How Vulnerable Is Our Power Grid?

coreboarder writes "Recently it was divulged that the Brazilian power infrastructure was compromised by hackers. Then it was announced that it was apparently faulty equipment. A downplay to the global public or an honest clarification? Either way, it raises the question: how vulnerable are we, really? With winter and all its icy glory hurtling towards those of us in the northern hemisphere, how open are we to everything from terrorist threats to simple 'pay me or else' schemes?"

Comments

One word: Enron

[goodmanj]

Hijacking the power grid and forcing entire states to pay ransom or suffer brownouts? Such a thing has never happened before!

http://en.wikipedia.org/wiki/Death_Star_(Business)

Re:One word: Enron

[Shakrai]

The military is it's own animal. But in 38 states (the blue and yellow ones on the map) you can easily obtain a concealed carry permit as a civilian, provided that you aren't a felon or mental case. In some of the remaining states you can also obtain one, though you may have to jump through additional hoops. The only two states where you absolutely can't get one are Illinois and Wisconsin.

It's probable that in a few years that you will be able to obtain one in all 50 states. SCOTUS is on the verge of incorporating the 2nd amendment against the states. Once that happens we can begin to dismantle the unconstitutional restrictions placed on our right to keep and bear arms by some of the more urban states.

Point being, that you have whatever chance you are willing to give yourself. Personally I carry everywhere that it's legal to do so. I hope and pray that I never have to use it. Should the day come though I won't be cowering under a desk waiting to be murdered by some mental case or Mumbai copy-cat.

Re:One word: Enron

[TubeSteak]

Point being, that you have whatever chance you are willing to give yourself. Personally I carry everywhere that it's legal to do so. I hope and pray that I never have to use it. Should the day come though I won't be cowering under a desk waiting to be murdered by some mental case or Mumbai copy-cat.

Most incidents of gun violence are domestic &/or perpetrated by someone you know.
Here's a prominent example that was in the news recently

Re:One word: Enron

[MartinSchou]

Should the day come though I won't be cowering under a desk waiting to be murdered by some mental case or Mumbai copy-cat.

But you might be shot by someone else carrying a concealed weapon who thinks you look a bit too suspicious and figures it's better to shoot first and ask questions later. After all, you had a gun ;)

Pay me or else?

[bunyip]

Suppose someone holds the nation's power grid hostage and then wants payment? So, why doesn't the government simply pay them, then track them down for assassination and release photos of their bullet ridden corpses? Would certainly discourage any copy-cat crimes. Somali pirates too.

Just a thought...

Re:Pay me or else?

[interploy]

Funny, as I recall I have to pay my electric bill every month "or else" even now... Damn, the terrorists have already won!

Major Brazil Power Failure Yesterday

[rsmith-mac]

Speaking of Brazilian power failures, Brazil had another major power failure yesterday. Power from the Itaipu dam was cut off, which apparently put millions of people in the dark as it generates something like 14GW. Itaipu blames the Brazilian grid, meanwhile Brazilian officials aren't sure what it was, but are protesting any idea that it was sabotage/hacking. Paraguay and Uruguay also get power from Itaipu and were similarly affected.

http://www.cnn.com/2009/WORLD/americas/11/11/brazil.blackout/index.html

Re:Major Brazil Power Failure Yesterday

[Extremus]

According some reports, it was probably caused by the weather. Two main high-voltage power lines faulted simultaneously, causing part of the system to shutdown for safety. So, no hackers this time, I guess.

How is that any different....

[Anonymous Coward]

than the current local power monopolies? We are already in a "pay me or else" scheme which threatens lives and leaves us with this vulnerable infrastructure in the first place. And, unlike the "terrorists", the power companies have the cojones to stand before Congress and admit the control systems are vulnerable, the transmission grid is old and failing, the expected load in the next 15 years can't be handled and then claim its not their problem, its too expensive and the government needs to pay for it. As if they aren't taking enough on the front end from the consumer, they want more off the back end too.

Sickening.

View from a US citizen living in Brazil.

[Mark_in_Brazil]

I've been living in São Paulo for over 9 years. I was without electrical power for a few hours last night.

The timeline on this is pretty entertaining. On the 7th, there were a bunch of stories saying the 2007 blackouts in Brazil were caused by crackers (the articles say "hackers"). On the 9th, there were strong denials all around, accompanied by stories saying that no, the 2007 blackouts were caused by "sooty insulators." On the 10th, Brazil suffered a blackout much worse than the ones in 2007. That looks to me like crackers saying "sooty insulators? We'll show you sooty insulators!"

By the way, power failures are normally abrupt, but the one last night was not. I usually go from lights to no lights almost instantaneously, but last night, the lights were flickering for a while. After a few minutes, I thought it was going to stabilize, because my compact fluorescents stayed on while my UPS beeped a lot to tell me it wasn't getting enough juice. The larger fluorescents in the kitchen couldn't start, but the compact fluorescents gave me some light in the living room.

How vulnerable is *your* power grid?

[GuyFawkes]

I'm writing from the UK, so no matter what happens to *your* power grid, it won't affect *our* power grid.

Before you can get a sensible answer, you need to learn to ask a sensible question.

In any event, *your* power grid has already proven to be incredibly vulnerable to everything from single points of failure to social engineering for profit (Enron) so, quite frankly, worrying about the vulnerability of *your* power grid to hacking is like wondering about the vulnerability of a shiny new laptop left unattended on a car front seat to hacking... you have other issues to need to address first.

