FERC Issues a Report Recommending Ways For The Bulk- Power System to Improve Compliance in The CIP Standards and Cybersecurity

FERC Issues a Report Recommending Ways For The Bulk- Power System to Improve Compliance in The CIP Standards and Cybersecurity

The Federal Energy Regulatory Commission (FERC) hasissued areport with recommendations for the “users, owners and operators of the bulk-power system improve their compliance with mandatory Critical Infrastructure Protection (CIP) standards as well as their overall cybersecurity posture.”

The findings shared in the report were based upon the “non-public CIP audits of registered entities that found most of the cybersecurity protection process and procedures adopted by the entities met the mandatory requirements of the standards.” FERC reported that the lessons they learned from conducting “audits completed in fiscal year 2019 can help entities assess their risk and compliance with mandatory reliability standards and… can facilitate efforts to improve the security of the nation’s electric grid.”

The lessons FERC staff learned in the audits were:

1.       “Consider all generation assets, regardless of ownership, when categorizing BES Cyber Systems associated with transmission facilities.

2.       “Ensure that all employees and third-party contractors complete the required training and that the training records are properly maintained.

3.       “Verify employees’ recurring authorizations for using removable media.

4.       “Review all firewalls to ensure there are no obsolete or overly permissive firewall access control rules in use.

5.       “Limit access to employee’s PIN numbers used for accessing PSPs using a least-privilege approach.

6.       “Ensure that all ephemeral port ranges are within the Internet Assigned Numbers Authority (IANA) recommended ranges.

7.       “Clearly mark Transient Cyber Assets and Removable Media.”

FERC staff from the “Office of Electric Reliability and Office of Enforcement conducted the audits in collaboration with staff from the North American Electric Reliability Corporation and its regional entities. In addition to assessing compliance with the CIP reliability standards, the report includes recommendations regarding cybersecurity practices that are voluntary.”

The recommendations in the report include:

  • “Consider all generation assets, regardless of ownership, when categorizing bulk electric system cyber systems associated with transmission facilities;
  • “Ensure that all employees and third-party contractors complete the required training and that the training records are properly maintained;
  • “Verify employees’ recurring authorizations for using removable media; and
  • “Review all firewalls to ensure there are no obsolete or overly permissive firewall access control rules in use.”
Statements of FERC Chairman and Commissioners on Southwest Power Pool Inc

Statements of FERC Chairman and Commissioners on Southwest Power Pool Inc

Southwest Power Pool, Inc. (SPP) submitted revisions to its Membership Agreement, on August 2, “pursuant to section 205 of the Federal Power Act (FPA) and part 35 of the Commission’s regulations.” The revisions were submitted to “add definitions for the terms Load Serving Entity (LSE) and non-LSE.” SPP’s revisionswent into effect by operation of law on October 1. This is because the Federal Energy Regulatory Commission (FERC) did not act on the filing within the established 60-day period, which means that FERC did not reach a quorum about the proposal.

Chairman Neil Chatterjee and Commissioner Bernard L. McNamee issued a joint statement on their stance on the proposal.

Chatterjee and McNamee said that in 2013 SPP proposed revisions to the same Agreement, wanting to “require a member to post a deposit, at the time the member provides its notice of intent to withdraw, to defray any costs SPP would incur to process the member’s withdrawal from membership in SPP. At the time, SPP proposed basing the amount of the deposit on whether the member is an LSE or a non-LSE, with the former submitting a $150,000 deposit and the latter submitting a $50,000 deposit.” The proposal would adjust the deposit based on the actual costs, “with the member either receiving an invoice for any additional costs exceeding the deposit or a refund of any unexpended deposit amounts.” This proposal had been accepted.

SPP’s current proposal “asserts that the proposed definitions are just and reasonable because they address a gap in the current Membership Agreement and will provide greater clarity to all members as to which level of withdrawal deposit will apply in the event that a member submits a notice of intent to withdraw.9 SPP further asserts that the revisions are just and reasonable because they rely on Commission-accepted definitions set forth in the OATT, under which SPP members have long been operating and should be familiar.”

