BlackIoT: IoT Botnet of High Wattage Devices Can Disrupt the Power Grid
Saleh Soltan
Department of Electrical Engineering
Princeton University
ssoltan@princeton.edu

Prateek Mittal
Department of Electrical Engineering
Princeton University
pmittal@princeton.edu

H. Vincent Poor
Department of Electrical Engineering
Princeton University
poor@princeton.edu
Abstract

CompromisedHigh Wattage
IoT Devices

We demonstrate that an Internet of Things (IoT) botnet of high wattage devices–such as air conditioners andheaters–gives a unique ability to adversaries to launchlarge-scale coordinated attacks on the power grid. In
particular, we reveal a new class of potential attacks on
power grids called the Manipulation of demand via IoT(MadIoT) attacks that can leverage such a botnet in orderto manipulate the power demand in the grid. We study
five variations of the MadIoT attacks and evaluate theireffectiveness via state-of-the-art simulators on real-world
power grid models. These simulation results demonstratethat the MadIoT attacks can result in local power outages
and in the worst cases, large-scale blackouts. Moreover,
we show that these attacks can rather be used to increase
the operating cost of the grid to benefit a few utilities inthe electricity market. This work sheds light upon the interdependency between the vulnerability of the IoT andthat of the other networks such as the power grid whose
security requires attention from both the systems security
and power engineering communities.

1

Power
Grid

Target of
the Attack

Synchronous On/Off

AdversaryCompromisedHigh Wattage
IoT Devices

Figure 1: The MadIoT attack. An adversary can disrupt thepower grid’s normal operation by synchronously switching
on/off compromised high wattage IoT devices.

most essential modern infrastructure networks, the power
grid.
Power grid security standards are all based on the assumption that the power demand can be predicted reliably
on an hourly and daily basis [62]. Power grid operators
typically assume that power consumers collectively behave similarly to how they did in the past and under similar conditions (e.g., time of the day, season, and weather).
However, with the ubiquity of IoT devices and their poor
security measures (as shown in [12]), we demonstrate that
this is no longer a safe assumption.
There has been a recent trend in producing Wi-Fi enabled high wattage appliances such as air conditioners,
water heaters, ovens, and space heaters that can now becontrolled remotely and via the Internet [3] (for the power
consumption of these devices see Table 1). Even older
appliances can be remotely controlled by adding Wi-Fi
enabled peripherals such as Tado◦ [8] and Aquanta [2]. A
group of these devices can also be controlled remotely or
automatically using smart thermostats or home assistants

Introduction

A number of recent studies have revealed the vulnerabilities of the Internet of Things (IoT) to intruders [21, 49, 50]. These studies demonstrated that IoT devices from cameras to locks can be compromised either
directly or through their designated mobile applications
by an adversary [12, 28, 43]. However, most previous
work has focused on the consequences of these vulnerabilities on personal privacy and security. It was not until
recently and in the aftermath of the Distributed Denialof Service (DDoS) attack by the Mirai botnet, comprising six hundred thousand compromised devices targeting
victim servers, that the collective effect of the IoT vulnerabilities was demonstrated [12]. In this paper, we reveal another substantial way that compromised IoT devices can be utilized by an adversary to disrupt one of the1

Table 1: Home appliances’ approximate electric power usage
based on appliances manufactured by General Electric [3].

such as Amazon Echo [1] or Google Home [4]. Hence,
once compromised, any of these devices can be used tocontrol high wattage appliances remotely by an adversary
to manipulate the power demand.
In this paper, we reveal a new class of potential attacks
called the Manipulation of demand via IoT (MadIoT) attacks that allow an adversary to disrupt the power grid’s
normal operation by manipulating the total power demand using compromised IoT devices (see Fig. 1). These
attacks, in the extreme case, can cause large scale blackouts. An important characteristic of MadIoT attacks isthat unlike most of previous attacks on the power grid,
they do not target the power grid’s Supervisory Control
And Data Acquisitions (SCADA) system but rather theloads that are much less protected as in load-altering attacks studied in [11, 41].
It is a common belief that manipulating the power demands can potentially damage the power grid. However,these speculations have mostly remained unexamined until our work. We are among the first to reveal realistic mechanisms to cause abrupt distributed power demand changes using IoT devices–along with Dvorkin andSang [24], and Dabrowski et al. [19]. Our key contribution is to rigorously study the effects of such attacks on
the power grid from novel operational perspectives (formore details on the related work see Section 6).
We study five variations of the MadIoT attacks anddemonstrate their effectiveness on the operation of realworld power grid models via state-of-the-art simulators.
These attacks can be categorized into three types:

Appliance
Air Conditioner
Space Heater
Air PurifierElectric Water Heater
Electric Oven

Power Usage (𝑊 )
1,000
1,500
200
5,000
4,000

the system is stabilized by the primary controller of thegenerators. Since the way power is transmitted in the
power grid (a.k.a. the power flows) follows Kirchhoff’slaws, the grid operator has almost no control over the
power flows after the response of the primary controllers.
Hence, even a small increase in the demands may resultin line overloads and failures. These initial line failures
may consequently result in further line failures or as it iscalled, a cascading failure [54]. For example, we showby simulations that an increase of only 1% in the demand in the Polish grid during the Summer 2008 peak,
results in a cascading failure with 263 line failures andoutage in 86% of the loads. Such an attack by the adversary requires access to about 210 thousand air conditioners which is 1.5% of the total number of households in
Poland [58]. During the Summer peak hours when mostof the air conditioners are already on, decreasing theirtemperature set points [61] combined with the initiationof other high wattage appliances like water heaters, canresult in the same total amount of increase in the demand.
We also show that an adversary can cause line failures
by redistributing the demand via increasing the demandin some places (e.g., turning on appliances within a certain IP range) and decreasing the demand in others (e.g.,turning off appliances within another IP range). These attacks, in particular, can cause failures in important highcapacity tie-lines that connect two neighboring independent power systems–e.g., of neighboring countries.

(i) Attacks that result in frequency instability:
An abrupt increase (similarly decrease) in the power
demands–potentially by synchronously switching on or
off many high wattage IoT devices–results in an imbalance between the supply and demand. This imbalance instantly results in a sudden drop in the system’s frequency.
If the imbalance is greater than the system’s threshold, thefrequency may reach a critical value that causes generators tripping and potentially a large-scale blackout. For
example, using state-of-the-art simulators on the smallscale power grid model of the Western System Coordinating Council (WSCC), we show that a 30% increase in
the demand results in tripping of all the generators. For
such an attack, an adversary requires access to about 90
thousand air conditioners or 18 thousand electric water
heaters within the targeted geographical area. We also
study the effect of such an attack during the system’s restarting process after a blackout (a.k.a. the black start)and show that it can disrupt this process by causing frequency instability in the system.

(iii) Attacks that increase operating costs: When the
demand goes above the day-ahead predicted value, conservatively assuming that there would be no frequency
disturbances or line failures, the grid operator needs topurchase additional electric power from ancillary services (i.e., reserve generators). These reserve generators
usually have higher prices than the generators committed as part of day ahead planning. Therefore, using thereserve generators can significantly increase the power
generation cost for the grid operator but at the same time
be profitable for the utility that operates the reserve generators. For example, we show by simulations that a 5%
increase in the power demand during peak hours by anadversary can result in a 20% increase in the power generation cost. Hence, an adversary’s attack may rather be
for the benefit of a particular utility in the electricity market than for damaging the infrastructure.

(ii) Attacks that cause line failures and result in cascading failures: If the imbalance in the supply and demand after the attack is not significant, the frequency of2

The MadIoT attacks’ sources are hard to detect and disconnect by the grid operator due to their distributed nature. These attacks can be easily repeated until being effective and are black-box since the attacker does not needto know the operational details of the power grid. These
properties make countering the MadIoT attacks challenging. Nevertheless, we provide sketches of countermeasures against the MadIoT attacks from both the power
grid and the IoT perspectives.
Overall, our work sheds light upon the interdependency between the vulnerability of the IoT and that ofother networks such as the power grid whose security requires attention from both the systems security and thepower engineering communities. We hope that our work
serves to protect the grid against future threats from insecure IoT devices.
The rest of this paper is organized as follows. Section 2 provides a brief introduction to power systems. In
Section 3, we introduce the MadIoT attack and its variations, and in Section 4, we demonstrate these attacks
via simulations. In Section 5, we present countermeasuresketches against the MadIoT attacks. Section 6 presents
a summary of the related work, and Section 7 discusses
the limitations of our work. Finally Section 8 provides
concluding remarks and recommendations. The central
results of the paper are self-contained in the above sections. We refer the interested reader to the appendix foran overview of recent blackouts and their connection to
MadIoT attacks, and additional experimental results.

Electricity
Generator

Transformers Transmission Transformers Distribution
step up voltage
Network
step down
Networkvoltage

Electricity
Consumers
or Loads

Figure 2: Main components of a power system.

In this section, we provide a brief introduction to powersystems. For more details, refer to [26, 27, 31, 62].

bus which is a node in the equivalent graph.1 Some of
the buses may be connected to the distribution networkof a city or a town and therefore represent the aggregatedload within those places.
The instantaneous electric power generation and consumption are measured in watts (𝑊 ) and are calculated based on electric voltages and currents. Almost all the power systems deploy Alternating Currents (AC) and voltages for transmitting electric power.
This means that the electric cur𝐼(𝑡)rent and voltage at each locationand each√point in time are equal to+𝐼(𝑡) = √2𝐼rms cos(2𝜋𝑓 𝑡 + 𝜃𝐼 ) and𝑉 𝑡
𝑉 (𝑡) =
2𝑉rms cos(2𝜋𝑓 𝑡 + 𝜃𝑉 ), in−
which 𝑓 is the nominal frequency of thesystem, and 𝐼rms , 𝑉rms and 𝜃𝐼 , 𝜃𝑉 are the
Figure 3
root mean square (rms) values and thephase angles of the currents and voltages, respectively.
In the U.S., Canada, Brazil, and Japan the power systemfrequency is 60𝐻𝑧 but almost everywhere else it is
50𝐻𝑧.
Given the voltages and the currents, the active, reactive, and apparent power amplitudes absorbed by aload can be computed as 𝑃 = 𝑉rms 𝐼rms cos(𝜃𝑉 − 𝜃𝐼 ), 𝑄 =𝑉rms 𝐼rms sin(𝜃𝑉 − 𝜃𝐼 ), and 𝑆 = 𝑉rms 𝐼rms , respectively.
cos(𝜃𝑉 − 𝜃𝐼 ) is called the power factor of a load.

