Keeping the Lights On in the AI Era with DOE’s Alex Fitzsimmons
Season 3 Episode 12 •Show Notes
Electricity demand is surging—and DOE’s Alex Fitzsimmons argues that the country’s ability to “keep the lights on” is now inseparable from how fast we can expand energy infrastructure, how we manage affordability, and how seriously we treat security. In this conversation with Frank Cilluffo, Fitzsimmons, the Acting Under Secretary of Energy and Director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER), frames “energy dominance” as a practical governing problem: meet rapid load growth (including from AI and data centers), avoid reliability shortfalls, and do it in a way that doesn’t push unacceptable costs onto everyday Americans.
Main Topics Covered
- AI- and data center-driven demand growth
- Affordability and “ratepayer protection”
- Resource adequacy and reliability risk
- OT security and critical infrastructure stakes
- Supply chain risk and security vs speed
Key Quotes
“Privacy, data breaches, all of these things are important. They matter. They matter. But OT matters more. Keeping the lights on matters more.” — Alex Fitzsimmons
“These tech companies recognize that for their technology to be politically and economically viable, that the American people cannot be shouldered with the burden of new data centers.” — Alex Fitzsimmons
“We were set to lose 100 gigawatts of reliable dispatchable generation by 2030, at the same time that we may need to build 100 gigawatts of generation and associated infrastructure to win the AI race.” — Alex Fitzsimmons
“We have to [build supply] securely. So we can’t sacrifice security for speed.” — Alex Fitzsimmons
“[AI-FORTS] is focused on 3 things: secure the energy system from AI, secure it with AI, and secure the AI itself.” — Alex Fitzsimmons
Relevant Links and Resources
DOE 2025 resource adequacy report
NERC; RTOs and ISOs (mentioned in the episode; link not provided)
Guest Bio
Alex Fitzsimmons serves in the Trump Administration as the Acting Under Secretary of Energy at the U.S. Department of Energy (DOE), where he spearheads DOE’s energy dominance mission and oversees a broad portfolio of offices advancing affordable, reliable, and secure energy for the American people.
He also serves as Director of DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), leading efforts to safeguard the nation’s energy infrastructure against evolving cyber and physical threats and strengthen resilience across critical energy systems.
Transcript
1
00:00:00,000 –> 00:00:01,000
Alex Fitzsimmons [00:00:00]: That’s when you’re talking about life or death, but privacy, data breaches, all of these things are important.
2
00:00:01,000 –> 00:00:02,000
Frank Cilluffo [00:00:07]: They matter.
3
00:00:02,000 –> 00:00:03,000
Alex Fitzsimmons [00:00:08]: They matter. But, but OT matters more. Keeping the lights on matters more.
4
00:00:03,000 –> 00:00:04,000
Frank Cilluffo [00:00:16]: Welcome to Cyber Focus from the McCrary Institute, where we explore the people and ideas shaping and defending our digital world. I’m your host, Frank Cilluffo, and this week I have the privilege to sit down with someone who’s at the epicenter of two of the largest issues facing our community today. Alex Fitzsimmons is the acting Undersecretary of Energy. He owns the energy dominance sets of issues, which is all-encompassing. But in addition to that, he is also the director of CESER, the Cybersecurity Energy Security Emergency Response Group, in essence, keeping the grid resilient and secure and the lights on. Couldn’t ask for a better guest than Alex today and, and really excited for the discussion. Alex, thanks so much for joining us.
5
00:00:04,000 –> 00:00:05,000
Alex Fitzsimmons [00:01:03]: It’s great to be here with you, Frank. Thanks for having me.
6
00:00:05,000 –> 00:00:06,000
Frank Cilluffo [00:01:05]: Now, so you, you really do have two of the most pressing issues, not only facing the cyber community, but society. And I thought we’d start with unpacking, um, the energy dominance questions. And we’ve had a number of guests here talking about, uh, grid security and looking at AI, and I think it’s fair to say you can’t be AI dominant unless you’re energy dominant. How do we put all these pieces together? What does your portfolio look like there?
7
00:00:06,000 –> 00:00:07,000
Alex Fitzsimmons [00:01:32]: Certainly, yeah, this is an incredibly important issue for the Trump administration. You look at, it was almost a year ago that President Trump signed an executive order to declare a national energy emergency and to create the National Energy Dominance Council that’s led by Secretaries [Doug] Burgum and [Chris] Wright. And this has set the tone for the entire energy policy portfolio of the Trump administration, which is focused on building the most affordable, reliable, and secure energy system possible. And so this is a fundamental responsibility because, as Secretary Wright says, energy is not just a critical sector of the economy, it is the critical sector of the economy.
8
00:00:07,000 –> 00:00:08,000
Frank Cilluffo [00:02:14]: And it is.
