Transcripts For CSPAN3 Hearing On Electric Grid Security 201

On cspan 3 committee will come to order. Today were discussing a topic. Theres Cyber Security and how to stop the bad guys. Whats not been discussed in great detail is what the consequence will be from a massive cyber attack that brings down for example a large portion of the electric for an amount of time. With the electrical power system is, what consequences should the federal government tell the state and local government to prepare for . In other words, for how many people and for how long should states plan on being without power . The federal government does not now for every significant hazard that we face. Whether its a category five hurricane hitting miami or an 8. 0 hurricane. The federal government does not have the basic planning scenario for a cyber threat in the you power system, and theres a huge disparity in different groups think and what is a potentialle scenario in what state and local government should prepare. Its significant for the local government. If the power is out for a few days, its an in cconveniencinc. If its out for several weeks or months, the local government has to potentially plan for increased approximate Public Safety, water treatment, sheltering, evacuation, fuel delivery, generators. What should we plan for . Ted in his book says that we should plan on six to 18 months of uninterrupted black out os. It could cause it in days and not weeks. Today were going to hear testimony from the federal Emergency Management agency, develop of energy, department f of Homeland Security director, the congressional and the electrical industry. I hope to get this for the states that are on the ground ask charge window the protection of people in property. Imagine what we would do without electricity for a day, week, month, a year. All Critical Infrastructure is on the grit and particularly the lifeline sectors and transportation, water and financial services. If the goal f of the bad guys is to collapse the system, theyre going to try to cut off the power. They have been reports of hacking attempts on the facilities by foreign parties and the National Security and Public Safety and economic competitiveness and according to the the Homeland Security, the Energy Sector was the target of more than 40 percent of all recorded Cyber Attacks. More discerning was the attack on ukraine that affected 4,000 substations and left a quarter of a Million People without power. Call centers were hit with the telephone denial of the Service Attack as customers were trying to report the outages. If anyone thought this was a glitch, think again. The electrical grid is under attack and then the power sector is all too familiar with the devastation storms like Hurricane Sandy can leave behind and the physical attacks like the 2013 incident and the sub cap station in california. Thankfully in the cases of storms and physical attacks, the pu er sector has strong plans in place and the systems to restore the power quickly and to avoid the loss of life and property. I am concerned about a cyber attack. Are there similar plans in place for the industry and for the state and local government . Will those provide the same types of protection . Most resent willy i have been discussing this topic with those in my district asking what they will do in their communities if the power is out for a long period of time. Honestly, most of them do not know because we dont know what to plan for. We have brought together the right people here to tell us today. We are also going to discuss what preparedness looks like and the best practices and how to achieve the the level of readiness all the way down to the local majors and townships. I am encouraging to hear the talk about an all hazards approach and focussing on the greatest risks, but i think that there are characteristics of of the threat that requires specific planning guidelines. I know we can not fight the system but given the daily lives, its crucial that we understand the risks and be prepared for the likely consequences possible from the failure of that system. I look forward to had this conversation today and starting with the witnesses, and i thank you all for being here. Thank you. You certainly laid it out all against the critical and electrical grid. We know that theres probing and being done by the states and in the just terror groups to the u. S. And we need to be certain that we are as prepared that we can be. The ukraine attack was a harbor of things to come. I think that it can cover the cyber attack area. The issue of of probably most immediate concerns for us that live in the northwestern United States is the treat of a cascade abduction of a quake of nine or nine plus. That will knock you out our, so there are going to be exercises conducted. Two exercises this year with the cooperation of the Homeland Security and all of o the local and state authorities in the region to simulate what would be possible in face of that sort of a disaster. Many of the problems that could occur will be the same. The loss of trans formers is particularly a concern, and im going to be probing the witnesses today. Theres a question if the federal government should be stockpiling since theyre Custom Orders and take six to 18 months. It seems to me a no brainer that we should either through the governmental sources or through the industry approximate be creating an industry here in the United States to to deal with with any and soul of the sorts of potential attacks and coordinate a physical and cyber attack that could of course be the most devastating outside of a massive earthquake and again many of the same issues arise and then one that does not get talked about very much but we held a series on it and then called the committee over the nuclear you power is the po tejsal for a bomb in place. Thats a nuclear plant. The if you destroy the back up system and take over the plant, you create a melt down. How good is the security at our Nuclear Plants these days . I know that this hearing is not going to get to that topic. I am not sure that its in the jurisdiction, but its a concern to me and i just wanted to raise that issue. Like aviation and electricity and the grid, and Nuclear Plants theyre of interest to the t terror groups and i am pleased that youre holding this hearing today. We have two administrators on the panel. Assistant secretary hauf man from the office of electricity, delivery and ability. This is those facilitating the recovery from disruption and emergency and the energy supply. Assistant secretary for the protection from the department of Homeland Security, and mr. Richard campbell and expert at the Congressional Research service and the you power sector. On the second panel its the president and ceo of the Liability Corporation and those who the mission is to insure the system in north america and mr. William the ceo and the corporation and one of the largest and the Utility Companies and then bobby kill mer and a Nonprofit Organization in northeastern pennsylvania. I asked for the full statement be including in the record without the objection so ordered. Since its made part of the order, you ask that you limit the oral testimony to five minutes. Starting with the first panel mr. Fugate and you may proceed. Thank you. I want the to address the question of what they need to plan for. Ba based on the the other experiences causes hazards this can be you are measured in weeks. Again with cyber we have seen restoration. If theres not physical damage and you do have it for transform ers, that will extend it. We do know that its important that in the initial response that you provide the safety and security. When lights are out, power is out. We have had major metropolitan areas go with this. We have had people trapped the elevators and that may mean to go out and wait for problems and not wait for the call of 911. The next steps are again as the members point out and all hazards. You have to provide the needs and hopefully the Critical Infrastructure has power and emergency you power. You have to fuel supply that you need. We have found in many cases that communities have not planned for that. Either they dont have critical equipment on the back up you power or fuel supply. They only have enough to run the weekly and monthly test but not for a crisis. Generators are expensive and in my other cases there are options. The idea is is what are the things required to keep the the community up and running until the you power can be restored and the lifeline . Water treatment and hospitals and communication and the 911 and other facilities. They usually have them but they have to be planned. Not just during the monthly test. As you pointed out mr. Chairman, it starts to drive other issues. As we saw the longer that you have them, the longer that you have the affects and not getting to Retail Stores and others and gasoline distribution and as they start to get back to normal, theyre all challenges. So the planning is based on the safety, keeping the life systems up, focuses on the restoration of the grid and the reality that the areas are going to be last to get the power because youre going to try to get the Retail Sectors and Major Centers up first. The industry has shown a lot of capables f f of doing the structures. We think that it would apply for cyber. Cyber has a lot of unknown. I will differ to my experts to my left on what they are and the potential threats and how likely they are. You said how big is by . Well, we look at things and thats jail to the storms. Because of the way that its built and the transform ers, we have developed what we would do and the satellites and systems. We are working currently now with the lessons of the previous out Power Outages on the annex to add to the natural response frame work to look at the Power Outages and a lot of the agencies that the government brings and this has to be a true working relationship. We cannot do this separately as a partnership. We have to have levels and then we have the power in the states through the utility regulatory management. That frame work the this summer is going to our Senior Leadership in the agency to begin the process of occurrence and updating it. Its the the frame work if something were to happen now. Based on the lessons from sandy and other disruptions. The challenge for people to look at planning for not what they do everyday but what happens if the you power is out. Not just for hours but for weeks. Do they understand what they need to do and that the critical lifelines have the power . I have been through enough hurricanes and few had enough to pass what was there and in a full load of crisis, they failed. They did not maintain enough fuel in the systems for that. They did not have the contracts for the firm deliveries when the crisis occurred. You really need to get people to focus on this. If youre going to provide the emergency power, it has to be for real and provide it for a long time. You have to do it from a stand approach. We dont know how long its going to be out. We have the response steps, and you have to ask the question if its only on the 72 hours and if were out for a week, what are the things that we have to focus on. The story of the industry is also good. We learned a will the how to get the systems back up and bypass the failed systems. In many cases they have replaced the man in the middle and then come back and run a system and get the you power back. So i think theres both a good news story, but theres still a lot that we do not know. So against that, were not going to run a plan for everything that cannot happen. We need the right thing on consequences. As we have the duration of the impacts, thats going to shake the guidance and officials. Were dealing with the extensive Power Outages. Regardless of the cause of it but the time and what would be happening and the next steps are. Again a will the of the lessons are learned from the hazards and then how wide spread and how they are impacted. Thats probably the one difference that a physical threat as much as a hurricane. We know the geographical area and we know that its not assigned by the boundaries and thats a system wide. Thats another area that we ask questions about. Thats probably outside of an a p and thats the largest impact to the utilities and a lot of work is done to minimize. Mr. Chairman, i stand ready for the questions, but i tried to answer them in the opening statements. Thank you for the testimony. Before we move on, i want to recognize the Ranking Member of the the subcommittee mr. Carson for the opening statement. I want to thank you guys and for the the sake of time we should continue, and i was the one that was late. Thank you. Thank you. We will move on assistant secretary. Thank you for focuses on the attention of being prepared on the outage and to discuss the electricity system in an increasingly challenging environment. Our economy, National Security and even the health and safety of the city depend on the reliable electricity. The mission of the office of electricity and delivering a liability is the strengthen, transform and improve the structure to improve the access to the clean sources of energy. Were committed to working with the public and private sectors to protect the structure and including the power from the disruption whether its caused by man made events, Cyber Attacks. The crucial factor is to be proactive and cultivate what i call an echo system of resilience and that owner, operators, vendors and consumers Work Together to prepare, respond and recover. Our organization wrks on indent