1. Cybersecurity and Other Important Updates
Delia Patterson
SVP, Advocacy & Communications and General Counsel
American Public Power Association
MEPAV Annual Conference
May 22-24, 2019
Virginia Beach, VA

2. American Public Power Association’s Cybersecurity Services

3. Cyber & Physical Preparedness
Help members develop “all-hazards” approach to disaster preparation and response
Show federal policymakers public power’s commitment to security and mutual aid
Strengthen government/industry partnerships
Minimize new federal regulation

4. DHS Open Source Alerts: HIDDEN COBRA – North Korean Malicious Cyber Activity
August 9, 2018: North Korean Trojan: KEYMARBLE
June 14, 2018: North Korean Trojan: TYPEFRAME
May 29, 2018: HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm
May 29, 2018: HIDDEN COBRA RAT/Worm
March 28, 2018: North Korean Trojan: SHARPKNOT
February 13, 2018: North Korean Trojan: HARDRAIN
February 13, 2018: North Korean Trojan: BADCALL
December 21, 2017: North Korean Trojan: BANKSHOT
November 14, 2017: North Korean Remote Admin Tool: FALLCHILL
November 14, 2017: North Korean Trojan: Volgmer
August 23, 2017: Analysis of Delta Charlie Attack Malware
June 13, 2017: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
May 12, 2017: WannaCry Ransomware (300,000 computers affected)

5. DOE Cooperative Agreement Overview
In 2016 APPA partnered with the Department of Energy
3-year, $7.5M Cooperative Agreement
– Analysis and Data Collection
– Deployment and Resource Development
– Sustainability
Acknowledgment:  These activities are based upon work supported by the Department of Energy under Award Number DE-OE

6. DOE Cooperative Agreement Overview
Goal:
Develop a culture of cyber security within public power utilities
Objective:
Engage with public power distribution utilities to understand their cyber security awareness, capabilities and risks
Move each utility from its existing state to a public power target profile
Tasks:
Cybersecurity risk assessments (Cybersecurity Scorecard)
Onsite cyber vulnerability assessments
Pilot existing and emerging security technologies
Information sharing between utilities and APPA, E-ISAC, MS-ISAC, other partners
Acknowledgment:  These activities are based upon work supported by the Department of Energy under Award Number DE-OE

7. Cybersecurity Risk Assessments: Cybersecurity Scorecard
Used existing cybersecurity models to inform a product that is useable by all public power utilities
Developed a self-assessment tool called the public power Cybersecurity Scorecard
Usable by small to mid-sized public power utilities to start evaluating their cybersecurity program
Also scalable so all public power utilities will find it useful
Acknowledgment:  These activities are based upon work supported by the Department of Energy under Award Number DE-OE

8. Scorecard results will populate your dashboard
Results breakdown by domain
Dashboard
This dashboard will be generated upon completion of the Public Power Scorecard questions
It provides
a quick percentage breakdown of performance by each of the 10 C2M2 domains
a composite score out of 300 to gauge overall posture
the ability to share scorecard results with other users
tailored improvement recommendations based on based on Scorecard responses
Improvement recommendations based on scorecard responses

9. Scorecard Activity 225 public power utilities participating
(2019 Goal is to reach 400 utilities)
445 foundational cybersecurity self assessments at the 225 utilities
(14 Questions – 45 minutes)
All public power utilities have FREE access to the Scorecard portal
Utilities who have taken the assessment have reported that the Scorecard is helping to “take the guesswork out of what they should be striving to achieve”

10. Cybersecurity Scorecard Users
WHEN
# OF UTILITIES
2018 year end
182
2019 Q1 43
TOTAL TO DATE
225
TARGET FOR 2019
400
Pink indicates states without any target medium/large utilities.

