As DOE Prepares for Cyberattacks, Energy Industry Wants More Clearances

A backlog of Department of Energy security clearance applications is putting the U.S. at greater risk of cybersecurity threats to energy infrastructure, industry representatives told the Senate Energy and Natural Resources Committee on Tuesday.

Efforts to improve communication between the government and natural gas and electric utility companies have been hampered by top-level employees’ struggles to get security clearances, said representatives from two industry associations. Security clearances allow employees to get information about potential threats that would otherwise be kept secret from the company.

American Gas Association CEO Dave McCurdy, a former Democratic congressman from Oklahoma who chaired the House Intelligence Committee, said he applied for a top-secret security clearance with DOE more than a year ago and still has not been approved. He already has a Department of Defense security clearance, he said.

“We don’t need to know ‘sources and methods,’ the old terms we used to use,” McCurdy said, referring to the government’s system for gathering intelligence. “What we do need to know, though, [is] whether it’s actionable and directly relevant for our particular environment and situation.”

Security clearances were a major focus of the hearing on possible cyberattacks on the electric grid on Tuesday. Lawmakers from both parties have raised concerns over the topic, saying the country does not seem to be entirely ready to respond to a major cyberattack on energy infrastructure. The topic has attracted more attention with the development of the “smart grid,” or portions of the grid with tools that communicate digitally with each other.

“I’m convinced that the next major event in America is going to be a cyber event,” Sen. Jim Risch (R-Idaho) said at the hearing.

Duane Highley, CEO of the Arkansas Electric Cooperative Corporation, also cited streamlining the security clearance process as a way to improve how prepared the country is for a cyberattack.

Washington National Guard Col. Gent Welsh said that each state’s governor has a Homeland Security adviser who can sponsor people for security clearances, expediting the process. Washington state has successfully navigated the clearance process using this method, he said.

McCurdy said the issues are a matter of working through a backlog for top secret and other high-level security clearances, because secret security clearances, which are easier to get, are not as valuable to the industry.

“The department is actually trying, with the officials, the executives, to move the process,” McCurdy said. “But it’s the clearance process across government which is kind of fouled up.”

In December 2016, the Obama administration released an action plan on the electric grid, calling on the DOE to “convene a discussion” about how to ensure industry personnel have security clearances within 120 days of the report’s Dec. 6 release, which means the department is supposed to do so by Wednesday. The department did not respond immediately on Tuesday to a request for information on whether it had followed through on this directive.

And Sen. Bill Cassidy (R-La.) was not satisfied with the country’s ability to respond to an electromagnetic pulse.

Patricia Hoffman, acting assistant secretary of DOE’s Office of Electricity Delivery and Energy Reliability, said “within the utility sector, we have taken an aggressive posture of looking at investigating further the electromagnetic issue.” Cassidy responded that it sounded like the department had not even started implementing a plan.