strategies and product itself a and tools on the preparedness activity. This is done from forms, training and exercises that have federal, state and local officials. In the Cyber Security, its the effort to improve the Cyber Security capabilities. The department f of o energy and partners have developed the Cyber Security capability model. This is an evaluation tool that helps organizations prioritize and develop the Cyber Security ca capabiliti capabilities. In in april theres a clear path form in portland and washington dc. Its an exercise in testing and evaluating the Energy Sector and roles and responsibilities with response plans and utilized for the abduction zone of earthquakes and sue tomtsunami. The Department Works to access the affects on the disaster of local and federal structure, coordinate assets, monitor and from vied regular situation awareness and the key to the state, white house and the agency partners. We also provide leadership by requesting and facilitating the energy and sharing Analysis Center as well as the development of electric counsel. This is a group f of leader from across the sector that meet regularly to cord naordinate an share. When it goes out, power is is the First Respond er. Should anybody receive the capability of any private or sector resources congress did several sectors and this act confirms the Cyber Security and oil and gas information sharing, development of a transform er plan. In addition the fast act provides them with a new authority. Upon declaration of the Grid Security emergency by the president , the secretary can issue orders to protect and restore the critical structure. The the department is actively engaging in the process and procedure. The the key to strengthen is not only through site by innovation. Advance in technology and innovation of storage and mick row grids will help get ahead of the risks. In conclusion, the threats will continue to evolve. The doe is working to stay ahead of the curve. To accomplish this, we must invest in the resilience, encourage the innovation and use the best practices to help the raise the cyber and physical security and strengthen the local and response of the capabilities. Thank you for your time, and this concludes my remarks, and i look forward to the questions that you have. Thank you for the testimony and you may now proceed. Thank you members of the sub commit tee. Thank you for the community to discuss on the National Effort to secure and enhance the natur natures infrastructure and then the the response and recovery from all hazardous events. I want to begin by acknowledging that protecting the grid is a top priority of this administration and the department of Homeland Security. Its an underscore asking that the grid has a design. Its a complex network of the assets that has built in and can adapt to demand and climate in a host of other factors. In short, the electric grid has one principal in mind. Reliability. Thousands of Companies Work to run the most reliable grid in the world. While over 85 percent is in private hands, the federal government realizes that we have to work in partnership to protect the the grid because of the National Security and prosperity and resilience. I have the privilege of working with sectors and can say with confidence that the the electric industry takes a multilayered approach and is committed to adaptation based on the Cyber Security<\/a> and how to stop the bad guys. Whats not been discussed in great detail is what the consequence will be from a massive cyber attack that brings down for example a large portion of the electric for an amount of time. With the electrical power system is, what consequences should the federal government tell the state and local government to prepare for . In other words, for how many people and for how long should states plan on being without power . The federal government does not now for every significant hazard that we face. Whether its a category five hurricane hitting miami or an 8. 0 hurricane. The federal government does not have the basic planning scenario for a cyber threat in the you power system, and theres a huge disparity in different groups think and what is a potentialle scenario in what state and local government should prepare. Its significant for the local government. If the power is out for a few days, its an in cconveniencinc. If its out for several weeks or months, the local government has to potentially plan for increased approximate Public Safety<\/a>, water treatment, sheltering, evacuation, fuel delivery, generators. What should we plan for . Ted in his book says that we should plan on six to 18 months of uninterrupted black out os. It could cause it in days and not weeks. Today were going to hear testimony from the federal Emergency Management<\/a> agency, develop of energy, department f of Homeland Security<\/a> director, the congressional and the electrical industry. I hope to get this for the states that are on the ground ask charge window the protection of people in property. Imagine what we would do without electricity for a day, week, month, a year. All Critical Infrastructure<\/a> is on the grit and particularly the lifeline sectors and transportation, water and financial services. If the goal f of the bad guys is to collapse the system, theyre going to try to cut off the power. They have been reports of hacking attempts on the facilities by foreign parties and the National Security<\/a> and Public Safety<\/a> and economic competitiveness and according to the the Homeland Security<\/a>, the Energy Sector<\/a> was the target of more than 40 percent of all recorded Cyber Attacks<\/a>. More discerning was the attack on ukraine that affected 4,000 substations and left a quarter of a Million People<\/a> without power. Call centers were hit with the telephone denial of the Service Attack<\/a> as customers were trying to report the outages. If anyone thought this was a glitch, think again. The electrical grid is under attack and then the power sector is all too familiar with the devastation storms like Hurricane Sandy<\/a> can leave behind and the physical attacks like the 2013 incident and the sub cap station in california. Thankfully in the cases of storms and physical attacks, the pu er sector has strong plans in place and the systems to restore the power quickly and to avoid the loss of life and property. I am concerned about a cyber attack. Are there similar plans in place for the industry and for the state and local government . Will those provide the same types of protection . Most resent willy i have been discussing this topic with those in my district asking what they will do in their communities if the power is out for a long period of time. Honestly, most of them do not know because we dont know what to plan for. We have brought together the right people here to tell us today. We are also going to discuss what preparedness looks like and the best practices and how to achieve the the level of readiness all the way down to the local majors and townships. I am encouraging to hear the talk about an all hazards approach and focussing on the greatest risks, but i think that there are characteristics of of the threat that requires specific planning guidelines. I know we can not fight the system but given the daily lives, its crucial that we understand the risks and be prepared for the likely consequences possible from the failure of that system. I look forward to had this conversation today and starting with the witnesses, and i thank you all for being here. Thank you. You certainly laid it out all against the critical and electrical grid. We know that theres probing and being done by the states and in the just terror groups to the u. S. And we need to be certain that we are as prepared that we can be. The ukraine attack was a harbor of things to come. I think that it can cover the cyber attack area. The issue of of probably most immediate concerns for us that live in the northwestern United States<\/a> is the treat of a cascade abduction of a quake of nine or nine plus. That will knock you out our, so there are going to be exercises conducted. Two exercises this year with the cooperation of the Homeland Security<\/a> and all of o the local and state authorities in the region to simulate what would be possible in face of that sort of a disaster. Many of the problems that could occur will be the same. The loss of trans formers is particularly a concern, and im going to be probing the witnesses today. Theres a question if the federal government should be stockpiling since theyre Custom Orders<\/a> and take six to 18 months. It seems to me a no brainer that we should either through the governmental sources or through the industry approximate be creating an industry here in the United States<\/a> to to deal with with any and soul of the sorts of potential attacks and coordinate a physical and cyber attack that could of course be the most devastating outside of a massive earthquake and again many of the same issues arise and then one that does not get talked about very much but we held a series on it and then called the committee over the nuclear you power is the po tejsal for a bomb in place. Thats a nuclear plant. The if you destroy the back up system and take over the plant, you create a melt down. How good is the security at our Nuclear Plants<\/a> these days . I know that this hearing is not going to get to that topic. I am not sure that its in the jurisdiction, but its a concern to me and i just wanted to raise that issue. Like aviation and electricity and the grid, and Nuclear Plants<\/a> theyre of interest to the t terror groups and i am pleased that youre holding this hearing today. We have two administrators on the panel. Assistant secretary hauf man from the office of electricity, delivery and ability. This is those facilitating the recovery from disruption and emergency and the energy supply. Assistant secretary for the protection from the department of Homeland Security<\/a>, and mr. Richard campbell and expert at the Congressional Research<\/a> service and the you power sector. On the second panel its the president and ceo of the Liability Corporation<\/a> and those who the mission is to insure the system in north america and mr. William the ceo and the corporation and one of the largest and the Utility Companies<\/a> and then bobby kill mer and a Nonprofit Organization<\/a> in northeastern pennsylvania. I asked for the full statement be including in the record without the objection so ordered. Since its made part of the order, you ask that you limit the oral testimony to five minutes. Starting with the first panel mr. Fugate and you may proceed. Thank you. I want the to address the question of what they need to plan for. Ba based on the the other experiences causes hazards this can be you are measured in weeks. Again with cyber we have seen restoration. If theres not physical damage and you do have it for transform ers, that will extend it. We do know that its important that in the initial response that you provide the safety and security. When lights are out, power is out. We have had major metropolitan areas go with this. We have had people trapped the elevators and that may mean to go out and wait for problems and not wait for the call of 911. The next steps are again as the members point out and all hazards. You have to provide the needs and hopefully the Critical Infrastructure<\/a> has power and emergency you power. You have to fuel supply that you need. We have found in many cases that communities have not planned for that. Either they dont have critical equipment on the back up you power or fuel supply. They only have enough to run the weekly and monthly test but not for a crisis. Generators are expensive and in my other cases there are options. The idea is is what are the things required to keep the the community up and running until the you power can be restored and the lifeline . Water treatment and hospitals and communication and the 911 and other facilities. They usually have them but they have to be planned. Not just during the monthly test. As you pointed out mr. Chairman, it starts to drive other issues. As we saw the longer that you have them, the longer that you have the affects and not getting to Retail Stores<\/a> and others and gasoline distribution and as they start to get back to normal, theyre all challenges. So the planning is based on the safety, keeping the life systems up, focuses on the restoration of the grid and the reality that the areas are going to be last to get the power because youre going to try to get the Retail Sector<\/a>s and Major Centers<\/a> up first. The industry has shown a lot of capables f f of doing the structures. We think that it would apply for cyber. Cyber has a lot of unknown. I will differ to my experts to my left on what they are and the potential threats and how likely they are. You said how big is by . Well, we look at things and thats jail to the storms. Because of the way that its built and the transform ers, we have developed what we would do and the satellites and systems. We are working currently now with the lessons of the previous out Power Outages<\/a> on the annex to add to the natural response frame work to look at the Power Outages<\/a> and a lot of the agencies that the government brings and this has to be a true working relationship. We cannot do this separately as a partnership. We have to have levels and then we have the power in the states through the utility regulatory management. That frame work the this summer is going to our Senior Leadership<\/a> in the agency to begin the process of occurrence and updating