Title: Power, Privacy, and Protection: Unpacking Security Challenges in the Energy Sector
Speakers: Chris Jones and Jim Koenig
Chris Jones (00:08):
Jim, thanks for joining us today to talk about the exciting intersection of energy law and privacy law, which I will admit five years ago this was not a conversation I anticipated having, but here we are to talk about that exciting intersection. But first an introduction — you are a partner out of our New York office and work on privacy. Now, what exactly does that mean for those of us that don’t do that every day?
Jim Koenig (00:32):
Well, privacy law is at the intersection of a couple different disciplines. Privacy now includes not just the laws around the collection, use, and sharing of information related to individuals — personal information — but it also now encompasses security and cybersecurity. And that often includes not just personal information, but any information: valuable, sensitive, government safety information, much of which is related to power. And finally, when nobody else was looking, artificial intelligence and the ethics around that has often been part of this practice as a growing area, because many of the principles that go into using personal information or balancing safety versus surveillance — those same issues have come front and center in the ethics around artificial intelligence.
Chris Jones (01:28):
I want to come back to AI. But let’s start with grid security. I understand grid security has for a number of years been a big issue, a big policy issue at the state and federal level — how to secure the grid and protect it from potential wrongdoers. But I get the sense that that is not the universe of privacy issues that power companies need to be worried about. There’s more to it out there these days, isn’t there?
Jim Koenig (01:51):
Well, it’s true. While grid security is paramount — it’s about safety and protection from foreign actors and terrorists to make sure that we all have a supply of power for usage — as cyber techniques and threat actors become more sophisticated, that continues to evolve. And it’s an area that many of our power clients continually increase their practices in. But between NERC and FERC and other state and regulatory areas, many of them have invested a lot of money and it’s very locked down.
Chris Jones (02:33):
What about supply chain issues? Is that something you end up spending time on?
Jim Koenig (02:39):
No, that’s a key focus area. While many of our power companies — whether in generation, transmission, or distribution — are very locked down with respect to their own practices, often it’s the supply chain vendors, third parties, even contractors and service providers who get access to grid architecture information, supply information, or demand information that have increasingly been both subject to breaches and cyber attacks. They’ve also been targeted because if threat actors know that the power companies themselves are locked down, they look for the weakest link in the chain.
Chris Jones (03:24):
What about customer information? It sounds like that’s an area too where power companies have seen an increased focus to make sure that they’re in a position to protect not only their own information but their customer information.
Jim Koenig (03:37):
You’re dead on in that. Look, personal information — especially with respect to generation and transmission companies — it’s B2B. So they’ve never really had much personal information. But many of these companies, given the demand and desire to increase revenue and profitability, have now entered new services, whether they’re providing internet service, smart thermostats, or other things that are in the home. All of a sudden they’re collecting a significant amount of consumer information, billing information, credit card information, and things that they didn’t always have directly before. Now, the difficulty is twofold. One, the security — most of the grid information is locked down, but now this consumer information and payment and other information are in different databases that aren’t secured the same way or at the same expense. Plus, did they have the right permissions to be able to have those engagements?
They just haven’t had the same experience with having direct consumer contact and engagement and collecting that information. But that’s an area where many companies are quickly maturing because the financial reward of entering those new businesses makes it worth it.
Chris Jones (04:55):
So you work with a lot of clients across different sectors, but how’s the power sector doing generally? What grade would you give the power sector today and what do you think they really need to focus on going forward?
Jim Koenig (05:06):
I think with respect to basics and building block courses, straight A’s. It’s important for the protection of critical infrastructure and they work well and collaborate together through the ISAC information sharing group. And they actually do industry-wide cyber simulation war games as if we’re being attacked — GridEx is the name of that, where many of our companies participate. They’re doing very well with the basics. It’s the advanced moves — the new businesses and new areas — where it’s a mixed bag. Some take it very seriously, but some, not that they’re not taking it seriously, but they don’t have the same investment of time, money, and human capital to make that strong. And it’s a new area where they need support, and it’s an area where we’ve been able to help them on privacy, security, and the budding area of AI.
Chris Jones (06:02):
So speaking of emerging areas, even within the power sector — batteries are a huge issue. Battery storage technology, as you know, has come leaps and bounds from what it used to be, and now we see grid scale batteries popping up all over the place and creating all sorts of challenges and opportunities. What are the challenges associated with battery technology in your world?
Jim Koenig (06:24):
Well, it too is security and privacy, but it’s a little bit different. Different from the power companies that have a national security and critical infrastructure mandate behind them — where the stakes are so much higher. With respect to batteries, you have both the manufacturers and then you have the charging stations. Now, those potentially — as opposed to affecting a city or an area — their level of impact is maybe a vehicle or a particular device, which is important, but one by one it’s different. And so they haven’t applied the same amount of resources in that sector, but they’re coming up quickly because of the promise of autonomous vehicles and electric vehicles needing to make sure that those things are sound. Just the same way planes made sure that not just the critical engine components were secure and not addressable by the internet. Once they started adding new services, they created a separate siloed area to protect that information. Cars are going through the same thing now. Now that they’re becoming connected vehicles, they’re making sure that the security is in place and that they have the right permissions for privacy to add new services — things that make that area a very interesting place.
