S 1068 Introduced – Bulk Power Cybersecurity

Three weeks ago Sen Risch (R,ID) introduced S 1068 which would amend Part II of the Federal Power Act (16 USC 824 et seq) to give the Secretary of Energy specific authority over the cybersecurity of portions of the bulk power system.

The bill would add a new section (§224) to that statute. First it adopts two definitions (‘bulk power system’ and ‘Electric Reliability Organization’) from the existing statute {§824o(a)(1)} and then it provides a definition of a new term ‘cyber security threat’:

“The imminent danger of a malicious act that disrupts, attempts to disrupt, or poses a significant risk of disrupting the operation of programmable electronic devices or communications networks (including hardware, software, and data) essential to the reliable operation of the bulk-power system” {new §224(a)(2)}.

The bill would then provide the Secretary with the authority to “require, by order and with or without notice, any entity that owns, controls, or operates a bulk-power system facility to take such actions as the Secretary determines will best avert or mitigate the cyber security threat” {new §224(b)(1)}. That authority would be predicated on receiving a written finding from the President that “immediate action is necessary to protect the bulk-power system from a cyber security threat”.

The order could only be issued for a period of 30 days and the bill provides for procedures for up to two 30-day extensions of an order.

Moving Forward

Risch is the Chair of the Energy Subcommittee of the Senate Energy and Natural Resources Committee. Typically this means that this bill will likely be considered by that Committee in the near future. The bill is co-sponsored by Sen. Heinrich (D,NM) who is also a member of the Subcommittee (but not Ranking Member) so there does appear to be at least some bipartisan support for the bill. The 30-day limit on orders may assuage concerns of the bulk power community enough to allow this bill to make it to the floor of the Senate.

With all of the public foofaraw about cybersecurity vulnerabilities, particularly in the electric sector, I suspect that this bill would be able to be passed in the Senate and House. There is a remote possibility of this passing by unanimous consent, but that would depend on what changes the utilities would like to see made to this bill and if those changes were made in committee.

Commentary

 I’m not sure what changes could be made in a 90-day period that would adequately mitigate a ‘cyber security threat’. If an actual cyber attack had shut down a significant portion of the grid, I think that there is probably enough authority in place to respond to the situation and this added authority would not add anything to the adequacy of that response.

It is interesting, however, that the first thing described as being disrupted in the definition of ‘cyber security threat’ is “the operation of programmable electronic devices”. It is well understood in the cybersecurity community that a large number (if not most) of the PLCs in use in industrial control systems are specifically vulnerable to reprogramming by anyone that can gain access to the network on which they operate.

If we ascribe more technical knowledge than normal to the congressional staff that crafted this rather short bill (or the outside ‘consultant’ that pushed for the crafting) then a suspicious person might think that there could be a move made by DOE to require the replacement of all (more likely a specific sub-set) of the vulnerable by design PLCs with more modern and secure versions.

I don’t think that I am quite that paranoid, but I know enough people who are that the thought did cross my mind. If the authority had been given to DHS I would have dismissed this out of hand for lack of technical skills (outside of the relatively insignificant ICS-CERT; small size and out of regulatory loop) to require such a move. DOE, on the other hand, is much more technically oriented and may just have the technical and regulatory skills to pull of such a mandate.

S 1342 Introduced – Bulk Power Cybersecurity

Last week Sen. Bingamen (D, NM), the Chairman of the Energy and Natural Resources Committee, introduced S 1342, the Grid Cyber Security Act. When introduced the bill was accompanied by the Report from his Committee favorably reporting this bill. (NOTE: the actual bill is not yet available from the GPO but the Committee Report is. Makes sense huh? BTW: The report includes the text of the bill.) This means that this bill could be considered by the Senate at any time as committee actions are now complete.

This bill would amend the Federal Power Act to expand the official definition of what electrical infrastructure would be covered by cyber security rules. A new §224 would define the term ‘critical electric infrastructure’ that would include physical and virtual assets involved in the ‘generation, transmission, or distribution of electric energy’. The critical factor determining coverage would be the requirement that the incapacitation or destruction of the assets would “have a debilitating impact on national security, national economic security, or national public health or safety” {§224(a)(1)}.

The bill would have the Federal Energy Regulatory Commission (FERC) determine if current §215 reliability standards are adequate to protect the critical electric infrastructure from cyber security vulnerabilities. Those vulnerabilities are defined as “a weakness or flaw in the design or operation of any programmable electronic device or communication network that exposes critical electric infrastructure to a cyber security threat” {§224(a)(5)}. Unless FERC specifically determines that the current standards are adequate, they will be required to order the Electric Reliability Organization (ERO) to update those standards within 180 days.

There are no specific requirements for security for control systems in this bill; it leaves the establishment of those requirements to the ERO.

BTW: It would help spell checkers everywhere if Congress would decide if ‘cyber security’ was one word or two. I vote for a single word – cybersecurity.