[Senate Hearing 115-284]
[From the U.S. Government Publishing Office]


                                                        S. Hrg. 115-284

THE THREAT POSED BY ELECTROMAGNETIC PULSE AND POLICY OPTIONS TO PROTECT 
 ENERGY INFRASTRUCTURE AND TO IMPROVE CAPABILITIES FOR ADEQUATE SYSTEM 
                              RESTORATION

=======================================================================

                                 HEARING

                               BEFORE THE

                              COMMITTEE ON
                      ENERGY AND NATURAL RESOURCES
                          UNITED STATES SENATE

                     ONE HUNDRED FIFTEENTH CONGRESS

                             FIRST SESSION

                               __________

                              MAY 4, 2017

                               __________

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]


                       Printed for the use of the
               Committee on Energy and Natural Resources
               
           

        Available via the World Wide Web: http://www.govinfo.gov
               
               
                              __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
26-072                    WASHINGTON : 2018                     
          
----------------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].               
               
               
               
               
               COMMITTEE ON ENERGY AND NATURAL RESOURCES

                    LISA MURKOWSKI, Alaska, Chairman
JOHN BARRASSO, Wyoming               MARIA CANTWELL, Washington
JAMES E. RISCH, Idaho                RON WYDEN, Oregon
MIKE LEE, Utah                       BERNARD SANDERS, Vermont
JEFF FLAKE, Arizona                  DEBBIE STABENOW, Michigan
STEVE DAINES, Montana                AL FRANKEN, Minnesota
CORY GARDNER, Colorado               JOE MANCHIN III, West Virginia
LAMAR ALEXANDER, Tennessee           MARTIN HEINRICH, New Mexico
JOHN HOEVEN, North Dakota            MAZIE K. HIRONO, Hawaii
BILL CASSIDY, Louisiana              ANGUS S. KING, JR., Maine
ROB PORTMAN, Ohio                    TAMMY DUCKWORTH, Illinois
LUTHER STRANGE, Alabama              CATHERINE CORTEZ MASTO, Nevada

                      Colin Hayes, Staff Director
                Patrick J. McCormick III, Chief Counsel
                     Isaac Edwards, Senior Counsel
           Angela Becker-Dippmann, Democratic Staff Director
                Sam E. Fowler, Democratic Chief Counsel
                David Gillers, Democratic Senior Council
                 Rich Glick, Democratic General Counsel
                            
                            
                            C O N T E N T S

                              ----------                              

                           OPENING STATEMENTS

                                                                   Page
Murkowski, Hon. Lisa, Chairman and a U.S. Senator from Alaska....     1
Cantwell, Hon. Maria, Ranking Member and a U.S. Senator from 
  Washington.....................................................     3

                               WITNESSES

LaFleur, Hon. Cheryl, Acting Chairman, Federal Energy Regulatory 
  Commission.....................................................     5
Gingrich, Hon. Newt, Chairman of the Board, Gingrich Productions.    15
Cooper, Ambassador Henry F., Former Director, Strategic Defense 
  Initiative Organization........................................    19
Durkovich, Caitlin, Director, Toffler Associates.................    32
Manning, Robin E., Vice President, Transmission and Distribution, 
  Electric Power Research Institute..............................    39
Wailes, Kevin, Chief Executive Officer, Lincoln Electric System, 
  and Member of the Board of Directors, American Public Power 
  Association....................................................    49

          ALPHABETICAL LISTING AND APPENDIX MATERIAL SUBMITTED

Brumley, Dr. David:
    Response to Questions for the Record.........................   114
Cantwell, Hon. Maria:
    Opening Statement............................................     3
Cooper, Ambassador Henry F.:
    Opening Statement............................................    19
    Written Testimony............................................    21
    Responses to Questions for the Record........................    93
Durkovich, Caitlin:
    Opening Statement............................................    32
    Written Testimony............................................    34
    Responses to Questions for the Record........................   102
Gingrich, Hon. Newt:
    Opening Statement............................................    15
    Written Testimony............................................    17
    Responses to Questions for the Record........................    92
LaFleur, Hon. Cheryl:
    Opening Statement............................................     5
    Written Testimony............................................     8
    Responses to Questions for the Record........................    80
Manning, Robin E.:
    Opening Statement............................................    39
    Written Testimony............................................    41
    Responses to Questions for the Record........................   105
Murkowski, Hon. Lisa:
    Opening Statement............................................     1
Wailes, Kevin:
    Opening Statement............................................    49
    Written Testimony............................................    51
    Responses to Questions for the Record........................   109

 
THE THREAT POSED BY ELECTROMAGNETIC PULSE AND POLICY OPTIONS TO PROTECT 
 ENERGY INFRASTRUCTURE AND TO IMPROVE CAPABILITIES FOR ADEQUATE SYSTEM 
                              RESTORATION

                              ----------                              


                         THURSDAY, MAY 4, 2017

                                       U.S. Senate,
                 Committee on Energy and Natural Resources,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 10:09 a.m. in 
Room SD-366, Dirksen Senate Office Building, Hon. Lisa 
Murkowski, Chairman of the Committee, presiding.

  OPENING STATEMENT OF HON. LISA MURKOWSKI, U.S. SENATOR FROM 
                             ALASKA

    The Chairman. Good morning. The Committee will come to 
order.
    I would like to welcome everyone to the Energy hearing this 
morning. We are here to examine the threat that is posed by 
electromagnetic pulse, that is known as EMP, as well as policy 
options to protect energy infrastructure and provide for system 
restoration in the event of an EMP attack. The United States 
has recognized a potential EMP attack as a national security 
threat for decades and our efforts to understand a potential 
EMP burst are certainly not new.
    The Department of Defense (DoD) and our national labs have 
been grappling with these issues to one degree or another since 
we first started testing nuclear weapons. Extensive tests in 
the 1950s and 60s examined the potential impact of an EMP burst 
on both military and civilian infrastructure. Today, however, 
there is a renewed focus on understanding the effects of such 
an attack and an increase of efforts directed at mitigating and 
recovering from such an event should it occur. This issue is, 
perhaps, more salient now than ever for several compelling 
reasons.
    First is the proliferation of nuclear technology which is 
no longer limited to the U.S., Russia, China, the U.K. and 
France. Other nations have tested nuclear weapons and missiles 
to deliver them. Rogue nations, such as North Korea, may 
already have or be close to obtaining these capabilities. We 
must also be mindful of the potential for a non-state actor to 
obtain a nuclear device. While their ability to use a missile 
as a delivery vehicle for a high altitude EMP attack would 
likely be more limited, we know that it cannot be ruled out.
    Second is the proliferation of electronics in today's 
society. Just about everyone in this room, I would venture to 
say, has a smartphone. That is just the start of the devices 
that we rely on, and that, in turn, rely on electricity and 
electronics to function. This has magnified the impact as 
compared to the potential impact in the 1960s that an EMP burst 
could now have on the electric grid, the technologies that rely 
on electronics and on our daily lives.
    We must recognize from the start of today's discussion that 
the threat posed by an EMP attack is a matter of national 
defense. Defending our nation from a missile carrying a nuclear 
warhead is clearly beyond the scope of the owners and operators 
of energy infrastructure and their regulators. Nevertheless, 
these institutions do have a role in protecting critical energy 
infrastructure and providing for its restoration. As the owners 
and operators of critical energy assets, our utilities must 
assist government EMP experts in understanding how the electric 
grid works.
    For its part, government must prudently share its knowledge 
and expertise with industry on a timely basis and approve or 
direct prudent, reliability standards as warranted. There 
really is no way around this.
    On the one hand, we have defense and national security 
personnel who are very familiar with the effects of a nuclear 
detonation but who are not responsible for the complexities of 
keeping the lights on. And on the other hand, you have 
professionals in the power sector who know the grid but are not 
familiar with the characteristics of a nuclear detonation.
    It is critical that the electric industry and government 
improve upon their mutual understanding and trust because it is 
essential to the productive relationships that are necessary to 
improve our ability to respond to EMP and other potential, high 
impact, but low frequency events.
    Both camps must work together to share information and 
expertise. Our engineering schools and other conduits for 
professional expertise must embrace a new paradigm for 
considering and addressing security threats in the design and 
operation of electric systems.
    Improving our ability to respond to an EMP threat is also 
an area where, like cybersecurity, the subject of another 
recent hearing that we just had, stronger public/private 
partnerships are needed and today's capabilities must be 
improved. This hearing will consider as a policy matter whether 
the appropriate federal agencies have the authority they need 
to address this potential threat and whether additional 
authority or direction is needed.
    Back in 2005, we established authority for the North 
American Electric Reliability Corporation, now NERC, through an 
informed stakeholder process to establish, subject to the 
Federal Energy Regulatory Commission's (FERC) approval, 
mandatory, physical and cybersecurity standards for the 
industry. More recently, in 2015, Congress codified the 
Department of Energy (DOE) as the sector-specific agency for 
energy critical infrastructure and provided the Secretary with 
emergency authority to address a host of threats: cyber, 
physical, geomagnetic disturbances and EMP. So we have taken 
some steps, but many argue and believe that those steps are not 
sufficient and that we still have a great deal of work in this 
area.
    Our task today is to consider the distinct points of view 
about EMP brought to us this morning by our very distinguished 
panel. I am looking forward to the testimony we will receive 
from each of you.
    I now turn to my Ranking Member, Senator Cantwell.

