacts and a coil of copper wire.
        Now you get a box and it has 10,000 lines of code because
    it can do anything and everything that you want. Well, that
    philosophy really permeates everything in the consumer side, in
    the distribution systems and in the bulk power system.
        We are getting electronics that can do everything. The
    difficulty there is then it can be reprogrammed to do anything
    anyone else wants.
        All right. So I think we have to think about long-term
    partnership with suppliers, vendors, and manufacturers in terms
    of building better security into systems, making sure we are
    able to manage a purpose and have those be beneficial purposes
    and not adverse purposes.
        Mr. Sarbanes. Right. You have kind of a bundling problem.
    Get this thing and it can do all of this neat stuff that I
    don't necessarily need and could introduce a vulnerability that
    I won't notice because I never use that feature.
        Mr. Aaronson. Just to sort of piggyback on some of that, I
    think we don't have the luxury of doing the ostrich thing and
    putting our heads in the ground.
        Smarter energy infrastructure is here to stay and it serves
    a really important purpose and I think customers and consumers
    want it and are going to deploy and, again, utility scale and
    just industry in general sees the value.
        We talked about distributed resources, having a impact on
    resiliency. They are both a good one and a bad one, and I think
    instead of trying to fully cordon off I think the most critical
    assets instead we need to look at segmentation and awareness of
    the vulnerabilities that are introduced and additional
    resilience to ensure that a problem at one node is not a
    catastrophic problem, more broadly.
        And again, I think some of the standards that are already
    in place and some of the approaches to the promulgation of
    distributed resources are going in the right direction.
        Mr. Sarbanes. I yield back. Thanks.
        Mr. Olson. The gentleman yields back. The chair calls upon
    the gentleman from West Virginia, Mr. McKinley, for 5 minutes.
        Mr. McKinley. Thank you, Mr. Chairman.
        This issue has come up literally every year since I've been
    in this committee for the last 6 years and I keep being told
    that everything is going to be fine, that we have got things
    under control.
        Two years ago we had Tom Siebel with C3 Energy testify
    before us and Mr. Siebel said, it was kind of shocking to me,
    he said, I could--any hostile country--and he said as a matter
    of fact I could take 10 engineers from U.C. Berkeley and I
    could shut down the electric grid between Boston and New York
    within four days.
        Now, that was after all the testimony about all the
    safeguards we had in place. So is Mr. Siebel wrong?
        Mr. Aaronson. So I guess I'd push back on the premise a
    bit. He is not wrong in that, and I don't think any of us today
    are saying it's 100 percent under control.
        I think, as I mentioned, it is an ongoing effort to
    continue to improve our defenses to respond to incidents
    internationally and domestically and to apply those here. You
    have two options.
        You can be a good example or you can be a cautionary tale
    and, fortunately, there are a lot of cautionary tales out there
    about how a sophisticated, well-informed threat actor with a
    purpose can have an impact on grid operations.
        I think what I would say is while an attack that has an
    impact is always within the realm of the possible, the
    resilience and redundancy that has grown up and the ability to
    respond that continues to evolve makes me a lot more
    comfortable in our ability to deal with these.
        Mr. McKinley. We took that theme, that concept back--we had
    a cybersecurity summit back in West Virginia and we had some
    180 people attending, almost 200 people, in panels from all
    across the country, people coming in.
        They all agree that we are still very vulnerable. This
    exercise that we go through, talking about and telling us we
    are OK. They are saying from the inside we are not.
        So I am still going to remain uncomfortable--it goes back a
    little bit to what Johnny Wooden used to say when he was
    coaching the UCLA Bruins, that we often in America confuse
    effort with accomplishment. And I am afraid we are doing an
    awful lot of effort.
        We are showing up daily, talking about it. But I am not
    comfortable yet and neither were the other people on the panel
    that we hosted.
        So if I could now go to Ms. Sugg. One of the other
    testimony we had not too long ago here was from PJM and they
    said notwithstanding the problems that we have with
    cybersecurity but the bigger issue that we have with our
    electric grid is the electric magnetic pulse, EMP.
        Do you agree with that, that it's as much of a threat as
    cyber, or worse?
