BILL ANALYSIS

C.S.S.B. 75

By: Hall

State Affairs

Committee Report (Substituted)

BACKGROUND AND PURPOSE

The bill sponsor has informed the committee that despite the many changes made to Texas policy over the last 10 years, the electric grid remains vulnerable to a wide range of both natural and man-made existential threats, including cyber attacks, malware, electromagnetic pulses, and geomagnetic disturbances that would, at best, disrupt the grid and, at worst, cause the entire grid to go down. The bill sponsor has also informed the committee that the state's growth continues to overwhelm all sectors of state industries, causing extreme stress on electric supply and demand, and that electric outages threaten not only individual safety but also elderly, vulnerable, and underprivileged communities who bear disproportionate environmental health and financial burdens when facilities are taken off-line. Further, the bill sponsor has informed the committee that critical weather events, such as the February 2021 power outages, have raised an outcry about the state's preparedness and resilience in managing power distribution and weather-related risks.

C.S.S.B. 75 seeks to improve the state's grid resilience by creating the Texas Grid Security Commission, which is tasked with evaluating all hazards to the critical infrastructure of the ERCOT electric grid, including threats that can cause future outages, among other duties.

CRIMINAL JUSTICE IMPACT

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.S.B. 75 amends the Utilities Code to establish the Texas Grid Security Commission, which is composed of the following members:

· a representative of the Texas Division of Emergency Management (TDEM) appointed by the chief of TDEM;

· a representative of the Public Utility Commission of Texas (PUC) appointed by the PUC;

· a representative of the Railroad Commission of Texas (RRC) appointed by the RRC;

· a representative of ERCOT appointed by the CEO of ERCOT;

· a representative of power generation companies appointed by the chief of TDEM; and

· a representative of transmission and distribution utilities, electric cooperatives, municipally owned utilities, and river authorities appointed by the chief of TDEM.

C.S.S.B. 75 provides the following with respect to the administration and operation of the security commission:

· TDEM must designate a member of the security commission to serve as presiding officer;

· the security commission must convene at the call of the presiding officer;

· the security commission must report to the chief of TDEM;

· a vacancy on the security commission is filled by appointment for the unexpired term in the same manner as the original appointment;

· individuals appointed to the security commission, to the extent possible, must be Texas residents;

· the chief of TDEM may invite officials or former officials of the U.S. Department of Defense or Department of Homeland Security with expertise on electromagnetic pulse defense to advise the security commission; and

· the presiding officer of the security commission or the chief of TDEM may invite to advise the security commission any person whose expertise the security commission considers necessary to carry out the purposes of the bill's provisions, including individuals recognized as experts in the fields of law enforcement, emergency services, communications, water and sewer services, health care, financial services, agriculture, transportation, electricity markets, cybersecurity of grid control systems, electromagnetic pulse mitigation, terrestrial and solar weather, and micro-grids.

C.S.S.B. 75 requires the members of the security commission who are representatives of ERCOT, TDEM, and the PUC to apply for a secret security clearance or an interim secret security clearance to be granted by the federal government and establishes that such a member who is granted an applicable security clearance is a member of the information security working group. The bill provides the following with respect to that working group:

· the working group must determine:

o which information created or obtained by the security commission is confidential;

o which members of the security commission may access which types of information received by the security commission; and

o which members, other than members of the working group, should apply for a secret security clearance or interim clearance granted by the federal government;

· information that the working group determines is confidential must be stored and maintained by ERCOT;

· the security commission must maintain a reasonable balance between public transparency and security for information determined to be confidential; and

· confidential information created or obtained by the security commission is not subject to disclosure under state public information law and a meeting of the security commission that involves the discussion of confidential information is not subject to state open meetings law.

C.S.S.B. 75 requires the security commission to evaluate, using available information on past power outages in ERCOT, all hazards to the critical infrastructure of the ERCOT electric grid, including threats that can cause future outages. The security commission must evaluate the resilience of municipalities in Texas in the following essential areas:

· emergency services;

· communications systems;

· water and sewer services;

· health care systems;

· financial services;

· energy systems, including whether energy, electric power, and fuel supplies are protected and available for recovery in the event of a catastrophic power outage; and

· transportation systems.

