…and potential cyber security challenges Valentine Emesih April 4, 2013

Who is CenterPoint Energy? A domestic energy delivery company Natural gas sales and delivery Over 3.2 million residential, commercial and industrial customers in six states Competitive gas services (CES) Over 25,000 commercial, industrial and wholesale customers across central U.S. Electric transmission and distribution Over 2.2 million meters in the Houston area 17.2 GW peak demand Interstate natural gas pipelines Two pipelines in the mid-U.S., connecting to over 20 other pipelines Natural gas gathering and processing 150 separate systems in major producing fields in Arkansas, Louisiana, Oklahoma and Texas 2

The Texas electric market Restructured in 2002 for retail competition Retail Electric Providers (REPs) Power Generating Companies Unregulated Compete for customers Bill customers Issue disconnect , reconnect orders to TDUs Unregulated Transmission and Distribution Utilities (TDUs) Regulated Own and maintain power lines Deliver power to customers Read meters Restore power after outages Execute Service Orders Step-down Substation  In the Texas electric industry, retail competition began in January 2002, so residential and business consumers can now shop for electricity. Retail Electric Providers (REPs) (or Competitive Retailers - CRs) compete to sell electricity to homes and businesses. CenterPoint Energy does not sell electricity. With the 2002 restructuring, we shifted from generating, marketing and providing power for over 2.2 million customers to delivering electricity to those same consumers on behalf of the REPs/CRs. Commercial Customer Residential Customer 3

Smart Grid Conceptual Model - NIST “The National Institute of Standards and Technology (NIST) Smart Grid Conceptual Model provides a high-level framework for the smart grid that defines seven important domains: Bulk Generation, Transmission, Distribution, Customers, Operations, Markets and Service Providers. It shows all the communications and energy/electricity flows connecting each domain and how they are interrelated. Each individual domain is itself comprised of important smart grid elements that are connected to each other through two-way communications and energy/electricity paths. These connections are the basis of the future, intelligent and dynamic power electricity grid.” http://smartgrid.ieee.org/ieee-smart-grid/smart-grid-conceptual-model

Electricity Distribution “The Distribution domain distributes the electricity to and from the end customers in the smart grid. The distribution network connects the smart meters and all intelligent field devices, managing and controlling them through a two-way wireless or wireline communications network. It may also connect to energy storage facilities and alternative distributed energy resources at the distribution level.” Centerpoint Energy in 2012 completed deployment of Smartmeters. In 2014 we will complete installation of a field, and substation devices, as well as other back office systems to support Intelligent Grid. http://smartgrid.ieee.org/ieee-smart-grid/smart-grid-conceptual-model

Customer “The Customer domain of the smart grid is where the end-users of electricity (home, commercial/building and industrial) are connected to the electric distribution network through the smart meters. The smart meters control and manage the flow of electricity to and from the customers and provide energy information about energy usage and patterns. Each customer has a discrete domain comprised of electricity premise and two-way communications networks. A customer domain may also generate, store and manage the use of energy, as well as the connectivity with plug-in vehicles.” http://smartgrid.ieee.org/ieee-smart-grid/smart-grid-conceptual-model

Operations “The Operations domain manages and controls the electricity flow of all other domains in the smart grid. It uses a two-way communications network to connect to substations, customer premises networks and other intelligent field devices. It provides monitoring, reporting, controlling and supervision status and important process information and decisions. Business intelligence processes gather data from the customer and network, and provide intelligence to support the decision-making.”

Market The Markets domain operates and coordinates all the participants in electricity markets within the smart grid. It provides the market management, wholesaling, retailing and trading of energy services. The Markets domain interfaces with all other domains and makes sure they are coordinated in a competitive market environment. It also handles energy information clearinghouse operations and information exchange with third-party service providers. For example, roaming billing information for inter-utility plug-in-vehicles falls under this domain. http://smartgrid.ieee.org/ieee-smart-grid/smart-grid-conceptual-model

System of Systems Power and Energy Layer IT/Computer Layer At IEEE, the smart grid is seen as a large "System of Systems," where each NIST smart grid domain is expanded into three smart grid foundational layers: (i) the Power and Energy Layer, (ii) the Communication Layer and (iii) the IT/Computer Layer. Layers (ii) and (iii) are enabling infrastructure platforms of the Power and Energy Layer that makes the grid "smarter." Communication Layer