        Ms. Sugg. I think the probability of that occurring is much
    lower. However, the impact of it, if it were to happen, is much
    larger than a cyber-attack. So it is a concern.
        We are working with the vertically integrated utilities who
    actually own the physical equipment to understand what sort of
    protections and redundancies and things that they need to have
    in place.
        Our dependency on the telecommunication industry is
    certainly a concern there because if there were a significant
    EMP event it would take out the telecommunications.
        And while we have a lot of redundancy in
    telecommunications, if it were all to go out then we'd have to
    relinquish the controls that we have back to the utilities
    themselves to help manage the grid.
        But I know Dr. Beck is an expert on the EMP. I'll be
    interested in his additional comments.
        Mr. McKinley. If you could. We are running out of time on
    this.
        Dr. Beck. Sure. Well, just quickly, they are both
    definitely an issue. We will just say on the one hand we have
    cyber-attacks, which are happening right now while we are
    having this conversation, right, versus EMP attacks getting the
    bullet for the EMP attack is difficult whereas getting the
    bullet for a cyber-attack you can go out and buy it right now
    on any criminal hacker web site.
        So there is a much different proliferation concern. The
    footprints could be quite similar. You can distribute a cyber-
    attack quite broadly as you could with an HEMP attack and also
    the similarity in that similar types of systems can be
    attacked. Any computer network could be susceptible to any EMP.
    It could be susceptible to cyber.
        Mr. McKinley. In respect for the time I had some other
    questions. Let me just close with a--I would hope, given the
    confusion out there, that we could possibly just show us what
    accomplishments, if periodically we get briefed on different
    terrorism attacks.
        If 56 were stopped last month or somehow to show that
    whatever you're doing on cybersecurity is working. Because when
    I have these panels they don't think it is.
        So I need to have something back to be able to support
    that. Thank you. I yield back.
        Mr. Olson. Gentleman yields back.
        The chair calls upon the gentleman from Ohio, Mr. Johnson,
    for 5 minutes.
        Mr. Johnson. Thank you, Mr. Chairman, and I want to thank
    the panel for being here with us today.
        Mr. Aaronson, some have expressed concern that the recent
    episode with the electric utility in Vermont will cause
    industry officials to avoid or think twice about sharing
    information with the government in fear that it could be
    leaked.
        Trust, as we all know, is a two-way street, and while we
    need to ensure that industry officials are properly
    implementing and carrying out federal cybersecurity standards
    and regulations, the government must be a trustful cooperative
    partner.
        What can be done, in your opinion, if anything, to improve
    this relationship and build trust, moving forward?
        Mr. Aaronson. I appreciate the question. The first thing
    I'll say is it would be helpful if sensitive information shared
    in confidence was not shared then with the media.
        Mr. Johnson. Hope you're better at it than we are here. Go
    ahead.
        Mr. Aaronson. Well, I will say up to the moment that there
    was a front-page article in the Washington Post, I would
    suggest that the information sharing associated with the
    Vermont incident went perfectly.
        There was actionable intelligence from government
    officials, shared with the Sector Coordinating Council. We
    brought together more than 30 CEOs onto a phone call within
    about 4 hours.
        That information was then cascaded broadly throughout the
    sector at a very senior level and at the operative level both
    through the Sector Coordinating Council and the E-ISAC.
    Utilities across the sector took that information, compared it
    against their systems and what do you know, some potential
    indicators of compromise were found. That is exactly the way
    it's supposed to happen.
        To answer your question about will this have a chilling
    effect on information sharing, I don't believe it will. I think
    because of the industry's commitment to and responsibility to
    help each other as we operate this one big machine together,
    there is a sense of responsibility to continue to share
    information even in the face of potential breach of or a
    potential disclosure to public sources.
        But we are looking at what happened at the end of last year
    as a teachable moment and one that we hope isn't replicated.
    And I will give the Burlington Electric Department a ton of
    credit. They said in their statement that they would not let
    this episode chill their intent to continue to share
    information.
        Mr. Johnson. OK. Good. Well, thank you for that. Anybody
    else want to comment on that? I've got a couple of other
    questions. OK.
        Let's talk about information sharing a little bit and we
    will just go down the line for any that want to respond.
