Since 2020, Manny Cancel has led the Electricity Information Sharing and Analysis Center through diverse challenges including the COVID-19 pandemic, the Russo-Ukraine war and intrusions into U.S. critical infrastructure by multiple state-backed actors, such as Volt Typhoon. He sat down with ERO Insider’s Holden Mann to discuss the state of the security environment and the challenges faced by incoming E-ISAC CEO Michael Ball. The following exchange has been edited for clarity.
ERO Insider: As you manage the leadership transition at the E-ISAC, what are some of the biggest cyber and physical security challenges facing electric utilities today, and how are you and your partners positioning for those challenges?
Manny Cancel: The environment continues to remain incredibly complex and really requires us to be constantly vigilant and responding. The threats continue to evolve, and the adversaries continue to take advantage of tried and true plus new techniques, and gaps in cybersecurity and physical security programs that our members have.
Complicating the matter is the supply chain. We are all reliant on each other, all the critical infrastructure sectors. We rely on many of the same products — the software that runs our businesses and the hardware and software that is used to protect our environments. You know, all these do a great job, and there have been some tremendous advances in technology. When I think of what we had in place when I first got started in this industry, it’s amazing to see what’s been accomplished.
At the same time, I think we all agree that these products could be more secure. They weren’t necessarily designed, and still probably are not designed, with the appropriate levels of security that help to eliminate or mitigate nation-state attacks, or attacks from very serious adversaries.
But in general, I feel really good about where the industry is. We didn’t just wake up to this issue. I’m really proud of this sector for its ability not only to monitor, but to evolve and transform and take the necessary actions and collaborate. Unlike other sectors, we do a great deal of collaboration and working with each other to share information and threat intelligence. The E-ISAC and NERC are a big part of that, but the industry really supports that too. And the leadership of the industry, all the way up to the CEOs, sets the tone there, and I think that goes a long way to putting us in a good position. It doesn’t necessarily mean that we defeated our adversaries, but we put up an incredible defense. And we take this role very seriously.
Q: The electric grid was a target for cybercriminals before you joined the E-ISAC, but today we are seeing a growing threat from sophisticated nation-state actors like China, Russia and Iran. What can the E-ISAC and its partners do to address these concerns?
A: There has been significant evolution. For one example, the exponential increase in interconnected devices is just mind-blowing. When you think about all the smart assets, whether they are distribution, transmission, consumer assets that plug into and need electricity — all of that sort of stuff has just expanded that attack vector.
So, the adversaries have more things to test to see if they’re vulnerable. The big change is that we’ve always had components of our infrastructure that were vulnerable to security issues. But it used to be much more individual, meaning they would target one or two products. What the bad guys have figured out is the one-to-many problem. They don’t have to attack each one of us. They can just attack a product that we all use — your iPhone, an enterprise software product, an enterprise control product. And if they figure out a way to get into that, and figure out the vulnerabilities, they can really take advantage.
You’re seeing this play out in attacks like the Volt Typhoon actors from China, who are incredibly stealthy, incredibly persistent and patient. They go across the spectrum of products and look for those vulnerabilities and then lay in wait to think about how they can use this. The concern is it’s not just for espionage. It is probably for taking control when they deem appropriate. Both the Director of National Intelligence in the United States and the Canadian Centre for Cyber Security, in their worldwide threat assessments, always conclude that the major nation-state actors possess the capability to disrupt critical infrastructure. So that’s something that we don’t question; we take it very seriously, and it’s part and parcel to our mission.
We’ve got to develop much more tolerant and resistant software. And if we don’t, we’re not only exposed to these vulnerabilities, but we also lose the race on other technology shifts — crypto, AI, the development of data centers, the further adoption of the cloud. There are so many great things that these technologies bring to society, but if they’re fraught with risk, the adoption of them is going to be challenged. So we have to figure out a way to incent these manufacturers to do this. They are rewarded for selling products, providing capabilities. That’s what makes the stock price go up, not so much that they’re secure. We have to reward security and do everything we can to put it in there.
Q: What role do you see specifically for the E-ISAC in pushing those security incentives?
A: It’s through our members, through the trade associations, and in our consultations with organizations like FERC and with legislative leaders in both the local, state, provincial and federal governments in the U.S. and Canada. Making sure they’re aware of these issues and thinking about how we move this forward.
I think one of the things that I’m proud that the E-ISAC has done is, we started our vendor affiliate program about two and a half years ago. It’s a pay-to-play program, not a revenue generation program — we don’t make boatloads of money on it. The biggest benefit that we get out of it is the collaboration with the technology community, who can advise us on security issues, and we can work together. I think forums like that really help, and they exist in other critical infrastructure sectors as well.
When you see what’s going on with the Typhoon threat actors, and their targeting of the telecommunication industry here in the United States, I’m really proud of the industry for sharing information about those attacks. They didn’t have to do that, but they recognize their role in the critical infrastructure pipeline. Stuff like that has to continue to happen.
