China, Clean Energy and the Future of U.S. Energy Security with Harry Krejsa

Show Notes

In this episode of Cyber Focus, host Frank Cilluffo sits down with Harry Krejsa, Director of Studies at Carnegie Mellon University’s Institute for Strategy and Technology. Krejsa, a former Pentagon and White House cyber strategist, discusses his latest report, Sunshield, which highlights the intersection of cybersecurity, U.S.-China competition, and grid security. The conversation explores how China’s cyber operations exploit technical debt in U.S. critical infrastructure, the cybersecurity risks and opportunities in the energy transition, and how the rapid buildout of AI-driven power demand presents both new challenges and unique opportunities. Krejsa outlines strategic actions the U.S. must take to secure its energy future and broader critical infrastructure against Chinese cyber threats.

Main Topics Covered

• China’s cyber threat to U.S. critical infrastructure, including Volt Typhoon’s activities
• The risks of integrating old and new technology in the energy sector
• How the energy transition presents a unique chance to embed cybersecurity from the start
• The role of AI data centers in reshaping U.S. energy infrastructure and security
• Key policy actions needed to reduce U.S. dependency on Chinese-dominated supply chains
• Lessons from the financial sector in managing systemic cybersecurity risks

Key Quotes

“The People’s Republic of China, we now know, are working to place disruptive and destructive cyber capabilities on various kinds of American infrastructure… to stymie our ability to mobilize a military response to a crisis… [and] induced societal panic.” — Harry Krejsa

“No critical infrastructure sector in the country has the amount of capital necessary to undergo that [security] transformation, except for one… the electricity sector.” — Harry Krejsa

“I think we need to put modern energy at the center of our competition with China.” — Harry Krejsa

“We need to get the glowering national security hawks like myself, and the affirmative vision granola crunching energy communities sitting down and talking to each other.” — Harry Krejsa

“The IT-OT convergence has been a theme we come back to over and over because it is very real. Yet if you look at our defenders, we still don’t look at it through the same lens.” — Frank Cilluffo

Relevant Links

SUN SHIELD: How Clean Tech & America’s Energy Expansion Can Stop Chinese Cyber Threats

Guest Bio

Harry Krejsa is the Director of Studies at Carnegie Mellon University’s Institute for Strategy and Technology. A former White House and Pentagon cyber strategist, he played a key role in shaping the National Cyber Strategy and served on the Cyberspace Solarium Commission. His expertise spans China’s cyber operations, critical infrastructure security, and the intersection of emerging technology with national defense.

Transcript

1
00:00:00,480 –> 00:00:05,496
Frank Cilluffo: Welcome to Cyber Focus from the McCrary Institute, where we explore the people and ideas

2
00:00:05,608 –> 00:00:10,360
Frank Cilluffo: shaping and defending our digital world. I’m your host, Frank Cilluffo, and this week I

3
00:00:10,400 –> 00:00:15,720
Frank Cilluffo: have the privilege to sit down with Harry Krejsa. Harry is Director of Studies at

4
00:00:15,760 –> 00:00:21,832
Frank Cilluffo: Carnegie Mellon University’s Institute for Strategy and Technology. He came to the Institute from the

5
00:00:21,856 –> 00:00:26,584
Frank Cilluffo: office the National Cyber Director, where he played an instrumental role in the first National

6
00:00:26,672 –> 00:00:31,974
Frank Cilluffo: Cyber Strategy, and prior to that served in the Solarium Commission, where I got to

7
00:00:31,982 –> 00:00:36,214
Frank Cilluffo: know Harry quite well, and prior to that, the Office of the Secretary of Defense

8
00:00:36,262 –> 00:00:44,614
Frank Cilluffo: and the Pentagon. Harry, privilege to have you here. Great to. I’m so glad you

9
00:00:44,622 –> 00:00:47,542
Frank Cilluffo: can join us. Thanks for having me, Frank. I’m thrilled to be here. So you

10
00:00:47,566 –> 00:00:53,702
Frank Cilluffo: recently authored a pretty big report, sunshield. And is that your first report since you

11
00:00:53,726 –> 00:00:59,124
Frank Cilluffo: joined cmu? That’s right, yeah. So I thought we could tee off on a broader

12
00:00:59,172 –> 00:01:07,588
Frank Cilluffo: discussion, but also jump into the report around us, China competition and grid security. And

13
00:01:07,724 –> 00:01:12,500
Frank Cilluffo: maybe we can start with sort of the key findings of the report just to

14
00:01:12,540 –> 00:01:17,556
Frank Cilluffo: set the scene. Sure. I think it’s no surprise to the audience of Cyberfocus that

15
00:01:17,628 –> 00:01:22,180
Harry Krejsa: one of the big premises here is that the People’s Republic of China, we now

16
00:01:22,220 –> 00:01:29,816
Harry Krejsa: know, are working to place disruptive and destructive cyber capabilities on various kinds of American

17
00:01:29,888 –> 00:01:38,760
Harry Krejsa: infrastructure. And that seems to be for two main motivations, one being to stymie our

18
00:01:38,800 –> 00:01:45,512
Harry Krejsa: ability to mobilize a military response to a crisis. And second would be to, as

19
00:01:45,536 –> 00:01:51,784
Harry Krejsa: I think former CISA Director Jan Easterly put it before Congress, induced societal panic so

20
00:01:51,792 –> 00:01:56,918
Harry Krejsa: that there was less political. Political will to sustain such a response to a crisis.