9
00:00:08,000 –> 00:00:09,000
Alex Fitzsimmons [00:02:15]: And it is. That makes every other sector possible. As you know, Frank, without energy, you don’t have transportation, you don’t have manufacturing, don’t have healthcare, don’t have telecom. And so we know that. Our foreign adversaries also know that, which I know we’ll get into on this podcast.
10
00:00:09,000 –> 00:00:10,000
Alex Fitzsimmons [00:02:33]: And so the energy sector within all of the critical infrastructure subsectors is the most critical. It’s one of the most targeted. It’s why we need to make sure that we are building the most reliable, resilient, and affordable system possible. And so President Trump’s leadership on this issue has truly been vindicated because you look at how dramatically the energy landscape has changed within the last 10 or 20 years, just a week or so ago, the United States celebrated the 10-year anniversary of our first shipments, exports of liquefied natural gas. That was something that would’ve been unheard of just 10 years even before that when the US was a net energy importer. We’re now a net energy exporter.
11
00:00:10,000 –> 00:00:11,000
Alex Fitzsimmons [00:03:20]: We’re now the largest producer of oil and natural gas in the world. That’s not only made the US more competitive, driven down energy prices in the United States, but it’s dramatically improved the security of the world, of our partners and allies, strengthened us from a geopolitical standpoint. The benefits are tremendous. But you look at, we were at risk of squandering all of that opportunity due to the disastrous energy subtraction policies of the previous administration, which drove up electricity prices by 20 to 30% or more in many parts of the country. This was obviously unacceptable to President Trump and Secretary Wright. We’ve also been looking at the resource adequacy side of the equation. We’ve seen the premature retirement of tens of gigawatts of reliable, dispatchable generation that’s needed to meet peak demand that helped keep the lights on during the most recent winter storm that we had, Winter Storm Fern, just about a month ago.
12
00:00:11,000 –> 00:00:12,000
Alex Fitzsimmons [00:04:15]: All of these resources are necessary. And so from an energy dominance standpoint, we’re focused on expanding, unleashing American energy innovation so that we can have the most affordable, reliable, and secure energy system for the American people.
13
00:00:12,000 –> 00:00:13,000
Frank Cilluffo [00:04:30]: You brought up a number of important issues here, but before we unpack some of those, for some of our viewers and listeners who aren’t fully aware of CESER’s mission, anything, can you shed some light on what CESER’s mission is as well?
14
00:00:13,000 –> 00:00:14,000
Alex Fitzsimmons [00:04:45]: Absolutely, Frank. It’s a true privilege to lead CESER. I’ve been the director of CESER for about a year now, and CESER is uniquely positioned within the federal government. It is the only office within the entire federal government that is solely dedicated to strengthening the security and resilience of the entire energy sector. So you have other offices within DOE that focus on one technology vertical. We have a nuclear energy office, an office of electricity, an office that deals with hydrocarbons and geothermal and critical minerals. CESER is the only office within DOE in the federal government that’s focused on security and resilience of the entire energy sector. So other parts of the federal government will, will deal with critical infrastructure, but no other office is just focused entirely on the entire energy value chain from oil, natural gas, upstream, midstream, downstream to the power sector, generation, transmission, ensuring the security and resilience of those.
15
00:00:14,000 –> 00:00:15,000
Alex Fitzsimmons [00:05:45]: I’d say we’re on the precipice of also publishing the first strategic plan that CESER has ever published. CESER was created under the first Trump administration in 2018 to elevate the role of cybersecurity and grid resilience, energy sector resilience in the broader Department of Energy mission, but CESER never had a strategic plan, never had our goals written down. And so that’s incredibly important, both internally and externally, to be able to communicate what CESER does. And so just very briefly, CESER’s mission is to strengthen the security and resilience of the energy sector. We do this in a few different ways. Fundamentally, our first job is to provide timely and actionable information to the energy sector. That is used to develop world-class cyber and physical technologies. That information and those technologies are used to secure and harden critical energy infrastructure. That security and hardening is used to help the energy sector respond and recover to cyber and physical incidents.
16
00:00:15,000 –> 00:00:16,000
Alex Fitzsimmons [00:06:45]: The lessons learned from which help us provide timely and actionable information to the energy sector. So that is the continuous cycle of activities that CESER does every day.
17
00:00:16,000 –> 00:00:17,000
Frank Cilluffo [00:06:54]: You know, Alex, I’m thrilled you’re actually putting out a strategic plan because I think you go around DC, people kind of get it, especially those that have been around for a while, but to actually articulate it, and first question I’d ask is do you get any sleep? It’s a pretty massive set of issues and being able to, and we had a discussion earlier, sort of the divide between the cyber community, IT and the CISO’s role and OT, which is something, sometimes in the CISO’s role, sometimes in the Chief Security Officer’s role. It’s hard to put all these together, but when you think about it, energy is, I mean, electricity is at the heart of it all, but they too depend upon water and transportation and other infrastructures being up and running as well. So you can’t just blame it on energy if there’s a problem, cause they also need some of the interdependencies that are so essential. What’s the timing on the strategy, if I could ask?
