BEFORE THE PUBLIC UTILITIES COMMISSION OF THE

STATE OF CALIFORNIA

Order Instituting Rulemaking to Consider

Smart Grid Technologies Pursuant to Federal
Legislation and on the Commission’s Own Rulemaking 08-12-009
Motion to Actively Guide Policy in California’s (Filed December 18, 2008)
Development of a Smart Grid System

REPLY COMMENTS OF CYBERSECURITY AND PRIVACY LAW AND POLICY

RESEARCHERS ON PROPOSED DECISION ADOPTING REQUIREMENTS FOR
SMART GRID DEPLOYMENT PLANS PURSUANT TO SENATE BILL 17 (PADILLA),
CHAPTER 327, STATUTES OF 2009

Aaron J. Burstein
Deirdre K. Mulligan
University of California, Berkeley*
School of Information
South Hall
Berkeley, CA 94720

*
Institutional affiliation is provided for identification purposes only. The views expressed in this
comment do not purport to represent those of the University of California.
Dated: June 15, 2010
BEFORE THE PUBLIC UTILITIES COMMISSION OF THE

STATE OF CALIFORNIA

Order Instituting Rulemaking to Consider

Smart Grid Technologies Pursuant to Federal
Legislation and on the Commission’s own Rulemaking 08
08-12-009
Motion to Actively Guide Policy in California’s (Filed December 18, 2008)
Development of a Smart Grid System

REPLY COMMENTS OF CYBERSECURITY AND PRIVACY LAW AND POLICY

RESEARCHERS ON PROPOSED DECISION ADOPTING REQUIREMENTS FOR
SMART GRID DEPLOYMENT PLANS PURSUANT TO SENATE BILL 17 (PADILLA),
CHAPTER 327, STATUTES OF 2009

Pursuant to Rule 14.3 of the Commission’s Rules of Practice and Procedure, we

respectfully submit this reply to comments filed on the Proposed Decision Adopting

Requirements for Smart Grid Deployment Plans Pursuant to Senate Bill 17 (Padilla), Chapter

327, Statutes of 2009, filed May 21, 2010 (“Proposed Decision”).

I. THE COMMISSION SHOULD HAVE FULL ACCESS TO CYBER SECURITY

AUDIT INFORMATION AND ESTABLISH CRITERIA FOR PUBLIC
DISCLOSURE.

As we stated in our Opening Comments,1 and emphasize here, keeping the Commission

and the public informed about the security of Smart Grid-related information and control systems

does not entail a binary choice between unrestricted public disclosure and no disclosure at all.

We acknowledge that audit plans, test reports, and other documentation developed in connection

with a cyber security audit may contain information that could assist an attacker. Publicly

1
Researchers’ Comments at 5.
disclosing such information clearly would not be in anyone’s best interests. The solution to this

problem is to redact sensitive information from audit reports, or to summarize the audit’s

findings. We support further development of criteria for redaction or creating digests of audit

results.2

However the Commission chooses to limit the disclosure of audit results and

documentation in deployment plans, we urge it to ensure that it has full access to these

documents. In addition, preserving the ability of an independent third party to review these

documents will provide the Commission with additional sources of technical expertise and a

basis for building customers’ trust in the Smart Grid.3 Thus, full access for the Commission and

an independent third party is crucial to the Commission’s oversight and public acceptance of the

Smart Grid. It will also provide the Commission with better, more complete information as it

considers adopting cyber security standards. Finally, access to these documents under these

conditions can be tightly controlled using standard techniques that minimize the risk that

sensitive information will fall “into the wrong hands.”4

II. CONCLUSION

We thank the Commission for the opportunity to reply to other parties’ opening

comments on the Proposed Decision.

2
See id. at 6.
3
See Opening Comments of CDT and EFF at 3-4 (“An understanding of basic privacy and
cybersecurity issues associated with the flow of energy usage data is important for
interoperability, for consumer trust and acceptance, for third parties planning services based on
energy usage data, and for the robust development of systems and technology more generally . .
.”).
4
Southern California Edison Opening Comments at 4.

2
 Respectfully submitted this June 15, 2010, at Baltimore, Maryland,

/s/ Aaron J. Burstein

AARON J. BURSTEIN

/s/ Deirdre K. Mulligan

DEIRDRE K. MULLIGAN

University of California, Berkeley*

School of Information
South Hall
Berkeley, CA
Telephone: (510) 410-6964
Email: aaron.burstein@gmail.com

*
Institutional affiliation is provided for identification purposes only. The views expressed in this
comment do not purport to represent those of the University of California.

