FERC Commissioner Cheryl LaFleur: Step Up on Grid Security or Step Down!

Has Commissioner Cheryl LaFleur – and the rest of FERC – dropped the ball on grid security?

Commissioner Cheryl LaFleur joined the Federal Energy Regulatory Commission (FERC) in July of 2010. Another interesting thing happened in July of 2010: The North American Electric Reliability Corporation (NERC) started covering up the names of entities that violate critical infrastructure protection (CIP) standards. Coincidence?

To be fair, there are other FERC Commissioners and FERC as an agency has fallen far short on grid security. All the Commissioners are culpable. Why then am I singling out Commissioner Cheryl LaFleur? She is by far the longest serving Commissioner at FERC (confirmed in 2010). Chairman Neil Chatterjee and Commissioner Richard Glick came in 2017. Commissioner Bernard L. McNamee was just confirmed in December of 2018. And unfortunately, Commissioner Kevin J. McIntyre, who was appointed to FERC in 2017 just passed away this month.

To most Americans, FERC is a rather obscure federal agency. Most people probably don’t know much about it or the mind-numbingly complex regulatory scheme of the electric grid. Most Americans don’t realize that FERC is the only thing standing between the United States and long-term, widespread electric grid blackout — a disaster of unimaginable proportions. In fact, our very lives depend on the electric industry doing the right thing – and, alarmingly, there is no requirement that they do the right thing. But I digress…

Before starting with FERC as an industry regulator, Commissioner Cheryl LaFleur was the ultimate industry insider: among other things, she worked as the executive vice president and acting CEO of National Grid, a major New England utility. Immediately upon switching her hat from regulated to regulator, she seems to have found a kindred spirit in disgraced former NERC CEO Gerry Cauley. Together, NERC and FERC began an overt cover up of the identities of the violators of CIP standards. After all, what is more embarrassing to a utility company than to have the public know the company who endangered them? (Besides, electric utilities routinely say to FERC it is “unduly burdensome” to protect the grid.)

So, in July of 2010 NERC brazenly began withholding the names of the companies that violated CIP standards. Unfortunately, regular Americans, who are busy earning their livings and caring for their families, take little notice of administrative dockets, regulatory regimes and bureaucratic filings. FERC – who is supposed to be the cop on the beat protecting us – has looked the other way. For eight and a half years, like the fabled three little monkeys, the FERC Commissioners have seen, heard and said nothing.

Commissioner Cheryl LaFleur: Why after eight and a half years of your leadership – including a stints as Acting Chairman and Chairman of the Commission – is the electric grid still in such grave danger? I am more and more convinced that FERC is part of the problem.

The Fact That FERC and NERC Prefer You Don’t Know

In America, we love “self-regulation.” Wall Street is partially self-regulated, for example, by the Financial Industry Regulatory Authority (FINRA). The electric grid is also partially self-regulated and the regulatory scheme is clearly not working. Why? One reason is the lack of transparency. The American people do not get enough information to evaluate whether the federal regulator (FERC) is too chummy with the self-regulatory body (NERC) and the regulated entities (your local power company and others).

The broken regulatory scheme is just fine with the electric utility industry, whose interests are well served by their mouthpiece, NERC. In fact, the regulatory scheme is not an accident, it is the result of electric utilities lobbying Congress. How do we fix this?

“Publicity is justly commended as a remedy for social and industrial diseases. Sunlight is said to be the best of disinfectants; electric light the most efficient policeman.” – Justice Louis D. Brandeis

Disclosure is the cornerstone of a successful regulatory scheme in a free society. The Securities and Exchange Commission routinely publicizes the names of companies and individuals subject to regulatory actions under U.S. securities laws; The Food and Drug Administration routinely publicizes the names of companies whose food is being recalled due to public safety concerns; The National Highway Traffic Safety Administration routinely publicizes the names of companies whose vehicles or parts are being recalled due to public safety concerns, and there are numerous other examples. When these public disclosures inform citizens of regulatory shortfalls, they prod federal agencies and Congress to make changes.

Not so for the electric utility industry. Between 2010 and 2018, there have been 243 FERC dockets involving 1465 “Unidentified Registered Entities” – the industry euphemism for CIP violator because NERC does not want to reveal who their regulated n’er-do-wells are to the American people. This is a massive game of “stump the chump” – and the American people are being played for fools.

How the FERC / NERC Cover Up Happened.

