Electromagnetic Pulse (15 page)

CRITICAL INFRASTRUCTURE PROTECTION ACT (CIPA) 2015

In the summer of 2015, the House of Representatives approved unanimously H.R. 3410, the Critical Infrastructure Protection Act (CIPA). This legislation marks a breakthrough. For the first time in four years, Congress has acted to begin to protect the nation’s most critical of critical infrastructures; the U.S. electrical grid. It now falls to the Senate and to President Obama to ensure that the House-passed bill becomes the law of the land.

CIPA’s lead sponsors were Reps. Trent Franks (R-AZ), a senior member of the House Armed Services Committee and co-chairman of the Electromagnetic Pulse (EMP) Caucus, and Pete Sessions (R-TX), the chairman of the powerful House Rules Committee. The measure enjoyed strong bipartisan support, including from the House Homeland Security Committee’s Chairman Michael McCaul (R-TX), and the Chairman and Ranking Member of the Committee’s Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, Reps. Patrick Meehan (R-PA) and Yvette Clark (D-NY).

The CIPA legislation requires the Department of Homeland Security to:

·
        
Include in national planning scenarios the threat of electromagnetic pulse (EMP) which would entail the education of the owners and operators of critical infrastructure, as well as emergency planners and emergency responders at all levels of government of the threat of EMP events

·
        
Engage in research and development aimed at mitigating the consequences of naturally occurring or man-caused EMP events; and

·
        
Produce a comprehensive plan to protect and prepare the critical infrastructure of the American homeland against EMP events.

TRANSPORTATION BILL AMENDMENT – November 2015

The transportation bill that President Obama signed in November of 2015 includes provisions intended to protect the grid from terrorist attacks and natural disasters, giving the Secretary of Energy emergency powers and creating a Strategic Transformer Reserve.

The legislation, which will provide $305 billion in highway funding over five years, cleared the Senate 83-16, following a 359-65 vote in the House. The bill represents both a vindication and a rebuke of former FERC Chairman Jon Wellinghoff’s controversial campaign to raise awareness of the grid’s vulnerability to sabotage.

It also checked off an item on current FERC Chairman Norman Bay’s wish list. Testifying before the House Energy and Power Subcommittee, Bay said it was essential that the government have emergency powers to respond to both an EMP attack and cyber attack. “That emergency authority does not need to reside with FERC. It could reside elsewhere in the federal government,” Bay said. “But someone needs to have it.”

Title 55 of the bill includes five “Energy Security” sections, including Section 61003, which authorizes the President to declare a grid security emergency in response to a geomagnetic storm, electromagnetic pulse, or cyber attack. Such a declaration would authorize the Energy Secretary to issue emergency orders to protect or restore electric infrastructure critical to
national security, economic security, public health or safety
.

Section 61004 requires the Secretary to submit a plan to Congress within a year for the development of a Strategic Transformer Reserve, including enough large transformers (100 MVA or higher) and trailer-mounted emergency mobile substations
to temporarily replace critically damaged large power transformers and substations that are critical electric infrastructure or serve defense and military installations
.

These provisions are a response to the April 2013 attack on Pacific Gas and Electric’s substation in Metcalf, California. At least two gunmen were believed involved in the attack on the 500/230-kV substation near San Jose, causing more than $15 million in damage that shut down the substation for nearly a month. The gunmen targeted transformer radiators, firing an estimated 150 rounds and hitting 10 of 11 banks. The Metcalf attack was the most significant incident of domestic terrorism involving the grid to date.

Former Chairman Wellinghoff found himself under fire after The Wall Street Journal quoted him in an article about a confidential FERC analysis that concluded the country’s entire grid could be shut down for months by disabling only nine critical substations. Transformers are typically custom designed and can take over eighteen months to replace. The WSJ article did not identify the locations of those substations or its source for the study, but it quoted Wellinghoff as saying, “there are probably less than 100 critical high voltage substations on our grid in this country that need to be protected from a physical attack.”

NERC, members of Congress and Wellinghoff’s former FERC colleagues complained that the disclosures had jeopardized, not improved, security. The Department of Energy Inspector General Gregory Friedman warned that FERC’s protection of information on the vulnerability of the grid is “severely lacking” and suggested that Wellinghoff had offered too much information when questioned about the disclosures.

As a result of Wellinghoff’s disclosures, Section 61003 requires FERC to develop regulations governing how it classifies information as critical electric infrastructure information (CEII), including “appropriate sanctions for commissioners, officers, employees or agents of the commission who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized.” The section also exempts CEII from disclosure under federal, state or local public records laws.

In testimony before the House subcommittee, current Commissioner Cheryl LaFleur suggested policymakers have more work to do.

“I think the reliability standards that we’ve put in place, which require every transmission owner to identify the most critical facilities and protect them, are an important step,” she said. “But I think beyond that, a lot of the protection has to come from how we build the grid — building more redundancy so we kind of ‘de-criticalize’ those places so that a physical attack won’t cause as much damage, and building in more standardization. If something goes wrong we can share transformers more, rather than having to build a custom one in every place.”

GAO REPORT: CRITICAL INFRASTRUCTURE PROTECTION: Preliminary Observations on DHS Efforts to Address Electromagnetic Threats to the Electric Grid

What the GAO Found

As of July 2015, the Department of Homeland Security (DHS) reported taking several actions that could help address the electromagnetic threats to the electric grid. GAO’s preliminary analysis of DHS’s actions indicated they fell into four categories: (1) developing reports, (2) identifying mitigation efforts, (3) strategy development and planning, and (4) conducting exercises.

In other words, they did what our government does best—talk about it.

