Electricity is Prerequisite to the Sustainability of Everything

Energy, most notably electricity, is a universal input and prerequisite to the sustainability of everything else; it’s essential to all activity from economic production to government functioning. If you do find a company with minimal direct reliance on electricity, it likely relies heavily on another source (e.g., natural gas) which in turn relies on electricity for extraction, transportation, and distribution.

Potential Disruptions are Huge with Far-Reaching Impacts

The utilities sector’s diverse operations span three of the sixteen critical infrastructure sectors (CIS) identified by the U.S. Department of Homeland Security (DHS) in its National Infrastructure Protection Plan:⁵

1. Energy: Utilities and non-nuclear power generators are big components of the DHS-defined⁶ Energy sector
2. Nuclear: Reactors, Materials, and Waste includes twenty-two IOUs that own 77% of U.S. nuclear generation
3. Dams: The Dams sector includes hydroelectric generation and utilities own over half of the nation’s total

Moreover, utility operations affect every other CIS. Major cyber attacks could spark a chain of cascading power outages leading to interruptions in other forms of energy including gasoline; potable water; food production, distribution, and refrigeration; critical communications; health and emergency services; and government including national defense.

Note: While well-placed and timed cyber attacks could start a chain of outages, severe outages are rare in the U.S. and cascading outages are usually limited in geographical scope. Occasionally however, a small initial failure can propagate across power grids — sometimes even jumping non-contiguously — to cause widespread failures. It’s a low probability but high impact event.

Utilities are in the Crosshairs and Increasingly Vulnerable

Given the potential for outsized disruption, utilities are a prime target for a host of actors and agendas. Some groups⁷ below are greater threats than others. Notably, those most interested in wreaking the kind of havoc caused by an electricity system attack are also those most capable of pulling it off (nation states, well-organized terrorist groups).

• Cyber Warfare: State-sponsored cyber acts of war on other nation-states for political, strategic, or military purposes
• Cyber Terrorism: Politically- and/or ideologically-motivated attacks such as by terror networks or sub-national groups
• Cyber Crime: A wide range of profit-motivated attacks, from credit card fraud to corporate ransomeware and espionage
• Cyber Hacktivism: A blend of hacking and activism, these actors (e.g., Anonymous) hack for political or social causes
• Cyber Vandalism: Intentional or accidental, and à la the Mountain Dew-fueled teenager in a dark basement stereotype

Eager threat agents plus an expanding array of attack vectors equals vulnerability. The latter is due to growing reliance on technology and communications. Modernization of traditional utility infrastructure (“plants and wires”) puts more “cyber” in cyber-physical systems⁸ and investments in things like distributed generation, energy efficiency, and smart metering lead to a more IoT-centric industry. All of this creates more access points for the ill-inclined.

A Few Cybersecurity Leaders Aside, Utilities are Ill-Prepared

The DHS and Department of Energy (DOE) conducted a joint assessment⁹ of the utility sector’s cyber incident response capabilities and identified major shortcomings including situational awareness and impact assessment, intelligence gathering and sharing, understanding of roles and responsibilities, and shortages in cybersecurity expertise.

The DHS/DOE assessment is alarmingly accurate. To be fair, however, two things must be noted: 1) certain utilities truly “get” cybersecurity and deserve credit where it’s due, and 2) some blame for the sector’s ill-preparedness falls outside the utilities themselves. Regulation is especially relevant to the cybersecurity preparedness problem.

Utilities are regulated at different levels. For those subject to federal oversight, cybersecurity is overseen by the FERC which adopted the NERC CIP standards and has its act together. However, many utilities are state regulated. At this level cybersecurity standards are lacking or fragmented, and there’s debate re: how cybersecurity should be funded.

Cyber Incidents Targeting Electric Utilities are on the Rise

Cyber intrusions — sniffing, probing, phishing, and other precursors to more dramatic attacks — are on the rise. One recent event had real-world, physical consequences when seven natural gas pipelines fell victim to a cyber attack targeting their third-party electronic communications systems; resulting in service disruptions which had collateral effects on electric utilities. The following are just a few examples of notable activity over the last year:

• As recently as January 29, 2019 the Director of National Intelligence — the head of the U.S. Intelligence Community — issued a threat assessment report¹⁰ stating that China and Russia have the ability disrupt the U.S. electricity grid.
• Cybersecurity researchers reported that an advanced persistent Iranian hacking group had been targeting the industrial control systems (ICS) of electric utility companies in the U.S., Europe, East Asia, and the Middle East.
• The DHS revealed that a campaign by Russian hackers in 2017 had compromised the networks of multiple U.S. electric utilities putting the attackers in a position where they could have caused extensive electricity outages.
• Researchers announced that a hacking group tied to Russian intelligence services was conducting cyber reconnaissance on the business operations, ICS systems, and computer networks of several electric utilities in the U.S. and U.K.
• Energy Services Group, which provides communications and data services to utilities, was the target of a cyber attack that caused five major natural gas pipelines to shut down, in turn impacting electric utilities including Duke Energy.
• The FBI and DHS issued a joint technical alert warning of generalized Russian cyber attacks against critical infrastructure in the U.S. Topping the list of targets were the energy and utilities sectors, with specific mention of nuclear plants.
• The FBI and DHS issued a joint technical alert specifically warning of a “multi-stage intrusion campaign” by Russia-linked hackers targeting ICS/SCADA systems at U.S. energy companies and other critical infrastructure.
• The FBI and DHS announced that hackers have been targeting U.S. energy facilities including the Wolf Creek Nuclear Generating Station in a campaign bearing resemblance to the operations of a known Russian hacking group.

Location of Cybersecurity Disclosures by Form 10-K Section

Chart 1 below shows the location of cybersecurity text by year and section. Color indicates relative intra-year density of cybersecurity-related text — i.e., cybersecurity-related word count for the section as a percentage of total cybersecurity word count. Dark green indicates highest density, dark red indicates least, and gray means no cybersecurity wording.

Some cybersecurity text appears in an introductory section usually labeled “Forward-Looking Statements” pertaining to a “safe harbor” provided by the Securities Act of 1933 and its amendments. It protects a company’s use of prospective language as long as a disclaimer is provided. I excluded this text from my analysis since it’s always repeated verbatim elsewhere (same with Tables of Contents).

The majority of values underlying the chart are infinitesimal — i.e., cybersecurity wording in most sections is a tiny fraction of overall wording — that they’re unimportant for this chart beyond their relativity. For perspective, the median percentage is 0.7%. However, there are few noteworthy sections and observations:

• In 2017, Text related to cybersecurity disclosures appeared in fourteen of twenty-two sections (excluding introductions).
• A full 92.6% of cybersecurity wording appears in just three sections: Part I, Item 1A (Significant Risk Factors), Part I, Item 1 (Business Description), and Part II, Item 7 (Management D&A), listed in descending order of percentage.
• Part I, Item 1A (Significant Risk Factors) is the single largest section accounting for 72.2% of all cybersecurity text. This is a good thing; it’s a commonly-read section that appears early in the 10-K and is consistent with SEC guidance.
• Part I, Item 1 (Business Description) follows at 13.7%. Some companies detail cyber risk factors in this section, thus for this analysis Item 1 is tantamount to Item 1A. Together Item 1 and Item 1A account for 85.9% of all cybersecurity text.
• The third most cybersecurity-dense section is Part II, Item 7 (Management D&A), however it only contributed 6.8%. It’s closely related to footnotes in Part II, Item 8 (Financial Statements) so you could consider them together (10.3%).
• Part III, Item 10 (Corporate Governance) ranks 9th (a mere 0.4%). This is unfortunate because this is where investors — particularly SRI/ESG investors — are likely to look first for substantive discussion of cybersecurity preparedness.

Location of Cybersecurity Disclosures by Relative Position

The heat map is a good illustration of sector averages but it doesn’t fully convey the “location” story. Two things can dramatically affect the relative position of cybersecurity text within a document, and thus its conspicuity.

First, section lengths vary widely by company. A complex utility could take many pages of Item 1 (Business) to get to Item 1A (Risks); one row apart in the heat map but sometimes half a document away. Second, a few companies re-arrange sections so they don’t appear sequentially; data in early heat map rows could actually be late in the document.

A better representation of location and conspicuity is the relative position of cybersecurity text within filings, regardless of section and document length. Chart 2 plots the position of all words in each company’s 2017 10-K from start to end, with only cybersecurity-related text highlighted. For reference, heat map Items 1 and 1A are in Chart 2’s 10-25% range.

Most Frequent Keywords in Cybersecurity Disclosures

Word frequencies alone don’t tell us a lot, but they’re a good start for a section on semantics since they give us, in a glance, a “feel” for the overall subject matter before diving into more detailed analyses.

I won’t subject you to a word cloud, just Chart 3 below instead. It shows the 30 most frequent words in cybersecurity-related disclosure text, using a keyword extraction algorithm based on contiguity of words. The RAKE Score on the x-axis is a ratio of degree (how often it co-occurs with other keywords) to frequency.

