Electricity Grid in the U.S. Penetrated by Spies

April 8, 2009 8:20 AM

According to an article posted in today's Wall Street Journal, the electricity grid in the U.S. has been compromised by foreign spies, leaving it vulnerable to disruption. Last year, the CIA acknowledged that the system had been compromised and that the goal had been extortion. In response, the Federal Electric Regulatory Commission issued new cybersecurity specs for the power grid, to which companies such as GE have begun responding. But could it be that the new security efforts are motivated by government officials who stand to gain by this attempt at drastically increasing government control over the Internet?

Note: Paranoid views of last blog post do not necessarily reflect those of this poster, but I thought it a valid concern as we deal with this huge security concern, especially in light of the recent flap over Presidential powers to control the internet.

posted by Roach (29 comments total)

I prefer my electrical grid be disrupted by god-fearing Americans. Like Enron.
posted by chasing at 8:29 AM on April 8, 2009 [5 favorites]

Knowledge K = Power P = I × V = R × I2 = V2 ⁄ R, where Power P is in WTFs, Potential Energy V is in Vast Right-Wing Conspiracies, Current I is in DC Asshats, and Resistance R is futile.
posted by It's Raining Florence Henderson at 8:44 AM on April 8, 2009 [7 favorites]

I've written some software for an electricity generation company that they use to manage their output. They've talked about linking the software with their control systems to automate the process.

The second sentence scares the crap out of me, and if a room of smarter-than-me people have some good ideas on how to make it less likely that software is compromised, I'm all for it.
posted by lowlife at 8:52 AM on April 8, 2009

Power companies are another one of those half-assed attempts to privatize a naturally public good. Sure, you have all this faux-competition going on, but its all over the SAME GODDAM WIRES. If the owners of the wires don't have to compete with other sets of wires (wouldn't that be wonderful to deal with?) then what motivation to they have to keep our grid up to date or even secure? Why should they? The government will eventually come in and give them lots of money to improve everything, at least in terms of security.

How we manage our private and public goods and mix the two up in the country really irks me sometimes.
posted by cimbrog at 8:53 AM on April 8, 2009

Ah, sorry, personal gripe there. There's more to it than I just wrote in terms of cyber-security, but I am still irked by the public/private aspects.
posted by cimbrog at 8:54 AM on April 8, 2009

When you plug in your toaster, you are cooking with COMMUNISM!
posted by DU at 9:00 AM on April 8, 2009

When you plug in your toaster, you are cooking with COMMUNISM!

E = MC Hammer and Sickle Red Squared
posted by It's Raining Florence Henderson at 9:06 AM on April 8, 2009 [1 favorite]

Computerworld has an article on this, too.

If there's any conspiracy afoot, I'd argue it might be one to undermine support for a national transition to smart grid technology. Russia has pretty sizable oil interests, so it'd make sense they'd be opposed to any measures aimed at reducing US dependence on oil, if only on the basis of their own national interests, considering what a decline in US demand would mean for oil prices on the global market.

And since our own government is, IMO, probably lousy with energy industry infiltrators thanks to Bush/Cheney opening the floodgates to their crew of Halliburton and Enron pals, this could be political theater, carried out with the help of insiders.

Not to say smart grid won't pose unique security risks. But this story kind of demonstrates that even pre-smart grid, our grids aren't particularly secure. So if this is a political stunt for undermining smart grid, it's not a particularly effective one, because just carrying the logic one step further makes it an argument in favor of smart grids, with the potential opportunities for enhancing grid security the implementation of new systems could also present.
posted by saulgoodman at 9:08 AM on April 8, 2009

James Gosling, the guy who invented Java, told a story about sitting on a plane next to a programmer who wrote code for control systems for airplanes. When the programmer found out who he was, he told Gosling that he was very glad Java came along, that it was a net plus for control systems. Gosling was surprised because Java, at the time, was getting a lot of flak for being fat and slow and inappropriate for anything mission critical; he told the programmer this, mentioning that the old standby of C seemed more appropriate. The programmer replied that Gosling didn't know how badly his colleagues were writing C, and that the built-in restrictions of Java, especially its garbage collection model, were desperately needed to improve the overall quality of the codebase that controls the nation's infrastructure.