2.1

2.2

2

Power Systems Background

BasicsPower Grid Operation and Control

Stable operation of the power grid relies on the persistent balance between the power supply and the demand.
This is mainly due to the lack of practical large scale electrical power storage. In order to keep the balance between
the power supply and the demand, power system operators use weather data as well as historical power consumption data to predict the power demand on a daily
and hourly basis [27]. This allows the system operators
to plan in advance and only deploy enough generators tomeet the demand in the hours ahead without overloading
any power lines. The grid operation should also comply
with the 𝑁 − 1 security standard. The 𝑁 − 1 standard requires the grid to operate normally even after a failure ina single component of the grid (e.g., a generator, a line,
or a transformer).
In power systems, the rotating speed of generators cor-

Power systems consist of different components (seeFig. 2). The electric power is generated at power generators at different locations with different capacities andthen transmitted via a high voltage transmission network
to large industrial consumers or to the lower voltage distribution network of a town or a city. The power is thentransmitted to commercial and residential consumers.
The main challenges in the operation and control of thepower systems are in the transmission network. Moreover, since a distributed increase in power demand does
not significantly affect the operation of the distribution
network, we ignore the operational details of the distribution network and only consider it as an aggregated load
within the transmission network. The term power grid
mainly refers to the transmission network rather that the
distribution network.
The transmission network can have a very complex
topology. Each intersection point in the grid is called a

1 The terms “bus” and “node” can be used interchangeably in thispaper without loss of any critical information.

3

almost entirely determined and governed by Kirchhoff’s
laws given the active and reactive power demand and supply values. Besides the constraints on the power flows enforced by Kirchhoff’s laws, there are other limiting constraints that are dictated by the physical properties of theelectrical equipment. In particular, each power line has acertain capacity of apparent power that it can carry safely.
Unlike water or gas pipelines, the capacity constraint
on a power line is not automatically enforced by its physical properties. Once the power supply and demand values are set, the power flows on the lines are determinedbased on Kirchhoff’s laws with no capacity constraints inthe equations. Thus, an unpredicted supply and demandsetting may result in electric power overload on some of
the lines. Once a line is overloaded, it may be tripped by
the protective relay, or it may break due to overheating–which should be avoided by the relay. Hence, the system
operator needs to compute the power flows in advance–
using the predicted demand values and optimal set of generators to supply the demand–to see if any of the lines will
be overloaded. If so, the configuration of the generators
should be changed to avoid lines overload and tripping.

Figure 4: Normal and abnormal frequency ranges in North
America. The figure is borrowed from [60].

respond to the frequency. When the demand gets greaterthan the supply, the rotating speeds of the turbine generators’ rotors decelerate, and the kinetic energy of therotors are released into the system in response to the extra demand. Correspondingly, this causes a drop in thesystem’s frequency. This behavior of turbine generators
corresponds to Newton’s first law of motion and is calculated by the inertia of the generator. Similarly, the supply
being greater than the demand results in acceleration of
the generators’ rotors and a rise in the system’s frequency.
This decrease/increase in the frequency of the system cannot be tolerated for a long time since frequencies
lower than the nominal value severely damage the generators. If the frequency goes above or below a thresholdvalue, protection relays turn off or disconnect the generators completely (see Fig. 4 for normal and abnormal
frequency ranges in North America). Hence, within seconds of the first signs of decrease in the frequency, theprimary controller activates and increases the mechanical input which increases the speed of the generator’s rotor and correspondingly the frequency of the system [26].
Despite stability of the system’s frequency after the
primary controller’s response, it may not return to its
nominal frequency (mainly due to the generators generating more than their nominal value). Hence, the secondary controller starts within minutes to restore the system’s frequency. The secondary controller modifies theactive power set points and deploys available extra generators and controllable demands to restore the nominal
frequency and permanently stabilizes the system.

2.3

2.4

Voltage Stability

Besides power line thermal limits, the power flows on
the lines are limited by their terminating buses’ voltages.
The voltages at the buses are controlled by maintaining
the level of the reactive power (𝑄) supply. Voltage instability or as it is called voltage collapse occurs when
the generated reactive power becomes inadequate. Thisis mainly due to changes in system configurations due toline failures, increase in active or reactive power demand,or loss of generators. Voltage collapse should be studied using 𝑉 -𝑄 (characterizing the relationship between
the voltage at the terminating bus of a line to the reactive
power flow) and 𝑃 -𝑉 (characterizing the relationship between the voltage at the terminating bus of a line to theactive power flow) analysis which is beyond the scope of
this paper, but for more details see [62, Chapter 7].
Voltage collapse results in the infeasibility of the power
flow equations. Hence, it can be detected when the power
flow solver fails to find a solution to the power flow equation (usually after an initial change in the system). In
such scenarios, the grid operator is forced to perform load
shedding (i.e., outage in part of the grid) in order to recover the system from a voltage collapse and make thepower flow equations feasible again. Hence, even failures in a few lines or an increase in the active/reactive
power demands may result in large scale outages aroundthe grid due to voltage collapse.

Power FlowsThe equality of supply and demand is a necessary condition for the stable operation of the grid, but it is far frombeing sufficient. In order to deliver power from generators to loads, the electric power should be transmitted by
the transmission lines. The power transmitted on eachline in known as the power flow on that line.
Unlike routing in computer networks, power flows are4

Shipments in million units

portant and direct ways that such attacks can cause damage to the grid (summarized in Table 2):

40
33.00
30

25.50

20

1. Significant frequency drop/rise: As briefly describedin Section 2, the normal operation of the power grid relieson the persistent balance between the supply and demand.
Thus, an adversary’s approach could be to disrupt thisbalance using an IoT botnet. An adversary can leverage
an IoT botnet of high-wattage devices and synchronously
switch on all the compromised devices. If the resulting
sudden increase in the demand is greater than a threshold, which depends on the inertia of the system, it cancause the system’s frequency to drop significantly before
the primary controllers can react. This consequently may
result in the activation of the generators’ protective relays
and loss of generators, and finally a blackout. Sudden decrease in the demand may also result in the same effectbut this time by causing a sudden rise in the frequency.
An adversary can further increase its success by strategic selection of the timing of an attack using the online
data available via the websites of Independent System
Operators (ISOs)3 (e.g., daily fuel mix and live updatesof the demand values.) For example, we know that as theshare of renewable resources in the power generation increases, the inertia of the system decreases. Therefore,
an attack that is coordinated with the time that renewablepenetration is highest, is more effective in causing largechanges in the frequency. Similarly, an attack during thepeak hours can result in a slow yet persistent frequency
drop in the system. Such an attack may exhaust the controller reserves and force the system operator to perform
load shedding. This may result in power outages in several parts of the system if the situation is handled wellby the operator, or in a large-scale blackout if it is mishandled and the system’s frequency keeps dropping. According to the European Network of Transmission System Operators for Electricity (ENTSOE) guidelines, if
the frequency of the European grid goes below 47.5𝐻𝑧
or above 51.5𝐻𝑧, a blackout can hardly be avoided [25].

17.50
12.00

10
2.50

5.00

7.50

0
2014 2015 2016 2017 2018 2019 2020

Year

Figure 5: Estimated number of homes with smart thermostats inNorth America in millions. Data is obtained from Statista [56].

3

Attacking the Grid Using an IoT Botnet

In this section, we reveal attack mechanisms that canutilize an IoT botnet of high wattage devices to launch alarge-scale coordinated attack on the power grid.

3.1

Threat Model

We assume that an adversary has already gained accessto an IoT botnet of many high wattage smart appliances(listed in Table 1) within a city, a country, or a continent.
Since most of the IoT devices are controlled using mobile phone applications, access to users’ mobile phones
or corresponding applications can also be used to control
these devices [28]. This access can potentially allow theadversary to increase or decrease the demand in different
locations remotely and synchronously. The adversary’s
power to manipulate the demand can also be translated
into watts (𝑊 ) using the numbers in Table 1 and basedon the type and the number of devices to which it hasaccess.
For example, if we consider only the houses with smart
thermostats in 2018 as shown in Fig. 5 and assuming thateach thermostat only controls two 1𝑘𝑊 air conditioners, an attacker can potentially control 35𝐺𝑊 of electric
power2 –even a fraction of which is a significant amount.
Recall that in the case of the Mirai botnet, the attackers
could get access to about 600 thousand devices within a
few months [12].
The 35𝐺𝑊 is computed by only considering the thermostats connected to a few air conditioners. By considering all the smart air conditioners as well as otherhigh wattage appliances such as water heaters, this value
would be much higher. Moreover, this amount will growin the future as the trend shows in Fig. 5.
We call the attacks under this threat model the
Manipulation of the demand via IoT (MadIoT) attacks.
In the next subsection, we provide the details of various
types of attacks that can be performed by an adversary.

3.2

2. Disrupting a black start: Once there is a blackout,
the grid operator needs to restart the system as soon as
possible. This process is called a black start. Since thedemand is unknown at the time of a black start, restarting
the whole grid at the same time may result in frequency
instability and system failure again. Hence, in a black
start, the operator divides the system into smaller islands
and tries to restart the grid in each island separately. The
islands are then connected to increase the reliability ofthe system.
Since the grid is partitioned into smaller islands at

MadIoT Attack Variations

MadIoT attacks can disrupt the normal operation of thepower grid in many ways. Here, we present the most im-

3 The system operators are given different names in different countries and continents, but here for the sake of simplicity, we refer to allof them as ISOs.