18
00:00:17,000 –> 00:00:18,000
Alex Fitzsimmons [00:07:53]: Imminent. So on the precipice, we’re imminent. We’ve been sharing it internally. We’ve been sharing it externally with some stakeholders. We plan on publishing a version very soon. Very soon for publication.
19
00:00:18,000 –> 00:00:19,000
Frank Cilluffo [00:08:05]: Well, we will share that with our viewers, listeners, and the like as soon as that is out. Going to sort of the energy demand, back to the first sets of questions, the energy demand question, there is the need to be, I don’t think we can afford to lose the AI race. And I’m not gonna put words in your mouth, but basically the existential pacing challenge there is the People’s Republic of China. And this is a race we simply cannot afford to lose. But at the same time, we have to have reliable and affordable energy for, for the average citizen. How do we balance that? What does that equity look like? And it’s got to be hard.
20
00:00:19,000 –> 00:00:20,000
Alex Fitzsimmons [00:08:47]: Yeah, fully agree. President Trump and Secretary Wright have made winning the AI race a top priority for the federal government. President Trump published his AI action plan last year. DOE is leading the Genesis mission.
21
00:00:20,000 –> 00:00:21,000
Frank Cilluffo [00:09:00]: And we’re going to talk about Genesis for sure.
22
00:00:21,000 –> 00:00:22,000
Alex Fitzsimmons [00:09:02]: That’s focused on rapidly increasing the productivity of scientific discovery and technological progress with AI. I think one of the most important applications of AI is AI for cybersecurity, which we can talk about. But of course, AI is a huge opportunity. The challenge is meeting the rising energy demand, and this is something we have to be very frank about. So President Trump convened a historic meeting with some of the largest hyperscalers in the country who are all signing the Ratepayer Protection Pledge that the president talked about in his State of the Union address, and that he held a meeting in the White House very recently that Secretary Wright was there for, and this is a recognition that we, we have to and we can get this right. We can meet rising energy demand, speed to power, and we can do it cost-effectively.
23
00:00:22,000 –> 00:00:23,000
Alex Fitzsimmons [00:09:52]: And there’s some tangible case studies of where this is working, like in Georgia and Indiana, that are actually freezing and reducing rates over time. And so we have a model for how this can work. I mean, simply, if you are expanding the rate base, which, which these AI companies are doing through their energy demand, that’s a, that’s a larger base with which the utilities can recoup the capital that they’re investing into the system. And so these tech companies recognize that for their technology to be politically and economically viable, that the American people cannot be shouldered with the burden of new data centers. Trump administration agrees. The technology sector agrees. And so now we’re focused on implementation, making sure that everyone’s holding up their end of the bargain, but we know this can work.
24
00:00:23,000 –> 00:00:24,000
Alex Fitzsimmons [00:10:44]: I mean, these companies have pledged to pay for all of the associated generation and transmission network upgrades that are necessary to connect the load that they’re seeking to build, and we have to be able to, to build faster in this country. That’s something that Secretary Wright is very passionate about. President Trump moves at the speed of business, and we have huge ambitious goals that we’re trying to meet, and we know that we can meet it. And so we, we don’t have to sacrifice speed. We can get affordability, reliability, cost-effectively, and we can do it fast.
25
00:00:24,000 –> 00:00:25,000
Frank Cilluffo [00:11:23]: And where do we see the labs fitting into all of this and then the utilities themselves? And is there a state that you would look to as a model who’s doing it right? Because there are lots of moving parts here and you gotta get them all moving in the same direction, which easy, easy, easily said, but very hard to do, right?
26
00:00:25,000 –> 00:00:26,000
Alex Fitzsimmons [00:11:42]: Yeah. We have a lot of national labs that are involved both on the, the AI side, so scientific discovery and technological innovation and then how do you produce enough generation and transmission and associated infrastructure to meet the needs of AI and win the, the AI race? So certainly it’s a, it’s a huge collaborative effort between us, industry, and the national labs.
27
00:00:26,000 –> 00:00:27,000
Frank Cilluffo [00:12:06]: Awesome, awesome. And anything else you want to discuss on the dominance before we pivot to a little more of the CESER discussion? And we’ll use some of the extreme weather incidents we’ve seen recently, but anything else on the energy dominance side that our viewers should know?