21
00:01:57,094 –> 00:02:03,526
Frank Cilluffo: I would also add espionage. But. But let’s start with Volt Typhoon, because that’s. That’s

22
00:02:03,558 –> 00:02:10,454
Frank Cilluffo: sort of. I think the. It goes many steps beyond simply intelligence preparation of the

23
00:02:10,462 –> 00:02:16,662
Frank Cilluffo: battlefield. It’s actually getting into our systems at a time of their choosing. What. What

24
00:02:16,686 –> 00:02:20,662
Frank Cilluffo: were some of your takeaways in terms of Volt Typhoon and what that means? And

25
00:02:20,686 –> 00:02:26,676
Frank Cilluffo: then in particular from. From a. An energy perspective. Absolutely. So over the last couple

26
00:02:26,708 –> 00:02:31,908
Harry Krejsa: of years, putting together, you know, Microsoft’s Threat Intelligence Cell was one of the first

27
00:02:31,964 –> 00:02:38,292
Harry Krejsa: organizations to really stitch together a lot of these signs of Volt Typhoon intelligence in

28
00:02:38,316 –> 00:02:43,988
Harry Krejsa: the public domain. And paired with some subsequently declassified information from government, we get this

29
00:02:44,044 –> 00:02:51,962
Harry Krejsa: kind of bigger picture of, you know, the Chinese security apparatus finding cracks in the

30
00:02:51,986 –> 00:02:59,790
Harry Krejsa: armor of our critical infrastructure. Right. The Volt Typhoon and certainly subsequent, like salt typhoon

31
00:03:00,130 –> 00:03:09,482
Harry Krejsa: campaigns were remarkably robust examples of cyber tradecraft that were often focused on initial

32
00:03:09,546 –> 00:03:15,562
Harry Krejsa: access at the seams between new technology and old technology. And in many sectors of

33
00:03:15,586 –> 00:03:24,236
Harry Krejsa: our critical infrastructure, those seams run pretty deep. We were one of the first countries

34
00:03:24,308 –> 00:03:30,540
Harry Krejsa: to industrialize, to modernize, to electrify, to deploy a lot of advanced technologies in our

35
00:03:30,580 –> 00:03:34,844
Harry Krejsa: various critical infrastructure sectors. But that means we also have a lot of technical debt

36
00:03:34,892 –> 00:03:39,964
Harry Krejsa: compared to many other countries around the world because we were the first to deploy

37
00:03:40,012 –> 00:03:45,196
Harry Krejsa: a lot of these technologies. And so we are sitting on foundations in many sectors

38
00:03:45,228 –> 00:03:51,932
Harry Krejsa: of our economy that were never intended to coexist with the level of digitization and

39
00:03:51,956 –> 00:03:56,520
Harry Krejsa: Internet Internet connectivity that they do now. And so in a lot of sectors, in

40
00:03:56,560 –> 00:04:04,504
Harry Krejsa: particular the, the divide between information technology, you know, your networks, computers and Internet connected

41
00:04:04,632 –> 00:04:11,400
Harry Krejsa: assets and operational technologies, the gauges, switches and pumps that change things in the real

42
00:04:11,440 –> 00:04:16,408
Harry Krejsa: world, those seams are, those lines are being broken down and a lot of older

43
00:04:16,424 –> 00:04:23,106
Harry Krejsa: infrastructure runs on ot that operational technology that cannot be secured in a world of

44
00:04:23,178 –> 00:04:29,330
Harry Krejsa: ubiquitous digital connectivity. You know, the ITOT convergence has been a theme we come back

45
00:04:29,370 –> 00:04:33,442
Frank Cilluffo: to over and over because it is very real. Yet if you look at our

46
00:04:33,466 –> 00:04:39,234
Frank Cilluffo: defenders, we still don’t look at it in through the same lens. And I do.

47
00:04:39,402 –> 00:04:45,858
Frank Cilluffo: Before jumping into some of the findings in your report, I do want to just

48
00:04:45,914 –> 00:04:54,622
Frank Cilluffo: unpack briefly. So Volt Typhoon primarily gaining access to systems that can be switched on

49
00:04:54,646 –> 00:05:00,334
Frank Cilluffo: and off at the choosing, at the timing and choosing of China. Salt Typhoon largely

50
00:05:00,382 –> 00:05:05,838
Frank Cilluffo: espionage, largely, largely telecommunications. But at the end of the day, if you can do

51
00:05:05,894 –> 00:05:13,534
Frank Cilluffo: collection on telcos, you can basically get to every critical infrastructure. Flax Typhoon More focused

52
00:05:13,582 –> 00:05:20,862
Frank Cilluffo: on IoT and IIoT devices to include some of those OT devices primarily focused on

53
00:05:20,886 –> 00:05:27,840
Frank Cilluffo: Taiwan, but obviously has implications globally. Silk Typhoon seems to be getting a lot of

54
00:05:27,880 –> 00:05:34,112
Frank Cilluffo: interest most recently in terms of new sanctions and the like. Fair. If you want

55
00:05:34,136 –> 00:05:39,920
Frank Cilluffo: to unpack the intentions behind all. Each one of those typhoons is a really bad

56
00:05:39,960 –> 00:05:45,392
Frank Cilluffo: day. It’s a bad day. Collectively, it’s a perfect storm of vulnerability, isn’t it? It

57
00:05:45,416 –> 00:05:54,460
Harry Krejsa: is. And while these various campaigns have different particular targets or tradecraft associated with,

58
00:05:54,900 –> 00:06:03,580
Harry Krejsa: they in many cases boil down to finding ways to exploit those seams between our

59
00:06:03,620 –> 00:06:08,492
Harry Krejsa: modern technology and our older technology. And indeed in sector after sector, you know, when

60
00:06:08,516 –> 00:06:13,132
Harry Krejsa: we were at the White House, you’d hear about, you know, a new sectoral, you

61
00:06:13,156 –> 00:06:18,332
Harry Krejsa: know, breach would become known. Folks would call NCOs to the White House and say,

62
00:06:18,356 –> 00:06:22,574
Harry Krejsa: hey, we gotta, we gotta fix this guys. And the response would be, you know,

63
00:06:22,742 –> 00:06:27,822
Harry Krejsa: sure, we’d love to, and we’re committed to doing so, but we need tens of

64
00:06:27,846 –> 00:06:32,350
Harry Krejsa: billions of dollars to do so durably. We can kick folks out in the near

65
00:06:32,390 –> 00:06:37,710
Harry Krejsa: term. We can try and find where these various typhoon campaigns have gone for now.

66
00:06:37,830 –> 00:06:45,518
Harry Krejsa: But to make things durably securable will require clearing out decades of technical debt that

67
00:06:45,574 –> 00:06:51,838
Harry Krejsa: can’t be made digitally native, that can’t be made secure. And there’s no sector, no,

68
00:06:51,894 –> 00:06:59,274
Harry Krejsa: no critical infrastruct in the country that has the amount of capital necessary to undergo

69
00:06:59,322 –> 00:07:04,794
Harry Krejsa: that transformation, except for one and what is that sector? That is the electricity sector.