Both Chatterjee and McNamee say they “would have accepted SPP’s proposed revisions to its Membership Agreement… and found the proposed definitions just and reasonable and not unduly discriminatory or preferential. We would have acknowledged that the proposed definitions are consistent with the definitions for LSE in Attachments C and AE in SPP’s OATT and agreed with SPP that defining these terms in the Membership Agreement provides clarity to members as to which level of withdrawal deposit will apply in the event that a member submits a notice of intent to withdraw.”

They say that since there was no quorum in this proposal, they were not able to “fully discuss the issues that arose in this proceeding with our fellow Commissioner, whose arguments we would have thoughtfully considered.”

Commissioner Richard Glick also released a brief statement on the matter.

Glick said that he “signed an ethics pledge that precludes me from working on any matters in which Avangrid, Inc. or any of its affiliates or subsidiaries is a party until November 29, 2019.” He said that while “Avangrid has not intervened in this particular proceeding, the substantive issues presented relate directly to a contested issue in another pending proceeding, Docket No. EL19-11-000, in which Avangrid intervened.” He decided that to be cautious, he would not have participated in the proceeding.

Statements of FERC Chairman and Commissioners on ISO New England Inc. To Comply with the Fair Rates Act of 2018

Statements of FERC Chairman and Commissioners on ISO New England Inc. To Comply with the Fair Rates Act of 2018

In February, “pursuant to section 205 of the Federal Power Act (FPA),ISO New England Inc. (ISO-NE) filed the results from the thirteenth Forward Capacity Auction (FCA 13), to become effective June 28, 2019 (FCA 13 Results Filing).” Then, in response to a request from the Federal Energy Regulatory Commission (FERC) for additional information, “ISO-NE requested waiver of section 388.112(b)(2)(i) of the Commission’s regulations,2 which requires parties seeking privileged treatment for certain filings to provide intervenors who execute a protective agreement with access to that privileged material.” In September the filing went into effect through the operation of law.

If FERC “does not act on a filing made pursuant to section 205 of the FPA within the 60-day period established therein because the Commission lacks a quorum, FPA section 205(g)(1)(B) requires each Commissioner to deliver a written statement to explain their views on the change. Chairman Neil Chatterjee and Commissioner Bernard L. McNamee released a joint statement, and Commissioner Richard Glick also released a statement.

Here is the statement from Chairman Neil Chatterjee and Commissioner Bernard L. McNamee.

Chatterjee and McNamee assert that ISO-NE requested the waiver of FERC’s regulations because they wanted to look at “the information contained in the Deficiency Response because it claims that the information is ‘highly confidential, non-public, proprietary business and competitively-sensitive commercial information’ similar to information that the Commission has previously declined to disclose.” They said that “ISO-NE stated that neither the resource-specific cost data submitted by Killingly nor the IMM’s evaluation thereof should be disclosed to participants and intervenors, even under a non-disclosure agreement.”

“Killingly’s owner and developer, NTE Connecticut, LLC (NTE), objects to the disclosure of the information in the Deficiency Response and supports ISO-NE’s arguments… NTE contends that the disclosure of this commercially sensitive information to Killingly’s direct competitors would irreparably harm Killingly’s ability to compete.”

Capacity Suppliers “oppose the Waiver Request, noting, among other things, that ISO-NE provided no justification for the complete redaction of its Deficiency Response and that, because of the redaction, intervenors are denied the ability to meaningfully participate in this proceeding.”

Chatterjee and McNamee say they would have voted in favor of granting the Waiver Request. FERC “has recognized both that parties have an interest in protecting the confidentiality of their data and that they must be permitted to participate meaningfully in proceedings. To address these competing principles, the Commission weighs the interests of a party seeking confidential treatment for information against the interests of parties seeking access to that information.”

