Page 1023 – RTO Insider

June 30, 2019

Utilities Warn of Encroachment on Communications Band

By Rich Heidorn Jr.

WASHINGTON — Utilities asked FERC on Thursday to lobby against a Federal Communications Commission proposal that the companies say could disrupt their mission-critical wireless communications.

Speaking on the final panel of the commission’s annual technical conference on reliability, representatives of the Edison Electric Institute and the Utilities Technology Council (UTC) urged FERC to oppose the FCC’s proposal to require utilities to share the 6-GHz wireless spectrum with unlicensed users, saying they fear it could cause interference with their communications. But wireless companies told FERC the utilities’ fears are unfounded.

Electric utilities use the spectrum (5,925 to 7,125 MHz) for point-to-point microwave links providing communications with substations, fault sensors, two-way meters and service crews. It is also used to provide situational awareness in rural areas where wireline networks are not available.

The UTC — which represents water, gas and electric utilities that use the spectrum — joined with the Edison Electric Institute, the American Petroleum Institute, the American Public Power Association, the American Water Works Association and the National Rural Electric Cooperative Association in joint comments opposing the FCC’s proposal.

“Electric companies use the 6-GHz band for [supervisory control and data acquisition] and tele-protection systems that monitor and control the balance of power on the grid, which must operate constantly in real time with sub-second latency to avoid system instability and power disruptions,” J.P. Brummond, vice president of business planning for Alliant Energy, testified on behalf of EEI on Thursday. “EEI joins with UTC to recommend that the commission coordinate and formally engage with the FCC and other stakeholders in regular meetings.”

FCC NOPR

The FCC proposed the change in a Notice of Proposed Rulemaking last October, saying it was in response to growing demand for access and a congressional directive to identify additional spectra for wireless broadband (18-295, 17-183).

“Unlicensed devices that employ Wi-Fi and other unlicensed standards have become indispensable for providing low-cost wireless connectivity in countless products used by American consumers,” the NOPR said. “The broad spectrum swaths that we propose making available in this frequency band could promote new technology and services that will advance the commission’s efforts to make broadband connectivity available to all Americans, especially those in rural and underserved areas.”

The commission cited estimates that North American mobile traffic, including unlicensed Wi-Fi devices, grew 44% in 2016 and is projected to grow nearly 35% annually through 2021.

The FCC’s proposal is based on existing rules on Unlicensed National Information Infrastructure (U-NII) devices that have been operating for years in the 5-GHz band, including Wi-Fi and Bluetooth technology used by smartphones, streaming video, cordless phones, security systems, garage door openers and baby monitors.

Communications Utility — The density of assignments in the 6-GHz wireless spectrum (excluding fixed-satellite service) | *FCC*

The commission said unlicensed use of the new spectrum is a “natural fit” for Internet of things (IoT) devices, which some project will grow to 15 billion by 2022.

The FCC began considering opening the 6-GHz band with a 2017 Notice of Inquiry. “Filers representing incumbent interests uniformly emphasized the need to protect those incumbent operations, with individual filers expressing differing levels of optimism as to whether successful sharing mechanisms could be established.”

Some companies that originally supported unlicensed use throughout the band without restriction, including Apple, Cisco Systems, Google and Qualcomm, now support requiring automated frequency coordination (AFC) for all outdoor and some indoor devices. AFC relies on a “database lookup scheme” to ensure that unlicensed users are not encroaching on an existing user’s priority access to the frequency in a specific area.

In response, a group representing fixed microwave incumbents, the Fixed Wireless Communications Coalition (FWCC), “appears to be more open to the possibility of finding successful shared use mechanisms in the band than it had been,” the FCC said.

Widely Used

Fixed point-to-point wireless in the 6-GHz spectrum is used by a range of critical services in addition to electric utilities, including police and fire dispatch, railroads, natural gas and oil pipelines, and long-distance phone service.

Alliant’s Brummond told FERC that the importance of his company’s wireless communications was illustrated in its response to a 2018 tornado in Marshalltown, Iowa. “The radios that our crews used during the recovery efforts were invaluable since public networks were overloaded right after the tornado hit,” he said.

Alliant’s Iowa generation and dispatch operations use the 6-GHz band “in support of bids” into MISO’s markets, Brummond said. Interference could also harm the company’s ability to control its generators and calculate accurate system load, he added.

The 6-GHz spectrum is currently available only to licensed operators that UTC said “undergo a rigorous process of frequency coordination” to prevent interference.

While interference can occur under current rules, the UTC said, the other entities in the band are known, allowing for arrangements to eliminate conflicts.

Under the FCC’s proposal, utilities would not easily know who is causing interference, UTC said. “Instead, they would need to track down interference all over their 6-GHz network and make any necessary adjustments for an event that may never occur again. This is a highly technical and time-consuming proposition without any guarantee that the interference mitigation efforts would be successful,” it said.

John Marinho, vice president of cybersecurity and technology for CTIA, which represents the U.S. wireless communications industry, told FERC that the FCC should continue its “flexible-use policies” to respond to spectrum demand while requiring AFC to prevent interference.

John Kuzin, regulatory counsel for Qualcomm, told FERC much the same. “We would not be supporting allowing unlicensed use of this band if it could not be done without protecting the current incumbent users. Because the point-to-point incumbent links are fixed and their operational parameters are in an FCC database, protecting them from unlicensed operations is straightforward. The 6-GHz band presents a great opportunity for new unlicensed technologies to support new devices, services and applications for these incumbent industries, as well as millions of American consumers.”

UTC said it is not convinced that AFC will protect its members, calling the technology “untested, unproven and hypothetical.”