2 For the sake of comparison, this amount is equal to 7% of the entire

U.S. 2017 Winter peak demand (about 500𝐺𝑊 ) [10].

5Table 2: MadIoT attack variations. The botnet size is in bots/𝑀𝑊 which is the number of bots required to perform a successful
variation of the MadIoT attack, if the total demand in the system is 1𝑀𝑊 . All the bots are assumed to be air conditioners.
#
1

Goal
Grid frequency rise/drop

2

Disrupting grid re-start

3

Line failures and cascades

4

Failure in tie-lines

5

Increasing the operating cost

Attack action
Synchronously switching on/off all the bots
Synchronously switching on all the botsonce the power restarts after a blackout
Synchronously switching on or off the botsin different locations
Synchronously switching on (off) the bots inimporting (exporting) end of a tie-line
Slowly switching on the bots during power
demand peak hours

the time of a black start, the inertia of each part is low
and therefore the system is very vulnerable to demandchanges. Thus, an adversary can significantly hinder theblack start process by suddenly increasing the demand using the IoT botnet once an island is up. This can cause alarge frequency disturbance in each island and cause thegrid to return to the blackout state.

Initial impact
Generation tripping

Botnet size
200–300

Simulation results
Figs. 8,7,9

Generation tripping

100–200

Fig. 11

Lines tripping

4–10

Figs. 12,13,15

Tie-lines tripping

10–15

Fig. 16

Utilizing power
generation reserve

30–50

Fig. 17of the demand increase only attack.
4. Failures in the tie-lines: Tie-lines between the ISOs
are among the most important lines within an interconnection. These tie-lines are usually used for carrying
large amounts of power as part of an exchange program
between two ISOs. Failure in one of these lines may result in a huge power deficit (usually more than 1𝐺𝑊 ) in
the receiving ISO and most likely a blackout due to thesubsequent frequency disturbances or a large-scale outage due to load shedding by the grid operator.
Due to their importance, the tie-lines can be the target of an adversary. An adversary can observe the actual
power flows on the tie-lines through ISOs’ websites, andtarget the one that is carrying power flow near its capacity. In order to overload that line, all the adversary needs
to do is to turn on the high wattage IoT devices in thearea at the importing end of the line and turn off the onesat the exporting end (using the IP addresses of the devices).4 This can overload the tie-line and cause it to tripby triggering its protective relay.

3. Line failures and cascades: Recall from Section 2.3
that the power flows in power grids are determined by
the Kirchhoff’s laws. Therefore, most of the time, thegrid operator does not have any control over the power
flows from generators to loads. Once an adversary causesa sudden increase in the loads all around the grid, assuming that the frequency drop is not significant, the extra
demand is satisfied by the primary controller. Since thepower flows are not controlled by the grid operator at thisstage, this may result in line overloads and consequentlines tripping.
After initial lines tripping or failures, the power flows
carried by these lines are redistributed to other lines basedon Kirchhoff’s laws. Therefore, the initial line failures
may subsequently result in further line failures or, as it iscalled, a cascading failure [54]. These failures may eventually result in the separation of the system into smaller
unbalanced islands and a large-scale blackout.

5. Increasing the operating cost: When the demandgoes above the predicted value, the ISO needs to purchaseadditional electric power from ancillary services (i.e., reserve generators). These reserve generators usually havea higher price than the generators committed as part ofthe day ahead planning. Thus, using the reserve generators can significantly increase the power generation costfor the grid operator but at the same time be profitable forthe utility that operates the reserve generator.
Hence, the goal of an adversary’s attack may be to benefit a particular utility in the electricity market rather thanto damage the infrastructure. The adversary can achieve
this goal by slowly increasing the demand (e.g., switching on a few devices at a time) at a particular time of the
day and in a certain location. Moreover, it may reach out

Moreover, failure in a few lines accompanied by an increase in the power demand may result in a voltage collapse (recall from Section 2.4) which consequently would
force the grid operator to perform load shedding. Hence,in some steps during the cascade, there are more outages
due to load shedding.
An adversary may also start cascading line failures byredistributing the loads in the system by increasing thedemand in a few locations and decreasing the demand inothers in order to keep the total demand constant. This
redistribution of the demand in the system may result inline failures without causing any frequency disturbances.
The advantage of this attack is that it may have the same
effect without attracting a lot of attention from the grid
operator. It can be considered to be a stealthier version

4 A sudden increase in the demand, only at the importing end of thetie-line, may also result in its overload. This is due to the fact that once
there is an imbalance between the supply and demand, all the generators
within an interconnection (whether inside or outside of the particularISO) respond to the imbalance which consequently results in an increasein the power flow on the tie-line.

6

to utilities to act in their favor in return for a payment.

in completely different power flows in the grid. Hence,
although losing a generator may not result in any issues as planned, increase in the demands by an adversary may result in many line overloads. Moreover, theimbalance caused by an adversary may surpass the imbalance caused due to losing the largest generator, andtherefore results in unpredicted frequency disturbances.
For example, the capacity of the largest operating generator in the system may be 1𝐺𝑊 (usually a nuclear power
plant) which can be surpassed by an attack comprisingmore than 100 thousand compromised water heaters.
Despite these difficulties, we provide sketches of countermeasures against the MadIoT attacks in Section 5.

Overall, the above attacks demonstrate that an adversary as described in Section 3.1 has tremendous power tomanipulate the operation of the grid in many ways whichwere not possible a few years ago in the absence of IoT
devices.

3.3

Properties and Defensive Challenges

The MadIoT attacks have unique properties that makethem very effective and at the same time very hard to defend against. In this subsection, we briefly describe someof these properties.
First, the sources of the MadIoT attacks are very hardto detect and disconnect by the grid operator. The main
reason is that the security breach is in the IoT devices, yet
the attack is on the power grid. The grid operator cannot
easily detect which houses are affected since it only sees
the aggregation of the distributed changes in the demandaround the grid. At the same time, the attack does notnoticeably affect the performance of the IoT devices, especially if the smart thermostat is attacked. Moreover,
the attack may not be noticeable by the households since
the changes are temporary and can be considered as partof the automatic temperature control.
Second, the MadIoT attacks are easy to repeat. An adversary can easily repeat an attack at different times ofthe day and different days to find a time when the attackis the most effective. Moreover, this repeatability allows
an adversary to cause a persistent blackout in the power
grid by disrupting the black start process as described in
the previous subsection.
Third, the MadIoT attacks are black-box. An adversary
does not need to know the underlying topology or the detailed operational properties of the grid, albeit it can use
the high-level information available on the ISOs’ websites to improve the timing of its attack. It can also use
the repeatability of these attacks and general propertiesof the power grids to achieve and perform a successful
attack.
Finally, power grids are not prepared to defend against
the MadIoT attacks, since abrupt changes in the demand
are not part of the contingency list that grid operators areprepared for. As mentioned in Section 2, power grids
are required to operate normally after a failure in a single
component of the grid (the 𝑁 − 1 standard). Therefore,
the daily operation of the grid is planned such that even a
failure in the largest generator does not affect its normal
operation.
The scenarios predicted by the 𝑁 − 1 standard, however, are quite different from the scenarios caused by the
MadIoT attacks. Although an increase in the demand canbe similar to losing a generator from the supply and demand balance perspective, these two phenomena result

3.4

Connection to Historical Blackouts

There have been several large-scale blackouts in thepast two decades around the world. Although these
events were not caused by any attacks, the chain of events
that led to these blackouts could have been initiated by a
MadIoT attack. For example, the initial reactive power
deficit in Ohio in 2003 leading to the large-scale blackoutin the U.S. and Canada [60], and the failures in the tielines connecting Italy to Switzerland in 2003 leading to
the complete shutdown of the Italian grid [59], could havebeen caused by MadIoT attacks. Most of these events
happened beacuse the systems’ operators were not prepared for the unexpected initial event. Hence, the MadIoT attacks could result in similar unexpected failures.
We reviewed a few of the recent blackouts in the power
grids around the world and demonstrated how an adversary could have caused similar blackouts. The details ofthese events are relegated to Appendix A.

4

Experimental Demonstrations

In this section, we demonstrate the effectiveness of
the MadIoT attacks on real-world power grid models via
state-of-the-art simulators. Recall that the MadIoT attacks are black-box. Therefore, the outcome of an attack highly depends on the operational properties of thetargeted system at the time of the attack (e.g., generators’ settings, amount of renewable resources, and power
flows). We emphasize this in our simulations by changing the power grid models’ parameters to reflect the dailychanges in the operational properties of the system.

4.1

Simulations Setup

Our results are based on computer simulations. In particular, we use the MATPOWER [65] and the PowerWorld [7] simulators. MATPOWER is an open-source
MATLAB library which is widely used for computing thepower flows in power grids. PowerWorld, on the other
hand, is an industrial-level software suite that is widelyused by the industry for frequency stability analysis ofpower systems. We used the academic version of Power7

(a)
(b)
Figure 7: Frequency disturbances due to unexpected demand
increases in all the load buses in the WSCC system caused by anadversary, ignoring generators’ frequency cut-off limit (shownby red dashed line). Increase by (a) 23𝑀𝑊 and (b) 30𝑀𝑊 .

Figure 6: The WSCC 9-bus system. The generators at buses 2
and 3 are the buses with inertia, and the generator at bus 1 is aslack bus with no inertia. The slack bus is a bus in the systemthat can change its generation to make the power flow equations
feasible. The load buses are buses 5, 6, and 8. We consider two
operational settings of the WSCC system: (a) high inertia, inwhich both generators 2 and 3 have inertia constants (𝐻) equal
to 15𝑠, and (b) low inertia, in which generators 2 and 3 have inertia constants equal to 5𝑠 and 10𝑠, respectively [51, Chapter 3].
In all the simulations, the IEEE type-2 speed-governing model(IEEE-G2) is used for the generators [44].

switching on/off 1,000 bots. Therefore, we can define thenormalized botnet size in bots/𝑀𝑊 to be the number ofbots required to perform a successful variation of the MadIoT attack, if the total demand in the system is 1𝑀𝑊 .
By this definition, it is easy to see that to increase thedemand of any system by 1%, an adversary requires 10
bots/𝑀𝑊 .