CenterPoint Energy’s smart grid Advanced Metering System 2.2 + million meters installed 219+ million meter reads / day 97% service orders electronic Consumers save $35 million in fees 4 million remote service orders 293,000 gallons of gas saved / yr 2,500 tons of CO2 prevented / yr Usage data - smartmetertexas.com 600,000 Texans get 15-minute usage data 15,000 In-Home Displays in TX Distribution Automation Field equipment Automated switching devices Line monitors Substation monitoring Implement Advanced Distribution Management System (ADMS) Leverage AMS investment Common telecommunications network for AMS and IG AMS meter data feeds outage analysis module of ADMS 4

CNP’s Advanced Metering System View construction at YouTube CNP’s Advanced Metering System View construction at YouTube.com/CenterPointEnergyVid Digital Communications Backhaul Data Collection Engine (Itron DCE 3.0 SP1) Meter Data Management System (eMeter MDM 6.2) Itron Open Way HW 2.0 SR 3.0 Legacy Systems Wireless Communications Environment (GE WiMax with GSM Backup) Existing Recently Deployed Legend Smart Meter Texas Portal Combined with back office computer systems and integration, our AMS provides: Daily register reads Daily 15 minute interval reads Remote connect / disconnect / on-demand reads Access to data via Smart Meter Texas portal 11

AMS Successes Meter Deployment is Complete Meters - Provisioned, accepted and approved – 2,283,012 Cell Relays - Installed in production – 5,434 Take Out Points - Installed in production – 140 (132 AMS, 8 IG) Service orders completed electronically – 4,073,075 96.9% of service orders successfully executed electronically Significantly reduced windshield time for readings and service orders Average electric service order completion time is 30 minutes Enabled extended working hours & shortened order execution times Smart Meter Texas Portal makes consumption data available to Retail Electric Providers (REP) Over 2 million customers in the CNP service territory Over 600,000 consumers get consumption data directly from SMT or indirectly, for example in an email from their REP 12

Consumer benefits of smart meters Available NOW Remote meter reading, on demand re-reads, fewer estimated reads Faster, cheaper automated move-in/out, switching Pre-paid service, time-of-use rates 15-minute usage data to promote energy conservation via www.SmartMeterTexas.com Energy analysis and cost comparison tools Easier integration of distributed generation and renewables Available SOON Automatic outage notification Available in the FUTURE Support for plug-in hybrid electric vehicles Consumer remote control of thermostats and appliances (HAN) Energy management systems 6

Some Components of our Intelligent Grid (IG) The Intelligent Grid consist of smart sensors, switching devices, transformer monitors and systems that will help detect, locate and isolate faults automatically. The devices and systems that make up the Intelligent Grid will eventually combine to produce a “self-restoring” electric distribution grid. CenterPoint’s Intelligent Grid strategy centers on an increased visibility into the electric distribution grid. Remote switching and monitoring devices are installed along distribution circuits and in substations, to provide insight into the real time behavior of the grid and it’s components. An Advanced Distribution Management System (ADMS) transforms the data collected from the monitoring devices into information that is utilized to control costs, improve reliability and performance, manage maintenance activities, realize operational efficiencies and enhance consumer value. Combined with back office computer systems, our IG technology, when fully deployed, will automatically identify the location of power outages, isolate faulted sections of the main feeder portion of the network and re-route power from other sources, essentially automatically restoring as much of the system as possible. 14

2010-2014 Deployment of the Intelligent Grid IG Infrastructure Automate up to 29 substations Smart Relays & Transformer Monitors 18 substations complete through 9/30/12, remainder by YE 2013 Install about 625 intelligent grid switching devices (IGSD) on about 230 distribution circuits Provide Remote/Automated Switching Capabilities Include Distribution Line Monitoring, Dual Communications Capabilities, Physical & Cyber Security Provisions, etc. 293 IGSDs installed through 9/30/12, 374 by YE 2012, Remainder in 2013 Implement an Advanced Distribution Management System (ADMS) Leverage AMS Communications Investment Common telecommunications backhaul network for AMS and IG AMS meter data feeds outage analysis module of ADMS While Phase 1 covers about 15 percent of CenterPoint Energy’s service area, some of the improvements will benefit consumers in the entire system. 15

Consumer Benefits of Intelligent Grid View demo at YouTube Consumer Benefits of Intelligent Grid View demo at YouTube.com/CenterPointEnergyVid Initial Benefits More precise identification of outage locations, resulting in faster restoration of electric service Reduction in time required to perform circuit switching to isolate fault Long-term Benefits Improved reliability and faster restoration, especially during major weather events Enhanced and improved customer communications and notifications Following Hurricane Ike in 2008, the Mayor’s Task Force concluded that a smart grid “offers the best return-on-investment for improving grid resilience and enabling storm recovery system-wide” and that “[f]inding the means to accelerate CenterPoint Energy’s deployment of intelligent grid technology in the Houston area is the Task Force’s strongest recommendation.” It has been estimated that full intelligent grid functionality could improve reliability by up to 30%. 16