28
00:00:27,000 –> 00:00:28,000
Alex Fitzsimmons [00:12:21]: Yeah, I think one important piece of context is, so after President Trump declared a national energy emergency on day one of his second term, the Department of Energy conducted a study on resource adequacy that confirms what the nonpartisan grid operators, NERC, and all the RTOs and ISOs have been saying for years, which is that under the previous administration’s energy subtraction policies, resource adequacy was getting worse. Reserve margins were shrinking to dangerously low levels. Despite the fact that the United States is the largest energy producer in the world, didn’t make sense in 2025, 2026 that we would be at risk of energy generation shortfalls in the United States because we have all this abundant supply of natural gas and coal and nuclear. And so the secretary commissioned a resource adequacy report, which found that on the pace we were on prior to the Trump administration, we were set to lose 100 gigawatts of reliable dispatchable generation by 2030, at the same time that we may need to build 100 gigawatts of generation and associated infrastructure to win the AI race and onshore manufacturing and meet all of these goals. The result of which, if we had allowed that to continue, would have been 100 times more blackouts by 2030. Not 100%, 100 times more loss of load hours by 2030, simply not being able to have supply meet demand. That was completely unacceptable to the Trump administration, so from an energy dominance standpoint, we’ve been working to rapidly reverse that policy and that path we were on with a three-pronged strategy to stabilize, optimize, and grow the energy system.
29
00:00:28,000 –> 00:00:29,000
Alex Fitzsimmons [00:14:06]: We’ve done a lot in that, in all of those areas. Secretary Wright issued orders that saved 17 gigawatts worth of reliable power last year alone that would have left the bulk power system. Some of those plants were running during the winter storm. We’ve also been working on optimizing the energy system, so we’re investing billions upon billions of dollars to do strategic upgrading of the transmission system. We just issued a $1.9 billion funding opportunity. It’s called SPARK. That’s focused on strategic, apropos, right, focused on strategic reconductoring and grid-enhancing technologies to alleviate system congestion and lower prices. And then, of course, we’re focused on rapidly expanding the supply of reliable dispatchable generation to meet growing demand, everything from nuclear, natural gas, to clean, beautiful coal, all of those technologies.
30
00:00:29,000 –> 00:00:30,000
Frank Cilluffo [00:14:57]: And one question I do want to ask is around nuclear. Are we seeing a renaissance?
31
00:00:30,000 –> 00:00:31,000
Alex Fitzsimmons [00:15:03]: Yeah, I think we’re, we’re on the precipice of it. I was just in, in Paris at the nuclear energy conference, and United States is making more progress than any other country on earth in this area in terms of putting real resources behind this. So a couple data points here are, so President Trump issued 4 executive orders last year that are focused on revitalizing America’s nuclear sector and, and unleashing both conventional traditional reactors and next-generation reactors, small modular reactors, micro reactors, other technologies. The goal is to quadruple U.S. nuclear capacity from around 100 gigawatts to 400 gigawatts by 2050. We’ve already started making investments in this area. So just a couple of weeks ago, DOE closed the largest loan that has ever been issued in the history of the federal government outside the financial crisis. This was under President Trump’s leadership, under our newly redesignated Office of Energy Dominance Financing, previously the Loan Programs Office, the $25 billion loan package to two companies that you’ll know well, Georgia Power and Alabama Power.
32
00:00:31,000 –> 00:00:32,000
Alex Fitzsimmons [00:16:16]: And it’s focused, it includes nuclear. So it is, it is an encapsulation of the president’s energy dominance agenda in one package of loans. It includes 6 gigawatts of new natural gas generation, more than 5 gigawatts of nuclear upgrades, so investing in increasing the incremental capacity of our installed nuclear base over the next few years, 3.5 gigawatts of battery storage, a gigawatt of hydropower upgrades, 1,300 miles of transmission lines to expand the capacity of the bulk power system. And it will all result in $7 billion worth of savings to ratepayers in Georgia and Alabama. So yes, we’re focused on that. You’re going to see a lot more deals coming out, both grants and loan funding for nuclear and for all baseload power that’s needed to help meet peak demand.
33
00:00:32,000 –> 00:00:33,000
Frank Cilluffo [00:17:05]: And not to go too deep on this particular set of issues because I don’t know what I don’t know, but at the end of the day, it’s the cleanest form of energy in many ways as well, right?
34
00:00:33,000 –> 00:00:34,000
Alex Fitzsimmons [00:17:15]: Yes. And it has the highest capacity factor, totally.
35
00:00:34,000 –> 00:00:35,000
Frank Cilluffo [00:17:17]: I grew up with this idea of Three Mile Island, but that’s changing.
36
00:00:35,000 –> 00:00:36,000
Alex Fitzsimmons [00:17:20]: It’s the cleanest, safest form of energy that exists on planet Earth. It has the highest capacity factor of any energy resource. Grid operators accredit 95% of the installed capacity that nuclear, no, no other source comes close. And natural gas and coal also get most of their capacity accredited because they’re always on. They work 24/7. Case of coal, you have onsite fuel, natural gas infrastructure, the best form of long-duration storage we have is natural gas infrastructure, but nuclear is the safest, as you said, cleanest, most reliable form of electricity that we have.
37
00:00:36,000 –> 00:00:37,000
Alex Fitzsimmons [00:17:55]: President Trump recognizes this, so we’re doing everything we can to revitalize the nuclear industry in America.
