Grid cybersecurity: how big is the threat & what should we do about it?

0:06All right. All right. Hello, everyone. Greetings. Salutations. This is Volts for August 7th, 2026. Grid cybersecurity. How big is the threat and what should we do about it? I'm your host, David Roberts. As clean electrification proceeds, more and more of the U.S. economy is going to be dependent on the electricity grid. And the electricity grid is going to be more and more dependent on power electronics, software, and computing. If there's one thing we all know about computers these days, it is that they can be hacked, accessed, and controlled from the outside by bad actors. Fears about the vulnerability of the electricity grid to hacking and manipulation have been steadily rising in recent years.

1:02Most of the power electronics, the inverters, transformers, controllers used to build the electricity grid come from China. If you listen to the doomsayers, they'll tell you that China is embedding malware on all these devices with the goal of creating some sort of apocalyptic kill switch that could take the entire U.S. grid out at a stroke. How much of that cybersecurity threat is real and how much is hype? I've been meaning to get to this subject for years, and I'm excited that I have the perfect guest with me today. Patrick Miller helped write the original cybersecurity rules for the U.S. bulk power grid, the NERC Critical Infrastructure Protection Standards, in the 2000s.

1:49Then he became the first person in the country with delegated federal authority to enforce them, auditing utilities on the government's behalf. Since then, he has founded a nonprofit, run a Department of Energy program, and built a consulting firm, all to advise and educate utilities and regulators worldwide on cybersecurity threats. It's an unusually broad range of experience, and it has made him a prized voice in the field, a level head in an area filled with uncertainty and fear. I'm eager to talk with him today about how cybersecurity threats might manifest in our increasingly distributed grid, and how grid engineers and regulators should be managing those threats.

2:37All right, then. With no further ado, Patrick Miller, welcome to Volts. Thank you so much for coming. You bet, David. Thanks so much for having me on the show. Really excited for this. This is something I've been circling around for a long time, as I said, and I'm excited to dig in. So you, among other things on your extensive resume, you run a program for NARUC, the National Association of Regulatory Utility Commissioners, a training that brings state utility commissioners up to speed on cybersecurity. I guess where I'd want to start is when those commissioners come in, I suspect that they, like me, like I suspect most of my audience, don't know much and have all kinds of weird preconceptions.

3:27So I'm curious, sort of like, what's the first thing you kind of tell them to get grounded and what sort of misconceptions are they carrying around with them? a great place to start. Yeah, I do a lot of work with NARUC to help the state commissioners. As you know, where the federal regulations don't reach, it's pretty much left to the states. And in a lot of cases, you can end up with like, you know, 50 different directions. Yeah, we're going to get into that later. Okay. So typically where I start with them is they come from varied backgrounds. They're almost always a legal background. Or in some cases, they may have some infrastructure, or they may have been a, I've seen CFOs and other, like even general counsel from various utilities, whether it's, you know, telecom, water, gas, electric.

4:14You start with the fact that they probably don't understand all the technical things. And the typical questions they come with, they usually sit on one side or the other of a pretty, you know, wide divide. They either think that, you know, everything's fine, nothing is hackable, this is all a bunch of hype, or they think, oh my God, everything is hackable and China is here to eat your children. You know, it's just, you know, so it's kind of one or the other. There's a few that are in the middle, but it's a slim few. That's funny. That's funny. Well, hopefully we can find some, chart some course in between.

4:48In between those. That's my goal. Yeah, yeah. So before we get into some of the details, maybe just to level set, I kind of want to know, are we talking about something that might happen or something that has happened? Like, have there been notable cybersecurity attacks on grids that have had negative effects? Or is this mostly something that people are worried could happen? Well, there's a bit of nuance in the answer. There have been attacks on grid companies. We do know that. There's public evidence of that. Most of these have been situations where the attacker is broken into the system and hasn't done any damage yet.

5:33They just pre-position themselves. They're holding that access. So in theory, they would use it for something bad or nefarious later on. What we don't have is direct examples in the U.S. where actors have broken in and actually directly caused damage. We do have evidence of this in Ukraine more than once. So at least a couple of exercises there. And then one in Poland recently. And when I talked to my contacts in Poland, they say they've got a long list of things they just haven't published yet. So there are some threat actors that are definitely breaking into power systems and definitely causing direct damage, direct harm, blackouts, that kind of thing.

6:15Just not in the U.S. Just curious, in Ukraine, are those state actors? Is that Russia doing that or do we know? Yeah. No, it's definitely Russia. Yeah. And same with Poland. So this is something that's being used as a proxy for warfare kind of thing. It is. It's a proxy for warfare. It's also a proxy for influence. So, you know, Poland is the major channel that Ukraine gets supplied through. So Poland's also been under heavy attack from Russia as well with basically the same system, same type of attacks. Okay. So for the U.S., though, we've documented access, but we've not yet had anyone, like, cause a blackout, say, or something like that.

6:55Right. Right. Okay. So I thought I'd start with a basic distinction here. I think a lot of people, when they hear the word cybersecurity, they think about IT. They think about information technology, protecting passwords, protecting data, preventing identity theft, that kind of thing. But a key distinction here is that cybersecurity in the way that you are dealing with it is mostly about OT, operational technology, physical processes. And those are different. That's a different approach. So talk a little bit about that distinction and how it's meaningful for cybersecurity. Sure, sure. I mean, IT still plays a role.

7:38I mean, information technology is how any company runs these days. is you pretty much can't work without your email and your corporate systems and your data. You know, all your customers are in there. All of your billing is in there. In the OT world, in the operational technology world, it's the actual interface to the physical world. So like the sensors that take things like fan speed or oil viscosity or temperature. So this is like, you know, think of how much voltage is on the wire, for example. That's sensed by a digital component now. And the OT is what directly touches the physical world.

8:11like it's the last line. So you would click on a screen somewhere, like a picture of a breaker, you click on it and it will open an actual breaker out in the field. And that travels from someone's IT system, like a, you know, standard workstation. It's a Windows machine with a program on it that runs a kind of an operational window into what they've got in their field. So they've got transformers and breakers and all the things they use to operate their power system. They can operate those from like a control center through this kind of IT-OT partnership versus send someone out in the field to actually go open that breaker, right?

8:46So that's the automation that we get with this OT. But these systems are not like the OT systems. They're not like, you know, Windows or Unix or a database or a web server. They're literally purpose-built devices. They do one thing. They like, they open the breaker. They sense the voltage. They don't have like an operating system. They're not, you know, They're basically just what's called firmware and a configuration file. You just turn it on and it reads a configuration and it does its thing. So they're very interesting. And it seems intuitively like that would be a little simpler and maybe a little easier to protect.

9:23Is that right or wrong? It's easier to hack as well. Because there's not a lot of, I mean, they weren't really built. I mean, think about this. When we first built this out, they were never really connected to anything, right? They were just by themselves. So now that we've networked everything and we've made control centers that can control, you know, everything in the field. So, you know, generation assets, transmission assets, distribution assets, with all of that connectivity, you end up with devices that were never really meant to be connected that have some kind of connection to them. So they weren't designed to be protected in the same way.