70
00:07:04,962 –> 00:07:12,522
Harry Krejsa: A confluence of supply and demand dynamics from the last few years is producing a

71
00:07:12,626 –> 00:07:19,674
Harry Krejsa: golden opportunity of transformation in our electrical sector. Between the. Over the last few years

72
00:07:19,762 –> 00:07:28,678
Harry Krejsa: the bipartisan infrastructure law and inflation Reduction act and huge decrease in prices for technologies

73
00:07:28,774 –> 00:07:37,782
Harry Krejsa: like solar panels and batteries have created this big new influx of clean energy technologies

74
00:07:37,926 –> 00:07:44,422
Harry Krejsa: that are disproportionately digitally native and so can be made more securable, more future proofed

75
00:07:44,486 –> 00:07:49,382
Harry Krejsa: than our legacy infrastructure can be and that are more distributed in nature. They can

76
00:07:49,406 –> 00:07:54,374
Harry Krejsa: be made more resilient against disruption and attack. And on the demand side, we’re seeing

77
00:07:54,502 –> 00:08:00,372
Harry Krejsa: for the first time in decades growth in demand for electricity. We’ve had basically flat

78
00:08:00,436 –> 00:08:06,772
Harry Krejsa: or like 1% growth in electricity demand for decades and have gotten by mainly on

79
00:08:06,796 –> 00:08:13,700
Harry Krejsa: efficiency gains as our society has become more advanced and energy intensive. But we’re now

80
00:08:13,740 –> 00:08:18,692
Harry Krejsa: seeing for the first time in a long time true increase in electricity demand. And

81
00:08:18,716 –> 00:08:24,548
Frank Cilluffo: that’s because of AI data centers and the like. It’ll grow exponentially indeed, AI data

82
00:08:24,604 –> 00:08:31,652
Harry Krejsa: centers also reshoring of manufacturing. The big increase in re industrialization over the last few

83
00:08:31,676 –> 00:08:38,180
Harry Krejsa: years is producing a lot more electrical demand. Vehicle and industrial electrification with the big

84
00:08:38,220 –> 00:08:44,500
Harry Krejsa: AI data center load growth are combining to increase that demand for electricity and to

85
00:08:44,540 –> 00:08:52,286
Harry Krejsa: build out that grid anew. So just to clarify, you have an opportunity with new

86
00:08:52,358 –> 00:09:01,742
Frank Cilluffo: technology to bake security into the design to cyber informed engineering, some of the DOE

87
00:09:01,806 –> 00:09:07,182
Frank Cilluffo: principles. You, you, you don’t get that opportunity every day because you’re building Lego on,

88
00:09:07,286 –> 00:09:12,350
Frank Cilluffo: on top of legacy systems, some of which were built on quicksand, if I’m being

89
00:09:12,390 –> 00:09:18,846
Frank Cilluffo: very honest. But, but you do get that opportunity once you’re looking at new investment,

90
00:09:18,998 –> 00:09:26,874
Frank Cilluffo: new technologies, is that correct? That’s correct. So clean technology, it’s about a new opportunity

91
00:09:26,922 –> 00:09:33,770
Frank Cilluffo: and China is ahead of us from, from a, from many perspectives or. No, they

92
00:09:33,810 –> 00:09:40,186
Harry Krejsa: certainly have an early advantage in clean tech manufacturing and this is something that we’ll

93
00:09:40,218 –> 00:09:45,514
Harry Krejsa: want to, you know, actually join the fight on here more, more deliberately in the

94
00:09:45,522 –> 00:09:51,450
Harry Krejsa: years to come. Because the golden opportunity here with our own infrastructure is not only

95
00:09:51,490 –> 00:09:56,390
Harry Krejsa: that we have a moment of recap, but that we have available to us these

96
00:09:56,430 –> 00:10:03,894
Harry Krejsa: new technologies for energy generation that are more digitally native, more defensible, more software defined.

97
00:10:04,022 –> 00:10:08,790
Harry Krejsa: And so they have these kind of unique technological attributes to them. They’re also becoming

98
00:10:08,870 –> 00:10:15,222
Harry Krejsa: dirt cheap. I think solar panels and batteries are following the same cost curve of

99
00:10:15,246 –> 00:10:19,750
Harry Krejsa: like falling 90% in prices in like the last five to 10 years. It is

100
00:10:19,790 –> 00:10:26,632
Harry Krejsa: just a tremendous decline in costs that’s made solar and battery storage facilities like the

101
00:10:26,656 –> 00:10:31,352
Harry Krejsa: cheapest new form of electricity that you can buy. And as a result is becoming

102
00:10:31,496 –> 00:10:38,168
Harry Krejsa: a popular choice for electricity around the world, particularly in the. In emerging markets and

103
00:10:38,224 –> 00:10:44,456
Harry Krejsa: developing economies around the world. Many are hoping to leapfrog straight to solar and batteries

104
00:10:44,648 –> 00:10:52,456
Harry Krejsa: as that modern source of electricity. And right now, China is helping set the rules

105
00:10:52,488 –> 00:10:57,832
Harry Krejsa: of the road for that global capital investment rush. So what does that mean from

106
00:10:57,856 –> 00:11:05,384
Frank Cilluffo: a supply chain perspective? It means that we, as with many manufacturing quandaries in front

107
00:11:05,392 –> 00:11:09,928
Harry Krejsa: of us, we need to think about how we compete with China on different parts

108
00:11:09,944 –> 00:11:14,136
Harry Krejsa: of that supply chain. It means how do we think about disaggregating some of these

109
00:11:14,208 –> 00:11:22,734
Harry Krejsa: technologies into pieces that we want to have a more secure and verifiable supply chain,

110
00:11:22,782 –> 00:11:27,470
Harry Krejsa: a supply chain for more exquisite, digitally exposed components that we need to have more

111
00:11:27,510 –> 00:11:34,862
Harry Krejsa: trust in versus supply chain that serves commodity components that we are more willing to

112
00:11:34,886 –> 00:11:39,710
Harry Krejsa: accept risk in. I think one of my favorite examples would be a battery. Right.