They say that in the past using non-disclosure agreements in order to access the confidential information, and this helped to maintain the balance. “But, the Commission has also recognized that it is inappropriate to disclose confidential material that can create adverse impacts to competition, even under a non-disclosure agreement. Specifically, in the FCA 8 Order and 2017 Waiver Order, the Commission ruled that release of resource-specific privileged information was inappropriate because that information would remain sensitive beyond the FCAs in question and could harm the competitiveness of FCAs going forward.”

NTE objected to FERC’s “issuance of deficiency letters in this proceeding, contending that such letters are meant to address ‘minor, technical shortcomings’ in tariff filings, like a failure to meet “threshold filing requirements,” not to investigate the merits of a protest.” NTE has argued that FERC “could only act to (1) reject the filing on the merits; (2) accept the results despite Capacity Suppliers’ protest; (3) accept the results as filed but note that Capacity Suppliers could file a complaint; or (4) accept the results but set the issues raised in the protest for hearing. Because the Commission did not take any of these actions, NTE argues that the FCA 13 Results Filing went into effect by operation of law on June 28, 2019.”

Chatterjee and McNamee say they “would have rejected NTE’s objections in regard to the issuance of the deficiency letters. The FCA 13 Results Filing was in substantial compliance with the Commission’s filing requirements because ISO-NE submitted information regarding certain FCA 13 inputs and reported detailed FCA 13 outputs resulting from ISO-NE’s application of the FCA Tariff provisions.” There were testimonies submitted by ISO-NE staff “in support of the competitiveness of FCA 13. However, consistent with the discussion in PP&L, Commission staff issued a deficiency letter to cure specific omissions identified in the rate filing… ISO-NE did not provide sufficient cost data to evaluate Killingly’s offer floor price and, therefore, the justness and reasonableness of the FCA 13 Results Filing. Therefore, we would have found that the precedent cited by NTE does not suggest that the Commission improperly issued the deficiency letters in this proceeding.”

They also found that “the FCA 13 Results Filing did not go into effect by operation of law on June 28, 2019. ISO-NE submitted the Deficiency Response on June 28, 2019 and its response to the Second Deficiency Letter on July 26, 2019. Each of these responses established a new filing date for the FCA 13 Results Filing and reset FPA section 205’s 60-day clock.”

They explained that they “would have found that Killingly was appropriately mitigated. Based on an evaluation of the data submitted in the Deficiency Response in this docket, we believe that the IMM complied with its responsibilities as outlined in the Tariff…  we would have found that through its Deficiency Response, ISO-NE demonstrated that its review was not focused solely on whether Killingly received out-of-market revenues but rather that the IMM scrutinized all aspects of Killingly’s offer to ensure they were consistent with prevailing market conditions, including all relevant cost components and revenue assumptions that support Killingly’s offer.”

As for the “the arguments by Vineyard Wind, Massachusetts Attorney General Maura Healey (Massachusetts Attorney General), Clean Energy Advocates and/or Public Citizen Inc. (Public Citizen) related to Vineyard Wind’s participation in the auction, specifically that FCA 13 resulted in unjust and unreasonable rates because the Vineyard Wind facility was not exempted from the Minimum Offer Price Rule (MOPR) as a Renewable Technology Resource.” It is because of this that Chatterjee and McNamee would have rejected these arguments.

“Vineyard Wind met the Tariff requirements to seek Renewable Technology Resource status at the time FCA 13 took place on February 4, 2019, it did not qualify by the October 2, 2018 deadline established in the Tariff. Vineyard Wind did seek a waiver of the Tariff to participate in FCA 13 as a Renewable Technology Resource on December 14, 2018, in Docket No. ER19-570-000. However, that waiver request remains pending… there has been no action on the Vineyard Wind waiver request, and on February 4, 2019, Vineyard Wind had not received a waiver to allow it to be treated as a Renewable Technology Resource. Based on these facts, we would have found that ISO-NE treated Vineyard Wind’s capacity appropriately and in accordance with the Tariff—not as a Renewable Technology Resource—when it conducted FCA 13.”