4.2

Frequency Disturbances

In this subsection, we evaluate the first two MadIoT
attack variations described in Section 3.2. We consider
two operational settings of the WSCC system: (a) highinertia and (b) low inertia (for details see Fig. 6).

World.
For frequency stability analysis in PowerWorld, to thebest of our knowledge, there are no large-scale real-world
power grids available for academic research. Hence, forevaluating the effects of the MadIoT attacks on the system’s frequency, we use the WSCC 9-bus grid model that
represents a simple approximation of the Western System
Coordinating Council (WSCC)–with 9 buses, 9 lines, and315𝑀𝑊 of demand [35]. Despite its small size, due tothe complexity of power systems transient analysis, it is
widely used as a benchmark system [22, 48, 52].
For evaluating the effects of MadIoT attacks on the
power flows, however, we use the Polish grid which is oneof the largest and most detailed publicly available realworld power grids. To the best of our knowledge, there
are no other real power grids at this scale and detail available for academic research.5 We use the Polish grid data
at its Summer 2004 peak–with 2736 buses, 3504 lines,
and 18GW of demand–and at its Summer 2008 peak–with
3120 buses, 3693 lines, and 21GW of demand. Both areavailable through the MATPOWER library.
Since the total demand in the WSCC system is315𝑀𝑊 , but the total demand in the Polish grid is about
20𝐺𝑊 , for comparison purposes, we focus on the percentage increase/decrease in the demand caused by anattack instead of the number of switching on/off bots.
However, if we assume that all the bots are air conditioners, 1𝑀𝑊 change in the demand corresponds simply to

4.2.1

200–300 Bots per 𝑀𝑊 Can Cause Sudden
Generation Tripping

In order to show the frequency response of the system
to sudden increases in the demand, we simulated the increase of (a) 23𝑀𝑊 and (b) 30𝑀𝑊 in all the loads forthe high inertia and low inertia cases. These values canroughly be considered as 20% and 30% increases in theload buses, respectively. We similarly studied the frequency response of the system to sudden decreases of thedemand. Figs. 7 and 8 present the results.
As mentioned in Section 2, the generators are protectedfrom high and low frequency values by protective relays.
These values depend on the type of a generator as well as
the settings set by the grid operator. Here, we assume thesafe frequency interval of 58.2𝐻𝑧 and 61.2𝐻𝑧 which iscommon in North America (see Fig. 4). Once a generator
goes below or above these values, it gets disconnectedfrom the grid by protective relays.
As can be seen in Figs. 7(b) and 8(b), sudden increaseor decrease in the load buses by 30% or 20%, respectively,
cause the system’s frequency to go below or above thefrequency cut-off limits. Hence, an adversary requires
200–300 bots/𝑀𝑊 , or in this case 60–90 thousand bots,to perform these attacks.
As can be seen, however, the drop/rise in frequency
is higher in the low inertia case (as predicted). Therefore, there are cases in which the frequency may go be-

5 Topologies of other power grids may also be available through university libraries, but they are limited to the topology with no extra information on the operational details.

8

(a)
(b)
Figure 8: Frequency disturbances due to unexpected demanddecreases in all the load buses in the WSCC system by an adversary, ignoring generators’ frequency cut-off limit (shown by
red dashed line). Decrease by (a) 15𝑀𝑊 and (b) 20𝑀𝑊 .

60

55usually done by restarting the grid in parallel in disconnected islands and then reconnecting the islands.
Fig. 10 shows one way of partitioning the WSCC system into two islands. We assume that initially the grid
operator could restart the two islands and stabilize thefrequency at 60𝐻𝑧. Then, before the two islands are reconnected, an adversary increases the demand at all theload buses with the same amount (see Fig. 11).
The attack is performed at time 30 and the two islands
are reconnected at time 50. As can be seen in Fig. 11(a),when there are no attacks, the two islands are reconnectedwith an initial small disturbance in the frequency and thenthe system reaches a stable state.
Fig. 11(b) shows the frequency of the system after
20𝑀𝑊 increase in all the load buses at time 30. In thiscase, the frequency goes slightly below the minimum safe
limit, but it is common in the black start process that thegenerators’ lower (upper) frequency limits are set to lower(higher) levels than usual. Hence, the system may reacha stable state in this case as well.
As can be seen in Fig. 11(c), a 30𝑀𝑊 increase in all
the loads causes a large disturbance in the frequency, but
as the two islands are reconnected the system’s frequency
is completely destabilized. These substantial deviations
from safe frequency ranges can cause serious damage tothe generators and are not permitted even in the black
start process. Hence, in this case the system returns tothe blackout stage. Even if the grid operator decides not
to reconnect the two islands due to the frequency disturbances, Fig. 11(d) shows a significant drop in the second island’s frequency that results in disconnection of thegenerators. Therefore, even if the big drop in frequency
of island 1 (1𝐻𝑧 below the safe limit) is acceptable during the black start, island 2 goes back to the blackout state.
For comparison purposes and to reflect on the role ofthe operational properties of the system on the outcomeof an attack, we repeated the same set of simulations
with different maximum power outputs for the generators’ governors (see Fig. B.1 in the appendix). We observed that under the new settings, demand increases of65
Low Inertia
High Inertia

Frequency (Hz)Frequency (Hz)65

Figure 10: The WSCC 9-bus system during the black start.

0

2

4

Time (sec)68

Low Inertia
High Inertia

60

55
0

2

4

6

Time (sec)(a)(b)
Figure 9: Frequency disturbances due to unexpected demandchanges in all the load buses in the WSCC system by an adversary, considering generators’ frequency cut-off limits (shownby red dashed lines). (a) Demand increase of 30𝑀𝑊 and (b)demand decrease of 20𝑀𝑊 .

low/above the critical frequency in the low inertia casebut may remain in the safe interval in the high inertia
case (see Figs. 7(a) and 8(a)). This suggests that an attack that is not effective today, may be effective tomorrow
if the system’s inertia is lower due to a higher rate of renewable generation.
In Figs. 7 and 8, the frequency cut-off limits of thegenerators are ignored. Hence, the generators are kept
online even when the frequency goes beyond the safe
operational limits. In reality, however, these generators
are disconnected from the grid by the protective relays.
Fig. 9 presents the frequency response of the system when
the protective relays are enabled for the cases shown in
Figs. 7(b) and 8(b). As can be seen, the grid completely
shuts down and the simulations stop in less than 10 seconds due to disconnection of the generators.
Simulation results in this subsection demonstrate thatthe effectiveness of an attack in causing a critical frequency disturbance depends on the attack’s scale as wellas the system’s total inertia at the time of the attack.
4.2.2

100–200 Bots per 𝑀𝑊 Can Disrupt the Grid
Re-start

Once there is a blackout, the grid operator needs torestart the system as soon as possible (a.k.a. a black start).
As mentioned in Section 3.2, due to frequency instabilityof the system at the black start, the restarting process is
9

60
59
58
57
0

50

Frequency (Hz)

58

3
0

50

100

Time (sec)

(a)

(b)
Freq. Island 1
Freq. Island 2

80
60
40

0

4

59

57
100

50

Time (sec)100

5Freq. Island 1
Freq. Island 2

60

Time (sec)

100

20

Frequency (Hz)61
Freq. Island 1
Freq. Island 2

2

62

Frequency (Hz)Frequency (Hz)61

1

Freq. Island 1
Freq. Island 2

60

Figure 12: The cascading line failures initiated by a 1% increasein the demand in the Polish grid 2008 by an adversary (colors
show the cascade step at which a line fails). It caused failuresin 263 lines and 86% outage.

58
56
54
0

50

100

Time (sec)(c)(d)
Figure 11: Frequency disturbances during the black start due
to unexpected increases in all the load buses by an adversary,ignoring generators’ frequency cut-off limits (shown by reddashed lines). (a) Normal black start in the absence of an adversary. (b) Demand increases of 20𝑀𝑊 at the load buses before
the reconnection of the two islands. (c) Demand increases of
30𝑀𝑊 at the load buses before the reconnection of the two islands. (d) Demand increases of 30𝑀𝑊 at the load buses without attempting to reconnect the two islands due to frequency
instabilities.

4

3

2

1

up to 10𝑀𝑊 results is a successful black start, unlike theprevious case which could handle demand increases of
20𝑀𝑊 at all the loads. Hence, an adversary requires atleast 100–200 bots/𝑀𝑊 , or in this case 30–60 thousand
bots, to increase the demand at all the loads by 10–20%
and disrupt the black start. Here again we observe thatthe operational properties of the grid play an importantrole in the outcome of an attack.

