While Grant is correct that "permitting only portions of the protocol to be authenticated" does "remove as much of the cryptography burden as possible from smaller devices" this is not much of an excuse. Efficient techniques exist to compile code or ASICs for low-cost devices that allow them to reliably encrypt reports - indeed to assemble a report in encrypted form in the first place (only).

Aside from the effect on "bump in the wire" types of solutions, utilities will be able to deny third parties access to their networks on the excuse that critical infrastructure data is not all universally encrypted. This will prevent deployment of robust monitoring and conservation and DR/PLS services that are not controlled by the utility itself, prevent deployment of resilience and human vulnerability related services (fire, security, medical monitor) and generally slow deployment as utilities bill customers for smart meters and other smart grid related expenses. Rather than doing as they should do, and did do in some other countries, which is to require utilities to act as a common carrier for such services, and even for voice over IP (VoIP) and general communications services such as broadband over power line (BPL), and use tariff revenues from these to subsidize the smarter grids.

Admittedly there are problems in requiring every device to be upgraded to encrypt its reporting (relatively easy) and also in requiring devices to respond to encrypted commands (somewhat harder) and in requiring them to soft-upgrade their firmware by remote control or respond appropriately to changes in authentication protocols (the hardest of all). But it needs to be clear that utilities that don't employ universal encryption can't use this as any kind of excuse to delay third party services nor to restrict the network to only their own internal use. They are in a clear conflict of interest when it comes to supporting services that reduce load at least off-peak, and are not motivated generally to help communities meet resilience goals or protect vulnerable persons, as they don't pay any of the consequences (emergency response or health costs). Governments do, so governments should insure these utilities against third party access risk in return for clear tariffed access to the smart grid network assuming the utilities made good security tradeoffs and employ encryption where it is really necessary.