They conclude explaining that it was because of a “lack of quorum at the time of the statutory deadline for Commission action on the FCA 13 Results Filing, we were unable to fully discuss the issues that arose in this proceeding with our fellow Commissioner, whose arguments we would have thoughtfully considered. To the extent any of those discussions raised new issues for consideration, we would have carefully considered those matters and incorporated them into the decision-making process.”

Commissioner Richard Glick also issued a short statement about the issue.

Glick said that he “signed an ethics pledge that, as relevant here, precludes me from working on any matters in which Avangrid, Inc. or any of its affiliates or subsidiaries is a party until November 29, 2019. Vineyard Wind LLC filed a protest and answer in this proceeding. Vineyard Wind LLC is a joint venture between Copenhagen Infrastructure Partners and Avangrid Renewables, LLC, which is a subsidiary of Avangrid, Inc. Accordingly, I am not participating in this proceeding.”

FERC Proposes to Modernize PURPA Regulations

FERC Proposes to Modernize PURPA Regulations

The Federal Energy Regulatory Commission (FERC) “proposed to modernize its regulations governing small power producers and cogenerators under the Public Utility Regulatory Policies Act of 1978 (PURPA) to better address consumer concerns and market changes in the energy landscape in recent decades.”

PURPA was enacted by Congress in order to “address the national energy crisis by encouraging the development of small power producers and cogenerators, called qualifying facilities (QFs), to reduce the country’s demand for traditional fossil fuels, which were considered to be in short supply.” Its rules were first enacted by FERC in 1980, and they remain in effect today.

The Notice of Proposed Rulemaking is FERC’s “first comprehensive review of its PURPA regulations.” The changes FERC has proposed is “intended to continue encouraging development of QFs while addressing concerns regarding how the current regulations work in today’s competitive wholesale power markets.”

FERC Chairman Neil Chatterjee said, “PURPA laid the foundation for the Commission’s open access transmission policies and the competitive wholesale power markets that we have today. But a lot has changed since 1980. We have seen tremendous technological advancements in renewables, increasing sophistication in competitive electric power markets, and abundant supplies of domestic natural gas. It’s time to modernize the Commission’s implementation of PURPA to reflect those significant developments.”

Chatterjee said that FERC was directed by Congress “to review our policies from time to time to ensure that our regulations continue both to protect consumers and to encourage the development of QFs. That is precisely what we are doing here.”

The proposal “focuses on providing flexibility to state regulatory authorities so they can accommodate recent wholesale power market developments and streamlines the Commission’s policies and practices.” It will allow “states to incorporate market pricing into avoided cost energy rates in various ways, allows states to require energy rates (but not capacity rates) to vary during the life of QF contracts, modifies the ‘one-mile rule,’ and lowers the threshold presumption for nondiscriminatory access to power markets from 20 megawatts to 1 megawatt for small power production, but not cogeneration, facilities. It also requires states to establish objective and reasonable standards for QFs to obtain legally enforceable obligations for the purchase of their power. Finally, the proposal permits protests of a QF’s self-certification or self-recertification without the need to file and pay for a separate petition for declaratory order.”

Comments can be made regarding this notice for up to 60 days after this is published in the Federal Register.

A presentation on the proposal is available here.

Commissioners Richard Glick and Bernard L. McNamee provided statements elaborating on their opinions on the matter.

FERC Releases its Energy Infrastructure Update for July 2019

FERC Releases its Energy Infrastructure Update for July 2019

The Federal Energy Regulatory Commission (FERC) issued its monthly Energy Infrastructure Update for July 2019. This update covers the news and highlights for energy around the country, in gas, hydropower, and electric generation. In July there were five natural gas pipelines were certified and another five were proposed. One natural gas storage facility was certified. For liquified natural gas (LNG) imports and exports, one export was placed in service, and one import/export was certified.For the year to date, five natural gas pipelines have been placed in service, compared to six at this point in 2018; 19 have been certified, compared to 31 in 2018. No storage facilities have been placed in service this year, as was the case last year as well, but three have been certified, compared to four in 2018. Three LNG import and export facilities have been placed in service, compared to one in 2018; five have been certified, whereas none were at this point last year.

