MIT Recommends Single Agency to Manage Cyber Security Threats for Electricity Grid

The Massachusetts Institute of Technology released a report on Monday that discusses the future challenges facing the U.S. electricity grid and several recommendations for how to best manage them. The researchers found that one of the most notable challenges facing the electricity grid is the threat of cyber attack.

MIT writes in the report:

Perfect protection from cyberattacks is not possible. There will be a successful attack at some point.

This is a huge threat to the grid because a cyber attack in one area has the ability to affect other areas very rapidly, which could greatly disrupt power supply all over the country. Cyber attacks are also considered by the Pentagon to be an “act of war,” said the MIT researchers at a National Press Club event this week.

To best manage this issue, MIT recommends that:

The federal government should designate a single agency to have responsibility for working with industry and to have the appropriate regulatory authority to enhance cybersecurity preparedness, response and recovery across the electric power sector, including both bulk power and distribution systems.

But which agency should be tasked with this authority? CNET’s Don Reisinger writes:

The Obama administration has argued in the past that the Department of Homeland Security should be charged with securing the electrical grid, while many members of Congress have called on the Department of Energy or Federal Energy Regulatory Commission [FERC] to take over. So far, a decision hasn't been made, and MIT researchers didn't provide insight into which organization might be best.

Although the MIT researchers believe that a single agency should be tasked with overseeing these efforts, the nuclear industry believes that the U.S. Nuclear Regulatory Commission has extensive regulations already in place for protecting nuclear energy facilities from cyber attack and that regulatory oversight by other agencies would be “unnecessary and duplicate strict NRC oversight.” In response to the White House’s proposal for DHS to manage a cyber security program, NEI writes:

However, this proposal—along with recent efforts to legislate cyber security for critical infrastructure—is not needed for nuclear plants because NRC regulations and oversight of industry actions to respond to cyber threats. Additional regulation would be duplicative and risk creating inconsistencies in requirements.

Some of you may remember NEI’s cyber security expert Bill Gross who posted in October on the House Republican Cybersecurity Task Force’s recommendations. He had this to say about the MIT’s recommendation:

The U.S. Nuclear Regulatory Commission has mandatory cyber security requirements in place for all power plants. While there may be value in a central coordinating authority, the regulators of jurisdiction have the subject matter expertise to manage the cyber security issue. Any centralized role should be focused on minimizing the potential for dual or duplicate regulatory requirements across sectors.

The industry does agree with MIT, however, that cyber attacks are one of the greatest threats facing the electric power industry today. Exelon Nuclear’s President and Chief Nuclear Officer Mike Pacilio commented on current cyber security programs in place in the nuclear industry in a recent video interview at the 10-year anniversary of September 11.

All of our plants today, not only Exelon, but in the industry, have a very comprehensive cyber improvement program where we are essentially making our plants an island. Any of the controls that interface with the Internet, for example, that could possibly control the reactor are not connected.

See NEI’s website for more information on cyber security programs in the nuclear energy industry.

Among MIT’s other recommendations outlined in the report are:

• To facilitate the integration of remote renewables, the Federal Energy Regulatory Commission should be granted enhanced authority to site major transmission facilities that cross state lines.
• To improve the grid’s efficiency and lower rates, utilities with advanced metering technology should begin a transition to pricing regimes in which customers pay rates that reflect the time-varying costs of supplying power.
• To improve utilities’ and their customers’ incentives related to distribution generation and energy conservation, utilities should recover fixed network costs through customer charges that do not vary with the volume of electricity consumption.
• To make effective use of new technologies, the electric power industry should fund increased research and development in several key areas, including computational tools for bulk power system operation, methods for wire-area transmission planning, procedures for response to and recovery from cyber attacks, and models of consumer response to real-time pricing.
• To improve decision making in an increasingly complex and dynamic environment, more detailed data should be compiled and shared, including information on the bulk power system, comprehensive results from “smart grid” demonstration projects, and standardized metrics of utility cost and performance.

For more information on MIT’s research, see the full report, “The Future of the Electric Grid.”

Image credits: From the Department of Homeland Security’s Web page on Cybersecurity.

Where Goes Solar, There Goes Nuclear?

