    [Senate Hearing 115-273]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 115-273

      EFFORTS TO PROTECT U.S. ENERGY DELIVERY SYSTEMS FROM CYBERSECURITY
                                    THREATS

    =======================================================================

                                    HEARING

                                   BEFORE THE

                                  COMMITTEE ON
                          ENERGY AND NATURAL RESOURCES
                              UNITED STATES SENATE

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 APRIL 4, 2017

                                   __________

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                           Printed for the use of the
                   Committee on Energy and Natural Resources

            Available via the World Wide Web: http://www.govinfo.gov

                                _________

                    U.S. GOVERNMENT PUBLISHING OFFICE

     24-979                 WASHINGTON : 2018

                   COMMITTEE ON ENERGY AND NATURAL RESOURCES

                        LISA MURKOWSKI, Alaska, Chairman
    JOHN BARRASSO, Wyoming               MARIA CANTWELL, Washington
    JAMES E. RISCH, Idaho                RON WYDEN, Oregon
    MIKE LEE, Utah                       BERNARD SANDERS, Vermont
    JEFF FLAKE, Arizona                  DEBBIE STABENOW, Michigan
    STEVE DAINES, Montana                AL FRANKEN, Minnesota
    CORY GARDNER, Colorado               JOE MANCHIN III, West Virginia
    LAMAR ALEXANDER, Tennessee           MARTIN HEINRICH, New Mexico
    JOHN HOEVEN, North Dakota            MAZIE K. HIRONO, Hawaii
    BILL CASSIDY, Louisiana              ANGUS S. KING, JR., Maine
    ROB PORTMAN, Ohio                    TAMMY DUCKWORTH, Illinois
    LUTHER STRANGE, Alabama              CATHERINE CORTEZ MASTO, Nevada
                          Colin Hayes, Staff Director
                    Patrick J. McCormick III, Chief Counsel
                     Kellie Donnelly, Deputy Chief Counsel
               Angela Becker-Dippmann, Democratic Staff Director
                    Sam E. Fowler, Democratic Chief Counsel
                    David Gillers, Democratic Senior Counsel

                                C O N T E N T S

                                  ----------

                               OPENING STATEMENTS

                                                                       Page
    Murkowski, Hon. Lisa, Chairman and a U.S. Senator from Alaska....     1
    Heinrich, Hon. Martin, a U.S. Senator from New Mexico............     3

                                   WITNESSES

    Hoffman, Patricia, Acting Assistant Secretary, Office of
      Electricity Delivery and Energy Reliability, U.S. Department of
      Energy.........................................................     4
    Cauley, Gerry W., President and Chief Executive Officer, North
      American Electric Reliability Corporation......................    14
    Highley, Duane D., President and CEO, Arkansas Electric
      Cooperative Corporation........................................    23
    McCurdy, Hon. Dave, President and CEO, American Gas Association..    34
    Bochman, Andrew A., Senior Cyber and Energy Security Strategist,
      Idaho National Laboratory......................................    50
    Welsh, Colonel Gent, Commander, 194th Wing, Washington Air
      National Guard.................................................    58

              ALPHABETICAL LISTING AND APPENDIX MATERIAL SUBMITTED

    Bochman, Andrew A.:
        Opening Statement............................................    50
        Written Testimony............................................    52
        Responses to Questions for the Record........................   220
    Cauley, Gerry W.:
        Opening Statement............................................    14
        Written Testimony............................................    16
        Responses to Questions for the Record........................   196
    Heinrich, Hon. Martin:
        Opening Statement............................................     3
    Highley, Duane D.:
        Opening Statement............................................    23
        Written Testimony............................................    25
        Responses to Questions for the Record........................   207
    Hoffman, Patricia:
        Opening Statement............................................     4
        Written Testimony............................................     6
        Supplemental Response to Question from Senator Hirono........   174
        Responses to Questions for the Record........................   190
    McCurdy, Hon. Dave:
        Opening Statement............................................    34
        Written Testimony............................................    36
        Responses to Questions for the Record........................   215
    Murkowski, Hon. Lisa:
        Opening Statement............................................     1
    Power Pack Group:
        Statement for the Record.....................................   236
    REM Technology Consulting Services, Inc.:
        Statement for the Record.....................................   240
    United Technologies Council:
        Statement for the Record.....................................   265
    Welsh, Colonel Gent:
        Opening Statement............................................    58
        Written Testimony............................................    60
        Responses to Questions for the Record........................   228

                               EFFORTS TO PROTECT

                          U.S. ENERGY DELIVERY SYSTEMS

                           FROM CYBERSECURITY THREATS

                                  ----------

                             TUESDAY, APRIL 4, 2017

                                           U.S. Senate,
                     Committee on Energy and Natural Resources,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 10:06 a.m. in
    Room SD-366, Dirksen Senate Office Building, Hon. Lisa
    Murkowski, Chairman of the Committee, presiding.

      OPENING STATEMENT OF HON. LISA MURKOWSKI, U.S. SENATOR FROM
                                 ALASKA

        The Chairman. Good morning. The Committee will come to
    order.
        I want to acknowledge my stand-in Ranking Member, Senator
    Heinrich. I understand that Ranking Member Cantwell is delayed
    a little bit coming from the game.
        [Laughter.]
        Very important.
        Senator Heinrich. I don't know what you are talking about.
        The Chairman. Very important.
        I am sure there are those that are happy this morning, and
    for those of us that love the West Coast and all things West,
    we are not as excited this morning. But anyway, we will look
    forward to Senator Cantwell coming later this morning.
        We are here today to not talk about basketball, but we are
    here to examine our collective efforts and those from Congress,
    the rest of the Federal Government and industry to protect our
    domestic energy delivery systems from cybersecurity threats.
        Here in the United States, we have purposefully built
    redundant systems to ensure resilience and technological
    advancements have improved system efficiencies. We have made
    our devices smarter and connected more of them to the internet,
    boosting consumer convenience and lowering costs. But as the
    so-called ``internet of things'' has become increasingly
    involved in all phases of energy generation and delivery, we
    have created even more avenues for cyber intrusion.
        This Committee has long recognized that our nation's energy
    sector is a popular target for bad actors. Everyone from
    individual hackers to nation-states who wish to do us harm.
    That is why we took action over a decade ago, through the
    Energy Policy Act of 2005, to protect the nation's critical
    grid infrastructure from both physical and cybersecurity
    threats.
        The 2005 law directed the certification of an electric
    reliability organization, now the North American Electric
    Reliability Corporation (NERC), to develop and enforce
    mandatory reliability standards. Congress specifically declined
    to provide the Federal Energy Regulatory Commission (FERC) with
    direct authority to establish such standards, instead opting
    for an industry stakeholder process to assist in formulating
    these highly complex and technical requirements.
        This decision has fostered a robust public/private
    partnership, and given FERC's current lack of quorum, it
    perhaps is even more prescient today. I am pleased that NERC's
    President and CEO, Gerry Cauley, is here to testify this
    morning.
        Last Congress, in the FAST Act, we moved again to protect
    our energy systems from cyberattack. As enacted, that law
    includes provisions from this Committee codifying the
    Department of Energy as the sector-specific agency for the
    energy sector and providing the Secretary with authority to
    address grid-related emergencies caused by cyberattacks,
    physical attacks, electromagnetic pulses (EMP) or geomagnetic
    disturbances.
        We will address the EMP issue, in depth, at a future
    hearing, but I am looking forward to hearing today from Pat
    Hoffman, the Acting Assistant Secretary for the Office of
    Electricity Delivery and Energy Reliability, about the
    Department of Energy's (DOE) effort to implement its FAST Act
    authorities.
        Finally, while our Committee has spent considerable time
    over the years examining the threats posed to the nation's grid
    infrastructure, today we will also assess efforts to secure
    natural gas pipelines. Given the interdependency of natural gas
    and electricity, it is imperative that these energy delivery
    systems are adequately protected. So I look forward to Dave
    McCurdy's testimony as the President and CEO of the American
    Gas Association. Mr. McCurdy, I am also curious to know why it
    is taking so long, particularly, as a former Chairman of the
    House Intelligence Committee, to get the requisite security
    clearance from the Energy Department, and we will have an
    opportunity to chat about that.
        In addition, this morning we will hear from Mr. Duane
    Highley, who is the President and CEO of the Arkansas Electric
    Cooperative Corporation and the Co-Chair of the Electricity
    Subsector Coordinating Council (ESCC) which interfaces with the
    Federal Government on behalf of industry.
        We also have Mr. Andrew Bochman, a Senior Cyber and Energy
    Security Strategist for the Idaho National Laboratory. This is
    the lab responsible for the Aurora experiment which first
    demonstrated how a cyberattack could impact physical assets.
        We will then hear from Colonel Gent Welsh, from the
    Washington National Guard, who has done a lot of important work
    to secure critical infrastructure in that state and develop a
    cyber workforce.
        We all recognize that this is no time for the United States
    to rest on the question of cybersecurity. The number and scope
    of attacks is ever-increasing and the resulting harm could be
    very significant. That is why our Subcommittee, under Senator
    Gardner's leadership, held a cybersecurity hearing last month
    and that is why we are broadening the effort here at the full
    Committee today.
        I would like to thank all of our witnesses for joining us
    this morning, and I look forward to their comments in just a
    few minutes.
        At this time, I will turn to Senator Heinrich for his
    opening comments.

                  STATEMENT OF HON. MARTIN HEINRICH,
                      U.S. SENATOR FROM NEW MEXICO

        Senator Heinrich. Thank you, Madam Chairman. As you
    mentioned, Senator Cantwell is running a few minutes late and
    asked me to fill in until she arrives.
        As a member of the Senate Intelligence Committee, I am
    acutely aware of the sophisticated threats that our energy
    infrastructure faces in cyberspace today. Cybersecurity is one
    of the most serious challenges to our economy and national
    security that we face as a nation-state. The future of warfare
    is moving further away from the battlefield each day and closer
    to the devices and the networks that everyday citizens, as well
    as the private sector, rely on and depend on.
        Protecting our nation from malicious cyber actors requires
    a very comprehensive approach, and keeping our energy
    infrastructure secure is absolutely central to that. In
    January, the U.S. Department of Energy warned that the U.S.
    grid ``faces imminent danger'' from cyberattacks.
        The Department's Quadrennial Energy Review (QER) warns that
    a widespread power outage caused by a cyberattack could place
    at risk the health and safety of millions of U.S. citizens. The
    QER included a number of policy recommendations for both
    regulators and Congress. The QER also pointed out that our
    electric grid has become increasingly reliant on a reliable and
    secure supply of natural gas, and it is essential to what we do
    that we do all we can to protect against cyberattacks against
    natural gas pipelines as well. So I am pleased that Congressman
    McCurdy will be testifying today on behalf of the American Gas
    Association to discuss pipeline cybersecurity as well.
        Top officials within the intelligence community have
    testified that energy infrastructure is an enticing target to
    malicious actors. Those officials have also warned that without
    action, the U.S. remains vulnerable to cyberattacks that could
    result in catastrophic damage to public health and safety,
    economic security and national security.
        I am pleased, again, to be an original co-sponsor of
    Senator King's bipartisan Securing Energy Infrastructure Act,
    which was the subject of last week's Subcommittee hearing, and
    I hope we can take action on this bill this year.
        Today we are also going to hear from Pat Hoffman, the
    Acting Assistant Secretary for the Office of Electricity
    Delivery and Energy Reliability at the Department of Energy.
    This office, in coordination with our national labs, helps
    protect our nation's energy infrastructure from a variety of
    cyber threats.
        I am very concerned the President is proposing significant
    cuts to the Electricity Office's budget that could impair our
    ability to meet the challenges foreign actors, and others,
    present to the security of our nation's energy infrastructure.
        Thank you for holding this full Committee hearing today,
    and I look forward to all of our witnesses' testimony.
        The Chairman. Thank you, Senator Heinrich.
        At this time, we will begin with our distinguished panel. I
    have introduced each of you already, so we will move straight
    to your comments. I would ask you to keep your comments to five
    minutes or less. Your full statements will be incorporated as
    part of the record.
        We will begin with Patricia Hoffman, again, the Acting
    Assistant Secretary for the Office of Electricity Delivery and
    Energy Reliability at the U.S. Department of Energy, and we
    will proceed down the line.
        Ms. Hoffman, welcome.

      STATEMENT OF PATRICIA HOFFMAN, ACTING ASSISTANT SECRETARY,
      OFFICE OF ELECTRICITY DELIVERY AND ENERGY RELIABILITY, U.S.
                          DEPARTMENT OF ENERGY

        Ms. Hoffman. So, thank you.
        Good morning. Thank you, Chairman Murkowski, Ranking Member
    Cantwell, Senator Heinrich, members of the Committee. Thank you
    for the opportunity to discuss the continuing threats facing
    our nation's energy infrastructure and the Department of
    Energy's role and authorities under the Fixing America's
    Surface Transportation, or FAST, Act. The Department of Energy
    is focusing on cybersecurity and resilience of energy delivery
    systems, and this is one of the Secretary's top priorities.
        Our economy, national security, and even the well-being of
    our citizens depend on the reliable delivery of electricity.
    The mission of the Office of Electricity Delivery and Energy
    Reliability is to strengthen, transform, and improve energy
    infrastructure to ensure access to reliable and secure sources
    of energy. The Department is committed to working with our
    public and private sector partners to protect the nation's
    critical energy infrastructure, including the electric power
    grid, from physical security events, natural and man-made
    disasters and cybersecurity threats.
        To address security, it is critical for us to be proactive
    and cultivate what I call, an ecosystem of resilience, a
    network of producers, distributors, regulators, vendors and
    public partners, acting together to strengthen our ability to
    prepare, respond and recover. We continue to partner with
    industry, federal agencies, states, local governments and other
    stakeholders to quickly identify threats, develop in-depth
    strategies to mitigate those threats and rapidly respond to any
    disruptions.
        DOE plays a critical role in supporting industry functions
    in several ways. Providing partnership mechanisms that support
    collaboration and trust, leveraging government capabilities to
    gather intelligence on threats and vulnerabilities and sharing
    actionable intelligence with energy owners and operators in a
    timely manner. We also support energy sector best practices,
    incident coordination and response and innovation through R&D
    for the next generation physical and cyber systems.
        In the energy sector, the core critical infrastructure
    partners consist of the Electric Sector Coordinating Council
    and the Oil and Gas Sector Coordinating Council. Through these
    partnerships, the energy sector and the government share
    emerging threat data and vulnerability information.
        An example of this type of collaboration is a Cybersecurity
    Risk Information Sharing Program (CRISP), a voluntary public/
    private partnership, that is funded by industry, administered
    by the Electric Sector Information Sharing and Analysis Center
    and supported by the Department of Energy.
        Another example of how the Department supports the cyber
    posture of the energy industry is through the Department's
    Cyber Capability Maturity Model, which helps private sector
    owners and operators better evaluate their cybersecurity
    capability. This tool allows organizations, regardless of size,
    type or industry, to evaluate, prioritize and improve their own
    cybersecurity capabilities.
        Beyond providing guidelines and technical support to the
    energy sector, the Department also supports an R&D portfolio
    designed to develop advanced tools and techniques to provide
    enhanced cyber protection for key energy systems.
        Intentional, malicious cyber threats challenge our energy
    systems and are on the rise in both number and sophistication.
    This evolution has profound impacts on the energy sector. Since
    2010, the Department has invested more than $210 million in
    cybersecurity research development projects that are led by
    industry, universities and national laboratories. These
    investments have resulted in more than 35 new tools and
    technologies.
        Threats continue to evolve. The Department of Energy is
    working diligently to stay ahead of the curve. The solution is
    an ecosystem of resilience that works in partnership with
    local, state and industry stakeholders to help provide the
    methods, the strategies and the tools needed to help protect
    local communities through increased resilience and flexibility.
        To accomplish this we must accelerate information sharing
    to inform better local investment decisions and encourage
    innovation and use of best practices to help raise the energy
    sector's security maturity and strengthen local incident
    response and recovery capabilities, especially through the
    participation and training programs, disaster and preparedness
    exercise.
        Building an ecosystem of resilience is, by definition, a
    shared endeavor, and we must continue to keep a focus on
    partnerships. This is an imperative.
        I thank you for the opportunity for being here today, and I
    look forward to answering any questions that you may have.
        [The prepared statement of Ms. Hoffman follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you, Ms. Hoffman.
        Next we will turn to Mr. Gerry Cauley, welcome.

