Powering the Future: The Overlooked Cyber Risks in Our Expanding Electric Grid

Aaron Crow (0:2.179): Hey y'all, thank you for joining me. I just wanted to have this episode. I posted about this this week. The DOE just released a major report on the future of our power grid. And I personally think something's missing. The everybody's talking about AI and AI coming. What does that mean? Then we need more.

Aaron Crow (0:23.010): We need more power. need more data centers. So data centers are getting built all over the country. They're getting built all over the world really, for our country or for the United States and the grid specifically, I live here in Texas and our grid in Urquhart is impacted. In fact, they actually call out Urquhart because there's a lot of data centers being built in this state and a lot of power utility or a lot of generation that's getting stood up in this state as well.

Aaron Crow (0:52.814): to meet that demand. So I'm excited to talk about this. I've got a lot of hot opinions on this. you know, I've spent a long career working in power utility by no means am I an expert. at no time am I pretending to know all the details, but I do know I've been through a lot of plant commissionings and control system upgrades and FATs and SATs and all that type of stuff. And I've seen plants get built and handed off, you know, the builder hands it off and commissioning to the owner.

Aaron Crow (1:22.126): um... and things just aren't madden and that the the experience that i have and i've seen this and i have heard these stories my father was a priority for forty something fifty years uh... he still is dabbling in it and and he has the same experience of this is not coming from you know some you know research paper or you know something that i've heard about this is this is first-hand experience in plants get commissioned and things that are missed so many times and i want to call it any names of of people to build plants of the companies

Aaron Crow (1:50.670): Cause it's not necessarily their fault, but they're built, um, on, on a contract and every only the only things that get done are the things that are in the line in the paperwork that the, that the attorney signed. Right. And the problem with that is sometimes the eyes aren't dotted and T's aren't crossed. Right. Um, so, you know, we're talking about a 50 % load growth by 2030. Um, that is huge. Um, load growth being, we have to build capacity, 50 % more capacity than we currently have.

Aaron Crow (2:20.415): in this country on this grid because the demand is going to grow that much with electric cars, but specifically around AI by 2030. That's this is 2025. You don't build power plants very quickly. Now granted, I before I left my my previous as an asset owner, we decommissioned like four plants and those things are still sitting there. The substations are there.

Aaron Crow (2:43.840): It's very possible for folks to walk into those, those sites and spin up a plant a lot faster than if they were doing it from just a raw piece of earth. That doesn't have a lot of those other things there. So switch yard and gas and, and, you know, roads and, know, the, the, cooling for them, the, the lakes that are nearby. So a lot of those requirements are in those places, but still, even with all of that, there's a lot of things that have changed over, over, you know, the last, lot of these plants were built in the seventies.

Aaron Crow (3:13.773): And there's a lot of things that have changed in designing those plants. So all this growth is really driven by AI data centers cloud and in the report the Department of Energy Didn't even mention cybersecurity in their 2025 resilience adequate adequacy report now granted that wasn't the intention of it 100 % agree but when we're talking about the resiliency of the grid and the added the resilient resource adequacy report

Aaron Crow (3:42.455): There's not a word about OT. There's not a word about cyber. There's not even a footnote. Like there's nothing in there. This is a grid level transformation and we're building it without security in mind. And again, I know this is something that, is not supposed to be part of just that. but again, it has to be there, right? So as we're building out these sites, we have to be considering what those things are. Right. So, so let's dive in.

Aaron Crow (4:11.821): Um, you know, so I'm reading the report, the numbers are just, they're staggering, right? Or caught my home state. We're looking at 50 % increase of peak demand by 2030, 50%. Um, you know, I've been in power plants for, you know, again, a couple of decades and I've seen, you know, I've been around it my entire life. You know, I grew up going to coal mines and power plants as a kid, as my dad was working there. Right. So.