38
00:00:37,000 –> 00:00:38,000
Frank Cilluffo [00:18:01]: And I’ve also seen the industry, which I don’t want to suggest was ever sleepy, but very conservative in terms of their thinking, almost like a utility, you would think a utility would be, a public utility in some ways. But now you’re starting to see innovation find its way into a number of these companies. And, and I guess they need to know there’s commitment, that this isn’t a one-and-done kind of thing with these peaks and valleys. Is there a sense that this is the long haul?
39
00:00:38,000 –> 00:00:39,000
Alex Fitzsimmons [00:18:32]: Totally, and a couple of reasons for that. It was so difficult to build new nuclear in the United States.
40
00:00:39,000 –> 00:00:40,000
Frank Cilluffo [00:18:35]: That’s the challenge, right?
41
00:00:40,000 –> 00:00:41,000
Alex Fitzsimmons [00:18:36]: And so safety is always the, is always a top priority. But we’re doing things at the NRC to make, put sensible regulatory frameworks in place so we can actually get to to yes or no decisions and build quicker in the United States again, right? And then I’d say the other point is that the market signal exists now. We had relatively flat power demand growth for years. We were growing at about a historically 0.5% compound annual growth rate.
42
00:00:41,000 –> 00:00:42,000
Alex Fitzsimmons [00:19:05]: Now we’re, you know, with the projections from AI, more than 2% compound annual growth rate, so 3 to 4 to 5 times faster growth in the electricity sector than before with large electric load that we know is going to show up. We know it’s going to show up in places. And so that’s providing a huge market signal to build more nuclear again, and we’re really happy to see it.
43
00:00:42,000 –> 00:00:43,000
Frank Cilluffo [00:19:26]: Exciting times. And I do want to pivot to a little bit of CESER and, and, you know, one of the challenges I think we all recognize that the grid is essential for not only our national security and not only our public safety, but our economy, everything societies are dependent upon. Extreme weather circumstances, bad weather, I mean, you mentioned the winter storms we went through recently, they were pretty unprecedented in the Southeast in terms of the snow and the ice. What does a day in the life of CESER look like when one of these storms hits? What would, what would your office do? How is it supporting sort of the utilities, state, local, advising? Just, just help our viewers understand that.
44
00:00:43,000 –> 00:00:44,000
Alex Fitzsimmons [00:20:18]: Yeah. How we prepare, respond, and recover from cyber and physical incidents is our fundamental responsibility. We’ve got to help the industry keep the lights on. DOE is a sector risk management agency for the energy sector. It’s a responsibility that we take very seriously. We have strong partnerships with the energy sector. We’re in constant communication with them. We have these subsector coordinating councils with the oil, natural gas subsector and with the power sector as well that we meet consistently.
45
00:00:44,000 –> 00:00:45,000
Alex Fitzsimmons [00:20:50]: It’s all the work you do in between those meetings that really, that really makes it.
46
00:00:45,000 –> 00:00:46,000
Frank Cilluffo [00:20:54]: You don’t want to be exchanging business cards when the bad day happens.
47
00:00:46,000 –> 00:00:47,000
Alex Fitzsimmons [00:20:58]: Right, exactly. So we, DOE has an energy response center that we will activate even before we’re activated by FEMA. And we will, we have a surge capacity of around 100 volunteers in addition to the DOE staff that we can, that we can bring in to help prepare and respond to an event. But most important thing is we get into a battle rhythm quickly, well in advance of an event, especially if it’s a major storm that we can see coming. And we have constant, what we’ll call unity of effort, unity of message discussions with the industry on a daily basis, at least. We’re talking high level. I’m in contact with the CEOs of all the major energy companies in the areas that we think—
48
00:00:47,000 –> 00:00:48,000
Frank Cilluffo [00:21:45]: Through the ESCC?
49
00:00:48,000 –> 00:00:49,000
Alex Fitzsimmons [00:21:46]: Through the ESCC and the ONG SCC to make sure that we’re coordinating resources in advance. So with Winter Storm Fern, the energy industry activated 65,000 personnel, linemen and other workers, and got thousands of them pre-positioned in advance of the storm and then surged them into high priority areas once the storm hit to see where the impacts were.
50
00:00:49,000 –> 00:00:50,000
Alex Fitzsimmons [00:22:12]: And so it’s, it’s incredibly important that, that we do that, that we advance that work, that we know where people are going when. And if you look at the winter storm, part of the goal is you want to make sure in advance and during a storm that we’re addressing unmet needs. So as I said, we do these unity of effort, unity of message calls. We figure out what the unmet needs are. We can help coordinate responses within the interagency as well. So obviously we’re working very closely with FEMA, DHS, with the White House and any other agency that might be impacted, Transportation Department, and we can not only help coordinate any unmet needs that the industry might have with other parts of the federal government. But we also have the authority under Section 202(c) of the Federal Power Act—
51
00:00:50,000 –> 00:00:51,000
Frank Cilluffo [00:23:01]: I was going to ask you about that. Good, please.
