What's happening
This bill strengthens security and privacy protections for critical utility infrastructure and customer energy consumption data in New York.
Why it matters
Expands the definition and scope of "critical infrastructure". to explicitly include industrial control systems (ICS) that manage the operational functions of New York’s energy sector, recognizing their vulnerability to cyber and criminal threats, not just physical or terrorist attacks.
Mandates heightened coordination and oversight. by requiring state homeland security and information technology agencies to jointly review, analyze, and report on the cybersecurity of critical energy infrastructure, ensuring that state oversight aligns with the latest federal and industry cybersecurity frameworks and standards.
Establishes strict privacy protections for customer energy consumption data. , preventing electric and gas utilities from sharing, selling, or disclosing individual consumption data to third parties without customer consent—except in anonymized form or as legally required—responding to growing concerns over personal data misuse.
Requires utilities and their third-party contractors to meet minimum cybersecurity standards and carry cyber insurance. if they access energy consumption data, aiming to reduce the risk of data breaches and cyberattacks that could disrupt utility services or compromise customer privacy.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Electric and gas utilities and municipal providers
The bill would restrict disclosure of customer consumption data, subject to consent and specified exceptions, and require electric and gas corporations to establish cybersecurity, safety and insurance requirements for third-party data connections.
Electric and gas customers
The bill would limit third-party access to their consumption data while allowing disclosures for anonymized analysis, utility contractors and purposes authorized by law or commission order.
Third-party energy data providers
Noncontracted third parties seeking connections to utility systems for consumption or other data would have to meet utility-established cybersecurity, safety and insurance requirements.
State homeland security and information technology officials
The bill would require coordinated reviews of energy infrastructure security, give information technology officials access to security audits and reports, and explicitly include cyberattacks and industrial control systems in infrastructure protection work.
Headline styles
Protect Utility Infrastructure Security
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Committed to rules
- Advanced to third reading
- 2nd report cal.
- 1st report cal.327
- Referred to energy and telecommunications
- Committed to rules
- Vote reconsidered - restored to third reading
- Passed senateVote 62–0
- Advanced to third reading
- 2nd report cal.
- 1st report cal.910
- Referred to energy and telecommunications
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect Utility Infrastructure Data
In Assembly Committee · Governmental Operations · Sponsor Michael Cusick
Full text
4 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
6195
2019-2020 Regular Sessions
IN SENATE
May 22, 2019
Introduced by Sen. PARKER -- read twice and ordered printed, and when printed to be committed to the Committee on Energy and Telecommunications
AN ACT to amend the energy law, the public officers law, the executive law, and the public service law, in relation to critical utility infrastructure security and responsibility
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Subdivision 1 of section 3-101 of the energy law, as amended by chapter 253 of the laws of 2013, is amended to read as follows:
1. to obtain and maintain an adequate and continuous supply of safe, dependable and economical energy for the people of the state, including through the protection of critical infrastructure as defined in subdivision five of section eighty-six of the public officers law, and to accelerate development and use within the state of renewable energy sources, all in order to promote the state's economic growth, to create employment within the state, to protect its environmental values and agricultural heritage, to husband its resources for future generations, and to promote the health and welfare of its people;
§ 2. Subdivision 5 of section 86 of the public officers law, as added by chapter 403 of the laws of 2003, is amended to read as follows:
5. "Critical infrastructure" means systems, including industrial control systems, assets, places or things, whether physical or virtual, so vital to the state that the disruption, incapacitation or destruction of such systems, including industrial control systems, assets, places or things could jeopardize the health, safety, welfare or security of the state, its residents or its economy.
§ 3. Section 86 of the public officers law is amended by adding a new subdivision 6 to read as follows:
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD08666-04-9
S. 6195 2
6. "Industrial control systems" means a combination of control components that support operational functions in gas, distribution, transmission, and advanced metering infrastructure control centers, and act together to achieve an industrial objective, including controls that are fully automated or that include a human-machine interface.