For hydropower, two conventional facilities filed for licenses, and there was no further activity in July. For the year to date, three conventional hydropower facilities have filed for licenses, along with one hydrokinetic facility. One license was issued to a pumped storage facility, and another to a hydrokinetic facility. One 10-MW Exception was issued, and a capacity amendment was issued. Nothing has been placed in service this year.

The electric generation highlights detailed the new and expanded units in July, plus the year to date, and a comparison of this period in 2018. Wind power had three new units this month, bringing the total to 25 for the year; compared to 27 last year. There were also three solar power units in July, bringing that total to 207 for the year; compared to 345 last year. There were no new units for coal, natural gas, nuclear power, oil, water, biomass, geothermal steam, or waste heat in July.

There were a number of proposed additions and retirements of generation units in July; this is all planned to occur by July 2022. Coal had two proposed additions, one that is under construction, and 57 retirements. Natural gas had 224 additions, another 100 under construction, and 109 retirements. Nuclear power had nine additions, one under construction, and nine retirements. Oil had 12 additions, two under construction, and 26 retirements. Hydropower had 220 additions, 84 under construction, and 20 retirements. Wind had 550 additions, 172 under construction, and two retirements. Biomass had 59 additions, 28 under construction, and 28 retirements. Geothermal steam had 18 additions, six under construction, and no retirements. Solar power had 2,622 additions, 580 under construction, and one retirement.

For electric transmissions, in the ≤230 voltage range, there were no lines completed in July, but there were 540 miles proposed to be placed in service by August 2021. In the 345-voltage range, 9.5 miles were completed in July, compared to 39 in 2018. This brings to total for 345 this year up to 299.5, compared to 847.2 in 2018. There were also 752.4 miles of proposed additions. The 500-voltage range did not have anything completed in July, but there were 670 miles proposed to be added.

FERC Issues DEIS for the Bucks Creek Hydropower Project

FERC Issues DEIS for the Bucks Creek Hydropower Project

In June, the Federal Energy Regulatory Commission (FERC) released a draft Environmental Impact Statement to relicense the “Pacific Gas and Electric Company and City of Santa Clara, California’s (co-applicants) existing 84.8-megawatt Bucks Creek Hydropower Project No. 619.” The application for the project was filed in December 2016, which is ” located on Bucks, Grizzly,
and Milk Ranch Creeks in Plumas County, California. The project consists of the Bucks Creek and Grizzly Developments and, as proposed, would occupy 1,316 acres of federal lands within the Plumas National Forest.” They also filed a supplemental application in May 2018.

“The project consists of Bucks Creek Powerhouse; Grizzly Powerhouse, and the Grizzly Tap Transmission Line; water storage, diversion, and conveyance facilities associated with the two powerhouses, including Bucks Lake, Lower Bucks Lake, Three Lakes, Grizzly Forebay; and other associated facilities.” They do not plan to “add capacity or make any major modifications to the project or its operations under the new license.” The only modifications they have proposed to make are:

· “Install a Howell-Bunger valve at the end of the existing low-level outlet of Bucks Lake Dam to release the minimum instream flows into Bucks Creek.
· “Enhance existing recreation facilities, including campgrounds, picnic areas, boat launches, day use areas, and trails, and construct a Bucks Lake Shoreline Trail and new facilities at the Bucks Lake Boat-In Campground.”

They also proposed to make changes to the already existing boundary that will: “(1) include existing facilities and roads that are necessary for current and future operation and maintenance (O&M) activities, and recreation development; (2) remove land and roads currently within the
boundary that are not required for project purposes; and (3) reduce the shoreline buffer along project impoundments where project infrastructure and recreation facilities are in proximity to the shoreline.”

FERC found four primary issues with relicensing the Bucks Creek Hydropower Project: “(1) the protection of aquatic habitats including stream flows, water temperature, and recruitment of spawning gravel and woody material; (2) the protection of special-status wildlife species from
human disturbance; (3) the need for additional recreational opportunities and facilities in the project area; and (4) the protection of cultural resources.”

