WASHINGTON — Government and power industry leaders want to improve the country’s weak defenses against a potentially catastrophic cyber-attack on the electric grid, but disagreements persist over the best approach to ensure collaboration between the public sector and the private sector.
What makes the electric grid an attractive target for cyber-attacks is its multiplier effect — an attack on one region or supplier can quickly ripple to others. Its vast infrastructure — from generation plants to substations — is spread over highly interdependent installations that are miles apart.
In addition, the grid makes an appealing target because of its exceptional vulnerability, which stems, in part, from its broad reach.
As past major outages have shown, a line outage or system failure in one area can lead to cascading effects in other areas. In 2003, a blackout across the Northeast, sparked by an overgrown tree near Cleveland, crippled commerce and transportation in the U.S. by cutting off power to 50 million people and causing up to $10 billion of damage to the economy.
As technology has advanced, utilities have begun taking steps to update the electric grid by integrating new technologies, such as automated systems, and information technology networks that connect grid operations and control systems to other computer networks and to the Internet.
Years ago, power companies saw that managing grid operations via the Internet would help them cut costs and increase efficiency, so they moved towards online systems that could be accessed remotely.
“Now we can remotely manage devices via the Internet,” says Mark Weatherford, a leading former Department of Homeland Security cybersecurity official. “So instead of putting someone in a truck and having them drive a hundred miles to a substation in the middle of the mountains somewhere, you remotely manage that.”
Weatherford, now a principal at the Chertoff Group, was among several power executives and cybersecurity experts who gathered recently at an event on grid security hosted by the Bipartisan Policy Center in Washington.
Although the changes have allowed the gradual modernization of the system, the increased interconnectivity has made the grid more vulnerable to attacks from computer hackers.
“To no one’s fault at the time — we didn’t realize it. [We] didn’t think about the security and the insecurity” of Internet connections, Weatherford said.
Security experts are aware of the problem, and they are moving quickly to solve what they see as a rapidly evolving threat to the networks of power utilities. But the increasing complexity of computer systems poses new challenges for personnel who do not have a cybersecurity background.
“How do we teach power engineers and operators what they need to know about cyber and in particular about cybersecurity?” asked Michael Assante, one of the nation’s top experts on cybersecurity. “These are tough questions. If you go to engineering school, you’re not taught about cybersecurity as part of becoming a power engineer.”
Some industry leaders argue that if power utilities want to counter the growing threat of cyber-attacks, they must use the same resources that they use to combat natural disasters.
“We have to treat the cyberthreat with the same respect that we give to forces of nature that impact our grid,” notes Chris Peters, the vice president for critical infrastructure protection at Entergy, one of the country’s largest operators of nuclear power plants. “We have to put the same comprehensive approach and the same attention to cyberthreats as we do to the other threats that impact our system.”
Former CIA and NSA director Michael Hayden warned that Edward Snowden’s actions have created a stir among those who are committed to transparency and Internet freedom, which could result in a retaliatory attack if Snowden is captured by the U.S. government.
“If, and when, our government grabs Edward Snowden and brings him back here to the United States for trial, what does this group do?” asked Hayden rhetorically about hacker groups such as Anonymous. “They may not go after the U.S. government because frankly, the dot mil stuff is one of the hardest targets in the United States. If they can’t go after dot mil, who are they going after? Who, for them, are the [digital] World Trade Centers?”