E-1: Commissioner James Danly Dissent Regarding Incentives for Advanced Cybersecurity Investment

Commissioner James Danly Statement
April 21, 2023
Docket No. RM22-19-000

I dissent from today’s Final Rule[1] because it is not in line with the Infrastructure Investment and Jobs Act (IIJA) directive to establish incentive-based rate treatments that “encourag[e]” “investments by public utilities in advanced cybersecurity technology” and “participation by public utilities in cybersecurity threat information sharing programs.”[2]  Some have stated that Congress intended for the IIJA to “shore up cybersecurity” across the energy sector and other critical infrastructure.[3]  The Final Rule provides cybersecurity incentives to select energy sector participants and only a few cybersecurity investments.  This rule does not “shore up cybersecurity” of the bulk power system.  At best, it is a tepid response to a clear Congressional mandate.

First, the Final Rule limits incentives and cost recovery to those public and non-public utilities “that have or will have a [cost-based] rate [tariff] on file with the Commission.”[4]  Put differently, the Final Rule excludes public and non-public utilities that sell electricity at market-based rates.  This exclusion is not narrow.  In 2019, the Commission estimated that there were over 2,500 market-based rate sellers.[5]

Given the size of the population excluded, one would expect the IIJA to have directed such limitation.  It does not.  The statute directs the Commission to establish incentive-based rate treatments that “encourage” “public utilities” to make cybersecurity investments and participate in cybersecurity information sharing programs.  It allows for single-issue rate filings and does not distinguish between those utilities with cost-of-service rates from those with market-based rates.

Nor does the broader context of the IIJA support such exclusion.[6]  A reading of the IIJA’s cybersecurity provisions in their entirety make evident that Congress intended for agencies to immediately undertake a broad campaign to support cybersecurity investment in the energy sector.  The IIJA directed the Commission to establish cybersecurity incentives within 1.5 years of its enactment.[7]  Further, as noted by the Electric Power Supply Association (EPSA), “Congress specifically cites small or medium-sized public utilities with limited cybersecurity resources as being potentially eligible for additional incentives beyond those identified in the legislation, demonstrating the Congressional intent to fortify the entirety of the [Bulk Power System] to the greatest extent that is reasonably possible.”[8]  The IIJA also directed the Secretary of Energy to “enhance[] grid security,”[9] “deploy advanced cybersecurity technologies for electric utility systems,”[10] and “increase the participation of eligible entities in cybersecurity threat information sharing programs.”[11]  Simply put, excluding 2,500 market-based rate sellers from cybersecurity incentives and cost recovery is not in line with Congressional intent.  It should also not go unnoticed that the majority fails to include the provisions from the IIJA in its revised regulations regarding additional incentives for certain utilities, including defense critical electric infrastructure and small and medium utilities,[12] without any explanation although there really can be none.

What Congress intended is of no consequence to the majority.  On top of failing to respond meaningfully to EPSA’s argument regarding Congressional intent (an Administrative Procedure Act violation),[13] my colleagues declare (without citing to any provision in the IIJA) that “utilities that make sales of energy, capacity, or ancillary services at market-based rates should [not] be able to continue to make those sales and also separately recover the costs of, and receive incentive-based rate treatment on, eligible cybersecurity investments.”[14]  Then the majority goes on to claim that the “final rule meets the requirements of [the IIJA]” because “[a]ll sellers of energy, capacity, and ancillary services are free to file cost-of-service rates under FPA section 205 . . . to recover their entire cost of service” and “proceed to make sales exclusively under that cost-based rate.”[15]  In other words, the Commission has fulfilled the Congressional mandate because 2,500 market-based rate sellers can always abandon their market-based rate authority and make filings to transact only at cost-based rates.

That reasoning is untenable.  The IIJA intended agencies to adopt policies and rules that would induce swift and efficient investments in cybersecurity by the entire energy sector—it was not designed to undermine competitive markets.  Moreover, the majority’s interpretation effectively voids the IIJA’s directive that “[t]he Commission shall permit public utilities to apply for incentive-based rate treatment under a rule issued under this section on a single-issue basis by submitting to the Commission a tariff schedule under [FPA] section [205[16]] . . . that permits recovery of costs and incentives over the depreciable life of the applicable assets, without regard to changes in receipts or other costs of the public utility.”[17] 

Public utilities submit revisions both to market-based rate tariffs and cost-based rate tariffs under FPA section 205.  While the proposed rule stated that utilities must file to recover costs and incentives in accordance with FPA section 205 and identified certain filing requirements as to utilities with formula rates and stated rates,[18] at no time did the Commission suggest that entities currently making sales of energy, capacity and ancillary services under market-based rate tariffs must make a filing to recover their entire cost of service, including costs of and an incentive return on, cybersecurity investments and proceed to make sales exclusively under that cost-based rate, as set forth in the final rule.  The final rule is not a “logical outgrowth”[19] of the proposed rule, and its sharp departure from the proposed rule violates that the Administrative Procedure Act (APA) requirement that agencies engaged in a rulemaking must provide interested parties adequate notice and opportunity to comment on a proposed rule.[20]  It also is nonsensical.  Even under the construct today, a generation utility may have both a market-based rate tariff under which it sells energy, capacity and ancillary services and a cost-based rate tariff under which it recovers a reactive power revenue requirement.  There is no requirement that such generation utility abandon its market-based rate tariff to recover its cost-based rates.  Because the proposed rule failed to provide adequate notice to the public of any change as to market-based rate sellers, this violation of the APA is an obvious legal error.