               STATEMENT OF HON. MARIA CANTWELL, 
                  U.S. SENATOR FROM WASHINGTON

    Senator Cantwell. Thank you, Madam Chair.
    I welcome the witnesses here today and thank you for 
scheduling this hearing.
    The electric grid is essential to our lives and also the 
lifeblood of our economy. With the fate of our economy 
dependent on access to reliable electricity, it is our 
responsibility to ensure that the grid is prepared to withstand 
many threats including natural disasters, including those 
caused by changes in climate, extreme weather, physical attacks 
of terrorism, cyberattacks, geomagnetic disturbances, 
electromagnetic pulse, or EMP. We must continue to identify and 
evaluate the threats to the system as well as appropriate 
investments in technology to reduce these threats.
    Threats to the grid are measured both by probability and 
severity of impact. We must prepare and protect against all 
these hazards, but we must prioritize based on the likelihood 
of occurrence and severity of impact.
    Electromagnetic pulse attacks are considered a high-impact, 
low-probability threat, as I think, Mr. Manning, in his 
testimony, indicates. We do not yet have the concrete science-
based analysis necessary to understand the threat and identify 
effective solutions.
    As a result, in 2001 Congress established a commission to 
assess the threat from high-altitude electromagnetic pulse, 
known as HEMP. In 2014, the Department of Homeland Security 
(DHS) developed guidelines to help federal agencies identify 
those options to protect critical equipment and facilities and 
communication and data centers from these attacks.
    The Department of Energy and the Electric Power Research 
Institute (EPRI) are both engaged in studying the EMP threat 
and releasing action plans for both government and private 
industry.
    The Departments of Homeland Security, Defense and Energy, 
including our national labs, are actively engaged in studying 
the effects of EMP and identifying proactive measures that can 
help mitigate against these threats.
    As Mr. Manning has noted, solutions to EMP threats to the 
grid are not well understood. Much of the available information 
is not specifically applied to utilities, making it difficult 
for utilities and regulators to identify the options for 
protecting that infrastructure. So I am pleased the work is 
currently underway by both industry and the government to 
identify our options.
    I also want to say that threats to our grid are measured by 
the likelihood of occurrence and severity and warming climate 
has increased physical threats to our infrastructure with 
rising sea levels, storm surge and extreme weather events. 
According to NOAA, high sea surface temperatures have 
contributed to a substantial increase in hurricane activity in 
the Atlantic and the severity of those strong threats on our 
grid.
    In 2012, Hurricane Sandy tore through the East Coast 
leaving a path of wreckage, rainfall, and knocked down power 
lines, leaving 88.5 million homes and businesses in 16 states 
without power.
    In the State of Washington, we have seen extreme weather 
changes. We have had landslides, flooding and sea level rise, 
as well as drought, that has induced forest fires threatening 
our grid. In 2014, large fires in Central Washington 
substantially impacted the electric infrastructure with over 
3,000 customers without power. I should say that the cost is 
how much was actually burnt up in the fire, substantive 
investments that had just been made by utilities in that 
region.
    Finally, I would like to talk about the issue of 
cybersecurity that the Chair mentioned. While we have never 
experienced a high-altitude EMP attack, the severity of 
successful cyberattacks on our grid is growing and it is 
significantly more likely that our grid is being tested for 
cyber vulnerabilities every day by our adversaries. In fact, 
Russia is believed to have deployed a cyber weapon to shut down 
Ukraine's grid in both 2015 and 2016.
    On March 14th of this year I asked the Trump Administration 
to protect the growing grid vulnerabilities from cyberattacks 
and make sure that we zero in on the appropriate assets. I sent 
a letter to the Administration and to the Department of Energy 
asking that they assess the capabilities of some of these 
nations, of Russians, particularly, to hack into our energy 
infrastructure, and I am looking forward to getting a response 
since it has been several weeks since we sent that letter.
    It is widely known the United States is under constant 
threat from cyberattacks, and many cyber experts have come to 
the same conclusion. It is not an if, but a when, a massive 
attack on our grid will occur. In fact, the former Director of 
National Intelligence, General Clapper, stated in 2015 that 
cybersecurity is now more a significant threat to our national 
security than terrorism.
    So I am glad we are holding this hearing on the risks to 
our grid, and EMP being one of them, but I hope that we will 
also make sure that we continue to focus on cybersecurity. I 
know we have had a hearing, and three other committees that I 
serve on have also had cybersecurity hearings.
    I think everybody is waking up to the fact that cyber is a 
big issue. Obviously, Madam Chair, we passed the Energy Policy 
Modernization Act out of the Senate, that the House failed to 
act on, which had a major cybersecurity provision. So I hope 
our colleagues over there will wake up to the importance of 
that.
    I look forward to hearing from our witnesses. And thank 
you, Madam Chair, for the hearing.
    The Chairman. Thank you, Senator Cantwell.
    We are joined this morning by a very distinguished panel. I 
welcome you all.
    The panel will be led off this morning by the Honorable 
Cheryl LaFleur, who is the Chairman of the Federal Energy 
Regulatory Commission. She has been a member of the FERC since 
2010. We appreciate all that you do on that very important 
commission. We would like to get you a quorum so that you can 
be working every day, but we are pleased that you are here this 
morning.
    Chairman LaFleur will be followed by a man who is well 
known up here on Capitol Hill. It is a pleasure to welcome you 
to the Committee. Chairman of the Board of Gingrich Productions 
and former Speaker of the House, Speaker Gingrich has been a 
leading voice on the issues and the dangers of an EMP attack. 
We are very pleased to have you provide your insight this 
morning.
    Following Speaker Gingrich is Ambassador Henry Cooper. He 
is the former Director of the Strategic Defense Initiative 
Organization, and he was President Reagan's Chief Negotiator at 
the Geneva Defense and Space talks. It is nice to have you at 
the Committee this morning. Welcome.
    Caitlin Durkovich is the Director at Toffler Associates. 
Prior to joining Toffler, she served as the Assistant Secretary 
for Infrastructure Protection with the Department of Homeland 
Security under President Obama. It is nice to have you here.
    Mr. Robin Manning currently serves as the Vice President of 
Transmission and Distribution at the Electric Power Research 
Institute, EPRI, where he oversees research and development 
activities. We thank you for your leadership there.
    The panel will be rounded out by Mr. Kevin Wailes, who 
serves as the CEO and Administrator of Lincoln Electric System. 
Mr. Wailes is also the Vice Chair of the Electricity Subsector 
Coordinating Council.
    We are pleased to have you all here. We would ask that you 
try to limit your comments to five minutes. Your full 
statements will be included as part of the record. Commissioner 
LaFleur, if you would like to lead off, please.

  STATEMENT OF HON. CHERYL LAFLEUR, ACTING CHAIRMAN, FEDERAL 
                  ENERGY REGULATORY COMMISSION

    Ms. LaFleur. Good morning and thank you, Chairman 
Murkowski, Ranking Member Cantwell and members of the 
Committee. I appreciate the opportunity to appear before you 
today to discuss electromagnetic pulse, EMP, threats to the 
electric grid in the United States. I very much appreciate your 
attention to this important issue.
    The Federal Energy Regulatory Commission, FERC, plays a key 
role in the oversight of grid reliability. In 2005, Congress 
entrusted FERC with the responsibility to approve and enforce 
mandatory reliability standards for the nation's bulk power 
system. Under the statute, FERC oversees the North American 
Electric Reliability Corporation, NERC, in developing standards 
to protect the reliability and security of the grid.
    In addition to our work on mandatory standards, FERC has 
also supported grid security through collaborative efforts with 
federal agencies, states, industry and stakeholders. This work 
is particularly well suited to revolving threats that require 
action more quickly than a standard can be written. And as 
Senator Murkowski noted, public/private communication on those 
threats is critical.
    FERC, NERC and industry have, over the last decade, put in 
place a robust set of baseline standards to address a wide 
range of reliability issues. In recent years, we've been 
particularly focused on emerging threats to grid security, 
including cybersecurity, physical security and the risk 
associated with geomagnetic disturbances.
    Geomagnetic disturbances to the bulk power system can be 
caused in two different ways: naturally occurring geomagnetic 
disturbances (GMDs) from solar activity and man-made EMP 
events.
    EMPs can be generated by devices that range from small, 
portable suitcase units all the way through detonation of 
nuclear weapons in the upper atmosphere. EMP devices can 
generate three distinct effects: a short, high energy burst, 
called E1, that can destroy electronics; a slightly longer 
burst that is similar to lightning termed E2; and a third 
effect, E3, that generates electric currents in power lines and 
equipment which can then damage equipment such as transformers.
    In the case of GMDs, naturally occurring solar magnetic 
disturbances periodically disrupt the Earth's magnetic field 
which in turn can induce currents on the electric grid that may 
cause voltage instability or destroy key transformers over a 
large geographic area. GMD events are similar in character and 
effect to the final phase of EMP, E3.
    I'll briefly touch this morning on some of the work FERC 
has done that can help address EMP.
    First, FERC developed the directed, excuse me, FERC 
directed the development of standards on GMD that can help to 
mitigate the E3 effective EMP based on a 1 in 100 years' solar 
storm benchmark event. Second, FERC directed the development of 
a physical security standard, like the GMD standard now 
effective and in place, that can help protect against attack 
from small, portable EMP devices which require proximity to 
their intended targets. Third, FERC has supported efforts to 
protect the grid, the resilience of the grid, against all risks 
which improves its ability to respond and recover from major 
outage events whatever the cause.
    For example, mandatory reliability standards require backup 
capabilities for the loss of critical assets which reduces the 
potential for cascading outages. FERC has also issued orders 
concerning grid assurance and EEIs, spare transformer equipment 
program, which are efforts to protect customers from prolonged 
outages by providing electric utilities timely access to 
emergency transmission equipment that otherwise would take 
months or longer to acquire.
    As I expect we will discuss today, FERC has not to date 
directed NERC to develop a specific standard specifically 
targeting EMP. To be clear, I believe this is the result of 
recent consideration of the issue, not a lack of attention or 
willingness by FERC to address EMP threats. Although much work 
has been done, there remains a significant amount of scientific 
research and debate underway about how EMP, particularly the E1 
component, affects the electric grid.
    I particularly want to highlight the work being done by 
DOE, Los Alamos National Lab, Idaho National Lab, an amazing 
place I visited a couple years ago, DHS and the Electric Power 
Research Institute, which I believe will help improve our 
understanding of EMP impacts on the electric grid and more 
importantly, how best to target our actions to mitigate them.
    FERC is closely engaged in all these efforts to understand 
and address the EMP threat as more fully detailed in my written 
testimony. Those efforts will and must continue, and I'm 
confident that should FERC determine that a reliability 
standard is warranted, it will exercise its authority to 
require one as it has with other threats, like GMD and physical 
security.
    Thank you for the opportunity to testify, and I look 
forward to your questions.
    [The prepared statement of Ms. LaFleur follows:]
 
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    The Chairman. Thank you, Chairman LaFleur.
    Speaker Gingrich, welcome.

    STATEMENT OF HON. NEWT GINGRICH, CHAIRMAN OF THE BOARD, 
                      GINGRICH PRODUCTIONS

    Mr. Gingrich. Thank you very much for holding this hearing. 
I think it's very important and I commend the Chair and the 
members for putting time in on this.
    I just want to focus backward from consequence.
    A good friend of mine and co-author of several novels, Bill 
Forstchen, wrote a novel called, ``One Second After,'' which is 
the study of a small town in North Carolina during the year 
after electricity was knocked out by an EMP attack. And it's 
really worth looking at because we take electricity for 
granted. Even in relatively short outages as we had in April in 
New York, San Francisco and Los Angeles, people are remarkably 
inconvenienced.
    But it turns out, for example, all the drugs we rely on for 
a wide range of things require refrigeration. And the minute 
you start knocking out the system, there's a cascade of 
consequences.
    We've known indirectly since 1859 with the Carrington event 
that something can happen that has an effect back then and 
knocked out telegraph lines but we weren't relying on 
everything that's electronic that we do today.
    We've known since 1962 that there can be a manmade event at 
a high altitude which knocks out electricity because it knocked 
from Johnston Island, it knocked out lights in Honolulu.
    The challenge we have with the electric grid is it's 
actually designed for efficiency and it's a remarkable 
achievement. The problem is efficiency, it leads to fragility. 
And so, from your perspective, you both have to look at notable 
points which could be knocked out physically or by a local EMP. 
You have to then look at cyberattacks, and then you have to 
look at EMP attacks.
    The grid is vulnerable at all three layers. And if somebody 
were to methodically come in here, they would find, I think, 
there are as few as nine notable points you could knock out 
that would have a catastrophic effect because it would lead to 
a cascade of systems to shutting down.
    If you then looked at the effect, potentially, of either 
the series of local EMP attacks or a high-altitude EMP attack, 
you're talking about a catastrophic event from which, 
conceivably, you couldn't recover for years.
    So, I would--a couple of quick things. One, the Congress 
should look at EMP attacks as one of the three great threats to 
our survival. The other two being cyber warfare and nuclear 
weapons, and they should regard all three as catastrophic. For 
us to survive as a civilization we have to be able to defeat 
all three of those threats. Two, I think that the Congress 
should communicate a sense of urgency. There are a lot of 
people doing a lot of good things at a relatively leisurely 
pace and trying to be reasonable. If you work back from 
consequence, you rapidly become unreasonable because the 
consequences are so horrible. This is like 9/11 where we said, 
gee, we hadn't thought about an airplane hitting a building 
which is nonsense. Tom Clancy had written about it a decade 
earlier, but nobody wanted to cut through and say so, what 
would you have to do to stop that from happening? After the 
event, we did all sorts of things to make it harder to take 
over an airplane. We're in the same boat right now except here 
we're gambling on our civilization. This is vastly bigger than 
9/11.
    I would suggest a couple things. One, that Homeland 
Security and Department of Energy should have some very 
rigorous war games thinking through all the permutations of 
what could happen and they should look for the key notable 
points where you could, in fact, begin to fix the system 
because there are a number of steps that are going to be taken 
to make the system more resilient and to make it more difficult 
to take out. Two, I would look at the new infrastructure bill 
to consider having a substantial part of the national security 
infrastructure component. Three, if you were to go through and 
cut out a lot of the red tape that the electric industry has to 
deal with, the time value of money you would save would 
probably more than pay for everything you're going to ask them 
to do on EMP.
    And so, there are very practical things that can be done 
here but you need to somehow communicate to the Executive 
Branch, you need a sense of urgency. We need to understand that 
every morning we get up, we're a step away from catastrophe.
    And let me just note that the NASA has estimated that the 
potential for the sun to hit us with a, it's different than a 
man-made, but nonetheless equally dangerous, the potential for 
the sun to hit us with the, effective of the Carrington effect 
is about 12 percent per decade. That we're now overdue for that 
happening. We apparently came within one week of it happening 
and happened to be out of position for the sun so the solar 
flare missed us. But that should give us a reminder.
    I'll just close by saying there's a historium. Work back 
from the consequences. When you have a high likelihood that 
over the next 20 to 30 years something this consequential is 
going to happen, there has to be a sense of urgency by blocking 
it from occurring because if it does occur, it could literally 
end civilization as we know it.
    [The prepared statement of Mr. Gingrich follows:] 

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    The Chairman. Speaker, thank you very much for your 
comments and reminding us of the imperative here.
    Ambassador Cooper, welcome.