One more chart on simple keyword frequencies, Chart 4 below, shows the most significant keyword changes from 2013 to 2017 (2017 compared to 2013, not each year in between). Being familiar with the underlying data I can tell you that the 2017 words as associated with slightly less generic cybersecurity wording than 2013’s. For example:

• The 58.9% spike in “cybersecurity” (including all of its variants) and 30.8% drop in “cyberattack” (and variants) reflects an overall shift to more proactive wording in 2017 from a more passive, risk-oriented stance in 2013.
• The increase in “awareness” and “situational” can be partially ascribed to specific uses of “situational awareness” in the context of the NIST Cybersecurity Framework and NERC Critical Infrastructure Protection (CIP) Plan.
• Words such as “electromagnetic” (as in “electromagnetic pulse attacks”) and “PayPal” are further examples of greater specificity, the former of a potential attack vector and the latter referring to a specific data breach (PG&E, 2017).

Thematic/Topical Content of Cybersecurity Disclosures

To better illustrate the kind of word relationships referred to above (e.g., “situational” and “awareness”) — and in turn better illustrate topical content — I made a word network graph (Chart 5 below). Also called a word similarity graph, it shows: 1) keyword relationships, and 2) topic categories. I know it’s busy; it’s a network of every single word, in every 2017 10-K. Don’t overthink it or try to discern every word and line, just get an overall feel for themes and relationships.

The chart is based on word co-occurrence (cosine similarity normalized co-occurrence to be exact), a measurement of which words/lemma appear in close proximity to each other, and do so frequently. High co-occurrence is indicated by word proximity (e.g., all those overlapping words) and the density of connecting lines. Topic categories are determined by statistical keyword clusters and are indicated by color.

Similarity of Disclosures Across Companies

Chart 6 shows a hierarchical clustering of cybersecurity-related text. Like many charts in this article, it’s intended to tell a high-level story at a glance. The key point is that there is perceptible dissimilarity (uniqueness) within the sector. That’s good. However, there are obvious clusters of high document similarity among companies that are themselves quite different. In other words, it’s highly-generic cybersecurity language that produces high cosine similarity metrics.

Diversity of Wording Within Disclosures

Whereas Chart 6 indicates levels of similarity/difference across companies, Chart 7 below shows lexical diversity within company’s filings. Higher lexical diversity equates to more varied wording, which implies greater level of detail.

Cybersecurity Disclosure and Sustainability/ESG Performance

To paraphrase my article Cybersecurity & ESG Investing, the current cybersecurity/ESG dialogue focuses heavily on Governance. This is a fair near-term prioritization since cyber risk management is a Governance issue and attack prevention is the first priority. Cybersecurity impacts all aspects of ESG, however, and utility cyber risks in particular can have major Environmental and Social consequences.

Cybersecurity disclosure and ESG scores are scaled to a relative 100-point scale. Disclosure scores are based on word density. ESG scores are the average of two data sources: 1) CSRHub and 2) Sustainalytics (as published on Yahoo Finance’s sustainability page). The number of data points exceeds the number of utilities because each utility’s E, S, and G score is plotted. Fifty utilities times three scores.

Chart 8 shows the relationship — or more accurately the lack thereof — between cybersecurity disclosure and ESG. If there were a material relationship the upper right quadrant would be the most populated. It’s the opposite; only 18.4% of scores fall into this corner. It’s worth noting that half of the upper right scores are Governance, i.e. there is some degree of relationship between good governance and cybersecurity disclosure.

Cybersecurity Disclosure and Roles in Grid Reliability

The second tenet is that utility cybersecurity is relevant to all investors, regardless of ownership, because electricity is a universal input. It’s the low-probability/high-impact scenarios — cascading and prolonged power outages — that are of universal concern. So I figured it’s worth looking at cybersecurity disclosure relative to roles in grid reliability.

Chart 9 includes some subsidiaries of the 50 utilities analyzed throughout this article and not all of those 50 appear in the chart. Entities plotted are those registered with NERC as bulk-power system users, owners, and operators responsible for specified reliability functions. The underlying measure of relative influence (e.g., megawatts, transmission lines) depends on function.

Chart 9 plots cybersecurity disclosure (the same y-axis measure as in Chart 8) and a measure of relative influence in grid reliability. Colors indicate functional role, defined below, in maintaining bulk-power system reliability. Several influential entities in important reliability roles perform well in cybersecurity disclosure but otherwise there doesn’t appear to much of a story, at least not at first glance. This another area ripe for further, future analysis.

