Energy Poverty and Potential Impacts to Other Critical Infrastructures

The talk opens with the speakers' careers in the electric sector and frames the central problem: utilities must become clean, reliable, equitable, resilient and secure at the same time. The United States has roughly 3,000 electric utilities, most of them small, including about 900 rural cooperatives, and some have no one dedicated to security. The history runs from 1930s rural electrification through smart grid spending, the 2013 Metcalf substation attack, the Colonial Pipeline restart, and recent storms and shootings at transformers.

The middle section looks at money and responsibility. Many households struggle to pay their energy bills, and federal clean energy funding is far larger than federal cybersecurity funding. The speakers describe a firmware problem with solar inverters in Hawaii, rooftop devices whose owners are told to firewall them, and a ransomware attack on a 7,000-customer utility handled by a single overloaded employee. They ask who is legally responsible for keeping the lights on when distributed devices belong to others, and they raise concerns about foreign-made inverters with remote radio access.

The closing section offers possible directions. These include defining critical infrastructure by region rather than by utility type, setting a stable and achievable baseline of security goals, and giving small operators decision support instead of more products. Other ideas are cyber-informed engineering, limiting how many devices of one brand connect to a feeder, clearer sensor data standards, and regional support centers that pair students with small utilities. The speakers conclude that solving this will take more than people inside the electric sector.