   STATEMENT OF AMBASSADOR HENRY F. COOPER, FORMER DIRECTOR, 
           STRATEGIC DEFENSE INITIATIVE ORGANIZATION

    Ambassador Cooper. Madam Chairman, Ranking Member and 
members, I very much appreciate the opportunity to testify 
before you today on my views of this important issue.
    Actually, Speaker Gingrich has covered a lot of my material 
which is a good thing because I wasn't sure I could get through 
even my abbreviated comments here.
    I guess I would like to say that I add that we're living 
through the most dangerous period of my lifetime for a number 
of reasons, but the vulnerability of our national electric 
power grid is among the most important and we are collectively 
continuing to endure or to take ineffective countermeasures to 
deal with it.
    Frankly, I've become so concerned about the 
dysfunctionality of the Federal Government, both the Executive 
and the Legislative branches, that I am now spending most of my 
time working with private citizens, local and state authorities 
and happily, some key people in the electric power industry to 
begin working this problem from the bottom up believing that if 
enough of our citizens gain a real understanding of the issues 
and how they can actually turn--must be addressed at the local 
level then Washington eventually will begin to do the right 
thing in addressing this urgent problem.
    I went through another set of issues in my summary comments 
here that have largely been covered already that I want to skip 
over and turn to the comments written by the Chairman of the 
EMP Commission which was chartered, as you know, by the 
Congress to deal with these issues, in a letter April 20th, to 
Secretary of Energy Perry. The EMP Commission, and these are 
their comments, I want to make clear. I share their views for a 
lot of reasons, but these are their comments. They view the 
current efforts to address natural EMP threat are ``producing 
grossly inadequate standards for protecting the grid,'' to 
quote its Chairman, Bill Graham, who is a colleague of mine for 
many years. He further noted the Commission's concern over 
misleading and erroneous studies by NERC and others that 
grossly underestimate the natural EMP threat from solar storms 
and dangerously have become the basis for grossly inadequate 
standards approved by FERC.
    Perhaps more importantly he noted the Commission's concern 
that the 2014 Obama Administration Intelligence Community 
Assessment of the nuclear EMP threat is profoundly erroneous 
and perhaps the worst ever produced on EMP, and that has been 
used to thwart efforts to protect the nation against nuclear 
EMP by dismissing the threat, despite overwhelming evidence to 
the contrary.
    He also noted that the nuclear EMP is the ultimate cyber 
weapon threat and its military--in the military plans of 
Russia, China, North Korea and Iran for combined arms cyber 
warfare that they will see decisive new revolution in military 
affairs as a consequence.
    He indicated to Secretary Perez and Perry that the 
Commission is also very concerned over misleading and erroneous 
studies recently completed by industries, Electric Power 
Research Institute and grossly underestimate the nuclear EMP 
threat.
    These and other bureaucratic issues led me, a couple of 
years ago, to lose confidence that we were ever going to deal 
with this problem from the top down, and I decided to try to 
work it from the bottom up.
    My written testimony goes into some detail discussing the 
work I am doing, along with Duke Energy engineers. Duke Energy, 
as you probably know, is among the largest, if not the largest, 
energy company in the nation. And we were working on a pilot 
study in York County and Gaston in South Carolina and Gaston 
County in North Carolina. And of course, Duke's corporate 
headquarters are in Mecklenburg County which is a neighbor to 
those two counties. We are engaging with local authorities, 
particularly the folks in Rock Hill which is a bedroom 
community for Charlotte as well as an important area of its 
own.
    This is important because the nature of the grid is, I'm 
sure this Committee knows, a crazy quilt patchwork of co-ops 
and electric utility companies across the nation, some, I don't 
know, 2,000 or 3,000, I understand. Unless those folks are 
actively involved in working the problem and providing the 
loading conditions that they can and will need at Duke Energy 
to produce the power and get it to the local subscribers, then 
we're going to have the consequence that the Speaker referred 
to earlier.
    Water and waste water is a key matter, for example. Duke 
Energy doesn't provide the electricity to the water and waste 
water operations in Rock Hill. That's provided by a different 
utility. And unless that utility is working hand-in-hand with 
Duke, then you're going to have hospitals running out of 
electricity very shortly and, as I understand it, without water 
those hospitals will be experiencing deaths within hours.
    So this is an important issue. I urge you to have the EMP 
Commission which, in my view, is the nation's top authorities. 
Many of the engineers were involved in the DoD from the 
earliest of days dealing with this issue, and that is where the 
expertise originally has been. The DoD is not particularly 
helpful in working this problem today.
    The Department of Energy, while I have great respect for 
the engineers at our laboratories, is reinventing lessons that 
were learned the better part of a half century ago. And it's 
absurd, in my judgment, that we find ourselves in this 
situation.
    I hope the Committee can help deal with the communication 
problems within the Executive Branch as well as help us work 
this problem from the bottom up.
    Thank you, Madam Chairman.
    [The prepared statement of Ambassador Cooper follows:] 

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    The Chairman. Thank you, Ambassador.
    Ms. Durkovich, welcome.

           STATEMENT OF CAITLIN DURKOVICH, DIRECTOR, 
                       TOFFLER ASSOCIATES

    Ms. Durkovich. Thank you.
    Good morning, Madam Chair and members of the Committee. 
Thank you for inviting me to testify today on protecting our 
energy infrastructure from the threat posed by electromagnetic 
pulse.
    My name is Caitlin Durkovich. I had the honor of serving 
eight years in the National Protection and Programs Directorate 
(NPPD) at the Department of Homeland Security, first as the 
Chief of Staff and from May of 2012 to January of 2017 as the 
Assistant Secretary of Infrastructure Protection. NPPD leads 
the national effort to protect and enhance the resilience of 
our nation's physical and cyber infrastructure. I transitioned 
from government to Toffler Associates, a future-focused 
strategic advisory firm that architects better futures for 
public and private sector clients.
    Over my nearly 20-year career in homeland security, I have 
seen critical infrastructure public-private risk management 
redefined to address emerging, complex issues from violent 
extremism to complex mass attacks, cybersecurity grid and GPS 
resilience, extreme weather and electro and geomagnetic 
disturbances.
    I have co-chaired interagency task forces that have 
integrated the private sector into government strategies, 
including those that are most relevant here today--the Joint 
U.S.-Canada Electric Grid Security and Resilience Strategy and 
the National Space Weather Strategy.
    There is no doubt that we live in a dangerous world. State 
and non-state actors, insiders and promulgators of 
disinformation are growing in kind and consequence. Borders no 
longer protect us whether our shores or the fences and walls of 
our organizations. We have built a complex ecosystem where 
disruption in one node can ripple across the system and where 
threats are not bounded to one sector or one industry nor can 
we protect against every threat and secure every building 
system and network. Our country is too big; our infrastructure 
too interdependent; the cost too expensive; and, the outcome 
would alter our way of life.
    This is why we are in the business of risk management. 
Think of a matrix where the x and y axes are increasing 
likelihood in consequence, respectively. A denial of service 
attack is highly probable, but the impact to a company and its 
operations is minimal.
    Most natural disasters are high likelihood and low 
consequence. Superstorm Sandy or a 9.0 Cascadia Subduction Zone 
event are exceptions and flip, low likelihood, high 
consequence. A cyberattack against industrial control systems 
like the December 2015 attack on the Ukrainian power grid, 
lower probability than denial of service, but certainly more 
consequential. In 1859 Carrington Light GMD event. As Speaker 
Gingrich said, we are long overdue. And so, I would say it is 
more likely and certainly high consequence. There are half a 
dozen more risks on that matrix, including a high-altitude 
electromagnetic pulse, and we place it at a very low 
probability but high consequence.
    All of the risks on this matrix must be managed. Since 
critical infrastructure is largely owned and operated by the 
private sector there are finite resources in a world where you 
have a business to operate, shareholder obligations, regulatory 
costs and rate recovery, just to name a few.
    I want to be clear. We have not ignored the threat of an 
EMP. Industry and government are working hand-in-hand to better 
understand the impacts of EMP. The work that EPRI is doing is 
critical to understanding how the systems and its parts would 
be affected. This critical modeling can help inform where 
investments and shielding will have the maximum value and what 
operational procedures can mitigate voltage collapse. And much 
of this effort can be applied to mitigating the consequences of 
a GMD where we will have time to put measures in place and 
manage flow thanks to improved space weather forecasting and 
alerting.
    Equally important is the fact that we understand an EMP, 
like many threats and hazards, is sector agnostic. Disruption 
to communications during incidents hampers response and 
restoration efforts. Malicious actors understand this, and 
Mother Nature is undiscerning.
    There is debate about the sophistication of the attack on 
the Metcalf Substation that supplies power to Silicon Valley, 
but the perpetrators knew enough to cut the fiber lines that 
controlled 911 and downstream communications. A telephone 
denial of service attack hampered the ability of customers to 
call and utility operators to talk to each other in the 
Ukrainian incident.
    An EMP or GMD will impact communication systems and data 
centers and, therefore, command and control. To industry's 
credit, they are looking beyond prioritized calling services as 
a contingency plan but it illustrates why we cannot take a 
silent approach and must understand the vulnerabilities caused 
by the intersections of these sectors.
    This complex risk environment is what has given way to the 
public/private partnership. While government brings important 
capabilities to the table, information sharing, private sector 
clearances, research and modeling, war gaming, industry is 
heavily invested in ensuring its reliability and resilience. 
Disruptions impact their bottom line, their brand and their 
industry.
    It is why the Joint U.S.-Canada Electric Grid Security and 
Resilience Strategy, the National Space Weather Strategy and 
the Joint Electromagnetic Pulse Resilience Strategy and 
corresponding action plans are critical. They lay out high-
level goals for government and industry to guide action and 
investment, to enhance resilience and accelerate recovery from 
these types of events.
    In conclusion, we are managing a complex risk environment 
and cannot protect against every threat and secure every asset. 
There is no one-size-fits-all approach. The solution requires a 
whole of community risk-based approach focused on mitigation 
planning and investment in a modern and secure infrastructure 
that is resilient to the threats of today and tomorrow.
    Thank you, and I look forward to your questions.
    [The prepared statement of Ms. Durkovich follows:]

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    The Chairman. Thank you, Ms. Durkovich.
    Mr. Manning, welcome.