9:58So we have to come up with really unique and interesting, you know, ways to isolate them and limit access and that kind of thing. because, I mean, realistically, you know, to update them, you have to reboot them in almost all cases. If this thing is required for the grid to run, you don't just reboot it because you get a blackout. So you end up with, you know, you got to wait for the right moment. So you have these, this kind of mishmash of various things. So our main protection is just to isolate the heck out of them and architect it so that it's, uh, it's very difficult to get to them unless you know what you're doing.

10:29Okay. Talk a little bit about these. Um, we're going to start with the bulk transmission grid. We'll get to the distribution stuff later, which is really my true interest, but let's talk a little bit about the NERC CIP standards, the critical infrastructure protection standards. So you were instrumental in developing these and then in enforcing them. They're about the bulk transmission grid. Just give us a little texture of like, what do they involve? What do they require of people? And they're sort of unusual. I mean, the grid world, the electricity world is full of all kinds of standards that are mostly voluntary.

11:05These are not voluntary. They are mandatory and enforceable. So talk a little bit about what they consist in, what they ask people to do, and how they are enforced. Sure. Let's start with who is required to follow the law because everyone thinks, oh, it's the whole U.S. power grid. There is no distribution in scope at all, and it's only some generation and some transmission. So there's a handful of exclusions for transmission. So it covers a pretty big, you know, area of the transmission system generation. If it breaks a certain threshold, which, you know, to give out some numbers, it's 75 MVA aggregate behind a single point of interconnection.

11:44They have to register with NERC and they're required to follow the laws. There's a lot of generators out there that aren't 75 MVA. So, and a lot of times they would even generate facilities to be 74.5. So they could get right under the threshold. But that's changing. We're taking that threshold down. It's going to go down to 20 MVA and connected to actual distribution environments. So that's the threshold is getting lower because a lot of those smaller generators have actually had an impact. So that's who's got to participate. The rules they have to follow, basically they have to declare which systems are critical.

12:18And these are systems that if for some reason there was a problem, whether you needed it or it got hacked, if it would cause an impact to that system within 15 minutes, that's a critical system. You got to protect those. And protecting them means you got to have security policies in place. You got to background screen your people and train your people. You got to restrict who has access to those systems and you got to remove their access when they leave. You have to put them inside of what's called an electronic perimeter. It's a firewall, really. And most people understand what a firewall is.

12:47It's kind of a way to protect the systems from other dangerous networks. Then you have to have the physical boundary. So you got to lock the systems up. You can't just, you know, let anybody have access and track who has access to them. And because honestly, if I can get my hands on it, I can hack it. Then you do the systems themselves. So you secure each individual system with everything from like password security to anti-malware to logging and tracking and monitoring. And then of course you have to have incident response plans. You have to test your plans. You have to have backup plans in case you need to restore a system and test those.

13:19And then you got to restrict their configuration. So if you want to make a change to the systems, you got to track them all, prove them all. And then there's the information about the systems that if hackers got it would be really bad. You have to protect that information. And then there's supply chain security. So you don't want to buy from like North Korea or China. So you got to like, well, do we really want to buy from these people? Or we're taking a big risk here. The next piece is the communication between control centers. There was a Chinese hack recently on, they basically hacked all the different telecoms.

13:52So control center to control center, you have to encrypt that. So if someone were to somehow get in the middle of that communication, they couldn't see what's happening. And then the last piece is what there's some physical security, additional stuff for like really, really big transmission substations. The last one that just got adopted is monitoring the traffic between those critical systems as they talk to each other. So we can see what they're saying to each other. And that's the last piece that pretty much covers the, what the requirements are for the body of the standards. That seems like a pretty, that's a lot.

14:26It is a lot. So these are like, so these are mostly large entities being asked to do this, right? Large power companies, transmission. Even some smaller ones. I mean, if you have transmission, like if you break 100 kV and you've got transmission, there's a chance you're in scope. And if you're a generator above 75, then you are in scope. So it actually covers a fair number of the utilities. It's just which systems fall into what they call high, medium, and low, because there's some categorization in SIP. Most of the systems are in the low-impact space. So they don't have to go through all of those things.

15:02They got to go through some of those things. But if they're medium or high, they got to do all that. And this is a little bit of a subjective question, but how big of a pain in the arse is that? I mean, if they're building systems that are 74.5 kV, this probably indicates that they'd rather not take all this on. Is this something that you can, like, hire a guy who will do this for you? Or is, I mean, how elaborate of a process is this? How much time does it take for them to do this? It's pretty elaborate. And what they really expect is they really expect kind of a level of diligence. And the reality is if you want to participate in the, you know, grid critical infrastructure ride, you have to be this tall to ride the ride.

15:43And it's, it's, the expectation is high for a reason. And, and, you know, when I was auditing it and, you know, writing violations and enforcing, we took it very seriously in the fact that, no, this is the North American power system. You have to keep the lights on. So, yeah, you've got to have a real program with real people doing real things and you got to take it seriously. And presumably these fines are big enough to really, these are not just things that they could absorb and brush off. The number that gets thrown around is a million dollars per day per violation. That's actually gone up with inflation.

16:16It's over 1.8 million per day per violation. That's never been seen, though. So what they typically do is they'll write the penalty. And if the utility is like, oh, okay, what if we put all this stuff in place and we fix these things and we put this money toward improvements? Can we take that cost down? Usually that's how the settlements work out so that it's less of a, you know, go spend a bunch of money on the penalty and then go spend a bunch of money on, you know, fixing it. They try to get them to incentivize the fixes instead. So it works out in a pretty good way where it drives the incentive to do better.

16:48And who is this we that is doing the enforcing? Is this the federal government? Is it some department of the federal government? Who's the enforcement arm? It's a branch. So the authority comes out of FERC, the Federal Energy Regulatory Commission. They have basically delegated this down to NERC, which is the North American Electrical Liability Corporation. They're now called the ERO, or Electrical Liability Organization. So they do the enforcement stuff for FERC. And there are six regions of NERC. So whatever region you're in, your region audits you. And if you're in a bunch of regions or all regions, there are some utilities that are big enough to actually cover all regions.

17:27You get audited, they kind of take turns and one of them will lead, but the rest of them participate. So, yeah, you get audited by your region and then that goes upstream to NERC and to FERC and then the penalties come back down. Okay, interesting. Okay, so here's the bit I'm really fascinated by, which is the CIP standards were designed for the bulk power system. But, you know, as listeners of this podcast are very aware, all the action these days is out on distribution systems. All the stuff that we cover every day here, rooftop solar, batteries, EV chargers, virtual power plants, sit outside that sort of regulatory perimeter and are in states, as you say, beyond FERC jurisdiction.

