Industry Needs to Step Up to Protect the Power Grid From Cyber Attack

Energy companies should create a new industry-led body to deflect cyber threats to the electric grid -- from large generators to local distribution utilities, according to a new report co-authored by Ret. Gen. Michael Hayden, former CIA and National Security Agency director. 

Such an organization would include power companies across North America and be patterned after the nuclear industry’s Institute of Nuclear Power Operations, an entity established following the Three Mile Island accident in 1979. The paper, which was released on Friday by the nonprofit Bipartisan Policy Center, evaluates approaches to protecting the continent's electric grid from cyber attacks. 

"We believe such an organization could substantially advance cybersecurity risk-management practices across the industry," the authors write. 

The idea of a new governing body arrives at a time when critical infrastructure operators, including healthcare systems and banks, are increasingly concerned about the vulnerability of networks that would upend daily living if disrupted. 

The energy sector is somewhat ahead of the pack in reducing weaknesses because the U.S. government enforces mandatory cyber standards for the bulk power system, mainly high-voltage transmission facilities and large generators. But distribution vendors that deliver power to local customers are not part of that regulated system.

The envisioned North American body, which the authors dub the Institute for Electric Grid Cybersecurity, would oversee all the power industry players that could compromise the electric grid if hacked.  

"In some cases, cyberattacks on distribution system facilities could have consequences that extend beyond that system," the authors write. "Simultaneous attacks on multiple distribution utilities, or an attack on a single utility’s distribution operations in multiple locations, could have broader ramifications for the bulk power system."

In addition, attackers that hit one electricity sector component could imperil other interconnected vital U.S. sectors. "Electric distribution systems carry power to pipelines, water systems, telecommunications and other critical infrastructure, while also serving critical government or military facilities," according to the authors. "Distribution-level cyberattacks that disrupt electric service to such facilities could have important economic and security consequences."

The report notes that the 2003 Northeast blackout cost $6 billion. While that incident was blamed on a tree branch in Ohio, not a hack, a cyberattack combined with a kinetic attack, such as a bombing, could have the same effect. "A large-scale cyberattack or combined cyber and physical attack could potentially lead to even larger costs, triggering sustained power outages over large portions of the electric grid and prolonged disruptions in communications, food and water supplies, and healthcare delivery," the authors state. 

The new institute would not alter the two existing industry and federal entities that regulate solely the bulk power system: the North American Electric Reliability Corporation (NERC), a standards-setting organization, and the Federal Energy Regulatory Commission (FERC), the agency that enforces the standards. 

Mark Weatherford, the Homeland Security Department's former top cyber official, who previously served as chief security officer at NERC, was among the cyber, energy and national security specialists who contributed to Friday's report. 

The authors write that, "at present, we do not believe that there is a sufficient case for expanding FERC’s jurisdiction to encompass cybersecurity at the level of the distribution system.”

Participation in the institute would be optional. 

The federal government would persuade companies to join by treating "participation in the institute -- and satisfactory performance evaluations -- as equivalent to adopting the cybersecurity cramework to the extent adoption of the framework is required to be eligible for particular government programs or incentives going forward," the authors write. Earlier this month, the White House issued a voluntary framework of cyber guidelines applicable to all critical infrastructure sectors. It is expected that contractors who comply with the practices and policies will be rewarded with more government business. 

Other carrots suggested in the report include better access to insurance against economic losses caused by network breaches. Coverage initially would be guaranteed by the federal government. 

"A federal backstop would increase carriers’ willingness to offer cyber insurance and lower the cost of doing so,” the authors write. “In addition, a federal backstop would give carriers time to gather and review data about cyber incidents as they seek to develop policies that appropriately share risk."

Of the roughly 260 cyber incidents that critical infrastructure companies reported to the government last year, the majority -- 59 percent -- occurred in the energy sector, according to the DHS Industrial Control Systems Cyber Emergency Response Team.