      STATEMENT OF GERRY W. CAULEY, PRESIDENT AND CHIEF EXECUTIVE
        OFFICER, NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION

        Mr. Cauley. Thank you and good morning, Chairman Murkowski,
    Ranking Member Cantwell and Senator Heinrich and members of the
    Committee. Thank you for conducting this timely hearing to
    assess the progress and challenges of securing the power grid
    which is critical to our nation's security and well-being. The
    threat of cyberattacks by nation-states, terrorist groups and
    criminal actors is at an all-time high.
        In December 2015, a cyberattack in the Ukraine left over
    225,000 customers without power for several hours. This
    indicates that nation-state adversaries have the tools and
    clearly now the will to disrupt the grid of another nation.
        More recently in the U.S., although no part of the grid was
    affected, we saw a million electronic devices all part of the
    internet of things, captured and used in a denial of service
    attack disrupting major internet service providers.
        We've seen increases in ransomware, data theft and other
    criminal activities across all sectors of our economy.
        NERC's role is to assure the reliability and security of
    the bulk power system through mandatory standards, compliance
    monitoring and enforcement and reliability assessments. Our
    independent board and staff are unaffiliated with system owners
    and operators.
        FERC approves NERC's standards and enforcement actions in
    the U.S. and has authority to direct NERC to develop new or
    revised standards.
        As a nation, we share an interconnected grid with our
    neighbors which is why NERC is international in scope, spanning
    the United States, Canada and Mexico.
        Our cyber standards are written with inputs from the best
    experts in industry and provide a strong foundation for
    security practices.
        NERC and its eight regions also have cyber experts, who
    conduct hundreds of site visits every year to assess security
    controls. We're finding that power companies take cybersecurity
    very seriously with strong attention at the top from CEOs and
    boards.
        Grid control cyber assets communicate over private
    networks, including fiber, microwave and lease circuits. They
    are isolated from business systems and from the public
    internet.
        Utility personnel are screened and well-trained. Companies
    are using advanced security services from third party providers
    to maintain the latest threat information.
        Most importantly, power companies know they must
    continuously monitor and detect suspicious activity, isolate
    malware and destroy it before an attack happens, commonly known
    as the ``kill chain.''
        As flexible and risk-based as our standards are, I firmly
    believe we cannot win a cyber war with regulations and
    standards alone. Industry must be agile and continuously adapt
    to threats. To do that, we need robust sharing of information
    regarding threats and vulnerabilities.
        NERC operates the Electricity Information Sharing and
    Analysis Center. Our role is to assimilate intelligence, to
    share trusted information with industry and the government and
    to recommend specific actions.
        One of our most effective tools in this effort is the
    Cybersecurity Risk Information Sharing Program, as mentioned by
    Ms. Hoffman. Developed by the Department of Energy, CRISP has
    been adopted by NERC and deployed across wide areas of the U.S.
    grid to continuously detect malicious activity and share that
    information with industry.
        NERC can also issue formal alerts to industry at three
    levels of urgency, two of which require responses.
        NERC conducts an annual grid assurance, grid security
    conference and training events and frequent classified
    briefings.
        We also conduct a continent-wide cyber and physical
    security exercise, called GridEx, with over 4,000 participants
    from industry and government across North America engaged for
    two days responding to a simulated massive attack on our grid.
        To date, there's not been a single cyberattack in the U.S.
    resulting in customer outages. This is an exceptional record
    and is due, in large part, to the vigilance of NERC, industry
    and our government partners; however, we will never be
    complacent. The risk is very real, and we have to work hard
    every day to stay ahead of our adversaries.
        I'll close by mentioning a few challenges ahead: securing
    millions of electronic devices being installed on distributed
    energy systems and behind the mirror; ensuring the security
    chain within our--security of our global supply chain; building
    a more robust public/private model to coordinate strategy and
    resources between the government and industry; expanding the
    sharing of classified information; filling a growing gap in
    cyber workforce; coordinating across critical infrastructures
    like telecom, finance and gas; and investing in grid
    resilience, including strategic reserves.
        I thank you for the time this morning, and I look forward
    to your questions.
        [The prepared statement of Mr. Cauley follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you, Mr. Cauley.
        We will next turn to Mr. Duane Highley, the President and
    CEO of the Arkansas Electric Cooperative Corporation.

      STATEMENT OF DUANE D. HIGHLEY, PRESIDENT AND CEO, ARKANSAS
                    ELECTRIC COOPERATIVE CORPORATION

        Mr. Highley. Thank you.
        Good morning, Chairman Murkowski, Ranking Member Cantwell,
    Senator Heinrich and members of the Committee. Thank you for
    the invitation to testify today. I'm speaking on behalf of
    Arkansas Electric Cooperative Corporation where I serve as CEO
    and the National Rural Electric Cooperative Association which
    represents 900 not-for-profit consumer-owned utilities serving
    42 million people in 47 states.
        I also serve as one of three co-chairs of the Electric
    Subsector Coordinating Council, or ESCC, a CEO level, public/
    private partnership serving as our subsector's principle entity
    in coordinating with our senior government counterparts on
    policy level issues. The 30 CEOs on our council meet regularly
    with senior officials from the White House, Department of
    Energy, Department of Homeland Security, Federal Energy
    Regulatory Commission, Federal Bureau of Investigation, et
    cetera.
        The electric sector, like other critical sectors, is now at
    the front lines of international warfare. We're under constant
    cyberattack. Many of those attacks are sponsored by foreign
    enemies and nation-states.
        Though the recently updated Quadrennial Energy Review
    recommends protecting the electric sector as a national
    security asset, it's important to remember that most of the
    critical infrastructure is owned and operated by private
    industry. So, for that reason, we must have timely access to
    actionable information obtained through the defense and
    intelligence gathering capabilities of our government. We have
    to work together to protect the grid.
        Our traditional design of the electric grid relies on
    defense in depth to maintain reliability. We designed the grid
    to survive significant natural disasters with minimal
    interruption and generally quick recovery. That same redundancy
    makes the grid very resilient to intentional cyberattacks.
        The electric sector is also the only sector with mandatory
    enforceable reliability and cybersecurity standards developed
    through NERC. We have to meet these standards and verify
    compliance through audits conducted by NERC's regional entities
    or face fines and penalties, potentially as high as $1 million
    per day per violation. And we take those standards very, very
    seriously.
        That said, just relying on defense, in depth and mandatory
    standards is not enough. That's why we're developing real time
    communication environment for sharing threat information
    between government and industry.
        Real time sharing is great but both parties have to play. I
    can share with you examples of times in the past when we became
    aware that our government counterparts knew about a developing
    threat, but were unable to share it because of the classified
    nature of the threat itself. Often we've learned of threats
    from private sector sources well before our government
    counterparts chose to share them with industry.
        One of the primary initiatives of the Electric Subsector
    Coordinating Council is to work together to improve information
    sharing in both directions, government to industry and industry
    to government.
        I believe that we've developed a mutual trust relationship
    and we've obtained some security clearances but not enough
    across the sector and not enough at a higher level of
    clearance, and we have contributed to the development of and
    deployed tools such as DOE's cybersecurity capability and
    maturity model, the Electric Information Sharing and Analysis
    Center, the E-ISAC, the Cyber Risk Information Sharing Program,
    or CRISP, in partnership with DOE and the national labs.
        These tools, clearances and briefings have helped, but we
    can still do more. We have to work together and we have to be
    able to trust one another to communicate threat information in
    real time.
        I'm pleased to report we've already met with Secretary
    Perry at DOE and leadership at the White House and FERC in the
    transition, and I'm confident in their commitment to maintain
    the momentum of the prior Administration in supporting, funding
    and staffing our many developing projects.
        In particular, we're very pleased at the response of DOE
    for greater assistance to smaller electric systems such as
    cooperatives and municipals. Last year DOE provided funding to
    the trade associations to assist their member utilities in
    improving cyber and physical security. The co-ops have used
    these funds to create the Rural Cooperative Cybersecurity
    Capabilities Program, or RC3, to assist the smaller utility
    systems.
        ESCC has also recently developed a Cyber Mutual Assistance
    Program modeled after existing mutual assistance programs where
    utilities mobilize staff across the country to help restore
    service after a disaster. The Cyber Mutual Assistance Program
    provides a steady cadre, a ready cadre, of IT staff to assist
    in restoration of critical systems, if needed. We already have
    93 member systems, including 18 cooperatives, on board. So now,
    80 percent of all utility customers in the United States are
    covered by this program.
        In summary, the electric sector has mandatory enforceable
    cybersecurity standards and redundant design providing defense
    in depth to protect us. But that's not the entire answer to
    defending against an ever-changing threat.
        To bridge the gap, we need an ongoing dialogue and ever
    more open information sharing, finding ways to provide more and
    higher level security clearances to our staff who are at the
    front lines, rapidly declassifying and sharing threat
    information and jointly developing new solutions to protect
    against this threat.
        I look forward to your questions.
        [The prepared statement of Mr. Highley follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you, Mr. Highley, we greatly appreciate
    that testimony.
        Next we turn to Congressman Dave McCurdy, the President and
    CEO of the American Gas Association. Welcome, Congressman.

    STATEMENT OF HON. DAVE McCURDY, PRESIDENT AND CEO, AMERICAN GAS
                              ASSOCIATION

        Mr. McCurdy. Thank you, Chairman Murkowski, Senator
    Heinrich and members of the Committee. As the Chairman
    indicated, I am here as the CEO of the American Gas Association
    (AGA). I'm also the former Chairman of the House Intelligence
    Committee and former CEO of the Electronic Industries Alliance.
    I also served on the board of the Software Engineering
    Institute and co-founded the Internet Security Alliance in
    partnership between the electronic industry's alliance and
    CyLab at Carnegie Mellon University. So, I have to say, I've
    been engaged in internet policy since before it was called
    cybersecurity.
        AGA represents more than 200 local energy companies that
    deliver clean natural gas to more than 72 million customers.
    Natural gas meets more than one-fourth of the United States'
    energy needs and is the foundation fuel for a clean and secure
    energy future.
        Alongside this opportunity natural gas offers comes serious
    responsibility to protect pipeline systems from cyberattacks.
    Technological advances have made natural gas utilities better
    able to serve our customers; however, there is a recombinant
    challenge with a more connected industry, as we become a target
    for increasingly sophisticated cyber adversaries.
        Natural gas utilities meet that threat via a commitment to
    security, skilled personnel, technological advances and
    partnership with the Federal Government.
        I'd like to highlight four critical areas related to
    pipeline and energy sector cybersecurity.
        First, natural gas utilities understand and take very
    seriously cyberattacks and cyber threats. This drives us to
    employ the best technology and personnel available to protect
    our systems and the customers that we serve. This obligation
    starts at the top. AGA member utility executives assign the AGA
    commitment to cyber and physical security demonstrating their
    dedication with a call to action to ensure natural gas
    pipelines remain resilient to cyber and physical security
    threats.
        Second, energy security interdependence. Recently the
    electric sector has increased the use of natural gas for power
    generation. With that comes a greater need for coordination.
    Natural gas utilities focus on safe and reliable gas delivery
    and they utilize a variety of assets in contractual plans to
    secure that reliability. We welcome electric generation
    customers, but stress the gas/electric interdependency policy
    should preserve and enhance, not decrease, natural gas system
    reliability for all customers, both gas and electric. In this
    regard, the importance of having adequate gas pipeline
    infrastructure must not be overlooked.
        And third, we need to maintain our existing security
    partnerships. Gas utilities maintain a pipeline security
    partnership with our statutory partner, the Transportation
    Security Administration. Industry also works closely with DOE,
    as we've heard from Ms. Hoffman and Gerry Cauley. These vital,
    non-regulatory partnerships are cooperative and support a more
    effective risk management approach to security. Further,
    disturbing the continuity of our security partnerships by
    reshuffling pipeline security authorities will not make us
    safer. It will simply add uncertainty to the mix.
        And last, as we've heard, public/private collaboration is
    paramount. Industry needs better government cyber threat data
    delivered in real time, quicker dissemination of classified
    threat information and a closer working relationship with
    sector agencies, law enforcement and the intelligence
    community.
        And finally, we should reform how industry leaders receive
    security clearances, as the Chairman and others have mentioned.
    For me, this is not a mere talking point. Despite my military,
    congressional and intelligence experience and currently holding
    a DoD clearance, I have not received a DOE security clearance,
    SCI, that I applied for over a year ago to be able to sit in on
    some of the discussions that we have at the ESCC and other
    areas, and I am the leader of the Natural Gas Sector for this
    industry.
        America's natural gas delivery system is the safest, most
    reliable energy delivery system in the world. Security is woven
    into the natural gas utility culture and our members apply a
    portfolio of tools to stay ahead of cybersecurity threats. One
    of our most important tools is partnership with the Federal
    Government.
        Chairman, thank you for the opportunity to testify. I look
    forward to the exchange of ideas.
        [The prepared statement of Mr. McCurdy follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you, Congressman McCurdy.
        Next, we turn to Mr. Andrew Bochman, who is with us today
    from Idaho National Labs.
        Thank you.