18:17And so, you know, you get something like a virtual power plant, you get the size and scale of a power plant that might have come under the bulk standards. But instead of a single point of, you know, regulation or access or physical whatever, the VPP can consist of thousands, thousands of devices scattered all over thither and yon, which just like intuitively to me sounds like a cybersecurity nightmare. You have your attack surface, as they say, has become exponentially larger. So I'm just curious, what's the cybersecurity community thinking about this? How do you reach these distribution grids?

19:08What sort of standards do they need? And who's going to enforce them? Like, how do you standardize an approach when you have 50 different regulatory bodies involved? Yeah, this one has been a really interesting challenge. So you've got some examples where those smaller assets, whether they're, you know, run by VPPs or in some markets like in Texas where it's kind of a QSE market. and what we now have just lumped them into a big term called inverter-based resources because it kind of captures all of them under this umbrella term. So there have been inverter-based resource, we'll say challenges, disturbances, also known as blackouts in Texas a few times as a result of these.

19:53So they're one of the good examples. There's been some other disturbances and things in the California area. It's caused some strain in some other ones. We've got a pretty good... Now, are we talking about accidents or are we talking about attacks? No, no. These are just like grid physics problems. Right, right, right, right, right. Yeah. So not attacks. Let's be clear. So what they did, just because those grid physics problems manifested, they were like, well, what if someone like caused this to happen with a hack? That would be even worse. So those two things converged. And basically, NERC went out and did lots of studying and invited lots of different participants and stakeholders to the mix.

20:29And they came back with this inverter-based resource study. And as part of that, they took that threshold that we were talking about, that 75 MVA for generators down to 20 MVA. And it used to be 75 MVA connected to a 100 kV system, which is basically transmission. They took that down and now it's 20 MVA connected to a 60 kV system, which is distribution. So give us a system. What is 20? Would that include a residential rooftop solar generator? How big is that? it wouldn't include this is like a a small scale uh like if like if a whole a small neighborhood for example or a um it's mostly commercial operations it's not likely going to be a rooftop that it was mostly generated for people that maybe had some battery storage that they were feeding back in for example they were on the market as a result of that so it was trying to capture those that are big enough to matter and they they looked at all the way down to rooftop up.

21:29Like, where do we draw the line? So they took it up to 20 MVA because they figured this is big enough in aggregate. If someone were able to control it, it could cause problems. So based on both the grid physics and the security aspects, they drew this line for what's called inverter based resources. They now have to register. They have to do some things. They don't have to do security things yet, but that's likely going to be coming in the future. But we're starting down the path of roping them into those federal regulations so that there's less of a state by state mix because, as you've probably covered, various states have their own rules about how things are done.

22:03Yeah. How does that work? I mean, how do the feds even have jurisdiction here? Isn't that violating sort of the kind of state-federal boundary that everybody cares about so much in the grid? Oh, yeah. It's been hotly contested. I mean, nothing short of a bar fight, really. But what the result of this was, and FERC has pretty much put their foot down and agreed with it, is that in these situations, it's affecting an interstate transmission system as a result of their ability to influence it with those smaller resources. So the aggregate possibility has, they've, and they've actually done a pretty good job of proving it with physics.

22:43It's not just a speculation. They can show their math. Yeah, this is, that line has become more arbitrary every day, just around the physics, just around the technology of everything. And I've been wondering, I'm sure this is a species of problem that is going to pop up more and more. That line between what is and isn't interstate, what is and isn't bulk is fuzzy at best. Yeah. Yeah. And we haven't even talked about like VPPs that could control assets all over the country. Yeah, right. I mean, a VPP that's aggregating resources across multiple states. Yeah. So, so you say right now it's about physics.

23:21What would, I mean, I guess the sort of the nightmare scenario here is like you gain, you know, a hacker or whoever, you know, and I, again, speaking here from a very low base of knowledge, but like a hacker gets, gets access to one battery through an inverter and like via that creeps into the other batteries it's connected to and creeps its way. You know what I mean? Like it gets in a back door through one thing and then accesses the whole system through that thing, which makes me think then that like you have to ensure that every one of those batteries has protections. Like, is that the threat here?

23:59Yes. To be short and sweet about it. Yeah. Well, we did some work with NARUC, as we mentioned earlier. We did what's called the cybersecurity baselines for distribution and DER aggregators. because those DER aggregators are a lot like a VPP in a lot of cases. They aggregate at a point much like a VPP does. So when you've got virtual power plants and distributed energy resource aggregation points, you have at your fingertips a very large amount of potential to affect regional problems just because you could say, well, if you did it across the whole board, yes, that would cause problems. If you want to focus in a certain area and cause a problem at the right time to cascade things, you could do that.

24:44So we wrote some standards, and it was basically some very lightweight things, you know, like have passwords, don't connect these things to the internet directly without a firewall. Really simple stuff, kind of basic things like, you know, if you're going to have remote access, put some multi-factor. Give them a one-time, you know, phone code to actually log in so that you can't just like log in with default credentials. Are there any of the, because one of the things that pricked my ear about the bulk standards is that I hadn't really occurred to me because, you know, I was thinking about kind of the technology angle of it, but the personnel angle is also obviously a thing.

25:21Are there any of those personnel-based standards going to be applied down at the VPP level, the aggregator level? So far, it hasn't gotten to that stage. And states can certainly go do this on their own, right? And that's kind of what it was designed for when we wrote these, what we call the baselines. We based them on a DHS work called the Cyber Performance Goals. And it was just lightly tailored to fit the distribution environment and for DER aggregators. But it was designed so that states could use it as a model to actually go write their own regulation. And it would give them something to work from.

25:55A blank page is always the hardest place to start. Yeah, right. And the ones that want to go further and do, you know, go their own route and do their own thing, they're going to do that anyway. But there's a bunch of them that don't really have anything to work with. So that was designed to give them something and hopefully, honestly, get some degree of uniformity in the approach. Yeah. So it's like a floor, a floor then, a federal floor that states can build on if they want to. At this point, it's just a suggestion. It's nice to have. Yeah. Interesting. And this is another just sort of intuition of mine, which is that once you're down to like 20, that 20 kV level, you know, you're not talking about individual residences, But you are talking about some pretty relatively small operations.

26:36Like if I'm, you know, I could have a warehouse, you know, with a bunch of solar panels on my roof and a stack of batteries. I could break that threshold. So you're, I just feel like there's a limited amount you're going to be able to demand from like a mom and pop. Like somebody who owns a warehouse, like these people are not going to be, you're never going to get them to be cybersecurity experts. You're never going to get them to hire dedicated personnel or employees just to focus on this. I'm just wondering, how far can you get? Don't eventually you need to start building the safety into the devices themselves?

27:18Is that not sort of like where this needs to go eventually? Yes. And we're also trying to do that at the same time because the way the system is designed, as you've already well articulated, there's not an easy way to do this. You can't just make all the warehouses out there with rooftop solar and, you know, warehouse level rooftop solar and batteries, which most of them kind of will break that threshold. You can't make them become like cyber secure and follow these federal guidelines and get audited, for example. I mean, there's not enough people to do the audits, right? So, you know, on the reverse side of that.