Second, the Final Rule unilaterally imposes the heightened requirement that each “cybersecurity investment[s] [must] . . . materially improve cybersecurity through either an investment in Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program.”[21]  The IIJA includes no such materiality requirement.  Congress directed the Commission to “encourage[]—(1) investments by public utilities in advanced cybersecurity technology; and (2) participation by public utilities in cybersecurity threat information sharing programs.”[22]

The IIJA already limits what qualifies as “advanced cybersecurity technology” to “any technology, operational capability, or service, including computer hardware, software, or a related asset, that enhances the security posture of public utilities through improvements in the ability to protect against, detect, respond to, or recover from a cybersecurity threat.”[23]  The ordinary meaning of “enhance” is “to improve the quality, amount, or strength of something.”[24]  It is not to “materially improve the quality, amount or strength of something.”

While the IIJA does not explicitly define “cybersecurity threat information sharing program,”[25] it can be inferred that the statute requires (1) that there is a “program,” (2) that “information [is] shar[ed],” and (3) that information relates to “cybersecurity.”  The statute cannot be read as inferring a requirement that the utility’s participation must “materially improve” the security posture of that utility.  The additional requirements in the Final Rule that the information be “relevant and actionable” and program be “sponsored by the federal or state government” are arbitrary and subjective and also is not in line with the IIJA.[26]  Congress knows how to say “materially improve,” and in fact, did so elsewhere in the IIJA,[27] but did not do so to limit the cybersecurity investments eligible for an incentive.

To make matters worse, the majority provides no meaningful objective criteria for satisfying its materiality requirement.  While the Final Rule lists specific sources that the Commission will “consider” in its determination,[28] even when parties demonstrate that an investment meets the requisite number of sources the Commission finds that it does not “have a high degree of confidence that such item[] will likely materially improve cybersecurity.”[29]  What could be more arbitrary than a “standard” based upon how confident an agency feels?

Third, the majority eliminates the 200-basis point ROE Adder incentive because “[cybersecurity] expenses . . . constitute a large portion of overall expenditures for many cybersecurity investments” and “the Cybersecurity Regulatory Asset Incentive alone provides the encouragement that Congress intended without unduly increasing costs on consumers.”[30]  I disagree.  Like Chairman Phillips, then Commissioner, stated in his concurrence to the NOPR:

I believe the 5-year proposed duration and the 200-basis point adder are adequate to properly incent utilities.  Unlike expenses in the traditional transmission incentives context, the dollar amounts in cybersecurity investments are typically small.  Yet, the benefits of additional, advanced cybersecurity investments cannot be ignored.  Offering anything less than what is proposed would likely be insufficient to incent any action by utilities, as required by Congress.[31]

Moreover, Congress required the Commission to establish a rule to provide incentives to investments in “any technology, operational capability, or service”[32] not just “many cybersecurity investments.”[33]

Finally, Congress did not require the Commission to simply “consider performance-based rates as an option among incentive ratemaking treatments”[34] as the majority contends.  The statutory text states that “the Commission shall establish, by rule, incentive-based, including performance-based, rate treatments.”[35]  There is no ambiguity here that could allow for, or support, the majority’s “interpretation.”

The word “consider[],” while used elsewhere in FPA section 219A,[36] is absent from that provision.  And the majority should not place too much weight on Order No. 679, which interpreted a provision in FPA section 219 similarly.[37]  The Commission’s interpretation in Order No. 679 was arguably not in accordance with law and was never upheld by a court on appeal.  My colleagues cannot rewrite a Congressional mandate because they believe that the statute is “difficult” to implement.[38]

Nor is compliance with this provision as “difficult” as the majority claims.  The Commission could comply simply by establishing a rule that entities can propose on a case-by-case basis a performance-based rate treatment that would measure and tie the rate treatment to the number and severity of cybersecurity incidents.  No more is required on the Commission’s part.

Congress has made it clear that the Commission must provide incentives to shore up the security of the bulk power system.  President Biden has “urge[d] our private sector partners to harden [their] cyber defenses immediately.”[39]  Former President Trump issued an Executive Order declaring that “[i]t is the policy of the executive branch to use its authorities and capabilities to support the cybersecurity risk management efforts of the owners and operators of the Nation’s critical infrastructure.”[40]  Former President Obama warned that cybersecurity threats are “the most serious economic and national security challenge[] we face as a nation” and “America’s economic prosperity . . . will depend on cybersecurity.”[41]  Similarly, last fall in his concurrence to the Cybersecurity Incentives NOPR, Chairman Phillips, then Commissioner, stated, “the nation’s security and economic well-being depends on reliable and cyber-resilient energy infrastructure.”[42]  Instead of following Congress’ instructions, and taking this reliability threat seriously, the majority passes up the opportunity to harden the cybersecurity defenses of the nation’s critical energy infrastructure.

For these reasons, I respectfully dissent.