12. THE RESILIENCE OF US ENERGY INFRASTRUCTURE

meantime, 10 LNG vessels were waiting in the Gulf of Mexico to be loaded. As this experience has shown, extreme weather events can cause significant damage to energy infrastructure and disruption to supplies, highlighting the critical importance of resilient and flexible supply chains that are able to adapt and respond to domestic disruptions.

Midstream

The DOE collaborates regularly with the other government entities and the private sector regarding natural gas infrastructure, safety and reliability. Additionally, it works with the National Association of Regulatory Utility Commissioners to provide technical assistance to states interested in natural gas infrastructure modernisation.

After the Aliso Canyon leak in Los Angeles from October 2015 to February 2016, the Pipeline and Hazardous Materials Safety Administration (PHMSA) released an interim final rule on underground gas storage in December 2016. This interim final rule revised the federal pipeline safety regulations to address critical safety issues related to wells, wellbore tubing and casing at underground gas storage facilities.

In April 2019, PHMSA issued an advisory bulletin to remind all operators of gas and hazardous liquid pipelines of the potential for damage to pipeline facilities caused by severe flooding and pointed to actions that operators should consider taking to ensure the resilience and integrity of pipelines (PHMSA, 2019).

Although significant progress has been made, there are limited mechanisms at the federal level to assess reliability and adequacy of privately owned infrastructure for oil and gas. Permitting and siting as well as export authorisation do not consider the privately owned supply chain across the country or the integrated markets in North America. A supply chain assessment could help inform assessments of security and adequacy of gas supply infrastructure, the role of the Strategic Petroleum Reserve to maintain oil supply in the event of a disruption, and the impact of natural disasters on the oil products supply chain. As the US export infrastructure is becoming a vital backbone of the US and global economy and more exposed to global market trends, maintaining a high level of regional and international security collaboration to foster preparedness and response on the part of the US government will be essential.

Cybersecurity resilience

Increased frequency and sophistication of cyberthreats require a strategic approach based on constructive R&D and advanced technologies. CESER’s Cybersecurity Risk Information Sharing Program provides continuous monitoring tools and capabilities for information systems and control networks to identify best practices for cybersecurity (DHS, 2018). CESER’s cybersecurity programme supports activities in three key areas:

strengthening energy sector cybersecurity preparedness

co-ordinating cyber-incident response and recovery

accelerating research, development and demonstration (RD&D) of game-changing and resilient energy delivery systems.

The first two strategic efforts are building the energy sector’s day-to-day operational capabilities to share cyber-incident information, improve the organisational and

261

ENERGY SECURITY

IEA. All rights reserved.

12. THE RESILIENCE OF US ENERGY INFRASTRUCTURE

process-level cybersecurity posture, and perform cyber-incident response and recovery. The remaining effort is innovating cyber-resilient energy infrastructure through the RD&D of new tools and technologies to reduce the risk that energy delivery is disrupted by a cyber-incident (DOE, 2018d).

With more than 80% of the nation’s power infrastructure privately held, co-ordinating and aligning efforts between the government and the private sector is vital. To achieve its vision, CESER works closely with representatives of the energy sector, companies that manufacture energy technologies, the national laboratories, universities, other government agencies and other stakeholders.

Recent examples of research being conducted with a combination of these partners are:

Efforts in utilising cloud computing, which could be used to optimise operations of the power grid.

Utilising lessons learned from cyberattack research that will be applied to the development of attack-resilient and self-healing attributes of the respective applications.

The Artificial Diversity and Defense Security project, which will develop solutions to introduce unpredictability and enhance situational awareness to energy delivery control systems.

The National Institute of Standards and Technology Cybersecurity Framework provides standards, guidelines and best practices for private-sector organisations to help manage their cybersecurity-related risks. The framework is available on a voluntary basis to owners and operators of critical infrastructure.

The Cybersecurity Capability Maturity Model (C2M2) programme is a public-private partnership effort that was established as a result of US efforts to improve electricity subsector cybersecurity capabilities, and to understand the cybersecurity posture of the grid. The C2M2 helps organisations of all types evaluate, prioritise and improve their own cybersecurity capabilities. The model focuses on the implementation and management of cybersecurity practices in information technology and related systems. In addition to the C2M2, there are two sector-specific models: the Electricity Subsector Cybersecurity Capability Maturity Model and the Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model.

Assessment

The United States continues to strengthen its preparedness and response mechanisms to new threats, such as natural disasters, extreme weather and climate change, cyberattacks, and accidents, in a move to reduce risks and bolster resilience as a matter of national security. Emergency response exercises are a crucial part of ensuring that industry and government are well prepared to work as a team during emergencies, whether naturally occurring or human-caused.

