The Department of Energy (DOE) has solicited the electric industry to request information to assist the DOE in drafting forthcoming rules that will prohibit the U.S. bulk-power electric system from using equipment sourced from or otherwise susceptible to harmful influence by “foreign adversaries.” Asset owners, utility operators, equipment vendors and other interested parties who wish to voluntarily provide this information must do so before Friday, August 7, 2020. The DOE’s solicitation suggests that the forthcoming rules will delve considerably deeper than merely considering bulk-power equipment’s country of origin or the identity of its manufacturer when asking whether equipment is sourced from a “foreign adversary.” Instead, it appears that the DOE is considering an evaluation of the entire supply chain used to procure and install a piece of equipment, including involvement from sub-tier suppliers and the development history of associated firmware and source code.
Background information
On May 1, 2020, President Trump issued Executive Order 13920 (the “Bulk-Power Order”) which prohibits the acquisition, importation, transfer or installation of “bulk power system electric equipment” in the United States when the U.S. Secretary of Energy (the “Energy Secretary”) and other government officials have determined that: (i) that equipment has been designed, developed, manufactured or supplied by persons owned or controlled by or subject to the jurisdiction of “foreign adversaries”, and (ii) the transaction poses an unacceptable risk to the U.S. bulk power system, U.S. critical infrastructure or U.S. national security (see this Husch Blackwell client alert for more details on the Bulk-Power Order). The Bulk-Power Order defined “bulk-power system electric equipment” as:
[I]tems used in bulk-power system substations, control rooms or power generating stations, including reactors, capacitors, substation transformers, current coupling capacitors, large generators, backup generators, substation voltage regulators, shunt capacitor equipment, automatic circuit reclosers, instrument transformers, coupling capacity voltage transformers, protective relaying, metering equipment, high voltage circuit breakers, generation turbines, industrial control systems, distributed control systems and safety instrumented systems.
The Bulk-Power Order also required the Energy Secretary to issue rules or regulations to formally implement the Bulk-Power Order no later than September 28, 2020. Shortly after President Trump issued the Bulk-Power Order, the U.S. Department of Energy (DOE) published a set of Frequently Asked Questions which stated that the DOE would “work closely with stakeholders” as it prepared these rules and regulations.
The request for information
The DOE published a Request for Information (RFI) in the Federal Register on July 8, 2020, which clarified several aspects of the Bulk-Power Order and asked for public input on a series of approximately 25 specific questions. The RFI established that the DOE will treat the governments of China, Cuba, Iran, North Korea, Russia and Venezuela as “foreign adversaries” under the Bulk-Power Order. Among that group, the RFI specifically noted that the DOE considers the governments of China and Russia to be “near-peer foreign adversaries” who are “attempting to access [U.S.] key supply chains at multiple points—from concept to design, manufacture, integration, deployment and maintenance—by, among other things, inserting malware into important information technology networks and communications systems.” The RFI did clarify that its designation of the Chinese, Cuban, Iranian, North Korean, Russian and Venezuelan governments as “foreign adversaries” was only relevant for purposes of the Bulk-Power Order.
In the RFI, the DOE explained that it is “seeking information to understand the energy industry’s current practices to identify and mitigate vulnerabilities in the supply chain for components of the bulk-power system.” The RFI splits its information requests into separate categories: (1) questions addressing the bulk-power system electric equipment supply chain, and (2) questions addressing the Bulk-Power Order’s potential economic effects. Although the RFI specifically states that “the [Bulk-Power Order] rulemaking process will allow the opportunity for stakeholder comment and input on the substance of the rule”, interested parties might be better served to submit responses to the RFI at this time rather than waiting to comment on the rules at a later date. Submitting a response to the RFI could provide respondents with the opportunity to hopefully influence the DOE while the rules are in a formative state instead of waiting until later in the rulemaking process when the DOE might be less inclined to make substantive changes.
RFI questions focused on the bulk-power system electric equipment supply chain
The DOE modeled the supply chain section of the RFI using existing best practices supply chain risk management (SCRM) frameworks, drawing particular influence from the SCRM framework tool developed by the National Counterintelligence and Security Center. The DOE also stated that when it does enact the Bulk-Power Order’s implementing regulations, it “does not plan to develop a SCRM tool or repeat questions already deemed best practices from well-established frameworks and tools” but rather “will build upon efforts by standards development organizations.”