Aaron Crow (4:39.338): I've seen load growth and I've seen plants come online. We've built plants, we've commissioned plants, we've purchased plants from third parties, but we're retiring generation faster than we're replacing it. Coal plants, gas plants, and even some nuclear going offline. Fortunately, I just saw today my former alma mater just got approval to extend the license on a nuclear plant that they have up north. So yeah, we're building renewables, which is great, but

Aaron Crow (5:8.812): What happens when the wind doesn't blow in West Texas? What happens when it's a cloudy day? It's not going to meet the demand for all of these AI data centers, for all of these electric cars. we see, think California has a requirement to outlaw the sale of combustion engine vehicles by 2035. I don't remember the number.

Aaron Crow (5:38.540): If you look at it, if every person in California were going to have an electric car, where are they going to plug them in? Where are they going to charge them? Every parking spot has to have a plug? What about an apartment complex where you've got hundreds or even a thousand parking spots? How do you have the capacity to extend that charging network to those places? So it's not that we can't solve these things, but it's going to impact

Aaron Crow (6:7.667): our ability today, we don't have a solution, right? It just isn't, it isn't there. So are we going to charge them at home? We're going to have, I mean, you, you go to a Tesla charging station today and you could be in line for an hour or longer, especially in highly populated areas, especially California, where you have a lot of these cars. So, you know, that's, that's, that's an that's a huge, huge, big deal for figuring this thing out. And we have to start thinking about cyber and not just cybersecurity, not just, you know,

Aaron Crow (6:37.163): nation state attackers, which those are things that we have to consider. But, know, NERC just came out with a new, you know, what is it? 15 that is East West communication. We have to monitor those things. So before we were just monitoring North and South. So everything from a firewall and a NERC asset, you know, anything that's, 1500 megawatts or 15 minutes is medium or higher. And generation, generation can never be more than medium. And then, you know, obviously transmission distribution, that kind of stuff is, is different classifications and different requirements.

Aaron Crow (7:6.815): But still, like in a generation site, if you are medium or higher, and you're going to have to do east west, meaning I have to know about all the everything that talks to everything. And I have to be able to not only just monitor, I have to not just, you know, have have a tool there, but if you're monitoring alerting on those things, and then take actions, they don't have the skill sets to do those. So we have to be thinking about and some of the switches may not have the capability to do spanning, like there's so many issues that goes into so

Aaron Crow (7:36.553): That's why if we're not architecting, especially on these new plants, these are greenfield, these there's such an opportunity here as we're designing these control systems, as we're designing these third party controls, as we're designing how the IO and the field, you know, the endpoints IDs, everything that PLC is, whatever systems are being used to build these things. What's we need to make, making sure that cyber is part of that table, that we are designing these systems to be cyber resilient. the report says.

Aaron Crow (8:6.538): The actually says, I'm not making this up, says, does not contain information about operational technology and cybersecurity aspects. So they, they, admittedly, it, you know, say that they're not doing. And again, I've already had people say, well, there's another report for that. Awesome. I strongly believe it should be in this report. There should be a section in there at least saying, Hey, we need to get a handle around this. How do you build a resilient grid with one of your largest risk, risk factors, not part of the conversation, not part of the evaluation.

Aaron Crow (8:36.299): So let that sink in for a minute. We're talking about the biggest transformation of our grid in history. And nobody's asking about cybersecurity implications. Nobody's talking about how to secure these systems. Nobody's talking about how to design security by default into these systems as they're being built. Which means if we're not designing them from the beginning and there's another report that talks about cybersecurity, which is always seems to be the way, there's another report that's talking about cybersecurity. What does that mean? We'll figure it out later.

Aaron Crow (9:3.710): We're going design the system and yet there's another report, but we're not, we'll get to that one later. And maybe that's not the case. Maybe, maybe some of the organizations are going to bring it right in and it's going to be parallel path with this. And we're going to, we're going to design these systems. But the fact that there's a separate document in my experience causes confusion causes issues. And that's going to lead to systems that are not designed. And again, it doesn't mean they're insecure necessarily. It just means they don't have security in mind when they're designing them.