STATEMENT OF ROBIN E. MANNING, VICE PRESIDENT, TRANSMISSION AND 
        DISTRIBUTION, ELECTRIC POWER RESEARCH INSTITUTE

    Mr. Manning. Thank you, Madam Chairman, members of the 
Committee. Good morning.
    I want to share with you a bit of history, if I can. I am a 
Vice President of Transmission and Distribution for the 
Electric Power Research Institute, but also spent 30 years at 
Duke Energy and another six at the Tennessee Valley Authority 
(TVA). And through this time my responsibility was leading 
construction, operation and maintenance of energy 
infrastructure.
    So, as the Chairman put it so well earlier, I kept the 
lights on across the United States. As the leader of TVA's 
transmission organization in the 2008-2009 timeframe as I read 
the EMP Commission report, I struggled to understand how I 
could take the plethora of information that was available on 
EMP and practically apply it to create some sort of a plausible 
approach for risk management associated with TVA's system.
    And that's exactly what EPRI is attempting to do as we are 
now one year into a three-year research project, began in April 
of 2016. Our project objective is to develop cost-effective 
mitigation tools, to develop recovery options for utilities and 
to form a basis for decision-making that provides utilities, 
like the TVA, the information that is necessary to effectively 
protect their customers from the EMP threat.
    This project now has financial support from 57 U.S. 
utilities, making this project one of the most widely-supported 
collaboratives ever at EPRI. We're also collaborating very 
closely with the U.S. Department of Energy with national labs 
and the U.S. Department of Defense.
    We have seven tasks on this project. Many of these tasks 
are being completed in parallel with various expected 
completion dates over the remaining two years of the project. 
We are seeking greater characterization of the HEMP threat as 
it relates to electric infrastructure; we're investigating 
specifically how EMP propagates and how it couples to power 
systems; we're testing that equipment to understand at what 
level do we begin to see damage from EMP events; and then we're 
combining the threats and the vulnerabilities to understand a 
more complete picture, a holistic picture of EMP impacts to 
infrastructure. But together this information provides 
methodologies and tools to support risk-informed decision, and 
of course, it's our intention to communicate our research 
findings to public policymakers and other stakeholders 
throughout the process.
    For example, in February we released publicly a report 
assessing the impacts of a HEMP-generated, E3 energy wave on 
bulk power transformers. We advanced a series of a test nuclear 
blast across the United States, 11 different locations and 
assessed the value of each of those. We used advanced modeling 
assessment techniques as well as conservative assessment 
criteria and conservative engineering judgments throughout.
    The results of this study indicated that damage to a large 
number of bulk power transformers from E3 is unlikely. Even so, 
the results of the assessment should not be interpreted to mean 
that HEMP or even the E3 would not adversely affect bulk power 
system reliability. The potential for widespread outages due to 
voltage collapse or the combined effects of E1, E2 and E3 are 
still being investigated.
    Certainly impacts from HEMP are real; however, evaluating 
the effects of such events on complex systems like our electric 
power grid requires concrete, scientifically-based analysis 
from people who understand the power system. With greater 
understanding, cost-
effective mitigation and/or recovery options can be developed 
and deployed.
    The utility industry is poised to take further action, and 
more scientific research enables these actions to be both 
appropriate and cost effective for consumers.
    At EPRI we are committed to providing sound science-based 
solutions to these complex problems and will continue to offer 
technical leadership and support to the electricity sector to 
public policymakers and other stakeholders to enable safe, 
affordable, reliable and environmentally responsible 
electricity to the people of the United States.
    Thank you for your time. That concludes my testimony. I 
look forward to your questions.
    [The prepared statement of Mr. Manning follows:] 

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    The Chairman. Thank you, Mr. Manning.
    Mr. Wailes, welcome.

  STATEMENT OF KEVIN WAILES, CHIEF EXECUTIVE OFFICER, LINCOLN 
ELECTRIC SYSTEM, AND MEMBER OF THE BOARD OF DIRECTORS, AMERICAN 
                    PUBLIC POWER ASSOCIATION

    Mr. Wailes. Chairman Murkowski, Ranking Member Cantwell, 
members of the Committee, thank you for giving me the 
opportunity to testify today.
    My name is Kevin Wailes. I'm the CEO of the Lincoln 
Electric System (LES) in Lincoln, Nebraska. I'm testifying on 
behalf of the American Public Power Association (APPA) on whose 
Board of Directors I serve. APPA is the voice for not-for-
profit, community-owned utilities that serve 49 million people 
nationwide.
    I also serve as the Co-Chair of the Electric Subsector 
Coordinating Council which is made up of 30 utility and trade 
association CEOs and serves as the electric sector's principle 
liaison with the Federal Government on policy level security 
issues.
    The electric sector takes very seriously the threat of 
electromagnetic pulse, or EMP, events and certainly, if you 
consider reliability, it's what we do. That's the primary 
objective for electric utilities in the first place.
    Chairman LaFleur provided a good description of the various 
types of EMP events. I want to emphasize, consistent with 
Senator Murkowski's, Chair Murkowski's, opening comments, that 
in effect a HEMP attack is an event that would be an act of war 
or terrorism, and in fact, is the responsibility of the Federal 
Government to prevent, as a matter of national security. But 
that doesn't mean that we don't take it very serious in trying 
to develop how we might mitigate that.
    The technical impact of a HEMP event on the electric 
infrastructure is uncertain. Though through a collaborative 
effort, as mentioned by Rob, with the Electric Power Research 
Institute and the Federal Government were conducting research 
to gain more information to be able to provide that mitigation.
    Some proposed the electric industry should install a 
particular protected device or fully gold-plate the entire grid 
so that it could survive a HEMP event. However, there's really 
no consensus on what measures should be taken at this point. 
The potential unintended effects of that type of protection on 
the grid or how successful the efforts would be if we, in fact, 
tried to do that at this time.
    Cost is a significant factor. As a community-owned, not-
for-profit utility, all additional costs borne by LES, for 
example, would have to be passed directly on to our customers.
    Assuming EMP blocking devices could be installed to protect 
the entire grid, power supply would still likely be disrupted 
by a HEMP event due to the collateral impacts on other critical 
infrastructures, as mentioned by Ms. Durkovich, the utilities 
rely on to provide services.
    EMP are one of many threats the electric sector must 
confront, as other witnesses identified, including severe 
weather events, geomagnetic disturbances, cyber and physical 
attacks. Given this broad threat landscape, our industry 
understands that we cannot protect all assets from all threats 
and instead we must manage that risk.
    To do this, the electric sector follows a multilayered risk 
management approach to grid protection. A HEMP event is a high-
impact, low-probability threat. We take EMP event threats 
seriously, but we must consider them within the context, a 
broader context of all threats. A cyberattack aimed at 
disrupting electric service would be a relatively cheaper and 
easier weapon to deploy and finding the needed nuclear 
materials and delivery vehicle to deploy that type of weapon. 
So clearly, we must place more effort on mitigating the highest 
and most profitable risk, probable risk.
    Given industry cannot protect the electric grid from all 
potential threats, we focus on all hazard recovery, that is, 
regardless of the cause of damage to the electric system, 
preparations to ensure mitigation, response and restoration are 
substantially the same. Grid operators must prioritize critical 
asset protection, engineer redundancy on to the system and 
stockpile spare equipment and as also mentioned, there are 
several programs that are ongoing with respect to enhance that 
capability given these new threats.
    In conclusion, electric utilities are working on multiple 
fronts to increase the scientific understanding of the 
potential impacts of EMP. As policymakers, there are several 
ways that you all can support that effort.
    First, the EMP Commission should be directed to work with 
owners and operators of critical infrastructure, EPRI, the 
North American Electric Reliability Corporation, and help 
assist the Electric Subsector Coordinating Council (ESCC), I'm 
sorry, and assess the vulnerability to the electric grid to 
EMPs. Collaboration between experts on EMP and experts in the 
utility industry will end up with the best product.
    Second, we need to ensure that the classified reports and 
research produced by both DoD and DOE are available and that 
can accurately reflect the threat we're trying to evaluate so 
we can come up with the best solution.
    Finally, this is an extremely complex issue that cannot be 
solved with a one-size-fits-all solution, as previously 
identified. Prescriptive legislative directives could have 
unintended consequences and saddle ratepayers with increased 
cost with no associated value.
    Similarly, protecting the current successful standards in 
process put into place by the Energy Policy Act of 2005 is 
critical. This structure produces standards based upon expert 
input and necessity when it comes to vast and complex bulk 
electric system.
    Thank you for the opportunity to testify, and I look 
forward to answering any questions as part of the panel.
    [The prepared statement of Mr. Wailes follows:] 

