Missouri Public Service Commission Publication VOL. 2 NO. 5 -- DECEMBER 2012 E F A S & E R U C E S Cybersecurity: Guarding Against Threats To Utilities Chairman’s Corner PSConnection GOVERNOR Welcome to this edition of the PSConnection. This issue starts Jeremiah W. (Jay) Nixon our third year of the publication and we hope that you find the PUBLIC SERVICE COMMISSION magazine and the topics contained within each edition interesting Kevin Gunn, Chairman and of value. Terry M. Jarrett Robert S. Kenney In April 2013, the Missouri Public Service Commission will Stephen M. Stoll recognize 100 years of service to the citizens of Missouri. We hope ADMINISTRATION that you will take time to read the article It All Started 100 Years and REGULATORY POLICY Ago in this edition of the magazine. Changes are occurring all the Wess Henderson time in utility regulation and we continue to SECRETARY/GENERAL COUNSEL meet those challenges with a great deal of Steve Reed hard work and enthusiasm; knowing that REGULATORY REVIEW the decisions we make will have a great Cherlyn Voss impact on the citizens and economy of our MANAGING EDITOR: Gregg Ochoa state ---today and in the future. CONTRIBUTING EDITOR: Kevin Kelly When a hacker or a virus gets into your EDITORIAL BOARD computer at home, the consequences can Debbie Bernsen be devastating. Now imagine if that same Kim Bolin thing were to happen to your utility com- Natelle Dietrich Gay Fred pany and its computer systems. The effect Kevin Kelly could cripple the electric grid, causing out- Lisa Kremer Gregg Ochoa ages as well as stealing confidential infor- Contessa Poole-King mation. We take a look at this issue in Nathan Williams our feature article Keeping The Lights On: Building Up Cybersecurity written by Commissioner Terry Jarrett. PSConnection is an official publication of In 2009, the Missouri legislature passed and Governor Nixon the Missouri Public Service Commission. It is published periodically each year and signed into law the Missouri Energy Efficiency Investment Act is free of charge to all Missourians. To (MEEIA). The purpose of this law is to encourage investor-owned request a copy or contact the editorial staff, call 1-800-392-4211. Correspon- electric utilities such as Ameren Missouri, The Empire District dence may be sent to: PSConnection, 200 Electric Company, KCP&L-Greater Missouri Operations Company Madison, P.O. Box 360. Jefferson City, MO 65102-0360 You may also request and Kansas City Power & Light Company to develop and implement an electronic version or download this energy efficiency programs. Commission rules implementing MEEIA publication at www.psc.mo.gov took effect in May of 2011. So what is MEEIA and why should con- The Missouri Public Service Commis- sumers be interested in this topic? We will explain in an article in sion regulates investor-owned electric, this edition of the magazine. steam, natural gas, water and sewer and telephone companies. Its mission is to The Cold Weather Rule has been a part of our rules and regula- ensure Missouri consumers have access tions since 1977. With cold weather here, it’s important to know to safe, reliable and reasonably priced utility service while allowing those utility what the rule means to you when trying to pay your heat-related companies under our jurisdiction an op- utility bill. Winter energy saving tips and information on what to portunity to earn a reasonable return on do in case of an emergency or if you smell natural gas are also in their investment. The PSC also regulates manufacturers and retail dealers who this issue. sell new and used manufactured homes We hope that you find this edition of PSConnection informative. and modular units. The Commission was established in 1913. The PSC is comprised Please feel free to share your thoughts about the magazine and give of five commissioners, who are appointed us your suggestions on future topics. Our toll-free hotline number by the governor. is 1-800-392-4211. Kevin Gunn M MISSION OF THE O S C T E AT C E IV O RE M F 1S CIL0BUP 0IR U O SSI PSConnection -- December 2012 1 IT ALL STARTED 100 YEARS AGO M IS SION OF TH M E O S Next year, the Missouri Public Service Commission will C T E AT celebrate its 100th anniversary. Here’s a quick overview of C E IV O how it all started. Please see page 13. RE M F 1S CI00O SSI LBUP IR U What’s Inside 3 CYBERSECURITY Federal and state agencies are working to protect critical infrastructure and help keep the lights on. 6 INVESTING IN ENERGY EFFICIENCY A look at the 2009 law designed to encourage investor-owned utilities to develop “demand-side” programs. 10 PREPARING FOR COLD WEATHER Winter is coming. You can take steps to prepare for the colder temperatures that are expected to hit the Midwest. Our Mission On The Cover More and more, we rely on computers for To ensure that Missourians everyday functions such as paying bills. It is receive safe and reliable important that these interconnected networks, routers and servers are secure. With that in utility service at just and mind, utilities are also working to protect criti- reasonable rates. cal infrastructure through cybersecurity. 