While response mechanisms are strong in the United States, preparedness is becoming even more important. The 2017 US National Security Strategy stresses the need to improve risk assessment, build a culture of preparedness, and improve planning and information sharing. The regular assessment of vulnerabilities is vital in this context and would need to encompass the entire energy sector, notably oil, gas and electricity. Using

262

IEA. All rights reserved.

12. THE RESILIENCE OF US ENERGY INFRASTRUCTURE

the outcomes of these assessments and learning from incidents such as natural disasters are vital to improve the resilience of the US energy infrastructure.

Since the last International Energy Agency (IEA) review, the government has adopted a suite of policies and mechanisms that have reinforced preparedness. The energy sector is one of 16 sectors classified for critical infrastructure security and resilience. Interagency co-ordination was strengthened under the 2015 FAST Act and by the NIMS under FEMA and the DHS.

The creation of CESER in the DOE in February 2018 marked strong progress. CESER acts as the energy SSA and is responsible for leading sector co-ordination and enabling sector-specific technical assessments and assistance. ISER within CESER is the lead on ESF-12 under the NRF, and is the designated energy SSA under PPD21 for national efforts. ISER works in co-operation with public and private-sector stakeholders to enhance the preparedness, resilience and recovery of the US energy sector (oil, natural gas and electricity) from all threats and hazards, including cyber-risks.

The DOE is well placed to lead efforts to regularly assess risks, in collaboration with other government authorities, states and industry, and to give guidance to improve the quality and ability of infrastructure to withstand natural disasters. Still, there are a number of agencies involved in the collection and dissemination of threat incidence information and response actions, which might potentially lead to overlap and inefficiencies within those agencies involved. With the creation of CESER, there is an excellent opportunity to strengthen effective collaboration to foster preparedness and response to cybersecurity threats.

NERC, under the supervision of FERC and in close collaboration with industry and market participants and the DOE, monitors emerging risks to the bulk power market by conducting regular short-term and long-term reliability assessments. Over the past years, the DOE and NERC have evaluated the impacts of possible gas supply disruptions on electricity security, amid the fast growth of natural gas-fired power generation, although without a focus on improving the resilience of the gas infrastructure itself. In 2018, FERC opened a generic proceeding on bulk power resilience. The DOE’s Grid Modernization Initiative also assesses resilience across the strongly integrated North American energy system more broadly.

For gas and oil, there are limited mechanisms at the federal level to assess reliability and adequacy of privately owned infrastructure, as permitting and siting as well as export authorisation do not consider the privately owned supply chain across the United States or the integrated markets in North America. As US export infrastructure is becoming a vital backbone of the country and global economy and is more exposed to global market trends, the US government should maintain a high level of regional and international security collaboration to foster its preparedness and response.

The number of outages caused by extreme weather events provides an indication of the vulnerability of the energy infrastructure, notably for electricity grids. Widespread industry adoption of resiliency measures for energy infrastructure have been limited to date by lack of full definition of design standards and understanding of their associated cost and benefit. Hence, partial renovation and modernisation of the existing facilities and better advance planning are essential to improve the resilience of the energy infrastructure. The US government should continue to work with government and industry stakeholders to strengthen the resilience of the energy infrastructure against weather damage, especially as the impacts of climate change become more pronounced in future years. Lessons

263

ENERGY SECURITY

IEA. All rights reserved.

12. THE RESILIENCE OF US ENERGY INFRASTRUCTURE

learned from hurricanes, intense storms and wildfires are ample and have helped to render infrastructure more secure and safe.

Recent amendments to Section 406 of the Stafford Act authorise FEMA to provide contributions to state, local and certain private non-profit organisations for the repair or replacement of a public facility damaged by a major disaster.

The DOE provides technical support to FEMA in the identification of relevant energy infrastructure hazard-based codes and standards. Cybersecurity is a top priority for the government; CESER also acts to address the threats from cyberattacks and protect the reliability and security of the energy sector. Cyberthreats against utilities and the electric grid are growing in frequency. In order to protect the electric grid from significant disruption, it is critical to share threat information with stakeholders in a timely fashion.

CESER’s emergency response programme co-ordinates with FEMA on all hazards incidents that affect the energy sector (oil, gas and electricity). During an incident it keeps leadership informed; provides real-time monitoring and energy outage and supply information; co-ordinates and communicates with state, local, tribal, territorial, industry and interagency stakeholders; and deploys staff under the NRF. A key goal is to facilitate the re-establishment of damaged energy systems and components during a declared Stafford Act emergency.