This MIT Technology Review article is good but gets off on the wrong foot:

Politicians are drawing parallels between the $535 million federal loan guarantee issued to bankrupt solar manufacturer Solyndra and loan guarantees that the U.S. Department of Energy is offering to utilities building new nuclear power plants. But while those nuclear startups could also go bust, experts say U.S. taxpayers are unlikely to take a loss on them. That's because the only reactor projects moving forward are those in a handful of southern states, where laws allow utilities to offload the risk onto state ratepayers.

Offload the risk? All the risk of any large electricity project redounds to the ratepayers – because they pay the bills. What those southern companies are doing is using a method that pays for plant construction as it goes along – which means less money borrowed from banks or paid back to banks – and thus less interest charges for ratepayers to eventually absorb.

Here’s how Southern Co. explains this in relation to the Plant Vogtle project:

• The cost of the plant will be phased-in over 7 years, versus included in rates over only two years. (Approx. 1.3 percent/yr over 7 years for total of 9 percent, versus approximately 12 percent total over two years.)
• Customers will avoid paying $300 million in interest charges, thereby saving money over the life of the plant.
• The in-service cost of the plant will be reduced by nearly $2 billion (30 percent).
• Total rate increases required to cover the cost of the plant when it goes into service will be nearly 3 percent lower.
• Preserving utility credit ratings reduces costs for other projects and helps keep customer rates low.

The MIT story is interesting in that it explains how this use of pay-as-you-go differs in regulated and non-regulated states and what the implications of that might be for nuclear energy projects.

It still comes back around to loan guarantees:

While the Solyndra case appears unlikely to be replicated with nuclear loan guarantees, political attacks from Congressional Republicans on the wisdom of loan guarantees for energy projects may, ironically, hurt the prospects for further nuclear projects that many support.

We’ll just have to wait and see, but those Congressional Republicans are as aware of nuclear energy loan guarantees as we are. It doesn’t necessarily follow that where goes solar also goes nuclear.

----

If you’re going to open a new nuclear facility, it makes sense to stress safety.

Hsu said Taipower had incorporated improvements to the project, such as an emergency diesel generator facility, after the Fukushima Daiichi Nuclear Power Plant crisis in Japan, triggered by a massive earthquake and tsunami that crippled the facility on March 11.

This is in Taiwan. Hsu is Taipower vice president Hsu Hwai-chiung. There’s more on safety:

In line with Ma’s instructions, Hsu said, Taipower would adopt the strictest possible safety standards in handling the Fourth Nuclear Power Plant’s testing and supervisory work.

“We will invite international professional organizations, such as the World Association of Nuclear Operators, to assist with oversight and the plant will go online only once optimal safety is guaranteed,” Hsu said.

In addition to Taipower’s internal controls, the Ministry of Economic Affairs and the Atomic Energy Council (AEC) have also closely monitored the construction of the plant to ensure safety standards are met, Minster of Economic Affairs Shih Yen-shiang said.

And Ma is Taiwan President Ma Ying-jeou. The World Association of Nuclear Operators, or WANO, is really stepping up to the plate here. These are the recommendations approved by WANO’s board during its general meeting in October:

These included expanding the scope of WANO's activities; developing a world-wide integrated event response strategy; improving WANO's credibility, including important changes to WANO's peer review process; improving visibility; and improving the quality of all WANO products and services.

This sounded as though WANO was interested in adopting the approach taken by the Institute of Nuclear Power Operations, the nuclear energy industry-created watchdog, into the international sphere. And indeed, that’s at least partly the case:

WANO said that it will also put into place an internal emergency response procedure that clearly defines roles and responsibilities in the event of a nuclear emergency. It will also take additional initiatives of working with other key industry organizations such as the International Atomic Energy Agency, the World Nuclear Association and the Institute of Nuclear Power Operations.

Issues of national sovereignty can easily keep WANO from becoming as effective as it could be, but if the organization’s members allow it latitude, as Taiwan is doing, and WANO is able to gather enough authority around itself, then its potential expands accordingly. It’ll be interested to see how the experience in Taiwan goes.

Sort of an interesting merger of the WANO logo – which is a wireframe world map – and a map showing its main offices.