An article at PR Newswire supports a point I’ve been making for years:
WASHINGTON, Feb. 10, 2019 /PRNewswire/ — Cost recovery for electric sector cybersecurity investments and development of resilience metrics to gauge the industry’s progress are two of several recommendations unveiled today by Vermont Law School researchers who briefed the Critical Infrastructure Committee of the National Association of Regulatory Utility Commissioners (NARUC) on the findings of a six-month study of electric grid security.
The study, conducted for Protect Our Power by the law school’s Institute for Energy and the Environment (IEE), recommends that state utility commissions exercise their authority to increase the flow of confidential information regarding vulnerabilities and best practices. It also identifies the diversity of regulatory approaches to cybersecurity regulation by utility commissions across the country as a concern that warrants attention and improvement.
“Addressing anticipatory threats such as cyberattacks is a challenge that we are not fully meeting,” said Mark James, assistant professor of energy law and a senior research fellow, who led the institute’s research team. “As interconnections between and within distribution systems increase, the vulnerability of the electric grid also increases. Continuous communication between utilities and their regulatory commissions is the first step to improving the depth, quality and consistency of efforts to address cybersecurity vulnerabilities.”
Resiliency of the power grid is a public good (non-rivalrous and non-exclusionary) and it is not one that individual power companies will ever pay for. They would prefer to take the risk of a catastrophic failure and face the outcome in the courts than pay the substantial amounts required to prevent the catastrophic failure in the first place. If you need an example of that look at the recent brouhaha about PGE in California.
When infrastructure bills are discussed grid resiliency rarely makes the list. It’s too invisible to make a good candidate and those it would employ are the wrong people and there are not enough of them.
