In May, President Donald Trump issued an executive order blocking the installation of bulk power system (BPS) equipment sourced from adversaries of the United States. Grid security is a major concern, but experts say the White House order is vague — and the process to translate it into enforceable regulations could stretch into next year.
In the meantime, the power industry is struggling to respond. Some companies have made changes to their procurement processes, but no one knows yet what equipment is safe and what will be prohibited.
"We're already seeing utilities limiting procurement," Tobias Whitney, vice president of energy security solutions at Fortress Information Security, told Utility Dive.
Some of those actions may be premature, according to U.S. Department of Energy officials. The executive order is not an immediate "rip and replace" directive, Michael Coe, director for operational modeling and technical assistance at the agency's Office of Electricity, told stakeholders during a May 21 phone call discussing the order.
"As of today, no equipment is prohibited," Coe said. "Any immediate steps would not only be premature but may be unnecessary."
"The industry is kind of freaked out — and rightfully so."
Keith Bradley
Partner, Squire Patton Boggs
For already-installed grid equipment that is found to be problematic, DOE is considering how to allow it to remain in place. The agency "will be considering procedures for mitigation measures that may allow for the use of equipment that would otherwise be prohibited," Coe said.
Still, the industry is anxious for more information. And observers say the DOE's stakeholder outreach has so far not been specific enough to quell concerns. The order does not mention specific countries from which equipment could be prohibited — though experts say the new rules will largely impact Chinese companies.
"The industry is kind of freaked out — and rightfully so," Keith Bradley, a partner at Squire Patton Boggs, told Utility Dive.
Bradley says the power sector is aware China is a security concern, and the North American Electric Reliability Corp. (NERC) is working to boost security through Critical Infrastructure Standards and new vendor requirements. "But nobody was expecting the administration to shortcut all that," said Bradley. "It throws a wrench into what's going on right now."
DOE says it is moving quickly on the issue and the order gives 150 days — until September 28 — for the agency to finalize new rules. Experts say it will be a challenge for DOE to meet that deadline.
"There is enormous uncertainty about the terms in the executive order and to what they apply. It will be difficult to narrow down quickly," Mike Leiter, a partner at Skadden, Arps, Slate, Meagher & Flom, told Utility Dive.
In the meantime, utility companies are making their best estimates of what equipment could be covered by the order.
"A lot of people are continuing to procure Chinese solar panels on the basis they don't think they're covered or they pose little risk to the bulk power system," Skadden partner Lance Brasher said. With other equipment, such as inverters, "people are a little more worried" and in some cases have been opting for non-Chinese equipment when they have a choice.
The order "is having some procurement effect in shifting away from vendors that appear to be of greater risk," Brasher said.
What is covered by the executive order?
According to Bradley, a point of confusion is the administration's use of the term Bulk Power System.
The administration likely drew the term "Bulk Power System" from the Energy Policy Act of 2005, said Bradley, where it defines the scope of NERC's reliability jurisdiction. But it isn't well defined, he said.
The executive order says it will apply to "electric energy from generation facilities needed to maintain transmission reliability." But which are those? The order "leaves many unanswered questions," said Bradley. Some of those could be answered through additional orders issued over the coming months, he said.
Fortress' Whitney, who formerly worked at NERC and the Electric Power Research Institute, believes the bulk power system is relatively well-understood by industry. However, he said there are gray areas and greater clarity is needed to turn the executive order into enforceable regulations.
"The devil is going to be in the details, and helping utilities understand what is the scope not only in terms of large assets, but within technology and subcomponents, where to draw the line."
Tobias Whitney
Vice President of Energy Security Solutions, Fortress Information Security
The big question, he said, will be in how far DOE drills down to find problematic equipment.
"There are suppliers of suppliers. The question is how far do we go," Whitney said. "All the way down to the microprocessor? The chip? The mother board? ... The devil is going to be in the details, and helping utilities understand what is the scope not only in terms of large assets, but within technology and subcomponents, where to draw the line. There needs to be much more fidelity around that conversation."