        STATEMENT OF ANDREW A. BOCHMAN, SENIOR CYBER AND ENERGY
             SECURITY STRATEGIST, IDAHO NATIONAL LABORATORY

        Mr. Bochman. Good morning, Chairman Murkowski, Ranking
    Member Heinrich, or depending upon her proximity, Cantwell, and
    distinguished members of the Committee, I thank you for holding
    this hearing and inviting Idaho National Laboratory's, or
    INL's, testimony on the protection of our energy delivery
    systems.
        I am INL's Senior Cyber and Energy Security Strategist. In
    this capacity, I provide guidance to DOE, and INL leadership on
    matters related to protecting national energy infrastructure
    against mounting cyber and physical threats. I am here today to
    share impressions on the state of cybersecurity in the energy
    sector and provide an update on DOE and national lab actions.
        I just returned from a USAID-funded trip to Estonia where I
    joined a team of U.S. state-level energy regulators, led by the
    National Association of Regulatory Utility Commissioners, or
    NARUC. We provided cyber training to Black Sea energy
    regulators, including commissioners from Ukraine, target of two
    outage-causing cyberattacks.
        The possibility of similar attacks or worse on U.S. energy
    infrastructure has been much on the minds of DOE, INL and some
    of your colleagues, including Senator King and co-sponsors
    Risch, Heinrich, Collins and Crapo. Last year they drafted the
    Securing Energy Infrastructure Act, and just last month,
    Senators Cantwell and Wyden wrote a letter to President Trump
    urging him to maintain, as 2015's FAST Act codified, DOE
    primacy over grid security matters.
        Concern for such an attack on U.S. energy infrastructure is
    well warranted. I pause at five reasons. Number one, the
    aforementioned successful attacks on foreign transmission and
    distribution energy infrastructures. Two, the now daily
    drumbeats of damaging cyberattacks on U.S. Government and
    private sector systems. Three, profound shortage of skilled
    industrial control system security professionals. Number four,
    manufacturer's zeal to embed new technologies in industrial
    systems and our eagerness for sound business reasons to buy and
    install these products in energy infrastructure. And lastly,
    five, while we make incremental improvements on defense, our
    attack surface and the attacker's ability to exploit it, are
    expanding at a much, much faster pace.
        Cyber risk futurists, myself included, are experiencing a
    palpable sense of foreboding that our nation's current security
    activities will not yield the transformational changes that we
    need; however, some significant improvements are in the offing.
    DOE's Office of Electricity Delivery and Energy Reliability, or
    OE, INL and our peer national laboratories are working via
    multiple policy and programmatic pathways to make a difference.
    Here are six, high impact examples.
        Number one, DOE's Cyber Threat Intelligence and Information
    Sharing Program, you've heard it referenced previously, CRISP,
    is currently in place at dozens of large U.S. utilities and
    efforts are underway to substantially improve both the
    timeliness and the helpfulness of the security warnings they
    receive.
        Two, INL and industry partners are on the homestretch of a
    threat-informed, engineering-centric assessment and mitigation
    activity at a large U.S. utility. We call this approach,
    Consequence-driven, Cyber-informed Engineering, or CCE. It
    clarifies and prioritizes the way we look at high consequence
    risks within control systems environments.
        Methodology lessons harvested from this pilot will be
    shared with other partners to expand the nation's ability. And
    I'd like you to remember this phrase, ``to engineer out the
    cyber risk from our most critical energy infrastructures.''
        Number three, INL assists DOE with initiatives to make grid
    systems more resilient against geo-magnetic disturbance and
    electromagnetic pulse events.
        Four, with the substantial expansion of the industrial
    control system security workforce as a goal, INL and its
    partners, Pacific Northwest National Lab (PNNL) and Sandia,
    U.S. universities and commercial training partners are teaming
    to create curricula to make this happen as quickly as possible.
        Five, OE's Infrastructure Security and Energy Restoration
    Organization, ISER, is the seat of the Department's sector
    specific agency authority. INL and PNNL are supporting the
    build out of ISER's cyber incident response and coordination
    capabilities in conjunction with DHS, NERC's Electricity
    Information Sharing and Analysis Center and other grid security
    stakeholder organizations.
        And lastly, per the 2013 Executive Order on improving
    critical infrastructure cybersecurity, INL supports ISER as it
    convenes the energy sector's Section Nine energy companies.
    Among several capabilities requested so far, is a multi-lab
    environment where energy sector systems can be analyzed from a
    threat informed cybersecurity vantage point with specific
    mitigation actions shared securely among the lab's equipment
    suppliers and asset owners and operators as well.
        I'll leave off there.
        Thank you very much for inviting me to testify today. And I
    look forward to your questions.
        [The prepared statement of Mr. Bochman follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Mr. Bochman, thank you.
        We are also able to welcome this morning Colonel Gent Welsh
    with the Washington Air National Guard. We appreciate your
    service.