Adrianne Collins, vice president of power delivery for Southern Company Services, filed written testimony with FERC also expressing doubts. “Southern Co. does not agree the 6-GHz band is the right band to implement unproven sharing technologies,” she wrote. “Given its extensive service territory in both urban and rural areas, the 6-GHz band is the only suitable band that can accommodate the bandwidth and performance objectives over very long microwave paths.”

UTC acknowledged that interference in the 6-GHz band “is unlikely to have a cascading impact on electric reliability.”

But it said its members have invested millions in 6-GHz systems. “If we can no longer rely on 6 GHz to provide these services, we will essentially be forced out of the band to seek alternatives, and there are few, if any, spectrum bands with the same qualities as 6 GHz, which provides wireless transmissions across longer geographic areas (propagation) very quickly (low latency),” UTC said. “Even for those who do have alternatives, redesigning and re-engineering their communications systems, we have been told, will be a lengthy and highly technical process, taking perhaps up to 10 years in certain instances.”

June 29, 2019

Panelists Seek FERC OK to Move to Cloud

By Rich Heidorn Jr.

WASHINGTON — Registered entities asked FERC on Thursday to clear the way for their use of cloud computing, which they said could improve system visibility, security and availability while saving money.

Speaking at FERC’s annual reliability technical conference, representatives of the American Public Power Association, MISO, Berkshire Hathaway Energy and PPL all said registered entities should be able to use cloud service providers (CSPs) and virtualization for some functions subject to NERC reliability standards.

“Current NERC rules of procedure and NERC critical infrastructure protection standards do not explicitly address the use of cloud services and virtualization, leaving the industry uncertain as to how to approach related security and compliance risks as they explore the use of these technologies,” said Antiwon Jacobs, chief information security officer for the Sacramento Municipal Utility District (SMUD), who testified on behalf of APPA and the Large Public Power Council (LPPC).

From left: Ashley Mahan, FedRAMP; Antiwon Jacobs, Sacramento Municipal Utility District; David Rosenthal, MISO; Michael Ball, Berkshire Hathaway Energy; Brenda Truhe, PPL; and Michael South, Amazon Web Services. | © *ERO Insider*

MISO is piloting some cloud services, though not for operations or NERC CIP functions. Current CIP standards “were not developed with cloud services in mind, and they offer no guidance as to whether and how cloud services may be NERC CIP compliant,” said David Rosenthal, MISO’s director of incident response and systems recovery.

“It is no longer a question of whether cloud services have a place in our industry,” Rosenthal said. “Rather, it is a question of when, what and how cloud services will work in our industry. Major software vendors have moved quickly from a ‘cloud first’ to a ‘cloud only’ mindset, and that tells us that older, non-cloud technologies will not be supported indefinitely.”

Brenda Truhe, NERC CIP senior manager for PPL, said her chief information officer recently attended an all-CIO meeting where “he was one of the few who did not have his main applications in the cloud. He was talking to the financial industry and they said, ‘We do trillions of dollars in banking every day in the cloud. You can make it work.’”

“We’re seeing all critical infrastructures use the cloud in some way shape or form,” said Michael South, Amazon Web Services’ Americas regional leader for public sector security and compliance. “In my experience, the financial sector is probably the most mature and advanced.”

Benefits

In April, a NERC standards drafting team (Project 2016-02) released a draft white paper that it called “the case for change.” The team said virtualization offers the kind of benefits for computing infrastructure that the interconnected power grid does for bulk electric system reliability.

“As individual utilities interconnected their power systems to form a power grid to share spare capacity for meeting demand peaks and surviving contingencies such as generating unit and transmission line outages, so virtualization connects processors, networks and storage into ‘computing grids’ that allow our vital systems and applications to meet peak demands and survive outages of individual components,” they wrote.

MISO said cloud services can provide redundant and resilient data and systems and potential cost savings compared to the legacy practices of procuring and supporting hardware.

“It takes quite a long time to provision servers and get them ready for use. One of the things that virtualization does is it allows us to build from templates — pre-hardened — that are ready to go immediately,” Rosenthal said. “When you want to do a recovery, it makes it very simple and very quick. … When we had to recover our physical servers, it took a significant amount of time, and sometimes we failed.”

Truhe said cloud services also help registered entities deal with the shortage of qualified IT candidates, who may find working for AWS or Google more attractive than working for a utility.

Current Rules

Jacobs said NERC CIP standards “do not address the concept of virtual infrastructure” and that registered entities need “a signal or some form of endorsement from NERC and FERC” to provide them regulatory certainty.

He also requested FERC and NERC endorse external accreditations of CSPs, such as those provided by the Federal Risk and Authorization Management Program (FedRAMP), to address entities’ compliance risk.

Michael Ball, chief security officer for Berkshire Hathaway Energy, agreed that third-party accreditation is “an essential foundation” for a move to the cloud.

But he said “it is not the service provider that provides the security. … It still relies on me as an entity. You know they can build the best house, the most secure doors. But when they hand me the keys, do I lock the door?”

Off Limits?

Jacobs said APPA and LPPC oppose the use of cloud-based technology for controlling energy management systems and supervisory controls and data acquisition “at this time.”

The groups also said CSPs should not result in the removal of “critical layers of defense to [physical access control systems] and [electronic access control or monitoring systems] such as operational security (physical), access points, authentication servers and key management servers.”

MISO and PPL agreed that those functions should not go to the cloud without more experience.

Truhe said the cloud could have a role in those functions in the future. “I wouldn’t want to take anything off the table at this point,” she said.

June 29, 2019

New Western RCs to FERC: All Systems Go

By Michael Brooks

WASHINGTON — CAISO, SPP and BC Hydro officials reassured FERC on Thursday that the Western Interconnection’s transition from two reliability coordinators to five is going smoothly and that everything will be ready by the time Peak Reliability closes shop Dec. 3.

“We are ready,” Dede Subakti, CAISO director of operations engineering services, told the commission at its annual technical conference on reliability. “That’s probably the reason they allowed me to go out of the office and I’m here now.”

