National Guard Poised For Major Role In Power Grid Security

It is a tribute to the genius of America’s Founding Fathers that the system of government they created, based on the principle of distributed power and responsibility or federalism, continues to serve us so well.  A wonderful example of this is the growing role of the National Guard in protecting the nation’s critical infrastructure, generally, but the electric power grid, in particular, from attack. As we have witnessed repeatedly over the past decade, the U.S. homeland is at growing risk to hostile forces, both nation states and non-state actors, able to disguise their intentions and movements or to use new means such as cyber space, to do harm. The United States is entering an era of continual conflict, much of it below the threshold of war as traditionally understood. The term of art is “gray zone conflicts.”

The ability to reliably generate and deliver affordable electric power is foundational to modern civilization. Among the various critical infrastructure sectors on which the nation as a whole but every individual depends, none is more important. And none presents greater challenges to those charged with the responsibilities of protecting the homeland. The electric power grid is highly disaggregated, with nearly 5,000 different entities of widely varying size and capacity generating and/or distributing energy. Some 72 percent of all consumers are served by the nearly 2,000 shareholder-owned electric companies.

While there is general federal oversight and regulation of the electric power industry, most of the governance, regulation, rate setting and protection of the individual entities and their assets occurs at the state and local level.  Major technological and organizational changes, notably the rise of distributed energy resources, the advent of the so-called smart grid and the creation of micro-grids, are changing the character of the industry, adding more players and points of entry into the system. These changes will also increase the difficulty of providing protection for the grid.

Historically, the greatest threats to the reliable generation and delivery of energy were environmental, ranging from vermin in transformers to major storms and natural disasters. This may be changing. Portions of the grid are particularly vulnerable to physical attack. More significantly, the grid is the subject of increasing cyber penetrations and outright attacks. Last December, a relatively simple cyber attack on a portion of the Ukrainian power grid disrupted power to hundreds of thousands of customers.

The National Guard is uniquely positioned, in terms of authorities, responsibilities and, soon, capabilities to support the ongoing defense of the nation against such threats. The National Guard is state-based and able to respond across both state and federal lines of authority. Moreover, because it is embedded in their communities, National Guard units are particularly well-suited to understanding and responding to local situations.

Quietly and without much public recognition, yet, the National Guard has begun to develop a sophisticated capability for cyber defense. In addition to meeting defined requirements to support the active duty military under Title 10, individual Guard units have shaped unique capabilities and concepts of operations that reflect the specific conditions and needs of their particular state. Guard cyber units in California, Maryland, Wisconsin and Washington, for example, have established collaborative relationships with local utilities. In some instances, the Guard unit and the utility have conducted joint exercises. Since no two states or even utilities are exactly alike, this one-on-one collaboration is particularly important. It is also an approach well-suited to the organization and operation of the National Guard.

With 54 states and territories, there is a real value to the National Guard as a laboratory for experimentation in ways of providing protection of public and private infrastructure. In Washington State, the National Guard cyber unit, with the approval of the governor, provided a risk assessment for the Snohomish County Public Utility District. Elsewhere, the Guard is serving in an advise and assist function. The Maryland National Guard is creating a cyber center of excellence. Other Guard units are looking at collaborating with local companies to train their IT professionals to be cyber operators.

The central policy question is how much of the scarce resource that is the National Guard can and should be devoted to providing cyber security of national infrastructure, most notably the electric power grid?

There needs to be a delineation of roles and responsibilities so that the Guard does not take on functions that should be the responsibility of the grid operators. Also, there is a danger in relying too much on the Guard for providing cyber protection within the homeland in the event those same units are mobilized for federal service. Greater attention needs to be devoted to how the National Guard and the state-based utilities can establish a mutually supportive collaborative arrangement.