12 minute read
Barrels and Bytes: The Energy Transition, Digital Transformation, and Cybersecurity
from THL_JanFeb21
by QuantumSUR
baRRels anD bytes:
dress climate change and cyber attacks to ensure society is able to reap the benefits of the products and services the industry delivers in a sustainable way.
the intersection of climate change and cybersecurity Anyone who has attended an energy industry conference in recent years will have noted the increasing number of presentations on climate change and cybersecurity, albeit typically in separate CLE presentations. “Although the atmosphere and cyberspace are distinct arenas, they share similarities of overuse, difficulties of enforcement, and the associated challenges of collective inaction and free riders.”4 Apart from those commonalities, the two issues are linked because achieving cyber resilience is necessary for energy companies to effectively address climate change.
Addressing climate change will require substantial investments of capital from energy companies and other stakeholders. Digital technologies will underpin much of the global effort to combat climate change, and energy companies must have confidence that these technologies are reasonably secure before investing large sums of money to procure and deploy them. Without that confidence, companies will be slower to adopt or may even forego adopting the technologies altogether. As an example of the potential delays that uncertainty regarding new technology can cause, it is worth noting that the maritime industry, which, like the energy industry, plans for capital-intensive, long-term projects, has been slow to order new ships that can run on cleaner fuels because ship owners are not sure which technology will remain viable in 20 years.5 To avoid similar uncertainty about the digital technologies needed to combat climate change, the energy industry must work with its stakeholders toward resiliency against cyber attacks.
The Energy Transition, Digital Transformation, and Cybersecurity
“It is difficult to think of two issues with a greater potential to negatively impact both our natural environment and the global economy than climate change and cyber attacks.”1 In 2018, according to a study by the Pew Research Center, Americans viewed cyber attacks, terrorism, and climate change as the three most significant risks to the security of the United States.2 Although the same survey conducted in 2020 identified, among other things, the spread of infectious diseases as top of mind,3 cyberattacks and climate change likely will remain major concerns for Americans for years to come.
The energy industry, which includes a range of sub-industries, such as oil and gas, coal, renewables, nuclear power, and electric power, and which includes business activities that range from mining to transportation to nuclear fission, is essential to the global economy. If not already clear before the onset of the global pandemic, that fact is now obvious. As a critical infrastructure sector, energy industry participants must ad-
and the European Union came together to sign the Paris Agreement and committed to undertake efforts to combat climate change, in particular by reducing global greenhouse gas emissions.6 The goals set out in the Paris Agreement include an “energy transition,” which is a shift in the global energy mix used to power industry, provide light and heat to homes, and transport goods and people across the globe. As historian Daniel Yergin notes,
The term [energy transition] is widely embraced—possibly the two most used words in talking about the future of energy. It aims to limit temperature rises to less than two—or 1.5—degrees centigrade above pre-industrial levels, but beyond that there is no clear consensus...There is certainly no consensus as to the speed of the transition, nor as to what the transition will look like decades from now, nor as to the cost—nor as to how it is all to be achieved.7
Energy transitions are not new. Earlier energy transitions include the shift from wood to coal in Britain beginning in the 13th century, the shift from coal to oil as the dominant energy source in the 1960s,8 and most recently, a further shift from coal to natural gas. Yet, the current energy transition is notably different from those in the past because of the global agreement to work toward a specific goal of decarbonization and because it is being powered by digital technologies and data. “Most of the drivers behind the [current] energy transition can be distilled down into three main pillars; decarboni[z]ation, decentrali[z]ation and digitali[z]ation.”9 This energy transition likely will result in different energy mix outcomes in different countries, but it will be based on those common inputs.
Digital transformation as a Pillar of the energy transition Digitalization is a term en vogue at energy industry conferences. At its core, digitalization is about using electronic data to improve ways of working. As digital technologies continue to evolve ever more quickly, entirely new business models and processes become possible, which lead to complete digital transformation. “Digital transformation is the process of using digital technologies to create new—or modify existing—business processes, culture, and customer experiences.”10 In 2020, the trend of digital transformation accelerated dramatically, not only in energy, but in every sector as a result of the global pandemic that forced companies across the globe to rethink their ways of working and business models.
In the energy industry, a digital transformation is necessary to help meet the challenge of providing more energy for more people while reducing greenhouse gas emissions to address the threat of climate change. “Unlocking the magnitude of energy resources... in a way that does not choke the environment, cannot be done without the power of digital [technologies] to improve efficiency and man-
F S e
4500 YOAKUM BLVD. HOUSTON, TX
8,791 SF BLDG
4500 Yoakum is a unique opportunity to purchase an offi ce building just minutes from downtown. Located off Montrose Blvd. and Richmond Ave., the building has a luxury build out with large parking area and elevator. It is SBA fi nancing eligible and could be easily subdivided for multiple fi rms. Isn’t it time you stopped paying rent
and invested in your fi rm’s future?