Aaron Crow (9:33.174): Idaho national labs design, know, security by design, right? CIE cyber informed engineering. When we're designing these systems, we need to be designing cyber security into them from the beginning. It's so much cheaper. It's so much more effective to do this from the beginning. How am I going to do secure mode access? How am I going to get plant, you know, operators access to these? How am going to get vendors access? I know, you know, everybody knows the largest target control, one of the largest target control companies in the world.

Aaron Crow (10:1.811): one of the largest companies in the world, monitored their turbo control systems. Okay, how do they do that? They have their own process to get in, but they have access to the networks and there's been multiple vulnerabilities known about that system. There's vulnerabilities all the time. There's zero days that come out that we're not gonna know about. And if we're not thinking about these things and how do we design these systems so that these things aren't gonna take us out, then we're losing a massive opportunity.

Aaron Crow (10:30.077): To to secure these systems and do it the right way the first time Again, I've been in these sites where we've built these plants and we knew that they weren't too up to standard They weren't gonna work we literally built a power plant in Texas and when they they they took the boiler and it was in pieces and in a field that had been sitting there for years they put this this thing together this boiler together and they put it together wrong like when they were cleaning it off they sandblasted off the

Aaron Crow (10:59.421): the things that, you know, it's kind of like put A to A and B to B and C to C, right? When they did that, they lost some of the instructions. So they put two pieces together wrong. So what that meant was, is this boiler that you're supposed to be able to have scaffolding and be able to walk all the way around. Well, you couldn't walk all the way around it because part of the section didn't go around and it blocked the path. It sounds silly, but it was too hard to fix down the road. So we just left it that way. With the men on this one floor, if you went around this way, you couldn't walk all the way around the boiler. had to walk.

Aaron Crow (11:28.667): a certain way and then if you're doing a round you have to walk all the way around the boiler back to the other side to be able to get to the next piece of equipment.

Aaron Crow (11:37.277): that also can mean an issue of evacuation. Like there's just all these domino effects that go into this problem, right? So it's such an impactful thing. I talk to people all the time. You go into these state of the art facilities, beautiful equipment, and you ask a project manager that's been there for 20 years, and hey, can you show me the OT architecture?

Aaron Crow (12:5.073): Or can you show me the cyber security? Like how are you handling this? How are you handling that? And there was like, well that's somebody else. I'm not exactly sure. Like we're focused on the operations or that's an operations problem I'm dealing with mechanical. But the cyber stuff has to be everybody's problem. It's no longer an optional thing. It has to be part of the over, like I wouldn't not include safety as part of my conversation. I would not.

Aaron Crow (12:33.575): you know, have it be reliable, as part of my design. So I can't not have cyber to be part of this. think it's too big of a problem. So here's what's keeping me up at night. mean, literally like this is mind blowing to me as I see this. I mean, I'm super excited about AI and the future that's coming with it and all that's coming with data centers and the opportunity to build power. you know, you can, you can map out,

Aaron Crow (13:1.276): the success of a country based upon their power generation and that's that's because of you know third world countries don't have have the power so they can't create

Aaron Crow (13:13.650): So who is building all this new generation? And I'm talking about the companies that funding it. I'm talking about who's actually designing the systems. Are they including cybersecurity? Are they even mentioning the Idaho National Lab Cyber Reformed Engineering Process? It's a couple weeks ago, I was meeting with a major tech company. They're planning to build their own generation to support their data centers, which is this very common, you know, co-

Aaron Crow (13:42.066): cojoin we've we used to do it all the time with like a aluminum smelter and one of our plants supported aluminum smelter in that the company guaranteed any any power that you buy will buy from writing any overage then we could sell it on the grid but these people are are building their own own generations for today's and smart people they know servers they know software they know data centers so ask about redundancy planning for the generation assets

Aaron Crow (14:9.330): And they just said, you know, we'll handle it the same way they do in the data center. I'll add more servers.