2 PSConnection -- December 2012 S ecurity of the power grid has been a hot topic in the news lately. Consider some recent media headlines: • “Chinese Hackers Linked To Breach of Canadian Energy Giant,” (redorbit.com, Septem- ber 28, 2012); • “Feds: Power Grid Vul- nerable to ‘Fast-moving Cybersecurity Threats,’” (CNET, August 28, 2012); • “Energy Grid: Safe from Cyber Attack?” (Discovery News, May 9, 2012); • “Power Grid Updates Left System Vulner- Keeping The Lights On: able to Cyber Attacks,” (Washington Post, February 7, 2012); and Building up • “Power-Grid Cyber Attack Seen Leaving Millions in Dark for CyBerseCurity Months,” (Bloomberg, January 31, 2012). By Commissioner Terry M. Jarrett Cyber threats against the power grid are not just a theoretical discussion topic—attacks have already occurred. As noted above, in September 2012, a team of Chinese hackers reportedly breached a Canadian energy company’s network. The hackers breached the company’s internal firewall and security systems, implanted malicious software and stole project files. The company said that it is actively working with law enforcement, security specialists and its affected custom- ers to ensure the breach has been contained. In November, 2011, Tech News Daily reported that a lone hacker penetrated the network of a South Houston, Texas, water-treatment plant to expose the inherent vulnerabilities in criti- cal industrial control facilities and prove how easily they can be compromised. “No damage was done to any of the machinery; I don’t like mindless vandalism,” he wrote. “It’s stupid and silly. On the other hand, so is connecting interfaces to your [industrial control systems] to the Inter- net.” The hacker added, “I wouldn’t even call this a hack, either, just to say. This required almost no skill and could be reproduced by a two year old with a basic knowledge [of industrial control systems].” PSConnection -- December 2012 3 Author Brian Krebs, citing a May 27, 2010, FBI Intelligence Bulletin, reported that a series of hacks against smart meters may have cost a Puerto Rico electric utility $400 million annu- When we talk about ally over the past several years. The FBI believes that former employees of the meter manufacturer cybersecurity and infra- and employees of the utility were altering the structure, we are referring meters in exchange for cash and training others to do so. “These individuals are charging $300 to the cybersecurity to $1,000 to reprogram residential meters, and of not only the physical about $3,000 to reprogram commercial meters,” the alert states. The thieves were able to hack distribution and trans- into the smart meters with their laptop comput- ers using software downloaded from the Internet. mission grids, substa- Once they altered the settings in the meters for tions and offices, but also recording power, customers were able to steal power from the utility. equipment and systems According to the Department of Homeland that communicate, store Security (DHS), America's water and energy utili- ties face constant cyber-espionage and denial- and act on data. of-service attacks against industrial control systems. While almost all of these attacks have either failed or have only been minor inconve- niences to date, DHS believes that it is only a matter of time before a cyber attack has more serious consequences. store and act on data. As the power grid is up- Utility-owned critical infrastructure has dated and modernized to include more computer become more difficult to protect because it is networks, control systems and smart grid tech- not just the physical assets that need protecting nology, the opportunity increases for computer anymore. When we talk about cybersecurity and hackers to cause mischief. While many of these infrastructure, we are referring to the cyberse- hackers may not have a malicious intent, others curity of not only the physical distribution and may want to steal money or confidential infor- transmission grids, substations and offices, but mation (like credit card numbers) or shut down also equipment and systems that communicate, the grid entirely. Under a worst case scenario, a Simple steps to help protect your online information Computers are an integral part of the power grid. But, we also use the Internet to stay con- nected and informed. We rely heavily on the Internet for everything from submitting taxes, to applying for student loans, to following traffic signals, to even powering our homes. Securing online data is important to protect personal information. Americans can follow simple steps to keep themselves, their personal as- sets, and private information safe online. Here are a few tips all Internet users can do to practice cybersecurity: • Set strong passwords and don’t share them with anyone. • Keep your operating system, browser, and other software optimized by installing updates. • Use anitvirus software. • Limit the amount of personal information you post online and use privacy settings to avoid sharing information widely. • Don’t open any suspicious e-mails or attachments. -- U.S. Department of Homeland Security 4 PSConnection -- December 2012 successful cyber attack could disrupt our econo- ond, utilities must collaborate