US warns of Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure

Thursday, March 22, 2018

The U.S. Department of Homeland Security has warned that for at least two years, Russian government cyber actors have targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.

In a joint Technical Alert issued March 15, 2018 by the Department of Homeland Security's U.S. Computer Emergency Readiness Team (US-CERT) and the Federal Bureau of Investigation, the agencies warned of a "multi-stage intrusion campaign by Russian government cyber actors." The report follows an October 2017 alert by computer security firm Symantec of a re-emergence of a sophisticated cyber espionage group known as "Dragonfly."

According to the government agencies' report, the Russian cyber threat actors seem to have deliberately targeted specific organizations, as opposed to pursuing targets of opportunity. In an initial "staging" phase, the campaign used tools like malware, watering holes, and spear phishing to gain access to small commercial facilities' networks -- typically peripheral organizations like trusted third-party suppliers whose networks may be less secure. For example, the threat actors sent emails with malicious attachments appearing to be personnel resumes or contract documents. Clicking on links in the attachments exposed the victims to malware or data harvesting. In a subsequent phase, the threat actors made further use of the staging targets' networks as "pivot points and malware repositories" for use in targeting their final intended victims.

The report says that these Russian government cyber actors used this hacked access for network reconnaissance and collection of information pertaining to Industrial Control Systems (ICS). It describes multiple instances of threat actors accessing workstations and servers on corporate networks that contained data output from control systems within energy generation facilities.

Cyber security is now a significant concern, both domestically and abroad. A February 2018 report by the U.S. intelligence community described the targeting of national security information and proprietary information from US companies and research institutions involved with defense, energy, finance, dual-use technology, and other areas as "a persistent threat to US interests." Last month, U.S. electric grid reliability regulators imposed a $2.7 million penalty on an unidentified utility for its violations of mandatory reliability standards in connection with a data security breach -- the largest fine to date associated with U.S. utility cybersecurity regulation. In that case, a third-party contractor hired by the utility allegedly copied protected data from the utility's network to the contractor's unsecured network -- where it was accessible online without the need to enter a user ID or password, and where it was in fact accessed by one or more unknown outside entities.

In 2014, reports emerged that Russian hackers had found flaws in solar panel monitoring software that, if left unfixed, could allow malicious actors to damage the electric grid. Foreign state-sponsored cyber attacks in 2016 and 2017 against Ukraine and Saudi Arabia targeted multiple sectors across critical infrastructure, government, and commercial networks, causing disruption to Ukrainian energy distribution networks.

FERC disallows MLP pipelines' recovery of income tax allowance

Wednesday, March 21, 2018

U.S. energy regulators have revised their policies, and will no longer allow master limited partnership (MLP) interstate natural gas and oil pipelines to recover an income tax allowance in their cost-of-service rates. The Federal Energy Regulatory Commission issued its Revised Policy Statement on Treatment of Income Taxes following a 2016 federal court order addressing the topic.

At issue is the Commission's policy on how MLP pipelines may set their cost-based rates. As described by the Commission, an MLP is a partnership form in which units are traded on exchanges much like corporate stock. To be treated as an MLP for Federal income tax purposes, an MLP must receive at least 90 percent of its income from certain qualifying sources, including natural gas and oil transportation.

MLP pipelines are not corporations, but are pass-through entities. This means that MLPs are not taxed at the pipeline level; instead, for tax purposes, the partnership agreement allocates to each partner a share of the partnership’s taxable income, and each partner is personally responsible for paying income taxes on the partnership’s net taxable income.

From 2005 until a 2016 court ruling, the Commission's 2005 Income Tax Policy Statement allowed all partnership entities (including MLPs) to recover an income tax allowance for the partners' tax costs, much like a corporation receives an income tax allowance for its corporate income tax costs. Alongside this income tax policy, the Commission has used a discounted cash flow (DCF) methodology to determine the rate of return regulated entities need to attract capital.

In 2008, a pipeline MLP named SFPP, L.P. filed a cost-of-service rate increase to increase the rates for a line running between California and Arizona. Shippers protested the filed rates, including the interaction between (a) the Commission’s policy permitting an income tax allowance policy for partnership business forms (such as SFPP) and (b) the Commission’s DCF methodology used to determine a cost-of-service rate of return. The Commission eventually issued orders addressing issues in the case including the income tax allowance issue, which were challenged in court.

On appeal, in 2016 the United States Court of Appeals for the District of Columbia Circuit issued a decision known as United Airlines, Inc. v. FERC, 827 F.3d 122 (2016). In that case, the D.C. Circuit held that because both the partnership income tax allowance and the DCF ROE may include investors’ tax costs, permitting both may result in a double recovery, and remanded the case back to the Commission for further action.