age complexity.”11 To illustrate how new digital technologies will affect energy demand, it is worth noting that in 2019, the global mining of the cryptocurrency, Bitcoin, required more electricity consumption than that consumed by the entire country of Austria.12
Although digital technologies will consume more energy as they are adopted by more people, they are necessary tools to manage energy production, storage, transportation, and consumption. For example, as the use of cloud computing increased around 550 percent between 2010 and 2018, efficiency improvements—through the use of renewable energy and digital technology, like machine learning—have kept the energy usage of data centers relatively stable at around one percent of global electricity consumption over the same period.13
In another example of the blurring between energy and digital technology, Tesla, which many think of as an automobile company and some think of as a tech company, states on its website that the company “builds not only all-electric vehicles but also infinitely scalable clean energy generation and storage products.”14 Tesla utilizes digital technologies to create an ecosystem which allows customers to install Tesla solar panels to power their homes, to store energy in Tesla Powerwall battery units, and to use the energy to power their Tesla vehicles.
cybersecurity is a must for any Digital transformation No company in the energy industry, or any industry for that matter, can fully reap the benefits of digitalization or effect a digital transformation without addressing the threat of cybersecurity. “Digitali[z]ation brings new opportunities in energy design, manufacturing, distribution and maintenance [but] also presents new cyber security and data integration challenges.”15 This means the ability to harness the potential of the digital technologies needed to power the energy transition hinges on companies addressing the cyber security risks presented by those same technologies— “[w]ith great power there must also come—great responsibility.”16
Addressing cybersecurity as part of a digital transformation requires focusing on people and processes as much as purchasing new products. The frequency and volume of cyber attacks will continue to increase, but energy companies can work to become harder targets and to build their capability to respond to and recover from attacks. In other words, energy companies must build cyber resiliency: “the capacity... to prepare for disruptions, to recover from shocks and stresses, and to adapt and grow from a disruptive experience.”17 The focus of cyber resiliency is less about preventing cyber attacks and more about preventing bad outcomes.18
In the past couple of years, cyber attacks within the energy industry have targeted oil and gas companies,19 renewable energy companies,20 electric companies,22 pipeline companies,22 drilling rigs,23 and more. As a result, regulatory bodies are beginning to impose more requirements for cybersecurity safeguards. In the United States, this can mean an energy company must comply with a patchwork of requirements issued by various federal and state agencies. The regulatory complexity only multiplies for multinationals. Because of the rapidly increasing regulatory requirements and the encroachment of cybersecurity issues into so many areas of law, energy lawyers have a vital role to play in helping clients achieve cyber resilience.
the lawyer’s Role in the Future of Digitalization The exact roles lawyers will play in helping achieve cyber resiliency will vary based on the client’s particular business and the lawyer’s particular area of legal expertise. ABA Model Rule of Professional Conduct 1.1 requires lawyers to “provide competent representation to a client... [which] requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.”24 Comment 8 to that rule, introduced in 2012, notes the implicit inclusion of technology as part of competent representation, and 38 states include similar requirements in their rules of professional conduct.25
Lawyers must have an understanding of technology and cybersecurity to competently advise clients in a growing list of circumstances. Examples of occasions when lawyers should discuss cybersecurity with clients include: (1) at the start of representation; (2) when the client enters a regulated field of activity; (3) when cybersecurity regulations are issued, amended, or judicially reinterpreted; (4) when litigation, enforcement actions, or investigation is reasonably anticipated; (5) when the client experiences a cyber incident; (6) in the event of a cyber incident or if reports of an external cyber incident raise concerns; (7) when the client anticipates being the buyer or target in a merger or acquisition; (8) when the client anticipates providing goods or services that utilize or are new technologies, especially in a regulated sector; and (9) when a client embarks on a major transition in its corporate or commercial activities.26
With energy infrastructure (e.g., oil fields, pipelines, power plants) being increasingly outfitted with sensors to collect and process data, organizations using machine learning algorithms to process that data on cloud platforms, and software tracking and documenting product sales, there is no shortage of occasions when energy lawyers will be called upon to advise clients on cybersecurity. This is not some distant future, but the present. Energy lawyers must work to help secure the digital transformation that will drive the energy transition.
Michael Razeeq is in-house counsel for a global energy company where his practice focuses on cybersecurity and privacy law, digital product counseling, and technology transactions.
1. Scott J. Shackelford, On Climate Change and Cyber Attacks: Leveraging Polycentric Governance to Mitigate Global Collective Action Problems, 18 VAND. J. ENT. & TECH.
L., 653, 655 (2016). 2. Jacob Poushter & Christine Huang, Climate Change Still
Seen as the Top Global Threat, but Cyberattacks a Rising
Concern, PEW RSCH. CTR. (Feb. 10, 2019), https://www. pewresearch.org/global/2019/02/10/climate-changestill-seen-as-the-top-global-threat-but-cyberattacks-arising-concern/. 3. Jacob Poushter & Moira Fagan, Americans See Spread of Disease as Top International Threat, Along with Terrorism, Nuclear Weapons, Cyberattacks, PEW RSCH.