27:49So what we're also trying to do is to actually, you know, do this at the supply chain level. So I've testified to Congress on this and some of my other counterparts have. Dr. Stewart is another really smart one, Emma Stewart. She's brilliant on this subject. Probably the, I would say, the global expert on this, really. We've taken a strong push to get the device level security to a place where you don't have to be a cybersecurity expert. And this is not an easy thing to do because we buy a lot of our equipment that, you know, not from the U.S. So imposing rules on China is a little challenging.

28:25Yes, yes. Yes. And also I would imagine that like for every barrier you put up to hackers or bad actors, you're making some incremental trouble just for the people who are just trying to use the device. You know what I mean? Like one more little gateway for the for normal everyday use of the device, which I'm sure like the people using devices are going to resist somewhat and the manufacturers are going to resist somewhat. So this does seem like a really sticky wicket. Yeah, it's not an easy one. But I mean, we have to try all fronts. And if we get an inch out of all the fronts, we actually can cover a larger amount of territory.

29:04So it just takes a whole village of effort to try to make the needle move, really. Well, you've set me up for my next question, which is, as I think people probably know, most inverters, you know, we're talking about inverter-based resources. Most inverters come from China right now. There was this big Reuters investigation in 2025, which said that inspectors found all kinds of little undocumented communication devices inside solar inverters and batteries. And I guess like two questions. A, what do you do about what I imagine are now hundreds of thousands, if not millions, of those Chinese inverters that are already installed somewhere?

29:55and running. Like you can't yank them all out. There's no practical way to audit them all. What do you do about those? And then what do you do about the new ones? As you say, we have no jurisdiction over China. Like how do we exercise any control over what China puts in those inverters? Yeah. I'm going to keep this at a non-technical level because it gets really technical really fast um so in in general you're absolutely right there's a there's millions of these things out there and they do have a lot of undocumented communications components in them but i want to make sure we're really understanding what that means without any any hype whatsoever when china manufactures a lot of this equipment they literally do it on what's called a commodity board so you can imagine in your mind like a motherboard right it's a you know it's a it's a computer component where the chips and the memory and all those things sit.

30:53And they'll buy literally millions of these at once. And they'll buy them, you know, from a commodity manufacturer that just makes, you know, boards, literally like generic board. And on that board, it'll have all the things just in case you need them, whether you use them or not. They don't buy specific boards with just these components. So when they, I mean, 99 % of the ones I've seen that they've gone out and found stuff. It's just been the commodity board. Yes, it came with a radio. It came with a modem. It came with a place for a SIM card. There wasn't a SIM card inserted, but it has all those components on there in case the buyer of these commodity boards wants to use that functionality.

31:32I see. I see. So not nefarious inclusion of these, right? Not necessarily. So whenever you see those, you kind of have to take that with a grain of salt and think, well, if there's millions of these things out there, did they just use commodity of gear and they're just not, you know, this is just part of the board that maybe it's used, maybe it's not. Now they have found some of these things phoning home and, you know, the routing traffic through China. So that's a different discussion that's at the software level, you know, where the applications that you're using to manage these devices and that kind of stuff.

32:03So those are, those are different components. And we, there's some supply chain there that we can impose because it's software, right? We can inspect code. We can enforce certain rules on how code is developed and what's, you know, certain like transparency of the code. We need to look at the code before we're willing to allow it. These kinds of things. And we're not just going to let updates from China happen without someone taking a look at it before it goes in, those kinds of things. So there are some gates we can put in place. You say there might be these elements on the boards just because the boards are sort of generic and created for maybe lots of different purposes.

32:37Could those components of the board that aren't being used be activated later. Do you know what I mean? Sort of remotely activated. Like that's, I guess, is the worry. Yeah. They're there and they could be activated, but they'd have to have, I mean, you could activate them, but you'd also have to configure them. Like it's hard to explain, but when you, when, just because you turn something on doesn't mean it's ready to be used. Right. Like even a phone, you can turn a phone on, but you have to give it a SIM card that's got an activation code that's got, you know, all these things have to happen before it'll actually work on a cell network.

33:13I mean, you could get a phone out of the box and turn it on and it just doesn't do anything. So those pieces of gear are there. That doesn't mean even if you did enable it, that it would automatically work. So it does, it ups the ante in terms of just like flipping a switch and getting this like rogue network of these things to go do stuff. Right. So are we currently trying to impose standards on these imported inverters? Like, is that something that's happened, is going to happen, is in the works? Yeah. States like Texas and Florida have banned certain Chinese gear. The feds have banned certain Chinese communications gear.

33:50What we're trying to do, at least myself and some of my friends that are pushing this, we're trying to get a place where we can actually just get transparency into what they're selling. It doesn't make sense to go rip and replace all this gear. They actually make quality stuff. I mean, we used to have a long time ago, China made, you know, garbage and it would break and you'd have to go buy new stuff. They actually make some pretty, you know, fairly high quality gear now. Yeah. I'm familiar from the EV space that that story is no longer, story no longer applies. Yeah. So, but if by and large, a lot of the stuff we have out there, it's going to work.

34:23It's going to work as designed. It's got, you know, it's going to fit within like the engineering specs that it says it'll do. So with that, is there a way to basically live on a diet of poison fruit. And that's really kind of the approach we're going to have to take is what if we needed to, I don't know, repurpose this, you know, so we can take out some of the Chinese software components or firmware components and put our own on it. That's an option we've got where we could just basically just say, thank you for the equipment. We're going to repurpose it to our needs and we're going to put our own software and firmware on it and run it that way.

34:54Or we can force anything sold wherever it comes from to just have certain degrees of transparency. We can, we can inspect it. And that way we can sample batches and say, okay, you know, X number of them to a high degree of certainty, we think are not tainted with some sort of bad code. Right. So there's different avenues that we're trying to push. None of them are, you know, like a switch. None of them are easy. None of them just, you know, roll out and make everything, make the problem go away. Well, hasn't the Trump administration discussed a wholesale ban of these, which I assume is like...

35:26Absolutely a bad idea. Not a good idea. Yeah, not a good idea. No, we mean, what we typically do now is when we buy this gear and we don't have these assurances, we just isolate the heck out of it so that it just can't talk to anything. Like it doesn't get to talk to anything except through this very slim channel. And we inspect every single thing that it does says you over monitor it so that just in case something did go wrong, you'd know. So you can't prevent it from happening, but you can certainly detect it. I mean, you can prevent a lot. You just can't prevent it. everything, but what you can limit it down to, and then you just detect on that narrow band of what's actually allowed, and it gets you a little bit more assurance that things are going to be okay.