11. Cybersecurity Roadmap
Using the Scorecard output, provide public power utilities with clear actions to improve their cybersecurity program
Provide information that creates a compelling business case for security investments

12. Incident Response Playbook
Modeled after mutual aid response network
Exercising the playbook to be prepared
Cyber Mutual Assistance (CMA) – national program
Utilities sharing cyber resources and expertise in a crisis
Acknowledgment:  These activities are based upon work supported by the Department of Energy under Award Number DE-OE

13. Onsite Vulnerability Assessments
Conducting Onsite Vulnerability Assessments
27 utilities have requested onsite vulnerability assessments
8 assessments are currently underway with current contractor
Additional assessments will be scheduled and utilize a newly developed tool suite using open source free resources
Creating a methodology to determine the readiness of utilities to deploy technology to monitor the cyber health of their systems

14. Cybersecurity Technology Assistance Program
After completing the Scorecard, utilities may be ready to reduce risk by investing in cybersecurity technologies from managed security service providers or other vendors
The Association’s new Cybersecurity Technology Assistance Program (CTAP) can support that investment first by connecting public power utilities to cybersecurity technology solution providers
Next, the Association can contribute partial funding through our cooperative agreement with the Department of Energy to qualified utilities
Interested utilities should contact us at:

15. Cybersecurity Training
Signing up JAAs to be host sites for training
Deliver low cost cybersecurity training and exercises that align with the Scorecard
Conduct regional facilitated workshops (JAA/State Association sites)
Hosting a year end public power Cybersecurity Summit (November , 2019 Nashville TN)

16. Secure Information Sharing
We continue to recommend the E-ISAC as the trusted source of public power utility’s ICS threat information
Sign up for the E-ISAC at
Multi-State – Information Sharing Analysis Center (MS-ISAC) is another option for public power. Focused on corporate network cybersecurity, they provide many free services to state and local government IT professionals
Sign up for the MS-ISAC at
Developing a program for Shared Cybersecurity Services
Joint Action Agency model as a framework to possibly provide a shared cyber analyst
Mature organizations mentoring others
Concise threat feed in our Secure Trusted Community (STC) network
Acknowledgment:  These activities are based upon work supported by the Department of Energy under Award Number DE-OE

17. Cyber Asset Tracking Tool
Developing a Cyber Asset Tracking system to provide public power utilities with an online tool for:
Cyber Asset Inventory
Configuration Baseline
Vulnerability and Threat Management
Cyber Event Logging
Supply Chain Tracking

18. Other Cybersecurity Resources
You can find published material on our website at:
Cybersecurity Information Engagement Plan
Cybersecurity Information Sharing Report
Cybersecurity Essentials: A Public Power Primer
Managed Cybersecurity Service Providers Guide
Physical Security Essentials
Cybersecurity Awareness Videos

19. Future Sustainability Model
APPA will continue to provide the platform to conduct cybersecurity self assessments
APPA will encourage members to mature their cybersecurity program over time to fill the gaps identified in the self assessments
Partner with Joint Action Agencies, Regional Agencies and State Associations across the country to provide services and resources to help utilities sustain their cybersecurity program

20. Environmental Protection Agency (EPA)

21. Federal Regulations on Greenhouse Gas Emissions
October 2015: EPA published the Clean Power Plan (CPP)
February 2016: U.S. Supreme Court stayed CPP
D.C. Circuit litigation regarding CPP held in abeyance
October 2017: EPA proposes to repeal CPP
December 2017: EPA issued an Advanced Notice of Proposed Rulemaking regarding replacement of CPP

22. Affordable Clean Energy (ACE) Rule
In August 2018, EPA released the proposed Affordable Clean Energy (ACE) Rule
Proposed that heat rate improvements constitute the best system of emissions reductions
Proposed revisions to new source review applicability
Proposed revisions to implementation regulations for this and future Clean Air Act §112 (d) actions, including extending the regulatory and compliance timelines
EPA plans to finalize the ACE rule in June/July 2019
APPA submitted comments on the proposed ACE Rule

23. APPA Recommendations on ACE
APPA supports the replacement of the CPP with emission guidelines that adhere to the statutory requirements of CAA section 111(d)
APPA supported the implementation of heat rate improvements (HRIs) as the best system of emission reductions (BSER) for existing coal-fired utility boilers
APPA supports the issuance of states guidance describing what comprises a satisfactory state plan
APPA supports allowing states’ standards of performance to take many forms
APPA supports states’ authority to provide flexible compliance options for affected sources to meet their standards of performance
APPA supports adopting an hourly emission increase test for what is a “modification” under the new source review program

