NERC Says Physical Attacks on the Grid are Rising
Image courtesy of Mark Turnauckas under Attribution 2.0 Generic License, resized to 700 x 391 pixels.
During a call with reporters in April 2023, NERC executives said that physical attacks on the North American power grid have increased a whopping 10% year over year. While the call highlighted other risks for U.S. electric utilities – namely, climate change, retirement of traditional generation, and physical and cyber-attacks – the alarming rise in physical grid attacks was at the top of the agenda.
The Alarming Nature of the Increasing Physical Attacks on the Grid
According to NERC, “the [security] landscape has become increasingly complex” since 2022. Reasons include the Russian invasion of Ukraine, the strained relations between the U.S. and China, and the rising hacking threat coming out of North Korea and Iran.
These geopolitical threats have not only led to an increase in attacks of all kinds, but they have also prompted the accelerated introduction of new kinds of ransomware and malware, particularly those that target operational technology, that can be obtained and deployed by anybody regardless of their level of expertise.
And NERC’s concern is more than just anecdotal – the proof is in the pudding. In December 2022 alone, multiple substations were physically attacked in Washington that created 14,000 outages, and a substation attack using firearms in North Carolina created outages for 45,00 Duke Energy customers.
All told, NERC’s data indicates that there were nearly 1,700 physical security incidents in 2022, up 10.5% from 2021. These incidents included attacks via firearms, ballistics, tampering and vandalism. The good news is that only about 50 of the 1,700 incidents resulted in outages.
The bottom line is that utility emergency preparedness must now account for cyber and physical attacks in addition to the traditional focus on severe weather. Emergency preparedness managers must ensure that emergency plans fully document how to address these types of attacks, and physical attack scenarios should be sprinkled into exercises and drills. To not do this and ignore the clear trends would be irresponsible and a disservice to customers. Good luck!
