Impact of the year 2000 (Y2K) computer problem on public utility service providers in Georgia : context, assessment, and recommendations / David Wirick, ... [et al.]

MEMORANDUM

Page 1 of 3

MEMORANDUM TO: Honorable Roy Barnes, Governor Honorable Mark Taylor, Lt. Governor Honorable Thomas B. Murphy, Speaker of the House Honorable Members of the General Assembly FROM: Stan Wise, Chairman DATE: January 21, 1999 RE: Impact of the Year 2000 (Y2K) Computer Problem on Public Utility Service Providers in Georgia

The issue of the Year 2000 computer problem is increasingly becoming a part of the consciousness of the nation. This problem has two essential components:
z The anticipated failure of mainframe and desktop computers and certain time sensitive embedded processors (chips) to accurately recognize dates beginning with January 1, 2000 and related problems. The impact of this loss of proper date recognition includes inaccurate computer operation and possible malfunction or shutdown of some computer controlled equipment. Utility services, unless proper action is taken by their providers, may be interrupted temporarily by this problem.
z An anxiety or fear-based reaction of people to what they may perceive the Year 2000 problem to be: a problem that may threaten them personally and they may believe is not being addressed effectively by federal, state and local government and by the business community.
The Public Service Commission has adopted a two part role with regard to Y2K to address both components of this problem: (1) facilitating and encouraging utility Y2K compliance and contingency planning and (2) providing information to the public concerning the Y2K readiness of utilities doing business in the state.
An essential component of both roles is the periodic collecting, analysis and presentation of utilities' Y2K readiness information. On November 3, 1998, for the second time, the Commission issued such a Request for Information (RFI) to utilities. The due date for responses was December 4, 1998. The overall response rate has exceeded 50% and responses continue to be received. The Commission requested the National Regulatory Research Institute (NRRI) at Ohio State University to perform an analysis of the information received in response to the above RFI. The NRRI report is attached. The Commission staff also reviewed each response and has prepared spreadsheet summaries of each, by utility service provider group. These summaries are also attached. Both of these documents will be placed on the Commission's web site and made available to the public.
The conclusions which are contained in the NRRI report include the following:
z Y2K requires policy makers to deal with uncertainty

http://www.psc.state.ga.us/utilitiesy2kweb/y2kletter%20to%20governor%201-99.html

2/25/2004

MEMORANDUM

Page 2 of 3

z Y2K is the first electronic crisis of an automated society z Y2K makes apparent the fragmentation of essential (utility) service delivery systems z Y2K is an issue that requires maintenance of public confidence z Y2K may require a re-evaluation of the role of government
The conclusions that the Commission wishes to share regarding the latest Request for Information responses are the following:
z Electric, telecommunications and natural gas (the Commission has no statutory role with regard to water/waste water) utility service providers are committed to solving this problem and are making significant efforts toward Y2K compliance/readiness. These efforts are requiring significant expenditures of financial and personnel resources.
z The strength (technical proficiency and financial health) of utilities doing business in Georgia is an important positive factor in this process.
z The Y2K readiness of utilities is improving and is generally expected to be achieved by utilities (who are reporting this information to the Commission) at various times in 1999.
However:
z Much work, including significant testing, remains to be done and January 1, 2000 is a fixed deadline.
z Vendor certification of the Y2K readiness of software and equipment may not be 100% reliable. z It will not be possible to perform fully integrated, real time testing of all software and equipment
to confirm Y2K readiness. This is especially true in the telecommunications industry. z The interdependent relationships between utility service providers (electric service providers
require reliable telecommunications, telecommunications and natural gas service providers require electricity, etc) complicates the Y2K readiness challenge. z Even though individual utility service providers may be fully Y2K ready, they may be adversely affected by the failure of other providers to be ready (electric outages spreading from one nonready state to an adjacent interconnected fully Y2K ready state).
Therefore, the Commission's general conclusions, at this time, are:
z While there is no certainty that Y2K will adversely affect utility services in Georgia there is also no assurance that temporary loss of utility services due to Y2K may not occur. If such interruptions do in fact occur they will be temporary in nature.
z The fact that Y2K utility service interruptions are even possible necessitates thoughtful and comprehensive contingency planning by utilities and all levels of state and local government. This planning is absolutely necessary to the public interest.
z A fear or anxiety reaction by Georgians to Y2K is inappropriate and unproductive. Y2K represents a challenge that must be met by planning, information, communication and appropriate action. Georgians and our institutions routinely respond effectively to temporary utility service interruptions caused by storms or floods. Y2K interruptions would provide similar challenges without the attendant damage and injuries caused by storms or flooding.
z Businesses should be advised that they might be exposed to as many as six sources of risk regarding Y2K. These are outlined in the attached NRRI report as well as in a source document available from the Commission.
The Y2K compliance/readiness of Georgia's utility service providers is a primary concern of the Commission and one that will involve the Commission's attention throughout 1999 and beyond. We are

http://www.psc.state.ga.us/utilitiesy2kweb/y2kletter%20to%20governor%201-99.html

2/25/2004

MEMORANDUM

Page 3 of 3

committed to working with you in any way possible to meet this important challenge.

http://www.psc.state.ga.us/utilitiesy2kweb/y2kletter%20to%20governor%201-99.html

2/25/2004

Page 1 of 50
THE IMPACT OF THE YEAR 2000 PROBLEM ON THE PUBLIC UTILITY SERVICE PROVIDERS
IN THE STATE OF GEORGIA: CONTEXT, ASSESSMENT, AND RECOMMENDATIONS
January 1999
National Regulatory Research Institute David Wirick
Debbie Daugherty Wendy Givler Tariq Majeed
Rosemary Wade
This report provides information and statements subject to protection under the Year 2000 Information and Readiness Disclosure Act of 1998. To the fullest permissible by law, the statements and information contained herein constitute "Year 2000 Readiness Disclosures" as defined by the Act. This report was prepared with funding provided by the Georgia Public Service Commission. It does not necessarily reflect the views or opinions of the National Regulatory Research Institute, the National Association of Regulatory Utility Commissioners, or its member states.
EXECUTIVE SUMMARY
Few issues have exploded onto the national consciousness as dramatically as the Year 2000 problem (Y2K). Part of the increasing concern with Y2K is related to the fact that the millennium is fast approaching. There are also other indicators that Y2K will be a serious problem. Those indicators include: the fact that the technical dimensions of Y2K have expanded; increasing cost estimates for Y2K mitigation and remediation; assessments that Y2K will affect the economy; the alleged slow progress of state governments in addressing Y2K; poor assessments of federal government efforts; the shift of Y2K efforts from complete resolution to risk mitigation and contingency planning; and increasing estimates of Y2K-related litigation expenses. As a result, though the full dimensions of Y2K are uncertain, and will remain uncertain for some time, it is apparent that Y2K is a public policy issue worthy of the full attention of policy makers.
Y2K was once regarded as a problem confined to old, mainframe systems. The mainframe problem is, indeed, considerable. But Y2K has also migrated to desktop computers and programs and, probably of most concern, to the embedded chips and systems that are omnipresent in an automated society. Though not all embedded chips will experience Y2K problems (estimates are that only one to four percent of embedded chips will be affected), finding and replacing the at-risk chips is a difficult and time-consuming process.
Businesses and government agencies face several levels of Y2K risk. At risk are mission

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 2 of 50
critical systems, networks and personal computers that manage day-to-day operations, data exchanges with third parties, equipment built around microprocessors, relations with business partners (the "supply chain"), and overall economic risks caused by the impact of Y2K on the economy. The result is that Y2K mitigation and remediation present an unprecedented project management problem. Unfortunately, systems projects of any magnitude are not noted for their timely completion.
Utility services are critical to the maintenance of state and national infrastructures, making them the biggest Y2K risk. Unfortunately, though substantial efforts have been mounted by most utilities, there are some indications that the utilities are not progressing fast enough in their Y2K mitigation and remediation efforts.
Utility services are delivered to the public through sophisticated and interconnected networks. Their susceptibility to Y2K problems is compounded by the facts that no single entity is responsible for utility service delivery from start to finish; utility service delivery, with some exceptions, represents the ultimate in just-in-time inventory; utility control systems that govern these vast, complex, and interconnected systems are largely automated; significant crosssectoral interdependence exists (e.g., electric utilities are dependent on communications systems and vice versa); and utility delivery systems are generally dependent on large numbers of outside suppliers.
The Georgia Public Service Commission (PSC) survey of utilities, which is analyzed in this report, has both collected information about Y2K readiness and sent a signal to the Georgia utilities about the importance the PSC places on Y2K preparation. Y2K information, though critical to public efforts to plan for and manage Y2K risks, is, however, difficult to interpret and apply. First, Y2K information can reduce, but not eliminate, uncertainty. Assessments of "percent complete" are, by their nature, subjective and can vary over time as more information about the extent of Y2K problems is known. Second, there are incentives for all organizations to overstate their readiness or to say as little as possible about their Y2K efforts, particularly if the information might become public. While inter-utility comparisons are difficult, assessments of progress within each utility over time can be useful, and the Georgia survey can provide a baseline for those evaluations.
Given the uncertainty of the data and the sensitivity of the information provided, public officials should carefully consider to what use the information should be put. The information might be used to help develop policies that might assist in Y2K mitigation and remediation, it might be used to determine the types of contingency plans to develop, and it might be used to help create information that can be provided to the public. Overall, the survey is an important first step in establishing an effective dialogue with service providers, a dialogue that is critical to the partnership between government and the private sector if Y2K is to be effectively resolved.
The Georgia PSC has been provided varying degrees of legal authority over utilities providing service in Georgia, authority which is greater for investor-owned utilities and less for municipal and membership corporations. The PSC has no authority over water/wastewater and cable television. The PSC has adopted a two part role with regard to Y2K: (1) facilitating and encouraging utility Y2K compliance and contingency planning and (2) providing information to the public concerning the readiness of the utilities doing business in the state. A failure of a utility to adequately address Y2K would call into question the level of technical competence of the utility and invite a review of the utility in this regard. The PSC has surveyed utility readiness twice, the first time in June of 1998 and the second in November of 1998.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 3 of 50
A total of 164 timely responses were filed in response to the second data request. Additional responses continue to be received by the PSC. The overall response rate now exceeds 52%. Analysis of these responses is provided in this report in the following categories: utility level of effort, percentage complete, estimated completion date, contingency planning, communication with consumers, utility concerns, and the role of the PSC. Where appropriate and possible quantitative analysis of the data was performed.
As might be expected, the percentage complete reported in the categories of inventorying, assessment, and planning exceeds the percent complete in testing and certifying changes. This is of some concern in that the last phase of work (testing and certifying changes) is likely to require substantially more work and resources than the other listed phases. Respondents were more likely to have begun advanced clock testing (56.8 percent of all respondents) for information technology systems than for embedded systems or network elements.
Respondents were also asked to identify the estimated completion date of all four phases of Y2K work. For each sector, a substantial number of projected completion dates fall late in the period. Whether the predominance of fairly late expected completion dates can or should be moved forward is a matter of debate. Given the difficulties often associated with major computer projects, those expected completion dates may be of concern.
The level of effort expended to deal with Y2K is far less important than success in mitigation and remediation. Given the uncertainty of data on progress, however, the level of effort may provide one useful indicator that successful mitigation and remediation are underway. It is apparent from the survey that substantial efforts have been mounted to battle Y2K, though the size of the response appears to largely depend on the size of the utility. Most companies report on their progress to company executives on a regular basis.
Contingency planning has always been a part of utility service delivery in that utility providers must always be prepared to respond to emergencies. This tradition may assist providers in their response to Y2K. Many respondents reported that contingency planning is in progress; estimated completion dates varied from 12/31/98 to the third quarter of 1999. One perceived weakness was the lack of coordinated disaster plans involving utilities and state and local governments. Some indicated that plans for natural disasters already in place would form the basis of a Y2K response. Responses also pointed out the facts that contingency planning is appropriately conducted in response to internal and external risk assessments and that contingency planning is an iterative, multi-step process.
Communication with customers about Y2K efforts seems to be a priority of some companies, and a variety of media have been employed to date. In some cases, utilities are actively sharing information with customers and vendors; others are only responding to inquiries at this time. It appears that larger companies have already begun to contact vendors and are using a wider range of communication tools than smaller companies. Few respondents indicated that they had communicated their contingency plans to the public.
In response to a specific question posed to telecommunications carriers and in other responses to the survey, the utilities cited a number of concerns. Chief among them were the inter-dependence of utility companies, the inability of any single utility to test the entire network, gathering Y2K compliance information from critical vendors and suppliers, the inability to conduct tests in "real time," negative news media, the large outlays of resources required, freeing human resources to complete surveys, legal liability, identifying specific technical