4.3

Figure 13: The cascading line failures initiated by a 10% increase in the demand in the Polish grid 2004 by an adversary(colors show the cascade step at which a line fails). It caused
failures in 11 lines and 46% outage.

the supply and demand, since this balancing is unplanned,
it may cause line overloads.
To demonstrate this, we assume that an adversary increases the demand at all the load buses by 1%. We also
assume that all the generators contribute proportionallyto their capacities to compensate for this sudden increasein the demand. This attack results in a single line failure in the Polish grid 2004 but no outages. However, as
can be seen in Fig. 12, the same attack on the Polish grid2008 results in the cascade of line failures that lasts for
5 rounds, causes 263 line failures, and 86% outage. The
1% increase in the total demand in the Polish grid 2008is roughly equal to 210𝑀𝑊 , requiring the adversary toaccess to 10 bots/𝑀𝑊 which is about 210 thousand air
conditioners in this case. This number is equal to 1.5%of the total number of households in Poland [58].
Since the Polish grid 2004 showed a good level of robustness against the 1% increase attack, we re-evaluatedits robustness against a 10% increase in the demand.
Fig. 13 shows the resulting line failures and the subsequent cascade caused by this attack. It can be seen that
this attack causes much more damage with 11 line fail-Line Failures and Cascades

In this subsection, we demonstrate the effectiveness ofthe third and the fourth variations of the MadIoT attacks
described in Section 3.2. For simulating the cascadingline failures, we use the MATLAB code developed by
Cetinay et al. [18]. We had to slightly change the code to
make it functional in the scenarios studied in this paper.
To evaluate the severity of the cascade, we define outage
as the percent of the demand affected by the power outage
at the end of the cascade over the initial demand.
4.3.1

Only 10 Bots per 𝑀𝑊 Can Initiate a Cascading Failure Resulting in 86% Outage

As described in Section 3.2, once an adversary causesa sudden increase in the demand, if it does not result ina major frequency drop, the primary controllers at generators are automatically activated to compensate for theimbalance in the supply and demand. Despite balancing
10

3

2

1

Figure 14: Histogram of the Polish grid lines’ power flow tocapacity ratio in Summer 2004 compared to Summer 2008.

ures and 46% outage. Despite the effectiveness of thesecond attack, the Polish grid 2004 shows greater levelof robustness than the Polish grid 2008 even under a 10time stronger attack. Although this may be due to manyfactors such as online generator locations and their values, topology of the grid, and even number of lines [54],one possible factor is how initially saturated the powerlines are.
Fig. 14 presents the histogram of the Polish grid lines’
power flow to capacity ratio in Summer 2004 comparedto Summer 2008. There are about 10% more lines withflow to capacity ratio below 0.1 in the Polish grid 2004
compared to the Polish grid 2008. Consequently, there
are more lines with power flow to capacity ratio greaterthan 0.3 in the Polish grid 2008 than in the Polish grid2004 (to see the locations of the near saturated lines see
Fig. B.2 in the appendix). This clearly demonstrates thata small increase in the demand is more likely to cause line
overloads in the Polish grid 2008 than in the Polish grid2004 (as observed in Figs.12 and 13).
Overall, as in the previous subsection, the results
demonstrate that the effectiveness of an attack depends
on the status of the grid at the time of the attack. However, unlike the large botnet size (about 300 bots/𝑀𝑊 )required to cause a blackout from frequency instability inthe system, we observe here that even botnet size of 10
bots/𝑀𝑊 can result in a significant blackout depending on the grid’s operational properties. Albeit the blackouts caused by frequency instabilities happen much faster(within seconds) than those caused by cascading line failures (within minutes or even hours).
4.3.2

Figure 15: The cascading line failures initiated in the Polish grid2008 by redistributing the demand by an adversary. Demand of
the loads buses with demand greater than 20𝑀𝑊 are changed
by with a Gaussian distribution with zero mean and standard
deviation 1𝑀𝑊 (colors show the cascade step in which a line
fails). It caused failures in 77 lines and 85% outage.

mand greater than 20𝑀𝑊 . This can be estimated by theadversary from the total number of IoT bots in a city ora town. The number of bots is correlated with the population of an area and therefore the total demand. Hence,an adversary detects these load buses and decreases or increases the demands by a random value such that the total
demand increase and decrease sum up approximately tozero. We assume this can be done by randomly increasingor decreasing the demand by a Gaussian random variablewith zero mean and selected standard deviation.
Again, the Polish grid 2004 showed a great level ofrobustness against these attacks. Even if an adversary
decreases or increases the demand randomly by a Gaussian random variable with zero mean and standard deviation 10𝑀𝑊 at loads with demand greater than 20𝑀𝑊 ,it only results in three line failures without any outages.
However, the same attack with 10-time smaller changes,
results in serious damage to the Polish grid 2008. As
can be seen in Fig. 15, making only small changes withstandard deviation of 1𝑀𝑊 at load buses with demands
greater 20𝑀𝑊 results in cascading line failures with77 line failures and outage of 85%. The total absolutevalue of the demand changes in this attack was about
80𝑀𝑊 which means that an adversary only requires 4
bots/𝑀𝑊 , or in this case 80 thousand bots, to perform
such an attack.
Although these changes are made randomly, due to thestealthy nature of these attacks they can be repeated without attracting any attention until they are effective.

Only 4 Bots per 𝑀𝑊 Can Initiate a Cascading Failure Resulting in 85% Outage by Redistributing the Demand

Another way of causing line failures and possibly cascading line failures in the grid is by redistributing thedemand without increasing the total demand. As mentioned in Section 3.2, the advantage of this attack is thatit may have a similar effect to the demand increase attack
without attracting the grid operators’ attention due to frequency disturbances.
Here, an adversary focuses only on the loads with de-

4.3.3

Only 15 Bots per 𝑀𝑊 Can Fail a Tie-line by
Increasing (Decreasing) the Demand of the Importing (Exporting) ISOs

In order to demonstrate an attack on the tie-lines as described in Section 3.2, since we do not have access to theEuropean grid or the U.S. Eastern Interconnection, we
modified the Polish grid 2008 in a principled manner to
11

0.8
0.6
0.4
0.2

25

Op Cost Increase (%)

Op Cost Increase (%)

1

5 Reserved Gen.
10 Reserved Gen.

20
15
10
5
0

25
5 Reserved Gen.
10 Reserved Gen.

20
15
10
5
0

1

2

3

4

Power Demand Increase (%)

0

5

1

2

3

4

5

Power Demand Increase (%)(b)(a)
Figure 16: Tie-line vulnerabilities in the partitioned Polish grid2008. (a) The ratios of tie-lines’ power flows to their nominal
capacity. (b) Failures in the tie-lines between the yellow area
and the light blue area caused by decreasing the demand by 1.5%in the former and increasing the demand by 1.5% in the latterby an adversary. Failed lines are shown in black.

(a)(b)
Figure 17: Increase in the operating cost of the Polish grid 2004
by an adversary. The initial demand is 10% higher than theoriginal demand during the Summer 2004 morning peak. (a)If the operating costs of the reserve generators are linear functions 𝑐1 (𝑥) = 100𝑥, and (b) if the operating costs of the reserve
generators are quadratic functions 𝑐2 (𝑥) = 5𝑥2 + 100𝑥.

represent a few neighboring ISOs in Europe connected bya few tie-lines.
First, we used a spectral clustering method to partition
the Polish grid into 5 areas with a few connecting tielines. This is done using MATLAB’s Community Detection Toolbox [34, 36]. Since the Polish grid does notinherently have 5 areas, however, the number of tie-lines
between areas is slightly more than those of the European
grid or Eastern Interconnection. Therefore, we removed
one fifth of the tie-lines. In order to make the power flows
feasible then, we reduced the total supply and demandby 60% and increased the capacity on the lines that wereoverloaded.
Fig. 16(a) shows the modified grid along with the ratiosof tie-lines’ power flows to their nominal capacities. As
can be seen, similarly to the real grid operation, some ofthese tie-lines are carrying power flows near their capacities. These lines–which can be detected through someof the ISOs’ websites [5]–are the most vulnerable to thisvariation of the MadIoT attacks.
For example, as can be seen in Fig. 16(a), the two linesthat are connecting the yellow area to the light blue area
are carrying power flows near their capacities. Therefore,
increasing the demand in the light blue area and decreasing the demand in the yellow area (corresponding to thedirection of the power flow on the lines) can potentiallyresult in those lines tripping. It can be seen in Fig. 16(b)that a 1.5% decrease in the demand of the yellow area anda 1.5% increase of the demand in the light blue area byan adversary results in the failure of the two tie-lines (additional attacks on the other tie-lines are demonstrated in
Figs. B.3(a) and B.3(b) in the appendix). Hence, an adversary can cause a failure in a tie-line by only a botnet
of size 15 bots/𝑀𝑊 , or in this case 60 thousand bots (30thousand bots at each end of the tie-line).
Since the tie-lines usually carry substantial amounts ofpower, failure in these lines can result in cascade of line
failures in other lines and eventually in disconnection of
an ISO from the interconnection. Such a disconnection

may result in a huge imbalance in the supply and demandvalues and in uncontrollable frequency drop leading to an
inevitable blackout.
Attacks on the tie-lines are an effective approach whenan adversary has a limited number of bots. By disconnecting an ISO from its neighboring ISOs, an adversary
can cause a huge demand deficit in the targeted ISO andpossibly a large-scale blackout.

4.4

Increasing the Operating Cost

In this final subsection, we evaluate the last variation of
the MadIoT attacks described in Section 3.2. In this variation of the attacks, an adversary increases the demand
not to necessarily cause a blackout, but rather to significantly increase the operating cost of the grid in favor of autility in the electricity market.
4.4.1

50 Bots per 𝑀𝑊 Can Increase the Operating
Cost by 20%

For these simulations, we use the Polish grid in Summer 2004. However, in order to mainly focus on the cost
related issues, we increase the line capacities to make surethat the attack causes no line overloads. To simulate thesystem in its peak demand state, we increase the initial
demand by 10% to make the demand before the attack
close to the online generators’ generation capacity.
We assume that the sudden increase in the demandcaused by the attack can temporarily be handled by the
primary controller and no large frequency drops as in
Section 4.2 happen in any of the scenarios here. Therefore, our focus is on the cost of the required reserve generators for providing the additional power and returning
the system’s frequency back to 60𝐻𝑧 (or 50𝐻𝑧).
We consider two cases, one with 5 reserve generators,
and the other one with 10. We also consider two possible
cost functions for the reserve generators: 𝑐1 (𝑥) = 100𝑥
and 𝑐2 (𝑥) = 5𝑥2 + 100𝑥, in which 𝑥 is in 𝑀𝑊 and the𝑐𝑖 (𝑥)s are in $∕ℎ𝑟. The linear and quadratic cost functions are the most common functions for approximating
the generation costs [62, Chapter 3]. The 𝑐1 (𝑥) is selected12

similarly to cost function of the high-cost online generators in the grid before the attack and the 𝑐2 (𝑥) is selected
to capture the start-up cost of the reserve generators aswell as their higher cost compared to the online generators.
Fig. 17 shows the increase in the total cost given thetwo cost functions. As can be seen, in the worst-case scenario, a 5% increase in the demand–which requires 50
bots/𝑀𝑊 , or in this case 1 million bots–can result in
about a 20% increase in the operating cost of the grid(see the yellow line in Fig. 17(b)). This is four times
higher than the best-case scenario (see the orange line in
Fig. 17(a)) which is similar to the normal increase in theoperating cost when no reserve generators are needed.
We observe that the effectiveness of the attack in increasing the cost depends on the total number of reserve
generators as well as their generation cost functions.