it. Its the the frame work if something were to happen now. Based on the lessons from sandy and other disruptions. The challenge for people to look at planning for not what they do everyday but what happens if the you power is out. Not just for hours but for weeks. Do they understand what they need to do and that the critical lifelines have the power . I have been through enough hurricanes and few had enough to pass what was there and in a full load of crisis, they failed. They did not maintain enough fuel in the systems for that. They did not have the contracts for the firm deliveries when the crisis occurred. You really need to get people to focus on this. If youre going to provide the emergency power, it has to be for real and provide it for a long time. You have to do it from a stand approach. We dont know how long its going to be out. We have the response steps, and you have to ask the question if its only on the 72 hours and if were out for a week, what are the things that we have to focus on. The story of the industry is also good. We learned a will the how to get the systems back up and bypass the failed systems. In many cases they have replaced the man in the middle and then come back and run a system and get the you power back. So i think theres both a good news story, but theres still a lot that we do not know. So against that, were not going to run a plan for everything that cannot happen. We need the right thing on consequences. As we have the duration of the impacts, thats going to shake the guidance and officials. Were dealing with the extensive Power Outages<\/a>. Regardless of the cause of it but the time and what would be happening and the next steps are. Again a will the of the lessons are learned from the hazards and then how wide spread and how they are impacted. Thats probably the one difference that a physical threat as much as a hurricane. We know the geographical area and we know that its not assigned by the boundaries and thats a system wide. Thats another area that we ask questions about. Thats probably outside of an a p and thats the largest impact to the utilities and a lot of work is done to minimize. Mr. Chairman, i stand ready for the questions, but i tried to answer them in the opening statements. Thank you for the testimony. Before we move on, i want to recognize the Ranking Member<\/a> of the the subcommittee mr. Carson for the opening statement. I want to thank you guys and for the the sake of time we should continue, and i was the one that was late. Thank you. Thank you. We will move on assistant secretary. Thank you for focuses on the attention of being prepared on the outage and to discuss the electricity system in an increasingly challenging environment. Our economy, National Security<\/a> and even the health and safety of the city depend on the reliable electricity. The mission of the office of electricity and delivering a liability is the strengthen, transform and improve the structure to improve the access to the clean sources of energy. Were committed to working with the public and private sectors to protect the structure and including the power from the disruption whether its caused by man made events, Cyber Attacks<\/a>. The crucial factor is to be proactive and cultivate what i call an echo system of resilience and that owner, operators, vendors and consumers Work Together<\/a> to prepare, respond and recover. Our organization wrks on indent strategies and product itself a and tools on the preparedness activity. This is done from forms, training and exercises that have federal, state and local officials. In the Cyber Security<\/a>, its the effort to improve the Cyber Security<\/a> capabilities. The department f of o energy and partners have developed the Cyber Security<\/a> capability model. This is an evaluation tool that helps organizations prioritize and develop the Cyber Security<\/a> ca capabiliti capabilities. In in april theres a clear path form in portland and washington dc. Its an exercise in testing and evaluating the Energy Sector<\/a> and roles and responsibilities with response plans and utilized for the abduction zone of earthquakes and sue tomtsunami. The Department Works<\/a> to access the affects on the disaster of local and federal structure, coordinate assets, monitor and from vied regular situation awareness and the key to the state, white house and the agency partners. We also provide leadership by requesting and facilitating the energy and sharing Analysis Center<\/a> as well as the development of electric counsel. This is a group f of leader from across the sector that meet regularly to cord naordinate an share. When it goes out, power is is the First Respond<\/a> er. Should anybody receive the capability of any private or sector resources congress did several sectors and this act confirms the Cyber Security<\/a> and oil and gas information sharing, development of a transform er plan. In addition the fast act provides them with a new authority. Upon declaration of the Grid Security<\/a> emergency by the president , the secretary can issue orders to protect and restore the critical structure. The the department is actively engaging in the process and procedure. The the key to strengthen is not only through site by innovation. Advance in technology and innovation of storage and mick row grids will help get ahead of the risks. In conclusion, the threats will continue to evolve. The doe is working to stay ahead of the curve. To accomplish this, we must invest in the resilience, encourage the innovation and use the best practices to help the raise the cyber and physical security and strengthen the local and response of the capabilities. Thank you for your time, and this concludes my remarks, and i look forward to the questions that you have. Thank you for the testimony and you may now proceed. Thank you members of the sub commit tee. Thank you for the community to discuss on the National Effort<\/a> to secure and enhance the natur natures infrastructure and then the the response and recovery from all hazardous events. I want to begin by acknowledging that protecting the grid is a top priority of this administration and the department of Homeland Security<\/a>. Its an underscore asking that the grid has a design. Its a complex network of the assets that has built in and can adapt to demand and climate in a host of other factors. In short, the electric grid has one principal in mind. Reliability. Thousands of Companies Work<\/a> to run the most reliable grid in the world. While over 85 percent is in private hands, the federal government realizes that we have to work in partnership to protect the the grid because of the National Security<\/a> and prosperity and resilience. I have the privilege of working with sectors and can say with confidence that the the electric industry takes a multilayered approach and is committed to adaptation based on the Lessons Learned<\/a> in the real world and exercises and the understanding of the dynamic risk and environment. Industry and government and we can not stop every threat and Natural Hazards<\/a> and that we must be prepared to repond to the range of events and consequences. The federal government and the partnership and thats designed under the Protection Plan<\/a> reached new levels following two important events. The first was a report publiced by the adviser commit tee and the counl in 2011 on the resilience of the sectors and called for the seen were your executives to convene on a regular basis to craft a Risk Management<\/a> agenda that was refle reflective of the threat in environment. Nearly a year later we had a scene of an earthquake of the power plant in japan. That had the United States<\/a> come together to plan for a tragic incident. Now 30 ceos have comprised the electric sector and meet regularly with the counter parts at dhs, doe and other members to address the growing number of the fassetts that put us at risks. This is to insure the consequences are minimize and that the value of our relationship is strengthened by identifying the authorities and the robust and the planning and regular testing and exercise of these plans. Projects conducted by the partnership is action oriented and then around the physical and cyber events. A 2013 and 2014 outreach is the importance of reporting the suspicious activity. An electric sector playbook and thats a crisis frame work to enable to Senior Executives<\/a> to coordinate on the response and recovery issues as well as work by dhs and d ooe with the sec fs to have the coordination with other lifeline functions. In addition to the work, dhs works with owner and operators to help to enhance the facility and posture. Understand that dependencies and exercise with the state, local and tribal authorities for a range of problems. This would not be possible without a specialist around the country that engage with asset ordinary reasons on a regular basis to help them understand the threats, perform assessments and insure that theyre connect today the broad er Homeland Community<\/a> in the state and local officials. They also work with partners across the government in event to a response or attack resulting in a failure of the electric grid. They support fema during the response operation and has an understanding of the concern and an impacted area in the decisions ask support and then recovery as well as recovering the communications and the infrastructure. During the cyber communication, the national Cyber Security<\/a> is able to coordinate with state, local and private sectors and including Law Enforcement<\/a> and intelligent communities so they can be brought to a manner. The Emergency Response<\/a> team is the component of the and provides on site support of the industrial control system. In conclusion they have engage in an effort to access and litigate the success of the Cyber Attacks<\/a> and natural disasters. All that can result had in disruptions of the electric grid. In a major state, the Department Proposed<\/a> to transition to an operation component and the Cyber Protection<\/a> agency. This would provide more comprehensive, coordinated Risk Management<\/a> to the the stakeholders thats the growing condition version of the cyber and physical threats. Chairman and members carson and the member of subcommittee, thank you for the opportunity to appear approximate befo appear before you today and discuss the cyber threats. I look forward to your questions. Thank you for the testimony. Mr. Campbell, you may proceed. Thank you. I am Richard Campbell<\/a> and i am a specialist for the congressional services. On behalf of crs i want that i dont think you for having testify today. The want to talk about the role of the respective parties and the roles of the Recovery Efforts<\/a>. I should note that we do not advocate policy or take specifics on legislation. The its vital to the common and daily functioning of the United States<\/a>. While the electric grid is operated with a high level of reliability and the parts and its to the failure and natural operational and mandated events. Natural events are Severe Weather<\/a> or solar storms. Operational events can be result in the the failure of the systems and man made events are attacks on the grid. The extent to which these events could damage the grid are there and much of the infrastructure is there and aging. Its modern niez aize and the N Technologies<\/a> are being incorporated with the activity. One they can improve the performance of the the grid. Mr. Campbell, can you pull the microphone a little bit closer . While theyre going to advance the performance of the grid, theyre going to increase the vulnerable of the Cyber Attacks<\/a> launched by the internet. In 2014 they saw intrusions of the capabilities to take down the power grids and the Water Systems<\/a> and other critical infer struck were chur. Although theres not a Cyber Security<\/a> event and resulting of a pu er outage, the potential still exists in the long outage. The first black out contributed and happened in ukraine in 2015. It had the control and the operating systems and the regional facilities. Other critical structures are targeted and then in the attempt of the recardiovasculovery effo. My report released in 2012 said that the large blackouts for the kounts eri countries or weeks or months. If it happened during the time of extreme weather, hundreds of thousands of deaths could occur with the exposure to the cold. It could cost the economy hundreds of billions of dollars. Recovery from a cyber attack ton grid could be complicated by the components and for example the strategic structure of the number of critical number of transform were ers and it may take months or years. They generally prepare and use the potential for a major attack or a similar event of a low event. If its severe enough to be a declared disaster than fema, the federal Management Agency<\/a> can from vi provide assistance. However, given the professor and the major attack on the grid, some may suggest that the focus is needed and maybe apart of the strategy as well as the security grid. A focus on the recovery should consider the mutual dependence to other Critical Infrastructure<\/a>s to a failure and how quickly such impacts could plan for an advance. You you can see how the future and the concerns are and incorporating the lemts to increase it as it develops and will add and reduce the vulnerable of the system. Finally they have stated after that after the major the systems will be a first priority. Its the communications systems, fuel, water supply treatment and customers will be a secondary priority. Congress may want to