CAISO’s new RC West, which received its NERC certification May 30, will take over providing RC services from Peak for the ISO, several California municipal utilities and a northern sliver of Baja California at the U.S.-Mexico on Monday. It will take on most of Peak’s territory elsewhere in the West on Nov. 1.

Meanwhile, BC Hydro will assume responsibility for its own footprint on Sept. 2, and SPP will take over the remainder of Peak’s territory on Dec. 3. (See New RCs Tell WECC Transition on Schedule.)

CAISO and SPP are taking over RC responsibilities in most of the West this year. | *CAISO*

Differences Add Complexity

The officials did acknowledge complications surrounding the transition. One of the primary functions of an RC is to work with other RCs to respond to threats to reliability, and each of the new providers is unique: an ISO, an Eastern Interconnection-based RTO and a Canadian provincial utility. Learning each other’s set of terms and functions has been important, they said.

“SPP is in a unique position” as an RC provider in both interconnections, said Bruce Rew, vice president of operations for the RTO. “Understanding the distinctive operation of each neighboring RC allows us to establish a framework for coordinating congestion between two or more RCs.”

The panel included officials from MISO and PJM to talk about their experiences developing the RTOs’ joint operating agreement. PJM Vice President of Operations Mike Bryson talked about the challenges of creating seams agreements with different entities — MISO, the Tennessee Valley Authority, NYISO and Southern Co. — that don’t necessarily share the same functions as his RTO. He expressed how “I love the fact that I’m the RC, the BA [balancing authority] and the TOP [transmission operator]. But I get that’s kind of unusual.”

From left to right: Dede Subakti, CAISO; Bruce Rew, SPP; Melissa Seymour, MISO; Mike Bryson, PJM; Asher Steed, BC Hydro; and Jordan White, WIRAB. | © *ERO Insider*

Commissioner Cheryl LaFleur noted that all Eastern Interconnection market operators also performed all three functions — but Rew and Melissa Seymour of MISO noted that their respective RTOs were not TOPs.

LaFleur seemed stunned. “This is how complicated this is,” she said. “This should be FERC 101.”

Commissioner Richard Glick asked if it wasn’t just simpler to have one RC. “It seems to me you’re just increasing the risk, even if you have all these seams agreements and do everything properly,” he said.

“My perspective to everything is that there is a pro and a con to it,” Rew replied. The pro of having a single RC is you don’t have to worry about seams or communication between multiple entities, he said. But “with multiple RCs, you have multiple eyes looking at” problems. “It gives you the opportunity to ask your neighbor, ‘What are you doing about this?’” He recalled as an example the Jan. 17, 2018, cold snap in the South, which led MISO to call a maximum generation alert. (See “SPP, MISO Discuss Jan. 17 ‘Big Chill,’” SPP Briefs: Week of July 9, 2018.)

“That was a wide-area issue, and it affected four RCs,” Rew said. “So we had four RCs working on that. … Just think if that was one RC, that would have been very challenging to have the resources and the ability to manage the widespread problem area.”

Common Tools

The new RCs stressed that they are using many of the same tools as Peak, which has helped in the transition.

In shadowing Peak, RC West has been able to check the accuracy of the tools, Subakti said. “We find that having two RCs in there brings us to a situation where iron sharpens iron,” he said. “We start asking ourselves, ‘Why did we do it this way?’ … It’s actually uncovered a lot of improvements.”

But Utah Public Service Commissioner Jordan White, speaking on behalf of the Western Interconnection Regional Advisory Body (WIRAB), said his organization was concerned about the potential loss of one tool he said has received little attention from the new RCs”: Peak’s performance metrics. Peak uses the metrics not only to keep itself honest, but to measure the level of information provided by the BAs and TOPs.

RC West is developing its own metrics, but WIRAB wants the commission and NERC to encourage the new providers to work together to establish consistent ones. “Consistent metrics across the RCs will not only provide the necessary data to improve reliability; they will demonstrate if reliability has diminished during this transition,” White said.

“Are Peak’s reliability metrics the absolute fundamental right way to go? Not necessarily,” he said. “We do think they’re a good starting place … but what we’re really looking for is a discussion among the RCs about what those best practices are.”

June 29, 2019

Reliability Conference: Deterrence or Collaboration?

By Rich Heidorn Jr.

WASHINGTON — Panelists at FERC’s annual reliability technical conference Thursday praised the Electric Reliability Organization’s maturation but acknowledged continuing challenges with the speed of standards development and the consistency of compliance determinations.

SPP CEO Nick Brown said that while NERC has made progress since its “adolescently clumsy” stage, it still is too slow to respond to emerging threats and that its focus on enforcement is interfering with collaboration that he said would be more productive.

“The standards development process is continually outpaced by technology and the changing threat vectors. … We simply need to speed the process of modifying the standards,” he said.

Brown also complained of disagreements among NERC and the regional entities over what constitutes compliance on individual standards. “While I appreciate NERC and the regions’ efforts to harmonize their views of the standards and their interpretation of the standards, I will say after 12 years, this area remains elusive to say the least.”

He said the priority on enforcement is “slowing the maturation of the standards development process and the consistency in interpreting the standards.

“I would highly encourage NERC and the regions to take full advantage of the outreach and assurance assessment component of the [Compliance Monitoring and Enforcement Program]. That collaborative approach is far more beneficial than focusing on the enforcement aspect when it comes to compliance. Internal controls, in my view, are the best and most appropriate way to move us toward a more reliable bulk electric system.”

Brown said the ERO has been focused on enforcement “because of a few bad actors.” He said penalties should be reserved for companies whose boards and senior management are not focused on compliance.

“I believe the vast majority of this industry wants to do the right thing. And when they can understand the intent behind the standards and collaboratively agree on what compliance means, then we’re going to be better off.”

