In December 2015, a cyberattack cut off electricity in Western Ukraine, leaving 225,000 people without power. In December 2016 it happened again. A cyberattack plunged parts of Kyiv, the capital city, into darkness.
Who might be attacked this December?
Electricity anchors U.S. daily life
In a new era of warfare and of terrorism, cyberattacks are a growing global weapon and energy infrastructure is their frequent target.
In the United States, energy sites have suffered more cyberattacks than any other element of critical American infrastructure, according to the Department of Homeland Security. The grid has prevented major impacts so far, but the appeal to attackers is frighteningly clear. The risks from a widespread and prolonged outage are significant.
In 2003 a blackout caused in part by a tree branch cascaded throughout the Eastern United States and parts of Canada. Over two days, 50 million people lost power. The estimated impact to the United States was $10 billion in damages and 11 lives lost.
That was just two days. An extended power outage would disrupt not only electricity, but also water, food, sanitation, health, and transportation. At the extreme, a blackout has the potential to collapse the social order, threatening livelihoods as well as lives.
Americans have taken notice. Across the political spectrum, Americans rank cyberattacks behind only terrorism and the North Korean nuclear program as a critical threat to national interests.
Within this overall concern Americans are worried about damage to U.S. infrastructure. This is no idle worry.
National defense in a digital and interconnected grid
Across the decades, the building blocks of America’s electric system were designed to stand alone. There were no interconnected operating systems and no internet to link to. Software and management systems controlled assets like power plants and substations from the inside, in operational isolation.
Today existing assets across the system are being rapidly joined through digital pathways. At the same time, new assets ranging from small residential solar panels to new utility-scale natural gas generation are being brought online. This rapid connection of old and new assets creates an "expanding attack surface" for cyber attackers.
Cyberattacks can hit any part of the grid, making the full system part of our national defense. This threat to national security is not yet matched with an adequate national response.
Regulation is driven by the Federal Energy Regulatory Commission and the North American Electric Reliability Corporation. Together they cover two of the three main aspects of the system - generation and transmission of power. Distribution, the last mile bringing electricity into communities, is largely regulated at the state level.
Looking ahead
These regulatory structures are being retrofitted in real time to incorporate cyber protection. Strong coordination between federal, regional, state, local, technical, and utility organizations with standard protections and a clear delineation of roles and responsibilities is essential.
It is a colossal task. From the Chicago Council’s new working paper, here are four places to start:
First, augment cyber defense in the core grid. Cyber threats are volatile, never static. The NERC recently held its biennial grid security exercise, GridEx, to simulate cyber/physical attacks and to test the full ability of utilities and partners to respond. For those who opt in, GridEx serves as a flexible testing ground, one that can be expanded. Ultimately closer alignment between threat identification and industry is critical. One of the leading drivers of corporate investment in cybersecurity technology is addressing regulation.
Second, strengthen protections against national threats with roots in distribution. Across the 50 states, multiple sectors will need to be engaged to manage threats. A national platform allowing state-based public-utility commissions to engage in the discussion and implement consistent best practices will be critical. This could also help address staffing pressure at the state level, where PUCs cover a wide range of issues. Developers of new grid-connected technologies will need to be engaged, and utilities that operate across state boundaries have a unique role to play.
Third, demonstrate and scale components of resilience. GridEx needs to be married to strengthened operations and an expansion of resilient infrastructure. Network segmentation, backup and restore procedures, and training for staff to bring the grid back up in a crisis must be strongly rooted across organizations. In addition, smaller sources of power can offer resilience benefits to the system. These benefits need to be demonstrated with data-driven metrics and then scaled through the regulatory and management oversight of the grid.
Fourth, invest in the cyber foundation of the future energy marketplace. The energy system is becoming increasingly digital, interconnected, and distributed. A collaboration platform that involves federal and state regulators, the energy industry, and city leaders must be created to inform both regulation and industry best practice. Its ranks must also be filled with cyber experts from the financial, engineering, and education sectors as energy takes on more virtual and financial characteristics. As a foundational element, the Unites States is underrepresented in cyber expertise.
Conclusion
The electricity system in the United States has long been at the forefront of both societal benefit and innovation. Today, however, there is no coordinated and integrated national forum addressing cyber threats to energy infrastructure and cities, nor a platform to give the grid edge resources that may offer unique local protections.
A cyberattack has not yet thrown American cities into prolonged darkness. A concerted effort is needed to keep it that way.
This commentary is based on a working paper entitled Grid Security is National Security: Cyber Threats to Energy Infrastructure and Cities, published by the Chicago Council on Global Affairs. The views expressed are the author’s own.
Karen Weigert is a senior fellow on global cities at the Chicago Council on Global Affairs. She served as the first Chief Sustainability Officer of the City of Chicago from 2011 to 2016 and is on twitter @KarenRWeigert.