consider how planning for the rest of the services would proceed to insure that all facilities are kept informed and treated as equally as possible in the efforts. This this concludes my brief remarks, and i look forward to your questions. Thank you for your testimony mr. Campbell. I will limit to five minutes now for the additional questions following the first round, we will have additional rounds of questions as needed. I will start with administrator fugate. You can walk us through a time line that we can expect to experience in a large scale and prolonged power outage which is the result of a cyber and physical attack . Lets assume that over ten Million People<\/a> are out of you power in the northeast and lasts for over a month. I am not talking about how to turn the the power back on, but what consequences will state and local governments and residence have to deal with because the power is out . This is many my concern. I am going to put my mayors hat back on. I have been listening to a lot of how prepared that we are and what we can what is typical and unlikely and what were going to do. I am not convinced that we have connected the tdots all the way down for the local government. I have not talked to a mayor or up supervisor yet when asking an unusual and unlikely event that power is out in a cyber attack, how long are you prepared to provide services . Nobody can give me that answer. I know its an unlikely event. Sorp t so were the chances of a plane running into the twoin towers. I was a mayor and people want to know how long can we expect . I dont know if anyone has given me a clear answer in the event of fiscal and cyber in the worst case scenario. Very unlikely and unusual. As a mayor and supervisor, i want to be prepared for the worst case circumstance. So in the the first few days there are a thousand of people stuck in the elevators. After three or four days they will will need the fuel for generators. After a week the clean water and Waste Disposal<\/a> maybe and may have serious problems. At some people may start to sell in large numbers. Walk us through the time line of the increasing consequences as the duration of the scenario increases. Mr. Chairman having this happened during accidents where human error caused the you Power Outages<\/a>, we dont know how long its going to be out. You only know that youre having them. Youre not aware what is is happening outside. Situation awareness is key. The response is no difference. We have had communities go through the power autoagout age theyre having to deal with the Traffic Control<\/a> issues and the commute er trail being knocked off. Those communities do the plans, those are the things that theyre doing from the e be beginning. What is critical and this is what my partners to the the left are focused on. Is this a short term or long term. When i was in the state we had a power knock down that was not occurring in a set pattern but all over the state. We did not know what was going on. By the time we got to the awareness, the next question is will this go through the the night hours. You start to focus on the immediate things like life safety. Also safety in the communities because when you lose power and start to see the disruptions, you have to provide a visible for policing and give them a sense of safety in the communities. Thats going to require more manpower and people on the streets. You start to look at my generators and what systems are next. Is it the next 72 hours. This is important and i learned this the hard way. A lot of communities do not plan for refuelling in a crisis. There are things that you have to have to make sure that you get the deliveries, and they may not be local. We were shipping fuel as far away as philadelphia back into the new jersey and new york to provide gas. We find all kinds of challenges, but youre saying the first step and the Emergency Response<\/a>. The next one is next 72 hours. Which one is going to start to run out of fuel or have a generator problem. At this this time, were hoping to access that this is a larger event and look at mobilizing the resources from outside and the fuel and other things to keep them on. Its key to keep the water system and the waste running. Electricity has a lot of problems, but the water and waste water are impossible to make up the difference in the population. Theres not really a good way to manage that if they go off line. So you continue to escalate. Once you get past the 72 hours, then you start to look at what is the Retail Sector<\/a> supply chain look like . Florida learned this the hard way and they have emergency you power and transfer switches because as we were dealing with the Power Outages<\/a> literally from the hurricanes and some is of them went for a month. We found that they were starting to do things that were not supporting. They were bringing in generators and we did not do it as a partner. We found ourself competing with them. Think they that most that have a good response they have done this or prepared to do this. Its once you get past 72 hours that you start to think past the plan. Where theyre going to get the fuel and do things to keep up. Where are the points to keep up. As we saw in new jersey and new york, it was the the rescues and people like that and a lot of people are evacuated and then it was the fuel. It became pharmacies, Grocery Stores<\/a> and then the cascading affec affects. Those are the things once youre past 72 hours i am out for a week, two weeks or three weeks. How much of the core is waiting. Youre not going to get pu er back to everybody, and youre not going to get power back to the residential areas. Can you get enough life support back up up aand running for tho that do not have the power to get the essentials. Its not going to be easy but difficult. The thing is to trade off and where can i make the activities to find more time to keep the population stable . The evacuations and maybe selfis evacuate and if they have that option, they will. Its unlikely that there are places to go to. It becomes a time of stabilization, continuing to look at the down range impact and what were able to bring up and the reality is that all of the scenarios and the society as well as the physical and residential areas are probably going to be the last ones to get the power. Can you get enough to get the major supply lines . Youre not going to have everything and the normal consumption rates. You may have go with rationing of gasoline to see what is available versus demand signals. This means you have to plan out, not just the power went out but now what are the impacts of that as you go through time x and hopefully this is what our partners are working on is to get you better information about how much time are we talking about before we systems come up . When will we get the final power turned back on . In the absence of your information, that generates its own problems. If we know its going to be out for three weeks we can plan. People can people are more resilient than we give them credit for but lack of information, that in itself becomes a channel. I ran over my time but i was thats okay because its important. Thats what im trying to get at is, are these conversations, and who is responsible for these conversations with people at the local level because this is an unknown. If theres a storm coming, a hurricane, an ice storm, were prepared for that. We can expect. We know its coming. An earthquake, not so. You dont know its coming but we have experience with that. But a widespread cyberattack with a physical attack attached to it is unknown. And who is having that conversation with people at the local level that we dont know. It could be out a week. It could be out longer than a week. You need to be prepared. Are those conversations actually happening . Im not convinced that they are. And thats where the life will be lost. And i think we need to begin to find out, how do we connect the dots . Who is responsible to having those conversations down at the lowest level of the people who will be first charged with trying to protect lives . Im going to turn to Ranking Member<\/a> carson for his questions. Thank you very much, chairman barletta. Madam hoffman, your testimony notes that the departments research and Development Activities<\/a> with respect to developing space transformer components, what is the cost manufacture to manufacturers when were making these alternative components, and has a domestic manufacturer been identified so that we can ensure there is no disruption to its prior usage . So thank you very much for the question. Transformers are very critical components to the electric sector, as was stated in the testimonies in some of the conversations earlier. With respect to transformers, the price of a transformer ranges anywhere between 5 million to 10 million. And so these are significant components. So what do we need to do as we look for, what is our Research Program<\/a> . What are the activities doing looking for dealing with the transformer issues . First of all looking at the spare components, the spare transformers that industry has and then industries looking at having Spare Capacity<\/a> on their system. Were also looking at how do we develop the next generation transformer which might be a transformer thats you have the ability to produce more quickly and also have more standardization and flexibility. So that includes in our Research Component<\/a> the development of Power Electronics<\/a> and hybrid transformers. Our 2017 budget request has a Strong Program<\/a> looking at transformers, which is about about 10 million in which were going to look at developing the next generation transformers, as well as doing testing of transformers to make sure we understand any vulnerabilities that may exist. Thank you. Administrator fugate, in the event of a widespread outage, what are femas plans for communicating with citizens on response and Recovery Efforts<\/a> when theres essentially zero electricity . Not much different than what weve faced in other significant outages. We have a variety of tools. First of all, within the Emergency Alert<\/a> system, the radio stations, tv stations, many of them that have emergency power, tv stations, partner radio stations we can get signals in. If we lose a transmitter, this will be something well be looking at inoringing or duri i oregon during the cascadia. We work with the fcc for the nonimpact to stations to get signal back in. We encourage people have that battery operated radio. Thats why we encourage the idfm chips in cell phones because we can get signals in from the outside but people need to receive it to get the information. But part of this is going to be, where the information is coming from. We are going to be working through the Governors Office<\/a> because governors and their teams are going to be the best information at the local level. Our job really on the federal side is to provide the backup and tools required. And were prepared to work with the fcc and broadcasters to get signal from the outside. In addition, we have gone as far and we did this in the sandy response. Bring in Satellite Communications<\/a> and set up wifi in some of the areas that have lost some of the cellular communications. But we have another backup. And selfdisclosure, i am an amateur radio operator. But sometimes the more we look at the complexity of our risk, we forget that we have some very Resilient Systems<\/a> that are part of government but they often are the last thing running when Everything Else<\/a> has failed. We look everything from our systems and satellite technology, working with nonimpacted station has the broadcast in, amateur radios are all part of that. But its important that people take the steps to be able to get the information when we can get the signal in. Thats why it may seem very passe in an area of streaming everything that a Battery Powered<\/a> radio may be that lifeline of communication link to get information. Because we have seen even in largescale, like katrina, stations outside the area could broadcast in but you had to have a way to receive the information. And lastly, have our most critical transformers and substations been the bulk power system been identified so that we have a clear comprehension of system dependencies and even cascading impacts from a widespread power outage, regardless of the cost . Thank you very much for that question, Ranking Member<\/a> carson. We work very closely with the utility owners, with our partners at d. O. E. As well as nerc and ferc to understand the most critical aspects of the electric grid. We have a number of programs that we leverage to help assess the vulnerabilities of these particular assets and to work with owners s and operators to help enhance the security and provide recommendations. Equally important as youll hear later from jerry colley, the president and ceo of nerc, we have a series of standards that are intended to guide the security of some of these most critical assets. Increasingly within my office, we are working to better understand the dependencies and inner detendency on Critical Energy<\/a> assets to be able to visualize what an outage is, the impacts its going to have to other key lifeline sectors and to be able to provide that information as leaders to include administrator fugate as they are working to get power restored. Thank you, maam. Chairman, i yield back. The chair recognizes mr. Meadows for five minutes. Thank you, mr. Chairman, for this important topic. I think this is one of the interesting aspects thats i get asked about more than anything else. Let me tell