with other utilities my and national security. to learn about the different kinds of threats out The Federal government has taken a number there as well as share best practices to combat of steps to beef up cybersecurity oversight. On them. Third, should a cyber attack succeed, our September 20, 2012, the Federal Energy Regula- utilities must be resilient in quickly responding tory Commission (FERC) announced the creation to and effectively recovering from such an attack, of a new FERC office that will help FERC focus just like utilities have had to do with natural on potential cyber and physical security risks to disasters for decades. energy facilities under its jurisdiction. The new Recently, the Missouri PSC opened a work- Office of Energy Infrastructure Security (OEIS) shop to obtain information from our regulated will provide leadership, expertise and assistance electric utilities about their cybersecurity ac- to FERC to identify, communicate and seek com- tivities. We asked a series of 47 questions so prehensive solutions to potential risks to FERC- that we can comprehensively evaluate what the jurisdictional facilities from cyber attacks and utilities are doing to keep their systems safe from such physical threats as electromagnetic pulses. cyber threats. We have received responses from Additionally, for some time Congress has been all of them and our staff currently is evaluating considering cybersecurity legislation. those responses. Once we have had a chance Likewise, protecting the grid and sensitive to review the information, we will have a better consumer information is an important func- picture of our electric utilities’ preparedness for tion for the Commissioners at the Missouri PSC. cyber threats, and can take appropriate steps if State commissioners are responsible for ensuring they are falling short in any way. that regulated utilities provide safe and reliable At the end of the day, we want Missouri service at just and reasonable rates. Cyber at- consumers to have confidence that our utilities tacks threaten safe and reliable service and the are doing the right things to keep confidential cost of implementing cybersecurity measures customer information safe from theft and keep affect utility rates. Therefore, we need to know the power grid protected and reliable. We want to that our regulated utilities in Missouri are aware make sure that the lights are kept on. of the cyber threat issues and are taking reason- able steps to protect their systems in the event of cyber attacks. Commissioner Terry M. Jarrett Cybersecurity is really a three-pronged ap- has served on the Missouri proach. First, utilities need a set of tools to Public Service Commission prevent a cyber attack in the first place. Such since 2007. He is chairman preventative strategies involve not only tradition- of the National Association of al security controls, like performing background Regulatory Utility Commission- checks on employees, but also use new tech- ers (NARUC) Critical Infrastruc- nologies, much like antivirus software that you ture Committee. would install on your personal computer. Sec- PSConnection -- December 2012 5 The Missouri Energy Efficiency Investment Act Encouraging customers to use less electricity, reducing the need to build more power plants By Martha Wankum and John Rogers H Demand Response refers to changes in istorically, Missouri’s electricity has electric usage by end-use customers from their come from numerous resources including elec- normal consumption patterns in response to tricity generating plants powered by a variety of changes in the price of electricity over time, or primary energy sources - supply-side resources to incentive payments designed to induce lower - to meet the annual electricity requirements of electricity use at times of high wholesale market customers – demand. Missouri has relied upon prices or when system reliability is jeopardized. coal powered generating plants to meet most of Demand response programs are designed to its annual electricity requirements and upon primarily reduce peak demand (kW). Examples coal and natural gas powered generating plants of demand response programs include providing to meet its peak electricity capacity needs (times incentive payments to customers to reduce their when electricity is in high demand). Due to the consumption of energy during periods of peak uncertainty of future annual electricity re- demand or when market prices for energy are quirements and peak electricity capac- very high. ity needs and the uncertainty of future environmental regula- tions, future fuel prices and What is the Missouri the cost of building and op- Energy Efficiency Investment Act? erating new generating plants, The Missouri Energy Efficiency it is important that Missouri Investment Act (MEEIA), section consider all available supply-side 393.1075 RSMo Supp. 2010, was and demand-side resources -- en- passed by the Missouri legislature ergy efficiency and demand response and signed by Governor Jeremiah -- when planning for and meeting the (Jay) Nixon in 2009. MEEIA is future electricity needs of the state. designed to encourage investor- owned electric