36:08I guess I just ask flat out, like, do we have reason to think that China wants to or is trying to do anything nefarious with these inverters? Like, just flat out. Like, do we have evidence, not just sort of vague suspicions, but do we have evidence that they are want to do, are trying to get away with something? Hey there, everybody. Don't worry, I'm not going to tell you about a new mattress or push a credit card on you. This isn't an ad. There are no ads on Volts. It is supported entirely by listeners like you. If you'll indulge me for a second, I'd like to ask for your support. I started Volts because we're all surrounded by depressing news about climate change and misinformation about clean energy, and it's never been more important to share the stories of the real people on the ground doing the real work of transition and all the ingenuity and courage and public spirit they are bringing to it.

37:08People are hungry to hear these stories, to learn from and find inspiration in them. I've heard from people who change majors or careers after hearing episodes of Volts, people using it in classrooms and community groups even state legislators who have passed bills inspired by specific episodes sharing these stories matters it makes a difference if you have found value in it and want to help me continue doing it i hope you will join the community of paid subscribers at volts.wtf it's about the cost of a cup of coffee a month if you don't like subscriptions you can make a one-time contribution leave a review on apple or Spotify or just tell a friend about Volts.

37:47I am grateful for any and all support. If you're already a paid subscriber, thank you. And now, back to the show. Do we have evidence that they are want to do or trying to get away with something?

38:12Yeah. Short answer is yes. There's a campaign called Volt Typhoon. And the one I mentioned earlier where they broke into the communications network is called Salt Typhoon. So this is the typhoon series of actors. Volt Typhoon was, and it's still ongoing. And it's not like it was, you know, like one group and then we, you know, sent them home and they went away. It's an active campaign that is still ongoing and they are trying to, and we've actually found them and there's documented evidence of this. It's public record where we found them embedded in utilities and various different systems. And they, like I said, they haven't done anything bad.

38:49What they do is they don't break in and come in the front door with like a marching band behind them. They don't announce their presence. They don't drop ransomware. They sneak. They come in very quietly and they immediately hide. And they don't even drop like malware. So they're not using, once they're inside, they're not using malware. They're using the tools that already exist. So we call it living off the land. But they're very good at this and it's extremely hard to detect. But we've found a few cases where we can see what they've done. It shocked everybody because we were quite surprised at how good they were first, but also how deep they'd gotten embedded.

39:22But yeah, so there's documented evidence that they're actively trying to do this. They have done it. They're still trying. But do we know why? Like, what are they up to? What do they envision doing with that access? They haven't openly communicated this to us. So all we can say is our best guess is, ostensibly, it is to exert influence over us, whether there is a particular trade situation, whether there is a particular Taiwan situation, you know, those kinds of things. So it is, they've got us in a very tight spot if we ever, you know, decide to take action against them in some way where they needed to leverage that.

39:59But it does seem like if they came out and said, hey, guess what? We have access to a bunch of your energy resources and we're going to shut them down if you don't do X, Y, Z. That would amount to something like a declaration of warfare. Like that would cause the U.S. to freak the hell out, I would imagine, and do all kinds of crazy things. That would not be a small step to take. It's not like a trade. You know, that would be more than a trade dispute. Yeah, one would think. So far, we've found them in our communications, literally almost every single communications backbone, all the major telecom providers.

40:38And they admitted it. They didn't just shy away from it and act like they didn't do it. No, they openly admitted it. And we didn't do an act of war then. So, I mean, you would think the answer to that question is yes, but maybe is probably the response. I'm not really sure. Wild, wild. I guess it would look very different if they actually did something, right? I mean, the fact that they haven't done anything sort of, I guess, lets all this kind of simmer in the background. Yeah. Let's talk about data centers. This is something I did an episode recently. They, you know, NERC, the Reliability Corporation, put out some alerts about data centers just because the way data centers are built, they're very sensitive to perturbations.

41:25They're very sensitive to grid conditions. And they are prone to just switching off and dropping off the grid all of a sudden, which If you're a, you know, gigawatt data center, you know, gigawatt of demand disappearing all of a sudden can destabilize the grid quite badly. And so that was those those worries were mainly about just the normal operation of these things. Like the way they operate is is somewhat of a threat, somewhat of a potential threat to the grid. But then it occurs to me as I'm researching this, like, what if you cause that to happen on purpose? So, you know, what if you got access to those systems and made that happen on purpose?

42:07You could destabilize grids via data centers. So is the profusion of large data centers, is this yet another sort of attack surface? And is anyone doing anything about it? Yes. That what's called a level three NERC alert, for those that want to look it up, it was for what's called the computational load entity. Right. And we've looked at these things, and this has been an issue in some areas. Texas is another example. Again, they have a lot of Bitcoin farms, and they would basically automatically shut off. So they would just absolutely draw enormous amounts of power until Bitcoin prices or whatever coin they were mining, whatever thing they're doing, whatever crypto situation they're in, would hit a certain price threshold, and they would just drop.

42:53And it would just swing their grid hard. Yeah. So they've put some rules in place there. And then we saw some other situations. I mean, recently was the one in PJM. A data center dropped three gigawatts. Good Lord. Of power at once and swung. They can typically stabilize these things. I mean, most disturbances, we can stabilize them within seconds to, you know, few minutes at best. This took 10 minutes to stabilize, which is a very long time in power curves. Yes, this is unprecedented. This is not something that has happened in history. This is a new thing in the world. Yeah. So when we look at these things, as I mentioned, the IBRs, we look at it not just from a, we start with the grid physics components and we look at this from an all hazards perspective.

43:35So cyber threat, backhoe, whatever the threat is, if that system drops or comes back online and starts drawing and we didn't expect it, those things can cause grid problems. So we take a look at this from an all hazards perspective and cyber is one of those hazards. And we're looking right now at how do these computational load entities affect the grid and what do we need to do to figure out how to balance this? Because typically you have to have some sort of reserve capability or ride through capability. other like grid physics components, whether it's like static var compensators and their larger grid components that can absorb these swings and, you know, kind of help us ride it out without like you flopping off a big area just because you're having a disturbance.

44:19Right. Didn't Texas just pass some ride through standards just recently? Yeah, they did. And we're looking at a bunch of ride through stuff for the NERC standards as well. So those would also guard against a deliberate malicious taking those things off the grid. Yeah. Intentionally by design. Like I say, when we're, I've been on the standards writing process with NERC for 20 something years now. We look at it from, we call it all hazards, whether it's a cyber threat, whether it's a squirrel, whether it's a backhoe, you name it. Our earthquake, flood, what happens to the grid physics and how do we actually stop that from being a problem?

44:58Interesting. Interesting. Here's sort of like a broader question. One of the other things I was worried about as I sort of approach this whole subject and I contemplate the sort of, as I said, the sort of incredibly distributed attack surface we are developing on the grid. Yeah. Which is that there's got to be just intuitively, there's got to be some tradeoff here between sort of security and speed. Like we, you know, we want to decarbonize the grid quickly. We want to elect we want to electrify quickly. quickly. There's a great deal of urgency behind doing that as quickly as possible. And I just think intuitively, like the more standards you put in place, the more requirements you put in place, the more personnel are involved, the more audits are involved, et cetera, et cetera, that is inevitably going to slow things down somewhat.

