When at least one sniper attacked a substation in California last April, the power did not go out. But the incident did bring the issue of power grid security to a new level.
New reports about an attack on Pacific Gas & Electric’s (PG&E) substation in California last April raise questions about the vulnerabilities of the U.S. power grid. The Metcalf transmission substation was not a critical facility, but the Wall St. Journal speculated that the attack could have been a test ground for a larger attack.
The former Federal Regulatory Commissioner, Jon Wellinghoff, told the Wall St. Journal it was "the most significant incident of domestic terrorism involving the grid that has ever occurred" in the U.S.
The assault took place in the middle of the night when at least one person entered an underground vault at PG&E’s Metcalf substation and cut fiber cables. Soon after, one or more gunmen opened fire on the substation for nearly 20 minutes. They took out 17 transformers and then slipped away into the night before police showed up.
Despite the coordination, tossing around the word terrorism might be premature. The attack appeared planned, but for now, the Federal Bureau of Investigation doesn’t think a terrorist organization is involved.
No matter who carried out the attack, there are questions about how to balance investment against attacks both physical and cyber. Foreign Policy magazine reported that Wellinghoff has noted that the recent focus on cybersecurity has overshadowed the need to rethink physical security.
In many ways, utilities are much more capable of rethinking physical security, as they have been facing physical threats as long as the grid has been in existence.
“Long before the arrival of smart grid technologies, utilities have been protecting substation, generation facilities and control centers with physical controls,” grid security experts Andy Bochman and Steven Bucci wrote in a grid cybersecurity report [PDF] for The Heritage Foundation. For example, Consolidated Edison in New York quickly repositioned the angles of its security cameras after the PG&E attack, according to National Public Radio.
Cybersecurity, on the other hand, is a more novel threat to the utility industry, but one that utilities are increasingly focusing on. Utilities will spend more than $7 billion between 2013 and 2020 on security, according to research firm Zpryme. The spending could also help even if there is a physical attack.
Previously, utility operational technologies (OT) were largely siloed from information technology (IT) infrastructure, but utility investments in smart grid technologies are increasingly merging OT and IT. In the Metcalf attack, for example, grid operators were able to reroute power around the site to avoid outages. If more sensors and communications networks are distributed across the grid and substations are more automated, power can be rerouted automatically when there is a fault so that less people lose power.
The threat of attacks is just one driver for investing in the grid. Resiliency, a buzzword since Superstorm Sandy, has also led legislators to call for electrical grids that can withstand extreme weather events. Many of the technologies that would help isolate the effects of storms and heat waves could also be beneficial in the case of an attack on the grid.
On the transmission grid, for example, data coming from sychrophasors (phasor measurement units that take real-time measurements off of transmission lines about 30 times a second and timestamp them using GPS) could be used for advanced applications that could help stop a blackout from cascading.
Better coordination among utilities is one of the challenges to handling attacks, but that too is changing. Just last fall, the North American Electric Reliability Corporation ran a drill that addressed both cyber and physical attacks.
Image: iStockphoto