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 4 of 50
information in a timely manner, and identifying the Y2K status of peripheral equipment. These concerns reinforced statements made earlier in the report about the interdependence of the utility network and the extreme complexity of Y2K mitigation and remediation.
A number of respondents to the Georgia PSC survey did not identify an active role for the PSC. Others were complimentary about the PSC's role to date. Some suggested that the PSC make use of standardized reporting formats or use other public filings to keep itself current about utility Y2K efforts. Those who suggested an active role for the PSC cited cross-sectoral concerns (e.g., that communications providers are dependent on electric providers and vice versa). Some suggested that the PSC assume an active role in sharing industry specific information, and others suggested that the PSC provide information to the public about Y2K and utility efforts.
The most frequently cited national survey of utility readiness was conducted for the nation's electric utilities by the North American Electric Reliability Council (NERC) at the request of the U.S. Department of Energy. The first survey report was issued in September; a second was issued in January 1999. Additional reports will be provided through 1999. Overall, the first report cited the substantial work that has been accomplished to date by the electric utilities and noted that the impact of Y2K on electrical systems appears to be less than first anticipated. Nonetheless, it determined that there are some organizations who are late getting started, who have not shown sufficient progress, and who are projecting completion later than the recommended schedule. The aggregate effect, according to the first NERC report, is that "the center of gravity for the industry needs to be accelerated."
The second NERC report identified three general results from the fourth quarter of 1998. It reported that findings continue to indicate that Y2K is expected to have minimal impact on electric system operations, that the level of participation in the industry-coordinated Y2K readiness assessment program had increased dramatically, and that the electric industry is taking very serious steps to prepare for possible operating contingencies. The report also identified three critical issues: 1) meeting industry established date targets, 2) the limited ability to test external voice and data communications systems, and 3) the preparation of electric distribution systems for Y2K. The NERC report also identified the progress made by electric utilities since the issuance of the September report, and identified roles state governments and commissions.
The categories of providers used in the NERC report (e.g., non-nuclear generation) do not match the categories used in the PSC survey (e.g., embedded systems and type of provider). As a result, it is difficult to make comparisons between the NERC and PSC data. Both surveys show that the early phases of Y2K mitigation are well underway and that testing and remediation comprise the bulk of the remaining work. Though the time periods do not match, it appears that Georgia utilities have reported higher rates of completion in this last category than the national electric industry sample. At a minimum, therefore, there is no reason to conclude that the Georgia utilities reporting to the PSC survey lag behind national averages.
A planning tool called Scenario Planning can be used to help chart the course of Y2K. Arraying two key, unknown factors against one another--the impact of Y2K and the effectiveness of our response to it--four potential scenarios can be developed. They include the avoidance of a crisis, an effective response to a low-impact event, an ineffective response to a low-impact event, and a Y2K crisis. Milestones that might indicate the development of each of these scenarios are identified in Part 8 of this report.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 5 of 50
The Georgia PSC survey clearly indicated that much work is underway to mitigate the impact of Y2K on the Georgia utilities. It also, however, made it clear that much additional work needs to be undertaken, particularly with respect to the interdependence of utility service providers and the development of seamless contingency plans. There is clearly a role here for government in general and for the Georgia PSC in particular.
In addition, Y2K presents unique challenges to government and poses several issues that transcend the specifics of Y2K: Y2K requires that government policy makers deal with uncertainty, may be the first electronic crisis of an automated society, makes apparent the fragmentation of responsibility for the delivery of essential services, requires the maintenance of public confidence in an era in which government is suspect, and may require the reevaluation of government's role.
State government has a clear role in Y2K mitigation and remediation. Roles that Georgia state government might play include increasing Y2K awareness, assessing readiness, making policy to facilitate Y2K preparation, coordinating utility and government efforts, developing and coordinating the development of contingency plans, and providing information to the public.
The Georgia PSC has taken the lead in addressing the critical impact of Y2K on the Georgia utilities. The recommendations that follow assume that it will continue to exercise that leadership and assume functions as necessary to continue to protect the public interest:
1. Engage in an on-going dialogue with utility service providers. This mostly informal, one-to-one dialogue should include monthly conferences (perhaps by telephone) between the PSC and the major investor-owned utilities, the trade associations that represent service providers, and the municipal utility service providers and their associations. This on-going dialogue would supplement the use of periodic surveys as a means to assess Y2K preparedness.
2. Monitor utility Y2K testing and performance with regard to milestones established by national organizations (e.g., NERC) and with regard to the milestones established by the utilities themselves.
3. Continue to participate in national Y2K efforts, which includes interaction with the National Association of Regulatory Utility Commissioners (NARUC) Ad Hoc Task Force on Y2K. If the PSC continues to utilize surveys for information gathering, it should make use of standardized formats for gathering information where those formats are available and appropriate.
4. Encourage utilities to participate in industry-wide efforts to mitigate Y2K problems. 5. Make use of alternative dispute resolution (ADR) and consensus-building models.
These techniques hold more promise than traditional regulatory methods of establishing collaborative relationships with utilities that may lead to effective solutions. 6. Review the non-respondents to the PSC to determine whether problems may exist among those non-respondents. Those who did not respond to the survey may be representative of all utility providers. Their non-response might also be indicative of pockets of a lack of Y2K awareness. 7. Participate actively in the Governor's plan for state government action with respect to Y2K. The PSC should be designated as the lead agency for utility matters. 8. Ensure that contingency plans are developed by all utility service providers to cover all potential hazards and provide coordination for the interfaces between utilities and between utilities and government. Coordinated disaster plans have not been developed by many respondents. PSC, utility, and government efforts should focus on

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 6 of 50
reducing the probability of system disruptions and the impact of potential problems (i.e., probable contingencies and credible worst case scenarios). 9. Establish a cross-sectoral dialogue to facilitate the sharing of information between utility service providers and between utility sectors (i.e., between electric and communications utilities). 10. Provide a forum for the exchange of technical information between similar carriers. Possibilities are workshops, newsletters, or use of the PSC website. 11. Provide information to the public about Y2K through a combination of the preparation of Y2K informational materials and establishment of a Y2K dialogue with the print and electronic media. The PSC Consumer Affairs Section is a resource that can be used to assist in the accomplishment of this function. 12. Draw on the best efforts of those utilities with high-profile, thorough Y2K programs to assist those who may need assistance. "Partnering" or "mentoring" programs may be useful. 13. Ensure that the PSC itself is compliant and a model for other organizations. An ambitious role is proposed here for the PSC; in order to accomplish that role, it must be able to function and communicate with the various stakeholders who will require information.
In the final analysis, the PSC has decided that we cannot leave Y2K mitigation and remediation to the best efforts of individual companies and agencies and simply hope for the best. This survey and other efforts of the PSC are predicated on the belief that all participants are best served by banding together to create a seamless Y2K team dedicated to protecting the public interest. Given the potential seriousness of Y2K and the high degree of interdependence of citizens in modern society, that joint effort is our best hope of success in combating Y2K.
PART 1
INTRODUCTION
Few issues have exploded onto the national consciousness as dramatically and rapidly as the so-called Year 2000 Problem (hereafter referred to as Y2K). Little more than a year ago, Y2K was regarded as an interesting, though not threatening, artifact of the information age. Now, Y2K is a staple of the popular press, regarded as an information systems threat of unprecedented proportions, and accepted as a cause for concern by state, local, and national policy makers.
Y2K has, in part, intruded onto the public agenda because the fixed deadline for systems corrections is fast approaching. Of additional concern, however, is the growing body of information that suggests that our mitigation and remediation(1) of potential Y2K-related problems is lagging behind schedule and that Y2K is proving to be a more-intractable problem that we were first willing to admit even though many companies continue to state that they are confident about Y2K mitigation and remediation. For example:
z The magnitude of the Y2K problem continues to grow rather than shrink. Y2K has migrated from computer programs written on old, mainframe computers to desktop applications and further to embedded chips. (More will be said about the technological