45:56How do you think about that trade-off? I also speaking as a recovering regulator, I'm a big fan of regulating only absolutely the bare minimum that you have to regulate and then let other forces operate above that threshold. So you will see things like business agreements. If you're an unreliable partner, you're probably not going to get a lot of business. If you're trying to grow a bunch of, you know, build a bunch of assets and grow a bunch of business, your insurance company is not going to want to do business with you and you're not going to get insurance for your plans if you can't show that you've got some degree of responsibility in the mix.

46:39So there's other forces that push these components around a bit too. So just sunlight, just exposing who's doing what, you think does some of the work? Well, it's going to be hard to hide because, you know, if a disturbance happens, we typically know where it came from. Like in the Spain blackout, for example, one of the bigger problems they had, they were able to come to a fairly rock solid conclusion. But there were still little gaps here and there because some entities just said, no, we're not going to give you our data. And some entities just said, we don't have the data. We don't log it. But in the U.S., you're kind of required to keep a lot of data.

47:15And, And, you know, we use a lot of data on our, just our operations. And we even like resell a lot of our data to third parties and that kind of thing for being a data broker, an operational data broker. So we have a lot of data. If something happens, we're going to be able to reconstruct that. And honestly, if a disturbance or a blackout happens, FERC is going to show up and it's not going to matter. You're going to have to prove it and show what you did. And you're going to get, you know, you're going to get that black eye or you're going get the stigma, for operating, you know, rogue or, you know, irresponsibly.

47:49So there are some things that will help. Are they perfect solutions? No. Does it prevent it from happening? No. But every time we've tried to prevent a problem through regulation before it happens, there's a lot of rightful pushback that says, prove it. Show me that this is a real problem. So until we have, unfortunately, it's always a rear view mirror approach. Yeah. And when you say you're going to find who's responsible? Are we talking about the entity running the power plant, the manufacturer who sent the equipment, the software company that wrote the software or some of each? Like, who's typically, who are you going to find that was at fault if something goes wrong?

48:36The answer to that is yes. And for different reasons, right? Like, if you caused a problem where my insurance company is trying to prove that it wasn't us, but it was somebody else, they're likely gonna send in some forensics teams to go figure out what happened. And if there's software liability or hardware liability, they're gonna chase that liability chain as far as they possibly can. Because, you know, hell hath no fury like an insurance company that's been scorned. So, you know, that'll happen. FERC will come in. They'll wanna do typically like a 1B investigation, especially if it causes a blackout.

49:09They send in a blackout investigation team. And those are some solid engineers that go do that work. They're good. That's like an NTSB investigation. So, you know, from all different angles, there will be sunlight on that event. hmm okay well this this again sets me up for my next question really well which is i think one of the sort of like disaster movie scenarios that people have in their head is that you you get access in one little spot and then and then there's some sort of cascade and you know next thing you know the whole east coast is out or the whole country's out or or whatever and so um I know a lot of your work and a lot of focus has gone into thinking about just how would you contain an event if it happened?

49:56Like, how do you and you call this cyber informed engineering. So just that's like what how do you build your devices in your systems so that things don't cascade? Basically, I think is the simple way to put it. So talk a little bit about what that means. Who's responsible for that and what does it look like? Sure. This is putting in some, we'll call them analog safeguards. So we put in some things that just aren't digital. They're just literally an electromechanical thing. And we used to have like electromechanical relays and protection systems. And we're looking at putting those things back in.

50:35Now they don't operate with the same level of like precision that we can do with digital stuff. like a PMU or a phaser measurement unit, unbelievable precision in terms of what it can protect. An old electromechanical one, not nearly close to that, but it sure does come in handy if someone hacked the system, right? If that's all you've got, it's better than nothing, I would imagine. Right. So we're looking at those kind of things and a lot of other just kind of really physics-based behaviors. So like one of the best examples, I go back to like a water system because it's easy to visualize where electrons just aren't as easy.

51:07So like if the concern is too much chlorine getting dumped into the water because someone hacked the system and said, you know, put all the chlorine in right now. What we've done is let's make the pipe that delivers the chlorine super, super tiny. So even if you set the, you know, 5 billion parts per million, it just couldn't do it. Let's make the pump a little tiny pump that can only deliver so much at once. Let's make the battery supply for that pump only operate at a certain amount, right? So the pump just can't over, you know, can't over pump, for example. And the reservoir that feeds it. Let's make it really super small.

51:41So there's ways to do this, you know, now correlate that to the grid physics side. There's ways to put in these analog gates and checkpoints where, you know, key areas are key, whether it's, you know, generation resources or large transmission throughput. We can do this on that scale and just, and it's relatively inexpensive to put these things in and it gives us a lot, kind of a safety underpinning. So think of like a float valve that operates based on pressure versus a digital sensor. So we've got, we're looking at those approaches, but you know, you have to remember we don't have one grid. We've got four.

52:16Yes. Yes. And each distribution grid in some sense is its own little thing. Is its own, right? So, I mean, we've got the HVDC, sorry, ACDC ties that break up all the grids. So you couldn't just black out the whole country at once or all of North America at once. That's is not a reality despite movies. And then, I mean, when I get the conversation around, could they just hack all the things? And I'm like, if you really went out and did like an asset inventory of just all the things that are out there on the grid right now, even the really important ones, and you just got those, the number of different devices would absolutely blow your mind.

52:55Like it's an incomprehensible number. Their ability to hack that diversity of systems is just, it's impossible. Well, it's astronomically improbable. I won't call it impossible. Even with AI, it's just improbable. So could they do key points and cause regional problems? Yeah, that's a concern. But nationwide or continent scale blackouts are just not a realistic thing. And so when you talk about these physical, these analog sort of gate limiters and type things. Is that something that's a manufacturer responsibility? Is that at the device level or is that at the system level? Is the utility the one doing that?

53:38Who's overseeing that? Yeah, this is typically the utility. Yeah, this is typically the utility that puts this in so that they can basically protect parts of their system that are very difficult to replace. Because in reality, one of the bigger concerns we've got is, I'll keep it simple, what are called protection systems relays, they're designed to keep the grid from burning down, basically, like no uncertain terms, like literally burning down. So this is keep transformers from exploding, all this kind of stuff. If we can put those, you know, like, for example, an electromechanical or dumb relay on some of these really expensive transformers and other really expensive pieces of equipment, even if they did hack it, this piece of equipment is going to keep it protected.

54:22So those are the kind of things that we're looking at. Really big generators, for example, obviously there's ways to desync and resync a really big generator and you can actually torque the shaft and there's even some that have modeled like actually getting the generator to go boom. That's a problem. So you put these kinds of devices placed in the right spot there to keep the generator safe as well. So this is to keep our big components that take a long lead time to build that are really difficult to replace or fix we're protecting those critical components with this kind of protection. Got it.

