NERC fines utility $2.7 million for cyber breach

The electric reliability organization responsible for the grid spanning much of North America has penalized an unidentified utility $2.7 million for its violations of mandatory reliability standards in connection with a data security breach. The penalty may be the largest fine to date associated with U.S. utility cybersecurity regulation.

NERC, or the North American Electric Reliability Corporation, is charged by U.S. law with ensuring the reliability of the nation's bulk power system. NERC establishes reliability standards for the bulk electric system, which are approved by the Federal Energy Regulatory Commission, and takes action to monitor and enforce compliance with its reliability standards.

On February 28, 2018, NERC filed with the Commission a Notice of Penalty regarding what it described as noncompliance by an "Unidentified Registered Entity (URE)", following a settlement between the anonymous utility and regional reliability group Western Electricity Coordinating Council (WECC).

Some of the details of the underlying fact pattern are protected from public disclosure as Critical Energy Infrastructure Information or CEII. But NERC's public filing says the settlement arose from WECC's determination and findings that the anonymous utility violated two of NERC's Critical Infrastructure Protection or CIP cybersecurity standards. According to NERC's report, the utility received a report that an outside "white hat security researcher" had found data publicly available online which appeared to be protected information associated with the utility.

Following this tipoff, an investigation by the utility and regional reliability group WECC revealed that a third-party contractor hired by the utility had copied data from the utility's network environment to the contractor's network environment, where it was no longer subject to the utility's visibility or control -- in violation of the contractor's authority. While the data was on the contractor's network, a subset of live utility data including over 30,000 records was accessible online without the need to enter a user ID or password for a period of 70 days. These records included some associated with the utility's Critical Cyber Assets, such as servers storing user data, systems controlling physical access within the utility's control centers and substations, and supervisory control and data acquisition or SCADA systems. System logs showed unauthorized access to this data set by both the white hat researcher and unidentified IP addresses.

According to the Settlement Agreement, the anonymous utility neither admitted nor denied the violations, but agreed to pay a $2,700,000 penalty and take other compliance actions. This may represent the largest fine to date for violations of NERC's CIP standards. While federal penalty policy encourages self-reporting of violations and having an internal compliance program in place -- as the anonymous utility did -- the settlement notes that the utility "was not fully transparent and forthcoming with all pertinent information detailing the data exposed in the incident." In particular, the settlement says the utility did not initially provide WECC with all the data fields exposed in the incident. These factors, combined with a finding that the violations posed a serious and substantial risk to the reliability of the bulk power system, led WECC to set the penalty amount at $2.7 million, which NERC subsequently approved.

By federal rule, the penalty will be effective upon expiration of the 30-day period following the penalty notice's filing with the Federal Energy Regulatory Commission or, if FERC decides to review the penalty, upon final determination by FERC.

Vineyard Wind offshore project changes hands

Danish fund management company Copenhagen Infrastructure Partners has acquired Offshore MW LLC, the holder of an offshore wind energy lease issued by the U.S. Bureau of Ocean Energy Management over an area south of Massachusetts.

Copenhagen Infrastructure Partners describes itself as a fund management company founded in 2012. On August 25, 2016, CIP announced that on behalf of its fund Copenhagen Infrastructure II it had acquired 100% of Offshore MW LLC.

Acquired company Offshore MW LLC is developing the Vineyard Wind project over the Outer Continental Shelf south of Massachusetts.  The site is part of the Massachusetts Wind Energy Area originally designated by BOEM for leasing in 2012.  Offshore MW won the lease rights through a competitive lease auction held by the Bureau of Ocean Energy Management on January 29, 2015, in which it submitted the winning bid for Lease Area OCS-A 0501.  That lease area covers 166,886 acres, or roughly 260 square miles of sea space in federal waters off Massachusetts. 

According to CIP, it will continue with the Massachusetts project's development.  The Vineyard Wind project could receive a boost from recently enacted Massachusetts legislation that will require utilities to purchase about 1,600 megawatts worth of offshore wind energy by 2027.  That law, known as H. 4568, "An Act to promote energy diversity," requires electric distribution companies to issue an initial joint competitive solicitation for offshore wind proposals by June 30, 2017.