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    The Chairman. Thank you, Mr. Wailes. Thank you, all, for 
your comments here this morning.
    Let me start with just a broad question to you all. Is it 
fair to say that you would all agree that an EMP attack is, in 
the first instance, a threat to national defense? Do we agree 
that is what we are dealing with?
    Ms. LaFleur. Yes, Senator.
    The Chairman. Chairman?
    Mr. Gingrich. Yes.
    Ambassador Cooper. Yes.
    Ms. Durkovich. Yes.
    Mr. Manning. Yes.
    Mr. Wailes. Yes.
    The Chairman. Okay, we have agreement here.
    Now the question is what we do with this?
    I do appreciate the various suggestions that have been 
presented here and how we can work to protect, how we can 
become more resilient.
    Speaker Gingrich, you mentioned the prospects for a broad 
infrastructure package and what we might be able to do in the 
context of national security. It begs the question, though, and 
you have indicated, Mr. Wailes and I think others have said, 
this is a tough order. There is really not a one-size-fits-all 
here. But is there commercialized technology the industry could 
use to protect against EMP attacks, and if not, what are the 
barriers to deploying the technology?
    Cost has been mentioned, most specifically, but how 
prepared are we, if we were to get this infrastructure package? 
Do we have something that we could actually lay down there that 
could be constructive? I will let anybody jump on this one.
    Mr. Gingrich. Let me, if I can for a second, I want to 
make, sort of, a deeper point about where we're at.
    We've done an extraordinarily elegant job operating off of 
a paradigm of efficiency to create an electric system for North 
America. It's really extraordinary.
    You now have to shift from that model to a model that says 
you want resistance, redundancy and resilience. Then you have 
to create, first of all, just the model and that's why I said--
part one of this is, at least in part, the Department of Energy 
and the Department of Homeland Security modeling what would 
that system look like.
    It's not a situation where you get a choice, where you get 
to say, you know, I'm going to take the risk of being destroyed 
by cyber because I'm really going to focus on EMP. You've got 
to look at all the major threats, figure out what the notable 
points of defense are against all of them and then design a 
policy to fit that. And this will be the more expensive system. 
Then you've got to figure out what part of that more expensive 
system is a national defense requirement in which case it ought 
to be borne directly by the government. What part can you 
legitimately say we can find offsetting savings, as I mentioned 
earlier, just in cutting the red tape and the time, value and 
money you could save an enormous amount of resources that the 
industry would, I think, be happy to swap and put that money 
back into a more resilient system.
    But I think you've also got to ask the question, I think 
there ought to be real urgency and cutting through all of this 
and setting very tight deadlines for implementation because I 
think we've known since 2004 that the Russians have given the 
North Koreans this capability. We've known since the 1990s that 
the Chinese have been developing this capability. And the 
capacity for a North Korean satellite to have an EMP weapon is 
a very real danger in real time, today.
    So, I think we have to have, well, almost, a wartime 
urgency of setting this up, offsetting the cost and to your 
point, in some areas we don't currently have a solution and 
there are obvious significant research projects, DARPA and 
others, to be engaged in figuring out the specific breakthrough 
points, how are we going to solve these things? Because if we 
don't solve them there's a genuine catastrophe that could 
happen that would be of horrendous consequence.
    The Chairman. Chairman LaFleur, and as you answer this I 
want to know whether you believe FERC has sufficient regulatory 
authority to address these EMP concerns and really, where we 
are with that, as you respond to this other point.
    Ms. LaFleur. Thank you, Senator. I'll take the questions in 
turn.
    So, your first question was is there technology available 
to protect against EMP? The answer is there is some technology 
available to protect some equipment against EMP. For example, 
the military sheaths some of its intelligence equipment in 
metal in some of its intelligence centers. So there is some 
technology available.
    The difficulty on the electric grid is knowing where you 
would deploy the technology to best protect the grid in an 
effective way because when we are going to mandate a standard 
for thousands of transmission owners, we want to make sure it's 
going to work and it's going to do the job that it's intended 
to do.
    Speaker Gingrich has referred to the study of the nine 
substations. I know that's a controversial study. I've 
testified about it here before. That was a study that was 
looking at simultaneous physical attacks on transformers and 
cascading of transformers, whether its results are right or 
not, that's what it was talking about.
    If I were to go to protect the grid from EMP I'm not sure, 
I'm quite certain those nine substations, wherever they are, 
are not where I would go. I'd probably go to the control 
centers first because you can't even turn a substation on and 
off without the communications from a control center. Those are 
ubiquitous in every territory.
    So we need to figure out, for this risk, which is different 
from a storm or a, even different from the risk we're 
protecting against with the physical security standard which 
was for the substations, where is the best place to go? That's 
the work Mr. Manning and others are doing.
    To your second question, we do not have the authority, as 
you know, under the law to write a requirement ourselves and 
say everyone, you have to do this. We have been given a complex 
statute under which we oversee NERC in a voting protocol, and 
they file a standard. We can reject it if it's not strong 
enough and make them change it. We can direct them to do a 
standard but it's a--that's the way the structure works.
    Within that authority, we could certainly direct NERC and 
the industry to do a standard if we believed we knew what they 
should do. And I have every confidence they would respond as 
they have with GMD, physical security, supply chain management 
and other things where they opposed initially but when we 
directed it, they did a standard.
    The Chairman. I appreciate that, thank you.
    Senator Franken.
    Senator Franken. Thank you, Madam Chair.
    In reading through the testimony provided for today's 
hearing, it became clear that some of the witnesses are quite 
alarmed about the threat of an EMP attack and the potential 
societal impacts and others are clearly more circumspect.
    Chairman LaFleur, could you comment on where we should 
direct the efforts and resources we devote to enhancing grid 
security? What should our priorities be? Where would you place 
physical attacks which is on Metcalf, cyberattacks, EMPs, GMDs 
and other threats on a triage list?
    Ms. LaFleur. Well, it's a difficult question because we're 
comparing attacks that are very numerous and kind of low 
barriers to entry, like cybersecurity when you don't have to be 
a nation-state. A lot of people can do it too, as several have 
said, high impact, low probability.
    I mean, I think that, first of all, we have to have a 
strategy for all attacks. I think right now I would probably 
put cybersecurity as number one, but that doesn't mean we don't 
need to protect our substations from physical attacks or that 
we don't need to protect against solar storms, which we are 
protecting against, and work on the EMP issue and figure out 
how to protect that.
    I think taking a step back, to me, where we should be 
going, the real solution, is to build resilience into the grid, 
to build the grid in a way that we have more redundancy, that 
we can island, that we have more inventories as we're working 
on because that works against all risks.
    I think resilience, which is increasingly where our efforts 
are going, is the strategy that works, whether it's a hurricane 
or an earthquake or something else.
    Senator Franken. So when you are talking about island mode, 
making sure there are just, sort of, circuit breakers, the 
opposite of circuit breakers, just so that if one goes down, 
not everything goes down.
    Ms. LaFleur. Well, you can't obviously, you can't have a 
backup for everything, but we have standards, for example, that 
critical control centers have to have backups, secondary supply 
lines and so forth.
    In the geomagnetic disturbance standard, the first part of 
the standard we put out was an operating procedure standard. 
When we hear from NOAA that there's a solar storm coming within 
half an hour, there's an immediate transmission to every 
control center in the United States. And they have to know, 
okay, which--how do I go into safe mode? What do I do in the 
time that I have?
    Now, we might have no warning of a bomb, but for GMD, 
that's precisely what they're working on.
    Senator Franken. Okay.
    Mr. Wailes and Mr. Manning, can you give the perspective of 
those who work in the industry and daily face of the near end, 
long-term threats to the security reliability and resilience of 
our electrical system? Which threats do you believe we should 
prioritize?
    Mr. Wailes. I actually concur with Chairman LaFleur. And 
we're looking at today's environment, we see the cybersecurity 
threat as a much higher threat. And we have a significant 
investment and a lot of work going toward that, as we speak.
    But I would like to address, kind of, the perception that 
we don't have a lot of redundancy built into the system now. 
That is actually part of the core of reliability, again, is 
electric utility, reliability and low cost are our primary 
objectives, but reliability is the primary one.
    So whether you're talking about, you know, transformer 
capacity to serve substations or you're talking about circuits, 
all of that is looking at that reliability is built into your 
generation fleet. When you look at how you plan against 
generation and reserves for different types of events, that is 
something we do routinely, but there are different things that 
we're looking at with current day threats that hadn't existed 
previously and how we're going to deal with those.
    The research that EPRI is doing, the work we do, for 
example, with the ESCC. I think one of the striking things, 
many of you may have heard about the GridEx exercises which are 
really significant exercises that are developed between the 
Electric Subsector Coordinating Council, NERC and the ISAC, 
which is the electric sector Information Sharing and Analysis 
Center. They take a year and a half to develop these exercises, 
and they look at very catastrophic types of events.
    Some of the learning out of that that we get between the 
Federal Government partners and the industry is more of an 
understanding of how much redundancy is in the system and some 
of the issues that we have to actually share information about 
how are we going to be more resilient and how are we going to 
respond. All of those things are an ongoing approach for us, on 
a continual basis.
    The difference is those threats are changing. And that's 
one of the things we found, even with the EMP threat. And we 
all thought there was a cold war we didn't have to worry about 
that anymore, nor did we have, as pointed out in the opening 
comments, the kind of sensitive--we had analog devices. We 
didn't have devices that were as sensitive as we do today.
    So as those threats have evolved, we have to get more 
understanding about how they impact what we do. And we also 
know that the easier threat now to us is a cybersecurity threat 
and the physical security threats.
    Senator Franken. I know I am way over.
    Mr. Manning, would you respond to that briefly?
    Mr. Manning. Yes, Senator.
    The first thing that came to my mind is that we like the 
information to make that decision, that we react, based off of 
our experiences. So if we have a high probability of 
cyberattack, then we immediately respond to cyber issues.
    We lack sufficient information to understanding exactly 
what the probability is and what the severity is of attacks 
like EMP. That information is becoming clearer and we're 
beginning to understand that. And once we have adequate 
information about EMP, then we can balance that sufficiently, I 
believe, with threats like cybersecurity where we have quite a 
bit of information.
    Actually, I think we talked about it earlier that risk is 
really about managing probability and severity and we have to 
look at both of those things. Well, in the industry we can do 
absolutely nothing about probability of an EMP attack, so we're 
focusing all of our efforts on severity. And if we can reduce 
the consequences of an EMP attack to the point where the 
probability no longer matters, then I think, we've actually 
made progress.
    Senator Franken. I just want to make one last comment which 
is really a question.
    Is this an argument for more distributed energy, more solar 
panels on rooftops, more island mode energy?
    The Chairman. Let's go to Senator Cassidy.
    We will leave that question hanging.
    Senator Franken. The hanging question.
    Senator Cassidy. I will start with Ms. LaFleur.
    Madam Chair, the Hawaii outage after the atmospheric 
nuclear test, was that due to an E1, E2 or E3?
    Ms. LaFleur. I believe it was due to E1. I believe it was 
communications equipment that was destroyed.
    Senator Cassidy. Mr. Manning, you all have looked at, you 
said, E3 and found it to be less consequential than a severe 
GMP. What I read in my notes is that E2s are more like 
lightning so it seems like E1 is, you said, not yet tested.
    Now, again, just coming up to speed, what you already know. 
So that is communications. Would that also threaten the grid or 
no, would this be specific--more likely to affect 
communications?
    Mr. Manning. If I can circle back on that question.
    Our findings on E3 are also partial. There is still 
additional work to be done on E3. We specifically investigated 
impact of bulk power transformers. We looked at the 37,000 or 
so bulk power transformers in the continental U.S. grid. As a 
result of only the E3 pulse, what we discovered is that the 
damage to those would likely be less severe than originally 
thought.
    It has----
    Senator Cassidy. I only have three minutes.
    You have got to hustle, man. I am sorry.
    [Laughter.]
    Mr. Manning. It has a correlation to GMD, but it's not 
directly related to GMD; however, you can't stand that up on 