But Jennifer Sterling, Exelon’s vice president of NERC compliance and security, said the organization and its REs have made progress in their consistency and in moving away from a punishment-first point of view.

“We’ve been able to work with our regions to develop more of a collaborative approach to compliance with the [critical infrastructure protection] standards. Recent enhancements such as self-logging really show a lot of promise. The compliance exception process, which allows for us to basically self-identify issues [and] mitigate them quickly without a penalty threat, are very helpful and allow us to … be very open and honest with our issues.”

Commissioner Cheryl LaFleur asked panelists how FERC should handle Freedom of Information Act requests for the identities of CIP violators. The commission has been dealing with the requests on a case-by-case basis.

“We have to be careful that we’re not overprotecting information that might have more reputational harm than security harm,” LaFleur said. “There’s a legitimate interest in transparency.”

“It’s not a secret that the industry had its struggles in the early days of the CIP standards and that most utilities probably do have a settlement agreement on file with FERC,” said Sterling, speaking on behalf of the Edison Electric Institute, which she said favors FERC’s continued use of case-by-case determinations. “That said, we do have to … have a balance between transparency and protecting critical information that could be used by intelligent adversaries to sort of back-engineer their way into exploiting vulnerabilities. Some of the settlement agreements that were filed early on contain a lot of information about exactly how the issues were mitigated.”

Tim Gallagher, CEO of ReliabilityFirst, said that registered entities need time to go through a “recovery period” after mitigating violations.

Releasing the names too soon would expose an entity as “sort of like there’s a weakened animal in the herd, and that’s where all the lions are going to go,” he said. “A lot of the issues we run into are not technological but cultural, organizational. And those sometimes take longer to correct.”

Commissioner Richard Glick said he was concerned about a lack of deterrence. “To the extent that companies are penalized but we don’t name the names, they’re not sufficiently incented to not disregard the rules … the next time,” he said.

Glick asked NERC CEO Jim Robb if there was a way to release the names of companies without tying the disclosure to specific violations.

“I’m sure there’s a path through this,” Robb responded. He emphasized the difference between CIP violations and operations and planning (O&P) violations. “O&P violations are the result of random events that occur out on the system that may or not been well-protected against. … In the CIP area, we’re dealing with determined adversaries.

“We can’t fine a company enough relative to the risk that they have from a cyber event. And I think management and executives understand that,” he added. The root causes of most CIP violations, he said, are “embedded in management structure, approach [and] philosophy.”

FERC Commissioners Cheryl LaFleur and Richard Glick | © *ERO Insider*

Efficiency

Robb said the ERO has “harmonized” more than 70 processes in the CMEP.

Jack Cashin, director of policy analysis and reliability standards for the American Public Power Association, said the ERO should continue its focus on operational efficiency and effectiveness.

“This is not to suggest that NERC should simply concentrate on cost savings or cutting back processes and procedures. Greater efficiency should not come at the expense of reduced effectiveness,” he said, saying APPA supports the increased spending to support the expansion of the Electricity Information Sharing and Analysis Center. “Opportunities for robust stakeholder input and debate might be regarded in some sense as inefficient. But the end results of such subject matter experts’ stakeholders-informed processes are likely to be more effective than decisions made without adequate stakeholder input.”

Fuel Supply

Robb and NERC Chief Reliability Officer Mark Lauby called for changes in how planners evaluate the importance of fuel supplies to resource adequacy, with a decreased reliance on capacity reserve margins.

“You can have infinite capacity without fuel,” Lauby said. Future plans, he said, should focus on ensuring operators have sufficient energy, demand response and storage to “change the paradigm so we’re not thinking about the one event in 10 years from a forced outage calculation based on capacity, and start looking more and more at the energy.”

Robb called for changes to the natural gas industry. “One of the other paradigms that we need to get beyond is [that] the gas industry tends to always think of itself on a volumetric basis: Do I have enough [British thermal units] to serve the needs of my customers? … I think what we learned coming out of California — with the duck curve, with the expansion of solar, the very rapid ramp rates that we’re seeing — the gas industry needs to start thinking about itself much the way the power industry does in terms of peak versus average. Because you can have all the BTUs you want, but if there’s not enough pressure in the system to meet the ramp rate and demands that power plants have, it’s not particularly helpful.”

SPP’s Brown said the fuel supply chain should be considered part of the BES for contingency analyses. “I’ll also say that we believe capacity obligations need to move under NERC’s purview rather than continue to be under the purview of individual regions,” he said.

Peter C. Balash, a senior economist for the Department of Energy’s National Energy Technology Laboratory, said the electric system “has been in great turmoil for the last decade” because of regulatory pressure, plentiful gas supplies and state-level policy interventions.

He said about 80% of weather events “could probably be ameliorated with three days of natural gas” stored on site, which he said would increase gas generators’ capital costs by about 15%.

June 27, 2019

ERCOT Working to Set Cyber Incident Processes

By Tom Kleckner

ERCOT is seeking more time to hash out the details around a Nodal Protocol revision request that would establish notification responsibilities for the grid operator and its market participants during cybersecurity incidents.

During a workshop Tuesday, ERCOT staff said they will ask stakeholders to table NPRR928 in order to allow more time for comments on the proposal, which outlines a process for market participants to notify the grid operator about cybersecurity incidents. ERCOT is seeking to increase its awareness about the vulnerabilities of third-party systems that interact with its own systems, with an eye toward preventing interruptions to the grid.

ERCOT operations center — ERCOT’s operations center | © *RTO Insider*

A second workshop on the rule change will be scheduled in August or September, staff said.

ERCOT defines a cybersecurity incident as a malicious or suspicious act that “compromises or disrupts” a computer network or system belonging to ERCOT, a market participant or its agent that transacts with the grid operator that “could foreseeably jeopardize the reliability or integrity of the ERCOT system or … market operations.”