24. GHG NSPS for New, Modified, and Reconstructed Sources
October 2015: EPA issues GHG New Source Performance Standards for new, modified and reconstructed EGUs
Litigation regarding the rule has been held in abeyance since 2017 and is expected to continue to be held in abeyance
December 2018: EPA proposed changes to the 2015 GHG NSPS
Proposed BSER for new coal-fired stream EGUs to be the most efficient generation technology instead of a coal boiler implementation partial CCS technology
Proposed revised standards for performance for reconstruction steam EGUs
Proposed separate performance standard for new & reconstructed coal refuse fired EGUs
Did not propose revisions to standards for stationary combustion turbines
APPA filed comment on the proposed GHG NSPS on March 18, 2019

25. APPA Recommendations on the GHG NSPS
APPA supports EPA’s decision to rescind partial carbon capture and as the BSER for EGUs
APPA agrees that sequestration at highly efficient generation technology combined with best operating practices is BSER
APPA supports a performance standard that is achievable under all load conditions

26. States and Cities Leading on Climate Change
Hawaii, California, New Mexico, Washington, D.C. and Puerto Rico legislatures have passed 100% clean energy mandates
Of the 114 U.S. cites with 100% commitments, five public power communities have met their renewables commitment
Aspen, Colorado; Burlington, Vermont; Georgetown, Texas; Greensburg, Kansas; and Rockport, Missouri
Main Street, Rockport, Missouri

27. Coal Combustion Residuals – State Actions
On March 20, 2019, Virginia Governor Northam signed a bill requiring the removal of coal ash from Dominion’s Chesapeake Energy Center
On April 1, 2019, North Carolina State Department of Environmental Quality ordered Duke Energy to excavate 31 coal ash basins and place their contents in lined landfills
Utility plans to appeal the decision
Tennessee ruling in Aug requiring TVA to excavate CCRs and move to a lined impoundment
TVA appeal pending in Sixth Circuit
APPA joined other associations and trade groups in amicus brief in support of TVA position
Other states and municipalities have moved to remove their coal ash from impoundments. Even though federal CCR rule allows for both closure in place or closure by removal of CCR from CCR unit.

28. Coal Combustion Residuals - Regulatory
EPA finalized changes to its 2015 CCR rule in June, 2018 (a.k.a. Phase I, Part 1)
Phase I, Part 1 challenged and EPA voluntary remanded rule
Phase II Rulemaking
Address the beneficial use of CCR
Federal Permit Program
Phase I, Part 1 Rule revisions included:
Certification of Compliance by State Director
Risked-based GWPS for Co, Pb, Li, Mo
Zero-migration Variance
Extension of Initiation of Closure to October 2020
EPA voluntary remanded Phase 1 Part 1 Rule to Implementation of DC Circuit Decision re that required unlined impoundments, use Liners or close. More pressure on EGUs to remove CCR from impoundments.

29. Combustion Turbine Emissions Standards
On April 12, 2019, EPA proposed to amend its Stationary Combustion Turbine (CT) National Emission Standards for Hazardous Air Pollutants (NESHAP) and Residual Risk and Technology Review (RTR)
EPA proposes to find that risk from CTs hazardous air pollutant emissions are acceptable and the NESHAP provides an ample margin of safety
EPA did not identify any new control technology
EPA proposes to remove startup, shutdown and malfunction provision
EPA proposes to require electronic reporting
Comments are due May 28, 2019
A court ordered deadline requires EPA to finalize the RTR by March 13, 2020
Residual risk assessment under CAA §112(f) assesses risk remaining after adoption of MACT standards
CAA §112(d)(6) requires EPA to review and revise, as necessary, emissions standards every 8 years