52
00:00:51,000 –> 00:00:52,000
Alex Fitzsimmons [00:23:03]: -to issue orders that, from the Secretary of Energy, to help alleviate generation and transmission issues to try to keep the bulk power system running. And so during Winter Storm Fern, the secretary issued 20 202(c) orders that helped grid operators and balancing authorities keep the lights on. So at the peak of the storm, there were about a million Americans who lost power, but those were issues that were mostly at the local distribution level. So ice falling on power lines in the Southeast, it’s not used to dealing with that, power lines that run to houses. The, the bulk power system, so the transmission and generation system that’s the backbone of America’s economy, that held up, that held firm. There were no fundamental energy shortfalls that would have resulted in massive rolling blackouts. That we were able to mitigate, in part because of how quickly the energy sector responded and how quickly DOE was able to activate to turn around orders that were coming in from the industry, from states and balancing authorities.
53
00:00:52,000 –> 00:00:53,000
Alex Fitzsimmons [00:24:11]: We were able to take a timeline for a typical 202C order down from 3 or 4 days to, in some cases during the storm, 3 hours.
54
00:00:53,000 –> 00:00:54,000
Frank Cilluffo [00:24:20]: Wow.
55
00:00:54,000 –> 00:00:55,000
Alex Fitzsimmons [00:24:20]: So we were able to rapidly activate, get these orders out so that the industry had the resources that they need to respond.
56
00:00:55,000 –> 00:00:56,000
Frank Cilluffo [00:24:29]: So great set of issues here. Any, any authorities you’d like Congress, any authorities you’re lacking at this point?
57
00:00:56,000 –> 00:00:57,000
Alex Fitzsimmons [00:24:35]: You’re going to get me in trouble, Frank.
58
00:00:57,000 –> 00:00:58,000
Frank Cilluffo [00:24:37]: I will drop that question.
59
00:00:58,000 –> 00:00:59,000
Alex Fitzsimmons [00:24:39]: No, look, I think we, I recently testified, I think in January, it was a House Energy and Commerce Committee hearing. They had a series of bipartisan bills. We provided technical assistance on a series of those. They were around increasing coordination with the industry. One important program that we have is the Energy Threat Analysis Center, ETAC. I mentioned one of our fundamental responsibilities that’s in the upcoming CESER strategic plan is to provide timely and actionable information to the energy sector because more than 80% of energy infrastructure is privately owned and operated. But we have the clearances.
60
00:00:59,000 –> 00:01:00,000
Alex Fitzsimmons [00:25:16]: Most of the industry does not. So we have to develop capabilities to get the information out, threat information out to the industry in ways that they can use, ways that are relevant for them. And so that’s what ETAC does. That’s one of the ways that we do this, which is we have cleared industry partners physically co-located alongside DOE staff so that we can analyze threat information as it comes in in real time, figure out, is this a sector-wide threat, because we have the industry expertise there, and it’s represented by a broad swath of the energy industry, and then figure out what the vulnerabilities are, how do we mitigate those vulnerabilities, then how do we get that information back out to the private sector so that they can do something about it.
61
00:01:00,000 –> 00:01:01,000
Frank Cilluffo [00:26:08]: That’s an essential service and an essential function. And I’d be curious, so when you think of the big utilities, you think of Southern Company, Duke, NextEra. They have resources, they have capabilities, and dare I say, they’re punching well above their weight. If I were to look at critical infrastructures, if they’re not at the top, maybe DIB, maybe financial services, but they’re right there. But how about the munis and the co-ops and how does ETAC or other entities, because ultimately they don’t have those resources, and I don’t want to suggest they have one person doing 5 jobs, but probably doing 2 jobs.
62
00:01:01,000 –> 00:01:02,000
Alex Fitzsimmons [00:26:45]: Yeah, sometimes they do. It’s a great point. You look at, the energy sector is diverse and, you know, there are a lot of rural municipalities and co-ops who might have one person working on IT and cybersecurity, but they’re expected to defend their networks against nation-state threat actors.
63
00:01:02,000 –> 00:01:03,000
Frank Cilluffo [00:27:09]: It’s an unfair playing field.
64
00:01:03,000 –> 00:01:04,000
Alex Fitzsimmons [00:27:11]: Totally, because they operate critical infrastructure and sometimes because they operate defense-critical infrastructure, sometimes who their customers are. So we are trying to expand our resources to them because you can have a huge return on investment for those resources, even investing in basic cyber hygiene, network segmentation, multi-factor authentication, training the various components within a utility who are on the front lines of cyber but don’t realize they are, like the HR department, right, are the front lines for spear phishing campaigns. Getting them, getting the communications, the legal team, the CEO buy-in across the enterprise that you’re all part of the solution here. You’re all part, that’s ensuring the security.
65
00:01:04,000 –> 00:01:05,000
Frank Cilluffo [00:28:00]: From a shared services perspective, you’re putting some of that out.