Having said that, a nice bit of scary fiction: The Great Cyberwar of 2002. Liddy Dole is president--awesome.
posted by fatbird at 9:09 AM on April 8, 2009 [2 favorites]

BTW: I don't personally believe the inside-conspiracy I just pitched above. Just offering it as an equally plausible (meaning, pulled straight out of my ass) alternative to the conspiracy that the last link suggests.
posted by saulgoodman at 9:12 AM on April 8, 2009

But this story kind of demonstrates that even pre-smart grid, our grids aren't particularly secure.

It's long seemed to me that, with a very small amount of coordination, or not even with much coordination at all, just patience, some clever electronics-and-plastic-explosive devices, and the willingness to drive around the country for a while setting things up, it wouldn't take bringing down THAT many of the electric towers positioned around the country to cause the grid to collapse in difficult to fix ways. Figure out the weak points, set up the cell phones to trigger on receiving a text, and then send out a broadcast SMS to all the triggers simultaneously...

Or would it? I'm not schooled in the concepts, but simple lack of security around the hardware seems to be a lot more of a weak point than the cyber angle.
posted by hippybear at 9:21 AM on April 8, 2009

Let's all agree to air as many bullshit conspiracy theories as we can think of. After all, THEY CAN'T BE DISPROVEN.
posted by alexwoods at 9:23 AM on April 8, 2009

When I first heard about this, I got to thinking about how spy stuff works; where a decade or two ago, some foreign agents were sent on a high risk mission into the US to implant software into our power grid so that they could monitor it. And then, due to budgetary cutbacks, the agency involved was closed and the employees retasked to some other project. Eventually, the black-ops code is completely forgotten.

Then some kid hacker in Russia finds an old command line that, when they experiment with it, he and his friends realize that they can shut down the East coast of the US.

He thinks long on hard on what to do with this information; he could blackmail us, or provide a detailed explanation and maybe be seen as a hero...

Instead, his friends and him get high, and spend the next month or two just fucking with us by periodically flipping off the lights for a minute or two. Just long enough to make everyone have to reset their clocks.

That's what I would do, anyway.
posted by quin at 9:32 AM on April 8, 2009 [2 favorites]

What's the over/under on long it takes the FBI to make a social call on hippybear? We can't have people running loose that have actually thought about how to take down the electrical power infrastructure in this country ;)
posted by COD at 9:42 AM on April 8, 2009

Exactly, alexwoods! So far, I can see five obvious possibilities, including the two already noted:

1) It's an Antichrist Obamanation tactic to push through oppressive cybersecurity policies, as the last FPP link suggests;

2) It's an energy industry plot to rally opposition to smart grid technology;

3) Elvis did it for reasons only His Highness can comprehend;

4) It's a plot by the super-advanced Yeti who live in the hollow earth, as they prepare at long last to emerge from their exile to destroy us surface-dwellers and restore the world to its natural state as a lush, Eden-like woodlands paradise;

5) It actually is a Russian and Chinese espionage plot, as the reports indicate (seems the least likely of the possibilities so far to me though--wayyy too conspiratorial!).
posted by saulgoodman at 9:44 AM on April 8, 2009 [1 favorite]

You have to take some of these reports with a grain of salt. There are some people who are playing fast and loose with the facts, equating all three of the following statements:

1) The attacks orginate from a computer in Russia or China
2) The attacks are perpetuated by a hacker physically resident in Russia or China
3) The attacks are perpetuated by a hacker working on behalf of sinister Government agents of Russia or China

You will find that attack vectors from unsecured computers in Russia or China are quite common in various hacker communities for spam or other modern nasties. It does not follow that the spammers are OMG KGB!
posted by Lame_username at 9:52 AM on April 8, 2009 [1 favorite]

Given the fact that even small glitches can take out power for the entire eastern seaboard, it's not surprising that motivated and well informed hackers could take the system down on purpose. I'm not sure if they could do all of it remotely, or if they would need some physical access.