113
00:11:39,830 –> 00:11:48,904
Harry Krejsa: A battery is 90% electrolyte goo and 10% controller electronics, battery management

114
00:11:49,022 –> 00:11:55,092
Harry Krejsa: systems. And if we’re wanting to talk about supply chain security and confidence in those

115
00:11:55,116 –> 00:12:00,080
Harry Krejsa: kinds of systems in the future, we can disaggregate those things. We can say that

116
00:12:00,700 –> 00:12:05,172
Harry Krejsa: on the power control portions of it. We have a lot of allies around the

117
00:12:05,196 –> 00:12:11,732
Harry Krejsa: world, Japan, South Korea, Taiwan, who are great at advanced electronic manufacturing and that we

118
00:12:11,756 –> 00:12:15,852
Harry Krejsa: might be able to partner with to create parallel supply chains for those components. If

119
00:12:15,876 –> 00:12:21,452
Frank Cilluffo: I’m thinking about that’s friend shoring. That’s right, exactly. But like the electrolyte goo, I

120
00:12:21,476 –> 00:12:25,756
Harry Krejsa: don’t really care where that comes from. Right. We do want minerals, don’t we? It’s

121
00:12:25,788 –> 00:12:29,964
Frank Cilluffo: dominating a lot of discussion these days. There’s a difference between, you know, supply. Chain

122
00:12:30,012 –> 00:12:34,636
Frank Cilluffo: goo and goo. Right. But if we’re talking about like supply chain risk, like supply

123
00:12:34,668 –> 00:12:40,716
Harry Krejsa: chain attack risk and supply chain availability, then, you know, I’m less concerned about where

124
00:12:40,788 –> 00:12:48,072
Harry Krejsa: the critical minerals come from. A supply chain attack perspective. But certainly general availability is

125
00:12:48,096 –> 00:12:52,712
Harry Krejsa: something we want to keep an eye on. Absolutely. And from a US perspective, obviously

126
00:12:52,776 –> 00:12:59,912
Frank Cilluffo: we’re going to continue to double down on traditional forms of electricity. And I would

127
00:12:59,936 –> 00:13:03,224
Frank Cilluffo: argue from a security standpoint, they’re pretty high on the list. If you were to

128
00:13:03,232 –> 00:13:08,248
Frank Cilluffo: compare them to say water or health care or some of the other sectors that

129
00:13:08,304 –> 00:13:12,840
Frank Cilluffo: are not as far along as I think many of us would like, but we

130
00:13:12,880 –> 00:13:17,214
Frank Cilluffo: also see the ability to expand that. So it’s not an either or proposition. It’s.

131
00:13:17,232 –> 00:13:20,994
Frank Cilluffo: It’s kind of both to be able to meet energy needs. And I’d be curious

132
00:13:21,122 –> 00:13:28,850
Frank Cilluffo: what you think some of the cybersecurity risks are with integrating smart inverters, battery storage,

133
00:13:28,930 –> 00:13:34,530
Frank Cilluffo: virtual power, all the things that flip a switch and turn things on on the

134
00:13:34,570 –> 00:13:39,042
Frank Cilluffo: OT side, what does that mean from a cybersecurity perspective? Sure. It’s one of those

135
00:13:39,066 –> 00:13:43,682
Harry Krejsa: things where if we do it right, we can end up with a grid that

136
00:13:43,706 –> 00:13:48,162
Harry Krejsa: is more defensible and resilient than it could have ever been otherwise. But if we

137
00:13:48,186 –> 00:13:54,654
Harry Krejsa: do it wrong, we will just recreate the vulnerabilities of the fundamental foundation under it.

138
00:13:54,742 –> 00:14:00,062
Frank Cilluffo: So single point failure kind of concerns. That’s right. Are we doing it right or

139
00:14:00,086 –> 00:14:02,542
Frank Cilluffo: what do we need to do to do it right? I think we’re making great

140
00:14:02,566 –> 00:14:08,846
Harry Krejsa: progress. An important kind of bit of context is in the late 2010s, Gao released

141
00:14:08,878 –> 00:14:15,534
Harry Krejsa: these couple of reports that were sounding the alarm about the proliferation of Internet connectivity

142
00:14:15,582 –> 00:14:20,158
Harry Krejsa: across our electrical grid. And they had nothing to do with a particular kind of

143
00:14:20,214 –> 00:14:26,778
Harry Krejsa: energy generation, but rather just asset management. We’re a big country. We’ve got substations and

144
00:14:26,914 –> 00:14:32,634
Harry Krejsa: assets that are in difficult or dangerous to get places. And we’d really like to

145
00:14:32,642 –> 00:14:36,634
Harry Krejsa: be able to manage those assets without having to send someone there every day. So

146
00:14:36,642 –> 00:14:42,794
Harry Krejsa: since the early 2000s, we’ve been slapping dial up modems onto the sides of dams

147
00:14:42,922 –> 00:14:49,108
Harry Krejsa: and managing things remotely because it was easier to do it efficient way, right? Yeah.

148
00:14:49,204 –> 00:14:54,600
Harry Krejsa: And if you’re trying to think about our infrastructure in terms of just pure cybersecurity,

149
00:14:55,180 –> 00:15:00,276
Harry Krejsa: you have basically two options. One is a totally air gapped situation. No such thing.

150
00:15:00,348 –> 00:15:05,972
Harry Krejsa: Indeed. But the theoretical is the ideal, right? Yeah. And the opposite end is a

151
00:15:05,996 –> 00:15:12,068
Harry Krejsa: totally digitally native one where you’re saying we’re going to be interactive. Exactly. But we’re

152
00:15:12,084 –> 00:15:14,548
Harry Krejsa: going to be agile, we’re going to patch all the time. We’re going to be,

153
00:15:14,604 –> 00:15:19,584
Harry Krejsa: as you know, forward leaning as we can on learning about new threat and incorporating

154
00:15:19,632 –> 00:15:24,112
Harry Krejsa: those into the software that helps secure all of this. And where we are now

155
00:15:24,136 –> 00:15:29,360
Harry Krejsa: is this messy middle where we have some assets that are Internet connected and never

156
00:15:29,400 –> 00:15:34,624
Harry Krejsa: were meant to be, never could be securable and some that are. And when we

157
00:15:34,632 –> 00:15:42,096
Harry Krejsa: think about the proliferation of more software defined electronics tools like smart inverters and batteries,

158
00:15:42,288 –> 00:15:47,812
Harry Krejsa: we see the opportunity to do it right. You know, you know, I was a

