Lawmakers Told US Power Grid is Vulnerable Without More Protection

PINEHURST, N.C. — A congressional panel considered options Friday for enhancing security of the nation’s power grid as the federal government continued to ward off another cyberattack traced to a Russian gang.

The Energy Department was one of the agencies that was hit. Hospitals — such as Johns Hopkins in Baltimore, Maryland — as well as universities and agencies of foreign governments also reported the intrusion into their data.

No blackouts were reported but the incident served as a reminder of other attacks in recent years that shut down power systems in the United States and abroad.

Energy industry witnesses at the hearing of the House Energy and Commerce Subcommittee on Energy, Climate and Grid Security identified cyberattacks as an increasing vulnerability for the nation’s power grid.

The U.S. power grid is spread among more than 730 power plants, 50,000 substations and millions of miles of cables to carry the electricity into homes and offices.

“The challenge of protecting it is immense and it’s growing,” said Rep. Jeff Duncan, R-S.C., the subcommittee chairman.

The subcommittee held the field hearing in Pinehurst, North Carolina, which was the site of a Dec. 3, 2022, attack that shut off electricity to about 45,000 homes in Moore County. It resulted from an unknown person firing gunshots into substation generators. Power was restored by Dec. 7.

“I think we can learn from what happened here, what could happen somewhere else,” said Rep. Richard Hudson, R-N.C.

Weeks later, burglars damaged four electric distribution substations in the Tacoma, Washington, area, causing millions of dollars in damage and cutting power to about 30,000 utility customers.

On Feb. 6 of this year, the Justice Department announced the arrest of two persons planning to attack five electric power transmission substations around Baltimore.

The most devastating cyberattack so far was the May 7, 2021, attack on the Colonial Pipeline oil pipeline system that originates in Houston, Texas, and carries gasoline and jet fuel mainly to the southeastern United States. The ransomware attack linked to a Russian gang impacted computerized equipment managing the pipeline for six days.

Among potential solutions being considered in North Carolina and in Congress is development of “microgrids.”

Rather than generating power from a single source spread across several counties or large cities, electricity would be distributed to much smaller areas. If severe weather, equipment failures or cyberattacks shut down generators, the blackout would be limited to lesser microgrids.

Other measures being considered would require utilities to warehouse key equipment at each power station to quickly replace any systems that fail. Lawmakers also suggested more aggressive law enforcement against saboteurs.

Even as the subcommittee discussed solutions, Mark Aysta, managing director of security for energy giant Duke Energy, said, “No utility can completely eliminate the risk of attack.”

He suggested striving for “grid resiliency” with redundant safeguards that would help utility customers “recover faster from attacks and other adverse events.”

His words of caution were echoed by Jordan Kern, a North Carolina State University engineering professor whose team builds software that simulates failures of power grids to help utilities prepare for them.

More intense hurricanes and heat waves from climate change, as well as increasingly sophisticated cyberattacks, are making the “stress tests” he performs with Energy Department support more difficult, he said.

Adding to the unknowns is the nation’s switch to electrical vehicles, Kern said. The vehicles are recharged by electricity, which could leave some owners with no transportation in prolonged blackouts.

With limited electricity, they could be forced to choose “whether they power lifesaving devices in their homes or whether they get out of there,” Kern said.

Any new federal regulations would be overseen by the Energy Department, where damage from this week’s cyberattack still was being assessed Friday.

The U.S. Cybersecurity and Infrastructure Security Agency said in a statement that it was helped in the response by the Energy Department and several other federal agencies “that have experienced intrusions affecting their [file transfer] applications.”

“We are working urgently to understand impacts and ensure timely remediation,” the statement said.

You can reach us at [email protected] and follow us on Facebook and Twitter