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 7 of 50
implications of Y2K in Part 2 of this report.) One test determined that over 50 percent of factory process control equipment encountered date-related problems.(2) Estimates are that one to four percent of embedded microchips will have Y2K compliance problems.(3) First, though this number might appear to be small, finding those non-compliant chips is very difficult. For example, one combination electric and gas utility in the Midwest reports the existence of more than 170,000 suspect devices, those that might fail, in its system. Second, the high level of interconnectivity of a modern, automated society means that the impact of failed devices could ripple with devastating consequences. z Cost estimates for correcting Y2K problems continue to rise. In disclosure statements required by the Securities and Exchange Commission, companies are now reporting that they plan to spend about 26 percent more than they reported months ago.(4) The Gartner Group, a technology consulting firm, warns that Y2K costs will hit $1 trillion worldwide-$600 billion before 2000 and $400 billion after.(5) z Y2K is being regarded by some as a big enough problem to impact the national economy. A Deutsche Bank Securities, Inc., economist puts the chance of a recession in 2000 or 2001 at 70% because of Y2K-related disruptions in the flow of information.(6) The manager of Fidelity Investment's Magellan Fund states that he is "truly scared about the Year 2000."(7) z State governments are lagging behind in their preparation. A November 1998 Government Accounting Office survey found that many states are behind schedule in renovating their computer systems that support major health, welfare, and nutrition programs. As a result, federal and state officials have concluded that it is likely that payments will be delayed or services interrupted for some people who rely on those services.(8) z Federal agencies have also been criticized as being behind. A Subcommittee of the U.S. House of Representatives Government Reform and Oversight Committee gives federal agencies a "D" in their Y2K efforts to date.(9) z Y2K efforts are shifting from complete Y2K resolution toward risk mitigation and contingency planning--how to cope with system failures and the public reaction to them. Thirteen states have already announced that their Emergency Operations Centers will be open and fully staffed at the millennium change.(10) A Gartner Group Vice President also says that "by the end of 1999, 30% of externally focused mission critical systems, and 50% of all systems will fail to achieve full Year 2000 compliance. For the first time in its history, the Federal Reserve System has planned for a nationwide demand for extra cash at the millennium in the event that people begin to stockpile cash in fear of being unable to access their funds from banks or ATM machines. If Y2K-related cash demands persist, the Federal Reserve has announced its capability to put even more cash into the system by ordering extra shifts at its regional banks, printing larger denominations of currency, and slowing the retirement of worn currency.(11) z Some expect the cost of Y2K-related litigation to exceed the cost of mitigation and remediation. Class action suits have already been filed against software manufacturers who have required customers to pay for software upgrades to fix Y2K problems. Shareholder derivative suits are expected against corporate officers for failing to warn shareholders of Y2K dangers if share prices fall as a result of Y2K damage or litigation. Litigation will also likely be filed against vendors who fail to deliver goods and services on time as a result of Y2K problems.(12)
As a result of information and factors such as these, Y2K is no longer regarded by public policy

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 8 of 50
makers as solely a private-sector problem. Prudent public leaders and policy makers are raising awareness of the situation, assessing compliance efforts, putting their own systems in order, providing coordination of efforts, and beginning the process of Y2K contingency planning (which includes mitigation, operational planning, the anticipation of internal and external problems, and disaster recovery (13)).
Confounding public policy makers is the simple fact that the outcome of Y2K is unknown. Doomsayers are certain that Y2K will be devastating, and other observers maintain that the concern about Y2K is vastly overblown. In actuality, the full extent of the impact of Y2K cannot be known now and, unfortunately, will not be fully known until the millennium arrives. (See Part 8 of this report for a discussion of potential "milestones" that may help identify Y2K scenarios as they develop.) As one of the respondents to the Georgia survey said:
The Company views Year 2000 compliance as a process that is inherently dynamic and will change in response to changing circumstances. While the Company believes that through execution and satisfactory completion of its Year 2000 compliance strategy its computer systems, software applications, and electronics will be Year 2000 compliant, there can be no assurance until the Year 2000 occurs that all systems and all interfacing technology when running jointly will function adequately. Additionally, there can be no assurance that the assumptions made by the Company within its Year 2000 compliance strategy will prove to be correct, that the strategy will succeed or that the remedial actions being implemented will be able to be completed by the time necessary to avoid system or component failures. In addition, disruptions with respect to the computer systems of vendors or customers, which systems are outside the control of the Company, could impair the Company's ability to obtain necessary products or services to sell to its customers.
Though some might regard this statement as being largely driven by legal considerations, it is also descriptive of the level of uncertainty surrounding Y2K mitigation and remediation. In this highly uncertain environment, it is true that "the Year 2000 landscape is riddled with hyperbole, overused quotations, and misinformation."(14) It is nonetheless also true that procrastination has driven what might have been a manageable problem to near crisis proportions(15) and that the reality of Y2K lies somewhere between "disaster" and "everything is under control."(16) In that vast uncharted territory lies the need for state policy makers to take actions needed to avoid harm to citizens and the economy. The potential societal costs are simply too significant to do otherwise.
This report is designed to provide a full range of information for the public policy makers of the State of Georgia with a focus on the critical Y2K issues that affect the delivery of public utilities to the citizens of the state. It includes a description of the Y2K problem with a focus on the kinds of computer systems likely to be affected; an assessment of its impact on utility delivery systems; a discussion of the role and limits of information about Y2K progress; a description of the actions of the Georgia Public Service Commission (PSC); an examination of the results of the Georgia PSC survey of utilities; a description of the survey results obtained by national surveys of electric utility readiness conducted by the North American Electric Reliability Council; a discussion of potential Y2K scenarios with milestones for each; and some conclusions and recommendations. A copy of the Georgia PSC survey is included as Appendix 1.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 9 of 50

PART 2
THE TECHNICAL DIMENSIONS OF THE Y2K PROBLEM
As Y2K was making its transition from purely a problem to be left to the best efforts of individual businesses and public agencies to one that has clear public policy implications, it was making a technological migration as well. In fact, technical examination of the Y2K problem has become very much like pealing an onion, in which new dimensions of the problem are being constantly uncovered.(17)
Y2K was first regarded as a problem that infected old, "heavy metal" computer systems, those systems installed years ago with no expectation that they would survive to the millennium. The Y2K problems associated with these "legacy" systems, though they are only the tip of the Y2K iceberg, are significant. Nationwide Insurance has estimated that Y2K will affect 20,000 of its 35,000 mainframe applications.(18)
The total volume of computer code in use is part of the problem. There are estimated to be 1.7 billion function points (a metric measuring the relative size of a computer application in terms of what it accomplishes) within software applications in the United States.(19) The complexity of these systems also makes Y2K mitigation and remediation in the mainframe environment more difficult. By one estimate, about 30 percent of U.S. software applications contain at least two programming languages.(20) These mainframe systems may account for the greatest volume of computer code, but given the tools and consulting support, they may be the simplest to correct.(21)
Were the mainframe Y2K problem not enough to occupy our attention, Y2K has extended itself to the ubiquitous desktop systems that most businesses and many individuals rely on. Part of the microcomputer Y2K problem stems from the fact that for microcomputers, unlike mainframe computer applications, users have no access to the source code--the programs themselves.(22) Many potential Y2K errors in microcomputers are embedded in off-the-shelf software, and, according to one study of 1000 commonly used microcomputer programs, 25 to 30 percent have "issues and concerns relating to dates."(23) To compound the problem, 47 percent of those programs identified as having Y2K issues had been described as Y2K "compliant" by their manufacturers.(24) To be fair, not all microcomputer program Y2K errors will cause system failures of any magnitude. Nonetheless, with an estimated 100 million microcomputers in use in the United States,(25) Y2K microcomputer problems represent another significant problem to be resolved.
The third, and most serious element, of the Y2K problem is embedded systems. An embedded system:
...is any system or device that contains a microprocessor or microcontroller to perform a dedicated service or function. A typical, simple embedded system consists of a singleboard microcomputer with software in Read-Only-Memory (ROM), which starts running a special purpose application program as soon as it is turned on and will not stop until it is turned off. A typical complex embedded system consists of multiple, simple embedded

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 10 of 50
systems functioning together to perform a substantial sum of the requirements of a larger system.(26)
These embedded systems have become omnipresent in our automated society, allowing such innocuous technologies as automated greeting cards, but have also become key components of extremely complex systems vital to society. They include such systems as elevators, fax machines, factory controllers, traffic lights, VCRs, the proper functioning of aircraft, power generation systems, and water and sewer systems.(27) Of particular concern are those embedded systems that contain a timing function. Traffic lights provide a good example of the date-sensitivity of some, but not all, electronic systems. Traffic lights do not require datesensitive embedded chips to manage the transition from red to yellow to green or even to manage weekday-weekend timing. (The days of the week fall into a consistent pattern independent of the date.) But when traffic lights need to function differently on holidays, a datesensitive chip is required.
"Embedded" means that these chips and systems are essentially locked within inaccessible "black boxes."(28) Embedded chips are typically concealed, difficult to identify, and hard to understand without extensive analysis.(29) A single circuit-board can contain 20-50 embedded chips from various manufacturers.(30) Because the instructions that govern the embedded chip were placed on it at the time of its manufacturing, it tends to perform its functions without notice--until it fails. As was noted earlier, it is estimated that one to four percent of embedded microchips have Y2K problems. Embedded systems could pass errant data into applications, databases, or networks.(31) Given the huge numbers of embedded microchips in service, the embedded chip element of Y2K may be the most serious.
Given this "three-legged stool" of Y2K risk, businesses and government agencies face considerable Y2K exposure. According to a model created by staff at the Federal Deposit Insurance Company (FDIC) business risk can be envisioned as being comprised of six interrelated levels as illustrated in Figure 2.1.(32) At the center of the risk matrix are those computer systems that are critical to the firm's operations--those portions defined as "mission critical." (For public utilities, some of these mission critical systems are dependent on equipment, which in the FDIC model is not impacted until the fourth level.) At the second level are those networks and personal computers that manage day-to-day operations. The third level encompasses data exchanges with third parties. The fourth represents equipment built around microprocessors that operate with internal clocks, which includes systems like telephone systems, security systems, and elevators. The fifth is composed of relations with business partners--what is called by some the "supply chain." And the sixth level of risk is represented by the macroeconomy, which may be adversely affected by the economic disruptions caused by business failures and uncertainties. Of course, the intersections between these levels represent challenges in themselves.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 11 of 50

The net effect of this model of concentric risk is that firms and public agencies must consider not only in-house computer systems but their interrelationships with others in order to successfully mitigate Y2K risk. These complex interrelationships, especially when compounded with the several types of computer problems described above, mean that Y2K creates unprecedented project management problems for those involved in its mitigation and remediation. Even though "fixes" are available for most, if not all, specific Y2K problems, finding, testing, and mitigating those problems can be daunting. It can, therefore, be said that at one level Y2K is not a computer problem. It is a project management problem.
Unfortunately, the outcome of major computer projects is often disappointing, boding poorly for this project of unique proportions. For example:
z 90 percent of major computer systems projects are delivered late, are delivered with less functionality than originally intended, or never delivered at all.(33)
z Most organizations consistently underestimate the time and cost of software development projects.(34)
z When companies try to fix software, they introduce bugs, some 15 percent of which are not detected before the software's introduction. Seven percent of software corrections are faulty.(35)
PART 3
THE IMPACT OF Y2K ON UTILITY DELIVERY SYSTEMS

