Feds fear coordinated physical, cyber-attacks on electrical grids.

• Author: Magnuson, Stew
• Position: Homeland Security News

Electrical grids in the United States are vulnerable to both cyber-attacks and space weather, federal officials have said.

[ILLUSTRATION OMITTED]

But an assault that combines the skills of a hacker with a physical attack on key parts of a grid's infrastructure may result in hundreds of millions of U.S. homes and businesses losing electricity

"I am most concerned about coordinated physical and cyber-attacks intended to disable elements of the power grid or deny electricity to specific targets, such as government or business centers, military installations, or other infrastructures," Gerry Cauley, president and CEO of the North American Electric Reliability Corp., said at a recent Senate hearing.

Scott Pugh, of the Department of Homeland Security's interagency program office, said at an energy conference in April that there are maps--not available for public viewing--that "show you a handful of substations--six or so--[where] you could take out those six substations and black out most of the U.S. east of the Mississippi, if you knew which six [they] were. And in many cases you could do it with a hunting rifle from a couple hundred yards away.

There are some 1,500 companies that generate electricity in the United States, and the hodgepodge of federal agencies that oversee them have limited statutory authorities to force them to protect themselves against attacks, the Senate Energy and Natural Resources Committee hearing revealed."

"Limitations in federal authority do not fully protect the grid against physical and cyberthreats," Joseph McClelland, director of the office of reliability at the Federal Energy Regulatory Commission, said.

Legislation passed in 2005 gave the agency the authority to impose reliability standards on "bulk," or large-scale, power systems. That law excludes local distribution facilities, federal installations located inside grids, and major cities such as New York. Hawaii and Alaska also don't fall under the commission's jurisdiction.

Officials are concerned about two threats: electromagnetic pulses, which come from solar storms or weapons, and cyber-attacks, particularly on "smartgrids," which it turns out, are not very "smart" when it comes to protecting against hackers.

"No single security asset, technique, procedure or standard--even if strictly followed--will protect an entity from all potential cyberthreats," said Gregory Wilshusen, director of information security issues at the Government Accountability Office...