Michael Mabee (516) 808‐0883
[email protected] www.MichaelMabee.info October 26, 2019 U.S. Securities and Exchange Commission 100 F Street, NE Washington, DC 20549 Subject: Failure of investor owned electric utilities to disclose cybersecurity risk. Dear Commissioners: I am a citizen who conducts public interest research on the security of the electric grid. I have conducted several recent studies which raise significant regulatory red flags, not the least of which is a massive cybersecurity risk coverup in the electric utility industry. I believe that cybersecurity risk is not being disclosed to shareholders (as well as ratepayers, Congress and state regulators). The purveyors of this coverup are the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) aided and abetted by the entire electric utility industry, which consists of many publicly traded companies. Exhibit A is a list of most of the “Investor Owned Utilities” from the industry group Edison Electric Institute’s member list.1 Exhibit B is a list of the NERC Regulated Entities downloaded on October 26, 2019 from NERC’s website.2 This list includes both investor owned and publicly owned utilities. As detailed in the attached report of my research (Exhibit C), which I filed with FERC on October 25, 2019, I have been conducting an investigation since March of 2018 into NERC’s practice of withholding the identities of Critical Infrastructure Protection (CIP) standards violators from the public. CIP standards include the standards for cybersecurity as well as physical security of critical facilities. This investigation has revealed that from July of 2010 through September of 2019 there had been 256 FERC dockets involving almost 1,500 “Unidentified Registered Entities.”3 In each of these instances, the identity of the regulatory violator was withheld from 1 See: https://www.eei.org/about/members/uselectriccompanies/Pages/default.aspx (accessed October 26, 2019).