1 Protecting the Texas Electric Grid: A Cybersecurity Strategy for ERCOT and the PUCT Abstract—The electrical system serves as the fundamen- for preparation and prevention, but only if the various tal base of a country’s economic activity, and it is therefore, governmental agencies can work together on a specific a likely target for cyberattacks. As the modern economy continues its evolution towards greater digitization and course of action. interconnectedness, policymakers must outline and enforce Since cyberattacks have not only private but also social regulations protecting those critical assets, without which costs, negative externalities arise, leading to underinvest- the economy would suffer. ment by the private sector in mitigating the costs. In The Texas Interconnection, due to being independently operated and to a large-extent legislated by the state of turn, this proclivity to underinvestment leads to under- Texas, enjoys a simpler regulatory environment than its na- insurement: a 2015 Lloyd’s white paper (Lloyd’s, 2015) tional counterparts. We exploit this relative independence suggests that an ‘Erebos’ malware attack on the eastern to offer policy solutions to better protect Texas against a cyberattack on its electric grid. Specifically, ERCOT and US grid could have a $243 billion impact; even if power the PUCT have the authority and ability to streamline were restored within 24 hours, many places would be and simplify the potentially confusing protocols enforced without power for several weeks. by NERC to make adoption more likely. We also discuss Given the negative externalities of cyberattacks, and grant programs for smaller utilities and the role of cyber- insurance in helping utilities navigate the difficulties in their concomitant underinvestment, the proper role of the understanding the protocols so that compliance can occur. government should be to invest in such protections at a socially optimal level so that attacks can be prevented. State governments can experiment within an existing framework of cybersecurity standards to find a solution I. INTRODUCTION AND RESEARCH MOTIVATION that meets the needs of all stakeholders: governments, Two recent events have alerted American policymak- utilities, their customers, and regulatory agencies. ers at all levels of government to refocus their efforts on grid security. First, the December 2015 and 2016 II. GOAL OF THIS STUDY successful cyberattacks on the Ukraine’s electric infras- The goal of this white paper is to discuss different tructure represented a “wake-up-call” for policymakers, policy options that might be applicable to the State of industry insiders, and the population at large. Another Texas, specifically the Texas Public Utility Commis- warning came in the summer 2017 during an attempted sion (PUCT) and the Electrical Reliability Council of cyberattack on a petrochemical plant in Saudi Arabia. Texas (ERCOT). Given its relative energy independence This attack, although foiled due to an error in the code, compared to the other states in the US, Texas has a could have led to a complete takeover of the plant by simpler jurisdictional path, granting it more space to the attackers, including the possibility of the release of experiment with different cybersecurity policy options. toxic gases (Giles, 2019). NERC CIP standards, which ERCOT must abide by, are These attacks are not performed by antisocial individ- a good starting point for such experimentation. The main uals wishing mayhem. Rather, these attacks are commit- difficulty will be in compliance of these standards, not in ted by state-sponsored teams working in collaboration their adoption or implementation; therefore, if solutions with their clients to engage in geopolitical cyberwarfare, for noncompliance can be overcome, the result would be representing a new twist in what it means for a country a safer, more secure electric grid for all Texans. to defend itself against its enemies. The United States This paper is organized as follows: The overall physi- is an especially valued target. It is no surprise then that cal and regulatory environments are described, with a at the legislative and executive levels of government, the special emphasis on the relative independence of the US is seeking to harden its grid against such attacks. Texas grid. Next, different state-based approaches to However, preventing cyberattacks is expensive, while cybersecurity are discussed to give Texas policymakers the events themselves are rare, but extremely disrup- an idea of what types of solutions are being used tive to the economy. Therefore policymakers need to throughout the country; 2019 Texas legislation is de- be acutely aware of the risks a successful cyberattack scribed to underscore the salience of the issue and how would cause. The Ukraine event makes such a case it may impact ERCOT and the PUCT. 2 The central crux of the paper follows, which is the FERC oversees 10 different regional transmission importance of NERC CIP standards to the cybersecurity organizations (RTO) which coordinate multi-state (ex- of the electric grid. Likelihood of compliance is dis- cept for Texas) grids in areas of power generation, cussed at a utility level, namely investor-owned utilities, transmission, and sale. Independent System Operators municipalities, and cooperatives. Lastly, reasons for non- (ISO) have similar functions; sometimes they operate compliance are analyzed from a theoretical perspec- only in one state, other times in multiple states. RTOs tive, and three potential solutions are outlined: a grant have an added responsibility of transmission planning program, a streamlined auditing process, and insurance (FERC Order 2000). The key to the oversight function reform. of FERC resides in US Const, Art 1, Sec. 8 which grants to the federal Congress the authority to “To regulate III. REGULATORY ENVIRONMENT Commerce with foreign Nations, and among the several Electricity generation, transmission, distribution, and States,”. Since electric power transmission and sales delivery in the United States is regulated at federal, state, frequently cross state lines, the federal government has and local levels of government. Three key organizations the authority to regulate such actions. However, in the at the federal level are responsible for ensuring reliable case of Texas, power is generated and sold only within power flow throughout the US - the North American the state; therefore, FERC has no direct authority over Electric Reliability Corporation (NERC), the Federal ERCOT, except for sales between ERCOT and other Energy Regulatory Commission (FERC), and the De- regions. partment of Energy (DOE). These organizations have Both FERC, as the government “side”, and NERC, as statutory authority to ensure that the nation’s power grid the industry “side”, work to oversee the RTOs as they can effectively and safely handle the nation’s increasing work to ensure reliability on the issue of cybersecurity. electricity demand. Therefore, while there may be investment differences Created in 1968 by the electric industry as a way to between the RTOs, they all are supposed to abide by coordinate planning and reliability efforts across the US the same standards, known as Critical Infrastructure and Canada, NERC now serves as a nationwide Electric Protection (CIP) standards, which are NERC’s protocols Reliability Organization (ERO). Electrical power across for cybersecurity. We focus on these because ERCOT is Canada and the US is divided into 4 grids, the Que- only held to the NERC standards, and not the FERC. bec, Eastern, Western, and Texas Interconnections. The They are however, for all intents and purposes, the same Texas Interconnection is the only one wholly contained as FERC’s protocols. in one geographic state. NERC works with FERC in The CIP standards revolve mainly around traditional establishing the necessary guidelines to ensure reliability expectations of physical security such as controlled ac- by subdividing the 4 Interconnections into 7 different cess into the facilities, as well as digital-based security reliability entities; this paper will focus on the Electric for computer network segmentation, access controls, and Reliability Council of Texas (ERCOT) and the Texas detection of an attack. Punishments are meted out in Reliability Entity (TRE). case of non-compliance; the same IT survey that demon- Beginning in 2000, NERC established an analysis strated an overall unreadiness of the grid operators also center devoted to the protection of the physical and mentioned a potential weakness is that many operating software components and furthered their oversight of the systems use legacy computer software like Microsoft member organizations. After the 2003 blackout, federal XP 2014, which due to its common use, is a popular legislation was passed granting NERC with its current target for hackers who code especially to exploit the status as a nationwide reliability organization with legal weaknesses in that operating system. authority to enforce its rules. In the United States, NERC sets up security protocols through its Critical IV. PROBLEM OF NERC CIP COMPLIANCE Infrastructure Plan (CIP) which was created in 2006. While the protocols are created by NERC, they must A. The industry perspective be approved by FERC to go into effect. Jason Miller, managing partner of the Archer Secu- Set up as an independent regulatory agency in the rity Group, a NERC compliance consulting firm, states 1930s as electrical systems proliferated throughout