Southern Company CEO explains importance of the meeting with President Biden

Tom Fanning, Southern Company CEO, details his meeting with President Joe Biden and other major CEOs.

Video Transcript

ADAM SHAPIRO: Just want to get right into our next guest. Tom Fanning is the CEO at Southern Company, and he has been part of the work symposium taking place at the White House on cybersecurity. For a lot of people, Tom, who may not be familiar with Southern Company, 9 million customers delivering electricity, natural gas, solar energy in three different states. And when we talk about the crucial role that companies like yours play in this country's infrastructure, we worry about cyber attacks. So what can you tell us about the meeting and where we go from here?

TOM FANNING: Yeah, actually, we're way more than three states. We're all over the United States. And in fact, microgrids, you may have heard about, we're something like a 75% share. So we're all over the US. Here's the point. I think President Biden led a very important discussion with private industry.

And I will say he has got a great team. When you look at Secretary Granholm, Secretary Mayorkas, when you look at folks out of the National Security Council, Anne Neuberger, the National Cyber Director Chris Inglis, Jen Easterly of CISA, this is an important conversation about a reimagination of protecting this nation's national security in a collaboration between the private sector and government.

SEANA SMITH: So Tom, then what role specifically do you see Southern Company playing in all of this? I guess, how do you-- how can you assist in this effort to combat the threat of cybersecurity?

TOM FANNING: Well, it's much bigger than any one company. For now about eight years, I've led the industry in terms of investor-owned utilities, along with some other folks I work with in cooperative utilities and municipals, in thinking about how to provide a single industry perspective on how best to defend ourselves against the cyber threat.

I'm also on the United States Cyberspace Solarium Commission, and what that does-- has worked with members of government, members of Congress in a non-partisan way, is the word I typically use, to really reimagine what national security should feel like and how it should operationalize in a cyber realm as opposed to kinetic warfare as opposed to a tank battle on the plains of Poland.

In this case, the battle is on our telecom networks, our electricity grids, and our financial systems. Since private industry owns 85% of that critical infrastructure, how should we lean in to the national security picture in working with government in a different way completely in the years ahead?

ADAM SHAPIRO: And Tom, as you've said, you've spearheaded this effort for almost a decade. A lot of us, we've heard the continued stories and reports of threats to the electric grid, for instance, and whether or not those would be acts of war. Can you share with us how close we've come or have there been attacks on the grid that, fortunately, were thwarted and what we need to do, what it's going to look like on the ground to counter that?

TOM FANNING: Yeah, so let me speak kind of broadly. And that is I really tend to focus on the excess threat, that is, evaluating the most important critical infrastructure in America, whether it's electricity or telecom or finance or water or whatever it is, and then trying to protect those. I tend to focus on that threat rather than the punks, thugs, and criminals.

Now, if you look at all of the threats, a company like mine gets attacked millions of times a day, OK, but most of those are really minor in nature or they are of a nature where they're trying to evaluate your defenses. They're kind of scouting the cyberspace for your vulnerability. There are three big initiatives that we need to think about for America.

First is shaping behavior. There really isn't a widely accepted way for countries, for criminals to be held accountable. And we're trying to set those standards among allies and, frankly, among those that would do America harm, so what are the accepted behaviors?

The second is to harden the attack surface. So folks like me working with my peers in banking and in telecom and across private industry, how do we make ourselves less vulnerable? Third, hold the bad guys accountable. How do we fight back? Setting those standards is some of the important work we're setting right now.

SEANA SMITH: Yeah, and Tom, I guess, what is the best way or how would you advise then fighting back? Because there was a lot of criticism when ransom was paid, saying that that was the wrong precedent to set here and how that obviously could be harmful to the US and other companies going forward So I guess what is the best way or the right way, from your view and from what you've experienced, to go about this?

TOM FANNING: So it's a really difficult question to pinpoint, but let me give you this example. It's almost as if you and I, we're going out to a beach. And I look over the ocean with you and I say, look at the cyber warfare going on. It's really like a submarine battle. We know that there is ongoing lethal activity, and it really only manifests itself that we can see when something cataclysmic happens-- Colonial.

So what we've got to do is understand how to work in an environment where the threat, the action, and reaction is not readily apparent to the vast amount of the public out there. This is occurring in classified space. It's occurring in places where people will never see it. And our idea is to prevent those threats from being manifested in the American economy.

And I would say right now we're doing great. But it's not enough to say the current state works and we've been good in the past. It's almost like that Wayne Gretzky expression, we always have to evaluate, skate where the puck will be, not where it is now. And I can tell you the threat continually changes. And so our defenses have to continually modify as well.

ADAM SHAPIRO: Is all of this handled, coordinated private sector with the government through the Department of Homeland Security? Or is it through Department of energy? Who's the lead on this on the government side?

TOM FANNING: What you should think about-- and I tell you a great asset to the United States government is Chris Inglis, national cyber director. He will help align the whole-of-government effort in this national security problem. In general, the umbrella for all of government to come together and for private sector to work is in CISA, which is in Homeland Security. And we have a terrific person leading that, Jen Easterly.

ADAM SHAPIRO: All right. We appreciate your briefing us on how that meeting went. Thomas Fanning is the CEO of Southern Company, and wish you all the best, sir. Thank you.

TOM FANNING: Hey, great being with you. Thank you.