“Does an incident compromise or disrupt? Does it jeopardize the reliability or integrity of ERCOT systems or market operations?” Senior Corporate Counsel Brandon Gleason said. “We’re interested in things that are going to have an impact on something. ERCOT’s perspective is we want to know actual events that are occurring and have the potential to impact others.”

“We’re interested in anyone who has access into our system,” General Counsel Chad Seeley said. “We’ve tried to capture every access point into the system.”

Staff said that while ERCOT shares information with various government oversight groups “depending on the nature of the event,” it has no legal requirement to report cyber incidents as they are occurring.

Under NPRR928, the grid operator would send market notices, if necessary, to alert the market to an incident and actions being taken, while also disclosing the identity of any law enforcement agency notified about the event.

The protocol change will help cover those market participants that are not NERC registered entities. ERCOT has 939 market participants, less than 25% of which (191) are registered with NERC and subject to its reliability standards, including CIP-008.

ERCOT system access under NPRR928 | *ERCOT*

Non-registered entities “don’t have reliability nexuses, but they do have market nexuses,” Gleason said.

FERC on June 20 approved a new NERC cybersecurity rule that expands reporting requirements beyond just those incidents that actually compromise or disrupt reliability tasks on the bulk electric system.

CIP-008-6 now requires NERC entities to report any incidents that compromise, or attempt to compromise, electronic security perimeters, electronic access control or monitoring systems, or physical security perimeters associated with high- and medium-impact BES cyber systems and attempts to disrupt operation of a BES cyber system. (See FERC OKs Cyber Reporting Rule.)

In Texas, the state’s Public Utility Commission, Department of Public Safety, Department of Information Resources and Cybersecurity Council all have cybersecurity oversight over ERCOT. At the federal level, oversight agencies include the departments of Homeland Security, Justice and Energy, the FBI, and FERC, in addition to NERC and others.

The Texas Legislature recently passed three cybersecurity-related bills, none of which affected NPRR928:

Senate Bill 64, effective Sept. 1, directs the PUC to establish a program to monitor utilities’ cybersecurity efforts that provide guidance on best practices and facilitate the sharing of information between utilities. It also requires ERCOT to conduct an internal cybersecurity risk assessment and submit an annual compliance report to the PUC.
SB 475, effective immediately, establishes the Texas Electric Grid Security Council to facilitate the creation, aggregation, coordination and dissemination of best security practices. It is composed of the PUC chair, ERCOT CEO and Texas governor (or designated representative).
SB 936, effective Sept. 1, requires the PUC to engage a cybersecurity monitor to manage outreach, research, develop and facilitate best practices and training, review voluntary self-assessments, and report back to the commission on preparedness.

June 27, 2019

PG&E’s Bondholders Push $30 Billion Investment Plan

By Hudson Sangree

A lawyer who filed a $30 billion plan by bondholders to bump PG&E Corp. out of bankruptcy urged the utility and the U.S. Bankruptcy Court on Wednesday to move the process along.

“We believe this case more than anything else needs a greater sense of urgency, a greater sense of transparency … and a greater sense of cooperation,” attorney Michael Stamer told Judge Dennis Montali in San Francisco.

Stamer and other lawyers with the firm Akin Gump Strauss Hauer & Feld filed a motion Tuesday to end PG&E’s exclusivity period — the time the company has to file its Chapter 11 reorganization plan without competing proposals. They represent the ad hoc committee of senior unsecured noteholders in PG&E’s massive bankruptcy case.

PG&E — Phillip Burton Federal Building, San Francisco | *U.S. Bankruptcy Court, Northern District of California*

Stamer told the judge that the unsecured creditors hold $10 billion in PG&E notes. The bonds would take a backseat to secured debts in the bankruptcy proceeding, and the noteholders stand to lose if PG&E can’t meet its obligations.

PG&E has until September to come up with its own reorganization plan. In May, Montali extended the 120-day statutory period under which PG&E and its utility subsidiary Pacific Gas and Electric had to file their proposal. (See PG&E Gets More Time to File Bankruptcy Plan.)

The companies sought bankruptcy protection Jan. 29, citing at least $30 billion in liabilities for a series of devastating wildfires sparked by their equipment. The blazes included November’s Camp Fire, the deadliest in state history.

Wednesday’s hearing was meant to establish a procedure for PG&E to notify fire victims about its bankruptcy and to set a “bar date,” a deadline for victims to file claims with the court. After four hours of argument, Montali approved PG&E’s plan for running notices online, in TV ads and in publications such as People.

He set Oct. 21 as the bar date, following PG&E’s recommendation.

Stamer appeared before the judge ostensibly to endorse PG&E’s proposed deadline but quickly segued into talking about the motion to end exclusivity he’d filed the day before.

A term sheet attached to the motion lays out a plan for creditors to invest up to $30 billion in PG&E in exchange for common stock and $16 billion to compensate fire victims.

The lawyer said PG&E’s bankruptcy has a “political element that’s hard to wrap your head around.” The investment plan is structured to appeal to elected officials and residents, he said, because it wouldn’t raise rates and avoids a government bailout.

“We have made the investment attractive to politicians and the people who elected them” by letting investors bail out PG&E and not “putting it on the backs of ratepayers,” Stamer said.

Newsom Plan

On Friday, California Gov. Gavin Newsom proposed a $21 billion fund to cover future wildfire costs, with ratepayers and utilities each paying half. Newsom wants to extend a $2.50 service charge that utility customers have been paying since the early 2000s but that’s set to expire next year.

The governor’s plan also calls for the state’s three large investor-owned utilities — PG&E, Southern California Edison and San Diego Gas & Electric — to spend $3 billion on safety measures and for PG&E to exit bankruptcy by June 2020 to access the wildfire recovery fund.