utilities to devel- What are “Utility op and implement demand- Demand-Side Resources?” side resources with a goal of Energy Efficiency refers to permanent achieving all cost-effective changes to electricity usage through installa- demand-side savings (sav- tion of or replacement with more efficient end- ings in annual electricity use devices or more effective operation of exist- requirements and peak ing devices that reduce the quantity of energy electricity capacity needs). needed to perform a desired function or service. Under MEEIA, the Missouri Public Energy efficiency programs are designed to pri- Service Commission (Commission) is marily reduce energy (kWh). Examples of energy required to permit electric utilities to imple- efficiency programs may include encouraging ment and recover costs related to Commission- customers to use more efficient light bulbs or to approved demand-side programs if the programs purchase a new refrigerator by offering various are expected to – over time - achieve all cost-ef- incentives such as monetary rebates. fective energy savings and lower customers’ bills. 6 PSConnection -- December 2012 The Commission’s Role and discontinuance of electric utility demand- in Implementing MEEIA side programs. The rules also set forth the infor- During 2009 and 2010, the Commission’s mation that an electric utility must provide to the Staff organized a stakeholder process, including Commission when it seeks approval, modification a series of three workshops, facilitated by the or discontinuance of demand-side programs. Regulatory Assistance Project, to obtain broad An electric utility may file an application input from investor-owned electric utilities, the with the Commission for approval of individual Office of Public Counsel, the Missouri Depart- demand-side programs or for an entire plan. The ment of Natural Resources, customers, consumer Commission is required to make a determina- advocates and various other groups concern- tion regarding applications within a specified ing MEEIA and to draft administrative rules to timeframe after providing the opportunity for a implement MEEIA (File No. EW-2010-0265). The hearing. Commission crafted four rules designed to imple- Electric utilities are required to file applica- ment MEEIA and allow electric utilities to recover tions to modify demand-side programs when costs and to provide financial incentives and there is a 20 percent or more variance in the timely earnings opportunities associated with total program budget or if the program design cost-effective demand-side savings. (File No. EX- is significantly modified. An electric utility may 2010-0368). The MEEIA rules became effective also file an application with the Commission to May 30, 2011. discontinue demand-side programs. Once again, Two of the administrative rules (4 CSR 240- the Commission is required to make a determina- 20.094 and 4 CSR 240-3.164) address demand- tion within a set time period after providing the side programs under MEEIA, and set forth the opportunity for a hearing. requirements and procedures for filing and pro- cessing applications for approval, modification, Examples of Residential Energy Efficiency Programs Program Description Lighting Incentives paid to retail partners to discount the price on high efficiency lighting products Energy Efficiency High efficiency water heaters, window air conditioners and smart Products strips will be promoted through rebates and incentives Heating, Ventilation Diagnostics/tune-up, retrofit, and replacement upgrades for air and Air Conditioning conditioners, heat pumps and cooling systems Refrigerator Recycling Incentives paid to remove inefficient refrigerator or freezer, pick up and recycling and disposal of old units Home Energy Energy assessment, direct install measures and cost effective Performance follow up measures ENERGY STAR New Targets builders and energy raters with incentives for construction Homes of ENERGY STAR homes Low-Income Delivers energy savings to low income qualifying customers through direct install measures and appliances PSConnection -- December 2012 7 How Do You Measure the for both supply-side resources and demand-side Cost-Effectiveness resources on an equivalent basis to meet future of Demand-Side Programs? needs for annual electricity requirements and Energy efficiency programs must be cost- peak electricity capacity at the lowest cost to effective, unless the programs are targeted to customers. Chapter 22 calls for active collabora- low-income customers, are for general educa- tion of each electric utility with the Commission tion campaigns or if the programs are funded by Staff and other stakeholders during the planning the customers participating in the programs or process and during review of each utility’s long through tax or other governmental credits. term resource plan. The Commission has established incremen- tal annual energy and demand savings goals to Who Evaluates and Verifies serve as a guideline to review progress toward Electric Utility MEEIA Performance? the expectation that the electric utility’s energy Each electric utility is required to hire an efficiency programs will provide all