Executive Order on Bulk-Power System Security: The Devil Is in the Lack of Details

On May 1, 2020, the President issued an Executive Order (EO) that declared that foreign adversaries' actions to create and exploit vulnerabilities in the United States bulk-power system (BPS), along with domestic unrestricted acquisition or use of BPS equipment in which foreign adversaries had certain roles, poses a national emergency.  Accordingly, effective immediately, the EO provides that with respect to transactions initiated after the EO was issued, such BPS equipment may not be acquired or installed when the Secretary of Energy, in coordination with the Director of the Office of Management and Budget and in consultation with the Secretary of Defense, the Secretary of Homeland Security, the Director of National Intelligence, and other appropriate heads of departments and agencies, has made certain national security determinations with respect to such transaction.

These predicate determinations are that (i) the transaction involves BPS electric equipment designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary; and (ii) the transaction (1) poses an undue risk of sabotage to or subversion of the BPS in the United States; (2) poses an undue risk of catastrophic effects on the security or resiliency of United States critical infrastructure or the economy of the United States; or (3) otherwise poses an unacceptable risk to the national security of the United States or the security and safety of United States persons.

For utilities that were in the process of needed replacements or additions to BPS equipment, or that have perceived vulnerable equipment presently in operation, much remains unclear at this time. The uncertainty applies both to transmission system operators of facilities of 69 kv or higher, as well as generating facilities that supply energy needed to maintain the reliability of the transmission system. The EO further recognizes that attacks on the BPS can originate through the lower-voltage distribution system, and establishes a Task Force relating to federal government procurement, incorporation of national security considerations into energy security and cybersecurity policymaking, and consultation with the Electricity Subsector Coordinating Council and the Oil and Natural Gas Subsector Coordinating Council that, among other things, anticipates the possibility of future recommendations related to the distribution system.

The EO requires that the Secretary of Energy in conjunction with the Secretaries of Defense and Homeland Security and the Director of National Intelligence, along with other agency heads as may be appropriate, publish rules and regulations implementing the EO within 150 days of its issuance, or by September 28, 2020. These rules may (1) identify foreign adversaries and persons under their control for purposes of the EO, (2) identify countries and equipment subject to particular scrutiny, (3) establish a licensing process for transactions that would otherwise be prohibited, and (4) provide a mechanism and identify the factors that may mitigate national security concerns. The EO provides that as soon as practicable, the same group of secretaries, directors and agency heads, along with the Board of Directors of the Tennessee Valley Authority, shall identify the BPS equipment influenced by a foreign adversary that poses an undue risk to the BPS or to the national security of the United States or the security and safety of United States persons, and recommend ways to identify, isolate, monitor, or replace such items that are in operation promptly.

While the Secretary of Energy may establish and publish criteria for recognizing particular equipment and vendors as pre-qualified (but not necessarily exempt from regulation) sooner, it is likely that during the five month period until rules and regulations issue, utilities that need to install or replace BPS equipment sourced from a foreign supplier may be at risk of a finding that the transaction is prohibited or subject to mitigation measures. And while the transmission system definition of 69 kV or higher is relatively clear, the definition of a generation facility needed to maintain transmission reliability is less so. Does this mean providers of reactive power? Generators in load pockets? Black start units? Reliability-must run generators? Who will decide, and when?

For all transacting for needed BPS equipment, a shroud of uncertainty has been cast by the EO that will require substantial further guidance to be dispelled. Unfortunately, the need for BPS replacements to meet the obligation to provide reliable service may be inconsistent with the patience required to await rules expected five months hence.  Moreover, the EO and the process it launches move the BPS industry into additional engagement with the federal government's national security, cybersecurity, national intelligence, and procurement policy institutions and processes.

Almost a year prior to this EO, the President issued an Executive Order on Securing the Information and Communications Technology and Services Supply Chain (ICTS Executive Order). The ICTS Executive Order, which issued on May 15, 2019, included a finding that the unrestricted acquisition or use in the United States of information and communications technology or services in which persons subject to the influence of foreign adversaries had certain roles augments the ability of foreign adversaries to create and exploit vulnerabilities in information and communications technology or services, and therefore constitutes an unusual and extraordinary threat to the national security of the United States. The ICTS Executive Order therefore prohibited such transactions involving property in which any foreign country or a national of that country has any interest. The ICTS Executive Order authorized the Secretary of Commerce to issue rules and regulations determining that particular countries or persons are foreign adversaries, identify persons subject to the direction of these foreign adversaries, to identify particular technologies or countries with respect to which transactions involving information and communications technology or services warrant particular scrutiny; and to establish procedures to license transactions otherwise prohibited pursuant to the ICTS Executive Order. This EO closely follows the structure, legal authorities, and regulatory process set forth in the ICTS Executive Order. The full impact on BPS planning and procurement decisions remains to be seen.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.