PG&E and other IOUs would still be on the hook for the catastrophic fires of 2017 and 2018. California imposes a strict liability standard, known as inverse condemnation, on utilities whose equipment starts fires.

Newsom called on lawmakers to introduce a bill of his plan as soon as this week and to pass it by July 12, the day before the legislature’s summer recess starts. Whether lawmakers will pass a measure that may be unpopular with voters, especially with anger toward PG&E and other IOUs running high, remains uncertain.

As Stamer continued talking, Montali reminded him that Wednesday’s hearing was not about the motion to end exclusivity. That motion is scheduled to be heard July 23.

The judge also reminded PG&E’s lead bankruptcy attorney, Stephen Karotkin, of the same point when Karotkin began to oppose Stamer’s motion.

“In their plan, he complains about nothing being resolved,” Karotkin said. “The only settlement in their so-called plan is the settlement we reached with the public entities.” PG&E recently announced it had agreed to pay cities, counties and public agencies $1 billion to settle claims arising from wildfires in 2015, 2017 and 2018.

“We’re not arguing the exclusivity motion,” the judge said, cutting him off.

June 27, 2019

MISO Monitor Poses 6 New Market Recommendations

By Amanda Durish Cook

Despite solid performance in 2018, MISO should adopt a new set of proposed changes to its markets to ensure they run more efficiently, the RTO’s Independent Market Monitor has recommended.

In his 2018 State of the Market report, Monitor David Patton produced six new market recommendations on top of previous suggestions not yet adopted by MISO. They range from clarifying what constitutes an emergency declaration to reserving more transfer capability on the RTO’s Midwest-South transmission constraint.

MISO’s market was overall competitive in 2018, even when considering three emergency declarations, Patton told the Board of Directors’ Markets Committee in a conference call Wednesday.

He said supplier offers were “highly competitive” last year and market power mitigation rare, though MISO experienced a “sharp increase in the frequency of generation emergencies partly due to changes in reserve margins and resource mix.” The RTO handled about $29.9 billion in gross market charges in 2018.

MISO lost about 2 GW worth of unforced capacity in 2018, mostly from coal resources, a loss that was only partially offset by wind resources, Patton said.

“We are seeing a continuation of the trend of renewables replacing coal units. That’s a trend we expect to continue,” he said.

Patton said coal and nuclear generators still operated at the highest capacity factors last year, with coal still producing the greatest share of energy and setting systemwide prices in 46% of hours, down from 55% in 2017.

Improvements for Emergencies

Ever increasing emergency declarations have given the Monitor ample fodder to review MISO’s emergency decision-making. In his report, Patton criticized the RTO for being inconsistent in how it issues warnings, declarations and calls for load-modifying resources (LMRs), saying he wants it to clarify the criteria for calling emergencies and “improve the logging” for taking emergency actions.

He said the inconsistency may have something to do with the fact that MISO is now experiencing region-specific — rather than systemwide — emergency conditions.

“These regional emergencies have only been occurring in the last few years. The risks are relatively unknown versus systemwide emergencies. The procedures around them are not as clear,” Patton said.

The Monitor also recommended MISO implement fixed default floors to reduce the unpredictability of its emergency pricing. Emergency default floors are currently set by a supplier’s offer, which can result in them being either too high or too low under different circumstances, he said.

Reserves on the Midwest-South Transfer Limit

To avoid exceeding the Midwest-to South regional transfer limit during emergencies, Patton recommended that MISO procure operating reserves on the line to “better allow it to respond to regional system contingencies.”

He said MISO could come to an agreement that would pay the joint parties to the transfer settlement the clearing price for subregional reserves as well as for the deployment of the reserves, which would use capacity over the line’s 3,000-MW contractual limit. Use of the reserved transmission would cost $500/MW multiplied by the quantity of reserves deployed, Patton suggested.

“We’re going to come to an end with the joint parties on the regional directional transfer,” Patton reminded the board. Starting Jan. 31, 2021, MISO and SPP’s settlement may be terminated by any party with a year’s notice. Without a replacement settlement in place, flows would be limited to MISO’s original 1,000-MW contract path in either direction.

Unreported Outages

Patton also wants to prevent emergencies through a clearer picture of actual supply. He said MISO should take inventory of unforced and unreported outages and derates during tight supply periods, then reduce capacity accreditations accordingly.

“There are a lot of outages and derates that are not reported, so they’re completely ignored,” Patton said.

He recommended that MISO measure all derates and outages — planned or unplanned — under its tightest supply conditions and calculate how much generators are actually delivering to the system during the tightest hours.

Patton said the change stands to affect peaking resources the most, which aren’t called on very often, so forced outages don’t affect their accreditation too much.

“We’re giving them way too much credit,” Patton said.

Assessing Capacity Needs

Patton also recommend three adjustments to help MISO improve the calculation of its capacity supply and demand, including: 1) working a realistic amount of unforced outages and derates during peak load conditions into planning assumptions; 2) accounting for planning resources’ behind-the-meter process load; and 3) devising a method for validating capacity suppliers’ submitted data.

“We have identified a number of areas where erroneous data has been submitted by suppliers, resulting in sizable capacity accreditation inaccuracies,” he said.

Patton also noted that, unlike station service loads, planning resources’ process — or industrial — loads “continue when the power generation equipment is out of service.” He said because process load must be served alongside MISO’s other firm load, it should be recognized in the RTO’s capacity requirements.

Easing Tx Constraints

Finally, Patton recommended the RTO use a lower generator shift factor (GSF) cutoff for transmission constraints with limited relief. The RTO currently employs a 1.5% GSF cutoff to identify which generators to optimize in its dispatch when managing the flows on a constraint, but the Monitor said that policy eliminates most or all of the economic relief available for some constraints.