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 12 of 50
No systems are more critical to the maintenance of the state and national infrastructures than the systems that delivery public utilities to consumers. Without electricity, gas, telecommunications, and water,(36) the efforts of public agencies and private companies to mitigate other potential Y2K problems will be of no use. According to U. S. Senator Robert Bennett of Utah, utility service is the biggest Y2K risk to the nation.(37) Whether or not the public utilities are ahead or behind the remainder of society in their efforts to mitigate Y2K problems remains to be seen; the simple fact remains that they are more important to the wellbeing of the citizenry than almost any other services. Some of the reports of utility Y2K readiness have not been encouraging. For example:
z In testimony before the United States Senate in June of 1998, Senator Bennett stated that only 20% of the largest electric, oil, and gas utility firms in the U.S. had completed an assessment of their systems. At the same Senate hearing, Senator Christopher Dodd stated that, "We're no longer at the point of asking whether or not there will be any power disruptions, but are now forced to ask how severe the disruptions are going to be."(38)
z A September 1998 report prepared for the United States Department of Energy by the North American Electric Reliability Council recommended that the electric industry as a whole accelerate its current pace of work.(39) (That report will be discussed in greater detail in Part 7 of this report.)
z One big Midwestern utility is advising some customers to buy their own power generators if they want to be sure the lights stay on at the millennium. Alliant Energy is doing widespread debugging of its systems, but admits there may still be some power outages.
(40)
Public utilities (electricity, natural gas, telecommunications, and water) are delivered to the public through sophisticated, often-interrelated systems. Figures 3.1, 3.2, and 3.3 respectively illustrate the electricity, gas, and telecommunications delivery systems. Y2K mitigation remediation are particularly difficult in these utility systems due to the following factors:
z No single entity is responsible for utility service delivery from start to finish. As the figures indicate, a variety of players have a role in utility service delivery. Some of that distributed responsibility is an artifact of recent utility industry restructuring. In addition, the electric systems of North America are tightly connected into three major electrical interconnections to create a single large interconnected system.(41) The high level of interdependence within an interconnection means that the overall system may only be as strong as its weakest link.(42) To compound the problem, utility delivery systems depend on one another during critical periods.(43) As a result, the Y2K efforts of each of the components of the service delivery system must be coordinated to ensure service delivery.
Figure 3.1 The Electric System

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 13 of 50

Source: Office of Technology Assessment, U.S. Congress, Biological Effects of Power Frequency Electric and Magnetic Fields Background Paper (Washington D.C.: U.S. Government Printing Office, May 1989).
Figure 3-2 The Gas System

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 14 of 50

Source: National Petroleum Council, Petroleum Storage & Transportation, Vol. 1 (Washington, D.C.: National Petroleum Council, 1990), 9.
Figure 3.3 Public Switched Network

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 15 of 50

z Utility service delivery, with some exceptions, represent the ultimate in just-in-time inventory systems. Utility service cannot be stockpiled and must be available the moment someone turns on a light or picks up the telephone. As a result, the complexity of service delivery is significantly compounded.(44)
z The control systems that govern these vast, complex, and interconnected systems are largely automated. Embedded chips and automated control systems abound.
z Significant cross-sectoral interdependence exists. Electric delivery systems depend on communications, including microwave, telephone, VHF radio, and satellite communications.(45) No communications or gas utility can function long term without heat (or cooling) and electric power. This cross-sectoral vulnerability is of great concern to utility managers.
z Utility delivery systems are also dependent on large numbers of outside suppliers. Alliant Energy, a combination gas and electric utility, for example, has 6000 vendors and suppliers.(46)
Table 3.1 details some of the specific utility delivery systems that might be impacted by embedded chip failures.
Table 3.1

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 16 of 50

Possible Impact of Public Utility Embedded Systems

Communications

Explanation

Telephone switches, PBXs, and communications exchange

Older switching equipment could be noncompliant and may require replacement. Potential exposure includes synchronization, date/time stamping, self-checks, and event logging

Cable systems

Potential exposure includes signal processing, synchronization, and communications protocol issues.

Satellites - Global Positioning System

Currently set to roll over and encounter date problems in late 1999. Potential exposure includes synchronization, event logging, date/time stamping, error checking, system interface formats, and communications protocol management.

Data switching equipment

Heavy focus on protocol management, logic routing, error checking, peer-to-peer communications.

Voice mail

Date and time login errors could result in a system that deletes messages based on date problems.

Internal telephone systems

In-house telephone system failures could shut down internal billing. A PBX could stop operating if it encounters an "invalid" date.

Mobile telephones

Exposure includes protocol management, communications management, signal processing, signal protection, function logic, date/time clocks, and system interfaces.

Energy Fossil fuel plants
Power stations and power grids

Possible Impact of Public Utility Embedded Systems
Explanation
Exposures include power management, date/time stamping, event login, interface management, controls, data acquisition, performance monitoring, and alarm systems. Tests have demonstrated that resetting a date to post1999 can, in some cases, cause the system to reset itself to 1980. Discrepancies between control units could cause a plant trip.
Embedded systems in these facilities contain numerous computer chips not all of which are compliant. Embedded logic control is in every facet of operation, from load dispatch and remote switchyard breaker control to nuclear power plant safety systems. Entire operational environment should

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 17 of 50

be checked for compliance.

Oil pipelines, refineries, storage facilities

Exposures include flow monitoring and control, alarms, sensor analysis, date/time stamping, and system interfaces. Valve control units (buried underground) contain flow control chips that should be analyzed. According to engineers at certain North Sea oil companies, an offshore oil platform contains over 10,000 microprocessors, some of which are deep below sea level. Engineers claim that all of these systems must be reviewed.

Gas and related metering devices

Some hand-held metering devices utilize two-digit year fields. This becomes a problem when information is downloaded into databases for processing.

Surveying and Exposures include date/time stamping, event logging, signal processing,

location

and system interfaces.

equipment

Water Water distribution
Water and sewage systems

Possible Impact of Public Utility Embedded Systems
Explanation
SCADA (Supervisory Control And Data Acquisition) systems run in real-time and nonreal-time mode. Systems must accommodate different flow and distribution situations. Pressure control functions dictate changes automatically or set off alarms. Data acquisition functions support data downloading and trend analysis to support capacity planning. Problems could arise well beyond 2000 due to errors in trend analysis. Sensor, logging, maintenance, meter monitoring, control, and distribution functions should all be reviewed.
Some metering devices utilize two-digit year fields and are not currently compliant. Other exposures include date/time stamping, controls, alarms, interfaces, and maintenance tracking.

Source: Adapted from Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: The Continuing Challenge (Upper Saddle River, NJ:Prentice Hall, 1998), p. 154-156. Some uncertainty about impacts remains because research into system categories is lacking or privately held.

PART 4
THE COLLECTION AND USE OF Y2K INFORMATION
In an environment of extreme uncertainty such as the one which presents itself to policy makers with regard to Y2K, it is natural and appropriate to attempt to collect information with which to mitigate that uncertainty. The Georgia PSC survey of utilities that will be discussed in detail in Part 6 of this report has collected valuable information and is the first step towards making the Georgia Y2K situation clearer. In addition, by distributing its questionnaire and

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 18 of 50
requiring utilities to respond to it the Georgia PSC sent clear signals to the Georgia utilities about the importance it places on Y2K mitigation and remediation. In short, the survey served to increase utility awareness of Y2K. But as we move beyond the awareness phase of Y2K and begin to operate on the assumption that all utilities are aware of the potential devastating consequences of Y2K, tougher challenges arise. Before we begin the consideration of the information collected, a discussion about the nature of Y2K information is appropriate. In short, it will be very difficult to glean useful information that policy makers can use as the basis of decisions from Y2K data.
First, the information collected by the Georgia PSC, and indeed by any entity attempting to assess the Y2K situation, should be regarded as being less than 100 percent certain. Because of the uncertainty surrounding Y2K, one Y2K testing expert has begun to refer to the "Y2K lottery," in which some who do a lot may still experience problems and others who have not done enough will get by.(47)
Because of the varieties of systems impacted by Y2K and the complex interrelationships that characterize modern utility delivery systems, the full extent of the Y2K problem is constantly evolving. As was indicated earlier, it is like peeling back the layers of an onion. At some junctures, it may appear that the problem is manageable, only to have it become more complex and intractable as more information is uncovered. As adeptly stated by one of the companies responding to the Georgia PSC survey:
The information provided in this Response represents the Company's best efforts to respond to your inquiries in a timely fashion and the information is to the best of the Company's present knowledge. Subsequent information and anomalies in current data may require that this information be amended or revised. (Emphasis added.)
Any question that requires an assessment of "percent complete" (a very useful piece of information) requires a subjective answer, one based on the best judgement of the respondent at that time. In a changing environment, that judgement could vary from month to month. In addition, some utilities may differ in their definition of "compliant," some rejecting full compliance on the grounds that it may not be an appropriate business objective. (Who would care, one could argue, if the fax machine continues to function but prints the wrong date in its header.)
In addition to the inherent uncertainty of Y2K data, the information provided by utilities is extremely sensitive. Though all Georgia utilities might report fully and honestly, there are incentives for all organizations to overstate their readiness or to say as little as possible about Y2K mitigation and remediation if the information has any chance of becoming public. No company wants to provide incentives for greater government scrutiny and, more importantly, few businesses want the investment community to trade its securities on the basis of Y2K readiness. The costs of failing to mitigate Y2K damages, which could include loss of revenue and litigation for damages, could be extremely high. If the securities market were to begin to trade on Y2K readiness, a public report that indicated that Y2K efforts lag behind other comparable organizations could be financially damaging.
To protect investors, the Securities and Exchange Commission (SEC) is requiring Y2K information from those companies that are required to file with the SEC. The SEC has determined that disclosure of Y2K status must be made because the likely impact on companies of Y2K is likely to be material (that is, it is likely to be relatively important and