              STATEMENT OF COLONEL GENT WELSH, COMMANDER,
               194TH WING, WASHINGTON AIR NATIONAL GUARD

        Colonel Welsh. Thank you.
        Madam Chair Murkowski, Ranking Member Cantwell, Senator
    Heinrich and members of this Committee, my name is Colonel Gent
    Welsh. I'm the Commander of the 194th Wing for the Washington
    Air National Guard, the Air National Guard's 89th Wing and the
    first cyber wing in the air guard. Thank you again for the
    honor to participate in such a crucial conversation today.
        A quick disclaimer. Please note that I appear before the
    Committee today in a National Guard Title 32 status. Although
    I've served as a National Guard Officer for more than 23 years,
    my testimony today has not been reviewed or approved by anyone
    at the United States Air Force or the Department of Defense.
        As you know, the front lines of the next conflict are not
    overseas in some country folks can't find on a map, they are
    right here, right now, every day at the doorstep of every owner
    and operator of our nation's critical infrastructure.
        Developing a plan to best secure our critical
    infrastructure is challenging, primarily because more than 85
    percent of our critical infrastructure to include our
    electrical grid, our water sources and our health care system,
    is owned by the private sector. As you know, the private sector
    doesn't always consider government a valuable partner.
        In Washington State, we believe we've broken that mold.
    Major General Bret Daugherty, the Adjutant General in our
    state, is also the Governor's Homeland Security Advisor and
    head of all emergency management efforts. These positions give
    him tremendous convening authority within the state to pull
    people together. And with the leadership of Senator Cantwell
    and members of our House delegation, such as Representatives
    Kilmer and Heck, we're able to get a variety of stakeholders
    around the table routinely to include public and private owners
    and operators of critical infrastructure to discuss and prepare
    for a catastrophic cyber event.
        As everyone on this Committee knows, when something does
    happen, it's going to happen in a state, and we've made our
    agency a key player in our state in the security and critical
    infrastructure.
        We're fortunate that our state law provides our agency with
    policies and authorities that provide resources before and
    after a cyber event. We have more than 600 cyber professionals
    that work in the Washington National Guard at our disposal. And
    because we conduct continual outreach efforts, both private and
    local governments know what we can offer. And that's critical.
    The private sector has to understand and know the government
    can provide something tangible and resources of value if you
    want their true cooperation. That's why policy authorities and
    capabilities matter. If government has clear policies and plans
    for either resources or outside assistance, that makes a
    decision for private industry to work with government easier.
        Washington is proof the government and private industry can
    not only get along, we can actually work together and very
    well. The Washington National Guard considers Pacific Northwest
    National Laboratory, the Idaho National Laboratory and several
    major utility companies, strong partners. The same could be
    said for Microsoft, Boeing and other Washington State
    corporations.
        Our efforts began five years ago when we formed an
    integrated project team within state government to fully
    develop the first ever, significant Cyber Incident Response
    Plan for the state. I'm talking about the state, not just state
    government networks. We've truly led this nation and positioned
    Washington in many ways as a national thought leader in
    critical infrastructure cybersecurity at the public level.
        Since then, we've continued to work with our state critical
    infrastructure sectors to exercise and refine our plan. I'd be
    remiss not bragging about the more than 600 cyber professionals
    in our organization. Several assist in our local utility
    companies, the Snohomish County Public Utilities District, with
    a critical cyber assessment back in 2015. Their work was beyond
    successful and was incredibly enlightening.
        Since then, we've had a steady stream of visitors to
    include the former Secretary of Defense, Ash Carter, who wanted
    to learn more about how cyber partnerships work in Washington
    State.
        It starts with the power of the citizen airman and soldier,
    our typical solider and airman participates one weekend a month
    and two weeks a year. Outside of that obligation they have
    full-time jobs, many working in the IT or critical
    infrastructure sectors.
        They bring in a remarkable understanding of their private
    sector's needs and their capability shortfalls. They also bring
    in credibility with these organizations as National Guard
    members. They are folks that understand government and private
    industry, and they're able to bridge those gaps and that's a
    tremendous combination.
        Looking forward, we're hopeful to bring a cyber schoolhouse
    to Washington State that allows us to train members of critical
    infrastructure sectors alongside our National Guard members.
    Those are the folks that are on the front lines these days in
    this environment.
        Sharing information and best practices among those tasked
    to defend this nation within the private sector is how we'll be
    more resilient to a significant cyberattack.
        And for those on the panel, I'm going to go off script for
    a second. We've solved some of the security clearance issues in
    our state, and I'd be happy to share some info on that.
        Again, I'd ask that you review my submitted testimony for
    further information and certainly thank you for the opportunity
    to appear in front of this Committee from the other Washington.
        And my sympathies for the Gonzaga Bulldogs because I'm a
    Washingtonian.
        Thank you.
        [The prepared statement of Colonel Welsh follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        The Chairman. Thank you, Colonel Welsh. I appreciate you
    summing things up from the state's perspective because I think
    it is critically important that we appreciate how that all
    comes down to the states and the responsibilities there.
        There is an awful lot to talk about this morning in the
    spaces that you all have discussed in your comments.
        Let me start with the information sharing protections, and
    I will refer back to the opening comments that I made with the
    FAST Act that we passed last Congress.
        We codified DOE as a sector-specific agency for energy. We
    provided the Secretary with some authority to direct utility
    action in emergency situations. We also included provisions to
    protect some of the sensitive information from disclosure.
        I will start with you, Mr. Highley. As the ESCC Co-Chair,
    how important are these provisions that we included in the FAST
    Act in its effort to help facilitate the timely sharing of the
    cyber threat information? And the CRISP program was mentioned,
    the Cybersecurity Risk Information Sharing Program. What we set
    up, is it helping at all? Is it too early?
        Mr. Highley. Yes.
        The Chairman. If you can speak to what we have put into law
    and what we are seeing as of this point?
        Mr. Highley. We're very grateful for the FAST Act
    authority, and we're supportive of the naming of DOE,
    reinforcing DOE, as the sector-specific agency for electric
    energy and the electric sector.
        That's where we want to see that. That's where the subject
    matter experts are, and that's where we have begun to develop a
    trust relationship between the CEOs that are part of the ESCC
    and our government counterparts.
        And I think trust is the key to information sharing. We
    need to be able to get that information over the wall from
    government to industry and then back over from industry to
    government. That's why it was so crucial for us to see this
    transition go so well from one Administration to the next and
    see the support of Secretary Perry.
        We support the direct action from DOE, in the event of an
    emergency. The FOIA protections are essential because this is
    critical infrastructure we're talking about that's at the front
    lines of international warfare. We can't just have that, you
    know, here's the most important target, be disclosed. So, we're
    supportive of that.
        The Chairman. What about within the Quadrennial Energy
    Review and the recommendations there, the recommendation that
    FERC be granted the direct authority to promulgate the
    reliability standards?
        I am assuming you do not support that recommendation from
    the QER? I would also ask you to speak to what it actually
    means for the stakeholder process that has been established
    through Congress.
        Mr. Highley. So----
        The Chairman. Mr. Cauley, I will ask you to comment on that
    as well.
        Mr. Highley. We're supportive of the NERC process, because
    NERC has the subject matter experts that go through and vet a
    proposed, a proposal, from FERC before it gets to industry.
    It's a very complex machine we're talking about modifying, and
    we think we need to rely on those experts at NERC which has
    both industry and government input to make sure that things are
    done properly.
        And when you talk about making a change to the electric
    system, FERC has the authority now to order NERC to make a
    rulemaking and they can give them the timeline. So, it can
    happen very quickly and it has. I know Gerry will comment on
    that. But we're supportive of keeping that authority at NERC.
        The Chairman. At NERC.
        Mr. Cauley, on the stakeholder process?
        Mr. Cauley. Yes, thank you.
        It's probably, I did read through most of the QER report
    and the one thing that I would struggle with the most is that
    additional authority at FERC to do standards.
        When there's a crisis and something needs to be done
    quickly, standards are not the solution. Basically, we need to
    get directives and marching orders out, but not through a
    standard process.
        To be able to have the industry expertise at the table and
    our process to get the best solutions for standards is very
    effective. We can produce a standard quickly. We were told to
    do the physical security standard in 90 days and we did it in
    87 days. We could do a standard quicker than that. It's just
    really, in an emergency, it's not where you head to do
    emergency standards.
        Thank you.
        The Chairman. Thank you.
        Senator Heinrich.
        Senator Heinrich. Thank you, Madam Chair.
        Congressman McCurdy and also Colonel Welsh. I thought maybe
    you could start, Congressman, to speak just a moment about how
    this bottleneck in security clearances actually directly
    impacts your ability to manage risk and the timelines? Then,
    Colonel Welsh, you mentioned that you might have some thoughts
    on how we can speed this up? If the two of you can speak to
    that, together, I think that would be very helpful for all of
    us.
        Congressman McCurdy?
        Mr. McCurdy. Sure, Senator. And everyone around here knows
    it is just Dave.
        So, the affected policy starts at the top and one of the
    improvements, I think, over the last few years in the couple
    decades I've been dealing with this, is having the C Suite, the
    CEOs, the Senior Executives in corporations, focused on this
    issue of cybersecurity. It is not just a CIO issue. There
    weren't even CIOs when we started this process. So it's
    critical that you have senior executive level engagement.
        Information sharing, in such groups, like the SEC, our
    groups, our safety committee within AGA and by the way, every
    investor-owned utility in the natural gas sector is a member of
    AGA. They've signed a commitment to security which is a call to
    action.
        They are into developing the expertise within their
    companies and working with government and cross sector to
    improve our overall security. By the way, many of them, over
    half now, are both electric and gas combination companies.
        What we find is critical is that when we have CEOs being
    able to sit across the table with each other and with
    government on a regular basis, but then also in emergencies or
    in threat situations, to be able to receive information. Now we
    don't need to know sources and methods, the old terms we used
    to use. What we do need to know, though, is whether it's
    actionable, indirect or directly relevant for our particular
    environment and situation.
        So it is a bit frustrating when we can't and I know a
    number of the CEOs on the electric side because they've been
    working a little bit longer through a formal process, had
    clearances. I've had--I was in the gang of eight, so I've had
    all kinds of different clearances. I currently have a DoD
    clearance. But if it's at a Secret level, that really doesn't
    help when we're talking Ukraine or some of those other issues
    that are timely when they came up. It's more of a backlog. I'm
    not in control of that. We do the reviews.
        I applied. The Department is actually trying with
    officials, executives, to move the process. But it's, the
    clearance process, across government which is, kind of, fouled
    up there. I hate for it to be a personal example, but it's one
    that----
        Senator Heinrich. Actually, I think it helps for it to be a
    personal example.
        Mr. McCurdy. Yeah.
        Senator Heinrich. Because you are an unusual example.
        Mr. McCurdy. Yeah.
        Senator Heinrich. And if it is this tough for you, you can
    imagine how tough it is for lots of people in the utility
    industry broadly on both the electric and the gas side.
        Mr. McCurdy. Absolutely.
        Senator Heinrich. Colonel Welsh, do you want to talk about
    some of the advances----
        Colonel Welsh. Yes, sir.
        Senator Heinrich. ----you have been able to make in
    Washington State?
        Colonel Welsh. So, you can't have a partnership without
    access and sharing. Information sharing without any partners at
    the table is tough.
        We view, from the National Guard's perspective and really
    in Washington State, I'll give you the Washington State case
    study.
        Every state, every state governor has a Homeland Security
    Advisor. That Homeland Security Advisor has the authority in
    that position to sponsor folks in that state for clearances. So
    we have the luxury of our Homeland Security Advisor being our
    TAG and our Emergency Management Authority, so it, sort of,
    makes it easy. It's all in the same family.
        But the fact that he is able to do that is a tremendous
    trust builder for our partners out there. Nothing makes more
    trust built, you can't build it without a, we'll put you in for
    a clearance. Here's the stuff to sign. Sorry, you'll probably
    get somebody asking your neighbors, you know, how you do, but
    it's tremendous for us. But it starts at that Homeland Security
    Advisor level. Again, we, sort of, wait for again, federal
    policy to, sort of, catch up with that.
        I think on the DHS side what we would like to see is it's
    fairly easy to get a security clearance at the secret level.
    It's that TS level that takes a bit more of a nudge, and that's
    really the only thing that matters. You know, secret is great,
    as everybody knows, but it's at that TS level, you don't need
    to know the sources and methods, but there are some things
    going on out there that are of interest with our sectors.
        Thank you.
        Senator Heinrich. Absolutely. Thank you for your input on
    that.
        I yield back my remaining second.
        The Chairman. Thank you, Senator Heinrich.
        Senator Risch.
        Senator Risch. Well, Madam Chairman, first of all, thank
    you for holding this hearing.
        I sit on the Intelligence Committee also and after all the
    testimony I hear there, I am convinced that the next major
    event in America is going to be a cyber event. Obviously, we
    are always vulnerable, not vulnerable, but at risk for some
    type of kinetic attack. But I am convinced that the next major
    one that affects large numbers of people is going to be
    cybersecurity.
        So it is important that we do talk about this and continue
    to work at it because from everything we are told, we are
    running fast but need to run faster to catch up to where we
    need to be.
        Mr. Bochman, thank you for coming from Idaho to testify
    today. Members of this Committee grow weary of me over the
    years explaining to them how important the INL is and being the
    lead lab for nuclear energy. And now, of course, we are
    developing our expertise on cybersecurity and becoming a lead,
    if not the lead.
        Could you tell my fellow members here the unique
    capabilities that our lab has as far as moving in to that
    position?
        Mr. Bochman. Sure, thanks, Senator.
        Thanks, Senator Risch, sure, you bet.
        Idaho National Lab, without making too much of it, is a
    national----
        Senator Risch. No, go ahead and make too much.
        [Laughter.]
        Mr. Bochman. It's a softball.
        It is the nation's nuclear energy lab where nuclear energy
    has been developed with, I think, 52 test reactors with a small
    modular reactor on the way.
        Senator Risch. And the first one, of course.
        Mr. Bochman. I think we, I think people there figured out
    it was probably a better idea to monitor and control those
    somewhat dangerous processes from a comfortable distance, and
    therefore they were highly incented to create control systems
    that would allow them to do that. Hence, early control systems
    theory and practical engineering knowledge developed ahead of
    the curve there in Idaho.
        When cybersecurity started to become on people's minds,
    certainly it landed in the IT universe first, but very quickly,
    I know folks realized that the same basic types of systems that
    help run banks and retail stores, et cetera, are also at the
    heart. They're either both at the heart of control systems
    operations, industrial control systems and they're also next
    door neighbors to them, as utilities, all our businesses and
    have IT organizations and with convergence.
        We used to talk about convergence of information technology
    and operational technology as something that was coming that we
    needed to prepare for. The most recent SANS Industrial Control
    Systems Conference in Florida, two weeks ago, we all admitted,
    this group of subject matter experts, that it's happened, that
    these, now these two parts are inextricably fused and it's one
    of the ways adversaries can get in.
        So Idaho is a great testing ground with that experience and
    also with its facilities. It has a test grid that has both
    transmission and a variety of distribution voltage assets,
    substations, transformers, control centers and linemen. It's
    integrated into the larger regional grid in a way that makes
    it, I'll say it this way, while we use models a lot and have to
    use models for a grid that's becoming ever more complex and get
    a handle on the types of risks that are there.
        Every once in a while, maybe more than every once in a
    while, it behooves us to validate the models with real world
    testing. And it's been several times now, in my short time
    there, where we've run real world tests that have shown that
    the models we rely on so much and trust, weren't quite right
    and need to be tweaked and tuned. Once you do that, then you
    can have confidence in them again.
        Senator Risch. Could you talk just briefly about the test
    bed that we have there for doing that?
        Mr. Bochman. Yeah, well this is the--there's both the grid
    assets I described. There's also communications test bed
    assets. So you can have both.
        Everyone knows a full electric indoor natural gas operation
    requires copious communications assets. Those are also subject
    to cyberattack and just as disruptive if you aim at them as if
    you aim at the actual industrial control systems that they
    support.
        It's also the home of a program where, in the past,
    industrial control system suppliers sent equipment and the