66
00:01:05,000 –> 00:01:06,000
Alex Fitzsimmons [00:28:02]: Yeah, it’s a joint responsibility. And so one of the programs we’re administering is the RMUC program, the Rural Municipal Utility Program, where hundreds of millions of dollars in cybersecurity services directly to munis and co-ops to elevate their collective cybersecurity posture. That’s something that we will continue to invest in and then get these companies involved in other CESER programs.
67
00:01:06,000 –> 00:01:07,000
Alex Fitzsimmons [00:28:31]: So munis and co-ops are represented in ETAC, as I mentioned, because we want to make sure we have a broad swath that we can get the information out to them. We have a supply chain testing program that we want to make sure that they’re a part of. We include them in all of our training program, our exercises, tabletops, is getting them integrated. Hardening is not just technology. Hardening is also system planning, so it’s as much about people and process as it is technology. And that does not cost a lot of money. It just takes time and effort.
68
00:01:07,000 –> 00:01:08,000
Frank Cilluffo [00:29:03]: And the engagement, and I’m glad you’re doing that engagement because that does matter. And we like to say the time to learn is not in the midst of, in the midst of the crisis. And I’m happy to hear the emphasis there. And for transparency, we are doing some work with DOE on some of these issues that we believe deeply in as well. Speaking of sort of that IT/OT, and you brought it up, how spear phishing, because you’re right, the battlefield here, the attack surface is everywhere. And when I look at what DOE in particular has unique capabilities. It’s around OT.
69
00:01:08,000 –> 00:01:09,000
Frank Cilluffo [00:29:46]: And when you think about incidents that cause life, death, it’s largely going to be OT. It can be IT enabled, it can be IT initiated, but at the end of the day, it’s on the OT side. And I think people lose that when, when they think about cyber, they’re thinking about the zeros and ones alone, which are essential. Don’t get me wrong. But anything you want to share on the OT side that you’re sort of driving?
70
00:01:09,000 –> 00:01:10,000
Alex Fitzsimmons [00:30:11]: Totally. I mean, that’s the reason why I care about cybersecurity. I started my career in the energy sector because of how important energy is to the world, to the United States, to our global competitiveness, how, as I said, it enables every other sector of the economy, and obviously the security and resilience of the energy sector is incredibly important. It’s fundamental. But that it, that OT security is often left out of the broader discussion around cybersecurity.
71
00:01:10,000 –> 00:01:11,000
Frank Cilluffo [00:30:42]: Or it’s a different group that does it.
72
00:01:11,000 –> 00:01:12,000
Alex Fitzsimmons [00:30:44]: It’s a different group. It’s people that are not talking to each other. Cyber IT people and OT people-
73
00:01:12,000 –> 00:01:13,000
Frank Cilluffo [00:30:49]: Rarely come together.
74
00:01:13,000 –> 00:01:14,000
Alex Fitzsimmons [00:30:50]: And I mentioned this, I was at the Munich Cybersecurity Conference and Munich Security Conference a few weeks ago. I had the privilege of sitting on one of the panels for the cyber conference and I was the, and I said this in the panel, so it won’t be breaking news to anyone there, but I was the only, essentially the only representative of critical infrastructure that I could find on the entire agenda. It was a lot of IT vendors, but no one, almost no one focused on OT and no one focused on critical infrastructure. It was just us and we have to change that. We have to fundamentally change that equation because that’s what really matters.
75
00:01:14,000 –> 00:01:15,000
Alex Fitzsimmons [00:31:33]: That’s when you’re talking about life or death. Privacy, data breaches, all of these things are important.
76
00:01:15,000 –> 00:01:16,000
Frank Cilluffo [00:31:40]: They matter.
77
00:01:16,000 –> 00:01:17,000
Alex Fitzsimmons [00:31:41]: They matter, but OT matters more. Keeping the lights on matters more.
78
00:01:17,000 –> 00:01:18,000
Frank Cilluffo [00:31:46]: I would agree with that. And there are a few entities that are converging. So you need visibility, first and foremost, sort of from a SOC awareness standpoint, IT, OT, but they’re not enough yet, and I’d like to see more of that. And we’re getting near the end of our time, but I wanted you to provide a little bit of a sense of the threat picture from your perspective and what you think our security posture should look like.
79
00:01:18,000 –> 00:01:19,000
Alex Fitzsimmons [00:32:11]: Sure. Yeah. Thanks for the question. The threat landscape is obviously severe and evolving. This won’t be news to any of your listeners, but we’re very concerned about prepositioning nation-state threat actors inside critical infrastructure, holding it at risk for a time and place they’re choosing. And we recognize that the energy sector is a juicy target for adversaries of all kinds. You look at how the landscape is changing with the introduction of DERs, expanding the attack surface, increasing threat vectors into the sector. That is a major challenge that’s only going to continue.
