Catastrophic grid attack? Here’s what it feels like

By Peter Behr | 07/23/2019 07:21 AM EDT

INDIANAPOLIS — As a new commissioner of the New Jersey Board of Public Utilities, Bob Gordon assumed his world would revolve around clean energy policies, rate regulation and infrastructure decisions.

Satellite imagery of the northeastern United States in 2003 before and during a blackout in New York. In a new exercise, regulators weighed ways to avoid a doomsday scenario for the grid.

Satellite imagery of the northeastern United States in 2003 before and during a blackout in New York. In a new exercise, regulators weighed ways to avoid a doomsday scenario for the grid. National Oceanic and Atmospheric Administration Defense Meteorological Satellite Program

INDIANAPOLIS — As a new commissioner of the New Jersey Board of Public Utilities, Bob Gordon assumed his world would revolve around clean energy policies, rate regulation and infrastructure decisions.

"I don’t think we ever considered we might be ground zero in a superpower confrontation," Gordon said.

But here Gordon was with regulatory colleagues from around the United States, role-playing what they could face following an existential destruction of the power grid across the eastern United States from the detonation of an electromagnetic pulse (EMP) weapon in the atmosphere. The workshop Sunday led off the summer policy meeting here of the National Association of Regulatory Utility Commissioners.

Advertisement

In the four-hour session created by the Electric Infrastructure Security (EIS) Council, actors playing the parts of helpless federal disaster officials appeared in a series of video clips as the attack mushroomed from a blackout to a catastrophe.

Within a week, power-starved water and wastewater systems failed. Food, medicines and fuel supplies ran out, and millions of motorists fleeing unheated homes in freezing wintertime turned highway escape routes into impassable death traps.

Now is the urgent time for regulators to think about the question that would haunt them after something even approaching a disaster of that magnitude, said John Heltzel, the EIS Council’s exercise director.

"What should we have been doing" while there was still time? he asked.

"Convene a meeting. Find out if my state is ready or not," Heltzel said. "If you don’t get a feeling that action items are being addressed, then be part of the dialogue."

State commissions have a unique capacity to bring together state executives, legislators, law enforcement, National Guard elements and critical infrastructure operators, one participant said.

Heltzel agreed, adding that the need is particularly vital in the case of municipal agencies supplying water and managing waste treatment. When those systems collapse, cities lose the ability to keep people in their homes to shelter in place. "Evacuate Boston" in winter? Heltzel asked. "Are you crazy?"

"Most water and wastewater utilities tend to be small and underfunded and worried about replacing century-old equipment rather than thinking about how do I back up power," said Alison Silverstein, a former senior policy adviser at the Federal Energy Regulatory Commission who took part in the exercise.

"It is a problem we have not confronted effectively as a society," she said, referring to the impact of an extended water and waste treatment outage. "We haven’t figured out how to fund and protect ourselves because we lurch from disaster to disaster. We haven’t had a big water or waste systems fail in ways that force us to confront this sort of disaster."

‘We’re not in the loop’

The EIS Council has led research and policy analysis on a small list of extreme "black sky" crises that could hit energy infrastructure, including damaging electrical currents unleashed by a "once-in-a-century" solar storm, a sophisticated cyberattack and an EMP weapon.

Beginning next month it will host a public, online disaster exercise called Earth Ex 19 to let the public stand in the shoes of officials in a crisis.

In the scenario presented to NARUC members Sunday, a nuclear weapon was fitted to a missile and launched at the United States from a freighter offshore.

"The scenario might be a little far-fetched, but it’s not incredible," Silverstein said. "It’s very important for regulators and other people with these responsibilities to be thinking about significantly worse cases with less happy outcomes than in the garden-variety disasters that we deal with every day."

After the EMP exercise wound up, Heltzel asked the group to consider the impact of a multistate cyberattack that took out 85% of the grid’s control systems.

Commissioners who spoke at the meeting described a patchwork of preparation by various states for natural disasters and dangerous cyberattacks. Smaller power utilities are not equipped to withstand an advanced, state-backed cyber assault, according to researchers for the Vermont Law School who are in the midst of an investigation of the issue supported by a grid security advocacy organization, Protect Our Power (Energywire, April 15).

"There is not a good body of work for a comprehensive analysis of where cybersecurity matters stand in the states," said Richard Mroz, a senior adviser to Protect Our Power and former president of the New Jersey utilities board, speaking to E&E News in February. "The [cyber] sophistication in each state is different," he added (Energywire, Feb. 11).

"We’re not in the loop," one commissioner said Sunday.

Heltzel also showed a video presenting the same actors responding to the same EMP attack — but this time from a foundation of nationwide preparation.

In this enactment, a critical difference was the survival of a shielded national emergency communications system that permitted a strategic response to the crisis by government and infrastructure operators and coordinated recovery actions by federal and state agencies under the existing Emergency Management Assistance Compact system.

The "good news" scenario script provided that states had established emergency operations centers and had implemented "power outage incident annexes," a planning document created by the Federal Emergency Management Agency. One exercise participant commented: "I would venture to say, fewer than 10 states have even the framework for a POIA now."

Scott Aaronson, vice president for security and preparedness at the Edison Electric Institute, updated the session about the power industry’s preparation of a grid emergency playbook of actions that would be ordered by the secretary of Energy in a presidentially declared national grid emergency.

In the EMP scenario the NARUC members played out, power in the western U.S., which escaped the blast, could be cut by 25% to permit the battered grid in the eastern half of the nation to run at 25%, Aaronson said, to keep more people in their homes while recovery proceeded.

Heltzel recognized that funding to prepare for a catastrophe that seems far over the horizon is hard to secure at a time when utilities and power companies are trying to replace aging infrastructure and transitioning to entirely new generation sources.

"Try different approaches," he said. "One is simply to say, let’s look at what resilience investments are being made in states and regions for conventional hazards. We could assume there is a percentage [of that amount] for extreme events. Zero is too low. Fifty percent is too high. It can be decided in discussion."

"It’s not just planning," said Avi Schnurr, the CEO of the EIS Council. "It is how to move from planning to implementation, to do it and exercise and train over and over and over again."