5the effectiveness of an attack.

5.2

The security challenges facing IoT devices are much
more difficult to deal with. There are many ways an adversary can access a smart appliance. An adversary candirectly get access to the device, or get access to the mobile phone, tablet, or a thermostat that controls that device, or with the ubiquity of digital home assistant devices such as Amazon Alexa or Google Home, an adversary can control smart appliances by getting access tothese devices. Any of these devices can be a breaching
point for an adversary. Hence, coherent security measures are needed to protect almost all the devices withina home network against an adversary.
Thus, in the IoT side, more research is required to study
the vulnerability of IoT devices and networks, and to protect them against cyber attacks.

Countermeasure Sketches
6

Although we are not aware of any rigorous countermeasures against the MadIoT attacks, in this section, we
briefly provide a set of suggestions both in the power grid
operation side and in the IoT design side to reduce the effectiveness of these attacks.

5.1

IoT Side

Related Work

The security and vulnerability of the IoT against cyberattacks has been widely studied [21,42,45,50,53,57,63].
In a recent study of the DDoS attack by the Mirai botnet [12], Antonakakis et al. showed that due to poor security measures in the IoT devices, such as easy to guess default passwords, an attacker could get access to about 600
thousand devices from cameras to DVRs and routers in avery short period. Similar studies had previously shownthat Honeywell home controllers (including thermostats)could easily be compromised due to a pair of bugs in theirauthentication system [6]. It was also shown by Hernandez et al. that the lack of proper hardware protections
in Nest thermostats allows attackers to install malicious
software on these devices [33]. The vulnerability of Arduino Yun microcontrollers–used in some IoT devices–tocyber attacks was also revealed by Pastrana et al. [47].
In an interesting recent work [64], Zhang et al. demonstrated that home assistant devices can be controlled byan adversary using inaudible voice commands. In another recent work [49], Ronen et al. demonstrated that thesmart lights within a city can potentially be compromisedby creating a worm that can affect all the lamps using
Zigbee. The security of mobile applications that control
IoT devices has also been studied [28, 43]. In a comprehensive work [28], Fernandes et al. studied security of
all Samsung-owned SmartThings apps and demonstrated
that due to the security flaws in these applications, they
could perform attacks like disabling vacation mode of asmart home. Naveed et al. also demonstrated that malicious apps on Android devices can freely mis-bond withany external IoT devices and control them [43].
Power systems’ vulnerability to failures and attacks has
been widely studied in the past few years [14, 17, 18, 23,54]. In a recent work [29], Garcia et al. introduced Har-

Power Grid SideOne of the most important properties of the MadIoT
attacks, as mentioned in Section 3.3, is that grid operators, in general, are not prepared for these types ofattacks. Hence, these types of attacks are not part ofthe contingency list of the power grid operators. Our
first suggestion is for the grid operators to consider the
MadIoT attacks in their contingency list and prepare forthem. Such preparations can be directly incorporated into
their already existing day-ahead planning tools to ensurethat their systems have for example enough inertia (orspinning reserve) and the power lines have enough extra capacity to minimize the effects of a potential attacks.
Although this might initially increase the grid operating
cost, by developing more efficient planning tools and applying recent advances in designing virtual inertia for
power systems [32], these costs can be reduced in the future. Thus, our suggestion for system operators is to pushfor more research in that direction in order to make theirsystems more robust to potential MadIoT attacks.
To minimize costs, the grid operators should also havean accurate estimate of the total number of high wattage
IoT devices in their system and accordingly the scale of apotential attack, without being overprotective.
Since this is a new type of attack, enabled by the ubiquity of IoT devices, our last suggestion for the systems
operators is to revisit their online data and to find secureways to release their data without revealing any criticalinformation that can be used by an adversary to improve13

vey, malware that affects power grid control systems andcan execute malicious commands. Theoretical methods
for detecting cyber attacks on power grids and recovering information after such attacks have also been developed [15, 20, 37, 39, 40, 55]. However, most of the previous work has focused on the attacks that directly target thepower grid’s physical infrastructure or its control system.
The interdependency between failures in power grids
and communication networks, and their propagation has
also been recently studied [16, 38, 46], but these works
focused on attacks and failures that target both the power
grid’s and the communication network’s physical infrastructure at the same time.
Load altering attacks on smart meters and large cloudservers has been first introduced by Mohsenian et al. [41].
Their work was mostly focused on the cost of protecting the grid against such attacks at loads. In contrast,
we have analyzed the consequence of such attacks andintroduced practical ways that they can be performed.
Amini et al. [11] have also recently studied the effectsof load altering attacks on the dynamics of the system
and ways to use the system’s frequency as feed-back to
improve an attack. In two very recent papers, Dvorkin
and Sang [24], and Dabrowski et al. [19] independently
revealed the possibility of exploiting compromised IoT
devices to disrupt normal operation of the power grid.
Dvorkin and Sang [24] modeled their attack as an optimization problem for the attacker–with complete knowledge of the grid–to cause circuit breakers to trip in the
distribution network. In contrast, we have focused onblack-box attacks on transmission networks. Dabrowski
et al. [19] studied the effect of demand increases causedby remotely activating CPUs, GPUs, hard disks, screen
brightness, and printers on the frequency of the European
power grid. To the best of our knowledge, however, thework presented in this paper provides the most coherent
and complete study on the effects of potential attacks on
the power grid using high wattage IoT devices.
There is another line of research that focuses on privacy of the customers in the presence of smart power meters which is beyond the scope of our paper [30].

7with access to the details of their systems.
Second, in our studies, we have not fully considered
the existing control mechanisms for minimizing the subsequent effects of an initial failure (e.g., preventive loadshedding mechanisms). Hence, our cascading failures
analysis may only reflect the worst case scenario.
Third, some of these high wattage IoT devices like air
conditioners, have very large capacitors. Hence, it takesthese devices 10 to 15 seconds to reach their maximum
capacities. Therefore, it might be challenging to cause an
abrupt increase in the demand and subsequently sudden
drop in the frequency using these devices. Nevertheless,other smart devices like water heaters that are resistive
loads can still be used for such purposes. Moreover, othervarieties of the MadIoT attacks that do not require synchronicity on the scale of seconds (e.g., line failures) canstill be performed using air conditioners.
Finally, unlike DDoS attacks, for the MadIoT attacks,
the IoT bots should all be geographically located withinboundaries of a power system. Hence, although the numbers of bots in Table 2 are achievable considering recent
botnet sizes (e.g., the Mirai botnet), it might be much
more challenging to reach these numbers within a targeted geographical location.

8

Conclusions

We have studied the collective effects of vulnerable
high wattage IoT devices and have shown that once compromised, an adversary can utilize these devices to perform attacks on the power grid. We have revealed a newclass of attacks on the power grid using an IoT botnet
called Manipulation of demand via IoT (MadIoT) attacks.
We have demonstrated via state-of-the-art simulators thatthese attacks can result in local outages as well as largescale blackouts in the power grid depending on the scaleof the attack as well as the operational properties of thegrid. Moreover, we have shown that the MadIoT attacks
can also be used to increase the operating cost of the grid
to benefit a few utilities in the electricity market.
We hope that our work raises awareness of the significance of these attacks to grid operators, smart appliancemanufacturers, and systems security experts in order tomake the power grid (and other interdependent networks)
more secure against cyber attacks. This is especially critical in the near future when more smart appliances withthe ability to connect to the Internet are going to be manufactured. In particular, our work leads to following recommendations for the research community:
Power systems’ operation: Power systems’ operators
should rigorously analyze the effects of potential MadIoT
attacks on their systems and develop preventive methods
to protect their systems. Initiating a data sharing platform between academia and industry may expedite thesedevelopments in the future.

Limitations and Future WorkIn this work, we have analyzed the potential consequences of the MadIoT attacks on the operation of thepower grid. However, our study has some limitations, andby addressing them one can provide a clearer picture of
the threats facing the grid now and in the future. First, as
mentioned in Section 4, we have only used publicly available data sets that may not exactly reflect the characteristics of all existing power grids. Therefore, the number ofbots listed in Table 2 may not be enough to cause significant damage to all power grids. More detailed analysis of
MadIoT attacks should be performed by system operators
14

IoT security: As shown by both presented MadIoT attacks and the Mirai botnet, insecure IoT devices can havedevastating consequences that go far beyond individual
security/privacy losses. This necessitates a rigorous pursuit of the security of IoT devices, including regulatory
frameworks.
Interdependency: Our work demonstrates that interdependency between infrastructure networks may lead tohidden vulnerabilities. System designers and security analysts should explicitly study threats introduced by interdependent infrastructure networks such as water, gas,transportation, communication, power grid, and several
other networks.

[13] AUSTRALIAN E NERGY M ARKET O PERATOR (AEMO).
Black system South Australia 28 september 2016.
https://www.aemo.com.au/-/media/Files/
Electricity/NEM/Market_Notices_and_Events/
Power_System_Incident_Reports/2017/
Integrated-Final-Report-SA-Black-System28-September-2016.pdf. Accessed: Jan. 2018.
[14] B IENSTOCK, D. Electrical Transmission System Cascades andVulnerability: An Operations Research Viewpoint. SIAM, 2016.
[15] B IENSTOCK, D., AND E SCOBAR, M. Computing undetectableattacks on power grids. ACM PER 45, 2 (2017), 115–118.
[16] B ULDYREV, S., PARSHANI, R., PAUL, G., STANLEY, H., AND
H AVLIN, S. Catastrophic cascade of failures in interdependent
networks. Nature 464, 7291 (2010), 1025–1028.
[17] CARRERAS, B., LYNCH, V., D OBSON, I., AND N EWMAN, D.
Critical points and transitions in an electric power transmission
model for cascading failure blackouts. Chaos 12, 4 (2002), 985–
994.