54:57So even if someone got in, caused some event, we have some reasonable confidence that it would remain reasonably localized. Yes. I mean, now, like I say, is there still a chance for problems? Sure. And is every big utility doing this for their critical stuff? Eh, some are, some aren't. So, you know, there's no rule to do this, no requirement to do this yet, But it's those that I think most of them are doing it out of the financial incentive to replacing that transformer is going to cost us, you know, how many hundreds of millions of dollars and a minimum of a two to three year lead time. And now we're up against, you know, Google and Facebook and Amazon.

55:34Yeah, supply chain. Out in front of us. So we can't even get in the front of the line if we wanted to. So, yeah, I think most of them are realizing this is just a good business decision, too. Right. Well, once again, you've teed me up for my next question, which is about AI. And of course, When anybody thinks about computing these days, that comes up, which is that maybe the number and diversity of devices would be daunting for any sort of human hacker. But of course, now we've got these giant, super intelligent robots who can just go at it without pause. So in your mind, does AI heighten the threat here?

56:16And then conversely, on the other side, is anyone putting AI to the task of building better defenses? What is the current role of AI in all this? Wow, that's another podcast in and of itself, really. I'll keep it to the two key things. AI is really good at finding vulnerabilities. Yeah. So we are concerned about its ability to find vulnerabilities in key equipment that we're concerned about. So yes, it will definitely accelerate that arms race. At the same time, we're using AI to patch those vulnerabilities. So the manufacturers can, well, they'll see there's a problem and they'll write a patch for it.

56:55And we can, the challenge is this is like grid equipment. So we may have to do things like, okay, general public, are you okay if we have like a blackout window and we schedule it because we got to patch stuff? Because most of the time you can't just like take these systems offline. Yeah, like an operating system update. Yeah, you know, yeah, got to reboot. It's enough of a pain in the butt on your personal computer, but if the whole grid has to do it. Yeah, if you got to reboot a section of the grid, that's a problem. So we're looking at ways to try to work this into operations. Some of it's going to be redundancy or, you know, moving the grid, the power over to a certain line while you, you know, restart those systems and try to get, build this into our operations and our behavior practice because we haven't done this yet, right?

57:39We got to figure out how to make this work. So we're in the process of that as an industry. And obviously the manufacturers have definitely, the light bulb has gone off and they're reacting and they're using AI to write patches for the vulnerabilities that the bad guys are finding. Now, the next piece is one of the bigger concerns that is not, we don't have an answer for yet. It's the ability to model the grid was pretty difficult in the past. It took a lot of computing horsepower. AI is actually really good at this. And you can model large sections of grid, if not the whole grid. You can overlay other infrastructures like transportation and communications and gas and the ability to cause a multi-infrastructure cascade by key component attacks in just the right number and frequency, basically like the sequence of infrastructure is to cause a larger problem.

58:37them. So we're worried about that. It's being discussed. It hasn't really, like we're trying to model it ourselves and figure out, oh, you know, if they're doing it, we should probably be looking at these same kind of key weaknesses and how do you get these cascading interdependencies down, this kind of stuff. So the thing that started is DHS CISA, CISA, put out what's called CI Fortify. This is the Cybersecurity and Infrastructure Security Agency. I wrote that It's got security in its name twice. That's really secure. But they put out one called CI Fortified. The goal is at least, if there's a problem, to get these, and it's not a requirement yet, this is still a suggestion, but to have these environments disconnect.

59:20Just what does it take for you to island yourself off? And in the business, we call it turtle mode. How do you like clamp down the shell until the danger passes and you peek open and you see that things are okay, and then you can, you know, pop your arms and legs out and keep going. So it's trying to get owners and operators of all the different infrastructures to go do an exercise on what's a day without connectivity look like? What's a week look like? Can you lock down in turtle mode and still operate and keep essential services running, even if not everything is working, but enough is? So we're at least trying some approaches.

59:57So these are like water systems, transportation systems. Gas, electric. Whatever, all the gas systems. Man, that's a whole new Pandora's box right there. Yeah. Trying to get multiple infrastructures to coordinate their behaviors just seems like it's a whole new layer. Well, if they can even do it on their own, great. Let's just start with them, figure this out what it looks like in your own little environment. Right. And then we'll look at what it does in terms of the interdependencies that cascade out. But yeah, I mean, think of like the dependence of electricity on the gas, right? We have a lot of gas generators, especially now for AI.

1:00:33Almost all of them are going to be gas generators. So it's amazing to try to think about this and wrap your head around it. But like I say, that's something we are at least discussing. We're starting with, you know, at the asset on our level, could you do this? Could you operate? And then we'll figure out what is now when you're doing it, what are the interconnectivity? What's the interdependency issues? And then we'll kind of take it out from there. But it's on our minds. It's interesting. It's hard not to, you know, it's hard to hear about this stuff and not get a little sci-fi dystopian about it, about a future where sort of like our massive super intelligent AIs are just battling their massive super intelligent AIs.

1:01:14And at some point, like, it's going to be hard for any human to even really know what's going on anymore, to wrap their head around any of it, you know, like eventually it's just going to be the robots. the robots battling over our infrastructure. That's why we're trying to put in a lot of that cyber-informed engineering underpinning so that, you know, even if the cyber causes problems, physics is still physics, you know. A couple of final questions. One that I'm just curious about. One is, and maybe this is naive to even ask it, but like, are we trying to sneak, you You know, are we trying to sneak stuff into China's systems too?

1:01:56I mean, I kind of assume we are. I mean, if we're not, then shame on us. I mean, I really think those are kind of table stakes for nation states at this point. So we're remarkably capable at what we do. I mean, we're arguably the best in the world at cyber anything. So one would have to believe that that's a reality. Yeah. It's just going to seem like all these forces are pushing toward, you know, kind of reversing the trend of the last century almost towards greater trade and greater independence or interdependence. Like, it seems like this is going to want to cause countries to want to domestically manufacture everything so that they can keep an eye on everything.

1:02:45You know what I mean? Yeah. I think there is a push for that right now. There's a lot of balkanization of manufacturing, of, you know, sovereignty of various things. What we've seen in most cases that actually solves the problem, and I'm working on various different channels. I've got operations in Europe as well. It's about, it's transparency. So that there are open frameworks and everyone operates against the framework and everyone can see what's in there and transparency. Think about what happened with encryption. There used to be like, you know, export rules on certain types of encryption.

1:03:15well now we just make it so that it's you know it's open everyone can see it and it gets all the transparency that's needed and it still works so there are ways to do this where you have transparency into how it's done what's being done and everyone can agree upon kind of what the standards are uh and then once and there's you know i triple e there's iec there are bodies that do this already and do it very well um so yeah i think it's gonna we'll we'll have a push where everyone goes into their little hole for a while and realizes, okay, we can't do this. We just can't survive like this. So the pendulum will swing and then it will have to swing back.