The bill authorizes the security commission to create groups to identify and address each hazard as necessary and requires the security commission to assess each hazard both on the likelihood of occurrence of the hazard and the potential consequences of the hazard.

C.S.S.B. 75 specifies that "all hazards" means the following:

· terrestrial weather, including wind, hurricanes, tornadoes, flooding, ice storms, extended cold weather events, heat waves, and wildfires;

· seismic events, including earthquakes and tsunamis;

· physical threats, including terrorist attacks with direct fire, drones, explosives, and other methods of physical sabotage;

· cyber attacks, including malware attacks and hacking of unprotected or compromised information technology networks;

· manipulation of operational technology devices, including sensors, actuators, and drives;

· electromagnetic threats through man-made radio frequency weapons, high-altitude nuclear electromagnetic pulses, and naturally occurring geomagnetic disturbances;

· electric generation supply chain vulnerabilities, including insecure or inadequate fuel transportation or storage; and

· insider threats caused by compromised or hostile personnel working within government or the utility industry.

C.S.S.B. 75 requires the security commission to take the following actions:

· identify methods by which the state can support an overall national deterrence policy as proposed by the U.S. Cyberspace Solarium Commission, including by:

o identifying means to ensure that measures taken to increase resilience of critical infrastructure against all hazards support critical national security functions in Texas; and

o engaging the Texas National Guard to be trained as first responders to cybersecurity threats to the ERCOT electric grid and other critical infrastructure;

· evaluate nuclear generation sites in Texas, the resilience of each nuclear reactor to all hazards, and the resilience to all hazards of off-site power for critical safety systems that support the reactor and spent fuel;

· evaluate current Critical Infrastructure Protection standards established by the North American Electric Reliability Corporation and standards set by the National Institute of Standards and Technology to inform the security commission's recommended standards for protecting grid infrastructure in Texas;

· investigate the steps that local communities and other states have taken to address grid resilience; and

· identify universities based in Texas that have expertise in cybersecurity and other matters that can contribute to the security commission's goal of mitigating all hazards to critical infrastructure in Texas.

The bill authorizes the security commission to communicate with the U.S. Nuclear Regulatory Commission to accomplish the evaluation of nuclear generation sites in Texas and to request funding from TDEM to conduct site visits to local communities and other states as required to investigate the steps they have taken to address grid resilience.

C.S.S.B. 75 authorizes the security commission, in carrying out its duties regarding grid resilience evaluations, to solicit information from defense contractors with experience protecting defense systems from electromagnetic pulses, public utilities that have developed electromagnetic pulse protections for the utilities' grid assets, the U.S. Department of Homeland Security, and the Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack. The bill defines "public utility" as an entity that generates, transmits, or distributes electric energy to the public, including an electric utility, an electric cooperative, a municipally owned utility, and a river authority.

C.S.S.B. 75 requires the security commission, based on the findings of its grid resilience evaluations and investigations, to consider and recommend resilience standards for municipalities and critical infrastructure of the ERCOT electric grid. The bill establishes that standards considered and recommended for energy systems of municipalities should include provisions to ensure that energy, electric power, and fuel supplies are protected and available for recovery in the event of a catastrophic power outage. The bill requires the security commission, not later than December 1, 2026, to prepare and deliver a report to the legislature on the security commission's recommended resilience standards, the estimated costs associated with implementing the recommended standards, the potential effects if the recommended standards are not implemented, and the anticipated timeline for implementation of the recommended standards.

C.S.S.B. 75 requires the security commission to recommend resilience standards for micro‑grids, defined by the bill as a group of interconnected loads and distributed energy resources inside clearly defined electrical boundaries. The standards must be developed for both alternating current and direct current.