The RFI’s bulk-power system electric equipment supply chain questions are focused on evidence-based cybersecurity maturity metrics and foreign ownership, control and influence. This RFI’s supply chain questions address topics which include (but are not limited to):
- The prevalence and frequency of cybersecurity risk assessments within the bulk-power electric system;
- Existing efforts by the electric industry to manage risk from foreign ownership, control and influence in the bulk-power electric system supply chain;
- Whether existing SCRM standards are adequate to maintain software integrity and establish a secure development lifecycle for software and firmware;
- Existing oversight of sub-tier vendors by energy sector asset owners and equipment vendors; and
- Existing access control policies to prevent foreign adversaries from tampering with the bulk-power system during equipment installation and integration.
According to the RFI, the DOE is especially interested in receiving responses which address the following types of equipment:
Transformers (including generation step-up transformers), reactive power equipment (reactors and capacitors), circuit breakers, and generation (including power generation that is provided to the BPS at the transmission level and back-up generation that supports substations). This includes both the hardware and electronics associated with equipment monitoring, intelligent control and relay protection.
However, the RFI qualified the above list by stating “Only transformers rated at 20 MVA and with a low-side voltage of 69 kV and above are included.” The DOE also stated that, based upon the information it receives in response to the RFI, the Energy Secretary “may establish specific pre-qualification criteria for a set of components that support defense critical electric infrastructure (DCEI) and other critical loads and critical transmission feeders (69 kV and above).” The DOE indicated that it would also consider establishing the same pre-qualification criteria for black start systems.
RFI questions focused on the bulk-power order’s economic impact
The RFI’s economic impact questions were directed at “the full scope of [bulk-power system] electric equipment as defined in [the Bulk Power Order].” Those questions addressed the following topics:
- The estimated one time and recurring costs of developing, implementing and periodically revising policies and procedures to comply with the Bulk Power Order;
- Whether there are categories of bulk-power system electric equipment that are more reliant on vendors that could be connected to or influenced by foreign adversaries and anticipated sourcing challenges and cost impacts for companies seeking to perform transactions involving those types of equipment;
- Whether the energy sector has a procedure to identify services, components and/or systems which should be covered by the Bulk Power Order, and (if so) which types of services and systems should be covered by or excluded from the Bulk Power Order’s implementing rules; and
- Unique challenges that the Bulk Power Order could present to small businesses.
The RFI’s line of questioning set forth in the third bullet point above is particularly important because it could provide equipment vendors with the opportunity to argue that their equipment should either be pre-qualified for use in the U.S. bulk-power electric system under the forthcoming Bulk Power Order rules or exempted from the rules entirely.
Procedures for responding to the RFI
To be considered by the DOE, written responses to the RFI must be received on or before Friday, August 7, 2020. The DOE will accept responses through the Federal eRulemaking Portal, email and physical mail. Information included in RFI responses will be available for review by the general public; however the RFI does allow submitters to request that the DOE omit confidential information from a comment before posting it publicly. Persons responding to the RFI should be aware that the DOE will ultimately make its own determination as to whether data identified as confidential information within a response will be withheld from public disclosure.
While it appears that the DOE will continue to solicit feedback from the electric industry as it develops implementing rules for the Bulk-Power Order, the DOE will have only 52 days between the end of the RFI’s solicitation period and the Bulk-Power Order’s deadline for issuing the rules. Considering this short timeline, if interested parties have feedback that they would like to share with the DOE concerning the Bulk-Power Order, then we suggest that they take advantage of the RFI in order to ensure that the DOE will have time to fully consider their comments.
Contact us
Husch Blackwell’s Energy & Natural Resources team will be carefully following the DOE’s implementation of the Bulk-Power Order. If you would like assistance in submitting a response to the RFI or have any questions concerning this topic in the meantime, please contact John Crossley, Cacki Jewart, Grant Leach or Chris Reeder.