Acknowledgments
This work was supported in part by the U.S. National
Science Foundation under Grants DMS-1736417, ECCS1549881, and CNS-1553437, and Office of Naval Research YIP Award. We also thank anonymous reviewers
for their helpful comments.

[18] C ETINAY, H., SOLTAN, S., K UIPERS, F. A., Z USSMAN, G., AND
VAN M IEGHEM , P. Analyzing cascading failures in power grids
under the AC and DC power flow models. In Proc. IFIP Performance’17 (Nov. 2017).
[19] DABROWSKI, A., U LLRICH, J., AND W EIPPL, E. R. Gridshock: Coordinated load-changing attacks on power grids: The
non-smart power grid is vulnerable to cyber attacks as well. In
Proc. ACM ACSAC’17 (Dec. 2017).

References[1] Amazon Echo.
https://www.amazon.com/all-newamazon-echo-speaker-with-wifi-alexa-darkcharcoal/dp/B06XCM9LJ4. Accessed: Jan. 2018.

[20] D ÁN, G., AND SANDBERG, H. Stealth attacks and protection
schemes for state estimators in power systems. In Proc. IEEE
SmartGridComm’10 (2010).

[2] Aquanta: Heat water when you need it, save money when you
don’t. https://aquanta.io/. Accessed: Jan. 2018.
[3] GE
Wi-Fi
connect
appliances.
www.geappliances.com/ge/connectedappliances/. Accessed: Jan. 2018.

[21] D ENNING, T., KOHNO, T., AND L EVY, H. M. Computer security
and the modern home. Commun. ACM 56, 1 (2013), 94–103.

http://[22] D OBAKHSHARI, A. S., AND R ANJBAR, A. M. A novel method
for fault location of transmission lines by wide-area voltage measurements considering measurement errors. IEEE Trans. Smart
Grid 6, 2 (2015), 874–884.

[4] Google Home. https://store.google.com/product/
google_home. Accessed: Jan. 2018.
[5] New York Independent System Operator (NYISO). http://
www.nyiso.com/public/index.jsp. Accessed: Jan. 2018.

[23] D OBSON, I. Cascading network failure in power grid blackouts.
Encyclopedia of Systems and Control (2015), 105–108.

[6] Pair of bugs open Honeywell home controllers up to easy hacks.
https://threatpost.com/pair-of-bugs-openhoneywell-home-controllers-up-to-easyhacks/113965/. Accessed: Jan. 2018.

[24] DVORKIN, Y., AND GARG, S. IoT-enabled distributed cyberattacks on transmission and distribution grids. In Proc. NAPS’17(Sept 2017).
[25] E UROPEAN N ETWORK OF T RANSMISSION SYSTEM O PERATORSFOR E LECTRICITY (ENTSOE). Frequency stability evaluation
criteria for the synchronous zone of continental Europe. https://www.entsoe.eu/Documents/SOC%20documents/
RGCE_SPD_frequency_stability_criteria_v10.pdf.
Accessed: Jan. 2018.

[7] PowerWorld Simulator. https://www.powerworld.com/.
Accessed: Jan. 2018.
[8] Tado intelligent AC control. https://www.tado.com/us/.
Accessed: Jan. 2018.
[9] The Federal Energy Regulatory Comission (FERC) and theNorth American Electric Reliability Corporation (NERC).
Arizona-Southern California Outages on September 8, 2011.
http://www.ferc.gov/legal/staff-reports/0427-2012-ferc-nerc-report.pdf. Accessed: Jan. 2018.
[10] U.S. Energy Information Administration (EIA).
www.eia.gov/. Accessed: Jan. 2018.

[26] E UROPEAN N ETWORK OF T RANSMISSION SYSTEM O PERATORS FOR E LECTRICITY (ENTSOE). Continental Europe
operation handbook, 2004.
https://www.entsoe.eu/
publications/system-operations-reports/
operation-handbook/Pages/default.aspx.
Accessed: Jan. 2018.

https://[27] FEDERAL E NERGY R EGULATORY COMMISSION AND OTHERS.
Energy Primer, a Handbook of Energy Market Basics. 2012.

[11] A MINI, S., PASQUALETTI, F., AND M OHSENIAN-R AD, H. Dynamic load altering attacks against power system stability: Attack
models and protection schemes. IEEE Trans. Smart Grid 9, 4
(2018), 2862–2872.

[28] FERNANDES, E., JUNG, J., AND PRAKASH, A. Security analysis
of emerging smart home applications. In Proc. IEEE S&P’16(2016), pp. 636–654.

[12] A NTONAKAKIS, M., A PRIL, T., BAILEY, M., B ERNHARD, M.,
B URSZTEIN, E., COCHRAN, J., D URUMERIC, Z., H ALDERMAN,
J. A., INVERNIZZI, L., K ALLITSIS, M., ET AL. Understanding
the Mirai botnet. In Proc. USENIX Security Sympsion’17 (Aug.
2017).

[29] GARCIA, L., B RASSER, F., C INTUGLU, M. H., SADEGHI, A.-R.,
M OHAMMED, O., AND Z ONOUZ, S. A. Hey, my malware knows
physics! attacking PLCs with physical model aware rootkit. In
Proc. NDSS’17 (2017).

15

[30] G IACONI, G., G ÜNDÜZ, D., AND POOR, H. V. Privacy-aware
smart metering: Progress and challenges. IEEE Signal Process.
Mag. (to appear) (2018).

[49] RONEN, E., SHAMIR, A., W EINGARTEN, A.-O., AND O’FLYNN,
C. IoT goes nuclear: Creating a ZigBee chain reaction. In Proc.
IEEE S&P’17 (2017).

[31] G LOVER, J. D., SARMA, M. S., AND OVERBYE, T. Power System
Analysis & Design, SI Version. Cengage Learning, 2012.

[50] SACHIDANANDA, V., TOH, J., SIBONI, S., SHABTAI, A., AND
E LOVICI, Y. Poster: Towards exposing internet of things: A
roadmap. In Proc. ACM CCS’16 (2016).

[32] G ROSS , D., BOLOGNANI, S., POOLLA, B. K., AND D ÖRFLER, F.
Increasing the resilience of low-inertia power systems by virtualinertia and damping. In Proc. IEEE IREP’17 (2017).

[51] SAUER, P., AND PAI, M. Power System Dynamics and Stability.
Prentice Hall, 1998.
[52] SHARMA, A., SRIVASTAVA, S., AND C HAKRABARTI, S. Testingand validation of power system dynamic state estimators using
real time digital simulator (RTDS). IEEE Trans. Power Syst. 31,
3 (2016), 2338–2347.

[33] H ERNANDEZ, G., A RIAS, O., B UENTELLO, D., AND JIN, Y.
Smart nest thermostat: A smart spy in your home. Black Hat
USA (2014).
[34] H ESPANHA, J. P.
An efficient Matlab algorithm forgraph partitioning.
Technical Report (2004).
https://www.ece.ucsb.edu/~hespanha/published/trell-gp.pdf. Accessed: Jan. 2018.

[53] SIMPSON, A. K., ROESNER, F., AND KOHNO, T. Securing vulnerable home IoT devices with an in-hub security manager. In Proc.
IEEE PerCom’17 (2017).

[35] ILLINOIS C ENTER FOR A SMARTER E LECTRIC G RID (ICSEG).
Power test cases.
http://icseg.iti.illinois.edu/
power-cases/. Accessed: Jan. 2018.

[54] SOLTAN, S., M AZAURIC, D., AND Z USSMAN, G. Analysis of failures in power grids. IEEE Trans. Control Netw. Syst. 4, 3 (2017),
288–300.

[36] K EHAGIAS,
A.
Community detection toolbox.
https://www.mathworks.com/matlabcentral/
fileexchange/45867-community-detectiontoolbox. Accessed: Jan. 2018.

[55] SOLTAN, S., YANNAKAKIS, M., AND Z USSMAN, G. Joint cyberand physical attacks on power grids: Graph theoretical approaches
for information recovery. In Proc. ACM SIGMETRICS’15 (June2015).
[56] STATISTA.
Number of homes with smart thermostats inNorth America from 2014 to 2020 (in millions). https://www.statista.com/statistics/625868/homeswith-smart-thermostats-in-north-america/.
Accessed: Jan. 2018.

[37] K IM , J., TONG, L., AND T HOMAS, R. J. Subspace methods fordata attack on state estimation: A data driven approach. IEEE
Trans. Signal Process. 63, 5 (2015), 1102–1114.
[38] KORKALI, M., V ENEMAN, J. G., T IVNAN, B. F., BAGROW, J. P.,
AND H INES, P. D. Reducing cascading failure risk by increasing
infrastructure network interdependence. Sci. Rep. 7 (2017).

[57] SURBATOVICH, M., A LJURAIDAN, J., BAUER, L., DAS, A., AND
JIA, L. Some recipes can do more than spoil your appetite: Analyzing the security and privacy risks of ifttt recipes. In Proc.
WWW’17 (2017).

[39] L I, S., Y ILMAZ, Y., AND WANG, X. Quickest detection of false
data injection attack in wide-area smart grids. IEEE Trans. Smart
Grid 6, 6 (2015), 2725–2735.

[58] T HE U NITED NATIONS.
Demographic yearbook, 2017.
https://unstats.un.org/unsd/demographicsocial/products/dyb/dybcensusdata.cshtml.
Accessed: Jan. 2018.

[40] L IU, Y., N ING, P., AND R EITER, M. K. False data injection attacks
against state estimation in electric power grids. ACM Trans. Inf.
Syst. Secur. 14, 1 (2011), 13.

[59] U NION[41] M OHSENIAN-R AD, A.-H., AND L EON-GARCIA, A. Distributed
internet-based load altering attacks against smart power grids.
IEEE Trans. Smart Grid 2, 4 (2011), 667–674.

