By Charles Landau, MPA & Kevin Sullivan, MPA

Winter Blockbuster

It’s an overused Hollywood trope: somewhere in a filthy bungalow, a punkish, brooding twentysomething math genius is typing inscrutable white lines of gobbledygook onto a black background. A questionable selection of metal or electronic dance music plays in the background while the young cyberwarrior aggressively sucks down energy drinks. Since War Games, the early-eighties classic, cyberwar has become a popular boogeyman for the silver screen. In 2007, Live Free or Die Hard, depicted a coordinated cyberattack that shuts power down for most of the east coast. In 2013, National Geographic released American Blackout, an over-the-top ‘what if’ story of a cyberattack that sets off the eponymous nationwide blackout.

No longer just a silver screen boogeyman, power companies, policymakers, defense and energy analysts are increasingly looking for ways to harden power grids against cyberattacks. In December 2016, Ukraine experienced a large-scale failure in the power grid that experts later attributed  to a Russian cyberattack. During the attack, operators were completely locked out of their computers while the malware cut power by about 20 percent in Kiev. In the U.S., the grid is transforming, and while some of the changes could make the grid more resilient to failures, others create new targets.

The Grid as an Onion

The U.S. power system is layered. At the top layer is Texas (ERCOT), which has its own power grid, as well as the Western and Eastern Interconnections. The grid is segmented among several regional transmission organizations and wholesalers like M.I.S.O. and PJM, as well as reliability councils under the North American Electric Reliability Council. Layers below that consist of a mishmash of utility companies, stakeholders, and legal jurisdictions. The system has faced challenges that come with a fleet of power generators that run on fossil fuels: timing peak power generation to meet peak demand, running high throughput power lines across long distances, and building substations that can handle intermediary connections.

This is the ‘hub and spoke’ model of power delivery, where central power plants send electricity out to the surrounding market. However, as more populous cities look to renewable energy and energy efficiency to help curb demand, smaller “microgrids” are popping up that can sustain power even if none is feeding in from the U.S. grid. When a microgrid is spread across multiple buildings and installations, they often use a distributed network model as opposed to the hub and spoke.

Spreading the Power Around

Managing microgrids is a complex challenge for policymakers, but the distributed model offers clear benefits for resiliency in the face of a serious cyberattack. A distributed power network has fewer critical elements that a cyberattack can target to bring the whole system offline. Unless a microgrid has a high value target for cyber attackers, we can consider it one less egg in our hub and spoke basket. Depending on battery capacity and the rate of generation onsite, these microgrids could run indefinitely while operators bring the external grid back up. Though some microgrids are set up that way, many have only a few minutes of grid-independent uptime.

Promoting a distributed network model is only half the solution. Our security strategy for the centralized grid needs to treat all hubs as high-value. The Department of Homeland Security made considerable headway to elevate the awareness of vulnerability and promote dialogue through Coordinating Councils and partnerships in recent years. In fact, the energy sector received high-level attention when it was called “uniquely critical” amongst other critical infrastructure sectors.

Lessons from NIST and the NRC

However, more needs to be done. Instead of taking a voluntary approach to improve sector security, the federal government should take definitive action to compel infrastructure stakeholders to adopt best practices. Standards for securing central generators should be nearly as stringent as those for special nuclear materials. And as we’ve seen around the world, terrorists or foreign hackers are more likely to compromise the electrical grid than get their hands on special nuclear materials.

The Department of Energy should create an agency analogous to the Nuclear Regulatory Commission. This agency could be responsible for coordination, control, and regulation of all elements related to the electrical grid and ensuring that appropriate systems are in place to protect this critical infrastructure. Many of the rules adopted by the NRC, such as 10 CFR Part 73 – Physical Protection of Plants and Materials, can be readily adapted for this use. A standard-setting agency specifically geared toward grid security norms could supplement security standards like the NIST Framework, support target hardening for microgrids and centralized power systems alike, and give industry stakeholders a common frame of reference for multilevel collaboration. If we get this right, we can leverage microgrids for big league gains in grid security and efficiency.