Pierce County substation attack
| Industry | Electric utility; cybersecurity |
|---|---|
Area served | United States |
Key people | Brien Sheahan (Illinois Commerce Commission chairman and CEO), Robert Powelson (former FERC commissioner) |
| Products | Electrical power transmission and distribution; grid security services |
Security of the Electrical Grid in the United States encompasses both physical safeguards and cybersecurity measures protecting the nation's electrical grid. While the smart grid introduces greater efficiency benefits for both utility companies and consumers, it simultaneously brings about novel security vulnerabilities.
The U.S. electric utility sector spearheads efforts to secure the grid, working in partnership with federal bodies such as the National Institute of Standards and Technology, the North American Electric Reliability Corporation, as well as intelligence and law enforcement agencies.
Since the early 2000s, there has been growing apprehension regarding possible assaults by extremist groups and foreign operatives targeting the electrical infrastructure. Notably, cyber threats have shifted towards financially driven motives rather than purely ideological or terror-related intentions.
Overview
North America's power grid is an extensively interconnected network currently undergoing a transformation known as the "smart grid." This modernization seeks to boost reliability, enhance efficiency, and integrate renewable energy sources like wind and geothermal. However, incorporating digital communication systems into physical infrastructure elevates security risks.
Incidents involving attacks on the grid have increased throughout the 2010s and into the 2020s, with 2022 experiencing a record number of such events. Since 2014, acts of vandalism and physical sabotage have ranked as the second most frequent cause of disruptions to electrical service.
A 2012 report by the National Research Council underscored vulnerabilities in high-voltage transformers that are essential for maintaining grid stability. In October 2022, the FBI highlighted a rise in threats from racially or ethnically motivated violent extremists aiming to target critical infrastructure to provoke civil unrest.
The Department of Homeland Security observed that extremist groups, particularly white nationalist factions, use platforms like Telegram to share low-technology sabotage methods against power facilities with the intent to undermine governmental authority.
There remain ongoing concerns about cyber incursions originating from foreign nations such as Russia, which pose substantial dangers to U.S. electrical grid security.
Government oversight
Within the United States, cybersecurity standards for the bulk power system (BES)—which includes vital components necessary for operating the interconnected grid—are regulated by the Federal Energy Regulatory Commission (FERC). However, investor-owned utilities fall under state public utility commissions’ purview and thus lie outside FERC’s direct regulatory reach. Historically, resistance from industry stakeholders has limited robust federal oversight, with relatively few penalties imposed for noncompliance noted during the early 2010s.
Federal oversight of BES began following major blackouts: notably, the 1965 Northeast Blackout and a smaller outage in 1967 within the Pennsylvania-New Jersey-Maryland (PJM) interconnection spurred congressional intervention. This led to enactment of the Electric Power Reliability Act of 1967 and establishment of the National Electric Reliability Council (NERC) in 1968, initially composed of twelve regional organizations spanning parts of Canada and the U.S. By 1971, Regional Reliability Councils were formed to promote cooperation and reliability within BES operations; some regions later consolidated from twelve down to nine.
In 1997, NERC introduced its inaugural Operating and Planning Standards alongside certification programs aimed at improving BES dependability. Although post-9/11 security enhancements were implemented, a significant blackout in 2003 affecting half a million individuals exposed compliance shortcomings. This event prompted adoption of enforceable reliability standards approved in late 2004 and enforced starting April 2005.
The Energy Policy Act of 2005 granted FERC authority to certify an Electric Reliability Organization empowered to mandate compliance with NERC standards. NERC received this certification in 2006 and delegated enforcement responsibilities by 2007 to eight regional entities—including groups such as the Midwest Reliability Organization and Texas Reliability Entity. These regional bodies oversee mandatory enforcement of NERC Critical Infrastructure Protection (CIP) standards ratified by FERC in 2007.
As of 2024, six regional entities remain responsible for monitoring BES reliability and security by administering evolving NERC CIP standards designed to address new cyber threats and operational challenges while ensuring continued system stability and protection.
Cybersecurity
Ted Koppel, in his 2015 publication, points out that numerous utilities, particularly smaller ones, fail to completely separate their operational systems from internet access, thereby exposing themselves to considerable cyber risks.
In 2016, Russian cyber actors linked to the "Grizzly Steppe" group breached the computer network of Vermont's Burlington Electric, highlighting vulnerabilities within the U.S. electric grid infrastructure. Although the attackers did not interfere directly with the grid’s operation, malware was detected on a system isolated from the grid itself.
By 2018, two major developments complicated cybersecurity efforts in utilities: cybercriminals evolved to become more advanced and focused their attacks on industrial control systems rather than just corporate networks; concurrently, the grid’s growing decentralization and enhanced connectivity—largely driven by the expanding Internet of Things ecosystem—introduced additional security challenges.