“The reality is that there are many, many generators. The problem is our software may not solve when 150 generators can relieve a constraint,” Patton said.

Patton said MISO should introduce new software capabilities that allow for a 0.5% GSF cutoff.

“It’s a relatively simple idea,” Patton said, adding that it was a good time for the recommendation because the software capability could be worked into MISO’s new market platform.

29 Outstanding Recommendations

The six new recommendations bring the running total of Monitor recommendations to 29. Patton said MISO addressed four of his recommendations in 2018 and early 2019.

The RTO last year implemented three recommendations from 2012, creating dynamic narrowly constrained areas for market power mitigation, tightening thresholds for uninstructed deviation and implementing five-minute settlements — a “very important accomplishment,” according to Patton.

MISO also addressed a 2016 recommendation last year by getting FERC’s permission to apply existing reserve procurement enhancement — first rolled out in 2011 in MISO Midwest — to the sub-regional constraint between Midwest and South. The enhancement models the effects of transmission constraints by accounting for the deliverability of reserves deployed from market-cleared resources and adding a marginal delivery cost to the zonal reserve market clearing price.

The RTO said it will review the Monitor’s 2018 report and post a public response in October. Its Tariff provides it 120 days to respond to the State of the Market report. By December, it will have decided whether to incorporate any of the Monitor’s suggestions into its ongoing Integrated Roadmap list of market improvements.

June 27, 2019

MISO Keeps Cards Close on Market Platform Details

By Amanda Durish Cook

While MISO continues to acknowledge that General Electric is behind schedule on delivering a key piece of the RTO’s new market platform, it is tight-lipped in disclosing other project particulars — including who will ultimately take on the bulk of the work.

Initial deliveries from GE are “lagging,” MISO reported to the Board of Directors’ Technology Committee on Tuesday. But executives are offering few public details on other vendors they might be considering, though they still target a 2024 implementation.

The RTO recently told the board that delivery of a new day-ahead market clearing engine is running behind schedule, with GE now expected to deliver at the end of the year instead of in August as originally planned. (See “Vendor Delay on Market Platform Replacement,” MISO Board of Director Briefs: June 20, 2019.)

On Tuesday, Executive Director of Digital Transformation Kevin Caringer said MISO would only discuss GE’s performance in the Technology Committee’s closed session because the RTO is negotiating contracts with multiple vendors and is committed to securing “the best value” for stakeholders.

He did note the RTO continues to hold monthly executive meetings with GE.

“Our goal is always to adapt and move quickly, either with our own performance or vendor performance,” Caringer said.

MISO is exploring using different vendors for the platform’s model manager and private cloud development, Caringer said. In spring, the RTO said it would divide the platform replacement into a series of smaller agreements with vendors rather than one large contract with an outside party as originally planned. The move will undo its earlier plan to reveal a single chosen vendor at the beginning of 2020 after finishing an evaluation of alternatives to GE. (See MISO Seeking Multiple Vendors for Market Platform Redesign.)

The RTO is expected to launch the market clearing engine in 2022 and have the full new market platform operational in 2024. It now expects to spend about $139.7 million on the project, up from the $133.7 million estimate last year. However, it has also made provision for a 20% — or $26.7 million — contingency fund, which it could later decide to include in the project budget.

Meanwhile, MISO reported that a communication system went down on April 20, forcing it to use a backup system for about 28 minutes. Chief Information Security Officer Keri Glitch said the malfunction was associated with a power strip failure.

June 27, 2019

NERC Adjusting to Brighter Spotlight

By Rich Heidorn Jr.

WASHINGTON — NERC CEO Jim Robb blinked in seeming disbelief when he walked into a press conference at his organization’s offices here Wednesday and was confronted by 10 reporters — more than twice as many as had shown up when he had his first press briefing almost nine months ago. “I didn’t think I was that interesting,” he joked.

Robb, who took the top job at NERC in April 2018, is not someone who hungers for attention. But the spotlight on NERC has grown nonetheless as it has been drawn into the fuel-wars debate over whether the grid can remain resilient as the resource mix changes. NERC also has drawn attention because of the growing cyber threats and China’s role in technology supply chains.

Just two weeks ago, security firm Dragos reported that XENOTIME, the group behind the 2017 TRISIS malware attack on a Saudi Arabian oil and gas facility, “began probing the networks of electric utility organizations in the U.S. and elsewhere” in late 2018.

A day after the Dragos warning, The New York Times reported that the U.S. has increased its cyber incursions into Russia’s electric power grid, a move that it noted “carries significant risk of escalating the daily digital Cold War between Washington and Moscow.” Last week, the Times and others also reported that the U.S. Cyber Command had conducted attacks against computer systems that control Iranian missile launches.

Asked whether he was concerned that moves against Russia could make the U.S. grid more of a target, Robb demurred.

“As the CEO of NERC, no [comment],” he said. “These are issues of national defense and military strategy and not electric reliability. So, I have my own opinions that I will talk about over a cocktail sometime, but I think I’ll pass on [commenting in] this forum.”

“That is a very good question,” said NERC Chief Security Officer Bill Lawrence, director of the Electricity Information Sharing and Analysis Center, when he was asked later during a tour of the E-ISAC.

He did not answer either.

“All I can say is we’ve got some really smart people; they’ve got some really smart people,” he said. “And cyber is recognized as another domain by the Department of Defense.”

Outside the ‘Four Walls’

Robb said that although the electric industry’s mandatory standards give it “a very good security posture … when you get beyond the four walls of the electric industry, things get very murky very quickly.” That is illustrated, he said, by the supply chain.

In May, NERC’s Board of Trustees accepted staff’s “Cyber Security Supply Chain Risks” report, which recommended revising the supply chain standards to address electronic access control or monitoring systems (EACMS) and physical access control systems (PACS) connected to high- and medium-impact bulk electric system cyber systems. NERC is planning to send a data request in early July on whether low-impact systems with external routable connectivity should also be covered. (See “Supply Chain Report Recommends Expanding Standards,” NERC Standards News Briefs: May 8-9, 2019.)