C.S.S.B. 75 requires the security commission, not later than December 1, 2026, to prepare and deliver to the legislature a plan for protecting critical infrastructure from all hazards, including a catastrophic loss of power in Texas. The plan must include the following:

· any weatherization recommendations, in addition to weather emergency preparedness requirements prescribed under current law for certain entities that sell electric energy at wholesale in the ERCOT power region, necessary to prevent outages of critical infrastructure from extreme cold weather events, an analysis of whether these recommendations would induce cyber vulnerabilities, and an analysis of the associated costs for these recommendations;

· recommendations for installing, replacing, or upgrading industrial control systems and associated networks, or the use of compensating controls or procedures, in critical facilities to address cyber vulnerabilities;

· recommendations for installing, replacing, or upgrading extra high-voltage power transformers and supervisory control and data acquisition systems to withstand 100 kilovolts/meter E1 electromagnetic pulses and 85 volts/kilometer E3 electromagnetic pulses;

· a timeline for making improvements to critical infrastructure to meet resilience standards recommended by the security commission;

· long-term resilience recommendations for supporting industries, including:

o communications;

o food supply;

o fuel supply;

o health care;

o nuclear reactors, materials, and waste;

o transportation; and

o water and sewer services; and

· any additional recommendations considered necessary by the security commission.

The bill authorizes the security commission to consult with the Private Sector Advisory Council in developing the plan.

C.S.S.B. 75 requires the security commission, not later than January 1 of each year, to prepare and deliver a nonclassified report to the legislature, the governor, and the PUC assessing natural and man-made threats to the electric grid and efforts to mitigate the threats. The bill requires the security commission to make the report available to the public and authorizes the security commission, in preparing the report, to hold confidential or classified briefings with federal, state, and local officials as necessary.

C.S.S.B. 75 includes the following legislative findings:

· electric grid outages threaten the lives of the citizens of Texas and pose a disproportionately large risk to:

o the elderly, vulnerable, and underprivileged within Texas; and

o communities facing disproportionate environmental health burdens and population vulnerabilities relating to facilities such as chemical plants and refineries that can become environmental disaster areas when taken off-line due to loss of electricity;

· the 16 critical infrastructure sectors identified in President Barack Obama's Presidential Policy Directive "Critical Infrastructure Security and Resilience" (PPD-21) (chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, health care and public health, information technology, nuclear reactors, materials, and waste, transportation systems, water and wastewater systems) depend on the electric grid in Texas and make the grid's protection vital to the economy of this nation and homeland security;

· the power outage that occurred in Texas in February 2021 caused:

o death and suffering in Texas;

o economic loss to the state's economy;

o impacts to all critical infrastructures in Texas;

o the dispatch of generation units that likely exceeded limits established by the Environmental Protection Agency for sulfur dioxide, nitrogen oxide, mercury, and carbon monoxide emissions and wastewater release limits;

o radically increased pricing of electricity and made electric power bills unaffordable to many customers across Texas; and

o exacerbation of COVID-19 pandemic risk by forcing many citizens of Texas to consolidate at warming centers and in other small spaces where warmth for survival superseded social distancing protocols;

· a previous large-scale power outage occurred in Texas in February 2011 during which 4.4 million customers were affected;

· the state is uniquely positioned to prevent power outages because the state is a net exporter of energy and is the only state with an electric grid almost exclusively within its territorial boundaries;

· the 2011 and 2021 power outages call into question:

o whether too much risk has been accepted regarding weatherization of electric generation infrastructure;

o whether the state lacks the internal distribution structure and control systems to manage rolling outages; and

o whether sufficient resources have been allocated toward overall grid resilience;

· public confidence in the resilience of the electric grid in Texas is essential to ensuring economic prosperity, domestic tranquility, continuity of government, and life-sustaining systems;

· a resilient electric grid that offers businesses in Texas continuity of operations in the event of a natural or man-made disaster will be an unrivaled attraction for businesses to expand or move their operations to Texas;

· a resilient electric grid that can operate in the event of a natural or man-made disaster will protect important facets of the state, including its military installations and environment;

· current market incentives and regulations are not sufficient for electric utilities to prioritize grid security and resilience and to protect the grid against hazards;

· protection of the electric grid in Texas against hazards would assure businesses and the citizens of Texas that the "lights will be back on first in Texas" in the event of a nationwide catastrophe affecting electric infrastructure, sparing the state from catastrophic societal and environmental consequences; and

· when the state begins implementation of the plan for all hazards resilience provided for by the bill to protect the electric grid in Texas, short-term and long-term economic benefits will far exceed even the most optimistic estimates of the conventional economic incentives provided by tax abatements to attract businesses to Texas.