you why im a little troubled here today. I hear a lot of rhetoric that acts like we have our act together from a federal standpoint when, really, the vast majority of the job that gets done is with the stakeholders, with those Public Utilities<\/a> thats for years have been prepared for mass outages, but perhaps the scope of the threat, the cyberthreat and what were talking about mass outages, we can talk about Hurricane Sandy<\/a>. We can talk about, you know, other storms. They are used to that. And im just telling you. I used to work for an electric utility many years ago. I was around. Ive got enough gray hair. I was around when the d. O. E. Was actually stormed. So when we look at this, to suggest that the federal government is here to help, i want to make sure that you are helping. Y in chairman talked about the real communication being done. The real communication is being done by the local utilities, if anything is getting done. Its crickets when it comes to the other federal agencies as it relates to this. Now i say this as a criticism only because we have to figure out that were sick before we start to figure out the diagnosis and how to fix it. So let me ask assistant secretary hoffman on one point. You were talking about National Security<\/a> and how you can reprioritize and make sure that those National Security<\/a> interests are supplied by Public Utilities<\/a> or governmental agencies. Heres my concern. Many of our National Security<\/a> interests have their own generating and own distribution capacity. Yet i find them woefully underprepared for cyberattacks. Some of them are primary metered at the point of entrance so you may have a public utility providing the generating capacity. They do the distribution. So as we look at this, what kind of turf war did we get in between dod and d. O. E. With regards to being ready for a cyberattack that would have National Security<\/a> implications . Thank you congressman for that question. When we deal with any sort of event, were going to act as a whole government. Whether its but who is in charge . Heres the problem. And i have dealt with a number of agencies. We get fema that comes in and local Emergency Management<\/a> responses. And what you have is you have different people saying different things. So with regards to National Security<\/a>, who is in charge of the power grid . Is it d. O. E. Or is it dod . The owners and operators are ultimately in charge of the power grid. The support to the power grid is going to come both from d. O. E. With respect to working with the owners and operators to restore power. Dod has a responsibility with respect to National Security<\/a> and protection. So from a physical security perspective, we may look at Law Enforcement<\/a> to help with the utilities to protect substations. It depends on the event but the response to be coordinated. So you have a plan, a coordinated plan that i could look at today on how that would happen . So for that you could give to this committee in terms of because heres what happens. Most of the time an event happens and then you go out and figure out the problems. You know, mr. Fugate was talking about the fact we learned lessons from each event we have. The problem with a cyberevent as were looking at in the ukraine, here we van outage to over 200,000 people have it was cut off. The real problem was they were in the system for almost six months and we didnt know about it. So the question is, how many times are we getting attacked, and are they in our systems without our knowledge . You bring up a good point, congressman, thank you, but the issue is every event and every incident is going to be different. And were going to have to think about the capabilities when somebody can take someones access skreshls. We have to look at that and think about that as an industry. Thats more of a physical threat. I want to go back to the cyber aspect. What were talking about is were looking at Risk Management<\/a>. And really what we need to start to focus on is a real comprehensive plan on how were going to partner with the private sector or Public Utilities<\/a> on doing this because what happens is we get a little check box and say weve gone and talked to x, y, z and asked them to make sure theyre vigilant about cybersecurity, which most of them are, but yet what happens is we dont have a comprehensive plan at a federal level to look at how we can support them in the event of a National Attack<\/a> that would come in the way of cyber. Im not talking about storms. Im not talking about stealing a credential. Im talking about the real attacks we get hit with every day. Do we know, have we done a Risk Assessment<\/a> where we have intelligence and have we shared that with the Public Utilities<\/a> . Because a lot of times we have this National Security<\/a> concern that we dont want to share that with an outside, you know, group because of National Security<\/a> concerns. Thank you. You bring up very good points in your discussion. First of all, we follow the National Response<\/a> frahmwork. As administrator fugate talked about, regardless of whether physical or cyber or weather related were going to react as a whole government. With respect to your question on intelligence, we are sharing information with the private sector. Dhs and d. O. E. Host classified briefings with the private sector to share actionable information. And that is the information that the utilities are able to take back and really do respond for us. With respect to specific events such as ukraine incident, ics alert has provided specific actionable information. D. O. E. Working with the electric sector sharing and Analysis Center<\/a> has provided actionable information to the industry to learn from these events and prepare. And thats whats important. Each event is going to be different. We have to take those events and learn from them. Ive run out of time. Ill yield back. Mr. Chairman, thank you for your patient. The chair recognizes mr. De blas blasio. I regret i had to step out to go to a hearing upstairs. The committees should look at not scheduling hearings in different subcommittees at the same time. Administrator fugate, you made a number of excellent points and talked about being a ham radio operator, thats a potential backup. I was recently in japan and one of their greatest regrets is that they didnt have enough deep ocean sensors, and they underestimated the size of the tsunami. And they did manage to get out a warning with that original estimate before the electrical grid went down in those areas and they had no further capability of broadcasting and warning people. And, therefore, many people sheltered in places that actually were below the crest of the tsunami and died. So theyve now moved to a cell phonebased system and required resilient cell towers to be built. Are we looking at anything like that here in the u. S. . Yes, sir. Part of the charge you gave us and the fcc was to develop wireless Emergency Alert<\/a>s. We implemented faster than we thought. Right now every cell phone being manufactured today is required to be able to transmit a wireless Emergency Alert<\/a>, part of the Emergency Alert<\/a> system. Tsunami warnings are built into those. So if there is a triggering event the originator for that will be the National Weather<\/a> service, tsunami warning centers. In case of oregon, the alaska warning center. It would go out. Its geo coded to the areas of impact. Those counties and communities at risk would get those notifications on their cell phones. You dont have to opt in or sign up. The only thing you can do to a cell phone is turn it off and not get the alerts. Unless youve done that, a tsunami warning would be issued and transferred upon that point and go out. You point out one of the challenges which is why we work closely with local levels. Its hard to get the magnitude of the tsunami so the evacuation zones have to be whats the maximum risk . Weve got to move now. A phased approach, we generally dont have time with cascadia. Its too close to the coast. Even before you get the warning if you feel shaking, you have to move to higher ground. Even with a warning you only have minutes to move. But the cell phone system now, as soon as the Weather Service<\/a> issues a warning, it will get transmitted to those areas. Weve seen this occur already. But it has answered this question of, what will wake people up in the middle of the night . Your cell phone buzzing and humming and making strange noises was the whole purpose of the Emergency Alert<\/a> system. When phones are manufactured after what date were required to have that . Do you know . It started i believe its id have to look at the exact date but its been about the last 2010, 2011 that all new handsets. Apple, the ios was the last of the handsets to incorporate this in. So pretty much all the new handsets now have this. And as we see the replacement cycle of cell phones weve now third, fourth, fifth replacement cycles. Were getting good penetration with those systems. Ive been on an airplane here where we were held on the ground because of thunderstorms and everybodys cell phones started buzzing as if they had a tornado alert or something. So that is great progress. To the honorable ms. Hoffman, just on the issue i raised earlier, you know, the transformer issue. It does seem really critical, and they are very expensive. They are cumbersome. Hard to move. But, i mean, where are you at in evaluating the potential or possibility of having some, you know, back dup or replacement transformers in a Strategic Reserve<\/a> . Youre analyzing that . Or where are you at in that process . Thank you very much, congressman, for the question. The transformer reserve plan that was required as part of the fast act is in progress. We have contracted with Oakridge National<\/a> laboratory to do an assessment with respect to transformers. The transportation issues, any sort of where they would be placed. Volumes and size. As you are well aware, the transformers in the United States<\/a> are quite unique and we also have to look at a parallel process for how do we look at standardization, look at next generation transformer for additional manufacturing. We are also in the process of assessing the transformer manufacturing in the u. S. D. O. E. Has had several reports out with respect to transformer manufacturing. There are several manufacturing entities in the u. S. , including efisec, georgia transformer, abb, wau ke sha and hyundai. Those are the transformer manufacturers in the u. S. Is that enough capacity we need . I would say we need more capacity with respect to transformers. So its important that we continue to look at a transformer sharing program. So we are in progress and on target to meeting that deliverable for the committee. So what was the timeline that was established for the conclusion . The timeline established in the fast act was one year from enactment. So it would be due in december. Okay. Great. Are you aware whether or not the Regional Power<\/a> administration is, you know, are you working with them, because they obviously have most of the are interlinked with private but for the most part provide for the Power Transmission<\/a> and high voltage Power Transmission<\/a>. And half of that well, part of it is d. C. So we have two different sets of transformers. Thank you very much for highlighting that. Yes, we are working with the Power Marketing<\/a> administrations which includes wapa, vonnebell. They are a core asset to the infrastructure rit large. Theyre a very important part of the conversation. As required by the fafts act well do consultation with industry and with experts in this area. Okay. Thank you, mr. Chairman. Chair recognizes mr. Perry for five minutes. Thank you, mr. Chairman. Secretary hoffman, the fast act you were just discussing includes what you were just discussing some additional roles and authorities. Can you talk a little further about the importance of the transformer reserve and what your thoughts on that are particularly . Thank you very much for the question. The transformers in the United States<\/a> are very critical component of the system. The fast act recognizes the criticality of these transformers, as well as the need to assess where are we at with respect to any sort of need for a plan to develop a plan for transformer Spare Capacity<\/a>. So what this means is really evaluate i evaluating the Spare Capacity<\/a> in the United States<\/a>, the ability to transport transformers. So where we should have a transformer stockpile, if necessary. Where should it be located . Because of the difference sizes and dimensions of the transformers. So part of the plan of what were look at with Oak Ridge National<\/a> laboratories, our plan is assessing the number of transformers, the size of transformers, meaning the different voltage classes, and then where those transformers could potentially be needed to be located because of transportation issues. The industry has had discussions with the classa railroads and looking at the transportation of transformers. You may not be aware but a lot of substations are in very remote locations. So really the criticality in some of the time is not only manufacturing the transformers, but it is actually the transforation of those to a location. Will you be considering the manufacture time in that study, and when can we expect the results . Yes, we have started looking and have had several reports out with respect to transformer manufacturing. And those are on d. O. E. s website, but the result of that will be included in the report in december. Do you