Home Area Network (HAN) Enabled by AMS communications system Retail Apps Customer Self-Service Utility Apps Portal Water Heater Smart Thermostat RF (Radio Frequency) The meters will also establish a ZigBee wireless Home Area Network on the premise. This HAN will enable communications to various appliances / devices, such as Smart Thermostats. Zigbee Pool Pump Compressor 17 Energy Management and Conservation via a HAN for in home devices

Challenges First-of-a-kind deployment Performance at operational scale Knowledge transfer Subject matter expertise Volume of data Business transformation Process change activities Need to consistently engage employees Consumer education and myth-busting 13

Consumer / Data Privacy Statutes and rules state that meter data belongs to the customer Market rules also recognize various market participants’ need for meter data in order for the market to function Usage data, including historic data, is available to customer, TDU, and the retailer of record Data is available to other parties only with customer permission Personal information such as social security number is not in the system 15

Components of Cyber Security Strategy Prevention Reduce risks and vulnerabilities Intervene and stop attempted occurrences Mitigate effects Detection Identify anomalous behavior Detect malicious code and other events Gather digital evidence Response Address short-term direct effects of incident (public safety et al) Recovery Restore normal operation & Address issues

CenterPoint Energy’s Cyber Security Perspective Collaboration is Key: cyber threats are evolving and require collaboration, information sharing with the government and continued collaboration with the industry to effectively protect the nation’s critical infrastructure. Our goal is to focus our resources on facing the cyber threat. Our Cyber efforts parallel our corporate philosophy: Public Safety Energy Delivery Reliability Customer Service

Cyber Security Efforts We are entrenching a strong cyber security culture: Protection of customer privacy, and other essential information Cyber security is incorporated into our process, procedures, and operation through various mechanisms over time We have evolved from “perimeter defense” to “defense-in-depth” and maturing to an “agile defense” posture Established talents and tools to assist our current efforts Continuously educating our workforce – Be aware and be the first line of defense We recognize our efforts need to evolve to match ever-changing threats Enhancing system resiliency to cyber incidents Identifying and coordinating activities with the right stakeholders

Cyber Security Participant Observations Shared Goals Risk Based Approach Information Sharing and Situational Awareness Leveraging Tools and Techniques Security Clearance Cyber Security Regime Incident Management Collaboration

What’s Next? Smart Meters Are Just The Beginning 24 What’s Next? Smart Meters Are Just The Beginning HAN Devices Smart Appliances Smart Meter Texas Portal Intelligent Grid Phase 1: Customer Insight Smart Meters Storage Electric vehicles Phase 2: Engagement Micro Grids Aggregated Demand Management Phase 3: Co-Creator of Value 2010 2020 2014 2013 2012 2011 Price control / load control Advanced Grid 24

Conclusion “We take seriously the responsibility of protecting our customers, employees, assets, and communities in which we operate, and thus cyber security is a top priority for CenterPoint Energy. We also recognize the importance of critical infrastructure to our national security. Because cyber threats are constantly changing and evolving, we support voluntary programs that encourage partnership, collaboration, sharing of information and technology, and the preparedness necessary to mitigate and respond to the ever changing nature of cyber attacks.” … Gary W. Hays, VP & CIO Centerpoint Energy

DOE Acknowledgement and Disclaimer Per the DOE Grant Agreement,: “If you publish or otherwise make publicly available the results of the work conducted under the award, an acknowledgment of Federal Support and a disclaimer must appear in the publication of any material, whether copyrighted or not, based on or developed under this project, as follows:” Acknowledgment: “This material is based upon work supported by the Department of Energy under Award Number [DE-OE0000210]” Disclaimer: “This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Referenced herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinion of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.” 32

VALENTINE.EMESIH@CENTERPOINTENERGY.COM Youtube.com/CenterPointEnergyVid Twitter.com/energyinsights Facebook.com/CenterPointEnergy

Appendix

Lessons learned / keys to success Strong governance processes: Risk-, Change-, and Financial management Project planning/scheduling, metrics/benefits reporting Technical architecture, etc. Integrate and align project team, vendors and support functions Well defined standards and deployment plan Consumer engagement plan Early planning of transition from project to operations Strong industry collaboration EEI EPRI DOE SGIP Standards, security elements, installation plan 17

