China, Clean Energy and the Future of U.S. Energy Security with Harry Krejsa

Welcome to Cyber Focus from the McCrary Institute, where we explore the people and ideas shaping and defending our digital world. I'm your host, Frank Cilluffo, and this week I have the privilege to sit down with Harry Krejsa. Harry is Director of Studies at Carnegie Mellon University's Institute for Strategy and Technology. He came to the Institute from the office the National Cyber Director, where he played an instrumental role in the first National Cyber Strategy, and prior to that served in the Solarium Commission, where I got to know Harry quite well, and prior to that, the Office of the Secretary of Defense and the Pentagon. Harry, privilege to have you here. Great to. I'm so glad you can join us. Thanks for having me, Frank. I'm thrilled to be here. So you recently authored a pretty big report, sunshield. And is that your first report since you joined cmu? That's right, yeah. So I thought we could tee off on a broader discussion, but also jump into the report around us, China competition and grid security. And maybe we can start with sort of the key findings of the report just to set the scene. Sure. I think it's no surprise to the audience of Cyberfocus that

one of the big premises here is that the People's Republic of China, we now know, are working to place disruptive and destructive cyber capabilities on various kinds of American infrastructure. And that seems to be for two main motivations, one being to stymie our ability to mobilize a military response to a crisis. And second would be to, as I think former CISA Director Jan Easterly put it before Congress, induced societal panic so that there was less political. Political will to sustain such a response to a crisis.

I would also add espionage. But. But let's start with Volt Typhoon, because that's. That's sort of. I think the. It goes many steps beyond simply intelligence preparation of the battlefield. It's actually getting into our systems at a time of their choosing. What. What were some of your takeaways in terms of Volt Typhoon and what that means? And then in particular from. From a. An energy perspective. Absolutely. So over the last couple

of years, putting together, you know, Microsoft's Threat Intelligence Cell was one of the first organizations to really stitch together a lot of these signs of Volt Typhoon intelligence in the public domain. And paired with some subsequently declassified information from government, we get this kind of bigger picture of, you know, the Chinese security apparatus finding cracks in the armor of our critical infrastructure. Right. The Volt Typhoon and certainly subsequent, like salt typhoon campaigns were remarkably robust examples of cyber tradecraft that were often focused on initial access at the seams between new technology and old technology. And in many sectors of our critical infrastructure, those seams run pretty deep. We were one of the first countries to industrialize, to modernize, to electrify, to deploy a lot of advanced technologies in our various critical infrastructure sectors. But that means we also have a lot of technical debt compared to many other countries around the world because we were the first to deploy a lot of these technologies. And so we are sitting on foundations in many sectors of our economy that were never intended to coexist with the level of digitization and Internet Internet connectivity that they do now. And so in a lot of sectors, in particular the, the divide between information technology, you know, your networks, computers and Internet connected assets and operational technologies, the gauges, switches and pumps that change things in the real world, those seams are, those lines are being broken down and a lot of older infrastructure runs on ot that operational technology that cannot be secured in a world of ubiquitous digital connectivity. You know, the ITOT convergence has been a theme we come back

to over and over because it is very real. Yet if you look at our defenders, we still don't look at it in through the same lens. And I do. Before jumping into some of the findings in your report, I do want to just unpack briefly. So Volt Typhoon primarily gaining access to systems that can be switched on and off at the choosing, at the timing and choosing of China. Salt Typhoon largely espionage, largely, largely telecommunications. But at the end of the day, if you can do collection on telcos, you can basically get to every critical infrastructure. Flax Typhoon More focused on IoT and IIoT devices to include some of those OT devices primarily focused on Taiwan, but obviously has implications globally. Silk Typhoon seems to be getting a lot of interest most recently in terms of new sanctions and the like. Fair. If you want to unpack the intentions behind all. Each one of those typhoons is a really bad day. It's a bad day. Collectively, it's a perfect storm of vulnerability, isn't it? It

