Critical Infrastructure Protection: Preliminary Observations on DHS Efforts to Address Electromagnetic Threats to the Electric Grid
Released: 2015-07-22T00:00:00

Letter

Background

An EMP is a burst of high power electromagnetic radiation resulting from the detonation of nuclear and non-nuclear devices that are designed to intentionally disrupt or destroy electronic equipment. EMP events may be further categorized into a number of different types, based on their specific source of initiation. The threat focused on primarily by the EMP Commission is the high-altitude EMP (HEMP). A HEMP event is caused by the detonation of a nuclear device at a high-altitude, about 40 to 400 kilometers, above the Earth’s atmosphere. A HEMP attack is not intended to cause direct physical impacts at the Earth’s surface, such as injury or damage directly from heat or blast, but instead interacts with the atmosphere to create an intense electromagnetic energy field that can overload computer circuitry and could cause significant damage to critical electrical infrastructure.

In addition to manmade EMPs, naturally occurring solar weather events can also cause related electromagnetic impacts that can adversely affect components of the commercial electric grid. This type of event is commonly referred to as a geomagnetic disturbance (GMD). In 1989, a GMD caused wide-scale impacts on the Hydro-Quebec power system in Canada which caused the electric grid to collapse within 92 seconds and left six million customers without power for 9 hours. As noted in Presidential Policy Directive 21 (PPD-21), energy sector infrastructure is uniquely critical due to the enabling functions it provides to other critical infrastructure sectors. Given this interdependency, an EMP or major GMD event that disrupts the electric grid could also result in potential cascading impacts on fuel distribution, transportation systems, food and water supplies, and communications and equipment for emergency services, as well as other communication systems which utilize the civilian infrastructure. PPD-21 also recognizes that DHS has numerous responsibilities to protect critical infrastructure, including such things as analyzing threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure.

Within DHS, the National Protection and Programs Directorate (NPPD) is responsible for working with public and industry infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s infrastructure through the development and implementation of the infrastructure protection program. NPPD has two principal offices with responsibilities to facilitate protection of critical infrastructure that could be at risk from EMP and GMD events—the Office of Infrastructure Protection (IP) and the Office of Cyber Security and Communications (CS&C). In addition, DHS’s Federal Emergency Management Agency (FEMA) and Science and Technology Directorate (S&T) have roles related to addressing potential impacts to the electric grid, which could include EMP and GMD threats.

DOE also has a significant role as the sector-specific agency for the energy sector, which includes critical infrastructure and key resources related to electricity. For example, DOE is responsible for developing an Energy Sector Specific Plan—in collaboration with other stakeholders, including DHS—that applies the NIPP risk management model to critical infrastructure and key resources within the sector. Within DOE, the Office of Electricity Delivery and Energy Reliability leads national efforts to increase the security and reliability of the energy infrastructure and facilitate recovery from disruptions to the energy supply. DOE national laboratories also provide research support and technical expertise to federal and industry stakeholders regarding EMP and GMD impacts.

Other principal federal agencies working to address the threat of EMP and GMD include the Department of Defense (DOD) and the Federal Energy Regulatory Commission (FERC), as well as the National Oceanic and Atmospheric Administration (NOAA), and National Aeronautics and Space Administration (NASA).

Electrical infrastructure is primarily operated by private industry which owns approximately 85 percent of the nation’s critical electrical infrastructure. Industry entities are represented, in part, through membership in industry associations such as the American Public Power Association and the Edison Electric Institute. The North American Electric Reliability Corporation (NERC) also serves as the delegated authority to regulate the protection and improvement of the reliability and security of the electrical infrastructure.

Preliminary Findings Indicate that DHS Actions to Address Electromagnetic Threats were Conducted Independently of the EMP Commission Recommendations

As of July 2015, DHS reported taking several actions that could help address electromagnetic threats to the electric grid, but these efforts were conducted independently of the 2008 EMP Commission recommendations. Our preliminary analysis of DHS’s actions indicates that they generally fell under four categories of effort: (1) developing reports, (2) identifying mitigation efforts, (3) strategy development and planning, and (4) conducting training exercises.

Developing Reports

Since 2008, DHS has produced three reports that specifically address electromagnetic threats to the electric grid. Below is a summary of each report.

Electromagnetic Pulse Impacts on Extra High Voltage Power Transformers. This 2010 report analyzed the potential impact of an EMP on extra high voltage transformers—focusing primarily on transformer equipment designs and identifying specific mitigation efforts such as blocking devices that minimize the impact of geomagnetically induced currents (GIC) on the electric grid. The report concluded that the similarity of EMP effects, regardless of source, indicates that geomagnetic storms provide a useful basis for transformer impact analysis and that selective installation of blocking devices would minimize the impacts of GIC on transformers, among other findings.