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 19 of 50
significant in dollar amount). The SEC is requiring that companies report Y2K information in the Management's Discussion and Analysis of Financial Condition and Results of Operation portion of their SEC reports. Companies are required to report their state of readiness, their estimated costs, the risk including the most reasonably likely "worst case" scenario, and the company's contingency plans. The Georgia PSC required that the SEC statements be included as part of the survey response. These statements, though only filed by the largest utilities, are one source of information on company plans and strategies.
Given the uncertainty of the data and the importance and sensitivity of the information provided, public officials should carefully consider to what use the information collected is to be put. Collecting information about Y2K plans and progress can reduce the uncertainty inherent in the issue. It cannot, however, for the reasons listed earlier completely eliminate that uncertainty. Simply demanding more and more information will not by itself solve the problem. Nonetheless, Y2K information from utility providers can assist policy makers in three critical areas.
First, the information assembled, even though it must be regarded somewhat suspiciously, can help policy makers identify types of policies that might help the utilities be successful in their Y2K efforts. For example, it was determined some months ago that the exchange of Y2K information between organizations was being hampered by concerns that lawsuits might be filed if inaccurate information were exchanged. Two legal concerns arose: (1) the possibility that the manufacturer might sue for libel if an incorrect allegation were made regarding faulty software or hardware and (2) that those who relied on advice provided might sue if they adopted a solution unsuccessfully. As a result, federal legislation has been passed (the socalled "Good Samaritan" legislation) that protects those who, in good faith, share Y2K information. There are likely to be other areas in which changes in state policy might help the utilities grapple with Y2K. Examples might be temporary abeyance of environmental requirements or careful consideration of merger activity or industry restructuring so that utilities can focus their energies on protection of mission critical systems. The information provided by the utilities as well as their concerns expressed in the survey and elsewhere should be evaluated to identify these possible and appropriate changes in policy.
Second, though it might be the goal of utilities and policy makers to completely eliminate Y2K problems before they impact the public, it is becoming more likely that the public will be impacted in some manner. Disruptions of utility service may occur. As a result, the utilities and public policy makers should plan for these possibilities. As was indicated earlier, contingency planning for potential failures is increasingly occupying the attention of utility companies. For what possibilities should those contingency plans be prepared? Minor disruptions? Major outages? Part of the answer might be derived from the information gathered by the PSC survey. Further, the State must play a part in the development of those contingency plans and in their implementation. Establishment of an open and honest dialogue with the utilities is the first step.
Third, the public deserves and will demand accurate information about Y2K and about the reliability of their utility service. Certainly, nothing is served by inducing public panic. On the other hand, the public should not be mislead. While the doomsayers do not productively contribute to the Y2K discourse, neither do those who minimize the Y2K problem. The public will be provided information about Y2K from a variety of sources, some of which will act far less responsibly than others. The information provided in the Georgia Y2K survey should help policy makers frame the types of information they provide to the public.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 20 of 50
The information collected via the survey might indicate which utilities are lagging behind in Y2K preparations. Judicious use should be made of that information. For one reason, those utilities expressing a lack of progress might simply be those that are being most honest in their assessments. Second, the financial penalties that will accrue to those who are not prepared for Y2K are huge. A fine or penalty levied by the PSC will be dwarfed by the legal liabilities that will result from Y2K failures. A better option would be to work with those utilities to speed their efforts or to pair them with a utility that is making better progress. While inter-utility comparisons are difficult, assessments of progress within each utility over time can be useful, and the Georgia survey can provide a baseline for those evaluations.
In summary, the Georgia PSC survey is an important first step in establishing a productive dialogue with utility service providers. The information provided in response to the survey is not, nor can it be, the final answer to the Y2K threat. That answer will be found in a constructive dialogue fueled by mutual recognition of the need to protect and serve the public. What is required is a partnership between the utilities and the PSC based mutual trust and on the sharing of completely honest information. That partnership will certainly require the protection of information submitted by utilities and designated as confidential or proprietary. It may also be served in the future by the use of more confidential dialogues between the PSC and the utilities in lieu of the use of surveys.
PART 5
ACTIONS OF THE GEORGIA PUBLIC SERVICE COMMISSION
State Law gives the Georgia Public Service Commission varying degrees of legal authority over utilities providing services in Georgia. This authority ranges from significant to none. The Commission's greatest authority is over investor-owned utilities and less over membership corporations and municipals and none over water/ wastewater and cable television. The ongoing introduction of competition into local telephone service and the restructuring of the natural gas industry in Georgia have had an impact on the Commission's authority over these utilities.
The Commission has undertaken a dual role, in an effort to protect the public interest, with specific regard to safety, reliability, billing, collection and/or quality of service of utility providers doing business in Georgia:
z Facilitating and encouraging utilities' Year 2000 compliance and contingency planning for possible service disruptions, inaccurate customer billing and other Y2K-related problems.
z Providing information to the public concerning the readiness of utilities doing business in the state to deal with Y2K issues. This information will be provided on a continuing basis, commencing in October 1998. Such information will also be provided beyond January 1, 2000.
The failure of any utility, particularly those that are regulated by the Commission, to take those steps which are necessary to address the Y2K problem in a manner which adequately protects the public interest is a matter of concern to the Commission. Such a failure would call into the question the level of technical competence of the utility and invite a review of the utility in this regard by the Commission. Attainment of an approved level of technical competence is a basic

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 21 of 50
requirement for a Certificate of Public Convenience and Necessity or Certificate of Authority to provide utility services in Georgia. All utilities are ultimately responsible for the prevention or resolution of their Y2K problems.
At its May 19, 1998 Administrative Session the Commission authorized its staff to mail out a survey to all providers of utility services in the state in order to assess the level of preparedness of these companies to deal with the Y2K problem. The due date for responding to these surveys was June 26, 1998. As of that date, 482 responses had been received to the 1,278 surveys sent (37.7%). On September 18, 1998 a follow up letter was sent to each utility that had not responded as of that date. On November 3, 1998, the PSC issued a second Y2K Request for Information. It then contracted with the National Regulatory Research Institute for a report on Y2K and an analysis of the utility responses.
PART 6
ANALYSIS OF UTILITY RESPONSES TO THE GEORGIA PSC Y2K SURVEY
On November 3, 1998, the Georgia PSC issued a second request to companies providing utility service in the State of Georgia for information on Y2K compliance. This request was issued to all utilities doing business in the State of Georgia (excluding telecommunications resellers, payphone service providers, natural gas master meter operators, and housing authorities). Responses were due at the PSC by December 4. Of the total of 366 utilities surveyed, 163 responses (44.5 percent) were filed by the following categories of utility provider: 27 of 36 local exchange carriers and incumbent local exchange carriers; 8 of 36 interexchange carriers and common carriers; 26 of 98 competitive local exchange companies; 37 of 42 Georgia electric membership corporations; 19 of 50 municipal electric authorities; 34 of 81 municipal gas systems; 2 of 2 gas companies; 8 of 19 natural gas marketers; and 2 of 2 electric companies.(48) Because the major utility carriers responded, it is suspected that the vast majority of the utility services provided to Georgia's citizens are represented in the survey data.
This portion of this report analyzes the results of the survey. Quantitative analysis was applied where possible. In some cases, the small sample sizes limit the extent to which conclusions can be drawn. In some cases, questions were open-ended or the survey respondents did not limit their responses to the specific questions asked and provided information that did not lend itself to quantitative analysis. In those cases, the information provided was reviewed and general impressions were drawn. The analysis is provided in seven topic areas: the utility level of effort, percentage complete, estimated completion date, contingency planning, communication with consumers, utility concerns, and the role of the PSC.
Utility Y2K Level of Effort
The level of effort dedicated by utilities to Y2K mitigation and remediation is, to some extent, irrelevant. It is far more important that the problem be solved; the level of effort is of far less importance. However, because of the difficulties inherent in generating useful information about the status of mitigation and remediation, the level of effort put forth by a utility may provide one indicator that successful mitigation and remediation efforts might be underway.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 22 of 50
With that said, however, the level of effort of utilities is hard to evaluate. Based on the survey responses, it is apparent that substantial efforts are being mounted to battle Y2K. The number of employees and dollars dedicated to Y2K efforts appears to largely depend upon the size of the company. Many of the larger companies' service areas are within multiple states; they responded that it was difficult to determine the number of employees dedicated exclusively to Georgia. Almost all of the larger companies have prepared a Year 2000 planning document. Some of the smaller companies have such a document. Most of the companies, regardless of size, responded that they report to company executives on a regular basis. In one case, the Chief Operating Officer of the company was listed as the project leader.
At least one of the respondents felt that the specific number of employees addressing Y2K was propriety information.
Estimated Percent Complete
The Georgia PSC survey asked utilities to identify what percent they consider themselves complete in four Y2K components: (1) inventorying systems that may be affected by Y2K, (2) Y2K assessment, (3) planning, and (4) testing and certifying changes. Those responses were further broken down into information technology systems, embedded systems, and network elements for telecommunications carriers. Not all utilities responded to the questions.
Figures 6.1 (telecommunications information technology systems), 6.2 (telecommunications embedded systems), and 6.3 (telecommunications network elements) summarize the responses of the telecommunications respondents. Responses are further categorized by type of telecommunications provider: competitive local exchange carriers, interexchange carriers, and incumbent local exchange companies. The solid line indicates the status of all providers.
As might be expected, the percentage complete in the categories of inventorying, assessment, and planning exceeds the percent complete in testing and certifying changes. This is of some concern in that the last phase of work (testing and certifying changes) is likely to require substantially more work and resources than the other listed phases.
Figures 6.4 and 6.5 display the responses of the electric providers who responded to these questions on the survey. Results are displayed for electric membership cooperatives, investorowned electrics, and municipal electrics. The result for all electric respondents is also provided.
Again, the percentage complete in the categories of inventorying, assessment, and planning exceeds the percent complete in testing and certifying changes. For the first three phases of work, the investor-owned utilities report higher percent completion; for testing and certifying changes, the municipal electrics report higher percent completion.
Figures 6.6 and 6.7 display the responses of the gas utilities who responded to these questions on the survey. Results are displayed for investor-owned local distribution companies, municipal gas systems, natural gas marketers, and all gas respondents. Results in gas were similar to the results in the other two utility sectors. Natural gas marketers or investor-owned local distribution systems led the first three phases of work; municipal gas systems reported higher rates of completion of testing and certifying changes.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 23 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 24 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 25 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 26 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 27 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 28 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 29 of 50

Table 6.1

Advanced Clock Testing

COMPONENTS TESTED

ALL

TELE

Information Technology Systems

56.8%

46.7%

Embedded Systems

29.9%

24.4%

Network Elements

26.7%

26.7%

ELEC 61.2% 31.1%

GAS 66.7% 38.1%

Those surveyed were also asked if they had begun advanced clock testing. Table 6.1 lists the responses by utility sector and component. Of those who responded, gas utilities were more likely to have begun advanced clock testing than electric or telecommunications providers. In each sector, advanced clock testing was more likely to have been initiated for information technology systems than the other components.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 30 of 50
Given the fairly low response rates to these questions and the data analyzed, it is impossible to make judgements about the relative performance of the utility sector providers or about any particular provider class.
Estimated Completion Date
Those surveyed were also asked to identify the expected completion date of all four phases of Y2K work. The responses were sorted by utility sector and are displayed in Figures 6.8 (telecommunications), 6.9 (electric), and 6.10 (gas). The estimated completion dates are also grouped by the categories used above: information technology systems, embedded systems, and network elements (for telecommunications only).
For each sector, a substantial number of projected completion dates fall late in the period. Whether the predominance of fairly late expected completion dates can or should be moved forward is a matter of debate. It would, of course, increase confidence in our ability to deal with Y2K if respondents expected to be completed early in 1999. On the other hand, an honest person with a clear understanding of the complexities of Y2K would likely want to allow themselves as much time as possible. As was indicated earlier in this report, some utilities suggest that full compliance before the millennium change (and, therefore, full completion of Y2K remediation) is an unreasonable business goal. Given the difficulties often associated with major computer projects, those expected completion dates may be of concern.
Contingency Planning
Contingency planning has always been a part of utility service delivery in that utility providers must always be prepared to respond to emergencies and service disruptions promptly with the
goal of maintaining or restoring vital services. This tradition of service delivery in the face of obstacles and the skills developed in that regard will very likely be an asset to utility providers
as they face the Y2K threat.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 31 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 32 of 50

