{"id":5265,"date":"2013-10-28T16:46:31","date_gmt":"2013-10-28T16:46:31","guid":{"rendered":"http:\/\/blogs.edf.org\/energyexchange\/?p=5265"},"modified":"2015-12-21T12:45:15","modified_gmt":"2015-12-21T18:45:15","slug":"the-u-s-power-grids-cyber-war-games","status":"publish","type":"post","link":"https:\/\/blogs.edf.org\/energyexchange\/2013\/10\/28\/the-u-s-power-grids-cyber-war-games\/","title":{"rendered":"The U.S. Power Grid\u2019s Cyber War Games"},"content":{"rendered":"

\"\"<\/a>In the 1983 thriller WarGames, <\/em>Matthew Broderick plays a teen-age computer geek who unknowingly signs onto a Pentagon computer while hacking into a toy company\u2019s new computer game. Thinking that he\u2019s simply playing a game called Global Thermonuclear Warfare,<\/em> Broderick launches the game and nearly starts a nuclear war.\u00a0 The North American Electric Reliability Council<\/a> (NERC) will hold its own war game next month with a simulated attack on the U.S. power grid.<\/p>\n

The drill, called GridEx II<\/a>, will take place on November 13-14 of this year. The participants will include 65 utilities and eight regional transmission organizations, representing most of the nation\u2019s electricity customers.\u00a0 The drill will test how well the electric utility industry and the grid itself respond to physical and cyber attacks.<\/p>\n

A NERC Critical Infrastructure Protection Committee<\/a> (CIPC) working group will begin the drill by sending participants a series of simulated physical and cyber attacks, climaxing in a national security emergency.\u00a0 Participants will then respond and interact with each other, just as they would in a real emergency.\u00a0 The simulation will last 36 hours, and the CIPC working group will evaluate the participants\u2019 responses and provide feedback on how their actions impact the ongoing scenario.\u00a0 After the drill, the working group will analyze the results and prepare a report on lessons learned.<\/p>\n

<\/p>\n

The drill is timely.\u00a0 Our nation\u2019s power grid is under constant cyber attack<\/a>, according to a survey of electric utilities<\/a> by U.S. House Representatives Henry Waxman and (now Senator) Edward Markey. James Clapper, the Director of National Intelligence, described cyber attacks as a soft war that is already underway and a dire global threat in his April 2013 World Threat Assessment of the US Intelligence Community<\/a>.\u00a0 The Department of Homeland Security investigated over 200 serious cyber attacks against critical facilities during the first half of 2013, and more than half of these targeted the grid.<\/p>\n

Adequate Investment<\/strong><\/p>\n

The U.S. has developed a number of cyber security protections for the grid, but we must do more.\u00a0 Our country needs to make adequate investments in cyber security.\u00a0 With the huge budget deficits that the U.S. has incurred in recent years, the proper level of government spending is often at issue.\u00a0 Given the devastating consequences of a cyber attack on the grid, this is one area where we can\u2019t afford to cut corners.\u00a0 Our leaders must ensure that federal budget cuts do not impair the Department of Energy\u2019s and the Department of Homeland Security\u2019s means to protect our nation\u2019s critical energy infrastructure from cyber attacks.<\/p>\n

Broader FERC Authority<\/strong><\/p>\n

\"John<\/a>We also need legislation granting the Federal Energy Regulatory Commission<\/a> (FERC) broader authority to protect against cyber attacks.\u00a0\u00a0 FERC is charged with protecting the grid against cyber attacks, but it doesn\u2019t have the legal authority it needs to do so.\u00a0 FERC has pleaded<\/a> with Congress to fix this oversight.<\/p>\n

The Federal Power Act grants FERC authority over the bulk power system, but most of the smart grid equipment that creates vulnerabilities is installed on local distribution systems beyond its jurisdiction.\u00a0 As a result, the National Institute of Standards and Technology<\/a> (NIST) has put together a three-volume set of smart grid cyber security standards \u2013 but these standards are voluntary.\u00a0 FERC is working with the National Association of Regulatory Utility Commissioners<\/a> to monitor whether utilities are following these voluntary standards, but this is not enough.\u00a0 The threat of grid cyber attacks is too real, and the potential consequences too dire.\u00a0 The NIST standards should be mandatory and FERC\u2019s authority should extend to critical distribution infrastructure that puts the bulk power system at risk.<\/p>\n

Any new legislation should empower FERC to act proactively.\u00a0 FERC should have the means to take timely actions to counter clear and present dangers as they arise.\u00a0 Unfortunately, NERC\u2019s process for adopting cyber standards is slow and unwieldy.\u00a0 Because FERC\u2019s present jurisdiction is passive in nature, it can only approve standards developed by NERC.\u00a0 Congress should expand FERC\u2019s authority to act in case of emergency.<\/p>\n

Coordinated Enforcement<\/strong><\/p>\n

The appropriate boundary between federal and state control over electricity service has been disputed for over a century, since Thomas Edison\u2019s day.\u00a0 And, until recently, the manner of providing electric service had not changed much since Edison\u2019s era.\u00a0 The smart grid is beginning to modernize our energy infrastructure by marrying the Internet to the electric grid.\u00a0 Just as the Internet is a matter of interstate commerce, so are critical smart grid facilities that could disrupt the bulk power system.\u00a0 We can ease jurisdictional tensions by following an existing model that uses a federal-state partnership to enforce federal standards \u2013 interstate pipeline safety.<\/p>\n

Interstate pipeline safety standards are established by the Pipeline and Hazardous Materials Safety Administration<\/a> (PHMSA), a branch of the Department of Transportation.\u00a0 Although the PHMSA sets the standards, any state can assume responsibility for enforcing them within their borders.\u00a0 The state simply needs to follow the federal standards at a minimum and apply the same enforcement penalties.\u00a0 While not perfect, this federal-state partnership has generally succeeded in ensuring pipeline safety in a cost-effective manner.<\/p>\n

Information Sharing<\/strong><\/p>\n

We also need legislation to enable better practices for sharing information about cyber threats.\u00a0 At the moment, we have two venues where the government and utilities voluntarily share this information:<\/p>\n