    security subject matter experts did an exhaustive security
    assessments of it both at the hardware/software and firmware
    level in conjunction with the suppliers to give them feedback
    on how they might harden and build more secure systems in the
    future.
        In my testimony, there's a call now from the Section Nine
    utilities to, in some form, bring about a modernized version
    that fits the purposes of the Industrial Internet of Things
    (IIoT) and world in which we live in. And so, I'll stop there.
        Senator Risch. Okay. Thank you, Mr. Bochman.
        Thank you, Madam Chair.
        The Chairman. Senator Manchin.
        Senator Manchin. Thank you, Madam Chairman.
        I will be quick.
        [Laughter.]
        Thank you, Madam Chairman, I appreciate it very much.
        Thank all of you for coming.
        My concern is reliability, and I think this first question
    will go to Mr. Cauley. Today our reliability organizations,
    electric utilities, are tasked with maintaining our electric
    grid in an increasingly challenging environment. As you all
    know, a perfect storm of factors has put baseload units at risk
    and states are more frequently using outer markets solutions to
    rescue units and to ensure their citizens and businesses have
    reliable, affordable electricity.
        In the meantime, aging infrastructure, extreme weather
    events, the threat of cyberattacks, rapidly changing fuel mix
    and over regulations are increasingly testing our nation's
    electric grid. Several times throughout the month of January in
    2014, the upper Midwest and mid-Atlantic experienced
    temperatures below zero. The Eastern portion of the PJM grid
    flirted with rolling blackouts.
        On January 7th, a winter record was set with 141,132
    megawatts of electricity being used. PJM is the nation's
    largest grid operator, basically overseeing 180,000 megawatts,
    and that's cutting it pretty close.
        Interestingly, following the winter of 2014, AEP reported
    that nearly 90 percent of its coal plants scheduled for
    retirement ran during the Polar Vortex. If not for that, there
    would have been rolling blackouts. Coal helped keep the lights
    on, as we know.
        Last week PJM released a report that said it could keep the
    lights on with the generation portfolio that is 86 percent
    dependent on natural gas. Current installed capacity, this is
    their actual figures, it is 33 percent of coal, 33 percent
    natural gas, 18 percent nuclear and 6 percent renewable. But
    more of that coal is going to be retired.
        So my question would be this. I understand that your
    organization's reliability assessment from last year did not
    even flag PJM as having major near-term reliability issues, but
    I have to ask, is PJM correct? It seems highly risky for them
    to depend 86 percent on one fuel in an environment when all we
    talk about is fuel diversity.
        Mr. Cauley. Thank you, Senator, for that question.
        As a reliability engineer for 37 years, I think one of my
    most important factors is a diversity of our fleet and a
    diversity of our fuel mix. And it is a concern. We've done a
    number of studies over recent years on the changing resource
    mix and its impacts on reliability. One of those----
        Senator Manchin. Do you think PJM is correct?
        Mr. Cauley. I think currently, PJM----
        Senator Manchin. 86 percent?
        Mr. Cauley. ----does have a very robust supply, capacity
    supply, in the near-term years.
        The one concern I would have with PJM is the dependence on
    gas. And the concern there is, not so much the adequate amount
    of gas, but the dependence on gas infrastructure and supply
    during times of extreme weather when you'd be competing.
        Senator Manchin. You would be concerned about the
    reliability, putting all your eggs in one basket?
        Mr. Cauley. Yes, exactly.
        Senator Manchin. What do regulators need to do to help move
    natural gas into a position where it can serve as a baseload?
        I know that the pipeline, I know the things, the pressures
    can freeze up. I have known all of that.
        We are very blessed in West Virginia. We have a little bit
    of everything, coal, gas, wind, solar. We try to do it all, but
    throwing all your eggs in one basket.
        Here is my problem. I have not spoken to one CEO of a major
    utility that believes that they have the right mix in their
    energy portfolio. Not one. They think they have been forced
    because of what we have done here, forcing them in a direction
    that reliability is not demand. FERC is not even looking at
    reliability as their responsibility. What happens when the
    system collapses and goes down? Who gets blamed?
        Mr. Cauley. Me.
        [Laughter.]
        Senator Manchin. Oh, okay.
        Mr. Cauley. Well, I will be one of the folks. But it is
    creating some difficulty, and that's why we're working hard to
    make sure we get that information out.
        You know, one of the challenges is newer, inverter-based
    generators like renewable solar and wind don't have the
    rotating mass and the stability of larger units. So that
    creates a reliability challenge. We do see stability margins
    starting to shrink, so what we're trying to do is make sure
    everyone has the information needed to make the best decisions
    going forward.
        Senator Manchin. I am sorry, sir, my time is running short.
        This one is for Mr. Highley. In the U.S., approximately six
    percent of electricity is lost when it is transported from a
    generation facility across transmission distribution lines to
    consumers. Our transmission and distribution lines waste enough
    energy each year to power more than two million homes for one
    month. Each year they lose that much power.
        The Department of Energy in the past did a significant
    amount of work on superconductive materials in an effort to
    reduce transmission line losses. This research has apparently
    not led to any significant breakthroughs. If we are going to
    become more energy efficient, we need to improve these
    transmission distribution of electricity.
        Mr. Highley, what is the industry doing to improve the
    efficiency of electricity transmission and distribution lines?
    And do you expect any developments in the near term that will
    lead to dramatic line loss reductions?
        I am to understand that there are so many new products on
    the market we have not used yet.
        Mr. Highley. As a CEO of a member-owned system, I work for
    my members and I am absolutely incented to save every dollar I
    can for them. And if I could save them money by using those
    technologies for transmission distribution, we would be doing
    it. We don't see it as cost-effective today to deploy that.
        Senator Manchin. To deploy the new technology?
        Mr. Highley. Correct. If it was--in the areas where it's
    cost-
    effective----
        Senator Manchin. So you are saying the six percent loss is
    more----
        Mr. Highley. Is----
        Senator Manchin. ----cost-effective than buying the new
    equipment?
        Mr. Highley. Correct, correct in terms of life cycle costs.
        Senator Manchin. So basically our whole----
        Mr. Highley. I have to face the people who pay the bill
    every month. That's my Board of Directors.
        Senator Manchin. I understand that. So I would say that
    basically all of----
        Mr. Highley. They're my----
        Senator Manchin. ----those senators who have been really on
    energy efficiencies that we have been trying to do here is all
    for naught when it comes down to cost?
        Mr. Highley. It's just an economic choice.
        Senator Manchin. I understand.
        Mr. Highley. Yes, sir.
        Senator Manchin. I understand.
        Thank you.
        The Chairman. Thank you, Senator Manchin.
        Senator Cassidy.
        Senator Cassidy. I want to congratulate you all. I have
    never seen a collection of testimony with more acronyms,
    outside of maybe, Department of Defense. It was quite
    remarkable. And as a rule, they did not overlap. It wasn't as
    if I learned it here and then I would see it there, so good
    job, guys.
        Ms. Hoffman, let's start off with that which we have not
    yet discussed, the electromagnetic pulse (EMP) resilience. Now
    that is not related to cyberattacks, that is just the sun
    decides to send off something one day.
        I was not clear from your testimony, and you may have said
    it and I just did not follow, to the degree that we are now
    positioned to robustly endure such an electromagnetic pulse
    from either a military or the sun. I think I understand it
    could be either, right? How are we positioned to withstand
    that?
        Ms. Hoffman. So thank you, Senator, for the question.
        Electromagnetic pulses and GMD disturbances are basically
    electromagnetic disturbances that will affect not only the
    electric sector but multiple sectors in the United States.
        Within the utility sector, we have taken an aggressive
    posture of looking and investigating further the
    electromagnetic issues. The Department has partnered with the
    Electric Power Research Institute and developed a strategy for
    looking at EMP.
        Senator Cassidy. I have limited time, so how, if either EMP
    was discharged in the atmosphere or the sun sent off such an
    issue, if you will, how well are we now positioned to respond
    to it?
        Ms. Hoffman. So, it would depend where it was set off in
    the atmosphere. It would have multiple effects on transformers
    and components on the system.
        There is a need to do some additional hardening on the
    system to mitigate some of those effects. But a lot of the
    discussions are what is the strategy and what is the most cost-
    effective solution to implement?
        Senator Cassidy. I am not sure I am getting an answer to my
    question, but implied, is that we are not there yet.
        Ms. Hoffman. We are still working toward what is the best
    solution for the sector.
        Senator Cassidy. And so, if we are still working toward
    what is the best solution it suggests to me we have not yet
    implemented anything.
        Ms. Hoffman. No, the industry has implemented some
    solutions. There have been specific utilities that have looked
    at shielding, hardening of substations. So there has been
    progress with respect to some mitigation measures.
        Senator Cassidy. Okay, but still I am guessing
    vulnerability. Again, it is some. You are speaking in
    fractions. You are not speaking in significant fractions. We
    are 50 percent of the way there is not what I am hearing. I am
    hearing some have done something.
        Ms. Hoffman. Some, yes, utilities.
        Senator Cassidy. Colonel Welsh, you speak of failure of
    imagination. Now, it is a little bit, you know, existential.
    How do you imagine the future?
        I remember being in Israel and somebody came up, some young
    whiz kids came up, with some software that used an eye to
    imagine where in software would be a vulnerability and to
    anticipate what would be a response. Maybe that is how we
    imagine, but I was not sure how should we imagine?
        I saw your testimony, we need to have a robust response and
    the guy from Johns Hopkins on my staff gave me something that
    he has written also using National Guard as part of that
    response. But I guess my question is how do we imagine where
    the next cyberattack would be from?
        Colonel Welsh. Well, I think that the failure of
    imagination covers a wide spectrum, so my concern on the
    failure of imagination is we've now acknowledged that a
    cyberattack is possible, but huge gaps in capabilities, you
    know, at the federal level, at the state level.
        Senator Cassidy. As I read your testimony, again, I am
    skimming it, I apologize, because there is much you did not
    say, it was written, so I am skimming that what you wrote and
    spoke of a failure of imagination as it regards management.
        But is there a way to anticipate from whence the attack
    comes because, again, something else I read said that the folks
    who are going to attack us will probably save their best stuff
    for, you know, they are not going to tip us off as to what
    their most effective attack would be.
        Colonel Welsh. Correct.
        I think there are certain countries out there that we know
    we can potentially expect some interest from now and in the
    future. But again, back to the failure of imagination. It is,
    you know, I think we have decided that we can be attacked, but
    there is not much more imagination that is happening in terms
    of response and recovery. That is really where my concern is
    right now.
        Senator Cassidy. Response and recovery.
        Colonel Welsh. Correct.
        Senator Cassidy. Is there a way to anticipate what the
    attack itself would be, beyond the say, eye, that perhaps I was
    exposed to in Israel?
        Colonel Welsh. Maybe I'm not completely clear on your
    question, Senator.
        Senator Cassidy. Gentlemen, you seem to be----
        Mr. Bochman. If you don't mind, Senator.
        Yeah, there's definitely ways to anticipate, and I'd say
    that's happening every single day.
        If we're talking about a game changing cyberattack on U.S.
    infrastructure, the one it sounds like you're teasing out,
    we're looking for, we're always looking for that. But things of
    a lower order of impact are happening every day and people are
    monitoring them. They're identifying where traffic is coming
    from. They're monitoring signatures and behavioral
    abnormalities and jumping on them and protecting some things,
    blocking some things, not responding later on.
        Senator Cassidy. So you can look at a signature of an
    attack and therefore block something from that particular
    signature from thenceforth, sort of thing?
        Mr. Bochman. Yes, that's business as usual.
        Senator Cassidy. Gotcha.
        Mr. Bochman. That's happening now, fairly broadly. And I
    would imagine, I could say on behalf of the energy sector,
    that's happening broadly.
        Senator Cassidy. And quickly, because I am almost out of
    time.
        Mr. Bochman. Sure.
        Senator Cassidy. You mentioned this, kind of, paradigm
    shifting attack and that is what I was getting at.
        Mr. Bochman. Right.
        Senator Cassidy. How do we anticipate that?
        Mr. Bochman. Ah, to your point, if it's done well, we'll
    have a hard time anticipating it.
        Senator Cassidy. Okay.
        I yield back. Thank you.
        The Chairman. Thank you.
        Senator Stabenow.
        Senator Stabenow. Thank you very much, Madam Chair, and
    thank you to all of you for your testimony. As we talk about
    cyberattacks, of course, we are being attacked right now
    through our communication systems and so on, so this is a very
    important conversation, as we look at capabilities and what
    could happen, what is happening, what will happen.
        Mr. Bochman, I think you talked a little bit about, or you
    have included in your testimony a little bit about, something
    that I heard from a cybersecurity expert at the University of
    Michigan who suggested to me that we need to move away from the
    checkbox compliance mentality when it comes to securing our
    energy infrastructure and move toward building cybersecurity
    into the very fabric of our energy systems. For example,
    firewalls and anti-virus software described to me as merely
    afterthoughts and add-ons, and what we need is to be building
    security into the system.
        What is being done to transition toward an approach that
    fully integrates cybersecurity practices and technologies into
    the systems that are so critical to the economy and national
    security?
        Mr. Bochman. I appreciate the question, Senator Stabenow.
        First of all, in defense of checkboxes and mandatory
    compliance regimes that have, I think, demonstratively improved
    the security of the grid in the United States, you've got to
    achieve a baseline level of hygiene first before you can start
    thinking about playing even more advanced forms of defense.
        Hygiene is what you get when you, if you, adhere to the
    recommendations of say, the SANS top 25 security controls or
    the NERC CIPs or the C2M2 maturity model from DOE. We're trying
    to have people make sure that, it's kind of like the analogy
    for folks is, you know, you brush your teeth and you take
    vitamins and you eat well and get exercise so that you don't
    fall prey to all manner of different infections and bugs that
    could slow you down or worse, right? You want to, at least, be
    there with a level of hygiene. So, I'm responding to the, I
    think, compliance or checkbox mentality thing.
        In terms of building security in, yes, every security
    professional in their earliest days says, we need to make sure
    that we don't try to bolt security on after the facts, after
    something is deployed because that's both more expensive and
    less effective than it is to just get it right the first time
    when you design it, at the design stage, right? The challenge
    is so that's mom and apple pie for security folks.
        The problem is with the energy sector, it's true in all
    sectors, but if you're more IT you're used to replacing
    products on a fairly regular basis. You know, your laptop is
    giving you trouble after a year, or two, or three. It's time
    for a new one anyway, even faster sometimes for cell phones and
    other technologies.
        With assets that are deployed in industrial applications
    like the grid, like natural gas, the way we buy those systems
    and budget for them expects that they will be operational for
    10, 20 or 30 years or at least that's the way it's been up
    until now. And so, once that thing has been designed,
    purchased, deployed and now you're on maintenance cycle, you
    live with that thing. And so, bolt on, bolting on security,
    adding it after the fact, is your only choice.
        I think, though, to conclude, a strong push this is
    something that, I think, all of us here and Senators as well,
    the Committee could do, is it's almost like the oath, vow to do
    no more harm. If we could start to have more rigorous, I won't
    say enforcement, but encouragement, incentivization, is the
    right word, to help people get it right the first time on the
    next generation of products before those are rolled out. I
    think that would be a demonstrable sign of progress.
        Senator Stabenow. Thank you.
        Ms. Hoffman, thank you for being here. Distributed energy
    systems are notable for their efficiency and their flexibility.
    However, in terms of cybersecurity, what are the benefits and
    risks to having a distributed energy network and what does an
    increasingly decentralized network mean for the government and
    industry's role in combating cyber threats?
        Ms. Hoffman. So, thank you, Senator.
        Distributed energy resources are both, provide a value and
    a risk, as you have mentioned.
        From the value side of it, it brings generation closer to
    the load or closer to where demand is so it can provide
    consumers with a greater sense of resilience and reliability by
    being closer to where the customers are demanding that energy.
    It also provides a great diversity and resources from solar,
    from distributed solar, to natural gas generation and onsite
    generation. So it does provide that diversity.
        On the security side of things, though, it's still another
    generation asset that has communications and controls, and one
    needs to look at building security into supply chain or
    generation assets as part of the system. So, it's very
    important that even if you're a solar manufacturer or you're a
    distributed energy manufacturer, that if you have a control
    system and you have a computer or any sort of computer-aided
    control, you really need to embed cybersecurity into those
    devices.
        Senator Stabenow. Thank you very much.
        Thank you, Madam Chair.
        The Chairman. Thank you, Senator Stabenow.
        Senator Wyden.
        Senator Wyden. Thank you, Madam Chair.
        It has been an excellent panel. What is striking is how
    pervasive this challenge is. I am on the Intelligence
    Committee. We have cyber threats there. I am on the Finance
    Committee, and we are concerned about our data with respect to
    our taxes. And then, of course, we are concerned about the
    energy grid. So I want to, sort of, try to touch on several