159
00:15:47,836 –> 00:15:52,548
Frank Cilluffo: long advocate and I think I testified on this 20 years ago that in terms

160
00:15:52,604 –> 00:15:59,476
Frank Cilluffo: of any IT spend and any recapitalization and infrastructure spend, at least 12 to 15%

161
00:15:59,548 –> 00:16:04,452
Frank Cilluffo: should be devoted to security. Do you think that that issue is ripe again? I

162
00:16:04,476 –> 00:16:10,996
Harry Krejsa: think it’s getting there. You know, the bipartisan infrastructure law included some really helpful cybersecurity

163
00:16:11,028 –> 00:16:17,342
Harry Krejsa: components to it. Right. IT paired together cybersecurity requirements and funding with infrastructure investments and

164
00:16:17,366 –> 00:16:23,710
Harry Krejsa: funding. And I think that as we go into a new lawmaking push here in

165
00:16:23,750 –> 00:16:29,790
Harry Krejsa: the months ahead, I think that for lawmakers who are wanting to make their mark

166
00:16:29,830 –> 00:16:35,214
Harry Krejsa: on the future of our infrastructure, I’d recommend that we think less about where to

167
00:16:35,302 –> 00:16:41,454
Harry Krejsa: turn off funding for certain kinds of energy and more about how we compare cybersecurity

168
00:16:41,502 –> 00:16:48,932
Harry Krejsa: and resilience investments as a eligibility requirement with all of that funding. So let’s talk

169
00:16:48,956 –> 00:16:54,612
Frank Cilluffo: a little bit about the AI data centers and the demand on electricity. And it

170
00:16:54,636 –> 00:17:00,740
Frank Cilluffo: is exponential growth. I mean it really is. How will. So I’ve long been told,

171
00:17:00,780 –> 00:17:05,380
Frank Cilluffo: a pessimist is an optimist with experience. I get the sense you’re optimistic. I could

172
00:17:05,420 –> 00:17:10,720
Frank Cilluffo: be optimistic if we do this right. But how does this complement or complicate these

173
00:17:10,760 –> 00:17:15,696
Frank Cilluffo: dynamics? I mean, I think I know where you’re going to come from, but I’d

174
00:17:15,728 –> 00:17:19,888
Frank Cilluffo: rather, rather than put words in your mouth, I’d rather hear you. I think it’s

175
00:17:19,904 –> 00:17:26,832
Harry Krejsa: going to do both complement and complicate these dynamics in the compliment bucket here. This

176
00:17:26,856 –> 00:17:33,376
Harry Krejsa: is an example of capital, you know, recapitalization that other infrastructure sectors are not benefiting

177
00:17:33,408 –> 00:17:40,384
Harry Krejsa: from. Right. And being able to we’re already seeing various jurisdictions say to some of

178
00:17:40,392 –> 00:17:47,244
Harry Krejsa: these big load growth proposals say, hey, we’ll welcome your data center to our utility

179
00:17:47,292 –> 00:17:54,876
Harry Krejsa: region on the condition that you help modernize and pay for modernizing our grid infrastructure

180
00:17:54,908 –> 00:18:01,920
Harry Krejsa: upfront. And so there’s these conditions setting along the way and that’s not historically unusual.

181
00:18:02,580 –> 00:18:06,860
Harry Krejsa: And it can flow in both directions in the. And that it’s actually got an

182
00:18:06,900 –> 00:18:14,170
Frank Cilluffo: analogy with public safety, specifically in electricity and nuclear and the like. That’s right. And

183
00:18:14,470 –> 00:18:18,542
Harry Krejsa: an Asset we have on our side here is that the hyperscalers, you know, the

184
00:18:18,566 –> 00:18:23,310
Harry Krejsa: tech giants who are making these kinds of investments also have a couple decades of

185
00:18:23,350 –> 00:18:32,254
Harry Krejsa: being experienced energy market participants in the early 2000s and the 2010s, during the first

186
00:18:32,342 –> 00:18:39,250
Harry Krejsa: wave of cloud computing build out, they went out of their way to ensure that

187
00:18:39,630 –> 00:18:45,302
Harry Krejsa: first wave of cloud infrastructure was primarily run on clean energy. They were willing to

188
00:18:45,326 –> 00:18:53,814
Harry Krejsa: pay a green premium to get electricity that was primarily, primarily zero carbon because that

189
00:18:53,822 –> 00:18:57,782
Harry Krejsa: was a value that they held and wanted to be able to say that Gmail

190
00:18:57,846 –> 00:19:04,704
Harry Krejsa: ran on clean electricity. And I think today, now that, you know, clean electricity is

191
00:19:04,872 –> 00:19:09,040
Harry Krejsa: cost competitive or cheaper, like that’s not the thing we’re worried about so much now.

192
00:19:09,160 –> 00:19:14,752
Harry Krejsa: I’m wondering if these hyperscalers could similarly be willing to pay a security premium like

193
00:19:14,776 –> 00:19:18,592
Harry Krejsa: they did with the clean the green premium in the 2010s. They’re one of the

194
00:19:18,616 –> 00:19:24,384
Harry Krejsa: few actors in. Our entire economy, like a leads a seal of some sort around

195
00:19:24,472 –> 00:19:30,384
Frank Cilluffo: security as we’ve had for other things in the past. Yes. You know, and I

196
00:19:30,392 –> 00:19:35,180
Frank Cilluffo: would include nuclear in there too. Even though I do it is clean. It is

197
00:19:35,220 –> 00:19:41,852
Frank Cilluffo: not traditional clean tech. But I do think you’re going to see infrastructure build out

198
00:19:41,876 –> 00:19:47,916
Frank Cilluffo: there, whether modular or not. I mean, all things said and done, you could include

199
00:19:47,988 –> 00:19:52,412
Frank Cilluffo: that in that basket, right? In terms of growth. Absolutely. And I do include them.

200
00:19:52,436 –> 00:19:59,212
Harry Krejsa: And I think particularly as we move towards small modular reactors, people seem to be

201
00:19:59,316 –> 00:20:05,640
Harry Krejsa: converging toward these smr, small modular reactors being behind the meter. Right. Term of art

202
00:20:05,680 –> 00:20:12,888
Harry Krejsa: of having generation on site with your, with your electricity demand. And so a lot

203
00:20:12,944 –> 00:20:18,568
Harry Krejsa: of the data, AI, data center models are looking at ways they can reduce their

204
00:20:18,624 –> 00:20:24,712
Harry Krejsa: stress on the grid by having smarts or natural gas turbines or solar fields and

205
00:20:24,736 –> 00:20:28,504
Harry Krejsa: batteries on site with them to cut down on what they pull from the grid.