This week, the Commission took that further action. It issued an order in the SFPP case denying that MLP an income tax allowance. More holistically, the Commission concurrently issued a Revised Policy Statement on Treatment of Income Taxes. In the revised policy statement, the Commission found that "an impermissible double recovery results from granting a Master Limited Partnership (MLP) pipeline both an income tax allowance and a return on equity pursuant to the discounted cash flow methodology."

NH revises, reopens C&I solar rebate program

Tuesday, March 20, 2018

New Hampshire utility regulators have reopened a program offering a rebate to commercial and industrial electric customers who undertake qualifying solar energy projects, while reducing the size of the incentive and changing other program terms.

To encourage commercial and industrial (C&I) customers to participate in solar photovoltaic and solar thermal energy projects, the New Hampshire Public Utilities Commission first approved a solar rebate program in 2010. That program disburses funds from the state's Renewable Energy Fund to customers in exchange for customers' development of qualifying solar projects.

Terms and conditions for New Hampshire's C&I solar rebate program have varied since 2010, and the amounts of rebates available under the program have generally decreased over time. In 2015, the Commission created two separate categories of eligible projects with different rebate rates: Category 1, consisting of solar electric and thermal systems rated less than or equal to 100 kilowatts (AC) or thermal equivalent, and Category 2 consisting of solar electric systems greater than 100 kilowatts (AC) but less than or equal to 500 kilowatts (AC).

A 2016 Commission order set program rebate levels at $0.65 per watt (AC) for Category 1 new electric projects, and $0.55 per watt (AC), but not in excess of $175,000, for Category 2 new electric projects, in each case subject to a limit of 25 percent of the total project cost if less than the incentive payment otherwise calculated.

But the program closed to new applications as of July 14, 2017, due to "record demand" and a lack of funds. Even the allocation of additional funds only reopened the program for waitlisted applications, while keeping it closed to new applicants.

On February 13, 2018, Commission staff recommended reopening the program, while modifying it to further reduce the applicable incentive levels and to consolidate Category 1 and 2 projects into a single program that would allow applications for projects with capacities up to and including 500 kW AC.

On March 8, 2018, the Commission issued its Order No. 26,111, modifying the solar rebate program's terms and reopening the program. The changes include reduction in the amount of the rebate to $0.40 per watt up to a maximum of $50,000, or 25 percent of total project cost, whichever is less; and consolidation of Category 1 and 2 photovoltaic projects into a single program that would allow applications for projects with capacities up to and including 500 kilowatts AC. No change was made to the program terms and conditions applicable to solar thermal projects.

Under the order, the modified program terms and conditions became effective on March 19, 2018, and the program was reopened as of that date. The Commission noted that in anticipation of "robust demand for and potential oversubscription of the reopened program," it will conduct a public lottery in April to allocate initial queue positions for applications.

FERC acts on 2017 tax cuts

Monday, March 19, 2018

Federal utility regulators have taken a portfolio of actions in response to recent changes to U.S. tax law which reduced the tax rates applicable to many electric utilities and pipeline companies. Some rates for use of infrastructure will be reduced automatically, while regulators prompted others to explain why they should not be reduced to reflect the tax law changes. At the same time, regulators have opened an inquiry and proposed a rulemaking to address further aspects of the 2017 federal tax law change.

Late last year, Congress enacted the Tax Cuts and Jobs Act of 2017. That law amended U.S. tax law in a variety of ways. Among other things, the 2017 tax law changes reduced the federal corporate income tax rate from a maximum 35 percent to a flat 21 percent rate, effective January 1, 2018.

Many electric utilities and natural gas and oil pipeline companies stand to benefit from this tax reduction in the form of reduced income tax expense going forward, as well as a reduction in accumulated deferred income taxes on the books of rate-regulated companies. Where tax expense decreases, so does the cost of service.

Rates for use of some federally regulated energy infrastructure are set based on cost of service. On March 15, 2018, the Federal Energy Regulatory Commission took a series of actions to address the effect of the tax law changes on its regulated industries including electric transmission companies, interstate natural gas pipelines, and oil pipelines. According to the Commission, its actions “recognize the specific regulatory and operating parameters that must be addressed differently for each of the industries it regulates.”

Transmission rates for most FERC-regulated utilities automatically adjust with changes in the tax rates based on a formula whose inputs are updated annually or on some other regular cycle. For these utilities, a reduction in corporate income tax means a reduction in rates, although the ratemaking process means there can be a lag in time before rate reductions take effect.

But in some cases, utility tariffs provide for rates are either stated as a fixed number, or the formula includes a fixed tax rate. The Commission identified 48 companies whose transmission tariffs specifically reference tax rates of 35 percent. In a pair of show-cause orders issued under the Federal Power Act -- one for utilities with stated rates, and one for utilities with formula rates referencing 35 percent -- the Commission directed these companies to propose revisions to their transmission rates or show why they should not do so. It also issued two waivers allowing certain utilities mid-year rate adjustments to reflect the new tax law.

