Dive Brief:
- Domestic terrorists have developed "credible, specific plans" to attack the U.S. power grid and view it as a "particularly attractive target given its interdependency with other infrastructure sectors," according to a security briefing issued Monday by the Department of Homeland Security (DHS) and first reported by The Daily Beast.
- The alert warned of "physical damage" to electrical infrastructure, raising the specter of the 2013 sniper attack on Pacific Gas & Electric's Metcalf substation that damaged 17 transformers.
- The long lead time needed to replace large transformers is a threat to U.S. grid resilience, and in 2015 Congress directed the creation of a strategic reserve for critical power system equipment. "Congress would be wise to revisit this program and ensure that it properly addresses the risks we face today," Mark Carrigan, cyber vice president of process safety and operational technology cybersecurity at Hexagon PPM, said in an email
Dive Insight:
Electric utilities say they are prepared for both physical and cyber attacks on their systems, and that the DHS warning is not a surprise.
"The threat of physical attacks targeting critical infrastructure is not new," Edison Electric Institute (EEI) Vice President for Security and Preparedness Scott Aaronson said in a statement. Industry coordination with government partners "helps to ensure vigilance and gives us the ability to respond quickly should situations evolve."
"Threats of this type and many others from a wide range of extreme groups are an ongoing risk and something states have worked to address" by collaborating with the U.S. Department of Energy (DOE) and other federal authorities, National Association of State Energy Officials Executive Director David Terry said in an email.
EEI, which represents investor-owned utilities, has a security partnership with the government through its CEO-led Electricity Subsector Coordinating Council which allows power companies to "share actionable intelligence and to prepare to respond to incidents" that could impact the grid, said Aaronson.
DOE's Cybersecurity, Energy Security, and Emergency Response office "has proven to be an exceptional partner for the states and energy industry in dealing with these issues," Terry said.
The DHS warning of "physical damage" is a reminder of the Metcalf attack almost a decade ago. Though the grid impacts were modest, $15 million in damage was done by more than 100 rifle shots and the attacker was never found.
"The major concern is that large transformers, which are critical to grid operations, have a long lead time from order to delivery, often longer than 12 months," Carrigan said in an email.
A widespread outage is "unlikely," Carrigan said, unless the attackers have specific grid knowledge and carry out a coordinated attack at dispersed locations. But "the potential for a prolonged outage is possible depending upon the scope of an attack," he said.
In 2015 President Obama signed the Fixing America’s Surface Transportation Act, which included plans to develop a strategic reserve of transmission equipment. In 2017 DOE released a report outlining the creation of the reserve and recommending an industry-led approach.
"The results delivered by this program are not clear," Carrigan said, adding that lawmakers may need to ensure the transmission equipment reserve can address growing risks to the grid.
Grid Assurance, which is owned by American Electric Power, Berkshire Hathaway Energy and FirstEnergy, is an industry-led initiative to stockpile long-lead-time transmission equipment. The company announced in September that it had completed acquisition of its initial inventory "with the arrival of the last three power transformers to complete the asset roster."
"All utilities have to be on their game from a defensive standpoint, but you also have to put yourself in the best possible position to restore the grid quickly should something catastrophic occur," Grid Assurance CEO David Rupert said in a statement.