Aaron Crow (14:15.942): And I said, no, wait, wait. I meant like, how do you, your power generation redundancy. And they looked at me like I was speaking a foreign language, right? So they don't really understand. We're putting this in front of people that don't necessarily understand. We've bought plants from financial organizations that bought a power plant as an asset because it made money for them. But they didn't do the same maintenance. I think I've told this story before, but I'll tell it quickly again.

Aaron Crow (14:45.296): I was working at the previous company and we had three plants and they were all designed and built I think within the same year but the plans were exactly the same. You could cookie cutter, you could go to one site and look at it and it had the same exact floor plan. They basically just turned the drawing in it but it had the same, when it was built it had the exact same control system, exact same hardware, exact same boilers, exact same turbines, like everything about it.

Aaron Crow (15:10.103): Where the offices were located in the buildings and the popping and every the concrete layout the parking lot like absolutely everything was identical Two of the plants were owned by a power utility company One of the plant was owned by a financial services company The two plants that were owned by the power company they did maintenance. They did upgrades. They did control system upgrades They did you know all this this normal operations because they know how to run a power plant the financial company

Aaron Crow (15:38.059): never upgrade the control system ever. It had never been touched. Nothing in that system had ever been upgraded, patched, know, new functionality capability, anything like that. It was still running. Now, to their point, it was still making them money. So why, if it ain't broke, don't fix. But we had to go in there and fix a whole bunch of things that we knew about it that were issues and could cause problems in safety, availability, reliability, all these things that we knew and they were just, you know,

Aaron Crow (16:7.633): playing Russian roulette and nothing bad had happened yet. Right? So I say this all the time, OT is different. It's not harder, it's just different. You can't control alt delete your turbine or your boiler. You can't patch a generator while it's running.

Aaron Crow (16:27.012): We've learned that the hard way. can't just, you know, be upgrading systems as they're running in the middle of the night from, you know, three hours away and expect everything to be okay. You're going to get some really upset operators and plant managers, tech folks. I'm, I'm one of them. you know, I'm a, a, a recovering, IT technology corporate person. you know, we want to move fast and break things. I want to upgrade. want to test. want to,

Aaron Crow (16:53.232): push all this stuff. want to reboot. I want to take control. This is mine. All the things, but in OT you break things, people lose power.

Aaron Crow (17:2.437): people could die like in Texas in August. You don't have electricity. Some people can die in the winter time. You don't have power and there's a snowstorm. You can die. So specifically, let's talk about Texas for a minute because it hits us for me. I live in Texas. Um, I lived through through it last year. Um, the last couple of years we've had freezes and heat waves. Um, you know, notifications about conserving electricity. Um, we've had rolling Brown outs.

Aaron Crow (17:32.078): Our grid walks a tightrope. This is a deregulated environment. Other states, they can go do a rate case and they can get a rate increase so that they can go justify building a new plant because the demand is low or the demand is high and the supply is low. In Texas, that's not the case. So there's no guaranteed return on your investment here. So it's difficult. more of a risk for a company to build a plant here.

Aaron Crow (18:2.118): can't just import power from, you know, Oklahoma when things get tough. We can, Texas is different. We are caught is, is a isolated environment by design, right? It's, it's DC connections into, you know, uh, Oklahoma and Mexico and all these places, but that's to protect the grid, like the overall grid. that one trip or bringing the grid down on the East coast isn't going to black out the whole country.

Aaron Crow (18:28.773): So taxes can be used and there's this whole thing about Blackstar and I'm not going to dive too much into that, but you you have to have power to start power. That's the funny thing is, is like, you can't just start up a power plant. If hypothetically, if the entire grid went down, you have to be able to start. So you'd get these little gas turbine generators basically, and you get them spinning up enough that you can start one small plant and that gets up enough. And then you have to start the next one. And there's a whole electrical phase that you have to do.