Prior to July of 2010, the identities of companies violating CIP regulations were disclosed and available for public scrutiny. For example in FERC Docket NP10-2-000 FERC noted:

Of the 564 penalties submitted, the great majority concern entities registered with WECC. FRCC submitted 63 penalties; MRO submitted two; RFC submitted 23; SERC submitted three; SPP submitted 11; and WECC submitted 464. Violations of Requirements R1 through R4 of Reliability Standard CIP-001-1, requiring procedures for sabotage reporting, accounted for the largest number of penalties.

(Emphasis added.) As you can see from the below article, names were named and this information was very useful for the public, law firms and others to analyze the regulatory actions: NERC Case Notes: Reliability Standard CIP-001-1 (White & Case LLP).

However, on July 6, 2010 NERC began withholding the names of companies who violated CIP regulations. On that day, NERC submitted numerous NOPs to FERC. The last CIP violation where an entity was actually named occurred on that date – Docket number NP10-125-000.(Covanta York Renewable Energy, LLC has the dubious distinction of being the last violator outed before the cover up!) That same day, numerous other Notices of Penalty (NOP’s) were submitted with the name of the entity withheld. The first appears to have been NP10-130-000.

Reduced disclosure now comes in several forms: A “Notice of Penalty” or NOP will typically have the story for one entity and its violation(s). A “Spreadsheet NOP” will typically have an Excel spreadsheet with numerous entities and their violations. Finally, in 2011 NERC started another track called “Find, Fix, Track” or FFT. These disclosures initially looked similar to the “Spreadsheet NOP” but covered allegedly minor violations. (NERC stopped disclosing the FFT information with the NOPs on their website in 2013 – a further blatant lack of transparency.)

FERC apparently has been complicit in this cover up; it is hard to believe they were just asleep. They have allowed the industry to wag the regulatory dog. Perhaps it shouldn’t be surprising that that Commissioner Cheryl LaFleur is a big supporter of the FFT scheme. Click here for her statement on FFT. I’m not against regulatory streamlining in general, but it is problematic that it is being used to hide CIP violations. Commissioner LaFleur says:

“The essence of the proposal is to allow streamlined processing of remediated issues that do not pose a significant reliability threat, in order to free up resources to focus on more significant reliability issues.”

Really? CIP violations do not pose a significant reliability threat? What does CIP stand for again? Oh yeah. Critical Infrastructure Protection. Nothing significant about those violations.

Bottom line: The FFT program has been used to sweep numerous CIP violations under the proverbial carpet – and now these are no longer even disclosed on NERC’s website! Are these CIP violations “minor”? I wish I could tell you, but at least the industry assures us they are. Why do I not feel comforted?

NERC’s complete lack of self-regulatory teeth.

You will notice that the vast majority of these anonymous regulatory actions are “settlements.” However, the public is not provided with a copy of the settlement agreement to review. In several instances, we have found that NERC and its regional entities have settled with uncooperative companies and companies that were “not fully transparent and forthcoming.” In other words, the uncooperative and unforthcoming companies paid a fine they agreed to pay and didn’t need to have their identity disclosed. A great deal for them – and a horrible deal for the public interest. In many of the settlement agreements, not only do they not get outed to the public, and get to pay a fine they agree to pay, they don’t even have to admit fault. The fines are probably minor in comparison to the utilities’ income—but we can’t tell for sure because the identities of the utilities are concealed! How convenient for investor-owned utilities and their shareholders.

Ouch did that NERC fine hurt? No, I guess not.

Conclusion

After the FERC/NERC cover up started in July of 2010, the concealment of the identities of these “Unidentified Registered Entities” withheld on all of these regulatory actions has resulted in less incentive to fix the grid security problems. That’s why disclosure is important. Why spend money to fix that pesky cyber security issue if you know that 1) if you get caught, your chummy regulator will “settle” the violation with you privately, 2) you can negotiate the fine you want to pay, and 3) your name will not be disclosed to the public?

The American people have a right to judge for themselves whether the FERC/NERC regulatory scheme – which is being blessed off by our government every day – is working. Especially since the security of the electric grid is so critical to our very existence.

Click here to read my first FOIA Request

Click here to read my second FOIA Request

Download List of “Unidentified Registered Entity” Dockets

These are the 243 FERC Dockets between 2010 and 2018 where the names of the violators were hidden from the public.