30. Federal Energy Regulatory Commission (FERC)

31. FERC: A Year of Changes
Chatterjee (R)
LaFleur (D)
Glick (D)
McNamee (R)
August Commissioner Robert Powelson leaves the Commission
October Commissioner Chatterjee designated Chairman due to illness of Kevin McIntyre, who remains a Commissioner
December 2018 – Bernard McNamee replaces Powelson
January 2019 – Commissioner Kevin McIntyre passes away
January 2019 – Commissioner Cheryl LaFleur announces she is not seeking another term after her current term expires June 30, 2019
Photos courtesy of FERC

32. Transmission Cost Concerns
Rising transmission costs continue to be a concern in PJM and other regions
Problematic growth of Supplemental Projects in PJM
In 2018, $5.7 billion of $7.8 billion in proposed transmission projects were Supplemental
Limited stakeholder review
Crucial that FERC implement and enforce transmission planning and cost recovery policies that ensure reasonable rates

33. FERC Notices of Inquiry
Two FERC Notices of Inquiry (NOIs) issued in March 2019
NOIs request comment on:
FERC policies for determining the allowed return on equity (ROE) to be included in cost-based rates (Docket PL19-4)
FERC’s policies on transmission incentives (Docket PL19-3)
Any policy changes resulting from NOIs could impact transmission costs
Initial comments due June 26; reply comments due July 26 (extension requested)
APPA intends to comment extensively on NOIs

34. Incentive Notice of Inquiry
Includes 105 separately-numbered questions on virtually every aspect of FERC incentive policies
Could result in increased use of costly ROE “adders” a/k/a “FERC candy”
On the other hand, FERC might limit some incentives (e.g., the ROE adder for RTO participation)
Could have implications for transmission planning, public power joint ownership, adoption of new technologies, etc.
APPA organizing joint comments

35. ROE Notice of Inquiry
Dozens of questions regarding FERC policies for calculating the allowed transmission ROE (profit)
FERC recently proposed changes to its ROE method in an ISO New England case
ROE NOI asks for broader industry comment on the new proposed method and other issues
New method could result in higher ROEs, but good arguments exist against most problematic aspects
APPA coordinating with other organizations on comments and experts

36. Storage and DER
FERC issued Order No. 841 on participation of electric storage resources in RTO/ISO markets in Feb. 2018; rehearing order issued May 2019
FERC continues to defer action on non-storage distributed energy resources (DER)
Key issue for APPA is state and local authority to address rate, operational, and safety issues presented by DER (including storage DER)
APPA argued FERC should allow retail regulators (including public power) to opt out of allowing DER participation in the wholesale market
Order 841 rehearing

37. PJM Capacity Construct: Overview
PJM’s capacity construct, the Reliability Pricing Model (RPM) has been of concern to public power since its inception, due to:
high and volatile prices
frequent rule changes
impediments to self-supply through the minimum offer price rule (MOPR)
A self-supply MOPR exemption was removed by FERC at the end of 2017, following a DC Circuit decision
Increasing state actions to procure or retain specific resources have accelerated the generator requests to expand the MOPR from new natural-gas generation to include all technologies and existing resources

38. PJM Capacity Construct: Recent Developments
Last June, FERC found that the RPM rules are not just and reasonable because they do not adequately address the suppressive effect on capacity market clearing prices from of “out-of-market” support from state subsidies
FERC initiated a hearing and proposed a “replacement rate”: Expansion of the MOPR to all resources and a new “carve-out” provision to allow the removal of a “subsidized” resource from the capacity auctions, along with a commensurate amount of load
The Association and PJM members requested rehearing of the order, and filed briefs requesting a complete self-supply MOPR exemption and supported a workable carve-out for state-sponsored resources

39. PJM Capacity Construct: Current Status
With no order from FERC, PJM announced its intent to conduct the August capacity auction under current rules
Meanwhile, the market monitor filed a 206 complaint arguing for a reduction in the capacity offer cap, due to market power concerns. The Association and PJM public power support the complaint
Association position:
Capacity markets should be residual, voluntary markets with bilateral contracts and ownership as the primary means for resource procurement
At a minimum, capacity offer mitigation should not apply to public power self- supply
States may have legitimate policy reasons for procurement or retention of specific resources, and should also not be subject to mitigation