    pieces of the puzzle this morning. I think I am going to start
    with you, Mr. Cauley.
        First, I am particularly interested in this concept of red
    teaming because we saw this report coming from Houston where
    essentially a team of hackers, for a couple hundred bucks, got
    into a Houston oil refinery. Basically, they broke through an
    electric lock. They installed a small credit card-sized device
    to penetrate the company's control systems.
        I think the government ought to be involved in red teaming.
    What do you think of that concept?
        Mr. Cauley. Well, I think one of the things that the NERC
    standards does is require the electric companies to do
    vulnerability testing which includes red team penetration tests
    and things like that to the critical systems. And I think part
    of our risk approach on our standards is that they're not
    prescriptive but tell people what they need to do.
        Senator Wyden. I guess I would like to hear if you think
    more should be done on this.
        Mr. Cauley. I think more should be done, could be done, and
    I think partnering with government to support that would be
    useful.
        Senator Wyden. Good.
        Let's hold the record open on that point because I would
    like to hear, given the fact that you think more needs to be
    done, what additional work you think would make sense. Okay?
    Could you get that to us, say, within, say, 10 days?
        Mr. Cauley. Yes, yes, sir.
        Senator Wyden. Very good.
        One other question for you and one point just with respect
    to the group. I have been trying to assess our witnesses'
    position on strong encryption, because I think strong
    encryption is vitally important to the security and well-being
    of the American people and certainly the energy grid. There are
    people around here who would be very interested in weakening
    strong encryption. I have made it clear that I will filibuster
    any bill that weakens strong encryption because it will leave
    Americans less safe.
        If any of you have views you would like to advance to the
    contrary, I would like to see that in writing as well. In other
    words, if you do not agree with the notion of how important
    strong encryption is, I would like to have anybody share their
    views as to why we should not be for that.
        The last point I want to make, Mr. Cauley, goes again, back
    to you, and it really involves the Internet of Things.
        Last year, James Clapper, who was then the Director of
    National Intelligence, talked about how the Internet of Things
    was going to play a bigger and bigger role as it relates to
    surveillance and monitoring and location trackers. I would be
    interested in wrapping up this round of questions, we
    understand the important role that the North American Electric
    Reliability Corporation has, in energy lingo that is NERC. I
    would be interested in your wrapping up, if you could explain a
    potential role for NERC as we try to address the Internet of
    Things and ensuring that we prove, as is my guiding philosophy,
    that security and privacy are not mutually exclusive, that
    smart policies can give us both. What kinds of things could
    this NERC outfit, the North American Electric Reliability
    Corporation, help us with as we try to come up with a smart
    policy given the challenge with the Internet of Things?
        Mr. Cauley. Well, the distribution system, the Internet of
    Things we see, largely at the customer distribution level, are
    not really within NERC or FERC's purview at the federal level.
        Senator Wyden. But they could give advice.
        Mr. Cauley. They do create a significant risk to the bulk
    power system and the denial of service attack, that we saw last
    October, could inflict harm on the bulk power system. So we are
    very concerned about making sure that distributed systems and
    customer systems are not easily hacked and captured and become
    a weapon in and of themselves. Heavy encryption and protection
    of those systems and making sure that we work with vendors to
    make sure that they're not easily hacked is our focus.
        Senator Wyden. If you could give us additional suggestions
    with respect to NERC and if there are other organizations that
    could do that work, I would be very interested in it because I
    have not yet seen a government or an entity like NERC get this
    right yet and it is obvious because it is an incredibly
    challenging area.
        Could you get us any thoughts you have, say, since I was
    looking at it for the next 10 days, on how they and other
    bodies could help us tackle the Internet of Things in this
    manner that would show that a smart policy means that security
    and liberty are not mutually exclusive, that you can have both.
    Is that agreeable?
        Mr. Cauley. Yes, sir, we'll do that.
        Senator Wyden. Great, thank you.
        Thank you, Madam Chair.
        The Chairman. Thank you, Senator Wyden.
        Senator Hoeven.
        Senator Hoeven. Thank you, Madam Chairman.
        Essentially, the question I have is how to secure against
    the interconnectedness of things? I would like each of you to
    respond to that for just a minute. I mean, everything is
    interconnected now, right? So if something goes wrong in one
    place that has a potential cascading effect throughout the
    system.
        How do you create circuit breakers or safeguards to prevent
    that because on the one hand you have to be fully integrated,
    and we are constantly trying to integrate more and more and get
    rid of silos? On the other hand, if something happens in one
    sector of our energy infrastructure, then potentially that is
    going to impact everybody else with a potential cascading
    effect. How do you handle that issue, the interconnectedness of
    things, I guess, unless you have a better way to term it?
        Ms. Hoffman. I will start and then----
        Senator Hoeven. Sure, that would be great.
        Ms. Hoffman. So first of all, I think you need to test both
    devices and networks. So you must start testing these networks
    to make sure you identify vulnerabilities. As you're looking at
    components that are connected, you must understand where their
    vulnerabilities are in the components.
        But also, build a system where cybersecurity is built in so
    that you know what normal operations of the system is and what
    abnormal operations or abnormal communications are so you can
    block them and prevent them from causing damage.
        Senator Hoeven. Can you create circuit breakers that both
    integrate systems and isolate them, when necessary?
        Ms. Hoffman. So on the circuit breakers, that's a specific
    technology that has the specific function so you should be able
    to look at that.
        Mr. Cauley. So a lot of work has been done to
    compartmentalize within the power system. As I mentioned in my
    oral remarks, the grid operates over private networks,
    microwave and fiber systems that are owned and managed by the
    company. So there is a lot of isolation and departmentalization
    to protect those systems.
        We require, within our standards, that critical assets, we
    understand the architecture and design of that system so we
    understand all the connection points and vulnerabilities from
    that.
        The more you get further down into the system, into
    distribution and distributed resources and those kinds of
    things, then we're talking about more amass devices and
    instruments and communications and it's much more difficult
    because the sharing is the value is everybody is contributing.
    It is a dilemma to try to operate a very interconnected grid
    and a compartmentalized and protected grid at the same time.
        Senator Hoeven. As you develop your cybersecurity, as you
    integrate, are you building those types of circuit breakers or
    isolation systems to separate yourself from the problem? Is
    that a standard part of cybersecurity?
        Mr. Cauley. Separation and compartmentalization is
    standard. There are some of the more most critical assets in
    control centers and so on now where people are using one way
    data diodes and things like that, that would control the flow
    so no harmful information can come in. So that's, sort of,
    early stages of some of that more advanced work.
        Mr. Highley. Just on the policy level, cross-sector
    coordination is critical. Oil and gas, telecommunications,
    electricity, finance, water, all depend on one another, and so
    what we're doing at the ASCC is bringing those sectors together
    in cross-sector dialogue, bringing our ISACs, that give us
    information about cyber threats and sharing those cyber threats
    amongst the different entities so that we're all working toward
    the same goal.
        Senator Hoeven. Dave?
        Mr. McCurdy. Senator, that's a great question.
        In the natural gas sector, we're doing two things.
        One, we are delivering electrons. So we have automated
    controls. We have Industrial Control systems in those. But we
    also are moving molecules. So it's a bit more of a mechanical
    and physical process. In both are safety and security,
    cybersecurity, concerns. And so, we have the automatic control
    systems that are separate from a safety standpoint we need to
    have backup for that and a second tier. In there we have
    shutoff valves. Again, because of pressurization and
    compressibility, it's a little slower process so we're able to
    have some physical control over it as well. And those are
    separate.
        In addition to the other basic hygiene where you try to
    separate your enterprise system from your operations system.
    And even though you have human beings crossing between and
    probably the most significant risk, we haven't talked about it,
    but people are still the most important risk and we test that
    on a regular basis.
        But there's a--you need that layer of--going beyond a
    layered defense but layered resiliency. And I think that's the
    culture we're trying to instill in our center.
        Senator Hoeven. The other question would be how do you know
    if you are safe? Maybe you alluded to it, but you just do that
    through testing? I mean, you run various scenarios and do the
    tests?
        Mr. McCurdy. Yes.
        Senator Hoeven. To try to assess whether you are safe,
    whether you have these safeguards and whether they work?
        Mr. McCurdy. Yes, sir. We do.
        And to one of the other questions, I think to Ron Wyden's
    question about red teaming. We participate in GridEx. We have
    another one coming up in a few months, and natural gas, I think
    for the first time, will actually be participating in that as
    direct. So as we look at the interdependence of the bulk power
    system and we're a portion of that, maybe one-third now.
    Natural gas is being used more.
        But you also have to recognize we deliver one-fourth of the
    country's energy directly to more than 74 million customer
    sites, not individuals. So, we've got multiple tiers here, and
    that's why it's important that we coordinate with DOE but also
    TSA and transportation, because we're a transportation system.
        There's multiple layers here, and that's why it's important
    to have a hearing like this so we can, kind of, get a better
    understanding. It's not just as simply, just one overlay.
        Senator Hoeven. Are you seeing attacks on a regular basis,
    be it cyber or other types of attacks on the system?
        Mr. McCurdy. Absolutely, yes. We have detection
    capabilities, and even my small association has that
    capability. We've seen it. We're targets. If you have energy in
    your title or name, you've been attacked for a long time.
    You've been surveilled. You've been mapped. You've been all
    these. And it's no longer, you know, what we used to see as
    individuals, it's nation-state, it's other.
        Senator Hoeven. Yes.
        Mr. McCurdy. Ramping of those threats. You have to assume
    that you've been penetrated, and then what do you do from
    there? So, it's a whole different conversation than it was just
    a few years ago.
        I know the Senate and Congress is much more acutely aware
    today than it was a few years as well.
        The Chairman. Thank you, Senator Hoeven.
        Senator King.
        Senator King. Thank you, Madam Chair.
        Mr. Bochman, your paper on the Ukraine attack in December
    2015 was, in large measure, the inspiration for S. 79, the bill
    that Senator Risch and I have put in. Could you give some
    background on what the concept is and what we are trying to do
    in that bill and the concept of places in the grid where we can
    protect ourselves by, perhaps, having analog technology?
        Mr. Bochman. Sure, thanks for the question, Senator King.
        And it is, sort of, a follow on, in a sense from Senator
    Hoeven's. The paper the Senator is referring to is the National
    Security Case for Simplicity in Energy Infrastructure. And so,
    all those questions, all the other points about cascades and
    interdependencies of the systems in different sectors, all that
    are enthusiastically embracing adding more technology into
    systems that used to just be electromechanical and were
    protected, in large part, through isolation. Each would have a
    trained engineer, who knew the way that thing worked all the
    way down to their bones, like an engineer in a substation, for
    example.
        For, as I alluded to in my testimony, many very good
    business reasons, usually having to do with efficiency and cost
    savings, but also the ability to see what's going on better.
    We've connected everything. Convergence has happened. Now we
    are adding communications and sensor and communications
    technologies into the most mundane parts of our different
    interconnected systems. So, they're all talking with each
    other.
        I was going to say to Senator Hoeven, our ability to
    influence the wide deployment of Internet of Things and
    Industrial Internet of Things is very minimal. So one of the
    best things that we can try to do to focus our thinking is
    prioritization. And this gets to some of the issues in the case
    for the simplicity paper you're referencing.
        What are the systems that absolutely must be protected from
    a national security point of view? Because of the energy and
    other processes they support, it would be unacceptable as an
    economy or as a nation to lose them.
        Senator King. What we are talking about is finding those
    places, not the entire grid, but finding places where
    simplicity, and perhaps even old technology, could be an
    isolating factor. That is what we are talking about here.
        Mr. Bochman. Yeah and it's, kind of, neat because very
    selectively adding these types of analog or out of band or
    putting a human, a trusted human, back in the loop, doing that
    in a moderate way in only the holiest of holy places, allows
    you to then proceed with the modernization which brings all the
    benefits of the grid that we need to have in the future. So it
    allows you to do that. At the same time, it might let utility
    executives, natural gas executives and folks on the hill, sleep
    a little bit more soundly.
        Senator King. Thank you.
        Mr. Cauley, I think you touched on this and Dave McCurdy
    touched on it as well, I think. We are talking all about
    cybersecurity and cyberattacks, but in our own national
    security agencies, insider attacks have been the vulnerability.
    To what extent is the industry looking at its own people and
    how they are investigated and examined and how do we protect
    against a rogue employee who could do a lot of damage?
        Mr. Cauley. Insider threat is one of the top risks that we
    look at in both physical and cybersecurity side. And the more
    critical the job, the more critical the facility that the
    individual works at, the scale of, in terms of screening and
    review, doing background checks, goes up with that. So it's a
    well-known and a well-understood risk.
        It's not always perfect. I mean, there was one employee who
    several, a couple years ago, was at NERC ISO, who went through
    the normal background checks and turned out that it was a
    suspicious person, a foreign national that we didn't know about
    because it wasn't in the database. But to the extent that that
    information is available in--through a background check, that's
    a common practice.
        Senator King. Mr. McCurdy, I take it you see this as a
    threat as well?
        Mr. McCurdy. Yes, Senator.
        And beyond just the individual that may have nefarious
    motives, just lackadaisical security practices. We do social
    engineering testing of our own staff, and we actually got
    caught. This week we did one and creative IT staff and just
    clicking on the wrong link or not checking everything. We test
    that regularly and you have to.
        It's easy just to assume that because it looks like an
    email from me or someone else, doesn't mean, yup, you know,
    then you go check those lines. So there's a whole level, multi-
    levels, of testing with people to raise their awareness of what
    the threat is.
        Senator King. Mr. Bochman, I am out of time, but----
        Mr. Bochman. Super short.
        I just wanted to say that you asked about insider threat.
    You mentioned self-phishing, auto phishing, making sure people
    aren't clicking on those crazy things, and some of them are
    very realistic.
        When those people, when the attackers successfully phish
    you and they gain your credentials they know your login and
    password. They are insider. They have every right to use the
    applications and access the data to whatever authorization
    level you were given as that employee. They can proceed at
    pace. They're not hacking. They're not going against any--
    they're not bumping into any other security system. That's why
    everyone is so energized on that topic and still trying to
    figure out ways to start to take care of it.
        Senator King. Thank you, Madam Chair, and thank you for
    convening this important hearing.
        The Chairman. Thank you, Senator King.
        Senator Hirono.
        Senator Hirono. Thank you, Madam Chair, and I thank the
    panel.
        I have some questions for Ms. Hoffman. In your testimony,
    you explain that an ecosystem of resilience, working in
    partnership with local, state and industry stakeholders is the
    solution to staying ahead of ever-evolving cyber threats to our
    energy delivery systems.
        Is this ecosystem of resilience happening in every state
    because you have to work with the state level? I mean, it has
    to be present in every state? Is it?
        Ms. Hoffman. So, I think there is a--thank you for the
    question.
        I think there is a different level of maturity in the
    different states in creating an ecosystem of resilience. You
    could take the example here with Washington State and the
    National Guard and their ability to partner with a local
    utility and to do some testing. You also have some other states
    that are very sophisticated in information sharing with the
    fusion centers. And so, there has been some advanced best
    practices.
        I think the states really have the opportunity to take
    advantage of looking at their critical infrastructure and
    building that partnership through the supply chain into the
    electric industry and supporting cybersecurity.
        Senator Hirono. But this ecosystem is being created in
    every state at whatever the level of their systems are?
        Ms. Hoffman. I think it's a work-in-progress and there is
    maturing at the state levels, including the information sharing
    with the Federal Government with the state utility commissions.
        Senator Hirono. Do you have a model or what would work?
        Ms. Hoffman. I don't have a single model for what would
    work. I think there are components of what would be successful
    including information sharing, testing, partnerships.
        Senator Hirono. Do you assess what is going on in every
    state with regard to this ecosystem of resilience?
        Ms. Hoffman. The Department of Energy does not assess, but
    we do do energy assurance plans. We have worked, at least in
    the past, with the state energy offices in looking at energy
    assurance planning.
        Senator Hirono. Have you done this in Hawaii?
        Ms. Hoffman. The energy assurance plans? I believe so. I
    would have to go back and check for you.
        [The information referred to follows:]