§ 4. Paragraph (j) of subdivision 2 of section 709 of the executive law, as amended by section 14 of part B of chapter 56 of the laws of 2010, is amended to read as follows:
(j) work with local, state and federal agencies and private entities to conduct assessments of the vulnerability of critical infrastructure to terrorist attack, cyber attack, criminal behavior, and other natural and man-made disasters, including, but not limited to, nuclear facilities, power plants, telecommunications systems, mass transportation systems, public roadways, railways, bridges and tunnels, and attendant industrial control systems as defined by subdivision six of section eighty-six of the public officers law and develop strategies that may be used to protect such infrastructure from terrorist attack, cyber attack, criminal behavior, and other natural and man-made disasters;
§ 5. Subdivision 1 and paragraph (a) of subdivision 2 of section 713 of the executive law, as amended by section 16 of part B of chapter 56 of the laws of 2010, are amended to read as follows:
1. Notwithstanding any other provision of law, the commissioner of the division of homeland security and emergency services, in coordination with the state office of information technology services, shall conduct a review and analysis of measures being taken by the public service commission and any other agency or authority of the state or any political subdivision thereof and, to the extent practicable, of any federal entity, to protect the security of critical infrastructure related to energy generation and transmission located within the state. The commissioner of the division of homeland security and emergency services and the director of the state office of information technology services shall have the authority to review any audits or reports related to the security of such critical infrastructure, including audits or reports conducted at the request of the public service commission or any other agency or authority of the state or any political subdivision thereof or, to the extent practicable, of any federal entity. The owners and operators of such energy generating or transmission facilities shall, in compliance with any federal and state requirements regarding the dissemination of such information, provide access to the commissioner of the division of homeland security and emergency services and the director of the state office of information technology services to such audits or reports regarding such critical infrastructure provided, however, that exclusive custody and control of such audits and reports shall remain solely with the owners and operators of such energy generating or transmission facilities. For the purposes of this article, the term "critical infrastructure" has the meaning ascribed to that term in subdivision five of section eighty-six of the public officers law.
(a) On or before December thirty-first, two thousand four, and not later than three years after such date, and every five years thereafter, the commissioner of the division of homeland security and emergency services, in coordination with the state office of information technology services, shall report to the governor, the temporary president of the senate, the speaker of the assembly, the chairperson of the assembly standing committee on energy, the chairperson of the senate standing committee on energy and telecommunications, the chairperson of the public service commission and the chief executive of any such affected
S. 6195 3
generating or transmission company or his or her designee. Such report shall review the security measures being taken regarding critical infrastructure related to energy generating and transmission facilities in consultation with the most recent version of the National Institute of Standards and Technology "Framework for Improving Critical Infrastructure Cybersecurity" and the North American Electrical Reliability Corporation's Critical Infrastructure Protection Standards, assess the effectiveness thereof, and include recommendations to the legislature or the public service commission if the commissioner of the division of homeland security and emergency services and the director of the state office of information technology services determines that additional measures are required to be implemented, considering, among other factors, the unique characteristics of each energy generating or transmission facility.
§ 6. The public service law is amended by adding a new section 54 to read as follows:
§ 54. Electric or gas consumption data protection. 1. An electric or gas corporation or municipality shall not share, sell, disclose, or otherwise make accessible to any third party a customer's electric or gas consumption data, except where the customer has consented and as provided in subdivision two of this section.
2.(a) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing a customer's electric or gas consumption data for analysis, reporting, or program management as long as all information has been anonymized regarding the individual identity of a customer.
(b) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing electric or gas consumption data as required or permitted under state or federal law or by an order of the commission.
(c) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing a customer's electric or gas consumption data to a third party that contracts with such corporation or municipality to provide services on behalf of the corporation.
3. An electric or gas corporation shall establish: (a) minimum cybersecurity and safety standards and (b) minimum cyber-security insurance requirements, which shall be applicable to third parties seeking to connect to any such corporation's systems to receive consumption or other data. Any third party not contracted by such a corporation that seeks to connect to such corporation's systems to receive consumption or other data shall meet any such established cyber-security and safety standards and insurance requirements.