discuss cost or reimbursement at all in your report . So part of the request is to look at policy implications and the cost and financing of that. We are going to work within the department of energy with our Energy Policy<\/a> and Systems Analysis Group<\/a> and assess what are some of the financial implications to setting up and developing a transformer reserve. All right. Thank you. In my opinion, the epa continues to overregulate the Energy Industry<\/a> and with that, i dont think they have the ability to determine or examine the requirements. Mr. Fugate, im sure youre aware based on what i have based on december 2015, retiring due to epa policy retiring or converting 81,423 megawatts or 499 units based on regulation. Has fema done an examination of how the epa regulations affect the grid and capacity . Are you interested in doing that . Do you know the capacity and the ramifications of the loss of the 499 units and the 81,000plus megawatts . To be honest, congressman, we depend upon our partners in dhs that do that. We are not the subject matter experts. So we determine for our Infrastructure Protection<\/a> what that means and what those impacts are. Having come from the state of florida weve seen dependence move from coal to i was in the unique experience of having a gas pipeline severed. Knoged out all the natural gas to the southern and middle parts of the state. We suddenly realized we had a tremendous reliability on that. And we were fortunate we had mild weather or we could have had generator capacity shortfalls that would not be made up. So ive got a limited amount of time here. So if fema is not doing it particularly, who are you getting the which partner are you getting that information from . Who is assessing the effect of the regulation, the loss of capacity and the timing of that loss . Who is doing that of your partners . I would depend upon my partners to the left. We look at energy as a function of government. There are numerous parts of the regulatory and response structure. We cons traut that into so may i ask your partner to the left. Do you have that information . Are you tracking that . Thank you very much for the question. The department does look at reliability implications with respect to any sort of Master Change<\/a> in generation mix in the United States<\/a>. With respect to the Clean Power Plan<\/a>, it is really going to be as the states develop their implementation plans, the assessment will occur with the regional reliability entities and the independent system operators where they will coordinate and understand the reliability impacts. So you dont know what it is up front or you dont assess it as it occurs . You dont know that so many plants and so much capacity is leaving in ohio or pennsylvania or alabama . You dont know that in advance and make an assessment of the potential risk thats involved . So thank you. From a wide from a widespread reliability point of view, d. O. E. Believes the Clean Power Plan<\/a> and regulations wul not have any widespread reliability impacts. But hold on. You believe that, but do you believe that because you have Empirical Data<\/a> to support that or you believe that because somebody is telling you that . Or you believe that because you dont have any reason to disbelief that. Right now the utilities woshl to ensure reliability. Our past experiences as any sort of reliability concerns come up, there is strong coordination within the industry to address any sort of reliability impact. So does that mean if you thought there was going to be a reliability impact based on the regulation and the capacity reduction that you would you would essentially exonerate or waive the requirements for a period of time to make sure that the Capacity Remains<\/a> . Do you have a policy to do that . Is there a thought to that . What is your plan if you come up against something that doesnt comport with what you think it needs to be from a capacity standpoint . Within Clean Power Plan<\/a>, the state says they develop their Clean Power Plan<\/a>, their state plans, they will be coordinating with the reliability entities, the isos and rtos looking at any potential reliability implications. How does that work . I live in the pjm, a multistate organization. Its not state by state. Its multistates that all feed into the same grid. How does one states plan affect another, and who coordinates whether reliability or capacity issues in that regard . The states are required as part of the Clean Power Plan<\/a> to coordinate with pgm. Npgm has and will continue to do reliability analysis for that region. Thank you, mr. Chairman. Thank you. Chair recognizes mr. Series. Thank you for holding this hearing. This is very important. I represent the 8th district in new jersey which got hoboken and some of the other areas, jersey city, which got hit very hard by sandy. If i learned anything about our infrastructure, its how unprepared we were for the storm or anything else. And theres plenty of blame to go around. Everybody points to the federal government but in reality the states could do a lot of things and the locals could do a lot of things and the Power Companies<\/a> could do a lot of things. I always think of the example, there was a generator in a flood zone. And the Power Company<\/a> was protecting it with a chainlink fence. So when it flooded, obviously, the chainlink fence did not hold the water back. So what im trying to get at is, these are the kind of simple things that we can do to protect, you know, this particular transformer. The other thing was in terms of the you were talking about now that we learned. We have plenty of gas, quite frankly, but they couldnt pump it. So a simple thing like a small generator to just move the pump or move the gas from, you know, from the containers to the people. It would have suficed. So when i say that everybody has shares of blame in this, i just hope that we have come from sandy far enough to learn some of these mistakes, and we are expecting them. So will you please tell me that weve come a long way from where we were . Weve come a long ways. We havent gone far enough. You point out what i see is the real challenge in which cyberhighlights, the tendency is to plan for what were used to dealing with, not for what can happen. We put a fence around a generator in a flood zone. The reason you have a generator is if power goes out. One of the likely reasons for a power outage is a coastal storm. But you hadnt had one in a long time so youre more concerned about someone breaking in and damaging the transformer. Cyber is new. A lot of things well do wont be new in response to the consequence. If we dont know what were planning against we may run the risk of only planning for what were used to having. Maybe shortterm Power Outages<\/a> or disruptions strictly local and not plan for what could happen and plan against it. As you point out, we try to promote these lessons, but it seems to again be one of our challenges. How do you get people to change . Lets talk about gas stations. Thats a private entity. Putting in a generator is a cost. So you can just ship a generator there. Most of those utilities were underground and it was hard to get a generator hooked up to it. In some states, theyve put in incentives that gas stations would be required to put in a transfer switch. It was a good compromise. That way if they did lose power, we can get jen ratsors in there and hook it up and pump gas. This is where we have to be careful. Its easy to say this is the fix until you ask who is paying for it. And i think this is the tradeoff of what would make sense either throughincentives, tax credits. I cant ask businesses to lose money if their other partners or competitors arent doing the same thing. You have to put a generator in every gas station. Thats not also necessarily a great idea either. Putting in a transfer switch was a great compromise. As we learn these lessons, we go back to this trap of, we plan for what we have experienced in the past, and that does not always scale up for the future impacts. We have got the Lessons Learned<\/a>. Weve put the information out there. But the receptiveness of that audience is based upon do they see this threat as applying to them. As you know for your community. We talk about hurricanes and hurricane evacuations. Most said we dont have hurricanes. We have noreasters. Its getting people to plan. We know what these impacts are. Its having people plan for what can happen, not only based upon their past experiences. And weve not had a lot of experience with cyber. So part of this again is getting what are we planning against . And then, what will we do differently . And if that requires resources, where are those resources coming from . I also think that we have to be prepared post sandy or post because we still have problems in new jersey where people still arent in their homes years later. And, to me, thats really unacceptable two or three years later that we have these issues where people, with the insurance, with the evaluation of the property. Somehow we have to be prepared for some of these things because it impacts real people. It does, and our experiences coming out of Hurricane Katrina<\/a> five years after that we still had families living in travel trailers because we didnt have the right answers. Rebuilding after disaster is time consuming. A lot of hurdles to go through. Its ideal to get people back in their homes as quickly as possible but that requires a lot of things that go beyond even some of my programs. Its really, as you point out, state, local sorry. Im not just putting the blame on you. Im also putting it on the locals and the state that we should prepare for any of these storms or whatever we have. Thank you, mr. Chairman. Thank you. Chair recognizes mr. Massey. Thank you, mr. Chairman. Im going to yield as much of my time as he might consume to the gentleman from north carolina. I thank the gentleman from kentucky for yielding. Miss hoffman, i want to follow up on one thing. You talked about the transformers and having these backup transformers as a redundancy. One of my Major Concerns<\/a> is that decisions that get made by d. O. E. Or dhs or fema all of a sudden what we do is we transfer that liability to others that are providing service. So what we right now, all utilities have backup transformers, primarily for distribution purposes. But even for larger transmission related transformers and switches. However, if youre going to make a decision, it directly impacts rate holders for two reasons. If they are having to have 10 million transformers sitting there, i dont know that they can get a return on that investment. If you start to extrapolate that out if its not in service, just kind of like generating capacity, theres a certain length of time they have in order to bring that online so they can get a return. Ults m ultimately it affects the rate payer, anything you do. When we start to look at the security implications, what id encourage both of you to do is look at it as we would from fema is that it is a federal redundancy required, not that needs to be done by utility to utility to utility. Do i have that commitment youll look at it as a federal obligation rather than utility obligation . For the record, both of them said yes. Let me finish with one other concern when we talk about sharing in a classified setting with the stakeholders. Have all of the utilities participated in that secured setting where you have let them know of both the threats, potential and real threats that we already have experienced . So you were saying that weve done that in a classified setting, and i just find that interesting. Im not challenging you, but i want to drill down on that because i dont know of too many maybe the big utilities but there are hundreds of utilities. They come into a classified setting. This is your rusk. This is where that is. This is your testimony today. So thank you for that question. Information sharing occurs at multiple levels. We do have classified information with the electric Sector Coordinating Council<\/a> which is a 30 ceos that comprise the whole sector. They are investor owned utilities, coops that participate in that information sharing, that classified information. In addition weve had one day readins where weve brought a larger section of utilities in to do classified information sharing. We have done that. Dhs has done regional information sharing, meetings where theyve had opportunities to bring folks in and do information. It occurs on multiple levels. Have we hit every single of those im not saying i want it to be systemic. Ill yield back to my good friend from kentucky in a couple of seconds, but i want to make sure that im clear. As we get the stakeholders, what i want it to be is more than just a box that were checking off. I want eei, i want all of the groups that are there to buy in and say, we have a plan. We do it for mass outages like sandy and other hurricanes. We havent done that, i believe, adequately, as it relates to cyber. And do i have both of your commitments that youll redouble your efforts to include them as stakeholders . Yes, we will redouble our efforts. One thing id say codifies how were redoubling our efforts is the gridx that happens between utility and industries where we are actively exercising this. Ill yield back to my good friend. Thank you. I just have a brief question that occurs to me during the questioning. Of this classified information, if we sought to get a brief on that, would you make yourself available in a classified setting for us as we contemplate what sort of legislation might be