                             INSERT FOR THE RECORD

        The Office of Electricity Delivery and Energy Reliability
    (OE) sponsored Hawaii, through the American Recovery and
    Reinvestment Act, to develop an Energy Assurance Plan. The
    Hawaii Department of Business, Economic Development and Tourism
    made a full udpate of the plan in March 2013 and has since done
    supplemental reviews and updates, including adding a new Fuel
    Shortage Emergency Response Measures Annex. Given the
    sensitivity of the critical infrastructure described in the
    plan, it is not available for public distribution, however DOE
    has a copy of the plan by agreement with the state.
        Senator Hirono. In addition to our own ecosystem, we also
    have a huge military presence in Hawaii. I am wondering whether
    your Department and the national labs have been called upon to
    provide technical expertise to the Department of Defense to
    help address potential cyber threats to our military
    installations?
        Ms. Hoffman. So thank you for that question. That's a very
    important relationship between the Department of Energy and the
    Department of Defense.
        I would answer this in a couple ways. We have an MOU with
    the Department of Defense, so we've been collaborating on a
    regular basis from an R&D perspective with the Department of
    Defense. In the FAST Act, there was a requirement in the FAST
    Act for DOE to work in partnership with DoD to look at electric
    sector critical assets in relationship to the Department of
    Defense. That was completed with the Department of Defense.
        We have also had innovation through microgrids that we've
    done with the Department of Defense. I'm sure you might be
    familiar with the SPIDERS activities which included several
    military bases in the Hawaii area as well as Colorado and some
    other states. So that is a very important relationship.
        Senator Hirono. With regard to the FAST Act, are there any
    concerns of moving the DOE office, the lead agency for
    cybersecurity for the energy sector, and going to Homeland
    Security, for example? Is that a concern, leading----
        Ms. Hoffman. So the FAST Act did codify the Department of
    Energy's role as the sector-specific agency, as well as we are
    the Emergency Support Function #12 and it has been mentioned
    many times in the hearing today as the primary point for
    security issues.
        Senator Hirono. So as far as you are concerned it should
    stay that way.
        Last month the President submitted a budget to Congress
    that would cut $2 billion, or nearly 53 percent, from four
    major DOE programs, including the office that you lead, the
    Office of Electricity Delivery and Energy Reliability.
        I am deeply troubled about the potential impact that this
    proposed funding cut would have to the cybersecurity for energy
    delivery systems R&D program. The CFDC's R&D program aligns
    federal and private sector priorities for important research
    that helps detect, prevent and mitigate the consequences of a
    cyber incident for current and future energy delivery systems.
        What will be the specific impact to the R&D program if
    these cuts are enacted next fiscal year?
        Ms. Hoffman. Senator, thank you for the question.
        As in your interest in the program, as the blueprint was
    released by the President there is, will be, the Secretary has
    announced as part of that blueprint, released that the mission
    of the department will change. We will focus on earlier stage
    research.
        The details of the budget aren't available at this time.
    We're working diligently to work through those details. I look
    forward to and would have probably more details, more
    information when the budget is released in May, in greater
    detail.
        Senator Hirono. That is being very diplomatically put, I
    would say.
        Thank you, Madam Chair.
        The Chairman. Thank you, Senator Hirono.
        Senator Franken.
        Senator Franken. Thank you, Madam Chair, for holding this
    Committee hearing. Boy, this is pretty hair-raising stuff.
        Colonel Welsh, you brought up in your testimony that we are
    not well prepared for what comes after a successful
    cyberattack. You say we have done little to anticipate and
    develop actual response capacity that would be needed post
    attack.
        The Chairman. That is interesting.
        Senator Franken. Can you elaborate on that? What does that
    look like? Would anyone else care to jump in too?
        Colonel Welsh. You bet, Senator.
        So my premise is basically that we've treated cyber
    different for a long time. Our view is cyber from an emergency
    response perspective can be looked at just like any other
    response that we undertake as a nation. So, through DHS and
    FEMA.
        Using the existing natural response framework, things like
    the National Cyber Incident Response Plan, but one of the most
    troubling things is, you know, we fight a lot of wildfires out
    in the State of Washington, there are things called resource
    types. We know what to call, what to order, what to buy, when
    something happens. We don't have any of that in cyber.
        If some cyber event happens tonight and it happens in the
    State of Washington, thankfully we've got a lot of cyber folks
    to help. But let's just say it happens in Idaho, and they don't
    have a whole lot. There's no way to get cyber resources.
    There's no cyber ninja force, for the most part, out there
    ready to call and organized in a way that can respond. That,
    sort of, goes back to the previous question before us on
    failure of imagination. We've not taken that next step from a
    response and recovery standpoint.
        And also, the acknowledgement that a cyberattack is, sort
    of, a cyber is an IT, sort of, issue. But the second and third
    order consequences that are emergency management issues, that
    are already handled by our existing emergency management
    processes, have to be brought into the discussion as well.
    Thanks.
        Senator Franken. Anyone else want to jump in on that?
        Mr. Highley. We all----
        Senator Franken. Does anyone not want to jump in on that?
        [Laughter.]
        Okay.
        Mr. Cauley. So, I would say first, Senator, that that's the
    purpose of our massive GridEx exercise we do. We basically
    break the system. We put people in the dark. We have massive
    disruptions in cyber and physical attacks.
        Senator Franken. So you do it at night?
        Mr. Cauley. We do it over a 2-day period.
        Senator Franken. Okay.
        Mr. Cauley. And it's simulated so no one actually gets hurt
    in the process. But with leadership from the White House and
    Energy and Defense and DHS, and the CEOs and leadership of the
    industry are on the table. We're working through the
    challenges.
        Senator Franken. Because the Colonel seems to be saying we
    are not prepared for this.
        Mr. Highley. There is a cyber----
        Mr. Cauley. One of the things that came out of this was the
    need to create a Cyber Mutual Assistance Program, and I'd like
    Mr. Highley to talk about that work.
        Mr. Highley. There is a cyber ninja force. It's in its
    early formation.
        Senator Franken. Cyber what force?
        Mr. Highley. Well, somebody said there wasn't a cyber ninja
    force. There is a cyber ninja force. It's the Cyber Mutual
    Assistance Program that's parallel to the utilities in the
    electric sector.
        Senator Franken. Is ninja an acronym or just----
        [Laughter.]
        There are too many acronyms.
        Mr. Highley. We have 93 member utility systems that are
    members of Cyber Mutual Assistance that will help each other in
    the event of a cyberattack and send their IT professionals to
    assist the others in restoration. That means that 80 percent of
    utility customers in the country are covered by that right now
    from the membership.
        Senator Franken. Because I think what the Colonel is saying
    that after this happens it is not just cyber.
        Mr. Highley. True.
        Senator Franken. It is the effects of the cyber.
        Mr. Highley. True.
        Senator Franken. And that we have got to be ready for that.
        Colonel, you were talking about the number of personnel
    that you have, cyber personnel or people prepared for this in
    Washington. What I am wondering about, and you talk about this
    too, is the need to train people in this. The need to, you
    called it a, some kind of school, schoolhouse, cyber
    schoolhouse program. Are we training enough people to do this?
    And how can we do that? That is the question.
        Mr. Bochman. There's an incredible dearth of trained
    utility qualified or industrial control systems, security
    personnel in the country, probably in the world. But where we
    need, the demand signals that we're getting from all over the
    place, are for a thousand or many thousands of these people who
    can touch that specialized type of equipment. We probably have
    hundreds from some informal surveys we've done.
        To your--go ahead.
        Senator Franken. I am sorry, but I am curious. What
    countries do this better than we do or which piece of it? In
    other words, I think, Russia attacks well.
        [Laughter.]
        I have this theory. You know, other? Who is good at
    attacking and who is good at defending and who has these
    people?
        I remember after World War II we took some of the German
    scientists.
        Mr. McCurdy. Well, Senator.
        Senator Franken. I am not suggesting--I think we need to
    have home grown and----
        Mr. McCurdy. Yeah.
        Senator Franken. Yes.
        Mr. McCurdy. Senator Franken, there's a lot in that
    question, but first of all, no one can surpass the United
    States in its offensive capabilities in the cyber arena whether
    it's national security agency or other confident, you know,
    classified areas. So, put that aside.
        China, Russia, Israel, in certain respects there are
    criminal elements. There are subnational levels, Iran. So, you
    know, there's multiple levels of capabilities.
        The question is what is the threat to us? And this is all
    risk assessment. If a nation-state decides they want to take
    down the grid, there are many ways to attack and it's not just
    cyber. It would be a combination of physical and cyber, if it
    got to that level because that's act of war.
        Now, there are other ways that people are attacking our
    systems. They either want to demonstrate capability. They want
    to, you know, steal information. So again, we have to plan for
    those different types.
        Recovery is a different question though, and I think you
    were, kind of, asking that other question. Recovery from the IT
    standpoint, the ICS, the control systems, that's where we need
    to work with the Federal Government and that's where the--we
    own 90 percent of the infrastructure out there so we have to
    have those backups.
        If you're talking about large units that could be affected.
    That's one issue. It's another if it's computer systems. And on
    my front, it's mechanical systems. If we have to restart pilot
    lights around the country, you know, in the dead of winter,
    it's pretty challenging.
        So there are multiple levels that we have to plan for. We
    do this with regard to storms. A lot of this activity you see,
    collaborative, is in fact the result of Superstorm Sandy where
    the Administration worked with utility sectors to respond to a
    natural disaster. So we've learned. Is it perfect? Never. Will
    it be perfect? You can't get there, but we're improving.
        Senator Franken. Okay. Thank you. I am way over.
        The Chairman. Thank you.
        Senator Cortez Masto.
        Senator Cortez Masto. Thank you, Madam Chair.
        I want to follow up on my colleague, Senator Franken. I am
    really interested in the Cyber Mutual Assistance Program. Can
    you elaborate? I am really interested in whether there is a set
    infrastructure to it and put on paper? And do you have
    involvement from the federal, state, local government, first
    responders, everybody that would be involved in an incident?
    And then, do you have regular table top exercises to address
    some sort of cyber threat that has an impact on a community's
    grid and the consequences of that?
        Mr. Bochman. If you don't mind I'd like to briefly go
    after, to answer your question, come back from Senator
    Franken's first question to Colonel Welsh of the National Guard
    and Cyber Mutual Assistance and how it is like and how it is
    unlike the mutual assistance that we often reference with
    storms and Sandy and such.
        We're all used to, utility folks, are all used to rallying
    when a hurricane or a tornado happens. You count on those
    proximate to you who weren't affected, who weren't damaged and
    they roll trucks and linemen and equipment and help out. That's
    a well-worn and very effective process.
        The thing in the cybersecurity world, and there's a
    subtlety here which I hope I can convey, they're all not
    interchangeable people. They all have, they're like specialties
    in the medical profession, all right? You can't take a brain
    surgeon and help someone set their leg and vice versa.
        So the people that are capable of bringing cybersecurity
    good effects after an incident are those most familiar with the
    particular type of equipment that that utility uses, which
    means, and DoD Under Secretary Paul Stockton who was in charge
    of mission assurance at the time articulated this, that your
    best ally when you need that type of help and it may come from
    a National Guard source, we're all looking to the National
    Guard increasingly for this capability is not the person in the
    utility that's right next to you.
        This could be a person in the utility on the complete other
    side of the country, but the control systems you use are the
    same make and model. And so, and not only that, since you knew
    that, you practiced and did exchanges beforehand and built a
    trust level with that person and a level of familiarity with
    that person. So that when you're in your time of great need,
    you knew who to call. You trusted them and they were familiar
    enough with your environment that you let them come. You trust
    them and they could potentially help you in that situation.
        Senator Cortez Masto. Okay, just so I understand, because
    what I am thinking about are, let me just put it in conceptual
    terms or rings. The interior ring is the cybersecurity
    specialists that responded at that level. The next would be
    community-wide, what is happening in that community and the
    responders that would be involved and the impact to that
    community and then whether it goes state and then federal.
        So what you are talking and what I hear is that the Cyber
    Mutual Assistance Program is that first ring. That is all that
    is involved and that is sharing that information back and forth
    to those cybersecurity experts who are addressing a response at
    that time. Is that correct?
        Mr. Highley. The Cyber Mutual Assistance Program is a
    written agreement that 93 member utilities have signed to share
    resources and then to trade who has what kind of system. Then
    it goes over to NERC and the exercise we do under GridEx where
    we get all the sectors together to practice the restoration,
    the rest of the circles. So working with state and local
    governments on restoration is what we also do with NERC,
    through GridEx.
        Senator Cortez Masto. Okay, that is helpful.
        Is that done on a regular basis or are there things that we
    need to improve upon those circles and that response?
        Mr. Cauley. Well, we do the GridEx exercise every two
    years. The next one will be November. The intervening time
    between there's a lot of building capability and doing mini
    exercises to develop that, test that capability.
        This coming exercise in mid-November will have a new
    emphasis on having state level participation and emergency
    response at the local and state level involved in the exercise.
    It's been there in the past. We just need to make it much more
    expansive this time around.
        Senator Cortez Masto. Thank you.
        Let me follow up very quickly on something that the
    Chairman started talking about. I have been sitting in a number
    of these committee hearings addressing cybersecurity threats.
    And thank you very much, it is such an important topic.
        One of the things I constantly hear is the need to be able
    to expedite and share classified information with private
    companies and utilities and with the federal level as well. I
    am curious, do any of you have suggestions that could improve
    CRISP's ability to distribute classified and unclassified
    information in a timely fashion while still protecting that
    classified content?
        Mr. Cauley. I'll--I'd like to answer the question more
    broadly even than it was asked.
        I think what's happened is that in the last couple years
    our position has changed to the point where protecting our
    critical infrastructure, including the electricity system, is a
    national security matter. I think what we've got to do is
    figure out how do we get government and industry to work
    together like we have a shared problem in front of us and not
    that the assets belong to the power companies and our job over
    here, historically, has been to find sensitive information and
    classified information and protect it. I think it starts with,
    really, two things.
        One is getting industry and the top levels of government
    together and develop a strategy and a plan going forward on how
    we're going to manage the critical nature of these assets to
    national security and how we're going to protect that. I think
    something like that was proposed in the NIAC report recently.
        Then the second piece is how do we, if we believe in the
    plan and we're going to work the plan together, how do we
    become part of a shared community where we trust sharing the
    information because the old rules of protecting classified
    information, sensitive information. We have cases where we've
    actually created new information out of the CRISP project,
    handed it over to the government and then the government says
    now that's classified. But we just gave it to you, so we're
    having a hard time sharing it because you just classified it.
    We need to figure out a new set of ground rules around a
    partnership between industry and government on fighting the war
    together.
        Senator Cortez Masto. Thank you. I appreciate the
    opportunity to speak today.
        The Chairman. Thank you.
        Senator Duckworth.
        Senator Duckworth. Thank you, Chairman Murkowski, Ranking
    Member Cantwell, for convening this very important hearing and
    about how we can secure our energy infrastructure against cyber
    threats.
        When I was on the House Armed Services Committee, I saw,
    first-hand, the vulnerability across departmental efforts on
    this. For example, I was touring a contractor for a major Army
    maneuvent command and they had the capability. They were very
    proud to show me that they had installed low wattage light
    bulbs for the street lights at this military post. They were
    showing me in Illinois how they could dim the lights and save
    energy at the post.
        But I was in a room where they were controlling the grid
    for this major military command in Texas, and I said, who has
    access to this computer? Who has a security clearance? They had
    one person with a security clearance who was an engineer over
    there. I said, oh. The room is just left unlocked but look at
    what we can do, how nifty this is. We're saving all this
    energy. And there was no thought to the cyber.
        And yet, this post is the headquarters of a major military
    command, and it was connected to the civilian grid of the
    community immediately off post. So anybody could have gotten
    access to that room, to that computer, and affected not just
    the military installation but also the civilian community on
    the outside. That's why, I think, we need to be much more
    sophisticated in how we talk about these issues.
        In my own home state, Argonne National Laboratory has a
    team of scientists and researchers with deep expertise in
    cybersecurity and critical infrastructure. They have been
    working on developing advanced power grid, cybersecurity
    solutions for DOE cybersecurity for the energy delivery systems
    program, including cloud-based grid applications, wide-area
    protection and control and distributed energy resource
    management systems.
        Ms. Hoffman and Mr. Bochman, can each of you quickly
    address the value of this cutting-edge research that is being
    conducted at Argonne at this time?
        Ms. Hoffman. So thank you to the Senator for the question.
        The laboratories provide a wealth of research and solutions
    for these energy delivery systems, and Argonne National
    Laboratory is on the cutting-edge of a couple of topics.
        You've mentioned clouds. Cloud-based computing is now being
    evaluated and looked at to be implemented within the energy
    sector, especially around the smaller type utilities that want
    to look for cost-effective solutions. Getting ahead of
    implementing cloud-based solutions is absolutely critical that
    we build security in. That is one example that they are working
    on.
        I was--admit I did not bring it up when Senator Stabenow
    brought up about the distributed energy resources, but looking
    at security around inverters, the work that Argonne is doing