Fortress runs the Asset to Vendor Network, which helps utilities better understand their supply chains and what equipment might run afoul of the order. "There very well may be a 'do not buy from' list, based on criticality of the asset," Whitney said. "A lot of those details are yet to be determined."
The executive order also contemplates a "white list" of pre-screened vendors and equipment, but so far there has been nothing concrete from DOE.
"Reading the executive order, it sounded like the white list could come out before the regulations," said Brasher. But from DOE calls, he said it appears the background work has not been done and the white list won't be ready in the short term. "It sounds like [the white list] is not necessarily on a path different from the regulations themselves."
In a statement to Utility Dive, DOE said it is currently working on a notice of proposed rulemaking (NOPR), "which will provide an opportunity for stakeholder comment and input on the substance of the rule. It is anticipated that the issue of pre-qualification will be addressed in the NOPR."
How long to generate regulations?
Energy law experts say they doubt DOE will be able to meet the 150-day deadline to generate regulations, leaving the utility sector in a state of flux for now.
DOE has indicated it wants to move quickly, but "a rulemaking of this complexity in normal times might typically take a few years," said Bradley. "DOE doesn't do things that fast," and meeting the 150 day deadline is unlikely.
"We're also entering an election year, and that never accelerates things,"
Mike Leiter
Partner, Skadden, Arps, Slate, Meagher & Flom
The process will likely include private consultations with industry and other stakeholders, followed by proposed rules, a comment period and then final regulations, said Bradley. During that time, utilities can't just put maintenance and expansion plans on hold. "If you run a utility, you are constantly repairing and refurbishing equipment. On a regular basis, people are replacing transformers," said Bradley.
It does not appear there was much preparation going on behind the scenes before the executive order was issued, Skadden's Leiter said. So while DOE is "not quite starting from square one, they have a lot of work to do."
"We're also entering an election year, and that never accelerates things," Leiter said.
Possible challenges to the order?
While federal regulations almost always face some kind of challenge, Trump has broad authority to act on national security concerns.
"I'm not sure there are any regulations adopted without a challenge," said Leiter. "As a general matter, because these regulations are based on national security concerns, that tends to provide the executive branch with a very significant amount of discretion on both substance and process. I expect there will be challenges but I also expect the success of those challenges to be somewhat limited given the subject matter."
There will probably be no challenges directly to the executive order, said Bradley, because "challenges to Presidential orders are very hard and they mostly fail. But there will almost certainly be litigation around the content of DOE's rule, whenever that happens."
And there are political questions because of the upcoming election, said Bradley.
"There's pretty much zero prospect DOE will have the rule done before January," he said. "If the administration does change, I don't know what Biden will do with this. Presumably it gets refined in a way to be more palatable to industry."
If Trump doesn't win, said Leiter, "there could be questions about whether and how the rulemaking will continue."
How much will it cost?
A key question is how much this directive will wind up costing utilities.
"Naturally, this will lead to cost increases," Ollie Whitehouse, global chief technology officer at cybersecurity consultancy NCC Group, told Utility Dive. The countries inferred in the order "have the ability to undercut pretty much every western country on technology."
"The immediate disruption will be a slowdown in [both] capital projects and the adoption of some technologies," Whitehouse said.
But it is still too soon to estimate the cost of Trump's executive order — though Whitney said those costs may wind up being passed along to consumers if equipment must be removed from the grid.
"If there are potentially sweeping changes then costs are a huge component," Whitney said. "There could be some type of support to help offset those costs, capitalize those costs, potentially passing them on to the consumer."
Alternatively, the federal government could offer incentives to utilities to take any necessary steps.
"You can get a lot more done with carrots than sticks," said Whitney. "There is mandatory compliance, versus incentives to replace equipment, which gives utilities flexibility."
DOE says its understands the industry is concerned and plans to address the issue.
"The Department recognizes complexity of the bulk-power system and the accompanying supply chain risk management, and we intend to take a phased, thoughtful approach, working closely with industry, to avoid any unintended consequences," the agency said in a statement.
