CDT Comment NISTIR 7628 Draft 12-02-09 FINAL CORRECTED

!!Before the Department of Commerce National Institute of Standards and Technology Request for Comments ) ) Draft NIST Interagency Report (NISTIR) ) Docket Number 0909301329-91332-01 7628, Smart Grid Cyber Security Strategy ) And Requirements ) !!COMMENTS OF THE CENTER FOR DEMOCRACY & TECHNOLOGY!! December 1, 2009 !!!! Jennifer M. Urban!Elizabeth Eraker ! Longhao Wang!! Samuelson Law, Technology & Public Policy Clinic !University of California, Berkeley School of Law! 585 Simon Hall!Berkeley, CA 94720-7200! (510) 642-7338!!! on behalf of the !Center for Democracy & Technology!!!December 1, 2009 ! Table of Contents!!Executive Summary……………………………………………………………………… 1!!I. Introduction………………………………..………………………... 2!!II. Smart Grid Consumer Data Flow and Applicable Standards Identified by NIST for Implementation…………………………..………………………………….... 4 A. Overview…………..………………….…………...……………………... 4 B. Data Flow in Standards Identified by NIST for Implementation………....7!1. ZigBee/HomePlug Smart Energy Profile…………………………7!2. Open Automated Demand Response (OpenADR)………………. 9 3. OpenHAN……………………………………………………......12 C. Data Flow in Real-World Products……………………………………....13 !III. Implications of Smart Grid Data Flow for Consumer Privacy…………………..14 A. Customer Data Concerning Home Activities Presents Privacy Risks !That Must Be ...