FERC recommended the staff alternative in the draft EIS, “which consists of measures included in the co-applicants’ proposal, as well as most of the mandatory conditions and recommendations made by state and federal agencies and non-governmental organizations, and some additional measures developed by the staff.”

The draft EIS consists of the views of “governmental agencies, non-governmental organizations, affected Indian tribes, the public, the license applicant, and Federal Energy Regulatory Commission (Commission) staff.” It has FERC’s evaluations of the proposal as well as some alternatives.


FERC seeks comments on white paper on CIP Standards Notices Penalties

FERC seeks comments on white paper on CIP Standards Notices Penalties

The Federal Energy Regulatory Commission (FERC) is seeking comments from the public about a white paper FERC and the North American Electric Reliability Corporation (NERC) put together. The “white paper proposes to provide transparency and public access to information on violations of mandatory reliability standards governing cybersecurity of the bulk electric
system while protecting sensitive information that could jeopardize security.”

FERC has “received an unprecedented number of Freedom of Information Act(FOIA) requests for non-public information in the Notices of Penalty (NOPs) for violations of Critical Infrastructure Protection (CIP) reliability standards” since 2018. Since 2010, NERC “has been submitting CIP NOPs to FERC… they typically include information regarding the nature of the violations, potential vulnerabilities to cyber systems as a result of noncompliance, and mitigation activities.” The white paper also “proposes that NERC would submit each notice with a public cover letter that discloses the name of the violator, which reliability standards were violated, and the amount of penalties assessed.” In every notice would be “non-public attachments that detail the nature of the violation, mitigation activity and potential vulnerabilities to cyber systems. These attachments would also contain a request for designation of such information as Critical Energy Infrastructure Information.”

The proposed changes will make it more straightforward to distinguish between public and non-public information, which “should make submission and processing of the notices more efficient while also reducing the risk of inadvertent disclosure of non-public information. While names of violators would be made public, detailed information that could be useful in planning an attack on critical infrastructure, such as details regarding violations, mitigation and vulnerabilities, likely would be considered exempt from FOIA.”

“FERC is seeking comment on many aspects of the white paper, including: the potential security benefits and, if applicable, risks associated with the proposed NOP format; difficulties with implementation or other concerns that should be considered; and the level of transparency provided by this proposed changed.”

The notice of the white paper says that comments need to be filed within 30 days, and FERC “encourages electronic submission of comments in lieu of paper using the ‘eFiling’ link at http://www.ferc.gov .” For those who prefer not to file their comments electronically, they can submit their comments to “Federal Energy Regulatory Commission, 888 First Street, NE, Washington, DC 20426.” All filings on this will be accessible online, under the eLibrary link. There is an option to subscribe to the docket to be alerted via email when a new document is added. FERC Commissioner Cheryl A. LaFleur issued a statement regarding the white paper, explaining her opinions on the matter.

LaFleur said she “mentioned at our Reliability Technical Conference in June, the handling and confidentiality of these NOPs has been an issue of growing controversy. As I advocated then, I think it is essential that FERC and NERC conduct public process to consider the appropriate balance between transparency and security in these instances. I am very pleased that such a process is being instituted today.”

She explained that the procedures that are currently in place have been there for over a decade, without changing, and she thinks it is good that they consider revising the processes now. “it is important that we handle NOPs so as to avoid subjecting the bulk electric system to risk of a cyber attack once a vulnerability is identified. At the same time, I believe state
regulators, members of the public, and others have a legitimate interest in such violations, and we should seek to achieve as much transparency as we can consistent with protecting legitimate security interests.”

LaFleur says the proposal is “worthy of consideration for a way to handle these NOPs differently. I hope that we receive a wide range of comments on the White Paper, including any suggestions for alternative processes, which will allow FERC and NERC to move forward on this issue.”

The Notice was issued on August 27, 2019, comments can be submitted until September 27, 2019.