Program Revamps, More Money Needed to Gird the Grid for Cyber Attacks: Experts

‘America’s adversaries are not waiting ... they are already embedded,’ witness warns House panel during three-hour Dec. 2 hearing.

A member of the hacking group Red Hacker Alliance, who declined to give his real name, is seen using a website that monitors global cyberattacks on his computer in Dongguan, Guangdong Province, China, on Aug. 4, 2020. Nicolas Asfouri/AFP via Getty Images

Congress must quickly reauthorize key federal cybersecurity programs and boost funding for collaborative public–private initiatives if the United States’ electric grid and pipeline networks are to withstand diverse, increasingly sophisticated, high-tech attacks, utility and energy industry leaders warn.

“America’s adversaries are not waiting,” Zach Tudor, associate laboratory director of Idaho National Laboratory’s National and Homeland Security Science and Technology directorate, said during a three-hour Dec. 2 hearing before the House Committee on Energy and Commerce.

“They are already embedded in our systems, mapping our infrastructure, and preparing to disrupt critical operations at a time of their choosing,” he testified.

“Cyberattacks on energy infrastructure are a daily reality and a growing weapon. Congress has a vital role to play in ensuring that policy, funding, and oversight match the scale of the challenge.”

That challenge is daunting, Tudor and four other witnesses told the panel, and spans a broadening landscape of threats orchestrated by nation states such as China and Russia, ideological “hacktivists,” and criminals, as documented in the Annual Threat Assessment by the Office of the Director of National Intelligence published in March.

Xcel Energy Security and Resilience Policy Area Vice President Sharla Artz said in her testimony that Volt Typhoon, a cyber-sabotage “actor” sponsored by the Chinese Communist Party (CCP), not only has “compromised multiple U.S. critical infrastructure providers” but also is more capable now of “disrupting operational controls” than it was when first detected by Microsoft in spring 2023.

“The threat is real, it is advanced, and it is persistent,” she said, speaking on behalf of the Edison Electric Institute, a Washington-based association that represents investor-owned utilities that provide electricity for nearly 250 million Americans nationwide.

Artz said that one of the institute’s priorities is convincing Congress to preempt “state-level initiatives that seek to increase public access to grid information” because “the release of such sensitive information could inadvertently aid malicious actors” and expose infrastructure vulnerabilities.

“We continue to urge policymakers and regulators to carefully balance transparency with the imperative to safeguard details that, if disclosed, could pose risks to national security and public safety,” she said.

A screenshot shows a WannaCry ransomware demand, provided by cybersecurity firm Symantec, in Mountain View, Calif., on May 15, 2017. Experts say attackers often leave a note instructing victims not to touch their IT systems, but instead download a Tor browser, visit a darknet site, and initiate communication with the attacker. Courtesy of Symantec/Handout via Reuters

Program Priorities

Artz and North American Electric Reliability Corporation Senior Vice President Michael Ball were among witnesses who called for permanent funding for the Department of Energy’s Energy Threat Analysis Center, a public–private pilot collaboration that convenes government and industry experts to analyze and advise on emerging threats.

Ball, who also serves as CEO of the corporation’s Electricity Information Sharing and Analysis Center, said October’s temporary reauthorization of the Cybersecurity Information Sharing Act through January was a reprieve but not the resolution the nation seeks from Congress.

“Industry representatives and cyber experts are urging lawmakers to act quickly to enact a more long-term solution,” he said in his testimony.

Ball said Congress must increase the $3 million it annually allocates for the Cybersecurity Risk Information Sharing Program, a public–private partnership jointly funded by the Department of Energy (DOE) and industry that his center manages “to facilitate participation of smaller companies that otherwise lack sufficient resources.”

“Any increase would benefit the program,” he said, and would help “the sector undertake proactive mitigations to better defend against new malicious cyber tactics, techniques, and procedures.”

Tim Lindahl, president and CEO of Kenergy Corp., agreed, stating that his Kentucky co-op is among the nation’s 900 nonprofit local electric cooperatives that need federal and state assistance in overcoming a “rural resource gap” to ensure they aren’t easily exploitable targets.

Speaking on behalf of the National Rural Electric Cooperative Association, whose members provide power to 42 million customers across “56 percent of the American landscape,” he said Congress must fully fund and reauthorize the Rural and Municipal Utility Cybersecurity Program.

Established under 2022’s Bipartisan Infrastructure Law, the program authorizes $250 million over a five-year period through fiscal year 2026 and is “a generational opportunity to improve the cybersecurity posture” of electric cooperatives and municipally owned utilities, Lindahl testified.

“There is an estimated $160 million left in [the program] with less than a year left in its authorization,” he said, urging Congress to also reauthorize the program beyond its 2026 expiration.

Microsoft, in spring 2023, detected Volt Typhoon, a cyber-sabotage “actor” sponsored by the CCP that had “compromised multiple U.S. critical infrastructure providers." It is a threat that remains as viable today as it was then, witnesses told a House panel in a Dec. 2, 2025, hearing. REUTERS/Matt Mills McKnight/File Photo

Rethinking Strategies

Girding the grid will require “modernization from top to bottom,” according to Harry Krejsa, director of studies for the Carnegie Mellon Institute for Strategy & Technology, who served as White House National Cyber Office director in the Biden administration.

He called for “a whole-of-nation strategy to guarantee the security, availability, and vendor trustworthiness of modern energy technologies that will be key to powering the [artificial intelligence] race and subsequent engines of innovation” that can “continue to evolve and be flexible to the modern realities facing us in the years ahead.”

Congress must better coordinate federal agency professionals with industry experts, academic researchers, and specialists in “Chinese geopolitical and economic statecraft,” Krejsa said.

The panel should ensure the White House National Cyber Office, the DOE, the Cybersecurity and Infrastructure Security Agency, and the National Security Agency “develop a joint risk and remediation framework ... that can inform legislative priorities for onshoring initiatives and sourcing from Foreign Entities of Concern,” he said.

The White House’s Office of Science and Technology Policy, the Department of Commerce, and the DOE should “establish an R&D strategy for modern energy technologies that not only are game-changing generation and storage tools,” Krejsa said, “but also provide ‘leap-ahead’ substitution opportunities for U.S. and allied manufacturers currently dependent on [China-based] supply chains.” Technologies would include next-generation batteries and geothermal, advanced nuclear, and fusion energies.

Governments at all levels should enlist artificial intelligence-driven hyperscalers—from among the small number of U.S. actors that understand energy economics and how the CCP exploits “flawed software”—to devise security practices for the energy sector, he said.

Success will require “rethinking existing industry convening and coordination structures,” Krejsa said, and “adopting more dynamic risk-and-reward assessments to identify critical ‘linchpin technologies,’ combining public-sector threat intelligence with private-sector purchasing power to drive secure-by-design practices.”

“Taking these steps will ensure the public and private sectors are prepared to collaboratively secure the energy foundation for America’s future while denying our adversaries the leverage to disrupt it,” Krejsa said.