The governments in both the United States and Canada also have tried some outreach. The Department of Energy has programs with the National Labs to work with vendors on cyber-informed engineering. Secure by design — former Cybersecurity and Infrastructure Security Agency Director Jen Easterly put that together during her tenure at the Department of Homeland Security. Those are really great programs, but they have to continue. We have to build upon them and make them more effective.
Q: On the physical security side, we continue to see reports of violence against substations across the grid. What sort of drivers has the E-ISAC seen for this behavior and what kind of measures might be needed to address it?
A: There are a variety of motivations — political, environmental, criminal. I think current economic conditions are lending more credence to the criminal side. The price of copper has reached all-time highs, so we’re seeing an increase in the theft of copper. Not to the extent that it’s compromising the grid, but as economic conditions deteriorate, you will see theft as a motivation.
On the more grid impacting side, those incidents generally have plateaued at about 3% of the total physical security events. That’s still troubling. There are a couple of opportunities for improvement there. One is, we have to continue to do as much as possible to protect these facilities. That doesn’t necessarily mean fences and cameras, or more standards. It probably means making the grid even more fault-tolerant.
The grid is incredibly tolerant as it is; it has multiple levels of contingencies. But do we need more? Do we need to treat assets differently, even those we might consider low-risk? You can bunch together several low-risk assets — if you look at the plot in Baltimore, to disrupt several substations for what basically was an ideological motivation. (See Neo-Nazi Convicted in Baltimore Grid Attack Conspiracy.) They knew what they were going after, and they were not all big, bulk power stations. Fortunately, that plot was foiled, but that could have been a lot worse.
One more thing I’d say — we hear a lot about the attacks, but what we don’t hear about is apprehension and the results. There’s not been an arrest made in the Moore County attacks; there are no arrests in the Metcalf incident. That’s not to criticize the folks that are trying to do this, it’s just amazing in this day and age that we’re not able to figure that out. I think we need to show people that, look, if you want to be stupid and do those things, here’s the price you’re going to pay. The headline is not just the damage, the headline is also, hey, we got these guys.
Q: How did the challenges of the moment affect the choice of Michael Ball to succeed you? What skills did he bring to the table that NERC and the E-ISAC thought would be useful in the current environment?
A: I couldn’t be more assured and happy to hand the reins over to Michael. He is eminently qualified for this position. I’ve known him for over 10 years, back to when I was at Con Edison. He knows us; he knows NERC, he knows the E-ISAC, he knows the industry.
I think what’s especially compelling about Michael’s CV is his tenure at Berkshire Hathaway. He’s been the CISO there, not only advising the company’s energy portfolio but also the insurance portfolio, the real estate portfolio, the logistics, rail, air and finance portfolios. He’s been exposed to other critical infrastructure sectors, which I think gives him a real unique perspective on the threat landscape.
On top of all that, he’s a good, reasonable guy, a great leader, a consensus builder. Somebody who will continue to, not just execute our mission, but do what we do even better. I’m very confident and I look forward to seeing that.
Q: We’re also in the middle of a presidential transition, with several key agencies, including CISA, still lacking confirmed heads. How does that affect the work of the E-ISAC and your partners?
A: Most presidential transitions do take some time. It’s not unusual for things to still be shaking out. I’m confident we will have colleagues in the U.S. and Canadian governments. I think our missions are very aligned. When you look at what this administration is trying to accomplish from an energy policy perspective, there are a lot of things that we can support and we look forward to doing that.
It’s important to know that while we are in transition, we still are working with the government. We still are working with folks at CISA, at DOE and at FERC. That continues and has not been interrupted. So I’m sure we’ll learn more, particularly as folks are confirmed. I’m hopeful that we’ll continue to make progress. Certainly, energy is important to all of us, and that has been said clearly by this administration.
You can’t depend on the federal government to fix everything, and likewise, you can’t depend on the private sector to fix everything. It is a collaboration. But where is the right delineation of responsibilities? How do we share actionable intelligence, and what do we do about it? I think there’s always an opportunity to think about how we enhance current programs, pivot to other programs, or leverage the private technology sector as they develop their things.
Q: What kind of hopeful signs do you see for the E-ISAC and the rest of the sector, and what developments are you looking forward to seeing play out?
A: We’ve seen a huge increase in the E-ISAC membership. When I joined, there were about 900 members. We are at almost 1,900 members now in five years. And when you look at the number of utilities in the United States and Canada, it’s over a 50% saturation rate. That’s one measure of the E-ISAC’s success I feel good about, but I think we can do more. I feel really good about our collaboration with the other critical infrastructure sectors. The Critical Infrastructure ISACs meet once a month to share intelligence and information about their programs, legislative challenges and other things. I think that collaboration couldn’t be better.
I look forward to seeing what happens with things like secure by design, and how we think about how to deploy things in a more secure and resilient fashion. One of the hallmarks of our industry is mutual assistance; we use it typically for storm restoration. But a lot of people don’t know that we also have cyber mutual assistance, where utilities can request help on a cyber issue. It’s not widely used, thankfully; we haven’t had to. But it’s good to have that in place in case that rainy day comes.
I like where we are, but I’m not declaring victory. We’ve got to keep our foot on the pedal and our hands on the steering wheel.