SION

OF

FOR THE C OORDINATION OF THE T RANSMISE LECTRICITY (UCTE). Final report of the in-vestigation committee on the 28 September 2003 blackout
in Italy. http://www.rae.gr/old/cases/C13/italy/
UCTE_rept.pdf. Accessed: Jan. 2018.

[42] NAEINI, P. E., B HAGAVATULA, S., H ABIB, H., D EGELING, M.,
BAUER, L., C RANOR, L., AND SADEH, N. Privacy expectations
and preferences in an IoT world. In Proc. SOUPS’17 (2017).
[43] NAVEED, M., Z HOU, X.-Y., D EMETRIOU, S., WANG, X.,
AND G UNTER , C. A. Inside job: Understanding and mitigating the threat of external device mis-binding on android. In Proc.
NDSS’14 (2014).

[60] U.S.-C ANADA POWER SYSTEM O UTAGE T ASK FORCE.
Report on the August 14, 2003 blackout in the UnitedStates and Canada:
Causes and recommendations.
https://energy.gov/sites/prod/files/oeprod/
DocumentsandMedia/BlackoutFinal-Web.pdf.
Accessed: Jan. 2018.

[44] NEPLAN-POWER SYSTEMS ANALYSIS. Turbine-governor models. http://www.neplan.ch/wp-content/uploads/
2015/08/Nep_TURBINES_GOV.pdf. Accessed: Jan. 2018.

[61] WANG, N., Z HANG, J., AND X IA, X. Energy consumption of
air conditioners at different temperature set points. Energy and
Buildings 65 (2013), 412–418.

[45] N IA, A. M., AND JHA, N. K. A comprehensive study of securityof internet-of-things. IEEE Trans. Emerg. Topics Comput. 5, 4(2017), 586–602.

[62] WOOD, A. J., AND WOLLENBERG, B. F. Power Generation,
Operation, and Control. John Wiley & Sons, 2012.

[46] PARANDEHGHEIBI, M., AND M ODIANO, E. Robustness of interdependent networks: The case of communication networks andthe power grid. In Proc. IEEE GLOBECOM’13 (2013).

[63] Y U, T., SEKAR, V., SESHAN, S., AGARWAL, Y., AND X U, C. Handling a trillion (unfixable) flaws on a billion devices: Rethinking
network security for the internet-of-things. In Proc. ACM HotNets’15 (2015).

[47] PASTRANA, S., RODRIGUEZ-CANSECO, J., AND CALLEJA, A.
ArduWorm: A functional malware targeting Arduino devices.
COSEC Computer Security Lab (2016).

[64] Z HANG, G., YAN, C., JI, X., Z HANG, T., Z HANG, T., AND X U,
W. DolphinAttack: Inaudible voice commands. In Proc. ACM
CCS’17 (2017).

[48] R AMIREZ, L., AND D OBSON, I. Monitoring voltage collapse
margin with synchrophasors across transmission corridors withmultiple lines and multiple contingencies. In Proc. IEEE PESGM’15 (2015).

[65] Z IMMERMAN, R. D., M URILLO-SÁNCHEZ, C. E., AND T HOMAS,
R. J. MATPOWER: Steady-state operations, planning, and analysis tools for power systems research and education. IEEE Trans.
Power Syst. 26, 1 (2011), 12–19.

16

Appendix
Asive load shedding. The details of the events leading tothis blackout can be found in [59].
How an adversary could have initiated a similar scenario? An adversary could actively monitor the power
flow on the tie-lines through European grids’ websites
and overload the tie-lines by increasing power demand in
Italy and possibly decreasing power demand in Switzerland or France. This could have resulted in the failure of
the same tie-lines and subsequent failures.

Historical Blackouts Details

In this appendix, we briefly review a few of the recent
blackouts in the power grids around the world to further
demonstrate the potential effectiveness of the MadIoT attacks.

A.1

The 2003 Blackout in the U.S. andCanadaA.3

The August 14, 2003, blackout in the U.S. andCanada is one of the largest blackouts in history. It affected an area with an estimated 50 million people and61, 800𝑀𝑊 of power in the states of Ohio, Michigan,
Pennsylvania, New York, Vermont, Massachusetts, Connecticut, New Jersey and the Canadian province of Ontario. According to the aftermath report [60], the failure started with a generator failure in Ohio due to an underpredicted reactive load to serve high air conditioning
demand. After the initial failure, the Ohio grid operators were forced to import power which caused more line
failures due to overloads and lines touching nearby trees.
Within hours, the line failures cascaded and caused failure in major tie-lines between ISOs. This resulted in disconnection of the Eastern interconnection into East andWest parts which caused further frequency and voltage
instabilities and a large-scale blackout. The details of theevents leading to the blackout can be found in [60].
How an adversary could have initiated a similar scenario? In a relatively hot summer day (but not the hottestday), an adversary could have initiated the same event byoverloading the Ohio system by increasing the reactive
power demand by remotely starting several air conditioners. This could cause an unexpected shortage in reactive
power generation and possibly the same generator failureand consequent voltage collapse events.

A.2

The 2011 Blackout
Southern California

inArizona-

The September 8, 2011, Arizona-Southern California
affected approximately 2.7 million people. It started witha single high voltage line failure due to a fault which redistributed power towards the San Diego area on a hot
day during hours of peak demand. Within minutes thisredistribution of power resulted in more line and transformer failures (which are modeled as line failures in simulations in the previous section) and eventually separation of the San Diego area from rest of the Western Interconnection. This separation resulted in a huge imbalance
between the supply and demand in the San Diego area anda frequency drop which caused generation tripping and a
blackout. The details of the events can be found in [9].
How an adversary could have initiated a similar scenario? An adversary could have caused the same initialline failure (which was operating within 78% of its capacity) by increasing the demand in the San Diego area andpossibly reducing the demand in Arizona.

A.4

The 2016 Blackout in South Australia

The September 28, 2016, blackout in South Australia
affected approximately 1 million customers. Extreme
weather conditions on September 28 caused failure inthree transmission lines. Following these failures, there
was a 456𝑀𝑊 reduction in wind generation in the South
Australia grid which resulted in an increase in imported
power and further tripping of the tie-lines. As a result,
the South Australia grid was separated from rest of theAustralian grid. This resulted in 900𝑀𝑊 imbalance is
supply and demand, and a sudden drop in the frequency
which caused a blackout in the system. The details ofthese events can be found in [13].
What is special about this blackout is that a big portionof the electric power in South Australia in generated bywind turbines and solar panels (about 75%) which havevery low inertia. This is the main reason for the very
quick drop in the frequency after the separation of theSouth Australian grid from the rest of the interconnection, without the grid operator having a chance to respondto the imbalance by load shedding. This event, in particular, shows that in places or times that renewable resources
have a higher share of the power generation, the grid is

The 2003 Blackout in Italy

The September 28, 2003, blackout was the most serious blackout in Italy and caused an outage almost everywhere in Italy. At around 3pm in the afternoon, Italy
was importing 3, 610𝑀𝑊 and 2, 212𝑀𝑊 of power from
Switzerland and France, about 600𝑀𝑊 and 400𝑀𝑊
above their scheduled exchange agreements, respectively.
At this time, one of the tie-lines between Switzerland and
Italy tripped due to an overload and touching a tree. This
resulted in an overload in another tie-line between the twocountries and tripping of the second line. After, the second line failure, further lines between Italy and France,
Austria, and Slovenia tripped due to overloads and caused
the Italian grid to be disconnected from the continental
European grid. This resulted in a huge imbalance between supply and demand within Italy and a frequency
drop that could not be recovered despite further aggres17

much more vulnerable to the MadIoT attacks that cause
sudden increases in the demand.
How an adversary could have initiated a similar scenario? Due to the low inertia of the South Australiangrid, the sudden increase in the demand by an adversary
in the area should be compensated by the tie-lines. This,depending on the amount of the increase, can potentiallyresult in the overload of the tie-lines and their failure.
Once they fail and the system is islanded, it may collapse
because of the supply and demand imbalance and a quick
frequency drop.

B

1
0.8
0.6
0.4
0.2

Extra Simulations and Details

0

In this appendix, we present supplemental simulation
results.

59.5
59
58.5
50

0.8

59.5

0.6

59

100

0.4
0

50

100

Time (sec)Time (sec)

(a)

(b)

0.2

62
Freq. Island 1
Freq. Island 2

60
58
56

0

50

100

Frequency (Hz)62

Frequency (Hz)Freq. Island 1
Freq. Island 2

60

58.5
0

54

1

60.5
Freq. Island 1
Freq. Island 2

60

Frequency (Hz)Frequency (Hz)

60.5

(a)

0

Freq. Island 1
Freq. Island 2

60

(b)

58

Figure B.2: Polish grid lines’ power flow to capacity ratio in (a)Summer 2004 and (b) Summer 2008.

56
54
0

50

Time (sec)Time (sec)

(c)

(d)

100

Figure B.1: Frequency disturbances during the black start due
to unexpected increases in all the load buses by an adversary (asdescribed in Section 4.2.2), ignoring generators’ frequency cutoff limits (shown by red dashed lines). The maximum power
outputs for the generators’ governors are different in this figure
from that of the generators in Fig. 11. (a) Normal black start
operation in the absence of an adversary. (b) Demand increasesof 10𝑀𝑊 at the load buses before the reconnection of the twoislands. (c) Demand increases of 20𝑀𝑊 at the load buses before the reconnection of the two islands. (d) Demand increasesof 30𝑀𝑊 at the load buses before the reconnection of the twoislands.

(a)(b)

Figure B.3: Tie-line vulnerabilities in the partitioned Polishgrid 2008. (a) Failures in the tie-lines between the yellow area
and the purple area caused by decreasing the demand by 1% in
the former and increasing the demand by 1% in the latter. All
the failed lines are shown in black. (b) Failures in several tielines caused by decreasing the demand by 1% in the yellow area
and increasing the demand by 0.3% in the purple, dark blue, andlight blue areas. All the failed lines are shown in black.

18