4. The commission shall promulgate rules and regulations by January first, two thousand twenty-one to ensure the implementation and enforcement of this section.
§ 7. Paragraph (a) of subdivision 19 of section 66 of the public service law, as amended by section 4 of part X of chapter 57 of the laws of 2013, is amended to read as follows:
(a) The commission shall have power to provide for management and operations audits of gas corporations and electric corporations. Such audits shall be performed at least once every five years for combination gas and electric corporations, as well as for straight gas corporations having annual gross revenues in excess of two hundred million dollars. The audit shall include, but not be limited to, an investigation of the company's construction program planning in relation to the needs of its customers for reliable service, an evaluation of the efficiency of the
S. 6195 4
company's operations and use of customer electric or gas consumption data as provided for in section fifty-four of the public service law, recommendations with respect to same, and the timing with respect to the implementation of such recommendations. The commission shall have discretion to have such audits performed by its staff, or by independent auditors.
In every case in which the commission chooses to have the audit provided for in this subdivision or pursuant to subdivision fourteen of section sixty-five of this article performed by independent auditors, it shall have authority to select the auditors, and to require the company being audited to enter into a contract with the auditors providing for their payment by the company. Such contract shall provide further that the auditors shall work for and under the direction of the commission according to such terms as the commission may determine are necessary and reasonable.
§ 8. This act shall take effect on the one hundred eightieth day after it shall have become a law; provided, however, that section six of this act shall take effect thirty days after it shall have become a law. Effective immediately, the public service commission is authorized and directed to take actions necessary to promulgate rules and regulations related to the implementation of subdivision 3 of section 54 of the public service law on or before such effective date.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the energy law, the public officers law, the executive law, and the public service law, in relation to crit- ical utility infrastructure security and responsibility
Purpose or general idea of bill
This bill will ensure energy grid cyber security is part of any conver- sation regarding the state's energy system, provide communication chan- nels from Homeland Security and Information Technology to the legisla- ture, and protect customer data.
Summary of provisions
Section 1: Amends the Energy Law to include the protection of critical infrastructure as part of the New York State Energy Policy to ensure the adequate and continuous supply of safe, dependable and economical energy for the people of the state.
Read the full memo (1,118 words)
Sections 2 and 3: Amends the Public Officers Law to define "Critical Infrastructure" to include "Industrial Control Systems" and defines "Industrial Control Systems" as "a combination of control components that support operational functions in gas, distribution, transmission, and advanced metering infrastructure control centers, and act together to achieve an industrial objective, including controls that are fully automated or that include a human-machine interface." Industrial Control Systems are used at every level in New York's energy grid to transmit energy generated at one location to another.
Section 4: Amends the Executive Law to require the state Division of Homeland Security and Emergency Services to coordinate with local, state, federal, and private entities to assess the vulnerability of critical infrastructure, including "Industrial Control Systems", to "cyber attacks" and "criminal behavior".
Section 5: Amends the Executive Law to require the state Division of Homeland Security and Emergency Services to work with the state Office of Information Technology Services to conduct a review and analysis of the work being done by the state Public Service Commission and other agencies to protect critical infrastructure related to energy generation and transmission. Every five years, this report shall be made available to the Governor, the Temporary President of the Senate, the Speaker of the Assembly, and the chairs of the Assembly Standing Committee on Ener- gy and the Senate Standing Committee on Energy and Telecommunications and the report shall be undertaken in consultation with the most recent version of the National Institute of Standards and Technology's publica- tion, "Framework for Improving Critical Infrastructure Cybersecurity" and the North American Electrical Reliability Corporation's Critical Infrastructure Protection Standards.
Section 6: Amends the Public Service Law to prevent electrical and gas companies, and municipalities, from sharing, selling, disclosing, or otherwise making accessible customer consumption data to third parties unless it's been anonymized, secured against cyber threats, or it's required by the state or federal government.
