Cyber Security in a Competitive Distributed Energy Grid

Smarter Grid Cyber Security Is Required to Ensure Minimal Disruptions to Energy Supply

As the energy system evolves from a macro-utility-centric model to a distributed energy smart grid, a new concern has arisen quite separate from the more publicized battles over net metering and utility mandates—cyber security. According to Smartgrid.gov, cyber security threats include “deliberate attacks launched by disgruntled employees, agents of industrial espionage, terrorists, and other adversaries, but also inadvertent compromises of the information infrastructure due to user errors, equipment failures, and natural disasters.” The cyber security threat to the energy market is not new as the U.S. Department of Energy (DOE) has been involved in roadmapping activities to address cyber security threats and improve cyber resilience since 2004.

With the rise of competitive distributed energy resources (DERs), the New York State Public Service Commission (PSC) has placed new emphasis on securing the grid against cyber-threats. The PSC, a pioneer in restructuring the market to promote DERs, addressed cyber-vulnerabilities to the New York grid system in its recent Reforming the Energy Vision (REV) ruling.

Under REV, utilities will be deployed as central managers of multiple DERs. While this new vision will ensure that disparate distributed generators will be integrated into the broader grid, it could create vulnerabilities related to both energy disruptions and security. As a result, New York has, for the first time, suggested requiring that utilities monitor standards for non-utility DER providers with an eye toward protecting the grid from cyber security attacks directed at particular DERs. This move will ensure minimal security-related disruptions to supply and the protection of vulnerable customer information data.

Potential Cyber Security Regulation May Increase Costs for Distributed Energy Providers

In allowing utilities to monitor cyber security standards for non-utility DER providers, the PSC should consider that such activities likely will increase competitive energy suppliers’ costs. In most jurisdictions utilities have borne the cost of cyber security, which could then be recouped through ratemaking procedures. However, financing renewable DERs is oftentimes already a high-wire balancing act of tax equity, project finance, power purchase agreements, and fixed returns. Adding a cyber security cost to the mix, which may include purchasing a particular type of software, re-training personnel, preparing compliance reports, and conducting monitoring, would increase operating costs and thus decrease investor returns. It is also possible that investors will attach new risk premiums to projects to account for the added costs of security compliance.

Because utility-like cost sharing mechanisms are not currently in place for DERs, and given that grid security is a common good, the PSC and other utility commissions could demonstrate their commitment to a more renewable, DER friendly grid infrastructure by enacting incentive programs that drive intended results. The state has taken great strides in meeting its public policy goal of deploying DERs by utilizing innovative public-funded incentive programs. For example, the state has established numerous energy incentives, including a Renewable Portfolio Standard (RPS), Green Bank, and solar, efficiency, and electric vehicle programs. Moreover, New York City’s Mayor’s Office implemented INITIATIVE 13 with the goal of developing 800 MW of clean DERs on city-owned sites; an element of this program has been to advocate for ratepayer-funded DERs. Similar approaches could be deployed state-wide to ensure that private investment is not chilled and to ensure an efficient reallocation of costs in a more distributed generation-centric landscape.

To truly encourage DER deployment, the cost allocation between distributed energy providers and users of the macro-grid must be effectively managed. In the wake of the REV ruling, utility plans are due to the PSC by December 15, 2015, and a comment period is expected thereafter on topics including DER cyber security measures. Interested parties should be involved in this process to ensure that additional project costs related to cyber security risk management are addressed.

We are monitoring cyber security developments involving distributed energy. Please contact any member of our energy practice if you have any questions on distributed energy and cyber security.

Special thanks to Morgan Gerard who assisted in the preparation of this post.