(Bloomberg) — An executive’s involvement in drafting White House-backed cybersecurity guidelines for energy companies that could potentially benefit his firm rankled competitors and prompted an effort by the Biden administration to remedy the potential conflict, according to documents and emails reviewed by Bloomberg News and interviews with four people involved in the process.
Soon after President Joe Biden took office, the White House began developing a plan to harden the cyber defenses of the electric grid. Robert M. Lee, chief executive officer of the cybersecurity firm Dragos Inc., was brought in for advice.
Lee helped prepare guidelines that could direct utility firms in choosing a cybersecurity product, a plan that was intended to strengthen their digital defenses and encourage the sharing of threat intelligence. But some of the wording he inserted resembled the language his company uses to market a product, documents show.
In an early 2021 email to other industry experts involved in crafting the action plan, Lee said he needed to show support for the plan “without appearing to have authored anything.” In a separate email to the group, he wrote, “We’re trying to say Keeper without saying Keeper,” referring to his company’s Neighborhood Keeper program, which finds potential threats and shares anonymized information about them with the government.
The others on the email chain didn’t appear to be potential beneficiaries of the guidelines.
By inserting descriptors of his company’s own product into the guidelines — such as “high-fidelity sensor-based” monitoring — Lee’s efforts prompted complaints from competitors who felt they were effectively excluded from a major federal initiative. Government ethics experts said it also creates the appearance of favoritism.
Closely held Dragos has a valuation of $1.7 billion, and its backers include Koch Disruptive Technologies, as well as funds and accounts managed by BlackRock.
In interviews, Lee defended his actions and said the wording he chose simply mirrored language used “for years” by the U.S. government. “I have done, in my opinion, nothing wrong,” he said. “I’ve worked for over a decade in government and in the private sector to try to make infrastructure more secure. And finally something got going that was a good effort.”
Lee said he edited the guidelines to be “solution agnostic,” and he said he made that clear to others involved in the process. Asked about the “trying to say Keeper without saying Keeper” email, Lee said he often uses the term “keeper” as short hand for products like his own that share data anonymously.
“My intent was not to see Neighborhood Keeper itself get pushed but that this type of capability and information sharing be considered and recommended,” he wrote in an email to Bloomberg.Lee said he was brought into the process by an independent contractor, whom he declined to name, but wanted to avoid being directly involved over perceptions that he stood to benefit. He said he wanted to encourage anonymous data sharing on cyber threats in order to protect critical systems. “I know the way it’s worded in my email is shady but you can believe me or not that was the intent,” he said in an email to Bloomberg, adding he stopped participating after White House lawyers were “concerned of optics.”After publication, Lee said he was brought in by the White House for general advice on industrial control systems that are used by a wide swath of critical infrastructure. He said the edits that he made were for a white paper by the independent contractor, not the White House, though some ended up in the White House-backed plan.
It’s not known how many utilities ultimately hired Dragos as a result of the initiative. Lee declined to elaborate, saying information about Dragos’s customers isn’t public.
Government ethics experts said that when business executives influence policy that could benefit them, it runs counter to transparency norms and potentially exposes US taxpayers to products or services that haven’t been scrutinized by an open process. “We need a level playing field when it comes to government policies and decisions, not cozy relationships,” said Scott Amey, the general counsel for the Project on Government Oversight.
Dragos’s involvement in helping shape the plan unfolded amid a series of devastating cyberattacks made public in late 2020 and during the first half of 2021, including a ransomware attack on Colonial Pipeline Co. that caused fuel shortages along the East Coast. The new administration vowed to make improving the nation’s digital defenses a priority, though it has been limited because much of the nation’s critical infrastructure is in private hands.
Emails reviewed by Bloomberg show that Lee exchanged messages about the plan with Anne Neuberger, the deputy national security adviser for cyber and emerging technology, in early 2021. Neuberger brought in Lee to help because of his expertise in the relatively small field of industrial control system cybersecurity and his company’s investigation of an attack on Ukraine’s electric grid, according to a person familiar with her thinking.
The guidelines, for instance, urged utilities to pick a cybersecurity product that provides “high-fidelity sensor-based continuous network cybersecurity monitoring” and anonymize data by using a “technologically irreversible” process. Dragos described its platform in nearly identical language, according to an archive of Dragos’s website dating from weeks earlier.
A document obtained by Bloomberg tracks where Lee himself inserted references to some of those descriptors, which he said can be found in other government documents. Bloomberg couldn’t immediately find similar phrases on the websites of several of Dragos’s competitors, which declined to comment or didn’t respond to messages seeking comment.
On April 20, 2021, the Biden administration publicly announced a 100-day plan to bolster cyber defenses of the electric grid, including helping utilities modernize their own cybersecurity. A few weeks later, the industry’s point person on the White House plan, Berkshire Hathaway Energy Chief Executive Officer Bill Fehrman, sent an email to energy companies endorsing Dragos’s product.
“As part of the initiative and after a significant assessment of 18 different technologies, we are recommending Dragos Neighborhood Keeper,” he said, according to a May 2021 email from Fehrman on behalf of an industry group he was part of. He wasn’t aware of Lee’s involvement, according to his spokesperson.
In June, the National Security Council sent the draft guidelines to energy executives and other government officials, emails show.
But news of the Dragos endorsement made its way to the White House, and Neuberger told Fehrman’s group, the Electricity Subsector Coordinating Council, that such a claim could limit competition, according to a senior administration official. The guidelines were reworked and expanded before being made public by the Department of Energy last August.
A National Security Council spokesperson said, “When we became aware of concerns early last summer about the criteria that were then in development, we worked closely with the Department of Energy to ensure that the final guidance reflected the input of all government agencies with expertise in this area and did not favor any particular company.”
The DOE, which is leading the initiative, declined to comment.
In response to inquiries about Fehrman’s letter endorsing Dragos, Berkshire Hathaway Energy spokesperson Jessi Strawn said the “only sensor technology that was open to all investor-owned utilities at the time was Dragos Neighborhood Keeper.” As a result of the White House-backed plan, Berkshire Hathaway Energy adopted the use of Dragos within its organization, she said.
Competitors complained to an industry group that the guideline’s wording tracked closely to Dragos’s product, according to two people involved. One company planning to hire a competitor hired Dragos instead, believing Fehrman’s recommendation amounted to a government endorsement, one of those people said.
Neighborhood Keeper is free but requires buying Dragos’s platform, which could cost a municipal utility about $15,000 to $45,000 a year, according to a company presentation from 2019. An update on the program last August said at least 150 electric utilities, serving almost 90 million electric customers, “have adopted or committed to adopting technologies” to bolster cyber defenses.
Experts say the government has several ways to limit private firms from being able to craft policy in their favor, including prohibiting the executive branch from endorsing a product unless it has followed a defined process.
“It’s important that the public be able to have confidence in procedures the government uses,” said Kathleen Clark, a legal ethics professor at Washington University in St. Louis, after learning of Lee’s involvement. “There is reason not to have confidence in this case.”
(updates with additional detail from Rob Lee in 13th paragraph)
More stories like this are available on bloomberg.com
©2022 Bloomberg L.P.