necessary . Yes, congressman, we would be glad to have a briefing with you . Is that the case for everybody . Yes, sir, of course. Mr. Fugate . I wourld originate most of the data but id be most of the origination of the classified data would come from my partners to the left. Understood. Thank you very much. And i yield back. With respect to time for our second panel, were going to move on. And i think if i can summarize, and i thank you all for participating today. I think if i can summarize administrator fugate that planning for local and state governments should be needs to be in terms of weeks, not days. And thats important because thats the furirst time ive hed what we need to begin to look at in the event of an attack. I want to thank you all for your testimony. Your comments have been very respectful in todays discussion. Well now call on our second panel. I remind you of the subcommittees request to limit your oral testimony to five minutes. Mr. Cull oug, you may proceed. Good morning members of the subcommittee. Very glad to be here today testifying. Im the president and ceo of the north American Electric<\/a> reLiability Corporation<\/a>, nerc say nonprofit International Organization<\/a> overseeing the reliablity and security of the power grid in the United States<\/a>, canada and a portion of mexico. We have authority assigned by congress to develop and enforce standards affecting reliability and security of the grid. And that authorities overseen by the federal Energy Regulatory<\/a> commission. Electricity is the most critical lifeline sector for National Security<\/a>, for other lifeline sectors like finance, water and transportation, for the economy and for Public Safety<\/a>. Every day were reminded of a seriousness of our job related to securing the grid. There have been terrorist attacks in france and belgium and even here domestically. There have been Cyber Attacks<\/a> and data breaches across various industries and across government. Of particular relevance to our grid on december 23rd, 2015, there was a cyberattack in the ukraine which was launched against three Distribution Companies<\/a> and in which the perpetrators gained control of three Distribution Companies<\/a> and were able to put out the lights for 225,000 customers for up to six hours. A team from the u. S. Went to investigate that incident in the ukraine, including a member of the nerc staff, and what i can tell you is that the cyberthreats are real. But i think we have a very different situation in the ukraine as compared to what we have in the United States<\/a> and north america. Our security controls in north america are very different. Were the only industry with mandatory and enforceable reliability standards affecting physical and cybersecurity. Were currently in the fifth generation of cyberSecurity Standards<\/a>. Riskbased standards based on nisttype controls. They are adaptable and can keep up with the current threats. We have a very robust compliance monitoring and enforcement program. System operators use modern controls to ensure the security of the system, including separation of corporate and Business Systems<\/a> from control systems. Physical access controls. Patch management. Aggressive Threat Hunting<\/a> and mitigation and employee and contract training and many other measures they take. Weve established the electricity seccor coordinating council at the highest levels of industry and government including ceos and top officials from government. The ceos and boards of Power Companies<\/a> take security very seriously and security is one of their highest priorities on a regular basis. Our information sharing and Analysis Center<\/a>, which youve heard about, the isac, provides robust information sharing regarding physical and cyberthreats. Weve recently gone through a review and upgrade of the capabilities of the isac and the isac, i believe, is closely integrated with the Security Operations<\/a> and information sharing at individual companies, as well as the state Fusion Centers<\/a> and other sectors. We also operate a tool called crisp to monitor the internet traffic to key sites around the industry and compare that traffic to threats and vulnerabilities that were aware of worldwide and warn the utilities about issues they may be experiencing in realtime. In the unlikely event of a successful cyber or physical attack, i believe that we are well prepared. Ferc and nerc recently completed a study of the restoration and recovery capability plans and drills and exercises of nine Major Companies<\/a> in the industry, and that report is available publicly. Its posted on the nerc website. But it demonstrated the preparation is there and that the plans have been exercised. As you heard before, november this past year, nerc led what i believe is the largest Grid Security<\/a> exercise in the world. Gridx 3. Over 300 entities in north america participated. Over 4400 registered users. In my estimation probably closer to 10,000 actual participants. The distributive play portion where were in a Central Control<\/a> place and we inject the attacks outward and so the Power Companies<\/a> are engaged in the exercise locally in their own control centers in their own substations and power plants. Theyre receiving the information from us. That portion i apologize for my voice. Just getting over a cold. That portion lasted two days. On the second day there wauns executive table top that brought it together for senior execute ufs from industry and government. The scenario included Cyber Attacks<\/a>, physical attacks, including active shooters, truckmounted explosive devices and unmanned surveillance drones. This hypothetical event was extreme and intentionally extreme to go beyond our copyablity and to test the system and really the point was to find out what can we learn and what do we need to do to improve. During the distributive play exercise we caused outages on a simulated fashion. No one was controlled or affected. We simulated 5 million customers were out, and during the executive section to invoke all the policy questions at the National Level<\/a> we were looking to pull out, we had 15 million customers out, and those outages were projected to be extended for weeks and even into months to really push the questions that the chairman is trying to raise today. Participating entities work through their emergency procedures. Very extensive contacts with local Law Enforcement<\/a> and First Respond<\/a>ers. Those local government officials and First Respond<\/a>ers did participate in the exercise. We had in the exercise the white house, dhs, d. O. E. , department of defense, cyber command, nsa, northcom, fema and the illinois and Wisconsin National<\/a> guards are some of the players who participated in the executive exercise. A number of key take aways were to make sure that we are able to better coordinate between industry and government in terms of the situation assessment. And what do we communicate to the public . It would be a constant race with regard to information to the public. We all know social media and the news are very quick. We want to make sure were getting reliable information out to the public. Were focussed on ensuring unity of effort and unity of scale. We can resolve all of our resources for both industry and government together. Looking forward, i would say in this exercise well continue to expand the role of state and local governments and participants in the exercise to make sure we can exercise some of the things the chairman is looking to get here which is, how do we engage, how do we inform and how do we set expectations . I look forward to your questions. Thank you for your testimony, mr. Coley. Mr. Spencer . Members of the committee, my name is bill spence. Im president , chairman and ceo of ppl corporation. We deliver electric ut to more than 10 million customers in the u. S. And the uk. Beyond my role overseeing ppls operations, im also on the eei ceo policy committee on reliability and Business Continuity<\/a>. I also am a member of the electricity subcommittee or subSector Coordinating Council<\/a> that you heard about earlier today. The escc serves as a principal liaison between the federal government and the electric power sector to protect against cyberthreats to the nations power grid. Protecting the nations power grid as you heard earlier is not only a top priority of the federal government. Its also a top priority for the industry. We have a very strong record of working together closely in all kinds of disasters and storms. Along with our government partners. We identify, assess and respond to all threats. The electric sector takes a defense and depth approach to protecting grid assets. This approach includes three key elements. The first is a rigorous mandatory enforceable and regularly audited reliable standards. Jerry talked about that in his testimony. Also, close coordination among industry and with government partners at all levels. And thirdly, efforts to prepare, respond and recover should power Grid Operations<\/a> be affected. Our industry already maintains hundreds of spare transformers. I dont believe that came up earlier, but you should be aware of that. In addition we just recently launched as an industry a new project called grid assurance. Under grid assurance, many of the major utilities in this sector are coming together to establish regional centers, what we will not only store spare transformers but other critical equipment necessary to quickly recover the power system in any type of an event. Among all the kritsical unfra structure sect ors you should know the electric sector invests more annually than any other Critical Infrastructure<\/a> sector. Last year alone, we invested more than 100 billion. Regarding Security Standards<\/a> and regulations, as you heard, were subject to nercs reliability standards. Entities found violating these standards face penalties of up to 1 million per violation per day. In fact, our industry is the only industry subject to these mandatory federally enforceable cyber and physical standards. The industrys also implementing requirements for physical security as part of a broader suite of nerc standards and using voluntary standards to drive improvement. Secondly were accordinating closely with the federal government, sharing threat information between the government and industry to protect the grid. According to the National Infrastructure<\/a> advisory council, the electric power sector is viewed as a model for how other Critical Infrastructure<\/a> sectors can more effectively partner wuths government. Our intent is to keep it that way. The electric subSector Coordinating Council<\/a> brings senior government and industry executives like myself together with Agency Officials<\/a> to improve sectorwide resilience against all hazards and potential threats. The escc and our electric information sharing and Analysis Center<\/a> offer programs like the cyber risk information sharing program, as jerry also mentioned, which we share information on potential threat. This is an area where i think the federal government has been very helpful to the industry. By allowing us to utilize proprietary hardware and Software Developed<\/a> at the National Labs<\/a> and is now helping to protect the grid. We now have over 75 of the u. S. Customer base covered by industry participation in this critical program. The escc is also focused on several key other areas including planning and exercising responses to major disruptions. Our last exercise was a combined cyber and physical threat. Were also ensuring rapid threat communication amongst share owners and stakeholders who were also developing governmentheld technologies on electric Power Systems<\/a> that improve Situational Awareness<\/a> and crosssector coordination. Last, but not least, were focused on Incident Response<\/a> and Recovery Efforts<\/a>. Electric Power Companies<\/a> continuously plan and exercise for a broad range of potential threats. We share crews and equipment in times of trouble, and we regularly drill for potential emergencies. For our part, ppl is actively engaged in the industry efforts ive highlight and pursuing an aggressive approach to protecting the power grid. Thank you, and i look forward to your questions. Thank you for your testimony, mr. Spence. Ms. Killmer, you may proceed. Thank you for inviting me to testify today on how electric cooperatives manage the consequences of a power outage. Regardless of the cause, getting power restored quickly and safely requires advanced thinking and planning. My name is bobby kilmer. Im testifying on behalf of the National Rural<\/a> electric cooperative association. They deliver electricity to member owners at over 18,000 locations in rural northeastern pennsylvania. We have low consumer density averaging less than six consumers per mile of line, and we serve primarily residential accounts. We are one of pennsylvanias 13 electric cooperatives and our electric Distribution System<\/a> is not directly connected to the bulk power system. The National Rural<\/a> electric cooperative association is a Service Organization<\/a> dedicated to representing the National Interests<\/a> of electric cooperatives and their consers. Nreca represents more than 900 not for profit consumer owned Rural Electric<\/a> uactualities that provide electricity to over 42 Million People<\/a> in 47 states. Electric coops are accountable to their consumer members. Those same members own and govern the coop through a locally elected board. They reflect the values of their membership and are uniquely focusod providing Reliable Energy<\/a> at