3
 CERTIFICATE OF SERVICE

I certify that, pursuant to the Commission’s Rules of Practice and Procedure, I have

served a true copy of REPLY COMMENTS OF PRIVACY AND CYBERSECURITY LAW

AND POLICY RESEARCHERS ON PROPOSED DECISION ADOPTING

REQUIREMENTS FOR SMART GRID DEPLOYMENT PLANS PURSUANT TO

SENATE BILL 17 (PADILLA), CHAPTER 327, STATUTES OF 2009 on all parties

identified in the attached service lists. Service was effected through the means indicated below:

Transmitting copies to all parties who have provided an email address; sending copies via

first-class mail to all parties who cannot be served electronically; and sending copies via e-mail

and first class mail to Administrative Law Judge Timothy Sullivan and Andrew Campbell,

advisor to Commissioner Nancy Ryan.

Executed this June 15, 2010, at Baltimore, Maryland.

/s/ Aaron J. Burstein

AARON J. BURSTEIN
Research Fellow
University of California, Berkeley
School of Information
South Hall
Berkeley, CA 94720

Last changed June 8, 2010
Andrew Campbell
Advisor to Commissioner Nancy Ryan
California Public Utilities Commission
505 Van Ness Avenue
San Francisco, CA 94102-3214
aaron.burstein@gmail.com
ab2@cpuc.ca.gov
abb@eslawfirm.com
achuang@epri.com
ag2@cpuc.ca.gov
agc@cpuc.ca.gov
ali.ipakchi@oati.com
am1@cpuc.ca.gov
andrew_meiman@newcomb.cc
ATrial@SempraUtilities.com
ayl5@pge.com
barbalex@ctel.net
bboyd@aclaratech.com
bcragg@goodinmacbride.com
bdille@jmpsecurities.com
bfinkelstein@turn.org
BKallo@rwbaird.com
BLee@energy.state.ca.us
bmcc@mccarthylaw.com
bob.rowe@northwestern.com
bobsmithttl@gmail.com
brbarkovich@earthlink.net
brian.theaker@dynegy.com
bsb@eslawfirm.com
bschuman@pacific-crest.com
californiadockets@pacificorp.com
carlgustin@groundedpower.com
caryn.lai@bingham.com
case.admin@sce.com
cassandra.sweet@dowjones.com
cbk@eslawfirm.com
cbrooks@tendrilinc.com
cem@newsdata.com
CentralFiles@SempraUtilities.com
chris@emeter.com
cjuennen@ci.glendale.us
cjw5@pge.com
CManson@SempraUtilities.com
coney@epic.org
SERVICE LIST
Administrative Law Judge Timothy Sullivan
California Public Utilities Commission
505 Van Ness Avenue
San Francisco, CA 94102-3214
dbp@cpuc.ca.gov
dbrenner@qualcomm.com
demorse@omsoft.com
dennis@ddecuir.com
df1@cpuc.ca.gov
dgrandy@caonsitegen.com
Diane.Fellman@nrgenergy.com
djsulliv@qualcomm.com
dkm@ischool.berkeley.edu
dkolk@compenergy.com
dmarcus2@sbcglobal.net
DNG6@pge.com
DNiehaus@SempraUtilities.com
Douglas.Garrett@cox.com
douglass@energyattorney.com
dschneider@lumesource.com
dzlotlow@caiso.com
ed.may@itron.com
ed@megawattsf.com
EGrizard@deweysquare.com
ek@a-klaw.com
elaine.duncan@verizon.com
enriqueg@greenlining.org
epetrill@epri.com
e-recipient@caiso.com
esther.northrup@cox.com
faramarz@ieee.org
farrokh.albuyeh@oati.net
filings@a-klaw.com
fsc2@pge.com
fsmith@sfwater.org
fxg@cpuc.ca.gov
gayatri@jbsenergy.com
GHealy@SempraUtilities.com
glw@eslawfirm.com
gmorris@emf.net
gstaples@mendotagroup.net
gtd@cpuc.ca.gov
hsanders@caiso.com
cpucdockets@keyesandfox.com
crjohnson@lge.com
crv@cpuc.ca.gov
ctoca@utility-savings.com
dan.mooy@ventyx.com
danielle@ceert.org
dave@ppallc.com
david.rubin@troutmansanders.com
david@nemtzow.com
jerry@enernex.com
jgoodin@caiso.com
jhawley@technet.org
jlin@strategen.com
jlynch@law.berkeley.edu
jmccarthy@ctia.org
jmcfarland@treasurer.ca.gov
jmh@cpuc.ca.gov
joe.weiss@realtimeacs.com
john.quealy@canaccordadams.com