EFFECTIVE DATE

On passage, or, if the bill does not receive the necessary vote, September 1, 2025.

COMPARISON OF SENATE ENGROSSED AND SUBSTITUTE

While C.S.S.B. 75 may differ from the engrossed in minor or nonsubstantive ways, the following summarizes the substantial differences between the engrossed and committee substitute versions of the bill.

The engrossed and the substitute differ with respect to the composition of the Texas Grid Security Commission as follows:

· whereas the engrossed included a representative of transmission and distribution utilities appointed by the chief of TDEM, the substitute includes a representative of those utilities, electric cooperatives, municipally owned utilities, and river authorities appointed by the chief of TDEM; and

· the substitute omits the provision in the engrossed that provided for the inclusion, at the discretion of the security commission's presiding officer, of any other representative of a state agency, board, commission, or organized volunteer group not expressly identified in the bill, designated by the head of that entity.

With respect to the requirement in the engrossed for the security commission to evaluate all hazards to the ERCOT electric grid, including threats that can cause future outages, the substitute specifies that the hazards to be evaluated are hazards to the critical infrastructure of the ERCOT electric grid.

With respect to the requirement in the engrossed for the security commission to identify means to ensure that measures taken to increase resilience of electric utilities against all hazards support critical national security functions in Texas, the substitute replaces "electric utilities" with "critical infrastructure."

Whereas the engrossed required the security commission to evaluate current Critical Infrastructure Protection standards established by the North American Electric Reliability Corporation and standards set by the National Institute of Standards and Technology to determine the most appropriate standards for protecting grid infrastructure in Texas, the substitute requires the security commission to evaluate those standards to inform the security commission's recommended standards for protecting grid infrastructure in Texas.

With respect to the requirement in the engrossed for the security commission to identify universities based in Texas that have expertise in cybersecurity and other matters that can contribute to the security commission's goal of mitigating all hazards to the grid in Texas, the substitute specifies instead that the security commission's goal is to mitigate all hazards to critical infrastructure in Texas.

With respect to the authorization in the engrossed for the security commission, in carrying out its duties regarding grid resilience evaluations, to solicit information from electric utilities that have developed electromagnetic pulse protections for the utilities' grid assets, the substitute does the following:

· replaces "electric utilities" with "public utilities"; and

· defines "public utility" as an entity that generates, transmits, or distributes electric energy to the public, including an electric utility, an electric cooperative, a municipally owned utility, and a river authority.

With respect to the requirement in the engrossed for the security commission, based on the findings of its grid resilience evaluations and investigations, to consider and recommend resilience standards for municipalities and critical components of the ERCOT electric grid, the substitute replaces "critical components" with "critical infrastructure."

With respect to the requirement in the engrossed for the security commission, not later than October 1, 2026, to prepare and deliver a report to the legislature on the security commission's recommended resilience standards and the anticipated timeline for implementation of those standards, the substitute does the following:

· extends the deadline to not later than December 1, 2026; and

· includes among the report contents the estimated costs associated with implementing the recommended standards and the potential effects if the recommended standards are not implemented.

With respect to the requirement in the engrossed for the security commission, not later than October 1, 2026, to prepare and deliver to the legislature a plan for protecting the ERCOT electric grid from all hazards, including a catastrophic loss of power in Texas, the substitute does the following:

· extends the deadline to not later than December 1, 2026; and

· replaces "the ERCOT electric grid" with "critical infrastructure."

While both the engrossed and substitute include a plan for all hazards resilience, the versions differ in the following ways with respect to the plan's contents:

· whereas the engrossed required the plan to include weatherization requirements necessary to prevent power outages from extreme cold weather events, an analysis of whether these requirements would induce cyber vulnerabilities, and an analysis of the associated costs for these requirements, the substitute requires the plan to include weatherization recommendations necessary to prevent outages of critical infrastructure from extreme cold weather events and the same type of analyses regarding those recommendations that the engrossed required for the requirements; and

· whereas the engrossed required the plan to include a timeline for making improvements to remaining infrastructure to meet resilience standards adopted by the security commission, the substitute requires the plan to include a timeline for making improvements to critical infrastructure to meet resilience standards recommended by the security commission.