    there is also a critical, important asset.
        But the national laboratories, working together, through
    the Grid Modernization Lab Consortium, really provide an
    opportunity for us to add value across all the capabilities of
    the national labs.
        Senator Duckworth. Thank you.
        Mr. Bochman. Thanks, Pat. And Senator, thanks for the
    question.
        Yes, we have many fine colleagues, really brilliant people
    at Argonne and appreciate the effort that they bring.
        To go right at your question with two concrete examples.
    The oft-referenced CRISP program for threat intelligence and
    information sharing in the energy sector, Argonne plays a very
    important part of that, both in its current version and as
    we're working to improve it in some ways so it's better for the
    customers.
        They also play an important role in a California/DOE-
    funded, supported, California energy systems for the 21st
    century project that involves machine-to-machine information
    threat sharing. So whenever people say this needs to be faster
    and near real time or real time, that project that Argonne
    plays an important part on along with INL, PNNL and other labs.
    They play a big role.
        Right to your first thing, I want to finish this. When you
    gave that very bleak example, I don't know how many years ago
    that was, but I assume it could still be----
        Senator Duckworth. Not too many.
        Mr. Bochman. We could find that still today, right?
        I think the ultimate solution for problems that are as
    heinous as that is a cultural one, not a technology one. When
    we eventually start to see that security which we haven't spent
    much time worrying about up until recently, it is actually
    every bit as much a safety issue as a compliance issue or
    anything else and some lapse in security somewhere could cause
    physical damage or kill people in other places.
        Once those two things are fused much more tightly than they
    are today in people's minds, I think you'll see better behavior
    across the board.
        Senator Duckworth. And, you know, people have just simply
    had not thought about the cyber part. They were just very proud
    of the fact that they were saving money for the DoD.
        Mr. Bochman. Right.
        Senator Duckworth. And how great it was to have this
    technology. When I brought up how vulnerable are you to
    cyberattack, it was something that the engineers, because they
    were worried about wattage and controlling the street lamps, it
    never occurred to them that they could be under cyberattack.
        So I would think that you both would agree with me that
    Congress should prioritize funding for research like the one at
    Argonne in developing efforts in this area.
        Mr. Bochman. Sure thing.
        Senator Duckworth. Thank you.
        I am out of time. Thank you, Madam Chairman.
        The Chairman. Thank you, Senator Duckworth.
        Senator Cantwell.
        Senator Cantwell. Thank you, Madam Chair, and thanks to all
    the witnesses and to our colleagues. I think this has been a
    very good hearing illuminating where we are and many of the
    challenges we face going forward.
        Mr. McCurdy, I wanted to ask you, there is a 2014 Bloomberg
    report that states, ``hackers had shut down,'' this was in
    Turkey, ``had shut down alarms, cut off communications, super
    pressurized a crude oil pipeline which led to a physical
    explosion. The main weapon, Valve Station 30, was a keyboard.''
        We've given the Transportation Security Administration
    (TSA) the responsibility for mandatory reliability standards,
    and yet, here we are with TSA in this ever-changing and dynamic
    environment. What is the TSA budget for these activities and
    how many TSA employees are actually involved in the
    cybersecurity of the million miles of pipeline that we have in
    the United States?
        Mr. McCurdy. Well, it was, I guess, above my pay grade. I
    don't know what their budget is. I'd have to check. You
    probably do, I think.
        It's a--and you're right. We have 2.5 million miles of
    natural gas pipelines which is only a little less than the 2.6
    million miles of paved roads.
        The TSA does regular audits. They do cooperate. We work
    closely. They are a subject matter expert in the Department of
    Transportation, as is PHMSA.
        We talk about the culture of safety and security being
    together. That's where it really does come closest, and they
    are expert in that area.
        We dual hat. The other, as they say, is energy and as to
    the extent that we are interdependent and support them, we do
    benefit from that relationship in and across sector sharing of
    technologies, standards.
        We've done things as well. Downstream Natural Gas, we
    formed our own ISAC. Gerry runs the E-ISAC. We now have, we
    just announced that the Downstream Natural Gas ISAC has a seat
    in the E-ISAC. So, there is this sharing.
        We get the alerts that they put out that are relevant to
    our sector so that we disseminate that to our, you know,
    critical owners and operators out there in the system. So
    there's a lot.
        We use Idaho labs. We use the ICS CERT. We were involved in
    the NIST, development of the NIST standard. So the industry is
    very pro-active on this front, and we've had good collaboration
    with TSA.
        Senator Cantwell. I think you hit on it, which is the
    notion that you are on the private side and on the public side
    GAO has said that we still don't have the metrics needed to
    measure the relative cybersecurity of our pipeline system.
        I think what we need to do is, as we continue to see, and I
    mentioned the situation in Turkey, as those kinds of threats
    prevail, we need to elevate this discussion like we are doing
    today. But to get the Transportation Security Administration,
    who I'm not sure everybody understands who they are and what
    role they play in this, to some elevated level so that we
    actually have metrics here that we are holding the industry
    accountable.
        Now, I know, you may say something like that people would
    probably say, wait, wait, wait, no, we don't want any new
    regulation. But at the same time, I am for the collaborative
    effort. I am. I think that we have to have some measureables
    here that we need to put in place.
        So we will be looking at that.
        Mr. McCurdy. Well again, you know, I think it would be an
    opportunity to bring them in and have that conversation as
    well.
        But when you look at the cybersecurity standards and if you
    look at--which are minimal. What we do beyond that in the level
    of focus it has now within the companies themselves.
        I'll give you an example, I have some CEOs in this week, a
    leadership program. A CEO told me this morning, they're now
    recruiting board members from software companies or from IT
    companies or security firms because that's an expertise they
    need to even continue to push.
        So, on the private side, I can only speak to that. But I
    will tell you that it's a constantly evolving system and the
    threat evolves, with our actions evolving and we try to stay up
    with that.
        Senator Cantwell. You are willing to think about those
    things in a collaborative fashion.
        Mr. McCurdy. We have a culture of safety which means that
    we constantly adapt and improve. And as the Ranking Member
    knows, I've been involved in this for quite some time. I've
    watched this evolve. And anyone whose static is lost. It's a
    constant challenging game, and we have to be on top.
        Senator Cantwell. Well, I wanted, if I could, Madam Chair.
    I know we have a vote that has been called. I wanted to again
    thank Colonel Welsh for being here and for all that is
    happening in the State of Washington.
        And to the point that Mr. McCurdy was just making, what you
    have hit on is 600, I think, cyber personnel within the
    National Guard. So, that's been a great bonus to the operation
    and infrastructure.
        It sounds like cross pollination of cyber expertise in
    security as it relates to the infrastructure. We need to
    continue to do that.
        I know that the Center for Strategic and International
    Studies has called it a human capital crisis, that there will
    be by 2020 an opening of 1.5 million cybersecurity positions.
    Do you have thoughts on how we should proceed on a cyber
    workforce?
        [Laughter.]
        Either from your own National Guard perspective. I know
    what we're doing at the University of Washington, which is
    really great work, particularly at University of Washington,
    Tacoma with three different levels of degrees in cybersecurity.
    But is there more that we need to do, even within our own
    ranks?
        Colonel Welsh. You bet, Senator.
        So, I think, in some ways, I mean, just the fact that we've
    got that number of cyber professionals in the state is its own
    economic engine, you know, if managed appropriately.
        But you know, the National Guard does a great job of
    training folks. We get them into school. They're drug free. You
    know they're in great shape. Then they get security clearances,
    so I mean, that's a huge benefit to companies out there from,
    sort of, we can give back a little bit.
        But you're right. There are more jobs than people out
    there. We've got some great training programs with University
    of Washington, great internship opportunities in the state. And
    that's the great thing about, as I talked before about, the
    Adjutant Generals Convening Authority. You can actually, kind
    of, get folks together and talk about things like educational
    diversity and things like that.
        So we're doing good on workforce development. There's a lot
    more to do. But again, it's things like having jobs in the
    Guard. It's having jobs in the state that as we have good folks
    come out of schools we can actually place them and they can get
    to work.
        Senator Cantwell. And do you think that that kind of
    information and partnership, as you alluded to in your
    testimony, has put us, I don't mean ahead, but on the right
    track, as it relates to outlining this theme throughout the
    conversation, which has been how do we share information, how
    do we analyze and share this critical information?
        Do you think the fact that we are knitting a culture in
    layers across the public and private sector is creating avenues
    for information sharing that didn't exist before?
        Colonel Welsh. Yes. We don't copyright our processes at all
    in Washington State. So we are willing to share. Everything we
    do we'll be more than happy to talk about and discuss, but
    again, it's one approach that has worked.
        I'm worried more about the states that aren't. And really,
    we, in some ways, have really have and have nots, if you look
    across the states. I think the Senator from Hawaii was, sort
    of, nibbling around that a little bit.
        We're fortunate in the state. We're geographically blessed.
    But there are others that aren't and when you look, from an
    attacker's perspective, you just have to find the one that
    isn't and start there.
        Senator Cantwell. Did you want to say something, Mr.
    Bochman?
        Mr. Bochman. Yeah, thanks, Senator.
        Yeah, sure, the Pacific Northwest National Lab in your
    state of Washington, the Idaho National Lab and Sandia down in
    New Mexico, are arguably the three most operational technology
    or industrial security-oriented and capable labs in the
    complex. There's others as well that assist. And recognizing
    that tremendous shortfall in that type of talent, not just a
    generic IT security talent, but industrial control system
    security specialists which requires years of experience and
    special education.
        Those three labs have joined together to work with the
    regional universities, with other government agencies, with
    STEM programs, to begin to really kick this into a much higher
    gear than it seems to be doing on its own.
        Senator Cantwell. I would just note for everyone that the
    Chair and I have worked hard on this and we still have
    provisions of the energy bill that we would like to see passed
    that would double the R&D for this effort in DOE and help us
    look at a supply chain initiative and invest in the cyber
    workforce, given that there is such a high need. So, we hope
    that we will be able to keep pushing those ideas and getting
    our colleagues in the House to understand.
        I think we had a great representation here today and lots
    of great questions, lots of good information brought out by our
    colleagues.
        Thank you.
        The Chairman. Thank you, Senator Cantwell.
        I appreciate your comments there at the end, General Welsh,
    about the fact that in certain states, they are perhaps not as
    evenly endowed with the resources. Of course, Alaska and Hawaii
    sit off that grid. Sometimes the simplicity of our grid is
    something that gives us a little more comfort. But at the end
    of the day, we are truly one of those islanded states when it
    comes to access to resources as well.
        Senator Cantwell mentioned the metrics and how we measure,
    and there has been a lot of discussion in these past four, now
    five, hearings that we have had when we have been talking about
    infrastructure and talking about regulation and permitting and
    all that that entails. But we recognize that when it comes to
    regulations there are mandatory and there are voluntary. There
    are tradeoffs and benefits, I think, to each. But in
    recognizing that when we are talking about cybersecurity, our
    real challenge here is to be nimble, to be faster and smarter
    than the guys that are looking to bring us down.
        What is the right mix between mandatory as opposed to
    voluntary regulation? I don't know if any of you have anything
    concrete, but it is something that we need to assess here as we
    are looking at legislating.
        Mr. Cauley?
        Mr. Cauley. I think mandatory requirements has its place,
    and I think what we've done in the bulk power system is an
    appropriate fit where you have the most critical assets in the
    system. You want to make sure that everyone is meeting a
    threshold set of requirements that, you know, you could be
    harmed by the weakest link. So, I think, there's comfort across
    the industry having a common set of standards that are risk-
    based.
        It also helps with the mandatory standards in terms of cost
    recovery and making sure that the resources and investments are
    there. So, I think, the power industry appreciates having
    mandatory standards for the bulk power system.
        I think in other areas it may be more challenging. And I,
    you know, one area where I'm particularly concerned is a lot of
    the electronics and the distribution system. How do we get
    guidelines and best practices adopted in a consistent way
    across so many different jurisdictions?
        I think mandatory standards there would be very difficult
    given the jurisdictional challenge, but getting stronger
    guidelines and practices in a consistent way across that area
    would be helpful.
        The Chairman. Mr. McCurdy, on the gas side, do you think
    that the gas industry needs a set of mandatory standards?
    Should the mandatory NERC cyber standards need to apply to the
    gas industry?
        Mr. McCurdy. No.
        The Chairman. Okay, that's easy.
        [Laughter.]
        Mr. McCurdy. The--and part of that is the nature of the
    systems themselves. We've seen and we've all learned in the
    electric sector that because of its true interconnectedness and
    even though there are sub grids there, there can be massive
    cascading failures and those are critical infrastructures and
    they are a lifeline and they're absolutely essential for our
    economy and way of life and in public safety.
        It's less of a challenge, less risk, I think, in the gas
    distribution network. There are potentials, but they are not
    because they're--it's mechanical, it's gas, it's pressurized
    and it's less likely to have a complete regional failure based
    on a particular attack. So I think we've evolved. We're growing
    into that.
        The reason this is now part of this hearing, I think, and
    focus is the more that the electric sector is using natural gas
    as a base fuel, there is the concern what's the reliability in
    the access to that fuel?
        That's both the cyber question, but that's also a physical
    question that you know extremely well and that's where pipeline
    permitting and infrastructure and capacity, those are all
    issues as well.
        The Northeast in the Polar Vortex, that was raised earlier,
    was more risk because they had limited access to natural gas
    pipelines through firm capacity contracts than they are from a
    cascading failure because of some incident.
        So those are both questions that we have to ask and that's
    something that FERC has to deal with and it's a regional issue,
    it's not federal.
        The Chairman. Yes.
        Mr. McCurdy. It's not a federal fix. It's going to be a
    regional fix, but we all need to be working together and raise
    the awareness of that concern. That's the reason I put that one
    section in my testimony about the access.
        The Chairman. We have got a vote that started at noon and
    it is a 15-minute vote, but we are on Senate time here. So I am
    going to ask Ms. Hoffman, you wanted to weigh in and I also
    wanted to ask you. With the FAST Act we have identified DOE as
    the head, if you will, in terms of granting authority to direct
    utility action. Do you think that is being recognized and
    respected by DHS? Are we on the same footing as DHS?
        Ms. Hoffman. So the answer is yes, but I do believe that
    there is the interdependence issue that DHS has a strong
    capability of making sure that the interdependencies are
    recognized.
        The one point that I wanted to make on the earlier
    conversation is how do we measure success? I think at the end
    of the day the way to measure success is to make sure that
    every industry and sector has the capabilities to do what needs
    to be done when a cyber event occurs. So whether it's a
    workforce capability, whether it's installing additional
    equipment, whether it's having continuous monitoring, that we
    have the capabilities built and that we can test against those
    capabilities and be evaluated that we're performing correctly
    with those capabilities. That was the comment I wanted to add.
        The Chairman. Okay.
        Mr. Bochman, you get the last word.
        Mr. Bochman. Fantastic. Thanks, Senator.
        Your opening question about voluntary or mandatory types of
    security guidance, I think there's something, there's some
    things, there's three flavors, I think. There's guidance and
    best practices.
        And just back from Estonia where the Baltic Sea and Black
    Sea countries are, who are all trying to figure out how to
    regulate their energy sectors for security. They are so
    thankful that the DOE had put down in writing some very helpful
    best practices, both for managing--both for measuring maturity
    of security practices and also for procurement guidelines.
    These are things that took a lot of effort and a lot of
    expertise to build and give some of our friends a big head
    start. And so that's one plug for them. They appreciated that.
    Those are guidelines.
        Swing to the other extreme, are mandatory things. Thou must
    do, else you'll be penalized a significant amount of money and
    you won't like it reputational either. That's the NERC CIPs.
    Those have moved the utilities, many would argue, much farther,
    must faster than they otherwise might have, if they hadn't had
    to comply with those. With those, that's the stick, right?
        I think I'll finish with the carrot. The carrot which I've
    seen from--that seems missing, I think in some and could be
    improved from work with public utility commissions and
    utilities themselves would be incentives, ways to motivate,
    financially and otherwise, motivate good security behaviors
    that aren't just the stick of the mandatory things, but
    certainly go far beyond the guidelines and the best practices
    you should do these things. I think if we could look at
    incentives to motivate the types of behavior we want, I think
    you might see things go a lot farther, a lot faster.
        Mr. McCurdy. And just on that point, if I could, because we
    are state regulated in the natural gas area. And the current
    Chairman of NARUC was just at our offices this morning.
        We now have reimbursement. They are rate based. The ability
    to rate base the cost of cyber is a big deal. And if--because
    it's huge. You can, you know, throw money at this forever and
    never get to the level you want. But if you don't have it as
    recoverable in your rates, then it doesn't really work.
        So, that's--they are moving in that direction. So that's
    where the partnership with the states is really very critical
    from the incentive standpoint.
        The Chairman. Good.
        We could clearly go on for a long time, but even by Senate
    standards, I am late.
        [Laughter.]
        I thank you all for your very, very important testimony. I
    think you saw the level of interest here. Know that we will
    continue to work in this important area.
        Thank you.
        We stand adjourned.
        [Whereupon, at 12:22 p.m. the hearing was adjourned.]

                          APPENDIX MATERIAL SUBMITTED

                                  ----------

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]