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 33 of 50

The responses to the status of contingency planning varied. Many respondents stated that contingency planning is in progress. One stated that planning for critical systems would be complete 12/31/98. Others predicted completion in the first quarter of 1999 or by June 30. Several indicated that contingency planning would be accomplished in the third quarter of 1999. One stated that contingency planning would take place after responses to its inquiries of vendors were received. Several respondents indicated that no contingency plans would be needed. One indicated that the simple goal of contingency planning was to "keep the lights on."
The development of coordinated disaster plans involving state and local government and other utility providers seemed to be a weakness. Many respondents indicated that no such plans exist. Others indicated that plans for natural disasters exist and that those plans would form the basis of a response to Y2K. Another indicated that coordinated disaster plans would be necessary. One large utility stated that it is participating in joint contingency planning sessions with local governments and other utilities.
Responses pointed out the fact that contingency planning is appropriately conducted in response to assessments of internal and external risks, some of which have not been completed. They also indicated that contingency planning is an iterative process (one utility stated that contingency plans are revised quarterly or monthly if needed) and that it is not a

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 34 of 50
single-step process but involves both planning for the prevention of problems and reacting to them if they occur.
Y2K Communication with Consumers
Communication about Y2K efforts with customers of all types appeared to be a priority for some companies. Though there was a great range in the responses, methods identified as being used for communicating with customers included:
z Websites z Brochures z Letters in response to customer inquiries z Bill inserts z A dedicated Y2K response line (800 number) z Newsletters z Radio/television z Local newspapers.
One company stated that it has established a community council program in some of its markets for communication with selected customers and community leaders. These community councils will be used to provide the target audience with information about current issues, including Y2K. Another indicated that it had contacted more than 2500 key commercial and industrial customers and is in the process of contacting key business partners, including customers, to evaluate their Y2K readiness. Yet another stated in its SEC filing that it has sent over 11,000 letters and questionnaires to third parties including customers, vendors, and service providers. (Approximately 22 percent have responded to the questionnaires, and all have indicated that they are already compliant or will be on a timely basis.) Other companies stated that to date they have only responded to written requests for information. And still others indicated that they had not yet communicated with customers but were planning to begin sending information in 1999. Others plan to communicate with health care facilities, other government entities, and emergency service providers. In general, it appears that larger companies have already begun to contact vendors and are using a wider range of communication tools, where some smaller companies are more likely to be considering or using a bill insert or newsletter.
Very few companies indicated that they had communicated with the public at all regarding the effects of possible Y2K service disruptions or the company's contingency plans. At least two companies felt that their contingency plans were confidential and proprietary. One argued that "there are safety, security and reliability concerns associated with disclosing some aspects of contingency planning." One company stated that it prefers to put a "positive spin" on Y2K until "all the facts are in." It intends to reveal contingency plans to customers beginning in mid-year 1999.
Utility Concerns
The Georgia PSC survey specifically asked telecommunications utilities what they saw as the greatest obstacles to becoming Y2K compliant by 1/1/00. Other obstacles to utility compliance could be gleaned from their responses to other questions as well. Those utility concerns include:

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 35 of 50
z The inter-dependence of utility carriers. z The inability of any single carrier to test the entire network end-to-end. z Gathering Y2K compliance information from critical vendors and suppliers. The provision
of reliable service is dependent on outside suppliers and interconnections with other service providers. z The inability to conduct system tests in "real time" and the inability to manage and verify work performed by 3rd party laboratories performing Y2K testing. z The inability to test network components without the risk of radical failure. z Negative news media. z The large cash outlays required for compliant hardware and software. z Freeing the necessary human resources to complete surveys from each requester of detailed information. z Identifying information about the Y2K status of peripheral equipment such as elevators; heating, ventilation, and air-conditioning system (HVAC); and door alarms. z Protecting trade secrets and proprietary documents. z Coordinating and consolidating the status of international organizations. z Legal liability. z Identifying specific, useful technical information in a timely manner. There is no central information bank that tracks hardware and software systems identified as problematic. z These identified concerns reinforce statements made in this report about the extreme complexity of the tasks confronting utilities and the highly interdependent nature of the utility delivery system.
The Role of the Public Service Commission
A substantial number of survey respondents did not respond to the question, "What can the Georgia Public Service Commission do to assist your efforts to become Year 2000 compliant? A few were more demonstrative, requesting minimal government involvement. One survey respondent provided an emphatic "No Thank You" to the question. Others thanked the PSC for its offer of assistance, and several suggested that the PSC continue to keep up the good work. A fair number suggested that the PSC reduce its Y2K reporting requirements in that time spent on providing data is time taken away from mitigation and remediation. The use of web-based and electronic filing of Y2K information was suggested. Others suggested that the Georgia PSC use the standardized Y2K reporting formats developed by other organizations such as NERC, the FCC, the National Association of Regulatory Utility Commissioners (NARUC), and other state public utility commissions. They also suggested that the PSC make use of public filings (e.g., SEC filings) to keep itself current as an alternative to requiring separate Y2K filings. Others suggested that the Georgia PSC link its efforts to those of other national organizations (e.g., the Telco Forum on the Year 2000). Coordination of efforts with U.S. organizations with international responsibilities (e.g., the FCC, the U.S. Commerce Department, and the Office of the U.S. Trade Representative) was also suggested. One respondent asked that the PSC make known its future required reporting dates so that the utility might integrate those dates into its Y2K plan. Another asked the PSC to protect as trade secrets those documents submitted as confidential and proprietary; this treatment, it was argued, would help encourage the free-flow of facts and solutions necessary for effective mitigation and remediation.
Those who suggested a more activist role for the PSC often reflected the cross-sectoral concerns cited earlier. They asked that the PSC ensure that utilities on whom others are dependent be prepared. Of particular concern was the maintenance of the power grid and

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 36 of 50
power generation facilities. One respondent asked that the PSC provide "absolute assurance" that there not be electrical outages. One telecommunications provider asked that the PSC ensure "power availability without interruption." Concern was also expressed about the preparedness of natural gas pipelines and the preparedness of the major customers of utility service providers.
Some respondents asked the PSC to assume an active role in sharing information, especially industry specific information. They asked for confidential reporting to the PSC of any known issues that might affect hardware, software, operating environments, or networks. They suggested that the level of Y2K detail provided to the PSC be shared between all providers and that the PSC make information available on shortcuts, technology, and Y2K information sources. They also suggested that the PSC develop a repository of information on the Y2K status of other systems that might impact utility operations, like elevators, HVAC, and door alarms. Respondents suggested that the PSC facilitate information flow between companies; provide encouragement to the vendors of products used by utilities to share test results and provide equipment certification; identify and publicize possible testing procedures and issue statements of compliance on "critical systems;" endorse private sector coordination of end-toend network interoperability testing; provide checklists of problem areas; and identify available resources. This information clearinghouse function, it was suggested, could utilize the PSC's website. One respondent asked that the PSC ensure that all companies make the same level of effort as the incumbents.
Respondents also suggested a role for the PSC in providing public information. They suggested that the PSC increase awareness of Y2K, that it provide public education on successful Y2K programs, and that it conduct workshops for utility peer groups.
PART 7 THE REPORTS OF THE NORTH AMERICAN ELECTRIC RELIABILITY COUNCIL
In response to a request by the U.S. Department of Energy (DOE) the North American Electric Reliability Council (NERC) undertook one of the first comprehensive efforts to assess the readiness of the nation's electric power supply and distribution systems for Y2K. It has issued two reports, one in September 1998 and one in January 1999. These two reports are discussed here in turn. Additional reports will be issued throughout 1999.
The NERC September Report
The first NERC report, Preparing the Electric Power Systems of North America for Transition to the Year 2000, was issued in September 1998.(49) The report was based on a survey targeted at the 200 entities that own, operate, or monitor the bulk electric systems of North America.
Of those surveyed, 144 organizations responded. Categories addressed in the survey included general preparation, nuclear power generation, non-nuclear generation, EMS/SCADA (energy management systems and supervisory controls and data acquisition), telecommunications, substation controls and system protection, and business information systems.
The findings in the non-nuclear generation category were fairly typical. Figure 7.1 (taken from

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 37 of 50
the NERC report) identifies the average percent complete across the respondents of three Y2K phases: inventory, assessment, and remediation/testing.(50) As the figure shows, the inventory phase is nearly complete, assessment is 61 percent complete, and remediation/testing has begun in earnest. Whether or not these results are adequate is a matter of interpretation, particularly given that the last listed phase (remediation/testing) might require substantially more time to complete than the first two.
Figure 7.2(51) (also taken from the NERC report) attempts to identify when non-nuclear generation systems might be Y2K ready, where "ready" is taken to mean that "all primary and support systems and components are suitable for use into the Year 2000 and beyond." That definition implies that systems critical to sustained operations are ready.(52) The figure indicates that, while less than 30 percent of systems were ready as of the end of the 3rd Quarter of 1998, all systems are planned to be ready by the end of the 4th Quarter of 1999. Obviously, while much has been accomplished, much work remains to be done.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 38 of 50

Source: Preparing the Electric Power Systems of North America for Transition to the Year 2000: A Status Report and Work Plan, North American Electric Reliability Council, p. 29.
Overall, the first NERC report cited the substantial work that has been accomplished to date. Initial findings indicate that the impacts of Y2K on electrical systems appear to be less than first anticipated, and many organizations are on track to meet or exceed the NERC target dates.(53) Nonetheless, it determined that there are some organizations who are late getting started, have not shown sufficient progress, and are projecting completion later than the recommended schedule. The aggregate effect, according to the report, is that "the center of gravity for the industry needs to be accelerated."(54)
Impediments to the success of the electric industry posited by the report include:(55)
z The immovable deadline with a lot of work remaining. Targets are listed in the report for both achieving readiness and contingency planning.
z Reaching all of the 3200 entities in the industry. Every organization is an important link to

