Lawmakers Move to Elevate Leadership of Energy’s Cyber Office

A group of Republican senators, including the ranking member of an influential committee, have reintroduced legislation that would require that the head of the Energy Department’s Office of Cybersecurity, Energy Security and Emergency Response—or CESER—be led by a Senate-confirmed assistant secretary.

The bill—introduced on March 22 by Sens. John Barrasso, R-Wyo.; Jim Risch, R-Idaho; Mike Crapo, R-Idaho; and Susan Collins, R-Maine—would amend the Department of Energy Organization Act “to assign certain functions to the assistant secretaries of Energy relating to energy emergencies and energy security.” 

CESER, which functions as Energy’s main office responsible for cybersecurity, was created in 2018 by the Trump administration to “focus on energy infrastructure security, support the expanded national security responsibilities assigned to the department and report to the under secretary of Energy.” The office was initially led by a Senate-confirmed assistant secretary, but the Biden administration decided to change the designation of the office’s leader to an unconfirmed director. 

In a press release, the bill’s sponsors said that the legislation was needed to further strengthen the cyber resilience of the nation’s energy infrastructure in response to the myriad of digital and physical threats facing the sector, including those underscored by the 2021 Colonial pipeline ransomware attack.

“CESER’s leadership never should have been downgraded from assistant secretary in the first place—not when attacks on America’s critical energy systems are only growing in size and severity,” Risch said in a statement. “The leader of CESER must be restored to assistant secretary to put the U.S. in the best possible position to track and mitigate national security threats.”

Barrasso, the ranking member of the Senate Energy and Natural Resources Committee, introduced a similar version of the bill to elevate the head of CESER in June 2021, but that legislation did not advance beyond the panel by the end of the 117th Congress. 

A bipartisan group of 11 senators—including the current bill’s four co-sponsors—previously sent a letter to Energy Secretary Jennifer Granholm in March 2021 that asked the agency “to prioritize cybersecurity by preserving the CESER office and upholding its leadership at the assistant secretary level.”

“It is imperative that the department does not march backwards on its responsibilities to the energy sector and the protection of our critical infrastructure given the persistent, growing and significant threat cyberattacks pose to our nation’s economy and national security,” the lawmakers wrote at the time. 

The senators’ letter was sent just days after a report from the Government Accountability Office warned that the U.S. energy grid's distribution systems “are increasingly at risk from cyberattacks,” and recommended that Energy “more fully address risks to the grid's distribution systems from cyberattacks.”

But the agency has pushed back on the need for an assistant secretary-level official to helm CESER, citing partisan gridlock as an impediment to confirming a political appointee for such an important role. In an exchange with Sen. Angus King, I-Maine, during a June 2021 Senate Energy and Natural Resources Committee hearing, Secretary Granholm said that, “since CESER was established, about half its existence has been without leadership because it is a political position.”

An Energy representative reiterated Granholm’s position when asked about the need to elevate the head of the department’s cyber office.

“CESER is responsible for executing DOE’s risk management, preparedness and emergency response capabilities for the U.S energy sector, and we are committed to ensuring CESER is staffed with strong career personnel and leadership who have both the subject matter expertise and relationships with the sector that can span across administrations,” the department spokesperson told Nextgov. 

During a March 23 Senate Energy and Natural Resources Committee hearing, Barrasso asked CESER Director Puesh Kumar if it would it be helpful “if the Department of Energy’s cyber office had that same senior standing to signify how important it is.” 

Kumar deferred to the Biden administration and Congress about his position’s title, but added that “I can confidently tell you that I have access to the department’s resources and leaders to accomplish this position.”

While some lawmakers have raised concerns about the lack of a Senate-confirmed official heading CESER, broader questions about the resilience of the nation’s energy infrastructure remain top of mind when it comes to addressing the cyber risks posed by adversaries. 

Barrasso said during the same March 23 hearing that having a Senate-confirmed official lead CESER was “an obvious first step,” but added that “more needs to be done” to counter the threat that hostile nations and cybercriminals pose to the U.S. energy sector.

“The federal government must get its cyber house in order,” he added. “We must do more to counter China and Russia. We must work to strengthen private-public partnerships to improve the cybersecurity of our critical infrastructure. And we must not weaken our security in a headlong rush to electrify everything.”