        Why do you think situational awareness and information
    sharing is so necessary to enhance the electricity sector's
    ability to prepare for and respond to cyber and physical
    threats and vulnerabilities?
        So why is situational awareness and information sharing so
    necessary? Mr. Cauley.
        Mr. Cauley. I think the main reason is that one company's
    only going to view their own experience and what they see. So
    if a company has one laptop compromised they think, well, that
    laptop got compromised, somebody must have pushed the wrong
    button.
        But we are able to put together hundreds of specific
    instances, look at patterns over time and I think one of the
    capabilities we have through CRISP and through our analytics is
    to see patterns of connection points of internet locations,
    signatures of compromise, and things like that.
        We can see a pattern over 3 months, 6 months, 18 months in
    some cases and you can see what they are doing. You can
    actually watch what's evolving in a very big picture.
        So I think that's really the multiplier effect of being
    able to get everybody's data and to be able to share. We share
    through the DOE lab. We work the CRISP program.
         On the back end of that is the Pacific Northwest lab. They
    have people working classified space, helping us analyze the
    data. So for us to be able to get that, what does it mean, what
    are people trying to do to us, what should we look for, we turn
    around and give that back to industry.
        Mr. Johnson. OK.
        Mr. Aaronson. In the interest of time, I will say Gerry is
    spot on and I would just add one more thing Ms. Sugg said
    earlier which is, I love this quote, I wrote it down:
    ``Someone's detection is someone else's protection.''
        And I think everything that happens is a lesson for the
    rest of the industry. Applying it helps make us all more
    secure.
        Mr. Johnson. See something, say something.
        Mr. Aaronson. There it is.
        Mr. Johnson. There you go.
        Dr. Beck. I think situational awareness, even in the
    broadest terms, is important. So whether knowing about a
    certain attack at a certain utility, that whether or not it
    needs to be defended against by a different utility it's just
    important to have visibility to those reports to understand,
    this situation is happening or the frequency of attacks or that
    people are reporting it I think that just raises the
    consciousness of keeping your eye on this particular ball.
        Mr. Johnson. OK. Ms. Sugg.
        Ms. Sugg. Very quickly, the NERC alert system certainly has
    picked up in frequency of alerting. As Mr. Cauley mentioned
    earlier, given the understanding that we need to be thinking
    about events at any level no matter how small, one of the
    things that makes it particularly useful to us, I believe, is
    the accountability to respond to it.
        So it's not just a matter of, oh, I received some
    information and maybe I'll study that someday. But NERC puts
    requirements around--you must read this, you must look at these
    things and you must report back, and I think that that helps to
    ensure that if there are vulnerabilities somewhere that some
    utility has found that they are responsible for addressing
    those and reporting that back to NERC.
        Mr. Johnson. OK. Great. Mr. Chairman, I yield back. Thanks
    for indulging.
        Mr. Olson. Gentleman yields back. The chair calls upon the
    gentleman from Michigan, Mr. Walberg, for 5 minutes.
        Mr. Walberg. Thank you, Mr. Chairman, and thanks to the
    panel for being here.
        Coming from Michigan and my district, bordering Canada, I
    was just interested to know that since this grid is a North
    American grid, could you please describe, Mr. Aaronson, how
    utility industry coordinates with our northern neighbors on
    cyber and grid security.
        Mr. Aaronson. Sure, and I'll rely on Gerry a little bit,
    too, given NERC's responsibility as the North American
    Electrical Reliability Corporation.
        For the Sector Coordinating Council, the Canadian
    Electricity Association has been a integral part of that
    relationship as has the Canadian government. We have had not
    just the Department of Energy and Department of Homeland
    Security here in the United States but Natural Resources Canada
    and Public Safety Canada, their counterparts respectively north
    of the border.
        Given that this is a North American grid, we are all
    operating the same machine together, number one. Number two,
    you've seen in instances of particularly natural disasters
    where it's not just crews and bucket trucks from the United
    States descending on affected areas but from north of the
    border as well.
        And then also with our nascent, but growing cyber mutual
    assistance program, there have been Canadian utilities as part
    of that relationship also.
