A simulated attack on the bulk power system highlighted the importance of communications systems in enabling grid recovery.
North America’s bulk power systems could be hard pressed to recover from a coordinated attack on energy infrastructure if the communications infrastructure is also targeted.
That was one of the major findings by the GridEx VI exercise that took place in November 2021, the results of which are outlined in a North American Electric Reliability Corp.’s (NERC’s) Electricity Information Sharing and Analysis Center (E-ISAC) report released in early April. The GridEx VI exercise simulated a coordinated attack on energy infrastructure across the U.S. and Canada.
“Participants agreed that the loss of communications would essentially halt the grid restoration process,” the report said. It recommended strengthening operational coordination between the electricity sector and communications providers.
The report also found that federal government mechanisms to share potentially sensitive security information with the electricity industry are “challenging during normal conditions.” It said those existing mechanisms would be “severely strained” by the incidents used as part of last November’s GridEx VI exercise. The report said that work was needed to reach a mutual understanding of what information would be shared and how.
In addition, with Canada included in the grid attack scenario, the report said that coordination between the U.S. and Canada would require a level of crisis communication not seen since the 2003 Northeast blackout.
During last fall’s two-day disaster-gaming event, a grid security emergency (GSE) involving a nation-state sponsored attack on numerous power plants and gas pipelines, plus a widespread public misinformation campaign, was simulated. Participants, including grid operators, power producers, natural gas infrastructure owners, reliability coordinators, telecom providers and government officials, were tasked with responding to the simulated event and restoring power to the nation without causing chaos.
The scenario involved what NERC called both “Distributed Play” (an operational test) and “Tabletop Play.” The distributed play was outlined as follows:
- Move 0—November 9–15, 2021: Cyber and physical security threats to the electricity sector emerged across North America. Reports from the E-ISAC, law enforcement, and other government agencies to the electricity industry indicated that adversaries were conducting aggressive cyber and physical reconnaissance of the electricity grid, telecommunications infrastructure, and natural gas facilities across North America.
- Move 1—The Morning of November 16, 2021: Control system faults caused generation unit outages across numerous plants followed by transmission substation system faults. Large explosions caused generators to trip off-line and transmission circuit breakers to open at multiple locations near-simultaneously.
- Move 2—The Afternoon of November 16, 2021: Physical attacks on pipelines and LNG production facilities disrupted gas supplies to generators, further constraining generation capacity and forcing T&D operators to shed load. Cyber and physical attacks also targeted telecommunications infrastructure, forcing players to rely on backup systems.
- Move 3—The Morning of November 17, 2021: The adversary directly targeted critical employees, and pseudonymized social media users claimed responsibility for the attacks and threatened further incidents. Operations staff received vague but credible threats against them and their families via robocall. RCs were encouraged to discuss the impacts in case DOE pursued a GSE order that would impact their operations.
- Move 4—The Afternoon of November 17, 2021: Further social media threats targeted specific T&D facilities. Entities implemented emergency operations plans and worked to recover.
The Tabletop scenario centered on the coordinated response to cyber and physical attacks and was outlined as follows:
- Phase 1—The First Hour after the Attacks: Challenging operating conditions further degrade reliability when the Western Interconnection splits into two islands after a transmission disturbance initially assumed to be caused by wildfires.
- Phase 2—The Next Morning: Attacks on electricity and natural gas infrastructure cause widespread power outages affecting many high-priority customers, including defense-critical facilities.
- Phase 3—Later that Day: Telecommunications disruptions impair power system restoration activities and complicate coordination with government. Wind generation resources are disrupted by widespread control and response issues.
- Epilogue—Two Weeks and Beyond: The Western Interconnection is restored and customer load is eventually reconnected, but energy and capacity margins are tight for the foreseeable future. Active cyberattacks have ceased.
Communications are key
The results of the exercise, outlined in the NERC report issued April 7, showed that communication networks are of utmost importance in grid restoration. Participants in the exercise agreed that the loss of communications would essentially halt the grid restoration process.
Participants in the exercise agreed that the loss of communications would essentially halt the grid restoration process.
— GridEx VI Lessons Learned Report
The report highlighted the greater complexity of the bulk power system because renewables, growing real-time markets, and distributed energy resources (DER) rely entirely on effective communication networks. As such, utilities should consider alternate and/or backup communication capabilities such as private networks, the report said. Stakeholders also should engage with telecom providers to seek solutions to potential GSE where both electricity and communication networks go out.
Manny Cancel, CEO of E-ISAC and a senior Vice President at NERC, explained in a media briefing that while telecom providers have typically played a role in GridEx events of the past, the GridEx VI scenario was different. This time the scenario specifically tested the interdependence between telecommunications and the energy sector. More telecom providers were included in GridEx VI, which resulted in fruitful candid conversation about capabilities and restoration priorities, he said.
One recommendation for electric utilities was how they may need to re-prioritize which customers are restored first in a GSE scenario. For example, during an electricity outage, electricity crews should prioritize areas where communications cell towers or switching offices have exhausted their backup batteries and generator fuel, the report said.
Current events in Eastern Europe and elsewhere show that the threat of cyber and physical attacks on the grid is huge and that preparing today through scenario planning will pay future dividends, said Brandon Wales, executive director, Cybersecurity and Infrastructure Security Agency.
The full report with observations and recommendations for electric utilities and other energy stakeholders can be downloaded from this page.
Telecom providers and electric utilities participate in DISTRIBUTECH International, set for Dallas, Texas May 23-25.