It is like wondering how vulnerable *your* road bridges and infrastructure are to hacking, while completely ignoring the fact that they are falling down by themselves due to lack of maintenance.

Re:A bigger threat

[plague3106]

Actually it was Enron illegally manipulating the market which lead to the rolling blackouts. Notice they stopped shortly after the collapse of Enron and the arrest of those that hatched the schemes.

I read that link; appearly you think companies should be able to do whatever they want to public resources without restriction. I don't buy that nonsense, nor do I think corporations care about anything but squeezing money out of people. We allow them exist to serve a public good, not because they have any right to existence.

The "bribing" described in the article was Eddison trying to convience the local government that it would be worth it to install an electric grid. He proved to be right, but not every idea that comes along would pan out like that. The government is supposed to represent the people, and the people shouldn't have the roads they paid for torn up at the whim of a corporation, so the corporration (or Eddison) needs to convince OUR representives that there's something in it for us.

Speaking for generation, NOT VULNERABLE

[rift321]

Speaking as a controls engineer for a major utility contractor, the control systems for power plants are completely isolated from the internet... it's common sense. There are security consultants out there feeding FUD to the public about the vulnerability of these control systems to viruses planted (either knowingly or unknowingly) by plant personnel. Well, if someone had intimate knowledge of the software AND close ties to the operators AND really thought that bringing down the plant would be a good way screw everyone over, despite the fact that when things go wrong, all valves and systems return to a fail-safe position, AND once the software was re-installed, everything is easily restarted...

Yeah, I guess it could happen. As far as the grid is concerned, I'm *guessing* that a lot of people were influenced by the same method of thinking.

Look, if anyone really wants bring down the power grid, we should be worried about a physical attack WAY more than an electronic one. I just can't conceive of how our systems are as vulnerable as people say they are.

I wasn't affected, fortunately, and followed it RT

[kusanagi374]

I live in Rio Grande do Sul, in a region where we have smaller power dams that supply more than enough energy for us to keep running without Itaipu, and I must say it was quite interesting to follow everything from here in real time. I was chatting with a friend of mine from Rio de Janeiro, and we were about to play some Mario Kart online, when suddently she sends me an SMS in 22:14 telling me "You're not gonna believe it, but the entire city of Rio de Janeiro has no energy. Even the Cristo Redentor doesn't have any light, and I've never seen that happen in my entire life!". A few minutes later she comes back online using her notebook and a 3G modem, retwitted the infos I sent her to her friends, and following my suggestion took a couple of pictures of what she was (un)able to see.

I then called her and she proceeded to tell me about how chaotic things were on the streets, that basically the traffic was jammed, all buildings nearby had people locked inside elevators and she could hear the cries for help, and until 5 minutes after the blackout all cellphone lines were jammed too. I then kept following the news on portal websites and Twitter and reported back to her in real time to let her know what was happening and how big things where, although she had already contacted friends throughout the country and kind of knew the places that were online and the ones that weren't.

I must say it was quite an experience to follow things in real time and inform someone right there about it, and I guess she was "thrilled" about it too, even though she's afraid of the dark. :(

Here are the photos she managed to take:
  - http://img137.imageshack.us/img137/1382/foto1jm.jpg
  - http://img81.imageshack.us/img81/5272/foto2b.jpg

How many times need this question be answered?

[anorlunda]

The question of grid vulnerability comes up again and again. Every time, it is treated as if the question was novel and never addressed before.

I work in the industry. My view is not that cyber security is being neglected. On the contrary, it seems more like the situation in the Grand Canyon where there were 30 anthropologists for every Indian being studies. Homeland Security and DOE Tiger teams and security auditors swarm like flies around the operations centers. Each of them looks forward to fame and fortune if they expose the one big unaddressed vulnerability.

The most recent fully public test of the grid's vulnerability was the Y2K scare. Many people, including renowned experts such as Capers Jones, figured that there would be no way the grid could survive Y2K without numerous incidents. The actual grid incident count on the night in question was zero. No hacker could conceivably create a more ubiquitous and more diverse cyber challenge to the grid than Y2K.

What about robustness and vulnerability to chains of failures? It is true that regional blackouts do occur. Every incident can be traced to a chain of failures. However, earthquakes, hurricanes and especially ice storms every year challenge the grids with multiple simultaneous failures; sometimes hundreds of thousands of simultaneous failures without triggering cascades. Do you really think that a hacker could think up something more challenging than an ice storm?

One thing not appreciated is the design criteria. The NERC criteria for blackouts is that blackouts affecting more than 10 million people should not happen more than once every 10 years. Using NYC as a benchmark, it was blacked out in 1965, 1977 and 2003.

The public, on the other hand, thinks erroneously that the grid should be infinitely reliable and that every regional level blackout represents an avoidable failure, and that each blackout reduces confidence in the system.

Ironically, people who live in places with frequent loss of electric service, such as India, adapt so well that it causes minimal disruption. It is a paradox that the more reliable electric supply, the less well prepared the public becomes for outages and the more neurotic they become over hypothetical threats.

Re:Old Axiom

[Duradin]

Damn, it must be awesome to have built your generator from the ground up!

Mining the ore, refining it, casting it, forming all the wiring. How long did it take?

Did you start with stone tools and work your way up too?

What sort of fuel are you producing for it? Are you working your way through the agricultural stages so you can be sure you know how your crop works if you are using a bio fuel? Which wild plants did you decide to domesticate?

Civilization works because everyone doesn't have to know everything. Not having to individually reinvent the wheel for every task and tool is why we can make progress.