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 39 of 50
overall industry success. z Industry restructuring efforts that have drawn attention to competing in the marketplace,
cutting costs, mergers, reorganizations, and survival. z An "alarmingly low" ability to share technical information on Y2K problems and solutions. z The interdependence of electrical systems with telecommunications, natural gas and oil
supplies, and rail transportation for coal supplies.
The Second NERC Report
The second NERC report, Preparing the Electric Power Systems of North America for Transition to the Year 2000: A Status Report and Work Plan Fourth Quarter 1998, was issued on January 11, 1999.(56) It reported three general results from the fourth quarter of 1998. First, it reported that, with 44 percent of mission-critical components tested, findings continue to indicate that Y2K is expected to have minimal impact on electric system operations in North America. According to the report, only a small percentage of components tested indicate problems with date manipulations.(57) Second, the report indicated that the level of participation in the industry-coordinated Y2K readiness assessment program had increased dramatically during the fourth quarter and now exceeds 98 percent of electrical systems in the U.S. and Canada.(58) Third, the report cited the fact that the electric industry is taking very serious steps to prepare for possible operating contingencies. Contingency plans are to be ready by the end of June. The industry is also preparing to conduct two coordinated drills in April and September to prepare for operations under Y2K conditions.(59)
The report identified three critical issues for the industry. The first is meeting industry established targets. The most recent NERC data indicates that, on average, the electric industry is close to but slightly lagging the target of all mission critical facilities being Y2K ready by June 30, 1999. Follow-up discussions with Y2K program managers indicate that nearly all electrical systems necessary to operate into the Year 2000 will have been tested, remediated, and declared Y2K ready by June 30, 1999.(60) Despite these assurances, the report outlines further steps to move the industry into conformance with established targets.
The second critical issue identified by the report is the limited ability to test external voice and data communications systems. The operation of electric systems is highly dependent on voice and data communications from external service providers. Though the electric industry has been assured that telecommunications services will be reliable, the report states that it is difficult to achieve extensive verification in the form of integrated testing of electrical system voice and data communications functions. Meetings with the telecommunications industry are taking place to understand the contingency requirements of each sector.(61)
The third critical issue cited by the January NERC report is the preparation of electric distribution systems for Y2K. Though the report states that distribution systems are the least susceptible to Y2K problems, they are on the front line of electricity delivery. Industry associations working with NERC have worked to enlist the participation and cooperation of the approximately 3000 electric distribution entities in the U.S. and Canda.(62)
The report also cites progress made toward the completion of the Y2K program phases surveyed in the first report. In the case of non-nuclear generation, the following percent completion was reported (See Figure 7.3):

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 40 of 50

Whether or not these percentages of completion are adequate is, again, a matter of interpretation. They do represent improvements over the results presented in the first report.
The report suggests the following activities for state, provincial, and local governments and commissions:(63)
1. Encourage electric utilities within the local jurisdiction to participate in industry efforts facilitated by NERC, its Regional Reliability Councils, and industry trade association partners. Maximize the use of the existing NERC-facilitated process and readiness assessment information. Additional surveys and reports tend to draw resources from the primary focus of addressing Y2K technical issues.
2. Facilitate inter-utility coordination within the local jurisdiction to assure continuity of essential utility services such as electricity, water, sewage, natural gas, and telephone.
3. Facilitate coordination of emergency services such as police, fire, and other emergency management services.
Conclusions
The categories of providers used in both NERC reports (e.g., non-nuclear generation) do not match the categories used in the PSC survey (e.g., embedded systems and type of provider), limiting the comparability of the data. The time periods for the second NERC report and the Georgia PSC survey, however, match fairly closely. Nonetheless, it is impossible to make clear comparisons between the NERC and PSC data. Both surveys show that the early phases of Y2K mitigation are well underway and that testing and remediation comprise the bulk of the remaining work. Though comparisons are difficult, it appears that Georgia electric utilities have reported higher rates of completion in this last category than the national electric industry sample. At a minimum, therefore, there is no reason to conclude that the Georgia utilities reporting to the PSC survey lag behind national averages.
PART 8

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 41 of 50
CHARTING THE COURSE OF Y2K
Though the exact course of Y2K is unknown, some insight might be gained into it by applying an abbreviated version of a strategic planning tool known as "scenario planning." In scenario planning, several varied stories are invented and considered as a means to provide insight into decisions currently confronting managers.(64) These scenarios are essentially stories about how the world might turn out and are designed to help us recognize and adapt to changing aspects of our current environment. They are ways of ordering our perceptions about alternative future environments in which our current decisions might be played out.(65)
The point of scenario planning is not to find the most probable future and adapt to it but to make decisions that will be sound for all plausible futures.(66) In the case of Y2K, the principal current decision to be addressed is what action should be taken now to assist in mitigation, remediation, and contingency planning. In this application of the technique, more emphasis is placed on identifying milestones that one might encounter on the way toward each of the scenarios than on exploring the details of each scenario. In this way, policy makers can begin to craft decisions that can address each of the individual scenarios that Y2K might present and gain some insight into their development.
The four scenarios presented here are created by the intersection of two key unknown factors in the Y2K dilemma arrayed against one another. The first key factor is the impact of Y2K. Will the unmitigated impact of Y2K be severe or only a nuisance? In Figure 8.1, the impact of Y2K is arrayed on the vertical axis from low impact at the bottom to high impact at the top. The second key factor is our success in addressing Y2K. Will we be successful or not? In Figure 8.1, the effectiveness of our efforts are arrayed on the horizontal axis, with an ineffective response on the left and an effective response on the right. The intersection of these axes creates four plausible scenarios: (I) "Crisis Avoided," (II) "Much Ado About Nothing," (III) "the Tempest in a Teapot," and (IV) "Crisis." As was noted, the details of each scenario are left to the reader. Identified here are those milestones that might be observed if the particular scenario were to begin to be realized.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 42 of 50

In Scenario I, "Crisis Avoided," the impact of Y2K is high but our response is effective. Indications that this scenario might be approaching include the successful dedication of additional resources to Y2K by companies and government agencies and identification by the press of "success stories." As this scenario approaches, utilities and others should continue to meet deadlines and report favorable outcomes of tests even though the costs of Y2K might continue to climb and additional resources might need to be dedicated to it. If one subscribes to the "efficient markets hypothesis" that all information is currently factored into stock prices, stock prices would have already been adjusted for the possibility of Y2K-related costs. If companies successfully address Y2K, stock prices might "bounce" upward when it become apparent that Y2K damages will be avoided. This bounce might occur in every scenario except Scenario IV.
In Scenario II, "Much Ado About Nothing," companies effectively respond to Y2K but discover that its impact is less than might have been expected. As a result, if that scenario begins to emerge, resources currently dedicated to Y2K may be diverted to other projects, completion deadlines might be met or exceeded, tests may be passed easily, the press may lose interest, and public attention may decrease. As Scenario II approaches, less attention will need to be paid to contingency planning.
In Scenario III, the "Tempest in a Teapot," Y2K efforts are ineffective but Y2K has little societal impact. Milestones that might be encountered on the road to this scenario include decreasing press coverage and public attention and spotty litigation against those firms whose efforts have

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 43 of 50
failed to mitigate despite the reduced impact of Y2K. In Scenario III, the amount spent on Y2K mitigation and remediation may be questioned by government agencies and by shareholders in that the impact Y2K might have been less than was originally expected.
Scenario IV, "Crisis," is the scenario expected by the doomsayers. In it, the impact of Y2K on society is high, and the response to it is ineffective. Milestones heralding the approach of this scenario might include the failure of companies to meet deadlines and pass Y2K tests, increasing public concern and panic, increasing estimates of cost to mitigate Y2K, a shortage of skilled personnel, and blame for earlier more-optimistic estimates. In addition, contingency plans will need to be developed for increasingly stark potential outcomes.
It cannot be said at this time which scenario is most likely to result. Indeed, as was noted earlier, identification of the most likely scenario is beyond the scope of scenario planning. Each Y2K observer could, however, assign probabilities to each and create a "most likely" scenario based on his or her weighting of the current evidence. As that evidence is revealed and the millennium approaches, those assigned weights will need to be adjusted. In the meantime, this scenario planning exercise might provide policy makers with a basis within which to "plan for the worst and hope for the best."

PART 9
CONCLUSIONS AND RECOMMENDATIONS
The Georgia PSC survey clearly indicated that much work is underway to mitigate the impact of Y2K on the Georgia utilities. It also, however, identified that much additional work needs to be undertaken, particularly with respect to the interdependence of utility service providers and the development of seamless contingency plans. There is clearly a role here for government in general and for the Georgia PSC in specific.
In addition, Y2K clearly presents some unique challenges and an array of issues for public policy makers that extend beyond Y2K itself. They include:
z Y2K requires policy makers to deal with uncertainty. Y2K, perhaps more than any other issue confronting policy makers, is shrouded in uncertainty. Clearly, many companies and agencies have devoted substantial resources to Y2K mitigation and remediation. But will their efforts be adequate? This is indeed the "Y2K lottery." The stakes are high, but the potential outcomes vary significantly as well. Decisions cannot wait for full certainty to emerge.
z Y2K is the first electronic crisis of an automated society. Y2K may provide merely the first example of the risks that attend a highly automated and highly interrelated society. We are now not only dependent on one another for essential services but are also dependent on computerized systems for most of those services. Computerized systems, though efficient, are not immune to sabotage and failure. Y2K may cause us to reexamine the pivotal position we have allowed computers to assume and the safeguards we have placed upon them.
z Y2K makes apparent the fragmentation of essential service delivery systems. Utility

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 44 of 50
industry restructuring has fragmented the utility service delivery system. Though it may produce economic benefits, fragmentation of service delivery responsibility makes more complicated our response to crises. For this reason, the Department of Defense opposed, on national security grounds, the breakup of AT&T. If Y2K causes major utility system disruptions, a reconsideration of the wisdom of restructuring may be necessary. z Y2K is an issue that requires maintenance of public confidence. Panic over Y2K could be as serious as Y2K-related disruptions. Public policy makers will need to maintain the confidence of the public, a particularly difficult task in an era in which the relevance of government has been severely questioned. That public confidence cannot be maintained if government cannot respond to public requests for information or if the public concludes that government is not providing accurate information. z Y2K may require a reevaluation of the role of government. Y2K will require a partnership between the public and private sectors. Traditional models of command-and-control regulation will, undoubtedly, fail to produce the kind of productive dialogue necessary for effective Y2K mitigation, remediation, and contingency planning. On the other hand, government, charged with the responsibility to protect the public interest, has a clear role in Y2K and cannot simply step aside and let the private sector respond. To fulfill that role, it will need to establish an open and honest exchange of information with the utilities and others. New roles and new relationships are required.
What roles might Georgia state government play in Y2K? Figure 9.1 lists six functions that government might consider. They include: increasing awareness of Y2K so that all companies make Y2K mitigation and remediation a high priority; assessing the Y2K situation by collecting
and evaluating information about Y2K readiness; making policies that allow companies to focus on Y2K mitigation and remediation and on maintenance of mission critical functions;
coordinating government and utility efforts including establishing cross-sectoral (e.g., telecommunications to electric) communications; coordinating and encouraging the development of contingency plans that include contingency plans for government agencies as well; and providing accurate information to the public. At the core of those government functions is providing leadership, a somewhat scarce commodity, in these difficult times.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 45 of 50