john_gutierrez@cable.comcast.com
jon.fortune@energycenter.org
jorgecorralejo@sbcglobal.net
joshdavidson@dwt.com
joyw@mid.org
jparks@smud.org
jscancarelli@crowell.com
jskromer@qmail.com
juan.otero@trilliantinc.com
judith@tothept.com
julien.dumoulin-smith@ubs.com
jurban@law.berkeley.edu
jw2@cpuc.ca.gov
jwiedman@keyesandfox.com
kar@cpuc.ca.gov
Kcj5@pge.com
kco@kingstoncole.com
kd1@cpuc.ca.gov
keith.krom@att.com
kellie.smith@sen.ca.gov
kerry.hattevik@nrgenergy.com
KFoley@SempraUtilities.com
kfox@keyesandfox.com
kgrenfell@nrdc.org
kmills@cfbf.com
kmkiener@cox.net
kris.vyas@sce.com
lau@cpuc.ca.gov
lburdick@higgslaw.com
leilani.johnson@ladwp.com
info@tobiaslo.com
j_peterson@ourhomespaces.com
jandersen@tiaonline.org
jas@cpdb.com
jay.birnbaum@currentgroup.com
Jcox@fce.com
jdr@cpuc.ca.gov
jeffrcam@cisco.com
jellis@resero.com
lmh@eslawfirm.com
lms@cpuc.ca.gov
lnavarro@edf.org
longhao@berkeley.edu
mandywallace@gmail.com
marcel@turn.org
margarita.gutierrez@sfgov.org
mariacarbone@dwt.com
mark.s.martinez@sce.com
mark.sigal@canaccordadams.com
martinhomec@gmail.com
martinhomec@gmail.com
mary.tucker@sanjoseca.gov
marybrow@cisco.com
mc3@cpuc.ca.gov
mcarboy@signalhill.com
mcoop@homegridforum.org
mday@goodinmacbride.com
mdjoseph@adamsbroadwell.com
mgarcia@arb.ca.gov
mgo@goodinmacbride.com
michael.backstrom@sce.com
michael.jung@silverspringnet.com
michael.sachse@opower.com
michael_w@copper-gate.com
michaelboyd@sbcglobal.net
mike.ahmadi@Granitekey.com
mjd@cpuc.ca.gov
mkurtovich@chevron.com
MNelson@MccarthyLaw.com
monica.merino@comed.com
mozhi.habibi@ventyx.com
mpa@a-klaw.com
mrw@mrwassoc.com
mshames@ucan.org
mterrell@google.com
mtierney-lloyd@enernoc.com
nellie.tong@us.kema.com
nes@a-klaw.com
nml@cpdb.com
lencanty@blackeconomiccouncil.org norman.furuta@navy.mil
Lesla@calcable.org npedersen@hanmor.com
lettenson@nrdc.org nquan@gswater.com
lewis3000us@gmail.com nsuetake@turn.org
lex@consumercal.org pcasciato@sbcglobal.net
liddell@energyattorney.com peter.pearson@bves.com
lisa_weinzimer@platts.com philm@scdenergy.com
ljimene@smud.org pickering@energyhub.net
lkelly@energy.state.ca.us prp1@pge.com
puja@opower.com Valerie.Richardson@us.kema.com
r.raushenbush@comcast.net vjb@cpuc.ca.gov
ralf1241a@cs.com vladimir.oksman@lantiq.com
rboland@e-radioinc.com vwood@smud.org
rcounihan@enernoc.com vzavatt@smud.org
regrelcpuccases@pge.com wamer@kirkwood.com
rgifford@wbklaw.com wbooth@booth-law.com
rhh@cpuc.ca.gov wmc@a-klaw.com
ro@calcable.org wmp@cpuc.ca.gov
robertginaizda@gmail.com wtr@cpuc.ca.gov
RobertGnaizda@gmail.com xbaldwin@ci.burbank.ca.us
rogerl47@aol.com zaf@cpuc.ca.gov
rquattrini@energyconnectinc.com
rschmidt@bartlewells.com
rstuart@brightsourceenergy.com
rwinthrop@pilotpowergroup.com
salleyoo@dwt.com
sberlin@mccarthylaw.com
scott.tomashefsky@ncpa.com
scr@cpuc.ca.gov
SDHilton@stoel.com
sean.beatty@mirant.com
seboyd@tid.org
sephra.ninow@energycenter.org
Service@spurr.org
sharon.noell@pgn.com
sharon@emeter.com
shears@ceert.org
slins@ci.glendale.ca.us
srovetti@sfwater.org
ssmyers@worldnet.att.net
stephen.j.callahan@us.ibm.com
steven@lipmanconsulting.com
steven@sfpower.org
sthiel@us.ibm.com
sue.mara@rtoadvisors.com
suzannetoller@dwt.com
tam.hunt@gmail.com
tburke@sfwater.org
TCahill@SempraUtilities.com
TGlassey@Certichron.com
tien@eff.org
tjs@cpuc.ca.gov
tmfry@nexant.com
tomk@mid.org
tpomales@arb.ca.gov
traceydrabant@bves.com
trh@cpuc.ca.gov
ttutt@smud.org