Cybersecurity to Protect the Smart Grid
As the nation moves closer to an electric Smart Grid, state and federal governments and the electric utility industry are looking at potential cybersecurity threats to that system.
Scott Aaronson is director of government affairs with Edison Electric Institute, the largest association of U.S. investor-owned utilities, whose members provide roughly 70 percent of the nation’s electricity. He said the Smart Grid technology basically faces three categories of threat, one small and two a matter of national security. Smart Grid generally refers to a class of technology people are using to bring utility electricity delivery systems into the 21st century, using computer-based remote control and automation, according to the U.S. Department of Energy.
State and local governments, he said, would likely be concerned about criminal type attacks, such as someone hacking into a smart meter to alter their bill.
The other two categories of attack could come from rogue criminal organizations, including terrorist cells and nations interested in taking out U.S. infrastructure.
“That is something, in an act of war, the enemy would do,” Aaronson said.
The U.S. House and Senate are considering legislation to address cybersecurity threats to the Smart Grid, but Aaronson isn’t optimistic that Congress will pass any bill related to Smart Grid security.
The industry is supporting one bill in particular—the House’s Cyber Intelligence Sharing and Protection Act of 2011. The bipartisan legislation would permit private sector entities to restrict information they provide to others, including the government. It also would exempt threat information shared with the government from the freedom of information act, treat that information as proprietary information and prohibit its use from regulatory proceedings.
“There is some concern within the privacy community that this is very much like the Patriot Act,” Aaronson said. “The sponsors of the bill are actively working with the privacy community to try to allay those fears.”
This bill is different, he said, because any information gleaned by the government from information sharing can only be used to prosecute cyber crimes.
“This is not about regulating the Internet,” Aaronson said. “It’s not about keeping the Internet from being the free platform that it is. This is about national security.”
The power industry supports cybersecurity legislation, he said, that embrace four principles. It should:
Limit the scope of any new emergency authority to imminent cyber threats against truly critical assets. “We want to make sure that we are focusing on the most imminent threats to the most critical infrastructure,” said Aaronson.
Include all critical infrastructure sectors in a cyber security regime given their interdependence. “You can’t say you’ve protected the electric grid unless you protect the industries that we rely on,” he said. That includes such things as water to cool the system, transportation to move the fuel and financial services to protect the assets.
Encourage more information sharing between government and industry stakeholders. “We (the industry) don’t have standing armies. We need the federal government to tell us what we don’t know,” he said. On the flipside, the government doesn’t have experience running an electric utility and depends on the power industry in that regard.
Build on existing Federal Power Act process. “We are the only industry that currently has mandatory and enforceable cybersecurity standards,” said Aaronson. The original Federal Power Act provides for cooperation between the Federal Energy Regulatory Commission and other federal agencies, including resource agencies, in licensing and relicensing power projects.
Cybersecurity is important to the electricity industry because of efforts to create a Smart Grid to meet the growing demands for power. Christopher J. Eisenbrey, director of business information with the Edison Electric Institute, said utilities are moving toward the Smart Grid for many different reasons.
“One is to offset some of the new infrastructure investment and increase productivity of the existing grid,” he said.
To meet demand, utilities typically build power lines or power plants, which are very expensive; those costs are passed on to customers to pay for the investments.
“The idea behind the Smart Grid,” Eisenbrey said, “is to offset some of that investment by handling some of the demands for energy efficiency, demand response.”
In addition, a Smart Grid will allow more renewable energy to be connected to the grid and support environmental policy objectives, while enhancing the reliability and efficiency of the power grid.