Aaron Crow (18:53.689): to get them all in phase and it's this whole process and we have this black start process for a reason and we can then jumpstart other other, you know, other grids, East coast grid and the West coast grid and even Mexico can help as well. But it, it's a very, very complicated system. now we're adding all this load, all this complexity, all these people and who's owning them and are the people that are running or building these plants, are they, are they operators? Are they, are they the, the,

Aaron Crow (19:22.873): the normal folks like the company I used to work for that runs power plants and knows all the maintenance and all the things that go into them or they Tesla? I mean, I love Elon Musk. He's a smart guy, but he knows how to build rockets and all the things, but they don't know power plant management. That doesn't mean they couldn't hire people and come in. I'm not saying that you have to be, you know, Duke energy or Vistra or, you know, Florida power and light to be able to own a power plant and do a good job. Not at all what I'm saying, but what I am saying is those people have been doing this for so long. They're really good at it.

Aaron Crow (19:53.017): So we have to at least make sure that the people are going to be running these things, understand how to run them, and they're doing them correctly. So when we're running a grid with razor thin margins, when every megawatt matters, you have zero room for error, like zero. Now we're adding a cyber incident into that equation. What happens if we bring down a plant?

Aaron Crow (20:15.608): Picture this, you got a bad actor who compromises the control system. Maybe they get into an HMI at a substation. Maybe they manipulate some protection relay settings. In the past, we would have like spinning reserve that we could, once one thing went down and we had one kind of sitting and waiting, but we're getting so narrow on our spinning reserve, we don't have those things as much anymore.

Aaron Crow (20:41.262): So that can lead to, and again, it doesn't have to be a cyber attack. can be, you know, somebody having an accident running into a transformer or bad weather. We just had a bunch of bad weather in Texas that, you know, water and damage, anything like that can cause issues. We just need to be considering all of these things when we're designing these systems and we're doing a good job on some of them. I think this report, they're talking about a lot of the good things, but what about the cyber aspect? What about the technology design?

Aaron Crow (21:11.211): and designing that cyber resiliency in, right? I believe it's non-negotiable. I believe cyber-informed engineering needs to be mandatory in all these new generation projects. It's not a we'll think about it. It's not a separate process or a separate report. know, NERC SIP is a great thing, but it's not mandating. Like a lot of these will probably be underneath the NERC SIP requirement for a lot of the problems that we're talking about. Those will probably be smaller.

Aaron Crow (21:38.286): you know, under 1500 megawatt units, which means there'll be low impact and there's very low requirements on a low impact NERC SIP site. So they don't have to do, I mean, I don't even think you have to have an asset inventory. Like don't quote me on that. know, Patrick, you can, you can scream at me if I'm wrong on that. But the point is, is like the requirements for a low impact generation side is super low. And it's not enough. It's also short-sighted. I love compliance. I love NERC SIP. I think it's done. think it's one of the reasons why

Aaron Crow (22:8.131): out of the critical infrastructure verticals, know, 16 or 17 critical infrastructure in the United States. think power is one of the most mature. And I think that's because of NERC SIP. I've spent a lot of time with NERC SIP and it can be frustrating. Compliance can be frustrating, but I also believe it's the reason why we are so much more mature in the, generation and power utility environments. But we need to be able to understand this has to be mandatory. This has to be, these things need to be designed with this capability now because it's too expensive and too

Aaron Crow (22:38.712): Difficult after the fact to add it because you're changing the way the plant works many times you're changing the way and then I'm gonna have to get budget for it and it's not part of it it's way more expensive to do it like everything about it is more difficult we are So losing out by it's not even gonna be a huge cost difference to add the security by design in now if we add it later, it's gonna be Exponentially more expensive and then when are we gonna do it? That's the problem. It's like I'll handle that later When is later is it?

Aaron Crow (23:6.273): before or after we have something bad happen. So we also need to bridge the knowledge gap, right? We need to make sure that the tech companies that are playing in this power space, they understand that what they're buying and what they're running and understand that the power industry and OT is different than a data center, even though it's not just a data center with turbines, it's not just, it's different physics and risks and consequences and requirements and compliance.