• Balancing Authority: Integrates resource plans, maintains load-interchange-generation balance
• Generation Owner: Owns and maintains electricity generating plants that support system reliability
• Planning Authority: Coordinates electricity transmission systems, service plans, and protection systems
• Resource Planner: Develops long-term plans for resource/load adequacy within a Planning Authority area
• Transmission Owner: Owns and maintains electricity transmission assets that support system reliability
• Transmission Planner: Develops long-term plans for interconnected electricity transmission systems

Foreign Companies

U.S.-domiciled companies file a 10-K but foreign companies file different forms at the parent level. Specifically, the three Canadian companies mentioned above file a 40-F and National Grid files a 20-F. Although 40-F sections roughly mirror the structure of the 10-K, it’s not perfect and the 20-F is altogether different. Thus, for foreign owners I analyzed subsidiary-level 10-Ks. For example, for Fortis I analyzed the 10-Ks of ITC Holdings, Tucson Electric, and UNS Energy.

Berkshire Hathaway

I did the same for Berkshire Hathaway albeit for a different reason. Berkshire Hathaway Inc. (NYSE: BRK.A) files a parent-level 10-K but the holding company is just too fundamentally different from its utility investments to make any text analysis of its 10-K relevant and comparable for this article. Instead I analyzed individual 10-K filings for each of Berkshire Hathaway Energy’s holdings: MidAmerican Energy, Nevada Power, PacifiCorp, and Sierra Pacific Power.

Data Acquisition

EDGAR offers documents in HTML, plain text, and XML formats. Only the first two are relevant to text analysis and I used the HTML version since it has what I need without much extra. The plain-text version is a dump of every format, HTML included, into a single file. It has uses but not for this analysis; it’s redundant and unnecessarily taxing on resources.

The XML format is specific to XBRL instances of 10-K submissions. While XBRL — highly-structured financial and other quantitative data — is a godsend for traditional kinds of analysis but contains little text and is of limited use for NLP. As a side note, early adopters are using a new hybrid format called in-line XBRL (iXBRL) which combines HTML and XBRL into a single document.

The data acquisition process itself was largely automated with scripts I wrote to download filings and perform checks (e.g., file sizes) and inventories (companies and years). Some manual preparation went into creating a predetermined list of CIKs, the unique identifiers for SEC filers which are used to fetch documents from EDGAR.

In theory I could fully automate the process using SIC codes. Instead of manually curating CIKs I could use a script to collect those associated with each SIC code under the “utilities” umbrella. This could work for a multi-sector analysis but here I relied on my sector knowledge; a bit of informed manual intervention is good for analytical integrity since:

1. SIC codes aren’t perfect. Some company classifications are stale and would be different if re-classified based on current operations. Moreover the codes themselves (e.g., “Electric Services”) aren’t reflective of today’s differentiated sector.
2. CIK codes aren’t perfect. There’s nothing wrong with CIKs per se but rather how they’re used in special situations. For example a merger could, depending on timing, create a brief window where most recent filings are under old CIK codes.

Cleansing/Munging

It’s said data science is 80% cleansing, 20% analysis. This feels about right but it’s 80% well-spent because “garbage in, garbage out.” Believe me there’s a lot of garbage in 10-K filings, made worse by rampant inconsistencies in formatting. The first of two data preparation stages, this step entails: 1) cleansing messy text, and 2) parsing it into 10-K sections.

The messiness applies to the underlying markup and text analysis thereof. Otherwise, documents are fine and readable when viewed. Disorderly markup has many causes. Foremost, SEC rules apply to substance not style (as they should). Also, companies use different software to prepare filings. Some do it manually. Text is often copied/pasted from glossy annual reports, formatting characters and all.

Pre-Processing

Additional pre-analysis processing (hence “pre-processing”) is needed. Some is further cleansing but core tasks are more substantive transformations fundamental to NLP. The main steps I performed fall into three categories: 1) organizing documents for analysis, 2) distilling text to its essence, and 3) annotating text with linguistic information.

Classification

I’m finally emerging from that “80% preparation” into the “20% analysis” (although technically this step is a little of both). The goal here is simple binary classification — i.e., whether or not text is about cybersecurity. I assign boolean (true/false) indicators to paragraph- and sentence-level tokens, and later extrapolate up to sections.

In almost-plain English, my hybrid approach used semi-supervised machine learning algorithms to do the heavy lifting and a keyword-based technique for fine tuning re: sector-specific cybersecurity terms, acronyms, organizations, etc. It involved curating keywords/topics, training classification models, performing classification and tweaking results.