Chris Jones (07:50):
And are those things that a battery developer needs to be worried about, or a utility off-taker on a battery project? Where does that risk fall today?
Jim Koenig (07:58):
Sure. Well, security definitely applies to the battery manufacturer, but for the charging side — or even folks that make charging stations for the home, or renewable energy that can be stored in the home — all of a sudden, while that may seem like business to business and not very interesting information, it’s actually a very big privacy concern if not handled well. It can tell you when you’re home based on your power usage. When you connect to a charging station, I know you’ve returned home. When you disconnect, I know when you’re leaving for work and when your house may be vulnerable. Also, the internet of things — whether it’s thermostat devices or other smart home products, which are an area many are entering into — the charging devices there can also give hints about what appliances are being used in your house, so you can tell about different activities and behavior while in the house as well.
And so the smarter AI and other tools that can derive things from that data, the more this area will be of increasing concern and needs to be focused on as innovation and business continue to grow in this area.
Chris Jones (09:18):
So you mentioned AI a couple of times. Let’s talk about it. AI — threat or opportunity for the energy sector, or both?
Jim Koenig (09:26):
Oh, absolutely an opportunity. With AI, you can look at consumption patterns and trends, and you can do a better job with demand pricing. You can do a better job making sure that you have power supply availability and manage that more cost effectively than if you had less insight into that area. But meanwhile, one of the concerns around AI — besides security, safety, and a number of other things we’ve talked about — is making sure that it’s done in a way without discrimination and bias. Now you may ask, how in the world would demand pricing potentially end up with bias and discrimination? But it comes down to making sure that it’s not done in a way that, maybe not intentionally, discriminates. If you have bias in the data or train an algorithm on biased data, the output will be flawed too.
For example, you may think, well, let’s just do it by zip code. In financial services, it was actually determined that using zip code is discriminatory because it correlates with socioeconomic and racial lines. And so some of the natural things you turn to without thinking — with respect to power, as in other industries — have already had challenges with respect to fairness and bias. Looking at larger statistical metropolitan area power consumption and things like that, and making sure that data doesn’t create bias from the outset — those are some of the things that the power, energy, manufacturing, and charging sectors, and others within that ecosystem, are making sure they collectively do in a way that’s fair and provides equity and access to all.
Chris Jones (11:22):
That’s great. So it sounds like you get brought in during a crisis when there’s a data crisis of some sort. Do you also work with clients to develop best practices or try to get out ahead of these issues?
Jim Koenig (11:33):
Absolutely. For many companies that are looking to start in some of these areas — first, the new businesses — it’s not uncommon to develop a commercial privacy playbook of what you need from vendors and third parties, or updating your privacy policy to make sure that these new uses of information are covered and that your marketing practices align with the new privacy policy. Another area is with respect to those doing some artificial intelligence or new derived analytics. A key place to start: a number of our clients are developing ethical data collection, use, and sharing guidelines — here are things we’re never going to do, here are things we’re going to strive to do, and here are some policies, procedures, training, and additional best practices that we’re going to follow to do our best.
You can’t anticipate all of the consequences and the direction of where AI models will take you, but that’s a start. Whether it’s predicting when a wind turbine engine needs replacement — that’s out there now currently — or power demand on the electric grid — that’s out there now currently — but you start adding consumer services about charging stations and smart things in the home, and all of a sudden you’ve entered a whole new realm where it’s much more personal to people and potentially attracts a lot more threat actors who are just as creative and just as vigilant. So it’s a little bit of an arms race.
Chris Jones (13:20):
So on the cutting edge of technology, it’s hard to avoid talking about autonomous vehicles. Have you done any work in that area? Are there any unique challenges about autonomous vehicles that you don’t see in other parts of your practice?
Jim Koenig (13:33):
Of course. I’ve worked for several large auto manufacturers, one of the big four, an electric vehicle company, and handled cybersecurity issues. I’ve worked for a number of foreign automotive and EV companies looking to bring their vehicles to the United States. I’ve worked for ride hailing companies who’ve had privacy problems or were looking at how to use their data to create more value in a way that was in line with their privacy promises, plus a whole host of others within the ecosystem. Definitely an area of growing focus is the privacy, security, and AI uses for autonomous and electric vehicles and connected cars.
Chris Jones (14:26):
That’s great. Well, Jim, you and I have been doing a lot more work together recently. I know we’re going to do more as we go forward, but thanks for being with us today and sharing your insights.
Jim Koenig (14:35):
Well, having the right protection of the information, the proper permissions to be able to use it, and the right focus and ethical core to be able to use it for AI — that’s the real power.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This video is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this video may save and use the video only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this video may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided “as is,” with no warranty as to the accuracy or reliability. Please listen to the video for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.