is. And while these various campaigns have different particular targets or tradecraft associated with, they in many cases boil down to finding ways to exploit those seams between our modern technology and our older technology. And indeed in sector after sector, you know, when we were at the White House, you'd hear about, you know, a new sectoral, you know, breach would become known. Folks would call NCOs to the White House and say, hey, we gotta, we gotta fix this guys. And the response would be, you know, sure, we'd love to, and we're committed to doing so, but we need tens of billions of dollars to do so durably. We can kick folks out in the near term. We can try and find where these various typhoon campaigns have gone for now. But to make things durably securable will require clearing out decades of technical debt that can't be made digitally native, that can't be made secure. And there's no sector, no, no critical infrastruct in the country that has the amount of capital necessary to undergo that transformation, except for one and what is that sector? That is the electricity sector. A confluence of supply and demand dynamics from the last few years is producing a golden opportunity of transformation in our electrical sector. Between the. Over the last few years the bipartisan infrastructure law and inflation Reduction act and huge decrease in prices for technologies like solar panels and batteries have created this big new influx of clean energy technologies that are disproportionately digitally native and so can be made more securable, more future proofed than our legacy infrastructure can be and that are more distributed in nature. They can be made more resilient against disruption and attack. And on the demand side, we're seeing for the first time in decades growth in demand for electricity. We've had basically flat or like 1% growth in electricity demand for decades and have gotten by mainly on efficiency gains as our society has become more advanced and energy intensive. But we're now seeing for the first time in a long time true increase in electricity demand. And

that's because of AI data centers and the like. It'll grow exponentially indeed, AI data

centers also reshoring of manufacturing. The big increase in re industrialization over the last few years is producing a lot more electrical demand. Vehicle and industrial electrification with the big AI data center load growth are combining to increase that demand for electricity and to build out that grid anew. So just to clarify, you have an opportunity with new

technology to bake security into the design to cyber informed engineering, some of the DOE principles. You, you, you don't get that opportunity every day because you're building Lego on, on top of legacy systems, some of which were built on quicksand, if I'm being very honest. But, but you do get that opportunity once you're looking at new investment, new technologies, is that correct? That's correct. So clean technology, it's about a new opportunity and China is ahead of us from, from a, from many perspectives or. No, they

certainly have an early advantage in clean tech manufacturing and this is something that we'll want to, you know, actually join the fight on here more, more deliberately in the years to come. Because the golden opportunity here with our own infrastructure is not only that we have a moment of recap, but that we have available to us these new technologies for energy generation that are more digitally native, more defensible, more software defined. And so they have these kind of unique technological attributes to them. They're also becoming dirt cheap. I think solar panels and batteries are following the same cost curve of like falling 90% in prices in like the last five to 10 years. It is just a tremendous decline in costs that's made solar and battery storage facilities like the cheapest new form of electricity that you can buy. And as a result is becoming a popular choice for electricity around the world, particularly in the. In emerging markets and developing economies around the world. Many are hoping to leapfrog straight to solar and batteries as that modern source of electricity. And right now, China is helping set the rules of the road for that global capital investment rush. So what does that mean from

a supply chain perspective? It means that we, as with many manufacturing quandaries in front

of us, we need to think about how we compete with China on different parts of that supply chain. It means how do we think about disaggregating some of these technologies into pieces that we want to have a more secure and verifiable supply chain, a supply chain for more exquisite, digitally exposed components that we need to have more trust in versus supply chain that serves commodity components that we are more willing to accept risk in. I think one of my favorite examples would be a battery. Right. A battery is 90% electrolyte goo and 10% controller electronics, battery management systems. And if we're wanting to talk about supply chain security and confidence in those kinds of systems in the future, we can disaggregate those things. We can say that on the power control portions of it. We have a lot of allies around the world, Japan, South Korea, Taiwan, who are great at advanced electronic manufacturing and that we might be able to partner with to create parallel supply chains for those components. If

I'm thinking about that's friend shoring. That's right, exactly. But like the electrolyte goo, I

don't really care where that comes from. Right. We do want minerals, don't we? It's

dominating a lot of discussion these days. There's a difference between, you know, supply. Chain goo and goo. Right. But if we're talking about like supply chain risk, like supply

chain attack risk and supply chain availability, then, you know, I'm less concerned about where the critical minerals come from. A supply chain attack perspective. But certainly general availability is something we want to keep an eye on. Absolutely. And from a US perspective, obviously

we're going to continue to double down on traditional forms of electricity. And I would argue from a security standpoint, they're pretty high on the list. If you were to compare them to say water or health care or some of the other sectors that are not as far along as I think many of us would like, but we also see the ability to expand that. So it's not an either or proposition. It's. It's kind of both to be able to meet energy needs. And I'd be curious what you think some of the cybersecurity risks are with integrating smart inverters, battery storage, virtual power, all the things that flip a switch and turn things on on the OT side, what does that mean from a cybersecurity perspective? Sure. It's one of those

things where if we do it right, we can end up with a grid that is more defensible and resilient than it could have ever been otherwise. But if we do it wrong, we will just recreate the vulnerabilities of the fundamental foundation under it.