its own. It must be associated with the plethora of energy 
waves from a nuclear attack. So you must consider E1, E2, E3, 
all together, and we've only begun to consider that.
    Senator Cassidy. I got ya. So, whatever my questions about 
E1, it has to be considered within the context of E1, E2, E3, 
conglomerately.
    Mr. Manning. Absolutely, unless it's a handheld device 
which is only an E1 pulse.
    Senator Cassidy. Madam Chair, speaking of a geomagnetic, if 
I am getting all that right, what I quickly read about the 
Carrington event is that there was a 17.6-hour lead-in. They 
saw the flare, but the physical effect was not seen. And I read 
that in some places they actually unhooked their telegraph from 
the power source.
    Typically you would have a several day lead-in. We see the 
flare. That said, is it possible if there is such a flare from 
the sun that everybody could go home and unplug their 
computers, put in their surge protectors and otherwise protect 
their equipment?
    Ms. LaFleur. Well first of all, much more so than in 1859, 
our weather satellites give us good information, usually you 
know several days ahead something is coming, but the details of 
where it's going to go is more like in minutes or hours than 
days.
    That's the purpose of the operating procedure standard that 
is communicated to the control centers so they can protect the 
high voltage transformers and so forth, which take a lot longer 
to replace which are the most impactful equipment on the system 
in many ways.
    In theory, you could go protect your own equipment, but the 
solar storm doesn't have the same effect on communications. So, 
I don't think there's a lot of concern that it would destroy 
home electronics.
    Senator Cassidy. I guess I was using that as, kind of, a 
metaphor.
    Ms. LaFleur. Yes. Electric companies could do things like 
that.
    Senator Cassidy. They could. So we do have some advance 
notice and we could take some protection?
    Ms. LaFleur. That's why that was the first standard we put 
in place because you don't have to do equipment modifications. 
It's actually just planning of what you would do.
    Even when I used to run a distribution company, even when 
we had hurricanes or snow storms coming, sometimes you 
configure your system in a different way to prepare because you 
know where your vulnerabilities are. It's similar, but bigger 
scale.
    Senator Cassidy. Now going back to the point that Senator 
Franken made that some of you were more sanguine and others 
less so. I read about a 1989 geomagnetic storm which only 
affected Quebec and maybe a few Australians over in Namibia, 
but as far as I know it didn't affect Louisiana. That said, it 
tells me that even though we were about this being global at 
first, at times we have these geomagnetic storms and it is 
local.
    Ms. LaFleur. It depends on the size of the solar flare. One 
like a Carrington event is larger. Most of them are more 
regional. Our standard that's now in effect requires specific 
mitigation depending on the latitude and the soil and so forth.
    Louisiana is a little closer to the equator. In general, 
the poles are--this is one--you have a lot of hurricane issues, 
but this particular problem closer to the poles is generally 
considered more exposed to solar radiation.
    Senator Cassidy. So my kind of sense from everything, what 
you're saying is that we really do have an understanding and 
some advance warning that someone said if we can prevent it, 
it's a lot better, that at least with that which might come 
from the sun, granted it could overwhelm and the Speaker 
mentioned that.
    Ms. LaFleur. Yes.
    Senator Cassidy. But still we are somewhat prepared for 
that from the solar.
    Ms. LaFleur. Well, because we monitor all the time, some of 
the transformers have monitoring attached, they can get regular 
updates on what's happening with the sun and how it affects 
them. Fortunately we don't have a lot of experience monitoring 
explosives in the upper atmosphere. That's not the kind of 
monitoring experience we want to get. So, you can't develop the 
fact-based, experience-based information like with the sun.
    Senator Cassidy. Got it.
    Thank you. I yield back.
    The Chairman. Thank you.
    Senator Wyden.
    Senator Wyden. Thank you, Madam Chair and thanks to all of 
our witnesses. This is a very, very hectic day. The Speaker 
knows a little bit about what those are like up here. I just 
have a couple of questions.
    First, I want to note a point I am not sure has been made, 
and that is in the skinny budget the cuts that the 
Administration is looking at for agencies like NOAA and NASA is 
going to make it much tougher, much tougher, for the Congress 
on a bipartisan basis to deal with the important issues that we 
are talking about here today.
    I think there is a real role for government to play as it 
relates to improving the resiliency of the grid, and those are 
the questions that I want to touch on with all of you. I will 
start, Mr. Manning, with you and Ms. Durkovich.
    As you know, what we really are concerned about in our part 
of the world is the large earthquakes along the Cascadia 
Subduction Zone. This is a major, major issue for the people of 
the Pacific Northwest with respect to this whole issue of 
resiliency.
    Now my take, with respect to the science, and it picks up 
on a point where, I think, Senator Franken was trying to go, is 
microgrids and distributed energy resources. And here we are 
talking about rooftop solar. Energy storage can play a very 
real role in helping the grid quickly recover if you get hit by 
an event like this.
    So, for you, Mr. Manning, and you, Ms. Durkovich, could you 
just briefly walk the Committee through the role that these 
technologies could play in adding resiliency to the electric 
system when we are thinking about, in our part of the world, a 
physical threat like a Cascadia disaster?
    For you, Mr. Manning, and you, Ms. Durkovich.
    Mr. Manning. So it's an excellent question, thank you, 
Senator.
    There is no doubt that distributed energy that is grid 
connected introduces additional redundancy to the grid. As 
Kevin mentioned earlier, redundancy is a part of reliability. 
So the more redundancy we can add and couple into the grid, the 
greater potential we have for increasing reliability.
    But it's not a failsafe. In the event of an earthquake, for 
example, distributed energy is probably an excellent solution 
to offer alternatives to centralized generation. In the event 
of an EMP, by contrast, there's nothing that specifically 
protects those distributed energy resources any better than the 
centralized energy resources. So in the event of an EMP, you're 
likely to see the control systems for rooftop solar or for 
storage or for microgrids would also be impacted by that EMP. 
They would also be rendered ineffective unless they're hardened 
specifically for that. However, for weather events, for other 
events, even potentially cyber events, they add value because 
they add redundancy.
    Senator Wyden. Okay.
    Ms. Durkovich?
    Ms. Durkovich. Thank you.
    That's really an excellent question. I think another 
example of how government and industry have come together to 
think about how we are going to address impacts to the grid 
from some of these lower probability, high impact events. In 
2016, there was a major exercise called Cascadia Rising which 
focused on just this, the Cascadia Subduction Zone and the fact 
that, like a Carrington event, we are a little bit overdue for 
this scale of earthquake in the Pacific Northwest.
    I would agree that certainly distributed energy can help 
speed restoration to the communities, but this is, again, 
another type of incident where we really need whole of 
community effort when you think about the potential damage and 
consequences that we're going to see in something like this.
    And so, it is important for us to continue to do the large-
scale exercises that bring together our state and local's 
industry and government to help us think about, alright, what 
are the impacts going to be to the grid? What are the impacts 
going to be to communications? To transportation? How are we 
going to get basic commodities into this area? How are we going 
to make sure first responders can get in and equally important 
the utility and the linesmen, to help get the systems up and 
running?
    So this is not an easy challenge, but it's why we bring 
folks together to think through, alright, what are we dealing 
with and how are we going to speed recovery?
    Senator Wyden. Very good. Thank you all.
    The Chairman. Thank you, Senator Wyden.
    Senator Risch.
    Senator Risch. Thank you, Madam Chairman. Thank you for 
holding this hearing.
    We have heard a lot of criticism, or at least concern this 
morning, about the government's response to the growing threat 
of grid security and to cybersecurity. In large part, I think, 
there is certainly criticism to be had and certainly a lot of 
concern to be had.
    Part of it, I think, has grown out of frustration that, I 
think, there isn't a lot out there about what the government is 
doing. I sit on the Intelligence Committee, Senator King sits 
on the Intelligence Committee and Senator Wyden sits on the 
Intelligence Committee. I can tell you that these issues have 
not been ignored by the United States. Most of what we know 
about it, most of what we are doing about it, cannot be 
discussed in this setting. It is going to be a closed setting, 
only for people with the security clearance necessary.
    So, in that regard, it isn't quite as bad as what everybody 
is saying. But Speaker Gingrich, your deep insights into the 
consequences are greatly appreciated. We have been through 
these exercises and your statements are certainly not 
overstated.
    I would take issue though, as far as your recommendation, 
if we have an infrastructure bill coming. I can tell you based 
on what we know about where we are and what we are doing, I 
think that is appropriate at some point in time, but we are not 
ready yet.
    You saw what happened when they had this last $2 trillion, 
whatever it was, bill to stimulate. When you start throwing 
money at the wall a lot of it doesn't stick, and the term 
``shovel ready'' was used a lot. We are really not ready. We do 
not have shovel ready products yet. Certainly, we need more 
research and that could be included in that, but I would just 
be a little reluctant to start digging and laying stuff in the 
ground at this point.
    But there are things going on on this, and I think a lot of 
us on the Intel Committee are convinced that the next 
significant events in America are going to be a cyber event. 
That is where we have vulnerability. But certainly the grid is 
linked to that. And the bad guys, of course, Senator Franken 
had asked which was more, what is the most concerning right 
now? Well, we have to be able to walk and chew gum at the same 
time because, as we sit here today, there are different people 
working on different ways to attack us. And these are all 
included in that, whether it be North Korea trying to develop a 
weapon to drop on us or whether it be other state actors and 
non-state actors who are trying to get us through the grid and 
through the cybersecurity.
    Ms. LaFleur, thank you for the shout out today at our 
National Laboratory. Obviously, we are becoming, in Idaho, the 
go-to and the flagship on grid security. You saw the test bed 
that we have out there and the kinds of things that we are 
doing there on grid security, working with private industry. I 
think most Americans would be very pleased to see what is going 
on out there and the kinds of things that we are doing to try 
to mitigate them as we go into the future.
    In any event, we are going to continue to work on this. I 
think it is important. I really appreciated Ms. Durkovich and 
Mr. Wailes' description of risk management because, you know, 
after you sit here for a while today, you realize the threats 
to America, how many there are and how diverse they are and the 
widespread places that they come from.
    There are a lot of people out there that just, for their 
own reasons, want to do us harm. And yes, we have to be able to 
walk and chew gum at the same time. Yes, we have to be able to 
address all those threats. But you have got to do it on a risk 
management basis because there isn't enough money in the world 
to protect us 100 percent, whether it be the grid or whether it 
be the cybersecurity or just a normal kinetic attack.
    There was frustration, I think, expressed for the 
Department of Defense. We work with the Department of Defense, 
the Intel community works with the Department of Defense all 
the time, and I think that criticism is probably pretty well 
taken. I say this with great love and respect for the Defense 
community, but they are much more focused on the classical kind 
of warfare and the classical kind of defense that has always 
been and we have always challenged them to provide for America.
    These new things that are coming along, like cyber and grid 
and what have you, have not been in the wheelhouse. They are 
getting up to speed but so is the electrical industry and 
everything else.
    Probably one of the most telling things we hear in the 
Intel community is when we have these experts in on the grid 
and everything and I think this, kind of, put it in perspective 
for me. When you work on these problems and you try to predict 
what is going to happen and then try to design a defense to it, 
these people will tell you, when it comes to cybersecurity we 
are where the Wright Brothers were. We don't know what we don't 
know. And we keep learning things.
    A good example of that as Speaker Gingrich very rightly 
pointed out is the fact that all of this stuff is designed for 
efficiency. Well, when you design it for efficiency, you design 
in huge vulnerabilities.
    The Ukrainian attack taught us something. In fact, some 
legislation came out of that, and that is that the Ukrainian 
attack was not as bad as what it could have been because their 
system was not very efficient. It actually had to go through 
human beings. And when it got to these human beings, the human 
beings recognized what was going on and they were able to 
mitigate that.
    Senator King and I are co-authors of----
    Senator King. S. 79.
    Senator Risch. S. 79. Thank you, Senator.
    We call it the back to the future bill where you actually 
back up and start to look at these efficiencies and see if 
there are some places where we can put in some of these kinds 
of things.
    Anyway, I have talked long enough. Again, this is an 
incredibly important hearing, incredibly important subject. 
Thank you for holding it, Madam Chair.
    The Chairman. We appreciate that input, Senator Risch.
    Senator King, now you can speak to your bill here.
