Energy Industry Target of Cyber-Attacks and Congressional Efforts to Bolster Security

Cybersecurity of the electric power grid and energy sector as a whole has been the subject of heightened Congressional attention given the integral role the industry plays in our economy. According to a 2015 U.S. Senate committee report, nearly one-third of reported cyber-attacks involve the energy sector. Not surprisingly, the 114th Congress (2015-2016) has introduced several pieces of legislation targeted towards enhancing the security of the nation’s energy infrastructure. Among the bills introduced were S. 1068 – An act to amend the Federal Power Act to protect the bulk-power system from cyber security threats; S. 1241 – The Enhanced Grid Security Act of 2015; and two comprehensive energy bills that include provisions seeking to bolster energy sector cybersecurity and privacy, S. 2012 – The Energy Policy Modernization Act of 2015 and H.R. 8 – The North American Energy Security and Infrastructure Act of 2015. The comprehensive bills have gained traction in Congress, with H.R. 8 – The North American Energy Security and Infrastructure Act having passed out of the full House in December 2015 and S. 2012 – The Energy Policy Modernization Act of 2015 currently under consideration by the full Senate. The House bill was sent to the Senate for consideration and referred to the Senate Energy and Natural Resources Committee in December. The full Senate’s consideration of S.2012, along with several proposed amendments, began in late January 2016 and has been on hold since early February pending resolution of several issues, including how the Senate will deal with proposed amendments to the bill related to funding for the Flint, MI water crisis and offshore drilling revenues.

While cybersecurity is not the sole focus of the two comprehensive energy bills, both emphasize the critical importance of shoring up the nation’s energy infrastructure and technical capabilities to protect against cyber threats. H.R. 8 – The North American Energy Security and Infrastructure Act declares it as the policy of the United States to promote and advance safeguarding the nation’s critical energy delivery infrastructure and enhancing the infrastructure’s resilience to cyber threats, as well as the development of cyber-secure advanced grid technologies to increase cybersecurity awareness and protection. With respect to cybersecurity, the Senate Committee views its proposal as picking up where federal legislation left off in the Energy Policy Act of 2005, which granted the Federal Energy Regulatory Commission (FERC) primary responsibility for securing the power grid and established an Electric Reliability Organization tasked with developing mandatory reliability standards for the industry. The Energy Policy Modernization Act of 2015 is the product of an extensive effort by the Senate Energy and Natural Resources Committee during which ten oversight and legislative hearings were conducted to consider 114 bills last year. The Act is credited as the most comprehensive energy legislative effort in the Senate in nearly a decade and incorporates nearly 50 of the bills considered, including S. 1068 and S. 1241. We highlight key cybersecurity and privacy provisions from these bills below.

As the U.S. emerges as a global leader in energy, it is critical that it also emerges as a leader in cybersecurity in order to safeguard the nation’s energy resources and infrastructure. We will keep you posted regarding the fate of H.R. 8 and S. 2012, as well as further energy cybersecurity-related legislative developments.