Interstate natural gas pipelines typically have stated rates for their services. These rates are approved by the Commission in a rate proceeding under Natural Gas Act sections 4 or 5 and remain in effect until changed in a subsequent section 4 or 5 proceeding. To revise its practices with respect to natural gas pipelines, the Commission issued a Notice of Proposed Rulemaking that would allow it determine which pipelines under the Natural Gas Act may be collecting unjust and unreasonable rates in light of the corporate tax reduction and the Commission’s recently revised policies on income tax allowance. Under the rule proposed by the Commission, interstate pipelines would need to file a one-time report called “FERC Form No. 501-G” describing the rate effect of these changes. In addition to filing the one-time report, each pipeline would have four options: a pro rata rate reduction, a rate settlement or case, an explanation why no rate change is needed, or merely filing the FERC report and letting the Commission decide if further action is required.

While cost-of-service ratemaking typically applies to public utilities and interstate natural gas pipelines, most oil pipelines set their rates using indexing. With respect to oil pipelines regulated by the FERC, the Commission said it will address tax changes in the 2020 five-year review of the oil pipeline index level.

Concurrently, the Commission opened an inquiry into the effect of the Tax Cuts and Jobs Act of 2017 on all jurisdictional rates, including whether the Commission should address certain changes relating to accumulated deferred income taxes and bonus depreciation. In a presentation to the Commission, staff described this Notice of Inquiry as "a vehicle to help the Commission build a record to determine whether additional action is needed."

In a separate policy statement and order issued on March 15, the Commission revised its policies to disallow income tax allowance cost recovery in MLP pipeline rates.

ISO-NE files 12th capacity auction results

Monday, March 12, 2018

The organization responsible for New England's wholesale electricity markets has announced the results of its twelfth annual forward capacity auction. According to grid operator ISO New England, Inc., its FCA 12 concluded with sufficient resources to meet electricity demand in 2021-2022, at the lowest price in five years.

As in some (but not all) other organized electricity markets, New England's electricity market design includes a wholesale energy market as well as a forward capacity market. Operated by ISO New England, the Forward Capacity Market or FCM is designed to secure capacity resources sufficient to meet future demand. The capacity market is separate from the energy market, and can provide additional revenues for qualified resources.

The grid operator conducts annual Forward Capacity Auctions or FCAs, held three years in advance of each one-year operating period. Generation and other capacity resources such as load management or energy efficiency can compete in these auctions to obtain monthly market-priced capacity payments during the delivery year, in exchange for the obligation to supply capacity -- and supply energy or curtail demand when dispatched by the ISO in that future period. Capacity revenues can support the development of new resources as well as the retention of existing plants by providing predictable cash flows and incentivizing consistent resource availability.

ISO New England held its twelfth FCA on February 5 and 6, 2018, auctioning off capacity supply obligations for the capacity commitment period of June 1, 2021 through May 31, 2022. On February 28, 2018, ISO New England submitted its forward capacity auction results filing for FCA12 to the Commission. According to the filing, the descending clock auction commenced with a starting price of $12.684/kW-month, with resources in most zones to be paid at a clearing price of $4.631/kW-month based on the system sloped demand curve. About 1,100 megawatts of imports over certain interfaces with Canada will be paid at reduced capacity clearing prices. These prices are all below recent ISO-NE forward capacity auction results.

Through FCA12, ISO-NE procured 30,011 megawatts of generation, including 174 megawatts of new generation. The auction also acquired about 3,600 megawatts of energy efficiency and demand-reduction measures, 514 megawatts of which is new. The grid operator estimated the total cost of the capacity market in 2021-2022 to be approximately $2.07 billion.

ISO noted that it had rejected two "de-list bids", or requests by existing generators to leave the capacity market, for local reliability reasons. It identified those bids as coming from Exelon Generation Company, LLC with respect to its Mystic 7 and 8 units, totaling about 1,278 megawatts. As described in supporting testimony, ISO asserted that "allowing the resources to leave the market would have resulted in a violation of NERC, NPCC, or ISO criteria." According to a related press release, ISO found that "transmission lines in Greater Boston could be overloaded if Mystic 7 and Mystic 8 were not available during 2021-2022."

ISO described the results of the auction as just and reasonable, and asked the Commission to accept the filing.

FERC Order 842 requires primary frequency response by generators

U.S. energy regulators have issued an order amending standard interconnection agreements to require new generators to install, maintain and operate a functioning governor or equivalent controls capable of primary frequency response as a precondition of interconnection. The Federal Energy Regulatory Commission's Order No. 842 also amended the pro forma interconnection agreements to include certain operating requirements including maximum droop and deadband parameters, and sustained response provisions.

