The IT Nerd

Yesterday, the President Of The United States signed an executive order declaring a national emergency to secure the U.S. bulk-power system, citing cybersecurity and operational risks associated with foreign-produced energy equipment.

The order can prohibit the acquisition, importation, transfer or installation of foreign-made bulk-power equipment, including associated software and digital capabilities, when it is determined to pose a significant national security risk.

The order specifically warns that foreign-made equipment could contain vulnerabilities or digital backdoors capable of providing remote access to U.S. energy infrastructure.

The restrictions could affect equipment such as power transformers and components used in solar infrastructure. China currently accounts for 85% of global solar supply-chain production capacity.

The Department of Energy has 120 days to develop rules implementing the order in coordination with other federal agencies.

Doc McConnell, Head of Policy and Compliance, Finite State:

   “On August 26, the President declared a national emergency over foreign-made equipment in the United States electric grid. Executive Order 14420 is the latest in a series of supply chain actions from this administration, and it includes a now-familiar assumption: equipment manufactured in a foreign country poses a national security risk.

   “The order points to two reasons. First, where equipment incorporates software, firmware, or other digital components, an adversary could build in remote access for surveillance or sabotage. Second, an adversary could cut off the supply of critical equipment at a moment of its own choosing, and do real damage that way.

   “Supply chain risk is real, and it is appropriate for the federal government to act on it. But for software and firmware, I don’t agree that foreign development is inherently risky, or that requiring development to happen within our borders keeps us safe.

   “A better way to secure our critical infrastructure is to test the equipment we install. For example, analyzing the compiled firmware binary of bulk-power system equipment can identify vulnerabilities, surface insecure configurations, and allow us to mitigate specific risks to better secure our energy infrastructure, regardless of where that equipment was manufactured.

   “The Department of Energy has 120 days to write the implementing rule. I hope that we see an evidence-based approach to evaluating the security of the equipment in our energy grid.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “This has been a concern for a large number of people in the computer security industry for a very, very, very long time. If you go back to concerns raised around Super Micro Computer Incorporated, the bigger issue has always been the same. Where are the components that make up our critical infrastructure actually coming from, and how much do we really know about that supply chain?

   “It’s nice to finally see this being acknowledged at a serious level. But acknowledgment is the easy part.

   “The details of how this gets implemented are going to be much more interesting. This isn’t a situation where we can simply decide we don’t trust a supplier and buy the equipment somewhere else. China dominates the production of many of the components and materials that modern technology and critical infrastructure depend on. In some areas, there simply aren’t enough alternative suppliers to make an immediate transition realistic.

   “So yes, I’m glad this is being looked at. It should have been looked at much more seriously years ago. But the real question isn’t whether we recognize the supply chain risk. We do.

   “The question is how we actually reduce that risk when much of the supply chain we’re worried about is also the supply chain we currently depend on.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “The cybersecurity issue here isn’t limited to finding a secret backdoor soldered into a foreign-made transformer. A legitimate vendor update mechanism or remote maintenance service becomes a national-security dependency when the infrastructure behind it is controlled by an entity the U.S. considers adversarial. Modern grid equipment increasingly relies on vendor-maintained update channels, remote diagnostics, firmware management, and other lifecycle services. That control-plane dependency is the threat surface this order actually reaches.

   “The order’s definitions acknowledge this more clearly than its preamble. Section 2(a) expressly covers software, firmware, digital services, maintenance services, and remote-access capabilities. Section 5(b) separately tells agencies to consider “remote access capabilities, lifecycle maintenance and update mechanisms, and other supply chain dependencies.” That operative language goes well beyond hypothetical malicious implants.

   “Section 2(b) creates the harder enforcement challenge, authorizing DOE to order identification, isolation, monitoring, disconnection, or replacement of foreign equipment already installed. This is rip-and-replace authority dressed in “phased compliance” language. Traditional asset inventories may tell a utility who manufactured a device, but not who controls its firmware, update infrastructure, remote maintenance services, or other lifecycle dependencies. The 2020 version of this policy ran into the same implementation problem, with some utilities struggling to determine what equipment fell within scope.

   “The 120-day rulemaking window will determine whether this becomes enforceable policy or another unfunded mandate. If DOE applies the “Covered Foreign Entity” definition narrowly and provides a realistic pre-qualification pathway, utilities can plan around it. If the rules function as a blanket ban without realistic transition guidance, the order risks creating the same grid-reliability problem it is intended to prevent. You can’t rip out a 345kV transformer on a regulatory deadline when a compliant replacement may have a multi-year lead time.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.

   “EO14420 is a balanced executive order.  It recognizes that supply-chain provenance is a legitimate national security issue without treating every piece of foreign-made equipment as inherently compromised.  DOE has to identify a connection to a covered foreign entity and make a risk determination, and the order expressly requires consideration of reliability, replacement availability and continuity of service before existing equipment is disconnected or removed.

   “The cyber concern goes well beyond transformers. The order specifically reaches inverters, battery-storage systems, protective relays, PLCs, intelligent electronic devices, software, firmware, maintenance services and remote-access capabilities. The electric grid is increasingly a distributed network of computers, and that is before considering the possibility of undocumented or deliberately concealed capabilities and covert communications channels. Whenever equipment can receive an update or a remote command, who built it, who maintains it and who ultimately retains access to it are important security questions.

   “One interesting feature is what the order leaves out. It reaches transmission down to 69 kV but specifically excludes local distribution. I would not interpret that to mean distribution is safe or unimportant. It looks more like deliberate risk prioritization: generation and transmission are where a successful attack is most likely to create cascading, nationally significant consequences, while distribution is vastly larger, more heterogeneous, subject to different regulatory authorities and potentially much harder to remediate given existing supply-chain dependencies. The exclusion of distribution shouldn’t be read to mean distribution is secure. It means the government is starting with the part of the grid where compromise can most readily become a national event.

   “But that boundary is becoming less comfortable as distributed energy resources proliferate. One compromised residential inverter is not a threat to the grid; coordinated control of thousands or tens of thousands of installations and their inverters, batteries, EV chargers or other distributed resources is a very different proposition. A large fleet of individually modest devices can become a systemically important grid asset if an adversary can command them together. That is why the security of aggregated distributed resources increasingly has to be considered alongside the traditional generation-and-transmission security perimeter.

   “So, I view this EO as an important first step rather than a complete solution.  Cheap infrastructure isn’t cheap if a foreign adversary may retain a control path into it.  The test should be straightforward: do we know what the equipment contains, what and how it communicates with, and who can update or remotely control it?  The next challenge is making sure we eventually apply that same security thinking below the traditional bulk-power boundary, without imposing requirements that utilities and domestic supply chains simply cannot meet.

   “Engineers deliberately build margin into systems, for safety, for growth, and for resilience. In too many parts of the country, rapid load growth and constrained generation and transmission growth are consuming that headroom.  Sophisticated controls and grid-enhancing technologies can help us extract more capacity from existing infrastructure, but they are no substitute for building sufficient physical generation and transmission.  Cybersecurity, supply-chain security and adequate capacity are all parts of the same operational resilience problem.  The United States needs this EO, and it needs substantially more investment in generation and transmission.  It is very encouraging to see this administration treating those issues with the seriousness they deserve.”

Critical Infrastructure needs to be protected. The power system is critical infrastructure and hopefully organizations of all sizes pay attention to this and take whatever action is required to make themselves secure.