The Georgia PSC has taken the lead in addressing the critical impact of Y2K on the Georgia utilities. The recommendations that follow assume that it will continue to exercise that leadership and assume functions as necessary to continue to protect the public interest:
1. Engage in an on-going dialogue with utility service providers. This mostly informal, one-on-one dialogue should include monthly conferences (perhaps by telephone) between the PSC and the major investor-owned utilities, the trade associations that represent service providers, and the municipal utility service providers and their associations. This on-going dialogue would supplement the use of periodic surveys as a means to assess Y2K preparedness.
2. Monitor utility Y2K testing and performance with regard to milestones established by national organizations (e.g., NERC) and with regard to the milestones established by the utilities themselves.
3. Continue to participate in national Y2K efforts, which includes interaction with the National Association of Regulatory Utility Commissioners (NARUC) Ad Hoc Task Force on Y2K. If the PSC continues to utilize surveys for information gathering, it should make use of standardized formats for gathering information where those formats are available and appropriate.
4. Encourage utilities to participate in industry-wide efforts to mitigate Y2K problems. 5. Make use of alternative dispute resolution (ADR) and consensus-building models.
These techniques hold more promise than traditional regulatory methods of establishing collaborative relationships with utilities that may lead to effective solutions. 6. Review the non-respondents to the PSC to determine whether problems may exist

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 46 of 50
among those non-respondents. Those who did not respond to the survey may be representative of all utility providers. Their non-response might also be indicative of pockets of a lack of Y2K awareness. 7. Participate actively in the Governor's plan for state government action with respect to Y2K. The PSC should be designated as the lead agency for utility matters. 8. Ensure that contingency plans are developed by all utility service providers to cover all potential hazards and provide coordination for the interfaces between utilities and between utilities and government. Coordinated disaster plans have not been developed by many respondents. PSC, utility, and government efforts should focus on reducing the probability of system disruptions and the impact of potential problems (i.e., probable contingencies and credible worst case scenarios). 9. Establish a cross-sectoral dialogue to facilitate the sharing of information between utility service providers and between utility sectors (i.e., between electric and communications utilities). 10. Provide a forum for the exchange of technical information between similar carriers. Possibilities are workshops, newsletters, or use of the PSC website. 11. Provide information to the public about Y2K through a combination of the preparation of Y2K informational materials and establishment of a Y2K dialogue with the print and electronic media. The PSC Consumer Affairs Section is a resource that can be used to assist in the accomplishment of this function. 12. Draw on the best efforts of those utilities with high-profile, thorough Y2K programs to assist those who may need assistance. "Partnering" or "mentoring" programs may be useful. 13. Ensure that the PSC itself is compliant and a model for other organizations. An ambitious role is proposed here for the PSC; in order to accomplish that role, it must be able to function and communicate with the various stakeholders who will require information.
In the final analysis, the PSC has decided that we cannot leave Y2K mitigation and remediation to the best efforts of individual companies and agencies and simply hope for the best. This survey and other efforts of the PSC are predicated on the belief that all participants are best served by banding together to create a seamless Y2K team dedicated to protecting the public interest. Given the potential seriousness of Y2K and the high degree of interdependence of citizens in modern society, that joint effort is our best hope of success in combating Y2K.
1. For the purposes of this report, "mitigation" will refer to efforts to reduce the impact of Y2K difficulties. Examples of utility mitigation activities include increasing generation reserves and reducing systems transfers on sensitive dates. "Remediation" refers to efforts to reduce the probability of risks. The latter includes testing. These definitions are taken from The North American Electric Reliability Council, Year 2000 Contingency Planning and Preparations Guide (Draft), Princeton, NJ, September 8, 1998.
2. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 7.
3. Two to four percent is estimated by Jerry Dean, "Move to the Millennium," News-Sentinel, Knoxville, Tennessee, September 21, 1997 as cited by Ian S. Hayes and William M. Ulrich,

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 47 of 50

The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 174. The North American Electric Reliability Council in its September report cited later in this report states that "it is estimated that less than 1-2% of these devices may use a time/date function in a manner that could result in a Y2K malfunction of the device."
4. Marcia Stepanek, "Y2K Is Worse Than Anyone Thought," Business Week, December 14, 1998, 38.
5. Ibid., 38-39.
6. Ibid., 38.
7. Robert Stansky as cited by Marcia Stepanek, "Y2K Is Worse Than Anyone Thought," Business Week, December 14, 1998, p. 38.
8. Robert Pear, "Computer Trouble Looms for States in 2000, U.S. Finds," The New York Times, November 27, 1998, p. A1.
9. Telecommunications Reports Special Report, "House Panel Gives the FCC a 'C' Grade on Y2K Work; Key Cable Services Systems May Not Be Ready," undated, 2.
10. Remarks by Robb Pilkington of the Missouri State Emergency Management Agency to the Missouri Public Service Commission Y2K Forum, December 16, 1998, Jefferson City, Missouri.
11. Beth Belton, "A Stash of Cash for Y2K," USA Today, August 20, 1998, p. B1.
12. Rajiv Chandrasekaran, "Lawyers and Insurers Brace for a Flood of Y2K Lawsuits," The Washington Post Weekly Edition, May 11, 1998, 7.
13. Brenda Buchan, "Y2K Contingency Planning and Disaster Recovery Planning," letter.
14. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 3.
15. Ibid., 5.
16. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 11.
17. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 6.
18. D. C. Jones, "Solving the Year 2000 Problem: A Long and Costly Project," National Underwriter, June 19, 1995, 5 as cited in Leon Kappelman, Year 2000 Problem: Strategies and Solutions From the Fortune 5000 (Boston, MA: International Thomson Computer Press, 1997), 5.
19. Capers Jones, "Global Economic Impacts of the Year 2000 Problem," in Leon Kappelman, Year 2000 Problem: Strategies and Solutions From the Fortune 5000 (Boston, MA:

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 48 of 50
International Thomson Computer Press, 1997), 23.
20. Ibid.
21. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 6.
22. Karl W. Feilder, "Unloved and Forgotten: Year 2000 and Microcomputers," in Leon Kappelman, Year 2000 Problem: Strategies and Solutions From the Fortune 5000 (Boston, MA: International Thomson Computer Press, 1997), 32.
23. Ibid., 34.
24. Ibid., 35.
25. Ibid., 42.
26. The Millennium Journal, http://www.data-dimensions.com.
27. Ann K. Coffou, "Embedded Microchips: Another Dimension of the Year 2000 Challenge," in Leon Kappelman, Year 2000 Problem: Strategies and Solutions From the Fortune 5000 (Boston, MA: International Thomson Computer Press, 1997), 49.
28. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 151.
29. Ibid.
30. North American Electric Reliability Council, Preparing the Electric Power Systems of North America for Transition to the Year 2000, September 17, 1998, 9.
31. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 153.
32. Jay Golter and Paloma Hawry, "Year 2000 Circles of Risk" FDIC website at www.fdic.gov, December 1998. Their model has been developed to assess bank risk but can easily be extended to other types of entities. Jay Golter is a financial analyst in the Federal Deposit Insurance Corporation's Division of Research and Statistics. He can be reached by email at jgolter@fdic.gov. Paloma Hawry is a manager at the Actoras Consulting Group in Schaumburg, IL, (email: phawry@actoras.com).
33. Ian S. Hayes and William M. Ulrich, The Year 2000 Software Crisis: the Continuing Challenge, (Upper Saddle River, NJ: Prentice Hall, 1998), 383.
34. Steven V. Brull, "Then There's the Cost of Fixing the Fixes," Business Week, December 14, 1998, p. 40.
35. Ibid.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 49 of 50
36. The Georgia PSC does not regulate water and wastewater service.
37. The Honorable Robert Bennett, Conference Proceedings of the Y2K Crisis: A Global Ticking Time Bomb, sponsored by the Center for Strategic and International Studies, June 2, 1998. Senator Bennett restricts his definition of utility service to electricity and gas but lists communications service separately as the second biggest Y2K risk to the nation.
38. Senate Special Committee on the Year 2000 Technology Problem Hearings, June 12, 1998. The remark by Senator Dodd was reported by The New York Times, June 13, 1998.
39. North American Electric Reliability Council, Preparing the Electric Power Systems of North America for Transition to the Year 2000, September 17, 1998, ii.
40. Marcia Stepanek, "Utility Clients: Do It Yourself," Business Week, December 21, 1998, 6.
41. North American Electric Reliability Council, Preparing the Electric Power Systems of North America for Transition to the Year 2000, September 17, 1998, 10.
42. Ibid.
43. Ibid.
44. Ibid.
45. Ibid., 12.
46. Marcia Stepanek, "Utility Clients: Do It Yourself," Business Week, December 21, 1998, 6.
47. Donald Estes quoted in Barnaby J. Feder and Andrew Pollack, "Computers and 2000: Race for Security," The New York Times, December 27, 1998, A19.
48. Only those responses received by mid-December were included in this analysis. By report release date, a total of 191 responses (52.2 percent) had been received.
49. North American Electric Reliability Council, Preparing the Electric Power Systems of North America for Transition to the Year 2000, September 17, 1998. The report is available from the NERC website (www.nerc.com).
50. Ibid., 29.
51. Ibid.
52. Ibid., 27.
53. Ibid., 1.
54. Ibid.
55. Ibid., 3-4.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004

Page 50 of 50
56. North American Electric Reliability Council, Preparing the Electric Power Systems of North America for Transition to the Year 2000: A Status Report and Work Plan Fourth Quarter 1998, January 11, 1999. This report is also available on the NERC website. 57. Ibid., ii. 58. Ibid. 59. Ibid. 60. Ibid., iii. 61. Ibid. 62. Ibid., iv. 63. Ibid., 6. 64. Peter Schwartz, The Art of the Long View: Planning for the Future in an Uncertain World (New York, NY: Doubleday, 1991), xiii. 65. Ibid., 3-4. 66. Ibid., xiv.

http://www.psc.state.ga.us/Utilitiesy2kweb/georgiay2k.htm

2/25/2004