As described by the Commission, reliable operation of an alternating current grid requires maintaining system frequency within predetermined boundaries above and below 60 Hertz. Frequency response describes an interconnected grid’s ability to arrest and stabilize deviations from this predetermined range of frequencies after a sudden loss of generation or load.

Historically, the U.S. grid's primary frequency response capability came from baseload synchronous generators such as coal-fired power plants. But many such plants have retired in recent years, with further retirements expected. In 2016, the Commission noted that shifts in the portfolio of U.S. electric generators meant fewer resources could likely provide primary frequency response, especially if new variable energy resources such as wind and solar did not provide this service. In response, it opened an inquiry into what primary frequency response reforms it should make.

On February 15, 2018, the Commission issued its Order No. 842 revising its regulations to require newly interconnecting large and small generating facilities, both synchronous and non-synchronous, to install, maintain, and operate equipment capable of providing primary frequency response as a condition of interconnection. The final rule also amends the Commission's pro forma interconnection agreements to include certain operating requirements including maximum droop and deadband parameters, and sustained response provisions. It provides exemptions for nuclear power plants and some combined heat-and-power plants.

These requirements will apply to most newly interconnecting generation facilities that execute, or request the unexecuted filing of, an LGIA or SGIA on or after the rule’s effective date, as well as to existing large and small generating facilities that take any action that requires the submission of a new interconnection request that results in the filing of an executed or unexecuted interconnection agreement on or after the effective date.

In a press release, the Commission said its action was intended to address "the increasing impact of the evolving generation resource mix." Commissioner LaFleur made a separate statement in which she noted that while decreases in the nation's portfolio percentage of synchronous generation have contributed to declining frequency response performance, "recent technological advancements have enabled new non-synchronous generating facilities, such as wind and solar, to cost-effectively include primary frequency response capabilities in their facilities." Improved inverters and battery storage are among these innovations.

The Commission has also recently noted the potential of electric storage resources to provide frequency response and other services. Its Order No. 841 is designed to remove barriers to the participation of electric storage resources in wholesale markets operated by regional transmission organization and independent system operators, including markets for frequency response.

NERC fines utility $2.7 million for cyber breach

Friday, March 9, 2018

The electric reliability organization responsible for the grid spanning much of North America has penalized an unidentified utility $2.7 million for its violations of mandatory reliability standards in connection with a data security breach. The penalty may be the largest fine to date associated with U.S. utility cybersecurity regulation.

NERC, or the North American Electric Reliability Corporation, is charged by U.S. law with ensuring the reliability of the nation's bulk power system. NERC establishes reliability standards for the bulk electric system, which are approved by the Federal Energy Regulatory Commission, and takes action to monitor and enforce compliance with its reliability standards.

On February 28, 2018, NERC filed with the Commission a Notice of Penalty regarding what it described as noncompliance by an "Unidentified Registered Entity (URE)", following a settlement between the anonymous utility and regional reliability group Western Electricity Coordinating Council (WECC).

Some of the details of the underlying fact pattern are protected from public disclosure as Critical Energy Infrastructure Information or CEII. But NERC's public filing says the settlement arose from WECC's determination and findings that the anonymous utility violated two of NERC's Critical Infrastructure Protection or CIP cybersecurity standards. According to NERC's report, the utility received a report that an outside "white hat security researcher" had found data publicly available online which appeared to be protected information associated with the utility.

Following this tipoff, an investigation by the utility and regional reliability group WECC revealed that a third-party contractor hired by the utility had copied data from the utility's network environment to the contractor's network environment, where it was no longer subject to the utility's visibility or control -- in violation of the contractor's authority. While the data was on the contractor's network, a subset of live utility data including over 30,000 records was accessible online without the need to enter a user ID or password for a period of 70 days. These records included some associated with the utility's Critical Cyber Assets, such as servers storing user data, systems controlling physical access within the utility's control centers and substations, and supervisory control and data acquisition or SCADA systems. System logs showed unauthorized access to this data set by both the white hat researcher and unidentified IP addresses.

According to the Settlement Agreement, the anonymous utility neither admitted nor denied the violations, but agreed to pay a $2,700,000 penalty and take other compliance actions. This may represent the largest fine to date for violations of NERC's CIP standards. While federal penalty policy encourages self-reporting of violations and having an internal compliance program in place -- as the anonymous utility did -- the settlement notes that the utility "was not fully transparent and forthcoming with all pertinent information detailing the data exposed in the incident." In particular, the settlement says the utility did not initially provide WECC with all the data fields exposed in the incident. These factors, combined with a finding that the violations posed a serious and substantial risk to the reliability of the bulk power system, led WECC to set the penalty amount at $2.7 million, which NERC subsequently approved.

By federal rule, the penalty will be effective upon expiration of the 30-day period following the penalty notice's filing with the Federal Energy Regulatory Commission or, if FERC decides to review the penalty, upon final determination by FERC.