        Mr. Walberg. Mr. Cauley.
        Mr. Cauley. So to us they are equally engaged in all of our
    programs. We actually have representation on the coordinating
    council at the CEO level.
        They participated in the ISAC. They follow our standards
    and so they are equal partners. We share information with them.
    They've had some things happen in Canada that we have not seen,
    like an airplane flying over lines and dropping wire on line.
        So somebody was disgruntled and decided to launch their own
    attack out of an airplane. But we share that among ourselves
    and we are able to basically learn from each other and they are
    equal partners and I think all the ISOs in Canada are run
    highly competent systems with the similar controls we have on
    the U.S. systems.
        Mr. Walberg. Continuing on, Mr. Cauley, with some concerns
    about the relationships with Canada and ourselves from my state
    specifically, there is a growing number of interdependencies
    between power generation and natural gas, pipelines included.
        The two industries are similar but are different in some
    ways. How are you addressing power generation resilience to
    avoid single points of failure and what opportunities do you
    see, moving forward?
        Mr. Cauley. It's a very timely topic for us. We have
    actually been doing some recent analysis and we are in the
    processing of publishing a report to look at key parts of the
    gas infrastructure system that we depend on.
        We have now three of our eight regions that have more than
    50 percent of the power supplied by natural gas. And so
    pipelines and storage facilities do create vulnerabilities and
    I think not just from a physical perspective in terms of
    competition with retail gas customers in extreme weather but
    also from a cyber perspective where physical attack disruptions
    could cascade over into electric power.
        So it's high on our list of priorities and the one thing we
    do encourage is diversity in fuel and we encourage
    infrastructure and I think this is the partnership between us
    and Canada and the growing partnership with the infrastructure
    in Mexico which we are involved in will help us ensure our
    energy security through exchange of gas and electricity and
    renewables and all kinds of resources.
        Mr. Walberg. And, hopefully, along with that concept,
    moving back to a more robust standard of all of the above in
    generation and fuels.
        I know there has been a push that's pushed, at least in my
    district, the energy district of the state, away from having
    that robust opportunity for an all above standard.
        Mr. Cauley, let me just in the remaining few seconds here,
    how is NERC and the industry working to develop policies to
    encourage use of system components that will be less vulnerable
    to attack?
        And follow that up, what the Department of Energy is doing
    in this front as well and how you're working with them?
        Mr. Cauley. Well, our standards, and I think the experience
    that we are learning with feeding back industry encourage
    better protection.
        One of the things that we are seeing directly is greater
    diversity of equipment and basically reducing the criticality
    of an individual station or piece of equipment and creating
    redundancies in the system to make us less vulnerable.
        So I think there is a lot of examples like that where
    people are reacting to being more secure and building it into
    the architecture and design of their systems.
        Mr. Walberg. I yield back.
        Mr. Olson. The gentleman yields back.
        We saved the best for last. The chair calls upon the
    gentleman from Ohio, Mr. Latta, for 5 minutes.
        Mr. Latta. Well, thank you very much, Mr. Chairman, and to
    the panel thanks very much for being here today. It's very,
    very informative.
        I know that the other juries that we have had in the past
    year and two, I should say, that you know, this is a very, very
    important topic.
        It's a very, very serious topic, and if I could start with
    you, Mr. Aaronson, if I could ask this. You mentioned in your
    testimony that you're working with DOE to determine the scope
    and process for emergency orders.
        Would you expand on that conversation and provide insight
    as to whether there would be further action from Congress at
    this time?
        Mr. Aaronson. I don't know about further action from
    Congress yet. I mentioned earlier that the notice of proposed
    rulemaking was put out a few months ago.
        We have a due date actually of this coming Monday, February
    6th, to get comments in. Those comments are helping to inform
    the process of what an emergency order from the Secretary of
    Energy might look like.
        I think the most important thing, and it is built into the
    NOPR, is this idea of consultation. The law said consultation
    with the sector where practicable.
        Practicable to us is a little concerning, given that any
    emergency order that doesn't take into account how grid
    operators actually operate the system could have unintended
    consequences.