206
00:20:28,632 –> 00:20:34,792
Harry Krejsa: But that’s going to also have the useful dynamic of further distributed distribution of our

207
00:20:34,816 –> 00:20:42,682
Harry Krejsa: electricity generation capability. And these, these combined, you know, load consumers and load producers are

208
00:20:42,706 –> 00:20:47,818
Harry Krejsa: going to become assets for resilience in the, in this future grid where if there’s

209
00:20:47,834 –> 00:20:51,866
Harry Krejsa: an attack that brings down some portion of a grid somewhere, an AI data center

210
00:20:51,898 –> 00:20:59,882
Harry Krejsa: with a, you know, small nuclear reactor or a field of batteries can become not

211
00:20:59,906 –> 00:21:05,738
Harry Krejsa: just a electricity liability, but a contributor. And we even see that in the current

212
00:21:05,794 –> 00:21:11,370
Frank Cilluffo: grid. We’re still dependent upon other countries sometimes for key technologies in our grid and

213
00:21:11,410 –> 00:21:18,250
Frank Cilluffo: they’re pretty expensive to keep just sitting around and not being utilized. Although we do

214
00:21:18,290 –> 00:21:21,962
Frank Cilluffo: have to have some of that technology in Case of a black star. But so

215
00:21:22,066 –> 00:21:25,514
Frank Cilluffo: I don’t think these are either ors is what I’m really getting at. It’s both.

216
00:21:25,602 –> 00:21:30,714
Harry Krejsa: Indeed. Yep. And let me ask, so not to throw a buzzword, but whether it’s

217
00:21:30,762 –> 00:21:37,030
Frank Cilluffo: secure by design or cyber informed engineering, CIS put a big push around secure by

218
00:21:37,070 –> 00:21:44,086
Frank Cilluffo: design. DOE put a push around cyber informed engineering. Conceptually, I’m a proponent of both.

219
00:21:44,238 –> 00:21:48,134
Frank Cilluffo: But how do we make this real? And how do we translate the public private

220
00:21:48,222 –> 00:21:54,774
Frank Cilluffo: partnership from nouns into verbs? How do we make that really real? Well, one of

221
00:21:54,782 –> 00:22:01,510
Harry Krejsa: the biggest assets of the electricity sector right now is the dynamism of all these

222
00:22:01,550 –> 00:22:08,902
Harry Krejsa: new entrants entering the field. A lot of energy developer startups, new technologies that are

223
00:22:08,926 –> 00:22:14,582
Harry Krejsa: really transforming this space and that is just a fantastic asset that we haven’t been

224
00:22:14,606 –> 00:22:19,318
Harry Krejsa: able to enjoy as much in many other sectors. That’s also a source of risk

225
00:22:19,454 –> 00:22:24,134
Harry Krejsa: because you have a lot of small new young shops that aren’t used to thinking.

226
00:22:24,182 –> 00:22:29,430
Frank Cilluffo: Security is not going to be their priority. Absolutely right. Whereas you have these more

227
00:22:29,470 –> 00:22:35,382
Harry Krejsa: established energy players who spent decades thinking about national security risk, who might be a

228
00:22:35,406 –> 00:22:40,166
Harry Krejsa: little creaky right now when it comes to building their grids fast enough or advanced

229
00:22:40,198 –> 00:22:45,014
Harry Krejsa: enough or incorporating new technologies, but know where that risk comes from and how to

230
00:22:45,022 –> 00:22:51,878
Harry Krejsa: think about it. And we are making progress in adapting our regulatory and public private

231
00:22:51,934 –> 00:22:58,642
Harry Krejsa: information sharing structures for that new reality where we have a combination of big established

232
00:22:58,706 –> 00:23:03,922
Harry Krejsa: players and new dynamic entrants. But there’s a lot more work to do there. You

233
00:23:03,946 –> 00:23:08,722
Frank Cilluffo: know, we recently had Manny cancel on to talk a little bit about eisac. Are

234
00:23:08,746 –> 00:23:15,682
Frank Cilluffo: they going to be members, you think of that organization, or new entrants. Or so

235
00:23:15,706 –> 00:23:20,482
Harry Krejsa: it depends on, you know, which sector subsector we’re talking about. I know in the

236
00:23:20,506 –> 00:23:26,714
Harry Krejsa: case of the Electricity Subsector Coordinating Council, American Clean Power, which is sort of one

237
00:23:26,722 –> 00:23:34,298
Harry Krejsa: of the premier clean energy industry associations, recently joined the sec, which was really important,

238
00:23:34,434 –> 00:23:41,322
Harry Krejsa: a really important step forward, but also like significantly overdue, I think. Two, three, the

239
00:23:41,346 –> 00:23:45,322
Harry Krejsa: last two or three years, 90% of all electricity added to the grid has been

240
00:23:45,346 –> 00:23:50,618
Harry Krejsa: clean. And so the. That’s in the U.S. or globally. Or in the U.S. it’s

241
00:23:50,634 –> 00:23:57,460
Harry Krejsa: 90% globally, it’s 80, 86%. Okay. So it’s like it’s happening and it’s transforming everything.

242
00:23:57,580 –> 00:24:02,900
Harry Krejsa: And our institutions are lagging behind. And not to put too fine a point on

243
00:24:02,940 –> 00:24:08,660
Frank Cilluffo: it, but without electricity, all our other critical infrastructures are in a place of hurt.

244
00:24:08,740 –> 00:24:18,212
Harry Krejsa: Exactly. The essential role of security and resilience are paramount. Absolutely. And that’s why the

245
00:24:18,236 –> 00:24:23,728
Harry Krejsa: ESCC and various other ISACs and Isaac I think can get ahead of this by

246
00:24:23,784 –> 00:24:31,232
Harry Krejsa: thinking about how they operate, their convenings, their information sharing and intelligence analysis operations to

247
00:24:31,256 –> 00:24:36,656
Harry Krejsa: make it so that it’s easier for smaller institutions, startups to be able to contribute

248
00:24:36,688 –> 00:24:40,752
Harry Krejsa: to it, to learn from it, figure out how we communicate with this more diffuse

249
00:24:40,896 –> 00:24:46,176
Harry Krejsa: market ecosystem. And I would argue there is a CFIUS set of issues as well.

