“Indeed, whenever a new idea is developed, as for example ballooning, warfare immediately takes possession.”
– Fredrik Bajer, 1908 Nobel Peace Prize Winner
As the electricity industry evolves into the grid of the future, security risks are evolving as well. Although the risk of cyberattacks and physical disruption have been the focus of recent industry and government initiatives, other risks should not be ignored. In particular, operational risk, which includes failures in internal procedures, personnel and systems, is likely to increase as the electricity industry changes and the supply chain is exposed to potentially bad actors. Applying the FBI’s equation to evaluate risk, the combination of (i) accelerating changes in industry structure, (ii) globalization of the sector’s equipment supply chain, and (iii) integration of new technologies into system operations threatens to raise operational risks to levels that mandate coordinated attention.
Risk Evaluation
The FBI has an equation to evaluate risk: Risk = Threat x Vulnerability x Consequence
This algorithm minimizes perceived risk if any one of the three components are negligible or non-existent. If all three components are positive, however, they have a compounding effect. Applying this equation to the evolving electricity industry indicates that all three components are changing for the worse, increasing the potential for higher levels of operational risk as the industry advances to include modern-day technology.
Threat = Growing Globalization
Technological expansion tied to the grid edge (e.g., smart meters, demand response automation, energy efficient appliances with programmable controls and smart chips, electric vehicles, and distributed energy resources) increases exposure to a number of new manufacturers, new companies and new avenues through which nation-states can attack.
With new technology being manufactured abroad, often in those very same nation-states that wish to threaten U.S. interests, companies may not be able to maintain quality control over new equipment installed on the evolving electricity network. The problem is compounded by the lack of transparency in the manufacturing supply chain which increasingly requires specialization and incorporates parts created by multiple manufacturers and subcontractors. As was recognized with cyberattacks, there is a growing number of well-funded, sophisticated nation-states that are investing in ways to engage in overt and covert warfare with the U.S. The expanding electricity supply chain provides them with the means to do it.
Vulnerability = Increasing Integration
The grid of the future includes bi-directional networks that control and balance supply and demand. Although better monitoring and communication can mitigate operational risks, the new level of interaction using new equipment creates vulnerability.
Imagine smart meters that are coordinated to send incorrect load data simultaneously to a distribution system operator who then responds, incorrectly, and destabilizes the grid. Automated demand response and smart chip appliances can engage in a collective load changes that exceed spinning reserve levels and cause system-wide blackouts. Electric vehicles and storage technologies used to supply ancillary services can be programmed with a dormant code to instantaneously reverse response to system operator signals and exacerbate the very issues they are supposed to resolve.
Although such technologies and their incorporation into the system may not currently be at levels that could create system-wide consequences, vulnerability is growing as new technologies are adopted, installed and integrated into system operations. Assessing vulnerability attempts to answer the question of what can go wrong if a system is exposed to threats. In the case of vulnerabilities that come through the electricity supply chain, the answer is quite a lot.
Consequence = Deprivation
Each one of the Department of Homeland Security’s sixteen critical infrastructure industries are enabled by a functional and reliable electricity sector. The power sector provides integral inputs to companies and households that are critical to economic growth and personal well-being. Billions of dollars are lost during blackouts and human lives are at risk during extreme weather conditions when electricity is not available. Knocking out the electricity system alone could bring the country to its knees while a broader-based attack ensues. The consequences of operational risk are profound and far-reaching.
Evolution
The shift from centralized to decentralized resources and widespread communications across all aspects of the power system appears to create a more robust system from a physical and operational point of view. However, if the equipment can be compromised through a supply chain breach and jeopardize business processes and systems, integration of new technologies can elevate operational risk.
Such risk is growing with globalization, specialization and integration of equipment into the grid. The answer is not to stop progress, but to be aware of the risks progress may create and take measures to mitigate those risks from the beginning when it is more cost-effective to incorporate quality control over the still nascent supply chain.
The next article in November will describe what key actors in the electricity industry can do to mitigate the potential for elevated operational risk. Economic Inquiry runs on the fourth Wednesday every two months.
About the author: Tanya Bodell is the Executive Director of Energyzt, a global collaboration of energy experts who create value for investors in energy through actionable insights. Visit www.energyzt.com. She can be reached at: [email protected] or 617-416-0651.
The Author would like to thank Joyce Corell at the Office of the Director of National Intelligence and the members of the 2016 DHS-ODNI Public-Private Analytic Exchange Programfor their collaboration and insights regarding electricity supply chain risks.