        So that is a point that we are making in this response to
    the rulemaking to help inform the process. But I do think that
    given all of the great relationship we have with the secretary
    of energy and, frankly, just the Department of Energy in
    general as our sector-specific agency we are confident that
    they understand us, we understand them and think we can work
    productively with them to implement that emergency authority.
        Mr. Latta. OK. Thank you. Let me follow up, and this has
    been touched on a little bit before. You said something kind of
    interesting that I wrote down.
        You mentioned earlier about the vulnerabilities that the--
    that are potentially a concern through the internet of things,
    and if you could expand a little bit on that work and also with
    the electricity infrastructure sharing and analysis center and
    beginning to fix those risks.
        But then you said this. I thought, this is kind of
    interesting. You said you were on a journey without a
    destination. That's not real comforting as we are going down
    that road.
        Mr. Aaronson. Maybe I should pick a better cliche.
        Mr. Latta. I write those things down.
        Mr. Aaronson. But the point I am getting across is there is
    no such thing as 100 percent security. So we are constantly
    evolving and I think that is a good thing.
        If we became stagnant and just relied on this culture of
    compliance and, yes, we are secure, we would not be able to be
    responsive to new and emerging threats.
        So, it's the old joke--I don't have to be faster than the
    bear, I just have to be faster than the other guy. There is
    another cliche to add to that--the hit list.
        But what we were doing is constantly trying to stay ahead
    of the adversary and they have intent and capabilities but we
    do too.
        And I think I am particularly proud of the industry's
    culture of constantly reinventing and looking at its security
    posture, seeing where there are gaps, using exercises like
    GridEx, using observations from things that happen overseas and
    here at home and learning from those and then applying them to
    make us better.
        And to Mr. McKinley who I am sorry isn't here, I agree I
    love the wooden quote of effort does not equal accomplishment.
        But I would say there have been a number of accomplishments
    from putting in place spare equipment programs to creating a
    cyber mutual assistance program to doing a better job of
    sharing information to developing the cyber risk information
    sharing program and applying it from a DOE lab into a
    commercial application.
        So a lot of stuff that is happening in a very short amount
    of time because of the CEO leadership of the Sector
    Coordinating Council.
        Mr. Latta. Thank you. Ms. Sugg, if I could go back to what
    you also said. You said that innovation is important. Are we
    meeting that innovation to make sure we keep up the standards
    to make sure that we meet these potential threats?
        Ms. Sugg. Well, innovation is certainly changing faster
    than the standards are changing, hence my comments about
    ensuring that the standards are not overly prescriptive but are
    more focused on the risk.
        Innovation is important whether it be trying to understand
    the threat avenues from our attackers or understanding the
    newer and more interesting technologies that are coming to bear
    that may provide some additional securities for us beyond what
    we have today.
        We don't ever want to be really comfortable with our
    architecture that we have in place. We need to continue to look
    at opportunities to strengthen it, depending on what
    technologies are available and matching that up with where the
    threats seem to be coming in and how we can try to get ahead of
    that.
        Mr. Latta. Thank you.
        Mr. Chairman, my time has expired and I yield back.
        Mr. Olson. Gentleman yields back and the chair would like
    to have one invitation for the witnesses.
        If you want to see a robust grid security in action at a
    small level, come to Houston, Texas this weekend. There is this
    big football game called Super Bowl 51. It's not a power grid,
    but as you can imagine, if the power goes down right as the
    Falcons are about to score that touchdown to beat the Patriots,
    there will be a riot of biblical proportions. Invitation does
    not come with tickets, and that'll cost you a pretty penny.
        But seeing no further members wishing to ask questions, I
    want to thank all of our witnesses for your participation in
    today's hearing.
        And pursuant to committee rules, I remind members that they
    have 10 business days to submit additional questions for the
    record and ask the witnesses to submit their responses in 10
    business days upon receipt of the questions.
        Mr. Rush, before you leave I ask for uanimous consent that
    a statement for the record from the Large Public Power Council
    and a statement from the American Public Power Association and
    NRECA be put in the record.
        Without objection, the subcommittee is adjourned.
        [Whereupon, at 12:49 p.m., the subcommittee was adjourned.]
        [Material submitted for inclusion in the record follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                       [all]