So single point failure kind of concerns. That's right. Are we doing it right or what do we need to do to do it right? I think we're making great

progress. An important kind of bit of context is in the late 2010s, Gao released these couple of reports that were sounding the alarm about the proliferation of Internet connectivity across our electrical grid. And they had nothing to do with a particular kind of energy generation, but rather just asset management. We're a big country. We've got substations and assets that are in difficult or dangerous to get places. And we'd really like to be able to manage those assets without having to send someone there every day. So since the early 2000s, we've been slapping dial up modems onto the sides of dams and managing things remotely because it was easier to do it efficient way, right? Yeah. And if you're trying to think about our infrastructure in terms of just pure cybersecurity, you have basically two options. One is a totally air gapped situation. No such thing. Indeed. But the theoretical is the ideal, right? Yeah. And the opposite end is a totally digitally native one where you're saying we're going to be interactive. Exactly. But we're going to be agile, we're going to patch all the time. We're going to be, as you know, forward leaning as we can on learning about new threat and incorporating those into the software that helps secure all of this. And where we are now is this messy middle where we have some assets that are Internet connected and never were meant to be, never could be securable and some that are. And when we think about the proliferation of more software defined electronics tools like smart inverters and batteries, we see the opportunity to do it right. You know, you know, I was a

long advocate and I think I testified on this 20 years ago that in terms of any IT spend and any recapitalization and infrastructure spend, at least 12 to 15% should be devoted to security. Do you think that that issue is ripe again? I

think it's getting there. You know, the bipartisan infrastructure law included some really helpful cybersecurity components to it. Right. IT paired together cybersecurity requirements and funding with infrastructure investments and funding. And I think that as we go into a new lawmaking push here in the months ahead, I think that for lawmakers who are wanting to make their mark on the future of our infrastructure, I'd recommend that we think less about where to turn off funding for certain kinds of energy and more about how we compare cybersecurity and resilience investments as a eligibility requirement with all of that funding. So let's talk

a little bit about the AI data centers and the demand on electricity. And it is exponential growth. I mean it really is. How will. So I've long been told, a pessimist is an optimist with experience. I get the sense you're optimistic. I could be optimistic if we do this right. But how does this complement or complicate these dynamics? I mean, I think I know where you're going to come from, but I'd rather, rather than put words in your mouth, I'd rather hear you. I think it's

going to do both complement and complicate these dynamics in the compliment bucket here. This is an example of capital, you know, recapitalization that other infrastructure sectors are not benefiting from. Right. And being able to we're already seeing various jurisdictions say to some of these big load growth proposals say, hey, we'll welcome your data center to our utility region on the condition that you help modernize and pay for modernizing our grid infrastructure upfront. And so there's these conditions setting along the way and that's not historically unusual. And it can flow in both directions in the. And that it's actually got an

analogy with public safety, specifically in electricity and nuclear and the like. That's right. And

an Asset we have on our side here is that the hyperscalers, you know, the tech giants who are making these kinds of investments also have a couple decades of being experienced energy market participants in the early 2000s and the 2010s, during the first wave of cloud computing build out, they went out of their way to ensure that first wave of cloud infrastructure was primarily run on clean energy. They were willing to pay a green premium to get electricity that was primarily, primarily zero carbon because that was a value that they held and wanted to be able to say that Gmail ran on clean electricity. And I think today, now that, you know, clean electricity is cost competitive or cheaper, like that's not the thing we're worried about so much now. I'm wondering if these hyperscalers could similarly be willing to pay a security premium like they did with the clean the green premium in the 2010s. They're one of the few actors in. Our entire economy, like a leads a seal of some sort around

security as we've had for other things in the past. Yes. You know, and I would include nuclear in there too. Even though I do it is clean. It is not traditional clean tech. But I do think you're going to see infrastructure build out there, whether modular or not. I mean, all things said and done, you could include that in that basket, right? In terms of growth. Absolutely. And I do include them.