Section 7: Amends the Public Service Law to ensure that the five year audits undertaken by the Public Service Commission on large combination gas and electric companies includes an evaluation of their treatment of customer consumption data.
Section 8: The effective date.
Justification
On the afternoon of December 23, 2015, more than 230,000 residents in Ukraine were suddenly plunged into darkness. Power grid operators watched helplessly as the cursors on their computer monitors began moving on their own, eventually disabling power at roughly 30 substations (1). Hackers have similarly probed the American energy grid (2)(3), including in 2017, when the power plant that provides energy to Fort Drum in Upstate New York was targeted by foreign hackers in a massive breach of our nation's energy grid (4). These episodes highlight the need for immediate action by New York State to protect critical infrastructure from threats to our energy grid.
Utilities and generators in New York are turning, in some cases rapidly, to digitalization. The New York Power Authority is the vanguard of this movement, with it's "Vision 2020" initiative designed to build the first "next generation" electric utility (5). The benefits come in the form of increased efficiency, network reliability, and predictive tools that will enable NYPA to better move renewable energy from generation sites in Upstate New York and offshore to high-demand regions like New York City. Other utilities are rolling out a variety of internet connected devices which will enable customers to monitor and curb their electric- ity use in real time and provide savings by encouraging those customers to move their energy intensive activities to "off-peak" hours.
However, cyber attacks targeting the energy grid through internet connected devices have occurred in other countries pointing to possible security risks (6). In Spain, for instance, researchers have found secu- rity flaws in internet connected metering devices that would enable hackers to shut down power to individual homes, create fraudulent bill- ing, or turn the meters against the grid in order to cause widespread blackouts (7). Additionally, the end to end digitization of grid opera- tors and power generators, including NYPA, means each sensor must be secured and monitored. Otherwise, this energy "Internet of Things" could become a vulnerability and exponentially increase the attack surface for malware.
Today, New York's laws are inadequate to protect critical infrastructure and consumer data from the evolving threat of cyber attacks. To address this situation, this legislation would accomplish three key objectives: 1) This legislation would add "Industrial Control Systems", which are used by every utility to manage their distribution network, to the state's definition of "Critical Infrastructure" and enshrine it's protection in the state energy policy. 2) The state Division of Homeland Security and Emergency Services and the Office of Information Technology Services will be empowered to review what is being done to protect this infrastructure and provide lawmakers with data and recommendations to develop good policy so residents are protected from malicious actors both foreign and domestic. That data will be gathered every five years in consultation with the National Institute of Standards and Technolo- gy's publication, "Framework for Improving Critical Infrastructure Cybersecurity," and the North American Electrical Reliability Corpo- ration's Critical Infrastructure Protection Standards. 3) The legis- lation will protect consumer electrical and gas consumption data from misuse by prohibiting utility companies from sharing that data with third parties who do not adhere to strict standards.
1) https://www.wired.com/2016/03/inside-cunning-unprecedented-hackukraines- power-grid/ 2) https://wwvv.utilitydive.com/news/hackers-hit-communications- systemof-en eray-transfer-partners-pipeline/520531/ 3) https://www.eenews.net/stories/1060242741 4) https://wwvv.wsj.com/articles/americas-electrio-grid-has-avulnerable- back-doorand-russia-walked-through-it-11547137112 5) https://www.nypa.goviabout/strategic-vision 6) https://www.politico.eu/article/smart-grids-and-meters-raise- hackingrisk s/ 7) https://www.reuters.com/article/us-cybersecurity-spainidUSKCNOHW15E20141 007
Prior legislative history
None.
Fiscal implications for state and local governments
None.
Effective date
This act shall take effect immediately on the one hundred eightieth day after it shall have become a law; provided, however, that section six of this act shall take effect thirty days after it shall have become a law. Effective immediately, the public service commission is authorized and directed to take actions necessary to promulgate rules and regulations related to the implementation of subdivision three of section fifty four of the public service law on or before such effective date.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.