The Thwarted Baltimore Grid Attack is a Wake-Up Call on U.S. Grid Cybersecurity

By CHHS Extern Peter Scheffel

On Monday, February 6, 2023, two individuals were arrested by the FBI on criminal complaints of conspiracy to destroy an energy facility in connection with a plot to attack multiple substations in the Baltimore area. While this physical attack (the individuals intended to shoot the targeted substations) was thwarted, it highlights a growing trend in planned and carried out attacks on the U.S. electrical grid. One such attack occurred in December of 2022 in Washington state, where two individuals who were later arrested shot at four electrical substations in Pierce County. This event left more than 15,000 people without power. Likewise, North Carolina experienced a targeted physical attack in December 2022 on their energy infrastructure (also by way of gunfire), as individuals damaged two substations in Moore County. The North Carolina attack arguably led to the most dramatic response in which due to the high number of people affected (100,000 residents in Moore County, tens of thousands of which without power), schools were closed and a curfew was imposed.

Both the carried-out attacks in Washington State and North Carolina as well as the attempted attack in Baltimore indicates an increasing awareness by malicious actors of the U.S. power grid’s importance and its vulnerability to both physical and cyber-based attack. Thus, these attacks should serve as a harsh reminder of not only the need to increase preventative measures against physical attacks on the U.S. grid, but also to remind that the grid remains vulnerable to cyber-attacks. In the often-hasty rush to secure the physical aspects of the grid post physical attack, a danger exists in overlooking the equally necessary cyber-related vulnerabilities present. As the grid continues to be modernized and as we continue to electrify cars, replace furnaces with electric heat pumps, and connect substations to the internet, a more comprehensive preventative strategy is needed.

One of the main areas of risk are grid distribution systems, which often take the form of a pole near homes and businesses and serve as the final stage of the electrical grid, distributing electricity to homes, industry, and other end users from transmission systems (large structures often seen beside interstates and other roads which carry the high voltage electricity to the distribution systems). Grid distribution systems have become more vulnerable to cyberattack chiefly because they are increasingly allowing remote access and connections to the internet. This leaves open the potential for malicious actors to enter the system and create problems. According to the Director of National Intelligence’s 2022 Annual Threat Assessment, both nation-states and criminals are the greatest cyber threats to the U.S.’s critical infrastructure, including the electrical grid, and their capacity to attack successfully continues to increase. The U.S. Government Accountability Office (GAO) in 2021 even found that the federal government lacked sufficient awareness and understanding of the severity in scale of potential attacks on distribution systems, which are not subject to the Federal Energy Regulatory Commission (FERC). The absence of FERC regulatory authority over distribution systems results in a less cohesive strategy which fosters an environment susceptible to exploitation at a crucial stage of energy reliance: distribution to end users. An earlier GAO report, in 2019, also highlighted the need for changes to increase cybersecurity measures within the grid. These recommendations are not yet fully implemented, thus leading to continued vulnerability in the grid. While it is important for FERC to prioritize the first two aspects of the grid over which it has authority: generation and transmission, working with state partners is equally important to better protect distribution systems.

One stark example of the risks of an unprotected grid is the Russian-linked attacks just before Russia’s invasion of Ukraine last year. Hackers connected to Russia got incredibly close to taking out a large piece of the U.S. power grid through cyberattacks using malware during the first few weeks of Russia’s invasion of Ukraine. The attack included the use of malware called PIPEDREAM to take down up to twelve U.S. electric and liquid natural gas sites. The potential success could have been devasting, leading to possible loss of life. In addition, such a large and successful attack on U.S. critical infrastructure could have been seen as the “9/11” of the cyber-sphere, leading to sweeping changes to U.S. law and policy in response. Thankfully, these attacks were not successful (though the coalition of U.S. government and cyber industry groups which prevented the attack did not disclose how it was prevented). According to experts, this was the closest the U.S. has ever been to having its infrastructure go offline from a cyberattack.

Encouragingly, when combined with the spate of recent physical attacks, this now disclosed attempted cyberattack on the U.S. power grid may have spurred action that could and should continue in order to prevent such attacks. As of January of 2023, FERC is working towards developing new cybersecurity rules. These include the U.S. Department of Energy funding next-generation cybersecurity research and development projects, a software bill of materials (an ingrained inventory or list of ingredients that make up software components) required for certain energy vendors or other grid related services, and required disclosure of what components go into grid software. While a good start, distribution systems remain vulnerable as they are not subject to FERC authority. In order to better protect distribution systems, state legislative policy is needed. States must understand their role in protecting distribution systems and should prioritize increased grid cybersecurity within their borders. A great example of such measures is via the state of New York, which recently adopted legislation that will require utilities to prepare for cyberattacks in their annual emergency response plans. To implement this legislation, the New York Public Service Commission was given enhanced auditing powers so that critical infrastructure and customer data would be secured. The commission is also directed under the law to provide necessary rules and regulations, and operates under a mandate to provide a report to elected officials, reviewing compliance and providing recommendations to the legislature on if additional measures are needed.

Grid cybersecurity is often seen as an afterthought and becomes a response to an attack instead of a tool of prevention. As the grid continues to modernize and gain connectivity to the internet, cybersecurity must be prioritized as much as better physical fencing and concrete barriers. Should a successful attack go through such as the one Russia-affiliated hackers attempted, waiting to respond will prove costly beyond monetary value alone. In order to remain resilient despite ever growing reliance, the U.S. power grid must prospectively implement sound policy and continue to pursue actionable measures at both the state and federal level.