We really need to upgrade our electricity grid and build something that is not only more resistant to attack, but also can be used to transport wind and solar power from places with a lot of wind and/or open spaces.
posted by delmoi at 10:00 AM on April 8, 2009 [1 favorite]

What's the over/under on long it takes the FBI to make a social call on hippybear? We can't have people running loose that have actually thought about how to take down the electrical power infrastructure in this country ;)

Sadly, they'll be coming for everyone who ever read this MeFi thread. They know who you are.

Server wipe in 3.. 2..

;)
posted by hippybear at 10:26 AM on April 8, 2009

I've got a friend who consults to power plants on IT systems. He asked me some questions about Cybersecurity, so I reviewed the standard. I'd have to dig out my notes, but I seem to recall there were a lot of caveats about not taking any actions that might disrupt running systems. Anyway, most of his clients were planning on ignoring the standard for as long as they could.
posted by These Premises Are Alarmed at 10:32 AM on April 8, 2009

Here's another recent post on (probably) Chinese hackers: GhostNet.
posted by homunculus at 12:02 PM on April 8, 2009

If we should be worried, wouldn't it make more sense to worry about a Carrington event? A large solar flare in our direction could spell trouble for all electric grids, not only the USian one.
posted by bouvin at 12:52 PM on April 8, 2009

You know what we need? A Friendly Death Star Laser to Recreate the Sun's Power
posted by ornate insect at 12:55 PM on April 8, 2009

Why, WHY would any essential infrastructure, like the power grid, have any connection whatsoever to the internet!? There is absolutely no way to secure something as essential as this (or water supply, etc.) while connected in even the most tertiary way to any network that is in any way connected to the internet. Fuck.
posted by antispectacle at 1:14 PM on April 8, 2009

Why, WHY would any essential infrastructure, like the power grid, have any connection whatsoever to the internet!?

Maybe it's the same reason Bond villains always go on at length about the specific details of their evil master plans after they've captured James Bond instead of just killing him immediately. Just another part of the elaborate cat-and-mouse game of espionage.
posted by saulgoodman at 2:43 PM on April 8, 2009

I think what this article is warning against has, in all probability, already happened in 2003, but the governments involved chose not to tell us about it:


On Aug.14 2003, the Northeast Blackout

affected an estimated 10 million people in the province of Ontario (about one-third of the population of Canada), and 40 million people in eight U.S. states (about one-seventh of the population of the U.S.). Outage-related financial losses were estimated at $6 billion USD ($6.8 billion CDN).

Two weeks later, on Aug 28 a blackout disrupted London:

Mayor of London Ken Livingstone said at least 250,000 people were affected and said the situation showed the need for a serious look at the National Grid and why power went down for so long.

"We've never had this catastrophic failure before and we clearly can't have it again," he said.

About three weeks after that, on Sept. 23, Denmark and Sweden were hit:

The Danish capital, Copenhagen, and parts of Sweden have been hit by massive power cuts.

Around four million homes and businesses lost supplies at around 1240 local time (1040GMT). Engineers restored most power by late afternoon, but the exact cause of the cuts remained unclear.

Less than a week later, on Sept. 28, 2003, there was a problem in Italy:

Italy has been hit by a massive power cut - and many parts remain without electricity hours after the unprecedented blackout.

Only the island of Sardinia escaped the power cut, which struck at about 0330 (0130GMT) on Sunday morning.

The compactness in the timeline seems to me almost to obviate coincidence for these, and they did not recur.

Extortion seem like a reasonable attribution of motive, but these were all members of the coalition of the willing (the COWed), too.
posted by jamjam at 3:26 PM on April 8, 2009 [2 favorites]

Bruce McLean, don't forsake us now.
posted by maxwelton at 6:12 PM on April 8, 2009

Or John Willis.
posted by maxwelton at 6:12 PM on April 8, 2009

China denies role on US grid hacks
posted by homunculus at 10:01 AM on April 14, 2009

U.S. Steps Up Effort on Digital Defenses
posted by homunculus at 9:03 PM on April 28, 2009