And I think particularly as we move towards small modular reactors, people seem to be converging toward these smr, small modular reactors being behind the meter. Right. Term of art of having generation on site with your, with your electricity demand. And so a lot of the data, AI, data center models are looking at ways they can reduce their stress on the grid by having smarts or natural gas turbines or solar fields and batteries on site with them to cut down on what they pull from the grid. But that's going to also have the useful dynamic of further distributed distribution of our electricity generation capability. And these, these combined, you know, load consumers and load producers are going to become assets for resilience in the, in this future grid where if there's an attack that brings down some portion of a grid somewhere, an AI data center with a, you know, small nuclear reactor or a field of batteries can become not just a electricity liability, but a contributor. And we even see that in the current

grid. We're still dependent upon other countries sometimes for key technologies in our grid and they're pretty expensive to keep just sitting around and not being utilized. Although we do have to have some of that technology in Case of a black star. But so I don't think these are either ors is what I'm really getting at. It's both.

Indeed. Yep. And let me ask, so not to throw a buzzword, but whether it's

secure by design or cyber informed engineering, CIS put a big push around secure by design. DOE put a push around cyber informed engineering. Conceptually, I'm a proponent of both. But how do we make this real? And how do we translate the public private partnership from nouns into verbs? How do we make that really real? Well, one of

the biggest assets of the electricity sector right now is the dynamism of all these new entrants entering the field. A lot of energy developer startups, new technologies that are really transforming this space and that is just a fantastic asset that we haven't been able to enjoy as much in many other sectors. That's also a source of risk because you have a lot of small new young shops that aren't used to thinking.

Security is not going to be their priority. Absolutely right. Whereas you have these more

established energy players who spent decades thinking about national security risk, who might be a little creaky right now when it comes to building their grids fast enough or advanced enough or incorporating new technologies, but know where that risk comes from and how to think about it. And we are making progress in adapting our regulatory and public private information sharing structures for that new reality where we have a combination of big established players and new dynamic entrants. But there's a lot more work to do there. You

know, we recently had Manny cancel on to talk a little bit about eisac. Are they going to be members, you think of that organization, or new entrants. Or so

it depends on, you know, which sector subsector we're talking about. I know in the case of the Electricity Subsector Coordinating Council, American Clean Power, which is sort of one of the premier clean energy industry associations, recently joined the sec, which was really important, a really important step forward, but also like significantly overdue, I think. Two, three, the last two or three years, 90% of all electricity added to the grid has been clean. And so the. That's in the U.S. or globally. Or in the U.S. it's 90% globally, it's 80, 86%. Okay. So it's like it's happening and it's transforming everything. And our institutions are lagging behind. And not to put too fine a point on

it, but without electricity, all our other critical infrastructures are in a place of hurt.

Exactly. The essential role of security and resilience are paramount. Absolutely. And that's why the ESCC and various other ISACs and Isaac I think can get ahead of this by thinking about how they operate, their convenings, their information sharing and intelligence analysis operations to make it so that it's easier for smaller institutions, startups to be able to contribute to it, to learn from it, figure out how we communicate with this more diffuse market ecosystem. And I would argue there is a CFIUS set of issues as well.

Committee for Foreign Investment in the US where gets to the broader supply chain issue where you do have some significant security vulnerabilities on the front end. I agree with

that. Yes. And I'd be curious along those lines. Top three policy actions we take

to flip it on the positive side of the ledger in terms of looking at the new at some of the energy transition issues. How do we make it a positive. What are the top three things? So first one is kind of a strategic

level approach where I think we need to put modern energy at the center of our competition with China. Whether it's there, isn't it sort of or we not recognize

that. I think that we need it to be at the level of semiconductors. And

I think there's a lot of things to be learned there. Right. Where we realized a few years later than would have been ideal that we should have a more flexible and diffuse supply chain for our semiconductors and much of the world. Agreed. And you've seen since we passed the Chips and Science Act a number of copycat bills, I use that term complimentarily with trusted allies and partners that we're now making them interoperable with. Right. With the idea that we're going to make a parallel democracies supply chain. And I think we need a similar level of investment in intellectual and policy capital on in energy. And it could be, dare I say, quicker. Right. I mean

we're not going to see the benefit of a lot of the semiconductor work for a few years. No, I agree with that. And there's been some, I think in

solar and batteries in particular, there's already been a lot of great progress made in onshoring. Yep, yep. And I think that making that interoperable with our particular Indo Pacific allies will push that forward. Quite so. One, make it a strategic competition US China.