the lowest reasonable cost. Responding to Power Outages<\/a> is a major part of our business. Assessing the situation, knowing who to call and determining how to proceed is imperative, and it requires coordinated efforts in the public and private sectors during major events. One of the seven principles of the cooperative business mod cell Cooperation Among<\/a> cooperatives. This cooperation is integral to our Emergency Planning<\/a> and response. In pennsylvania, as in many states, the electric cooperatives statewide association plays an Important Role<\/a> in emergency coordination. Electric coops have mutual assistance agreements between one other so during a major event the process of securing additional crews and resources is simplified. There is also a National Cooperative<\/a> database which facilitates crossstate mutual assistance. As i noted in my written testimony, this network helped our statewide secure crews from florida to assist us in our restration following Hurricane Sandy<\/a>. Also important are the relationships that we have with state and local government agencies. During major events our statewide association is in regular contact with the Pennsylvania Public Utility Commission<\/a> and the pennsylvania Emergency Management<\/a> agency. The statewide communicates outage information and requests for assistance from other governmental decisi aal divisio behalf. Were in touch with our county local Emergency Management<\/a> agencies. We advise them of outages in their counties and expected restoration times. This allows them to coordinate with other organizations like the red cross to set up services such as warming shelters. We also have Close Relationships<\/a> with our local police and fire departments. And along with other agencies and utilities, we, too, participate in tabletop exercises which simulate emergency snacenarios and strengthen our community networks. Communication with our members is important, too. We always provide the option to speak with a Live Customer Service<\/a> representative. We use outgoing telephone messages, information postings on our website and social media and use radio and Television Broadcasts<\/a> which could be used even in the event the internet is down to keep members and the public informed about outages. We test our Business Continuity<\/a> and Disaster Recovery<\/a> plans annually, and we have plans in place so that we can operate from a remote location if necessary. Cybersecurity and awareness is a critical part of our operational preparedness. Though we are a small utility, we strive to follow industry best practices such as the use of network scanning and intrusion detection programs in protecting our operationalidata and our business and member information. We also participate in the Pennsylvania Department<\/a> of Homeland Security<\/a>s task force on cybersecurity. Our preparedness in the field is tested throughout the year during localized outages caused by weather events and other conditions. Lessons learned through experience, along with the coordination with our national, statewide and local networks would form the basis of our response to a national or cyber event. Again, thank you for the opportunity to testify today on our emergency preparations and Recovery Efforts<\/a>. Thank you for your testimony. Ill now begin our first round of questioning. And this question is to all. Im going to ask you the same question i asked our first panel. What is the planning scenario that state and local governments should be using for a cyberattack on the electric grid . Will the power be out for days or weeks or months . Considering both a cyberattack and a physical attack, the worst case scenario. How widespread could the outage be . Mr. Colley, nerc runs an exercise on the failure of the grid. What scenario do you the question. As i mentioned in my presentation, we do probably pose a scenario thats ten times beyond any sort of realistic expectation in terms of magnitude, its to test and shake us out and see what we can do. The difficulty in understanding the question is that theres many kinds of hazards that can cause outages. And, in fact, if we look at we do a lot of data and analysis about what causes blackouts. Thats one of our jobs. Since 2011, so four years running in our data, weather has been the top ten causes of all major outages in north america. So we have that sort of baseline. So, the question for me, i phrase it as what kinds of things can cause outages from a few hours up to two to three days . And theres a lot of things that can contribute towards that and what kind of response and capability we have. So it could be storms, it could be equipment failure, a number of things. Then i think as we get to the kinds of things were talking about here in terms of cyber and physical attacks, i think its reasonable to ask and severe storms, ice storms, hurricanes, it is reasonable to ask the question how are we taking care of people . In a one to twoweek outage . It may not be everywhere, but it might be in some local areas, it might be some cities that could reasonably be facing a one to twoweek outage. I would hate for us to say its a cyberevent or its a storm. Really the Public Safety<\/a> issue is similar. The major difference would be, to me the major difference would be we knows there some kind of security concerns, Law Enforcement<\/a> would be involved. Still the same fundamental without electricity, you need to take care of people, get them fuel, food and water. The one scenario i think that is the exception, and i think it was appropriate that the committee participated in the legislation around spare equipment, the one scenario i think realistically concerns me longer than the one to twoweek time frame is damage to spare equipment. Particularly the transformers that could happen from bomb blasts, shootings, other gmd storms. The question is not what caused it, but the question is what you are going to do if you lose transformers and theyre not replaceable for an extended period of time. I guess what im getting at, i want to get this connect the belts down to the local and state. I feel pretty confident that getting to that point weve got all the ducks in order. Im just concerned that theres a missing link to what should the state and local governments be preparing for or planning for in length of time because they need do the same thing youre doing. They need to know the scenario of worst case what do we need to prepare for . Right. Ive been doing reliability for 35 years. I really think theres two levels. Theres normal expected, you would see a number of times a year, is that one to three days is a normal kind of scenario that everybody should be prepared for. I think a one to twoweek scenario is a scenario that if youre prudent, i would be talking with the mayors and the City Councils<\/a> about what you can do to be ready for a one to twoweek outage in the extreme case of hurricanes, earthquakes. My only exception is spare equipment damage may be more challenging. I think it really is independent of the cause, whether its cyberattack. I cant imagine a cyberattack that will damage equipment to have an outage more than hours or days. I would agree with mr. Cauley. I think the prudent thing would be the same as what were doing today for devastating storms which is really a one to twoweek outage preparation. There are a lot of resources currently available to local communities, both at the state and local community level. They are a really great resource that all the towns and communities dont take advantage of. A lot of good best practices that have been used by towns and cities that have been more experienced with devastating storms for example the state of florida, has a lot of experience. A lot of Lessons Learned<\/a> there that are available to towns and communities. I think the other thing i think this was mentioned by the representative of fema earlier today, really boils down to, in many cases, the probability of the event happening that risk of the event, and willingness to put in place and spend the upon for backup generation or other backstops that would be necessary for one to twoweek event. So i think thats where i would direct the towns and communities to be aware of whats available, utilize that fully, make the critical investments that they need to survive a one to twoweek period. I will connect the dots. So do you think its the federal governments government or the state governments responsibility to make sure that the local government is doing all that . Because im just concerned well have everybody pointing fingers at each other, i thought you said, i thought you did, and nobody did. Whose responsibility should it be that we make sure that the local governments are prepared . Because today is really the first time im hearing a length of time. Right. In my own mind, again, ill put that mayors hat back on, im thinking, geez, if its a week or two weeks, theres a lot of things i need to be prepared for here, and im probably not. Which means most cities are probably not prepared. Thats what this hearing is about, to raise a red flag here today that we are not prepared in the event of something drastic, major, unlikely, but could be. Couple comments. First, i would say you probably would not want to hear this necessarily, i think its a shared responsibility between local government and the federal government. And i really do believe that because youre just not going to be able to have federal boots on the ground in all these local communities to get the communities back up and running. Secondly i would say theres things that the local yew tiuti do have at their disposal in terms of communication and backup generators that we can deploy to highpriority areas to make sure when we need to restore the system and cant do it in a timely fashion, at least theres a basic level of service that we can provide. In an extended period of outage, youll still have power to certain areas. It may not be this town or that town, but collectively there will be ways to get Resources Available<\/a> to the local towns and communities. To be quite frank, i was skeptical when we started this electric sub Sector Coordinating Council<\/a> and whether the federal government would be able to help us as an industry to restore power quickly. Ive been pleasantly surprised at the level of cooperation and collaboration thats gone on in the last three, four years. Simple things like providing fuel that we desperately needed during Hurricane Sandy<\/a> to restore towns and communities in jersey and pennsylvania, and theres other things like providing beds for crews that are coming from out of state. We were able to access barracks at the department of defense facilities. We were able to access portable generators. We were able to access experts in Emergency Response<\/a>. There are some things that the federal government can be helpful for. And i think now that we have a playbook that really dictates who does what when, which was always my concern in a major event who do i call . And are they going to be ready for that call . I can i can say that from what ive seen so far, i believe were more ready than weve ever been in the past and we have a very good system and play book and we can go right down the line and have access, were talking about this committee, to cyberresources at the highest level of the federal government. Thank you. Ms. Kilmer . I agree with my fellow panelists and the shared responsibility. I would also like to emphasize to the subcommittee the importance of communications during crisis periods. My experience has been that sometimes its not the length of the outage but simply knowing how long its going to be or what expectation is. It can help both residential consumers as well as townships and towns understand how they need to plan. Id also like to add one thing that weve seen in our rural area, especially since Hurricane Sandy<\/a>. And that is a focus on individual preparedness. Im seeing our local county management agencies doing a great job in trying to educate the public on being prepared. We try to do the same thing. We are in a rural area, were subject to many weather events, so i think our consumers are relatively prepared. Im not subjecting insuggestin on that but that is an element in all of that. The chair recognizes Ranking Member<\/a> carson. Thank you, chairman barleta. Ms. Kilmer you mentioned the claverack is not connect to the bulk Power Services<\/a> but you receive services from another Transmission System<\/a> what does that mean for your cooperative in the event of a major cyberattack on the grid . In the event that there was a cyberattack that took down the grid, we would be affected by that. If penelex was affected and taken down, we would also be without power. Mr. Spence, whoever, there was a newspaper article yesterday that indicated that the fbi and the department of Homeland Security<\/a> had machine warning the Power Industry<\/a> over the last month about a potential cyberattack. What role as the electricity information sharing and Analysis Center<\/a>, what role might they play in distributing","publisher":{"@type":"Organization","name":"archive.org","logo":{"@type":"ImageObject","width":"800","height":"600","url":"\/\/ia600307.us.archive.org\/26\/items\/CSPAN3_20160414_140000_Hearing_on_Electric_Grid_Security\/CSPAN3_20160414_140000_Hearing_on_Electric_Grid_Security.thumbs\/CSPAN3_20160414_140000_Hearing_on_Electric_Grid_Security_000001.jpg"}},"autauthor":{"@type":"Organization"},"author":{"sameAs":"archive.org","name":"archive.org"}}],"coverageEndTime":"20240624T12:35:10+00:00"}