cost-effective independent contractor to perform an evaluation demand-side savings. The goals are not manda- on each Commission-approved demand-side pro- tory and there are no penalties assessed to a util- gram. The Commission is also required to hire ity that is unable to achieve those goals. an independent contractor to review and report on the work of each utility’s contractor. Who Provides Input into Planning for Supply-Side and Demand-Side Resources? Who Pays for MEEIA? The MEEIA rules establish both utility-spe- The Commission promulgated two addi- cific collaborative groups and a state-wide col- tional administrative rules (4 CSR 240-20.093 laborative group. Each electric utility is required and 4 CSR 240-3.163) which allow for the es- to form an advisory collaborative that includes tablishment and operation of an electric util- members of the Commission Staff, the Office ity’s demand-side program investment recovery of Public Counsel, the Missouri Department of mechanism (Mechanism). The Mechanism may Natural Resources, consumer advocates and allow for periodic rate adjustments related to various other groups (stakeholders) for input on recovery of program costs as well as the recovery the design, implementation, and review of energy of lost revenues related to the programs and a efficiency programs. Utility specific collaborative utility performance incentive for investments in meetings are encouraged to occur at least once demand-side programs. The rules also set forth each calendar quarter. requirements related to MEEIA rate adjustment All electric utilities, the Commission Staff and filings and annual reporting requirements. stakeholders are also required to form a state- wide advisory collaborative to provide the op- Disclaimer: This article has been written for portunity for the sharing of lessons learned from the purposes of communicating timely concepts to energy efficiency program planning and imple- the public and is not a position statement by the mentation and to create a forum for discussing Missouri Public Service Commission or its Staff. statewide policy issues. Statewide collaborative Much of the technical terminology has been re- meetings are encouraged to occur at least once moved for ease of reading. each calendar year. Finally, each electric utility is also required John Rogers is a member of the PSC Staff, to comply with the Commission’s Chapter 22 working in the Energy Resource Analysis Unit. Electric Utility Resource Planning rules regarding Martha Wankum worked at the PSC when this long-term planning. The rules require planning article was written. 8 PSConnection -- December 2012 MEEIA Programs in Missouri: What Has My Utility Done? KCP&L-Greater Missouri Operations (GMO) (Case No. EO-2012-0009) -- On December 22, 2011, GMO filed a MEEIA case with the Public Service Commission seeking approval of programs (in- cluding both energy efficiency and demand response programs), and a cost recovery mechanism that would include cost recovery of program costs, a portion of the net shared benefits, lost revenues and a performance incentive mechanism. Under this proposal, GMO states it would incur approximately $38.8 million in program costs over the next three years. GMO anticipates that programs will result in $105.1 million in total customer benefits (net of program costs) and have a cumulative annual energy savings of approximately 155,000 MWh and cumulative annual capacity savings of approximately 73 MW during the third program year. Various parties in this case have reached an agreement; that agreement has been filed with the Commission for its consideration. Ameren Missouri (Case No. EO-2012-0142) -- On January 20, 2012, Ameren Missouri (Ameren) filed a MEEIA case with the Public Service Commission seeking approval of a broad portfolio of energy efficiency programs, a technical resource manual, and a cost recovery mechanism. The proposed mechanism included cost recovery for program costs, lost revenues and performance incentives. The Commis- sion approved an agreement on August 1, 2012, which included approximately $147 million in energy efficiency program costs over the next three years. The new energy efficiency programs are expected to be imple- mented on January 2, 2013. The programs are anticipated to result in $336.6 million in total cus- tomer benefits (net of program costs) and have a cumulative annual energy savings of approximately 793,000 MWh during the third program year. Power Generators Are Aging: How old are U.S. power plants? The nation’s current fleet of electric power generators has a wide range of ages. Most coal-fired plants were built before 1980. There was a wave of nuclear plant construction from the late 1960s to about 1990. The most recent waves of generating capacity additions include natural gas-fired units in the 2000s and renewable units, primarily wind, coming online in the late 2000s. The nation’s oldest power plants tend to be hydropower generators. For example, the first U.S. hydroelectric power plant opened on the Fox River near Appleton, Wisconsin, on September 30, 1882. (Source: U.S. Energy Information Administration) PSConnection -- December 2012 9