Over the past month many news stories have appeared about the current power grid and its susceptibility to interruption by both attacks and natural causes. While the industry has been monitoring and dealing with weather-related outages for decades, only more recently have policy makers and regulators taken a more focused interest on the viability of the grid with respect to cyber and physical attacks.
A reliable power supply is the lifeblood of any modern society. Disruptions to everyday life are exponentially higher if an electric grid attack prompts a major power outage. Due to the significant public safety concerns, and the economic fallout resulting from even a short power outage, the electricity system “faces imminent danger” from cyberattacks. If an outage were to occur, communications to the public would be a critical link to recovery. Utilities must prepare now to be in the best position to communicate and maintain the public’s trust throughout the event and into the future.
BACKGROUND:
Two watershed events prompted major calls to action for a more resilient U.S. energy grid infrastructure:
- In April 2013, a highly coordinated sabotage attempt – which may have involved insiders – was staged against Pacific Gas & Electric’s Metcalf substation in northern California. Telephone wires were first cut underground to prevent alerts, and then gunmen fired more than 100 sniper shots on the facility, taking 17 transformers offline. Some believe this was a dress rehearsal of sorts for future attacks, and unfortunately, the assailants remain at large.
- In December 2015, a cyberattack on the Ukrainian energy grid left more than 225,000 people without power for an extended period, an incident that the U.S. Department of Energy recently labelled an “indicator of what is possible.” Experts say this assault holds many lessons, since control systems in Ukraine were surprisingly more secure than some in the U.S. An extensive investigation concluded the stealthy saboteurs carefully conducted many months of reconnaissance and theft of operator credentials before launching the synchronized assault.
Although recent federal legislation was introduced to address the cyber-attacks problem in the U.S., it’s likely to take years for the energy industry to achieve best practices for grid security. Here are some of the primary reasons why:
- Unknown attackers. Utility personnel are already busy responding to outages caused by Mother Nature, accidents and other common causes; however, ongoing cyber or physical attacks occur just as often. About once every four days, part of the nation’s power grid is struck by a cyber or physical attack. Suspects have never been identified in connection with many of the 300-plus attacks on electrical infrastructures since 2011.
- There is much to be done to improve physical security, at great cost and effort. Transformers and other critical equipment from tens of thousands of substations often sit in plain view, typically protected only by chain-link fencing and a few security cameras. In a July 2016 feature story in The Wall Street Journal, a Federal Energy Regulatory Commission (FERC) hearing revealed that “eight or 10 vans going to different sites to blow things up” would not be difficult to pull off, and recovery from such a coordinated attack could take months.
- Fixing grid security and oversight will be complicated and time-consuming. Questions continue to swirl about the effectiveness of the North American Electric Reliability Corporation’s (NERC’s) compliance system and penalties and whether FERC should play a greater role. Currently, the industry must identify which infrastructure parts are “critical” and vulnerable. This is a question that grows more complex with each passing month, as power systems become smarter and more networked (e.g., wind farms, solar panels, smart meters, cognitive intelligence, etc.) and the interconnections simultaneously raise the risk of cyber intrusion.
- Technological hurdles. Recent legislation is looking at analog- and human-operated controls to defend against attacks, which will not be easy to adopt given the surge of networked systems. The legislation is suggesting a two-year pilot of this recommendation, a far-too-slow step to address a pressing need.
RECOMMENDATIONS:
If a significant portion of the U.S. grid is taken down, communications will be a key lifeline for the U.S. public to maintain calm and remain informed on available health and safety options. Although federal officials will likely provide a means to communicate broadly, regional and local communications will need to be customized and amplified – and that responsibility will fall squarely on the utilities and State Utility Commissioners. Communications professionals in the industry must prepare now. Here’s a list of things to consider and adopt:
- Be ready to communicate differently. Utilities cannot rely solely on the emergency broadcasting system to get messages across. Well-prepared utilities will augment any remaining “airwaves” communications with mailings and possibly even local leafleting and megaphone updates from trained spokespersons at community centers.
- Don’t rely on that plan on the shelf. A response capability will always be more important than a response plan. Conduct frequent trainings to build clear understanding of protocols, roles and responsibilities. Before an incident occurs, test capabilities with simulation exercises to uncover any gaps in processes (especially since most technology systems may not be working) and ensure departmental alignment. Utilities must also determine if the response plan is comprehensive enough in scope to deal with a major grid failure.
- Be realistic and authentic about recovery efforts. Wise communicators will fight any industry urge to calm fears with optimistic projections of when power might be restored. It is much better to communicate and enumerate all of the things the experts are working to restore power with an authentic time-frame of recovery goals, all while communicating ongoing support options available for the public. These strategies need to be adopted and endorsed now, before an incident begins, to get utilities’ leadership on board with this effective approach.
- Expect fingers to be pointed. Nearly every large crisis situation has a period where government officials, regulators, lawyers, media and even the general public begin to second-guess why an organization wasn’t resilient or prepared enough to avoid the crisis in the first place. Understand that “we’re compliant” messaging isn’t going to work for the major energy/utility suppliers/leaders. Your customers will expect, and demand, more. Be ready to communicate about your redundancy plans and the ongoing training/testing your organization conducts to remain ready to respond. In fact, consider videotaping some of those training/testing exercises to demonstrate that the organization takes preparedness seriously. In the event of rumors or facts that suggest an “insider” was part of any plot, be ready to illustrate very robust hiring practices that may include background checks, anonymous tip feedback vehicles and ongoing oversight systems that help expose any wrongdoing.