1:03:53And all of us that are pushing the pendulum back to the direction, we're all going, look, you know the solution to this is transparency. So let's just start there now. Interesting. Another question is, when you read, or at least when I've read about attacks on the grid that actually do damage, it's squirrels or like rednecks with rifles shooting at transformers. Like, how do you rate the physical threats to the grid relative to the cybersecurity stuff? Orders of magnitude worse than the cyber. Interesting. Orders of magnitude, without question. Interesting. Yeah, absolutely. It's been, it's largely squirrels, raccoons, snakes, scorpions.

1:04:34I've seen a whole bunch of different things. Mylar balloons, believe it or not, are actually a bigger threat than cyber. You know, so, you know. Has anybody weaponized Mylar balloons yet? No, no. But there was like a Twitter account called like Mylar Squirrel, and it would track all the attacks with just things that happened to the grid from like squirrels to balloons to raccoons to, yeah, I think it's stopped. But it's far, far bigger issue. I mean, it causes a lot more damage than cyber. And you think the vulnerability is greater? Like, I mean, that's what's... From a physical standpoint? Oh, absolutely.

1:05:08Yeah. I mean, you can physically... Well, that's what I mentioned earlier, the physical protections for big transmission in the SIP standards. There's a specific standard for that. Like, you actually have to protect the transformers from gunshots. Like, you have to put up ballistic protection for the transformers. Yeah. Because they're... I mean, it's a bigger threat. Yeah. I wonder... That's another one that just seems like as the grid distributes, as, you know, everything moves outward again. You're just like, you're not going to get every warehouse to hire armed guards and put up ballistic fences.

1:05:43Like again, you're just, your attack surface is so huge. It is. One of the good things about that is if you distribute the attack surface to a much, you know, more diffuse set of assets, you actually take the threat away in a lot of cases because they physically can't get everywhere. Right, right, right, right. Any single attack will have smaller consequences, I guess. Yep. Yep. Okay. So let's wrap up with this question. Right now, the aforementioned CISA, the Cyber Security and Infrastructure Security Agency, is getting cut, much like much of the rest of the federal government is getting slashed, its budget and staff.

1:06:23I'm just curious, your sort of overall assessment, you've written an essay actually saying that critical infrastructure cyber regulation is headed in the wrong direction. I'm sort of curious, your overall assessment, like, are we doing this correctly? And what is, if not sort of broadly speaking, what is the course correction you would like to see? Again, a whole other pod. That is a whole other pod. I'll keep it short. I do lament the cuts to CISA. It is, American infrastructure needs this desperately. We've got a mix of things. The regulators are all different. We need something that is a centralized and a harmonized effort that helps all of them.

1:07:07And most of what they've done so far has been fantastic outreach. They've done some really good information products that have helped a lot of people. They raised the floor for a lot of those asset owners that you mentioned that just don't, they can't hire a security team, But they can take this template and apply it because it's free from CISA. And CISA did the work for you. And you don't have to wonder, is this going to work? You've got an authoritative source to get good stuff that helps you and raises the floor. So I would love to see more funding in CISA. I would love to see more activity from CISA.

1:07:41I don't want them to become a regulatory agency, but I love what they do with, you know, their known exploited vulnerabilities list, which this is a different thing. when you hear of a vulnerability that happens, like, you know, Microsoft says, oh, we have a problem, go do something. What CISA does is if no one is exploiting this, okay, probably lower priority. But the minute someone's actually, like attackers are actually using this, it goes on this special list that CISA maintains. That gives us the priority. And because when you've got 100 vulnerabilities to deal with, well, which ones matter?

1:08:13This tells you. So that kind of work is absolutely useful. And they need to be doing more of that. Now, the follow on of kind of where should we go and what would if I had one rule that I could change and I get this question as a former regulator and someone who writes a lot of regulation all around the world at this point. I like the CIRCIA. It is C-I-R-C-I-A. It's an incident response reporting act that was put out. It's gotten a lot of negative attention because people don't want to report their incidents. And I get it. No one wants to air their dirty laundry. Right, right. Yeah, I guess it's embarrassing.

1:08:47It's embarrassing. right? And in some cases, you got to put it on your 10K right now and you got to report to the SEC, but people get around that and their lawyers step in and they, you know, they water it down. My issue with this is we don't know what is working. We don't know what the attackers are doing. We don't have any actuarial data without this kind of reporting. We need something there. And I'm not saying like, you know, make them divulge everything, but we should have at least some data that we get that's useful, like a handful of things. Because the corollary is if You know, we know that if I, you know, eat bacon cheeseburgers every day and I smoke and I never exercise and I never move, you know, Patrick's likely to die at age 45 of these conditions because we have, you know, hundreds of years of actuarial health data.

1:09:32We don't have anything like, we're basically guessing. So without this, what is happening, what's working, we don't know where to put our money and our protections. I think this would actually really benefit us. If we could do one thing, we need to see what's actually happening. because it helps us make regulation. It's a federal law. Is that a federal rule? Yeah, it's a federal rule for critical infrastructures. And there's, you know, a handful of them that get roped in first, that kind of thing. But we don't, right now it could happen. And, you know, if it wasn't a big enough issue, they could just hide it.

1:10:06And which, you know, I get companies may want to do that, but the rest of the industry and the rest of the populace, we need this data to know what's working and what's not. It helps regulators, it helps insurance, It just helps everybody all around. And when you say that cyber regulation is headed in the wrong direction, what do you think we're, what do you mean by that? What do you think we're doing wrong? I think we are, we need to harmonize a lot of our regulations. Like each individual infrastructure has their own, you know, authoritative body and they're all going in different directions.

1:10:37They've all got different penalty structures. They've all got, if you're a company that owns a gas infrastructure and an electric infrastructure or an electric and a water infrastructure, You got different and entirely different compliance organizations and different experts. The software companies have to write different versions of the software. I mean, we could standardize a lot of this stuff because realistically, I mean, this is all the same stuff. It's flow control, whether it's gas, electric, water, transportation, it's all flow control. So we're kind of doing the same things. The technologies are all roughly the same.

1:11:08We could make this a lot easier for a lot more organizations. And then we could even introduce easier guidance. So we wouldn't have guidance for just like the gas operators or the electric operators. We'd have guidance. So we need to get to a place where we're not doing this in such weird silos. And I get there are differences. Don't get me wrong. But there's a core component of this outside of those, you know, fairly small number of differences that could be done in a uniform way with a lot less wasted time and effort and money. Interesting. All right. Well, this has been so fascinating. Thank you so much.

1:11:43Thank you so much, Patrick. I feel like 100 % better grounded at this point. Thanks for walking us through it. Sure. Anytime. Thanks, everybody. You've been listening to Volts, founded and hosted by me, David Roberts, produced by Nate Peavy, and supported entirely through the generosity of listeners like you. If you enjoyed this conversation, please consider telling a friend about Volts. That's how this show grows and survives, through word of mouth. See you next time.