250
00:24:46,328 –> 00:24:50,946
Frank Cilluffo: Committee for Foreign Investment in the US where gets to the broader supply chain issue

251
00:24:51,018 –> 00:24:56,194
Frank Cilluffo: where you do have some significant security vulnerabilities on the front end. I agree with

252
00:24:56,202 –> 00:25:03,058
Harry Krejsa: that. Yes. And I’d be curious along those lines. Top three policy actions we take

253
00:25:03,114 –> 00:25:07,922
Frank Cilluffo: to flip it on the positive side of the ledger in terms of looking at

254
00:25:07,946 –> 00:25:11,474
Frank Cilluffo: the new at some of the energy transition issues. How do we make it a

255
00:25:11,482 –> 00:25:15,794
Frank Cilluffo: positive. What are the top three things? So first one is kind of a strategic

256
00:25:15,842 –> 00:25:20,102
Harry Krejsa: level approach where I think we need to put modern energy at the center of

257
00:25:20,126 –> 00:25:25,814
Harry Krejsa: our competition with China. Whether it’s there, isn’t it sort of or we not recognize

258
00:25:25,862 –> 00:25:31,254
Frank Cilluffo: that. I think that we need it to be at the level of semiconductors. And

259
00:25:31,262 –> 00:25:35,462
Harry Krejsa: I think there’s a lot of things to be learned there. Right. Where we realized

260
00:25:35,526 –> 00:25:39,702
Harry Krejsa: a few years later than would have been ideal that we should have a more

261
00:25:39,806 –> 00:25:45,492
Harry Krejsa: flexible and diffuse supply chain for our semiconductors and much of the world. Agreed. And

262
00:25:45,516 –> 00:25:49,572
Harry Krejsa: you’ve seen since we passed the Chips and Science Act a number of copycat bills,

263
00:25:49,716 –> 00:25:56,020
Harry Krejsa: I use that term complimentarily with trusted allies and partners that we’re now making them

264
00:25:56,060 –> 00:26:03,284
Harry Krejsa: interoperable with. Right. With the idea that we’re going to make a parallel democracies supply

265
00:26:03,332 –> 00:26:08,516
Harry Krejsa: chain. And I think we need a similar level of investment in intellectual and policy

266
00:26:08,588 –> 00:26:14,188
Harry Krejsa: capital on in energy. And it could be, dare I say, quicker. Right. I mean

267
00:26:14,324 –> 00:26:18,652
Frank Cilluffo: we’re not going to see the benefit of a lot of the semiconductor work for

268
00:26:18,676 –> 00:26:22,748
Frank Cilluffo: a few years. No, I agree with that. And there’s been some, I think in

269
00:26:22,804 –> 00:26:26,780
Harry Krejsa: solar and batteries in particular, there’s already been a lot of great progress made in

270
00:26:26,820 –> 00:26:33,100
Harry Krejsa: onshoring. Yep, yep. And I think that making that interoperable with our particular Indo Pacific

271
00:26:33,180 –> 00:26:38,384
Harry Krejsa: allies will push that forward. Quite so. One, make it a strategic competition US China.

272
00:26:38,472 –> 00:26:45,536
Frank Cilluffo: Two. Right. Two is update these convening institutions to incorporate that more diffuse energy ecosystem

273
00:26:45,568 –> 00:26:50,624
Harry Krejsa: that we now experience. What does that mean? That means figuring out how to get

274
00:26:50,712 –> 00:26:55,792
Harry Krejsa: information to all of these, to all of these clean energy entrants. How to make

275
00:26:55,816 –> 00:27:01,488
Harry Krejsa: ICE Ax work for a more diffuse ecosystem than they. They do right now. That’s

276
00:27:01,504 –> 00:27:04,442
Harry Krejsa: right, yeah. Yes. And do you have a third one? The third one is more

277
00:27:04,466 –> 00:27:09,642
Harry Krejsa: of a civil society one, but it is that we need to get the, you

278
00:27:09,666 –> 00:27:19,242
Harry Krejsa: know, glowering national security hawks like myself and the affirmative vision granola crunching energy communities

279
00:27:19,386 –> 00:27:25,242
Harry Krejsa: sitting down and talking to each other. Sandals meet wingtips. That’s correct, yes. I remember

280
00:27:25,306 –> 00:27:30,340
Harry Krejsa: when I was, when I was in government, you know, our cyber threat intelligence people

281
00:27:30,380 –> 00:27:33,172
Harry Krejsa: would look up from the reports and be like, wait, we’re plugging what into the

282
00:27:33,196 –> 00:27:38,532
Harry Krejsa: grid now? And some of my energy policy friends would similarly look up and say,

283
00:27:38,556 –> 00:27:44,276
Harry Krejsa: wait, China’s hacking people now. And there’s just a tremendous amount of common cause there

284
00:27:44,428 –> 00:27:51,812
Harry Krejsa: and a like, surprising amount of national security advantages vis a vis competition with China

285
00:27:51,996 –> 00:27:58,188
Harry Krejsa: that are being unrealized. And energy is going to be the whole game for these

286
00:27:58,244 –> 00:28:02,748
Harry Krejsa: next few years, whether we’re talking about the rules of the road for the future

287
00:28:02,804 –> 00:28:08,716
Harry Krejsa: electricity ecosystem of the world or for the kind of sprint to artificial superintelligence. It’s

288
00:28:08,748 –> 00:28:15,884
Harry Krejsa: about electricity. And that’s a race we clearly cannot afford to lose around AI and

289
00:28:15,972 –> 00:28:20,668
Frank Cilluffo: a couple of other key technologies like quantum and the like. But I put AI

290
00:28:20,844 –> 00:28:26,812
Frank Cilluffo: and its application very much at the top of the list. Any lessons other critical

291
00:28:26,876 –> 00:28:34,876
Frank Cilluffo: infrastructure sectors can glean from the energy sector, and I’m thinking telcos, I’m thinking finance,

292
00:28:35,068 –> 00:28:41,564
Frank Cilluffo: financial services, or anyone. I think that we gestured at this at the beginning, but

293
00:28:41,572 –> 00:28:47,596
Harry Krejsa: the electricity sector has historically been one of the more advanced, capable ones. That’s right.