CTR. (Apr. 13, 2020), https://www.pewresearch.org/ global/2020/04/13/americans-see-spread-of-disease-astop-international-threat-along-with-terrorism-nuclearweapons-cyberattacks/. 4. Shackelford, supra note 1, at 653. 5. Elizabeth Low & Jack Wittels, Ship Orders Slump 50% with Owners Unsure Which Green Fuel to Use, BLOOM-
BERG (Jan. 10, 2021, 6:02 p.m.), https://www.bloomberg. com/news/articles/2021-01-08/ship-orders-slump50-with-owners-unsure-which-green-fuel-to-use. 6. The Paris Agreement, opened for signature Apr. 22, 2016,
TIAS No. 16-1104, https://unfccc.int/process-and-meetings/the-paris-agreement/the-paris-agreement (last visited Feb. 15, 2021). 7. DANIEL YERGIN, THE NEW MAP: ENERGY, CLI-
MATE, AND THE CLASH OF NATIONS 377–78 (Penguin Press 2020). 8. Id. at 378. 9. Technology—The Vehicle for the Energy Transition, GRID-
BEYOND, https://gridbeyond.com/technology-energytransition/ (last visited Feb. 15, 2021). 10. What is Digital Transformation, SALESFORCE, https:// www.salesforce.com/products/platform/what-is-digitaltransformation/ (last visited Feb. 15, 2021). 11. Adrian Booth et al., Digital Transformation in Energy:
Achieving Escape Velocity, MCKINSEY & CO. (Sept. 3, 2020), https://www.mckinsey.com/industries/oil-and-gas/ our-insights/digital-transformation-in-energy-achieving-escape-velocity#. 12. Bitcoin Energy Consumption Index, DIGICONOMIST, https://digiconomist.net/bitcoin-energy-consumption (last visited Feb. 15, 2021). 13. Urs Hölzle, Data Centers Are More Efficient than Ever,
GOOGLE (Feb. 27, 2020), https://blog.google/outreachinitiatives/sustainability/data-centers-energy-efficient. 14. About Tesla, TESLA, https://www.tesla.com/about (last
visited Feb. 15, 2021). 15. WORLD ENERGY COUNCIL, ENERGY TRANSITION
TOOLKIT 31 (2020), https://www.worldenergy.org/assets/ downloads/World-Energy-Council-Energy-Transition-
Toolkit-User-Guide.pdf. 16. See S. LEE & S. DITKO, AMAZING FANTASY NO. 15:
“SPIDER-MAN” 13 (1962). 17. RICHARD A. CLARKE & ROBERT K. KNAKE, THE
FIFTH DOMAIN: DEFENDING OUR COUNTRY, OUR
COMPANIES, AND OURSELVES IN THE AGE OF CY-
BER THREATS 42 (Penguin Books 2020). 18. Id. at 13. 19. Christian Vasquez, Oil and Gas Hackers Chase Bigger
Pandemic Paydays, E&E NEWS (May 12, 2020), https:// www.eenews.net/stories/1063112771. 20. William Turton, How to Survive a Ransomware Attack without Paying the Ransom, BLOOMBERG (July 22, 2020, 11:01 p.m.), https://www.bloomberg.com/news/features/ 2020-07-23/how-to-survive-ransomware-attack-without-paying-ransom. 21. Dan Goodin, Hackers Behind Dangerous Oil and Gas Intrusions Are Probing US Power Grids, ARS TECHNICA (June 15, 2019, 6:50 a.m.), https://arstechnica.com/informationtechnology/2019/06/hackers-behind-dangerous-oil-andgas-intrusions-are-probing-us-power-grids/. 22. Meenal Vamburkar et al., Cyberattack on Energy Transfer
Partners’ Data System Overcome, HOUS. CHRON., Jan. 2, 2019, 3:03 p.m., https://www.chron.com/business/energy/ article/Cyberattack-on-Energy-Transfer-Partners-data12801633.php. 23. Jeremy Wagstaff, All at Sea: Global Shipping Fleet Exposed to Hacking Threat, REUTERS (Apr. 23, 2014, 10:10 p.m.), https://www.reuters.com/article/us-cybersecurityshipping-idUSBREA3M20820140424. 24. MODEL RULES OF PRO. CONDUCT r. 4.1, (AM. BAR
ASS’N 2020), https://www.americanbar.org/groups/ professional_responsibility/publications/model_rules_ of_professional_conduct/model_rules_of_professional_ conduct_table_of_contents/ (last visited Feb. 15, 2021). 25. Robert Ambrogi, Tech Competence, LAWSITES BLOG, https://www.lawsitesblog.com/tech-competence (last visited Feb. 15, 2021). 26. See, e.g., Rolan L. Trope & Lixian Loong Hantover, Occasions When Counsel Should Consider Initiating a Conversation About Cybersecurity with the Client, in JILL D.
RHODES & ROBERT S. LITT, THE ABA CYBERSECU-
RITY HANDBOOK: A RESOURCE FOR ATTORNEYS,
LAW FIRMS, AND BUSINESS PROFESSIONALS, 145–83 (2d ed., 2018).
