House lawmakers press feds on emergency plans for grid cyber attacks

Dive Brief:

Lawmakers in the U.S. House of Representatives are concerned about the potential for a cyber attack to cripple the nation's electrical system, and last week held hearings to consider how to guard against, and respond to potentially devastating blackouts.
According to The Hill, lawmakers at a House subcommittee hearing indicated they believe the grid and nation remain unprepared, with the potential fallout likened to massive earthquakes or other disasters.
The President of the North American Electric Reliability Corporation (NERC) and CEO Gerry Cauley testified at the hearing; earlier this month the group called for improvements in communications, including upgrading the Electricity Information Sharing and Analysis Center (E-ISAC) portal and enhancing coordination with law enforcement.

Dive Insight:

Cyber security continues to be a high-interest topic recently: NERC recently released a report based on simulated grid attacks last year; the Federal Bureau of Investigation has begun warning of potential threats, and the House Transportation Subcommittee on Economic Development, Public Buildings and Emergency Management last week sounded the alarm about potential impacts.

“Virtually all critical infrastructure is dependent upon the electrical grid, particularly lifeline sectors, telecommunications, transportation, water, and financial services,” said Chairman Lou Barletta (R-Pa.)., according to reporting from The Hill. "If the goal of the bad guys is to collapse the U.S. economic system, they are going to cut off the power."

NERC's Cauley told lawmakers "we must remain vigilant," and said that last year's simulated attack, Grid Ex III, "showed that there is more that we can and should do to be better positioned to plan for and respond to a disruption of service upon which we all depend."

Cauley also warned lawmakers about the potential cost to respond to an attack, telling them in his prepared testimony: "Utilities will need unprecedented levels of financial resources in order to restore their facilities and eventually resume normal operations."

More than 4,400 individuals from 364 organizations across North America participated in the simulated attack in November. The analysis of the event concluded, among other findings, that E-ISAC needs to be enhanced to accommodate "urgent real-time communication with portal members," and cyber and physical security incident reporting mechanisms need to be reviewed for redundancies.

Emphasis on the potential for cyberattacks has focused on the bulk power system since hackers caused widespread blackouts in Ukraine last year. Lloyd's of London estimated a widespread attack on the U.S. power grid could result in a total economic loss ranging from $243 billion up to $1 trillion in the most damaging scenarios.

Last month, the FBI and Department of Homeland Security launched a campaign to warn utilities of the potential for cyberattacks, according to a report in The Washington Free Beacon. It will include briefings in eight cities and online webinars. The briefings are called: “Ukraine Cyber Attack: Implications for U.S. Stakeholders."