    Senator King. Thank you.
    First, I want to welcome Speaker Gingrich. It is always a 
pleasure to have your wisdom and insights. I still remember 
very well a day we spent in Maine when we were lonely voices 
talking about digital education back in about 2000, so I 
appreciate that.
    Mr. Manning, and I think this gets a little bit to where we 
have been focusing today, we were talking about distributed 
energy and you appropriately said that could be a part of the 
redundancy and defense. Unless they are hardened, you said. 
That is my question. Are there reasonably priced, hardening 
tools out there? In other words, could we build in to every 
house, as part of the electrical system, some kind of high test 
surge protector that would be a defense in this situation? And 
by the same token, a similar kind of device in the grid back at 
transmission points?
    Mr. Manning. That's a wonderful question.
    I think the answer to that is there could be. Today, it's 
probably not, as we just heard, is not shovel ready. There are 
a lot of different components that need to be added together. 
But this will take a fundamental design change, in some 
respects, particularly for home-based equipment. You'll have to 
think about it differently and make just complete design 
changes----
    Senator King. Are the utilities thinking about this for 
their critical points? In other words, to me this is an 
insurance question.
    Mr. Manning. Yes.
    Senator King. How much is the insurance policy going to 
cost versus the risk?
    Mr. Manning. And one of the things that we are doing with 
our report which will be out this summer is taking the military 
EMP standards and converting those to utility standards.
    What we will find is that applying those utilities, those 
military standards to utilities broadly, will be prohibitively 
expensive. It's very difficult, it's very challenging, it's 
hard to do and it's very expensive.
    So utilities may still choose, as we've heard already, they 
may choose to pick perhaps nine points or something like that 
and harden those points with military standards. But it won't 
be practical to support the whole system until we develop some 
more effective and lower cost alternatives.
    Senator King. It seems to me this is a place for American 
ingenuity and inventiveness and creativity to market for 
somebody.
    Mr. Manning. Absolutely.
    Senator King. An important market for homes as well as for 
the grid itself.
    The bill that Senator Risch mentioned mandates a study. I 
should not have used the word mandate, suggest a study 
involving Idaho National Lab and several volunteer utilities on 
the possible importance of putting at certain points in the 
grid, analog devices, which is what saved the grid in Ukraine 
and that is exactly what we are trying to do. It is a bill that 
came out of our work on the Intelligence Committee, both of us 
are also on this Committee. And it is a great bill, Madam 
Chair.
    But I think, Mr. Speaker, you have done a lot of thinking 
about this. We cannot defend ourselves. We cannot install 
defenses that are so expensive that they far outweigh the risk. 
How do we get products that can solve the problem?
    Mr. Gingrich. Well, let me use this as an excuse to make 
three quick points, ending on that one, okay?
    Senator King. Fine.
    Mr. Gingrich. First, every member of Congress already got 
briefed on the concept of hybrid warfare, what you're seeing in 
Ukraine.
    Senator King. Yes.
    Mr. Gingrich. Because it's what makes the whole panoply of 
risks come together simultaneously. You don't know----
    Senator King. We are seeing warfare change before our eyes.
    Mr. Gingrich. That's right.
    And just as I talked about the paradigm change earlier, 
from efficiency to looking at resistance, resilience and 
redundancy, we have to rethink from the ground up what we mean 
and what the military means and what Homeland Security means.
    Two, if I walked in here and said to you, you know, I've 
been thinking about how we run our cities and I can't decide 
whether we've got to cut out food inspection in the restaurant, 
the sewer, the fire department or the police. Which one do you 
think we should drop? Because that's what we're doing right now 
in terms of this. If we had no choice as we rethink our 
infrastructure but to look at the totality of potential 
disasters and decide are we going to figure out a design that 
meets the totality. See, you can't say let's set priorities 
because the one you don't pick may be the one that kills you.
    Senator King. Sure.
    Mr. Gingrich. Lastly, there's a terrific book. I just did 
my newsletter yesterday. I very seldom do book reviews in my 
newsletter but it's called, ``The Weapon Wizards.'' I recommend 
it. I'd like to get every member of Congress to read it. It is 
the Israeli capacity to innovate and how dramatically they've 
done it and they're really cheap, okay?
    One of the things that I hope Trump is going to bring to 
the Pentagon, which would, as a Conservative, I'd like to see 
reduced from a Pentagon to a triangle by eliminating 40 percent 
of its redundancies.
    [Laughter.]
    But I mean this quite seriously.
    We start out and we say, since we have to design an 
absurdly expensive, over-engineered obsolete model based on 
work done in 1963, if you applied that to the grid you couldn't 
afford it. To which the correct answer is, well, what if you 
went out and asked every smart, young person in America to come 
up with a $9 version that could be sold on Amazon?
    Senator King. Exactly.
    You would be interested to know that we have had testimony 
at the Armed Services Committee in the last couple of months 
that Silicon Valley basically will not deal with the Pentagon 
because it is so, I would call it byzantine, but that would be 
an insult to the Byzantium empire.
    [Laughter.]
    Because it is so burdensome and cumbersome, and we are 
losing the innovation race.
    Mr. Gingrich. And at least half of that is the Congress 
which imposes patterns that are so stunningly stupid that if 
the Congress would look at the things it has passed into law in 
the past 40 years and get rid of half of that and then 
challenge the Pentagon bureaucracy to get rid of the other 
half, you'd be startled a year from now how rapidly we'd be 
innovating and how cheap it would be.
    Senator King. I am shocked you would use the words stupid 
and Congress in the same sentence, Mr. Speaker.
    [Laughter.]
    Mr. Gingrich. I apologize.
    Senator King. Thank you, Madam Chair.
    The Chairman. Thank you.
    Senator Manchin.
    Senator Manchin. Very quickly, thank all of you for being 
here, we appreciate it very much. Speaker Gingrich, it is 
always good to have you here.
    Chairman LaFleur, first of all, anybody can answer this and 
if you have any comment to it, but the likelihood of the EMP 
attacks, the likelihood of where we are most vulnerable. I came 
in a little bit late because, as you know, in this place we 
have competing committee meetings. But is it basically from a 
weapon from another country or is it basically going to be home 
grown to do damage to the delivery system? Where do you think 
we are the most vulnerable? Or what are you concerned about in 
vulnerability?
    Ms. LaFleur. Well, the so-called suitcase EMP.
    Senator Manchin. Yes.
    Ms. LaFleur. A handheld device is, obviously, much easier 
to build than a bomb, but it's also easier to protect against. 
I think some of the these we're doing, we do know how to put 
fences on substations and cameras and perimeter zones if you 
have to throw something in somewhere, we know how to protect 
that. So I think that's more likely, but easier, to protect 
against.
    Senator Manchin. You are requiring that because I can tell 
you we have an awful lot of power generating in West Virginia.
    Ms. LaFleur. Excuse me?
    Senator Manchin. We have a lot of power generating in West 
Virginia.
    Ms. LaFleur. Yes.
    Senator Manchin. And we light up most of the East Coast 
which they do not know about.
    Ms. LaFleur. Yes.
    Senator Manchin. If we ever turn the coal off, they would 
go dark. Maybe we should do that.
    Anyway, the substations, I have seen substations that are 
very vulnerable. Are you requiring them to basically solidify 
that and protect?
    Ms. LaFleur. What the physical security standard did was 
required each company, each transmission operator or owner to 
identify their most critical substations and come up with a 
specific plan to mitigate against physical attack.
    Senator Manchin. Do you have anybody that inspects it?
    Ms. LaFleur. Excuse me?
    Senator Manchin. Does anybody inspect it?
    Ms. LaFleur. Yes, we are inspecting and NERC does the first 
audit and FERC----
    Senator Manchin. Well, if I see some vulnerable situations 
I can call you?
    Ms. LaFleur. Yes.
    [Laughter.]
    Always.
    But the--so that's that thing. I think the high-altitude 
HEMP----
    Senator Manchin. Yes.
    Ms. LaFleur. The high-altitude EMP is, I don't remember the 
adjective you used in your question, troubling because we, 
unlike the smaller, we don't know----
    Senator Manchin. I understand.
    Ms. LaFleur. The most--way to protect it.
    Senator Manchin. You had something, right? Ambassador?
    Ambassador Cooper. Yes, I don't know how to put a 
probability statement on but let me give you a couple of facts.
    In 2004, several Russian generals who were experts in EMP, 
and I would note that they did more effective tests on this 
effect over populated areas, in fact, in the '62, '63 timeframe 
than we did. They learned more about it than we did.
    They told the commissioners, the EMP Commissioners, that 
they had passed, inadvertently, I think they said, but the 
information on how to design a super EMP weapon that is a low-
yield device that produces lots of gamma rays.
    Senator Manchin. At a high altitude?
    Ambassador Cooper. High altitude, to the North Koreans, 
okay, who in turn, as you know, worked in a direct alliance 
with Iran on everything.
    North Korea, by most estimates, has already anywhere from 
10 to 20 nuclear weapons. We take comfort in the fact that 
there have been low-yield tests in North Korea.
    Well low yield is what you use to produce a super EMP 
weapon, and they allege that they can launch this. They don't 
allege, a lot of experts I know claim that they can launch 
this, as Speaker Gingrich said, or put it in a satellite which 
comes toward the United States from our south, our undefended 
south, okay? We have no defense against that nor do we have a 
defense against missiles launched from ships in the Gulf of 
Mexico.
    We have not put our--we know how to do it. This is not a 
matter of ignorance. And actually it's not a matter of cost 
either, which I'd be happy to defend another time, but we know 
how to do it. We just simply are not doing it. We're deploying 
what's called Aegis Ashore, and I'm proud of that system 
because I started it, you know, when I was running the SDI 
program. It's deployed around the world on our ships, it's 
deployed on the ground in Romania and will be operational in 
Poland by the end of the year. We have an operational site in 
Hawaii.
    We ought to put a site in Panama City on First Air Force 
base at Tyndall Air Force base where First Air Force has the 
responsibility of the defense of the United States, give them a 
missile defense mission too.
    Senator Manchin. Do you mind if we bring in----
    Ambassador Cooper. We know how to do this.
    Senator Manchin. Do you mind if we bring you to the Intel, 
a little Intel briefing?
    Ambassador Cooper. I beg your pardon?
    Senator Manchin. The Intel Committee for a little briefing, 
would you come?
    Ambassador Cooper. I certainly would. I have my clearances 
still, by the way, so I wouldn't mind transferring them in.
    Senator Manchin. That is great.
    Ms. LaFleur, if I may, while I have got you, just real 
quick.
    The vulnerability basically is reliability of the grid 
system. Do you feel comfortable of the system of this grid when 
the vortex almost, the polar vortex, about took us down that 
one time? I mean, where are we today, right now, in your 
evaluation, with the amount of diversity we have going into the 
grid, as far as electricity sources?
    Ms. LaFleur. Well, today we still have quite a bit of fuel 
diversity. Coal, as you already referred to, plays a very 
important role in baseload in most parts of the country. And we 
have increasing natural gas and increasing renewables. And the 
system operators are learning to run----
    Senator Manchin. Do you consider gas as being a baseload?
    Ms. LaFleur. It depends. Some, the big combined cycle, some 
of them are run as baseload run all the time and then there's 
also----
    Senator Manchin. But are you concerned?
    I am just saying from the reliability, baseload, to me, 
means uninterruptable power. Coal and nuclear base are 
uninterruptable. They have what they have. Gas is a pipeline 
delivery system that can be targeted by terrorists or any other 
type of a natural disaster. But you are building, we are 
building baseload of something that could be interrupted. Is 
that correct?
    Ms. LaFleur. It's correct that to the extent we rely on 
gas, we have to build in fuel security that's different than 
the fuel security of coal which you can look out and see the 
pile.
    Senator Manchin. Sure, absolutely.
    What is your feeling of comfort on the reliability of the 
grid?
    Ms. LaFleur. I think most parts of the United States are 
well supplied with gas pipelines but we have places where there 
are constraints and I think operating the grid with all the new 
technologies is something we're still working on.
    Senator Manchin. Does anybody have anything else they would 
like to add?
    Ambassador Cooper. Yes, Senator.
    We've talked about E1, E2, E3. E1 is the high frequency, 
high amplitude, narrow pulse that causes damage to solid state 
electronics.
    Our natural gas pipelines, portions of the grid itself and 
petroleum pipelines, probably are controlled with little units 
called SCADAs, little, small computers that are vulnerable if 
we haven't taken special precautions to harden them. And my 
information is we haven't. So, we have critical infrastructure 
to the operation of the, of all of our grid to these kinds of 
effects from nuclear, high-altitude explosions. And as I said 
earlier, I don't know how to put a probability statement on it, 
but I can tell you the threat is absolutely real.
    I've worked on these problems for most of that half century 
since we began seriously improving our strategic systems to 
deal with it, and we set priorities in the Department of 
Defense. We didn't try to harden everything. We hardened what 
we thought was the most important things.