The GAO’s Report was of the DHS when it wrote:
“Preliminary findings indicate that DHS Actions to Address Electromagnetic Threats were Conducted Independently of the EMP Commission Recommendations.” In other words, they did their own thing.

The DHS reported its actions were not taken in response to the 2008 recommendations of the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). The GAO also recognized that DHS does not have a statutory obligation to specifically address the recommendations, but the implementation of them could help mitigate electromagnetic impacts to the electric grid, such as helping to assure the protection of high-value transmission assets. Moreover, the GAO’s preliminary work suggested that DHS, in conjunction with the Department of Energy (DOE), has not adequately addressed an essential critical infrastructure protection responsibility—identification of precise internal agency roles and responsibilities related to addressing electromagnetic threats. For example, although DHS recognized one component as the lead for assessing solar weather risks, the component has not yet identified any specific roles related to collecting or analyzing risk information.

DHS has also coordinated with federal and industry stakeholders to address some, but not all risks to the electrical grid, since the EMP Commission issued its recommendations. The GAO preliminarily identified eight projects in which the DHS coordinated efforts to help protect the power grid, including developing plans to address long-term power outages, participation in exercises, and research and development activities. Although these are positive steps, the GAO’s preliminary work indicated that the DHS has not effectively coordinated with utilities to identify critical assets or collect necessary risk information, among other responsibilities. The GAO announced it will continue to assess the issues in this statement as it completes its work and will publish a report with the final results in late 2015.

NDAA 2016, Section 1089: EMP Commission revived

Section 1089 of the bill restores the EMP Commission, which previously had a run from 2001 to 2008. Also, the EMP Commission's charter will expand to make clear its charge also covers non-nuclear EMP weapons, EMP-like effects from natural forces, and the study of how potential adversaries might propose to use EMP in their military doctrine.

The Commission was directed to assess the following:

(1) The vulnerability of electric-dependent military systems in the United States to a manmade or natural EMP event, giving special attention to the progress made by the Department of Defense, other Government departments and agencies of the United States, and entities of the private sector in taking steps to protect such systems from such an event

(2) The evolving current and future threat from state and non-state actors of a manmade EMP attack employing nuclear or non-nuclear weapons

(3) New technologies, operational procedures, and contingency planning that can protect electronics and military systems from the effects a manmade or natural EMP event

(4) Among the States, if State grids are protected against manmade or natural EMP, which States should receive highest priority for protecting critical defense assets

(5) The degree to which vulnerabilities of critical infrastructure systems create cascading vulnerabilities for military systems

STATE LEGISLATION

Policy makers on a local level have already begun to get smart and challenge the electrical industry to higher standards. At the National Council of State Legislatures in 2015, several lawmakers said they’re preparing legislation similar to a 2013 bill introduced in Maine. Here are a few of the more significant state legislative actions:

·
        
On June 11, 2013, the State of Maine passed the first legislation in the nation to protect the electric grid against electromagnetic pulse (EMP) and geomagnetic disturbance (GMD). EMPs, such as high-altitude nuclear explosions, and GMDs, such as major solar flares and storms, have the potential to critically disrupt or destroy the electric grid.

·
        
On March 10, 2015, Virginia Governor, Terry McAuliffe signed a bill requiring the commonwealth’s Department of Emergency Management (DEM) to plan for responses to disasters caused by electromagnetic pulses (EMPs). This requirement is part of the DEM’s overall mission of disaster preparedness.

·
        
Arizona implemented a requirement in 2014 for its emergency management agency to incorporate EMP preparedness into its disaster planning. Louisiana’s preparedness office is examining the possible effects of an EMP event. In 2013, Kentucky set up an interagency working group to examine EMP preparedness efforts.

·
        
In Texas, there are currently two bills that address the protection of the electrical grid. Specifically, they relate to a study by the Electric Reliability Council of Texas on securing critical infrastructure from electromagnetic, geomagnetic, terrorist, and cyber attack threats. They are House Bill 2289, and Senate Bill 1398.

The FAST ACT—Fixing America’s Surface Transportation Act

There is good news. On December 4, 2015, President Obama signed into law the “FAST Act”—an acronym for Fixing America’s Surface Transportation Act. Part of a massive highway and transportation bill, the FAST Act also includes energy security amendments to the Federal Power Act (“FPA”), several of which affect utilities and others in the electric industry. These changes potentially impact owners, operators, and users of electric infrastructure; even relatively small, intrastate utilities not ordinarily subject to control by the Federal Energy Regulatory Commission (“FERC”).

The FAST Act creates a new Section 215A in the FPA, much of which revolves around the newly-defined terms
critical electric infrastructure
and critical electric infrastructure information.
Critical electric infrastructure
(“CEI”) is broadly defined to include both physical and virtual systems and assets of the bulk-power system, whose destruction or incapacity would have a negative impact on national or economic security, public health, or safety.
Critical electric infrastructure information
(“CEII”) could mean potentially any information related to CEI, and generated by or submitted to FERC or any other federal agency, other than classified national security information.

The primary purpose of the act is to encourage information sharing between the public sector and the private sector. The FAST Act reduces the restrictions of disclosures of CEII, and also promotes information sharing among government and industry participants. As suggested in the definition of CEII, the full impact of these provisions will depend on rules FERC must promulgate within the next year, which will determine both procedures and substantive criteria for designating CEII and preventing its unauthorized disclosure. The Act itself does specify, however, that no federal, state, local, or tribal entity is required to disclose CEII on the basis of any public disclosure law at any level, including the federal Freedom of Information Act (FOIA). Our government seems intent on protecting on our grid, and not letting our adversaries know how we’re doing it.