Two. Right. Two is update these convening institutions to incorporate that more diffuse energy ecosystem

that we now experience. What does that mean? That means figuring out how to get information to all of these, to all of these clean energy entrants. How to make ICE Ax work for a more diffuse ecosystem than they. They do right now. That's right, yeah. Yes. And do you have a third one? The third one is more of a civil society one, but it is that we need to get the, you know, glowering national security hawks like myself and the affirmative vision granola crunching energy communities sitting down and talking to each other. Sandals meet wingtips. That's correct, yes. I remember when I was, when I was in government, you know, our cyber threat intelligence people would look up from the reports and be like, wait, we're plugging what into the grid now? And some of my energy policy friends would similarly look up and say, wait, China's hacking people now. And there's just a tremendous amount of common cause there and a like, surprising amount of national security advantages vis a vis competition with China that are being unrealized. And energy is going to be the whole game for these next few years, whether we're talking about the rules of the road for the future electricity ecosystem of the world or for the kind of sprint to artificial superintelligence. It's about electricity. And that's a race we clearly cannot afford to lose around AI and

a couple of other key technologies like quantum and the like. But I put AI and its application very much at the top of the list. Any lessons other critical infrastructure sectors can glean from the energy sector, and I'm thinking telcos, I'm thinking finance, financial services, or anyone. I think that we gestured at this at the beginning, but

the electricity sector has historically been one of the more advanced, capable ones. That's right. And that's been really great. But looking at how to integrate new entrants as a sector transforms is going to be a useful lesson for everyone. But in the other direction, I think I'm hopeful that the electricity sector can learn from the financial sector in how to think about systemic risk. You know, the financial sector has big players, it has small players, but they're uniquely attuned to thinking in terms of, of their shared systemic interests. Right. If Lehman Brothers goes down on Tuesday, I might go down on Wednesday. Absolutely, absolutely. And so I think that there's some bi directional lessons that could flow there. Awesome. And sort of to wrap a bow around this, what key

decisions in the next decade do you think will be important, or dare I say, even instrumental, to ensure that the A, we can successfully defend against the Communist Party of China's threat and B, that we can win this race that you're suggesting? I think, and that's a loaded and wide question But I'd be curious what, what you think we could be doing now. Sure. I think that on the, the energy and

resources side, I don't know that there's enough people in Washington thinking about the abundance possibilities behind modern energy technologies, whether you're talking about nuclear, solar, advanced geothermal. A lot of these technologies we're talking about generate electricity with almost no fuel. No, like, marginal costs along the way, which is a. That is something we're not. That is a framework we're not used to thinking in. Right. Like, if the Strait of Hormuz gets closed tomorrow, we'll have a gas, gas, gas crisis in days. Whereas if we lost all access to uranium pellets or solar panels, all of our nuclear plants and solar panels would keep working with no problem and keep creating electricity with almost no marginal cost. And that level of that is a strategically unique angle there for this kind of energy. And the possibility of lowering energy prices, as I know the President has said is one of his primary goals, unlocks so many other strategic competition advantages that I think we should be thinking seriously about, at least as seriously as we. Are

about artificial superintelligence and energy independence coupled with the two combined. Absolutely. That's, that's, that's spot on, Harry. What questions didn't I ask that I should have. We could have jumped in a million directions. Energy and the economy. No, I think, I think

we had a great conversation today. It's a very interesting issue set to be working on. And I know, you know, I, I came up as a, As a China hand, specifically first Chinese linguist, working on military and cyber competition. But I think a lot of folks, once they fluent Mandarin. I wouldn't say I'm fluent anymore, but I, at one point I was pret. Darn good. But I think a lot of folks find as soon as you start touching energy and electricity issues, it gets pretty hard to think about anything else. Yeah. Yeah. Harry, thank you for your service for all

these years. Carnegie Mellon's lucky to have you on their team, and I look forward to continuing to work with you. So thank you. I'd like that, too, very much.

Thanks for the opportunity here. Thank you for joining us for this episode of Cyber

Focus. If you liked what you heard, please consider subscribing your ratings and reviews. Help us reach more listeners. Drop us a line if you have any ideas in terms of topics, themes, or individuals you'd like for us to host. Until next time, stay safe, stay informed, and stay curious.