Chief Information Officer United States

Decisions that made our numbers smaller and our systems harder to stop

Meters served by our seventeen member cooperatives: 412,000; Oklahoma, southern Kansas and western Arkansas, 2026
Tested restore time for fourteen operations-essential systems: 19 hours; Planned restore from offline copies, November 2024
Distinct data-centre load behind 9.6 GW of enquiries: 4.1 GW; Large-load register, June 2026; 610 MW under signed facilities agreements

Decisions & consequences

One register for 9.6 gigawatts of data-centre enquiries

In 2024 our members began receiving requests from data-centre developers at a pace none of us had planned for. By early 2025 the enquiries reported to Merrowind totalled 9.6 GW, against a 2025 system peak of 2,640 MW. Our planners had been asked for a high-growth scenario with 4 GW of new load, and a proposal for a second combined-cycle plant of about 900 MW, estimated at US$1.6 billion, was being drafted around it. My data team, building a new feed for the load forecast, found the same developer's project at three members under three names.

I proposed one register for every enquiry over 20 MW, matched by parcel, developer and point of connection, with four gates: enquiry, study agreement with a deposit, facilities agreement with financial security, and signed service agreement. Only the last two would enter the base forecast. Our vice president of economic development opposed the gates in writing, expecting developers to go to utilities that asked for less. Royce Whitlatch, general manager of Cottonridge Electric Cooperative, our largest member, objected that Merrowind would see his prospective customers' terms. Both memos went to the board with my paper.

The board adopted the register in March 2025, with a rule I had not proposed: outside the planning team, Merrowind staff see each project's stage and size, never its commercial terms. We gave up speed and some goodwill. Developers had to sign confidentiality and study agreements before a member could quote, and two developers with about 700 MW between them took their projects to neighbouring utilities.

By June 2026 the register held 63 enquiries resolving to 41 distinct projects and 4.1 GW. Projects totalling 1.35 GW had paid study deposits and 610 MW had signed facilities agreements. In September 2025 the board deferred the combined-cycle decision and approved two 230 MW combustion turbines that can be built in sequence as signed load arrives.

Every load figure in a board paper now states its gate. What I would do differently is the message to developers. I let each member explain the gates in its own words, and for four months developers heard several versions. One published guide from the first day would have spared members some difficult meetings.

Correcting the network model before buying an outage map

In February 2023 an ice storm brought down lines across five of our members' territories, and 74,000 meters lost power at the peak. Our shared outage management system, used by fourteen members, took 9,400 calls in the first three hours and grouped them against our mapping data to predict which fuse, recloser or transformer had operated. In 42% of grouped outages the prediction was wrong. Crews drove to intact devices while the real fault sat on a tap the map assigned to a different line section. The last members were restored on the fifth day.

Afterwards the member managers wanted the public outage map and mobile application they had been promised, and our vendor proposed a major upgrade of the outage engine, together about US$4.4 million. With two members' staking technicians I sampled 3,000 service transformers and found about 11% associated with the wrong tap, phase or line section. I recommended spending US$6.1 million over two years on connectivity first and delaying the map and application by eighteen months. Three member managers and our vice president of member services argued that members would judge us on what they could see, not on data they could not, and local newspapers had made the same point.

The shared service's user committee approved the connectivity programme by nine votes to five. Members' crews checked connections during routine work, and my analysts used meter outage and voltage events to show which meters lost power together and therefore which transformer they really shared. By December 2024 association errors were below 2%.

In January 2025 a storm of wind and ice left 51,000 meters without power. First-device predictions were correct 87% of the time, dispatches to intact devices fell by about two-thirds and the last members were restored within three days. The outage map and application went live in August 2025 on the corrected model.

Mapping changes are now treated as operational changes and need a field check before acceptance. Where I went wrong was the sequence. We verified member by member, as each volunteered. Verifying first the lines most exposed to ice, across all fourteen members, would have removed more risk before the 2025 storm.

Moving fourteen operations-essential systems into their own enclave

When I joined Merrowind in July 2021, the audit and risk committee had already asked whether an attack on our business network could stop operations, as the pipeline attack that May had stopped fuel deliveries. Our control centre and plants sat inside the boundary of the federal cyber security standards for the bulk power system and were reasonably well protected. My review of 91 business applications found a different exposure. The systems we used to submit offers to the regional market, nominate gas to our plants, account for energy and settle with members shared the corporate directory, email-connected workstations and the same backups as everything else. Nobody could say how long restoring them would take.

I proposed moving the systems we classified as operations-essential into a separate enclave with its own identity directory and administrators, hardware security keys, no email or web browsing, offline backups and written procedures for running each function by telephone and spreadsheet for 72 hours. The capital cost was US$8.7 million, with US$1.4 million a year to run. Teresa Quintanar, our vice president of energy markets, opposed it because traders would lose remote access from their own devices and night shifts would need issued equipment. Our chief financial officer suggested buying more cyber insurance instead. The chief executive backed the enclave and asked me to defer our new data platform by a year to pay for it.

We gave up that year and some convenience on the trading desk. The enclave was complete in September 2023 with thirteen systems. I had left out outage management, treating it as a member service; the February 2023 storm had shown that members' restoration depended on it, and we added it in 2024.

In November 2024 a planned test restored all fourteen systems from offline copies in 19 hours, a figure we could not have estimated in 2021. It also exposed two gaps, a market certificate held on a corporate laptop and a stale gas nomination contact list, both since fixed. In March 2025 a phishing campaign compromised two corporate mailboxes and reached nothing inside the enclave.

Every new system now receives a consequence classification before purchase. What I would do differently is the starting point. I began with network diagrams. Asking each operations team what it could not do without for three days would have found the outage system in the first month.

Converting members' billing in waves after their boards retired rate codes

Fourteen members shared a billing system Merrowind had built on a midrange platform in the late 1990s, and in 2022 its vendor confirmed that support would end in December 2027. Across 236,000 accounts the system held 1,140 rate codes, including irrigation contracts, oil-field pumping loads, prepaid plans, member-specific power cost riders and tariffs that had last produced a bill a decade earlier. I had seen at Hollensby in 2012 what happens when a utility carries every rate into a new system: about 38,000 delayed or estimated bills in two cycles.

I proposed two conditions. Each member's board would review its rate schedules and retire codes it no longer needed before conversion, and conversions would run in four waves, smallest cooperatives first, with two bill cycles in parallel and every bill differing by more than 2% held for review. Cottonridge Electric Cooperative, our largest participant with 58,000 accounts, wanted to convert first to meet its own date for a new member portal and did not want its rate decisions tied to our timetable. Its board chose in 2023 to buy its own system, and a smaller member with 9,000 accounts followed.

We gave up about US$2.3 million a year in fees from those two members, which raised the cost per account for the remaining twelve by about 6%, and nine months of schedule. We agreed exit plans with both, with data extracts and a fee schedule, and my team supported Cottonridge's conversion.

The twelve remaining boards reduced their 940 codes to 296. Three waves have converted ten cooperatives and 120,000 accounts, in October 2024, April 2025 and February 2026. First-cycle exceptions were 0.6% in the first wave and 0.3% in the third, and no member has had to issue an estimated bill. The programme will cost about US$43.5 million against US$38 million approved, mostly for additional parallel cycles and member staff overtime. The fourth wave, two cooperatives with 49,000 accounts, is planned for March 2027.

Every tariff change at a participating member now carries a billing impact note. What I would do differently is the conversation with Cottonridge. I presented the conditions as settled before asking what its portal date required. A wave designed around that date, with its rate review running alongside, might have kept our largest participant in the service.

Discuss a leadership challenge