40. Price Formation Controversy
PJM, on March 29, filed Section 206 proposal for revisions to its operating reserve market price formation rules which will increase both operating reserve and energy prices
These changes were filed without stakeholder approval and with strong opposition from load-side interests, including public power, raising significant concerns about PJM governance
Stakeholders and the market monitor argue that PJM has not demonstrated a reliability or other justification for the proposal
PJM’s initial estimate was that these changes would increase costs by $2 billion per year
The Association joined a May 15 load-side coalition group protest of the price formation proposal

41. GreenHat and Financial Entities
The Association has long been concerned about financial entity participation in the RTO-run markets, especially in the Financial Transmission Rights (FTR) market
FTRs and Auction Revenue Rights should function as a hedge for load, and not as a mechanism for transferring payments from load to financial entities
Such concerns are exemplified by the default of the GreenHat company (managed by former staff of JPMorgan Ventures Energy, which was found by FERC to have violated the anti-market manipulation rule)
GreenHat amassed the largest portfolio of FTRs in PJM history before defaulting and costing other PJM members hundreds of millions of dollars
An independent investigation found that PJM management failed to identify growing evidence of the pending default and missed opportunities to stop or restrain GreenHat and limit the costs incurred

42. Pole Attachments

43. Pole Attachments
Section 224 of the Communications Act exempts public power from FCC pole attachment regulations and allows states to “reverse preempt”
Since 2017, the wireless industry has been:
pushing deployment of “small cells” (often pole top) for “5G” broadband
saying that small cells and 5G will solve the “digital divide” in rural areas
saying public power is “barrier” to broadband deployment
conflating right-of-way and “siting” fees with pole attachment rates
working in states and at Congress and FCC on siting “reform”
circulating or has “small cell” bills in more than 20 states

44. Pole Attachments FCC Actions
Mobilitie Petition: In 2016, FCC issued a public notice asking for comment on proposal to exercise jurisdiction over state and local governments, including public power
APPA filed reply comments
Broadband Deployment Advisory Committee (BDAC): In 2017, FCC enlisted this group, mostly communications industry representatives, to provide recommendations on streamlining local and state siting regulations. The BDAC is nearing completion of those rules
APPA filed a letter with FCC objecting to substance and process

45. Pole Attachments FCC Actions (continued)
Wireline and Wireless Proposals: In 2017, FCC proposed rules to “reduce barriers to broadband deployment” by preempting state and local rules and regulations using section 253 (re: rights-of-way and barriers to entry) and section 332 (re: wireless service)
APPA filed comments and reply comments
Declaratory Ruling and Third Report and Order: On Sept. 26, the FCC adopted an order preempting state and local laws (including pole attachment rules, regulations, and agreements) that do not comport with FCC’s “one-size-fits-all” rules, using sections 253 and 332 and ignoring the exemption in section 224

46. Pole Attachments Legal Actions
APPA Appeal of Declaratory Ruling and Third Report and Order: In November 2018, APPA filed a petition for review challenging the Report and Order as an improper assertion of authority that may pose significant risks to the safety, security, and reliability of electric utility operations
Transferred to the US Court of Appeals for the Ninth Circuit
APPA’s opening brief due on June 10
Amici briefs due on June 17
Oral arguments likely in fall of 2019

47. Pole Attachments Congressional Action
S The STREAMLINE Small Cell Act
Introduced in 2018 by Senate Commerce Committee Chairman John Thune (R-SD) and Senator Brian Schatz (D-HI)
Would gut public power’s exemption from federal pole attachment regulations by expanding section 332 of Communications Act
Failed in 115th Congress
H.R. 530 – The Accelerating Wireless Broadband Development by Empowering Local Communities Act of 2019
Introduced in January 2019 by Rep. Anna Eshoo (D-CA)
Would overturn FCC “wireline” and “wireless” orders
Sen. Feinstein (D-CA) intends to introduce a Senate version

48. Delia Patterson dpatterson@publicpower.org 202.467.2993