Robb said NERC is now developing a Level 2 alert to ask industry about their use of Chinese vendors, a follow-up to the “all-points bulletin” the E-ISAC issued in March regarding Chinese equipment suppliers, including Huawei and ZTE.

Anecdotally, Robb said, NERC has heard examples of Huawei technology in utility push-to-talk communication systems and some security cameras. Huawei also has been found in a small share of rooftop solar inverters in California. “We don’t expect we’re going to find many in the bulk power system,” he said.

Impact of Politics

NERC also is being looked to for reassurance that the grid can remain reliable as natural gas and renewables increasingly replace baseload coal and nuclear generation. The issue will become more acute as some policymakers pursue goals of 100% renewable power.

Robb said the impact of public policy debates on the industry “makes our world that much more complicated.”

“There’s a lot of understandably strong views that may not always be extraordinarily founded by the science,” he said, citing as an example those who confuse geomagnetic disturbances with electromagnetic pulses.

“Resource decisions are heavily driven by public policy, as they should be,” he added. “Public policy tends to be promulgated by people with a relatively short time horizon. And one of the challenges you have in the electric industry is we build assets that last 30, 50, 100 years.”

Robb said reaching a 100% renewable power system will take a new form of battery technology to replace lithium-ion “and probably some other investments that need to be made for things like voltage support and frequency response.”

But Robb is confident the West can survive its “tectonic shift.”

“The West was built around Rocky Mountain coal and Northwest hydro going into Los Angeles. It’s now being reversed. It’s solar out of L.A. going elsewhere. As long as there’s enough time to understand the issues and make sure that the transmission system is reinforced [so] you have the adequate voltage … to make the system operate stably, there’s nothing wrong with that.”

It will take deployable batteries “at extraordinary scale — I think people sometimes miss the scale of the electric industry,” he said.

“Twenty-four hundred megawatts of storage, which I think is what Southern California Edison is pushing for, [is just a start],” Robb said. “It’s a 12-GW peak load. And if you’re going to go for an entirely renewable system, at some point you’ve got to deal with the fact that you’ve got the Marine Layer [which can inhibit solar power] for several days; it may not always be windy. You’ve got to have the whole suite of technologies to get you through those [days], and that requires batteries.

“It’s easy to set great goals, and I think great goals are very important because they’ll galvanize a lot of important technology development. But some of the time frames that some of the [presidential] candidates have talked about, I personally don’t think they’re realistic. But will they spur a lot of great innovation along the way? Absolutely.”

June 26, 2019

Public Power Seeks ‘Actionable’ Cyber Intel

By Rich Heidorn Jr.

WASHINGTON — Utilities aren’t getting the “actionable” intelligence they need to defend themselves against cyber threats, the head of the Large Public Power Council said Tuesday.

“The classification system relative to classified information came out of a national security perspective — appropriately so — but there’s certain pieces of information that we don’t need attribution on,” John Di Stasio, president of the LPPC, said in a press briefing. “We just need to know: What’s the threat, and what’s the nexus to my operations? I think sometimes the way the system is now, it’s very hard to parse out pieces of classified information. So … you don’t necessarily get something that’s actionable.

“We certainly get heightened security alerts: ‘Pay attention. Keep your eyes open.’ That’s something that we do anyway. But those alerts, in and of themselves, don’t tell you what actions you might need to take in your system.”

“We need actionable intelligence,” echoed Pat Pope, CEO of the Nebraska Public Power District. “We don’t really care who it was done to or who did it. We just need to know so we can protect our own systems.”

The two spoke at a press briefing in D.C., where they and other LPPC members had come to lobby Congress on tax policy for municipal bonds.

‘Core’ Challenge

NERC CEO Jim Robb said he agrees with the criticism.

“It’s one of the core challenges the [Electricity Information Sharing and Analysis Center] has,” Robb said in a press conference Wednesday. “We can’t release classified information, so we have to work with our government partners to get it to a declassified state to where it can be shared. … The issue has been talked about [and] discussed, but we haven’t been able to break the back of that one.”

Robb, who noted the E-ISAC is 18 months into a five-year plan to expand its staffing and capability, said it is attempting to be “innovative” by issuing “all-points bulletins” on emerging issues.

The CEO said the bulletins have a lower threshold than other alerts. “We don’t have to … kind of assemble the United Nations, if you will, of 7,000 security officers to have a conversation around something. It’s a good way to get a heads-up out to industry about emerging issues as they unfold. One of the things we’re trying to do is to make sure we’re getting information out to industry in a way that’s timely, helpful, but not necessarily wait for every ‘i’ to be dotted and ‘t’ to be crossed, because by that time, you’re probably too late to be helpful.”

Response to Ransomware

The public power executives were asked Tuesday how their companies would respond to ransomware attacks like those that have recently hit Baltim o re and Atl a nta.

Jackie Sargent, general manager of Austin Energy, said her utility would not pay ransom.

“We actually invested in cyber insurance this year,” she said. “You don’t want to get into … paying ransom because then it just encourages them to continue to do that. So, you have to make sure that [you are] making backups of your system [and that] you have isolation of those backups so that you can reinstate those systems.”

She added, “One of the advantages of being a municipal utility and being part of a city is that we have access to not only our [cyber] resources … but also the city’s resources to help us.”

Di Stasio said the LPPC attempted to help its members plan their responses to cyberattacks with a crisis communication workshop.

It “is really helpful for people to think through: ‘What should I have in place?’” Di Stasio said. “So, the first time I think about it isn’t when [an attack occurs and] somebody says: ‘OK, what are you going to do?’”