Smart meters are accurate and secure CenterPoint Energy takes the accuracy of its meters very seriously, which is why we have in place a rigorous testing and quality assurance process: Meter testing by the manufacturer at the plant and by CenterPoint Energy Comparison testing of smart meters vs. traditional meters Independent third-party accuracy tests Digital photos of removed meters to verify final readings Individual smart meter accuracy tests upon customer demand Independent meter software review Comprehensive cyber security program based on national standards Energy usage data belongs to the consumer: shared only when authorized in writing by the customer or authorized by regulatory authorities as necessary to conduct business (such as for billing). Most likely cause of high bills is increased usage (e.g. heating/cooling) CenterPoint Energy takes the accuracy of its meters very seriously, which is why we have in place a rigorous testing and quality assurance process. Itron, manufacturer of CenterPoint Energy’s OpenWay meter, tests 100% of all meters shipped to CenterPoint Energy plus has an extensive quality assurance process which sample tests meters after manufacturing. CenterPoint, which has validated Itron’s testing process in person, also randomly tests meters before they are installed, according to ANSI (American National Standards Institute) standards. Comparison testing of smart meters versus traditional meters shows that smart meters record electric usage more accurately than traditional electromechanical meters. In some cases, the old meter has been running too slow. If your bill rises after the installation of your meter it is not because of the meter but likely due to increased usage driven by cooling or heating as the next slide will show. We also agreed to independent testing, to help give consumers the same high level of trust in our meters as we have. Of thousands of CenterPoint Energy smart meters tested by Navigant Consulting at the request of the Public Utility Commission of Texas, none were found to be inaccurate by ANSI standards. We even take digital photos of the final reading on the old meter to make sure there are no errors in the transition. We will also perform accuracy tests of a smart meter to any customer who requests a test [if it’s found to be inaccurate, there is no charge]. Navigant also tested our meter software to ensure that customers’ usage data is accurately transmitted to the market. We understand the importance of security and privacy to consumers. Without compromising the security of our system, I can assure you we maintain a cyber security program based on national standards followed by leading companies in the energy, defense, and financial industries. By Texas law, energy usage data belongs to the consumer and can be shared only when authorized in writing by the consumer or authorized by regulatory authorities as necessary to conduct business (such as for billing). We will protect customer usage data as we always have. 14

Health and safety cell phone Exposure to RF emissions from digital meters is much less than: Televisions and remote controls Cellular telephones Bluetooth earpieces and USB Cordless telephones Laptop computers WiFi routers and base stations Wireless smoke detectors Microwave ovens Remote garage door openers Remote keyless automobile systems Motion detectors Hair dryers Wireless baby monitors smart meter 16

Successes and recognition Sharing our experience with the industry More than 730 tours of our Energy InSightsm technology center Take a virtual tour at YouTube.com/CenterPointEnergyVid. Articles, white papers, webinars, presentations, documentaries Intelligent Utility, Transmission & Distribution World, Energy Central … World Energy Council, the White House, GridWise, Distributech, PBS Collaborations Smart Grid Energy Training Coalition Itron OpenWay Executive Forum EEI Smart Grid Advisory Group Smart Grid Consumer Collaborative  U.S. Dept. of Energy – cyber security, green button 2011 survey of CNP customers shows 80% approval of smart meters “CenterPoint Energy is on the point of the spear in teaching the rest of the United States and the world how we can work with consumers to enhance their electrical usage …” U.S. Secretary of the Interior Ken Salazar 18

The future Integrated advanced transmission, distribution, and meter management and control system Advanced analytical applications which create new operations-, customer-, and market-based solutions Two-way, real-time customer engagement/communication system Business transformation initiatives that advance processes and create new business outcomes Aggregated demand response platform to enable virtual supply of generation 19

Some collaboration stakeholders “ First, we believe that participation with industry coalitions is critical. Our collaboration with fellow energy sector members allows us to continually learn and incorporate leading practices, provide mutual assistance and educate stakeholders and policy makers of real risks and possible solutions. Second, collaboration between the public and private sector is a vital part of cyber protection. Deployment of the SmartGrid in Houston presented us with the opportunity to work with DOE, DHS and other federal agencies in order to successfully deliver advanced metering capabilities. Other examples illustrating the success of public‐private partnerships are the joint industry and governmental initiatives that developed the electric sector cyber security Capability Maturity Model… .. And, finally, cyber security collaboration must take into account the entire life cycle and supply chain. Therefore, we must recognize the essential participation of our vendors and suppliers in this effort. They have worked with us to provide products and solutions to meet the demands of this challenge. Our joint goals and efforts focus on design, testing, and improvement of products to understand quality, integrity, risks, threats, mitigations and management of these solutions in our operating environment.” - Excerpt from Testimony before House Committee on Homeland Security, March 6, 2013 by Gary W. Hays (Division VP & Chief Information Office, Centerpoint Energy)