    In my opinion, in the grid, we should be paying careful 
attention to our nuclear power plants to make sure they aren't 
a hazard if their grid goes down and they have to shut down--we 
don't want Fukushimas all over the place. So we need to make 
sure we have power to those, just to keep them safe and then to 
bring them back up to help support----
    Senator Manchin. I want to thank all of you. I appreciate 
it very much. Thank you.
    Ambassador Cooper. Thank you.
    The Chairman. Thank you, Senator Manchin.
    There has been discussion here about what we see out of 
Israel with their level of innovation. Ambassador Cooper, you 
have referred to other initiatives around the globe, but in 
terms of what other countries are doing specifically to address 
a HEMP or other EMP-related event. Is anybody, kind of, leading 
the way here? Are there best practices that we might want to be 
looking to? Who is doing some good things?
    Ambassador Cooper. The Israelis, the United Kingdom, I 
would go talk to those folks. We have international conferences 
every year----
    The Chairman. To what extent do we cooperate with them 
then?
    Ambassador Cooper. We meet with them.
    There's a big difference though, their government tends to 
control what's going on.
    The Chairman. Right.
    Ambassador Cooper. Whereas in this country, as I said to 
you earlier, we have a crazy quilt of electric power companies 
across the nation. Why, I believe, we have to work from the 
bottom up and island, that term we've used here, around our 
nuclear power plants, keep them safe, bring them back online. 
We get 20 percent of the nation's electricity from those 
plants. And so, that's a valid resource if we lose the entire 
grid.
    Today, I don't have confidence that we can do that because 
we don't have these crazy quilt components connected. So, we 
have a serious problem here, and we have been ignoring it 
collectively. I'm not trying to point fingers at anybody, but 
that's the reality.
    The Chairman. Chairman?
    Ms. LaFleur. Thank you for the question.
    We have Memoranda of Understanding with Israel, Norway and 
some other countries, the U.K., to work on these things.
    I would say, in the solar storm area, Scandinavia, is 
probably, the Scandinavian countries are doing the most. 
Obviously, their location would justify it and----
    The Chairman. Well, the United States actually has a 
location up there too.
    Ms. LaFleur. Yes, that is correct.
    The Chairman. It's called Alaska.
    [Laughter.]
    Ms. LaFleur. My feelings exactly.
    Ambassador Cooper. She noticed that.
    [Laughter.]
    Ms. LaFleur. That's why GMD has really been one of my 
biggest priorities, my feelings exactly.
    On the grid security defense area thing, I would agree with 
the Ambassador that Israel, the entire Israeli grid is--it's 
just a different society in the way things are run. We have a 
much more open society in terms of how our infrastructure is 
designed and set up, I mean, and so, I think, in security 
Israel is probably leading.
    The Chairman. Let me leave you with one question. Again, I 
am going to allow anybody to step in here. Ambassador, you 
mentioned this crazy patchwork that is out there. Some have 
mentioned the imperative of public/private partnership, but in 
order to have a public/private partnership there has to be a 
little bit of trust there, there has to be a willingness to 
share some information.
    In fairness, I think we have seen some instances where 
information gets out there and you get burned in the media. 
Probably the most current example is what happened in December 
in Vermont. As I understand it, Burlington noticed an alert 
about a suspicious IP address that had connected to one of 
their computers. They responded, reported. The next day, the 
Washington Post somehow learns about it. Then you have reports 
about Russian hackers infiltrating. Later follow-up shows that 
the IP address was not necessarily linked to Russia. It was not 
necessarily malicious activity. But you really have eroded any 
trust that may have been out there.
    So how do we do a better job of this? How do we work to 
restore this level of trust and build a relationship that is 
going to be necessary in order to really address this?
    Mr. Wailes?
    Mr. Wailes. Well, I think that we have a perfect example of 
that of the relationship that the industry has built with the 
Electric Subsector Coordinating Council, the Department of 
Energy and the Department of Homeland Security.
    There is no doubt that that was a significant issue and a 
learning experience for everyone. But I think that one of the 
things that needs to also be taken away is that proves the 
effectiveness of getting that information out because 
information came out, you know, here's some suspicious IPs that 
you need to look for, report to us right away. And that 
function worked. Now was there a communication issue and a 
potential issue associated with that, yes, and I think we're 
working on fixing that like we are lots of other issues between 
us.
    The relationship, I think, between the industry, actually 
within the industry and within the industry and the Federal 
Government is stronger than it's ever been, recognizing we have 
a lot of common issues and we need each other's help in order 
to make the nation stronger. And I think we're doing a good job 
of that.
    We have a long ways to go. There are a lot of threats, a 
lot of issues. But there are just so many examples of how that 
working relationship has worked. And I think, when we talk 
about that, one of the things we should even think about is 
five years ago you did not have a lot of security clearances in 
the industry. And now, thanks to DOE and DHS, even a utility 
our size has six or seven people that would have security 
clearances. We're able to do things they could never do before, 
and we're able to share information that we couldn't do before. 
So it's a learning experience. We all understand the 
communication challenges, and I think we're on the way to, at 
least for our sector, to do that.
    Now, we also are very interested in trying to build a 
stronger relationship with those other connected sectors that 
have issues and trying to make sure that we actually look at 
cross sector coordination, such that the other critical 
sectors, along with the electricity sector, actually can have 
that same functionality with the government.
    The Chairman. Well, I am encouraged to hear you say that 
you think things are getting better in terms of providing that 
level of security clearance because we had a hearing, not more 
than six weeks ago, where that issue was raised about the 
frustration with how long it actually took and it was actually 
a former member who was the former head of the Intelligence 
Committee on the House side and was still having trouble 
getting his clearance.
    Mr. Wailes. I don't know what the current process is, but 
the number of people from years ago that we got in, through 
that process, was much higher than through that.
    The Chairman. Yes.
    Ms. Durkovich?
    Ms. Durkovich. Yes, an excellent question.
    And while the incident that you referred to is unfortunate, 
I would say, overall, the trust that has been established 
between government and industry in the partnership is stronger 
than it's ever been.
    Kevin alluded to many of the activities that we have 
underway. In my former position I actually ran the private 
sector clearance program which is the program that provides 
clearances to infrastructure owners and operators who have the 
need to know. When I left, I think there were roughly about 
3,000 owners and operators that had clearances.
    Clearly what happened at OPM has slowed the ability for us 
to provide those clearances in a timely manner. But I think 
that those timelines are clearing up and those clearances, as 
well as many other authorities that Congress granted DHS, and 
that's everything from the protected, critical infrastructure 
information program to the critical infrastructure partnership 
advisory committee which allows us to both share information, 
to ask for vulnerability information from owners and operators 
to protect it from regulatory purposes from state sunshine 
laws, from FOIA.
    So we can take that information, we can investigate, we can 
do forensics, we can anonymize and we can push it out. Industry 
is one key part of how we share information.
    As part of the Electric Sector Coordinating Council and all 
of the other sector coordinating councils, we bring industry in 
on a regular basis to provide them with threat briefings, with 
classified briefings, to help them understand this complex risk 
environment. We can have conversations that are not available 
to the public about what we should be doing to protect our 
infrastructure. And the list really goes on.
    But I think, there's two important points that I want to 
end with is one, better understanding the intersection of these 
critical lifelines and the vulnerabilities caused by them and 
how we can continue to ensure and have plans in place to 
mitigate cascading impacts in the event of some of the 
incidents that we've been talking about. And then, I think, the 
second piece of this is as we begin to modernize our 
infrastructure and we begin to move to smart cities, I cannot 
underscore the importance of baking security in at the 
beginning. You need the security people sitting next to the 
coders, the architects and the builders. It is imperative. 
Security is the new normal.
    It will be a differentiator. It will be a differentiator 
for companies. It will be a differentiator for utilities. It 
will be a differentiator for cities. And it has to be one of 
the core principles as we go about modernizing our 
infrastructure.
    So, thank you.
    The Chairman. Good.
    Ambassador Cooper, why don't you wrap up, please?
    Ambassador Cooper. Okay. Thank you, Madam Chair.
    I just wanted to comment on this last discussion about 
security. I think someone needs to do a serious look at the 
levels of security that is inhibiting this kind of open 
discussion of what the environments are that the industry has 
to design against as well as other factors.
    I don't believe that there is an absence of technology to 
deal with the EMP issue in an affordable way.
    And I want for your peripheral vision to just make one more 
point. I absolutely agree with you about the need for trust 
between the people and the parties that have to deal with this 
issue which is why I gave up on trying to get institutions here 
in Washington and even in the states, to deal with this issue. 
Lots of folks have tried, are trying, and are frustrated by the 
issues that you've mentioned. That's why I'm working very 
closely on an individual level with key people and when I say 
local, I mean, in three counties right now, and we're going to 
couple into the NERC exercise this November, the GridEx 
exercise as well, to expand our lessons learned upward in South 
and North Carolina and we'll go elsewhere.
    I think that we have to wake up to the sense of priority of 
dealing with the issues. The EMP Commission has looked at the 
briefings that some of the folks at this table have given. It 
is their assessment that they're underestimating the threat, 
even for the solar threat. The magnitude of the E3 component 
for a nuclear device is larger than for the solar event. So, if 
we harden the grid for a solar threat, we will still leave 
ourselves vulnerable for the other.
    And in addition, you have E1 as a component that threatens 
the solid state electronics throughout our grid and that 
includes the distribution systems for petroleum and natural 
gas. So, we need to deal with this issue in a very, I believe, 
direct way.
    I think that we have hope that what we're doing to 
accomplish locally. And when I say island, I want to build an 
island around Duke's nuclear plant and its hydroelectric plant 
and coal plant all on that lake so that the local people are 
engaged in working the problem. And by the local people I mean 
the, you know, the mayor, the city council at the political 
level, but Joe Sixpack, who understands what we're doing 
through the National Guard and so on.
    Our--general is an electrical engineer graduate of Georgia 
Tech. He understands these issues and he is committed to try to 
work with us and we'll expand outward from there to other 
states and other locations. I believe that's the way we have to 
go to really build trust among the key players that are 
required to cut across the patchwork, quilt patchwork, that I 
tried to describe to illustrate earlier.
    And that's not to argue against initiatives at the state 
level or the federal level or so on. At least that raises 
consciousness about the nature of this threat.
    But my concern is the devil is in the details. And we 
learned hard lessons in the Department of Defense, that it's 
not just having the right design. It's not just having the 
right deployment, and it's not even just having an operational 
concept that's important. If you don't test it, I don't believe 
it. And we learned through hard experience that maintenance and 
that sort of operations of operational systems that were well 
designed and deployed, we create holes by which EMP can get 
through.
    So this is a hard problem. We have to choose where we work 
carefully and protect what we need to work to ensure the 
viability of the grid and for the American people.
    The Chairman. Well, ladies and gentlemen, thank you. I 
think the testimony this morning, the questions and responses 
back and forth, have been very helpful. I think this has been a 
great discussion.
    I appreciate some of the suggestions that we have, but I 
also appreciate the urging that we really not let our guard 
down, recognizing that this is complicated, multifaceted and it 
requires an attention to it that is really daunting. But just 
because it is daunting does not mean that we should not be 
working with you, with our agencies, with the sector, really 
across the country.
    I appreciate what you have said, Ambassador Cooper, about 
really starting out very local and understanding the 
implications, not just those that are tasked on the day-to-day, 
but helping to educate Americans about our vulnerability and 
what we can do to reduce that.
    It is always important here in Congress that we be reminded 
of the urgency and the imperative of our task, and I think we 
were given that message this morning.
    I thank you all for your contributions.
    With that, the Committee stands adjourned.
    [Whereupon, at 11:57 a.m. the hearing was adjourned.]

                      APPENDIX MATERIAL SUBMITTED

                              ----------                              


[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]


                                [all]