80
00:01:19,000 –> 00:01:20,000
Alex Fitzsimmons [00:32:56]: If you look at Energy Information Administration data on what capacity is going to be added over the next few years, a lot of solar, a lot of storage, so we’ve published reports on the security of DERs, of solar and storage technology, a lot of supply chain vulnerabilities there. The supply chain risk that our country faces is intensifying. So you think back to the need to rapidly build all of this energy infrastructure, 100 gigawatts I mentioned, to meet load growth, and, but we have to do it securely, so we can’t sacrifice security for speed. And so this is why we need to be prioritizing. This is why the secretary, when he talks about energy dominance, he says affordable, reliable, and secure. And we can’t overlook the security part.
81
00:01:20,000 –> 00:01:21,000
Alex Fitzsimmons [00:33:47]: And that’s the reason the secretary talks about it is because it cannot be an, an afterthought. We have to be able to do all of these things in conjunction. So we have a major supply chain testing program, it’s called CyTRICS. It’s a multinational lab effort where we can procure grid components, other energy technologies from a variety of vendors, tear them apart, figure out what the vulnerabilities are, how to mitigate it, and then get that information back out. We’re going to have to double, triple, quadruple that effort as we’re building all of this new infrastructure in new areas, hundreds of thousands of components and subcomponents. We need software bill of materials that need to get better, that we need to better characterize all of that. That’s what CyTRICS is trying to do.
82
00:01:21,000 –> 00:01:22,000
Alex Fitzsimmons [00:34:34]: We have another effort called Project Armor that’s in the president’s FY26 budget where we’re partnering directly with Defense Critical Energy Infrastructure owners and operators recognizing that, that prepositioning risk, especially for them because of who their customers are, serving critical DOW, uh, missions. And so we’re working collaboratively with DOW and with the industry to conduct rapid site assessments and then invest in strategic hardening and, and upgrades to make it more expensive for, for adversaries, like raise, raise the cost of attack, right, to improve our collective cybersecurity posture. It’s incredibly important work. It’s foundational to the entire energy dominance mission of the Trump administration.
83
00:01:22,000 –> 00:01:23,000
Frank Cilluffo [00:35:20]: And we just had Sean Cairncross on laying out the pillars and the priorities of the National Cyber Strategy and imposing cost and consequence and changing, inducing changes in behavior. I think the grid and prepositioning is pretty high on the list, potentially, of how that could play out in the future.
84
00:01:23,000 –> 00:01:24,000
Alex Fitzsimmons [00:35:41]: Yeah. And it was great to see the ONCD’s National Cyber Strategy come out. It has a pillar that addresses critical infrastructure.
85
00:01:24,000 –> 00:01:25,000
Frank Cilluffo [00:35:51]: Absolutely. Number 4.
86
00:01:25,000 –> 00:01:26,000
Alex Fitzsimmons [00:35:52]: That’s where DOE plays. And so we’re working very closely with the White House. It’s, and it’s, I think, that’s a reflection of how important critical infrastructure and critical energy infrastructure is in the broader cyber agenda. So working with Sean to help, as you said, bridge that divide between communities that don’t, may not ordinarily speak to each other, but need to, and so that’s what we’re doing with them.
87
00:01:26,000 –> 00:01:27,000
Frank Cilluffo [00:36:17]: We covered so much. I want one sentence on Genesis and what your thoughts are there, and then any questions I didn’t ask that I should have.
88
00:01:27,000 –> 00:01:28,000
Alex Fitzsimmons [00:36:27]: Sure. Well, on, Genesis Mission is the Trump administration’s and DOE’s bold effort to rapidly increase the pace of scientific discovery and technological innovation with AI. And, putting my Caesar hat back on, one of the most important use cases there is AI for cybersecurity. So we have the AI Forts program that was in the ’26 budget request. We’re going to be increasing our investments under this program as part of the Genesis mission. It’s focused on 3 things: secure the energy system from AI, secure it with AI, and secure the AI itself. So more to come on that.
89
00:01:28,000 –> 00:01:29,000
Frank Cilluffo [00:37:06]: Awesome. I’m looking forward to that. Alex, thank you so much for spending so much time with us today. Thank you so much for being, fighting the biggest fights I can think of and doing yeoman’s work in doing so. So thank you for joining us. Let me leave you literally with a token, figuratively and literally of our appreciation and keep fighting the good fight.
90
00:01:29,000 –> 00:01:30,000
Alex Fitzsimmons [00:37:27]: Love it. Thank you, Frank. Thank you for having me and thank you for our continued partnership. It’s one of the most important that we have with you at DOE.
91
00:01:30,000 –> 00:01:31,000
Frank Cilluffo [00:37:34]: Your mission is as essential as it gets and they’re lucky to have you there. So thank you, Alex. Thank you for joining us for this episode of Cyber Focus. If you liked what you heard, please consider subscribing. Your ratings and reviews help us reach more listeners. Drop us a line if you have any ideas in terms of topics, themes, or individuals you’d like for us to host. Until next time, stay safe, stay informed, and stay curious.