Aaron Crow (23:35.308): We need to understand who owns the security. How many times have they seen this? Like plant gets built, handed over to operations, suddenly they discover there's no security architecture. There's no, I talked about the walk it around the boiler. once they're done, they've signed and you've received it. You've commissioned that plant, they're done. They're not coming back and fixing things, they're done. So the company I worked for, we would literally say, we'll fix that after the fact. So was too expensive to get the contractor that was building the plant to change it.

Aaron Crow (24:3.830): So they just build it knowing that it's wrong and that's not how we want it. And then we spent the next three years fixing it to be the way that we wanted it.

Aaron Crow (24:13.686): That's super dangerous in this space.

Aaron Crow (24:18.092): So I always say that we're on the same team, whether you're IT or OT, you're generation transmission, you're on the C-suite, you're a vendor. Like we all are wearing the same Jersey and it's, it says critical infrastructure. says power utility. says generation, right? We're on the same team, but we're not always playing like we're on the same team. A lot of times, you know, we've been building critical infrastructure like it's, you know, 1995 when the threats are, you know, I'll just disconnect it from the network or I'll disconnect the modem, right?

Aaron Crow (24:48.161): But the math doesn't work like that anyways, anymore. So here's my challenge to anyone listening. If you're involved in new generation projects, I don't care if you're the owner, the vendor consultant, you you're just a grunt, whatever, start asking hard questions. Where are the OT security requirements? Who's responsible for security post-commissioning? Have we considered cyber-informed engineering? And if they haven't heard of it,

Aaron Crow (25:16.574): Idaho national labs is a great resource. Reach out. It's there. There's training you can take like all the stuff is online. It's super, super powerful to use in this scenario. And then do we, do we actually understand the doors between OT and IT reliability? And if you're in operations, if you inherit these new plants, don't wait to hand over, ask about security, do it now. Cause it's going to be more difficult after you commission that plant, make sure that you have a cyber representative in the design buildings.

Aaron Crow (25:45.765): Design meeting, excuse me.

Aaron Crow (25:49.153): bringing donuts if you have to, right? know, bribe your way, get in the room, talk to the vendors, figure out who the right people to talk to are, make sure that we're doing this stuff early as possible. At the end of the day, we all want the same thing. I want the lights to stay on. I want my electricity to work. I want my cooler to work, my fridge. We want our critical infrastructure protected. I want my kids to be able to go to school. I want to be able to go pop gas. I want to be able to go, you know, to the movies. But here's the thing, and this is why I'm optimistic.

Aaron Crow (26:19.177): Our community, OT security community, we've solved harder problems. Power industry, we've solved harder problems. This is not a difficult problem to solve. We know how to do it. Sometimes it's not always convenient to do it the right way. Sometimes, why do it right when you can do it twice? I can't tell you, unfortunately, how many times I've heard that statement in power utility over the years. Why do it right when you can do it twice? So.

Aaron Crow (26:46.004): We seem to make sure that we're at the table, make sure that our voices are heard, because the bad guys, the nation states, the attackers, they're not waiting for us to figure it out. As soon as they see these things come online, they know that's probably the time that it's the most vulnerable. So do this now. So.

Aaron Crow (27:7.391): At the end of the day, that's it, my rant for today. But seriously, if you guys are, what are you seeing out there? Are you involved in new generation projects? Are you seeing cybersecurity requirements? Are you seeing what I'm seeing? All of these new, if you're with Microsoft, if you're with Tesla, if you're with any of these folks that are building these new data centers and new generation to go along with them, drop me a line. Find me on LinkedIn.

Aaron Crow (27:35.840): I'd love to have a conversation with somebody that's building one of these data centers that's part of these teams. How are we doing this? How are we making sure that security is part of this? Security by design, it's included in these conversations. That's all. Thanks, Charles.

Transcript lightly edited for readability.