Terrorist attack risk
As of 2006, the United States possessed over 200,000 miles of high-voltage transmission lines operating at 230 kV or higher. Fully securing this extensive network against terrorist threats is not feasible. Nevertheless, any such attack would likely result in only short-term disruptions. For example, damage to a single regional transmission tower would have limited impact due to the grid’s inherent robustness and its ability to recover swiftly from natural calamities such as hurricanes and tornadoes. Even well-organized terrorist groups would struggle to inflict harm on a scale comparable to moderate natural disasters.
Potential solutions
The utility sector is enhancing cybersecurity by forging partnerships with federal entities aimed at strengthening defenses against both physical and cyber threats. These collaborations involve organizations such as the National Institute of Standards and Technology, the North American Electric Reliability Corporation, along with intelligence and law enforcement agencies at the federal level.
In 2017, investments by electric utilities in grid security reached $57.2 billion.
In September 2018, Brien Sheahan, chairman and CEO of the Illinois Commerce Commission and member of the DOE Nuclear Energy Advisory Committee, together with Robert Powelson, former commissioner of the Federal Energy Regulatory Commission, stressed the importance of implementing more rigorous national standards and enhancing government coordination to combat cyber threats targeting the country’s power infrastructure. The U.S. Department of Homeland Security confirmed that Russian hackers had targeted control centers within American public utilities. Given the increasing interconnectedness of electric distribution networks—which support essential services including water supply, finance, healthcare, and public safety—Sheahan and Powelson advocated for synchronized regulatory efforts between federal and state authorities.
Certain utilities maintain dedicated cybersecurity teams: for instance, Baltimore Gas and Electric conducts frequent employee training exercises and shares threat intelligence with allied organizations; Duke Energy operates a corporate incident response unit around the clock that collaborates closely with emergency management and law enforcement agencies.
Several states have implemented mandatory cybersecurity protocols:
- New Jersey requires utilities to establish comprehensive cybersecurity strategies.
- Pennsylvania obligates utilities to uphold physical security, cybersecurity measures, emergency response plans, business continuity procedures, and mandates reporting of significant cyber incidents.
- Texas performs annual security assessments through its public utility commission.
In December 2018, U.S. Senators Cory Gardner and Michael Bennet proposed legislation aimed at bolstering national grid security by creating a $90 million fund to assist states in developing energy security initiatives. The bill also tasks the U.S. Department of Energy with identifying vulnerabilities within the electrical grid related to cyberattacks.
In March 2019, President Donald Trump issued an executive order directing federal agencies to prepare for electromagnetic pulse (EMP) threats. Subsequently, in May 2020, he signed another order prohibiting grid equipment sourced from foreign adversaries in an effort to safeguard critical infrastructure against cyber intrusions.
Electricity Subsector Coordinating Council
The Electricity Subsector Coordinating Council (ESCC) acts as the chief intermediary between the federal government and the electric power sector. Its purpose is to facilitate coordination of preparedness and response initiatives in the face of national emergencies or threats targeting critical infrastructure. The ESCC is composed of CEOs from electric utilities and leaders of industry trade organizations, collaborating closely with senior federal representatives from the White House, cabinet departments, law enforcement agencies, and national security entities.
California
During March and April 1975, a Pacific Gas and Electric substation suffered two bombings, leading to power outages affecting more than 22,000 customers. The New World Liberation Front claimed responsibility for these attacks.
Washington
On December 31, 1975, an electrical substation in Seattle was targeted by a bombing carried out by the George Jackson Brigade.
Arkansas
From August through October 2013, Jason Woodring executed several assaults on electrical infrastructure throughout Central Arkansas. His targets included power lines, a switching station, and electrical towers situated near Cabot, Scott, and Jacksonville.
Utah
In 2016, an individual in Utah used a rifle to attack a substation and subsequently received a federal prison sentence. Court documents disclosed intentions to assault additional substations.
Vermont
Also in 2016, the Russian hacking group known as Grizzly Steppe breached the Burlington Electric computer network but did not disrupt Vermont’s electrical grid. The malware was detected on a system that operated independently from the grid.
Jones County, NC
On November 11, 2022, vandals caused damage to a Carteret-Craven Electric Cooperative substation in North Carolina, resulting in power outages affecting over 12,000 residents.
Washington and Oregon
In late November 2022, multiple attacks—at least six—targeted electrical infrastructure across the Pacific Northwest region, including two incidents involving firearms.
Pierce County, WA
On December 25, 2022, four substations near Tacoma, Washington were vandalized, causing outages impacting more than 14,000 customers. Repair expenses are projected at approximately $3 million, with restoration efforts expected to extend up to three years.
Two men with previous theft convictions were apprehended on January 3. Authorities indicated their objective was to disable power as part of a larger scheme to burglarize nearby businesses.
See also
Further reading
- Campbell, Richard J. "Electric Grid Cybersecurity." Congressional Research Service. September 4, 2018.
- Katz, Jeff. "Ten Grid Security Considerations for Utilities." SecurityIntelligence. November 10, 2016.
- "Framework for Improving Critical Infrastructure Cybersecurity." National Institute of Standards and Technology. February 12, 2014.
- Gheorghiu, Iulia. "How Utilities Are Addressing Increasing Grid Security Needs." UtilityDIVE. May 22, 2018.