Recommendations

The US government should:

Run regular risk assessments based on a holistic approach, looking at a variety of risks (cyber, reliability, extreme weather impacts), across fuels (oil, natural gas, electricity) and energy infrastructure (grids, power plants, gas/oil pipelines) to improve preparedness and devise actions to mitigate the risks identified, in collaboration with other relevant government authorities and industry.

Allocate sufficient resources to ensure effectiveness of CESER and its collaborative structures.

Strengthen mechanisms to ensure timely sharing of relevant information on all hazards including cyberthreats to participants in the bulk power system.

Maintain high levels of regional and international security collaboration with partners on oil, gas and electricity resilience.

Support the development of innovative resilient energy technologies and frameworks for energy infrastructure to effectively mitigate current and future risks.

References

ACE (US Army Corps of Engineer) (2018), Principles of Resilience, www.usace.army.mil/missions/sustainability/building-resilience/.

DOE (Department of Energy) (2018a), Office of Cybersecurity, Energy Security and Emergency Response: 2018 Emergency Response Summary, www.energy.gov/ceser/articles/2018-emergency-response-summary.

DOE (2018b), CESER mission, www.energy.gov/ceser/ceser-mission.

264

IEA. All rights reserved.

12. THE RESILIENCE OF US ENERGY INFRASTRUCTURE

DOE (2018c), Infrastructure Security and Energy Restoration, www.energy.gov/ceser/activities/energy-security.

DOE (2018d), Cybersecurity Strategy 2018-2020, www.energy.gov/sites/prod/files/2018/07/f53/EXEC-2018- 003700%20DOE%20Cybersecurity%20Strategy%202018-2020-Final-FINAL-c2.pdf.

DOE (2016), State Energy Resilience Framework, www.energy.gov/sites/prod/files/2017/01/f34/State%20Energy%20Resilience%20Framewor k.pdf.

DHS (Department of Homeland Security) (2018), Information Sharing and Awareness, www.dhs.gov/cisa/information-sharing-and-awareness-0.

DHS (2014), Quadrennial Homeland Security Review, www.dhs.gov/publication/2014- quadrennial-homeland-security-review-qhsr#.

EIA (Energy Information Administration) (2018), Annual Electric Power Industry Report, www.eia.gov/electricity/data/eia861/.

EIA (2013), Short-Term Energy Outlook Supplement: 2013 Outlook for Gulf of Mexico Hurricane-Related Production Outages, www.eia.gov/outlooks/steo/special/pdf/2013_sp_04.pdf.

EPA (Environmental Protection Agency) (2019a), Climate Impacts on Energy, https://19january2017snapshot.epa.gov/climate-impacts/climate-impacts-energy_.html.

EPA (2019b), Strategies for Climate Change Adaptation, www.epa.gov/arc-x/strategies- climate-change-adaptation.

EPA (2019c), Planning for Climate Change Adaptation, www.epa.gov/arc-x/planning- climate-change-adaptation.

FEMA (Federal Emergency Management Agency) (2018), 2017 Hurricane Season FEMA After-Action Report, www.fema.gov/media-library-data/1531743865541- d16794d43d3082544435e1471da07880/2017FEMAHurricaneAAR.pdf.

FEMA (2017), National Incident Management System (NIMS), www.fema.gov/national- incident-management-system.

GlobalChange.gov (2018), Fourth National Climate Assessment Vol II, www.globalchange.gov/nca4.

National Institute of Standards and Technology (2019), Cybersecurity Framework, www.nist.gov/cyberframework.

NCCIC (National Cybersecurity and Communications Integration Center) (2016), ICSCERT Annual Vulnerability Coordination Report, https://ics-cert.us- cert.gov/sites/default/files/Annual_Reports/NCCIC_ICSCERT_FY%202016_Annual_Vulnerability_Coordination_Report.pdf.

NERC (North American Elecric Reliability Corporation) (2017), Special Reliability Assessment: Potential Bulk Power System Impacts Due to Severe Disruptions on the Natural Gas System, www.nerc.com/pa/RAPA/ra/Reliability%20Assessments%20DL/NERC_SPOD_11142017_ Final.pdf.

PHMSA (Pipeline and Hazardous Materials Safety Administration) (2019), Underground Natural Gas Storage, www.phmsa.dot.gov/pipeline/underground-natural-gas- storage/underground-natural-gas-storage.

265

ENERGY SECURITY

IEA. All rights reserved.

266

IEA. All rights reserved.