294
00:28:47,668 –> 00:28:53,082
Harry Krejsa: And that’s been really great. But looking at how to integrate new entrants as a

295
00:28:53,106 –> 00:28:58,330
Harry Krejsa: sector transforms is going to be a useful lesson for everyone. But in the other

296
00:28:58,370 –> 00:29:04,618
Harry Krejsa: direction, I think I’m hopeful that the electricity sector can learn from the financial sector

297
00:29:04,754 –> 00:29:09,738
Harry Krejsa: in how to think about systemic risk. You know, the financial sector has big players,

298
00:29:09,794 –> 00:29:15,654
Harry Krejsa: it has small players, but they’re uniquely attuned to thinking in terms of, of their

299
00:29:15,742 –> 00:29:20,262
Harry Krejsa: shared systemic interests. Right. If Lehman Brothers goes down on Tuesday, I might go down

300
00:29:20,286 –> 00:29:25,382
Harry Krejsa: on Wednesday. Absolutely, absolutely. And so I think that there’s some bi directional lessons that

301
00:29:25,406 –> 00:29:34,438
Harry Krejsa: could flow there. Awesome. And sort of to wrap a bow around this, what key

302
00:29:34,494 –> 00:29:39,862
Frank Cilluffo: decisions in the next decade do you think will be important, or dare I say,

303
00:29:39,886 –> 00:29:46,352
Frank Cilluffo: even instrumental, to ensure that the A, we can successfully defend against the Communist Party

304
00:29:46,376 –> 00:29:52,624
Frank Cilluffo: of China’s threat and B, that we can win this race that you’re suggesting? I

305
00:29:52,632 –> 00:29:59,024
Frank Cilluffo: think, and that’s a loaded and wide question But I’d be curious what, what you

306
00:29:59,032 –> 00:30:04,112
Frank Cilluffo: think we could be doing now. Sure. I think that on the, the energy and

307
00:30:04,136 –> 00:30:10,404
Harry Krejsa: resources side, I don’t know that there’s enough people in Washington thinking about the abundance

308
00:30:10,532 –> 00:30:18,772
Harry Krejsa: possibilities behind modern energy technologies, whether you’re talking about nuclear, solar, advanced geothermal. A lot

309
00:30:18,796 –> 00:30:26,244
Harry Krejsa: of these technologies we’re talking about generate electricity with almost no fuel. No, like, marginal

310
00:30:26,292 –> 00:30:30,676
Harry Krejsa: costs along the way, which is a. That is something we’re not. That is a

311
00:30:30,748 –> 00:30:35,428
Harry Krejsa: framework we’re not used to thinking in. Right. Like, if the Strait of Hormuz gets

312
00:30:35,444 –> 00:30:41,268
Harry Krejsa: closed tomorrow, we’ll have a gas, gas, gas crisis in days. Whereas if we lost

313
00:30:41,324 –> 00:30:48,148
Harry Krejsa: all access to uranium pellets or solar panels, all of our nuclear plants and solar

314
00:30:48,164 –> 00:30:53,332
Harry Krejsa: panels would keep working with no problem and keep creating electricity with almost no marginal

315
00:30:53,396 –> 00:31:02,452
Harry Krejsa: cost. And that level of that is a strategically unique angle there for this kind

316
00:31:02,476 –> 00:31:09,064
Harry Krejsa: of energy. And the possibility of lowering energy prices, as I know the President has

317
00:31:09,152 –> 00:31:15,992
Harry Krejsa: said is one of his primary goals, unlocks so many other strategic competition advantages that

318
00:31:16,016 –> 00:31:20,616
Harry Krejsa: I think we should be thinking seriously about, at least as seriously as we. Are

319
00:31:20,688 –> 00:31:30,166
Frank Cilluffo: about artificial superintelligence and energy independence coupled with the two combined. Absolutely. That’s, that’s,

320
00:31:30,278 –> 00:31:36,214
Frank Cilluffo: that’s spot on, Harry. What questions didn’t I ask that I should have. We could

321
00:31:36,222 –> 00:31:42,614
Frank Cilluffo: have jumped in a million directions. Energy and the economy. No, I think, I think

322
00:31:42,622 –> 00:31:46,662
Harry Krejsa: we had a great conversation today. It’s a very interesting issue set to be working

323
00:31:46,686 –> 00:31:49,958
Harry Krejsa: on. And I know, you know, I, I came up as a, As a China

324
00:31:50,014 –> 00:31:55,574
Harry Krejsa: hand, specifically first Chinese linguist, working on military and cyber competition. But I think a

325
00:31:55,582 –> 00:32:00,518
Harry Krejsa: lot of folks, once they fluent Mandarin. I wouldn’t say I’m fluent anymore, but I,

326
00:32:00,574 –> 00:32:05,234
Harry Krejsa: at one point I was pret. Darn good. But I think a lot of folks

327
00:32:05,282 –> 00:32:09,762
Harry Krejsa: find as soon as you start touching energy and electricity issues, it gets pretty hard

328
00:32:09,786 –> 00:32:14,082
Harry Krejsa: to think about anything else. Yeah. Yeah. Harry, thank you for your service for all

329
00:32:14,106 –> 00:32:18,210
Frank Cilluffo: these years. Carnegie Mellon’s lucky to have you on their team, and I look forward

330
00:32:18,250 –> 00:32:21,698
Frank Cilluffo: to continuing to work with you. So thank you. I’d like that, too, very much.

331
00:32:21,754 –> 00:32:25,970
Harry Krejsa: Thanks for the opportunity here. Thank you for joining us for this episode of Cyber

332
00:32:25,970 –> 00:32:30,812
Frank Cilluffo: Focus. If you liked what you heard, please consider subscribing your ratings and reviews. Help

333
00:32:30,836 –> 00:32:34,892
Frank Cilluffo: us reach more listeners. Drop us a line if you have any ideas in terms

334
00:32:34,916 –> 00:32:40,508
Frank Cilluffo: of topics, themes, or individuals you’d like for us to host. Until next time, stay

335
00:32:40,564 –> 00:32:43,100
Frank Cilluffo: safe, stay informed, and stay curious.