Impacts of Severe Space Weather on the Electric Grid. This 2011 report assessed the impacts of space weather on the electric grid, seeking to understand how previous solar storms have affected some power grids, and what cost-effective mitigation efforts are available to protect the electric grid, among other topics. Some of the key findings and recommendations include the need for a rigorous risk assessment to determine how plausible a worse-case scenario may be and additional research to better understand how transformers may be impacted by electromagnetic threats. This report also recommended installation of blocking devices to minimize the impacts of GIC.

Sector Resilience Report: Electric Power Delivery.

This 2014 report summarizes an analysis of key electric power dependencies and interdependencies, such as communications, transportation, and other lifeline infrastructure systems. The report included an assessment of, and best practices for, improving infrastructure resilience such as: modeling to identify potential vulnerabilities, conducting a cost-benefit analysis of alternative, technology-based options, and installing protective measures and hardening at-risk equipment, among others.

Identifying Mitigation Efforts

DHS identified two specific efforts implemented since 2008 that could help to mitigate electromagnetic impacts to the electric grid. They are: (1) Recovery Transformer Project (RecX), and (2) Cyber Emergency Response Team.

RecX. In 2012, S&T partnered with industry to develop a prototype transformer that could significantly reduce the time to transport, install, and energize a transformer to aid recovery from power outages associated with transformer failures from several months to less than one week. S&T, along with industry partners, demonstrated the RecX prototype for 2.5 years, ending in September 2014. DHS reported that RecX proved to be successful in an operational environment and has the capacity to reduce the impact of power outages.

Cyber Emergency Response Team. CS&C operates the Industrial Control Systems-Cyber Emergency Response Team to assist critical infrastructure owners in the 16 sectors, including the energy sector, to improve overall cybersecurity posture of their control systems.Industrial control systems are among the types of critical electrical infrastructure that could be impacted in the event of an EMP attack.

Strategy Development and Planning

DHS has taken actions to support the development of two key strategies and plans that could help to address electromagnetic threats. These include areas: 1) Power Outage Incident Annex, and 2) the National Space Weather Strategy.

Power Outage Incident Annex. In 2014, FEMA began developing a Power Outage Incident Annex (incident annex) to provide incident- specific information, which supplements the National Response Framework. According to FEMA officials, the incident annex will describe the process and organizational constructs that the federal government will utilize to respond to and recover from loss of power resulting from deliberate acts of terrorism or natural disasters. Among other tasks, the incident annex is designed to identify key federal government capabilities and resources, prioritize core capabilities, and outline response and recovery resource requirements. FEMA officials reported that the incident annex is scheduled to be completed by October 2015.

National Space Weather Strategy. In collaboration with the White House Office of Science and Technology Policy and NOAA, DHS has been working since 2014 to help develop a National Space Weather Strategy. As a co-chair of the Space Weather Operations, Research and Mitigation Task Force, DHS is in the process of developing a strategy to achieve several goals, including efforts to establish benchmarks for space weather events, improve protection and mitigation efforts, and improve assessment, modeling, and prediction of impacts on critical infrastructure, among other goals. According to officials at S&T, a draft of the National Space Weather Strategy is currently being updated to incorporate stakeholder comments and is scheduled to be completed in September 2015.

Conducting Training Exercises

DHS has also conducted two training exercises that could help address the potential impact of power outages caused by electromagnetic events, GridEx II and Eagle Horizon.

GridEx II. In November 2013, DHS, along with the Federal Bureau of Investigation, DOE, and other relevant government agencies, participated in an industry-wide exercise assessing the readiness of the electricity industry to respond to a physical or cyber attack on the bulk power system. The key goals of GridEx II were to review existing command, control, and communication plans and tools, incorporate lessons learned from a previous exercise, and to identify potential improvements in cyber and physical security plans and programs. Upon completing the exercises, participants identified key lessons learned, which included the need for enhanced information sharing, and clarification of roles and responsibilities during a physical or cyber attack.

Eagle Horizon. Since 2004, FEMA has conducted a mandatory, annual continuity exercise for all federal executive branch departments and agencies to ensure the preservation and continuing performance of essential functions. Key objectives of the training exercise include: assessing the implementation of continuity plans, demonstrating communication capabilities, and examining broader national continuity capabilities with state, local, and private sector partners.

For our ongoing review, DHS did not identify its actions as specifically responsive to the EMP Commission’s recommendations; nonetheless, some of the actions DHS has taken since 2008 could help to mitigate some electromagnetic impacts to the electric grid. For example, the three identified reports provide some insights on how the electric grid may be impacted by electromagnetic threats. Additionally, the RecX project provided a functional prototype that may facilitate industry efforts to further develop more mobile transformers and assist with recovery efforts in the event of an electromagnetic attack on the electric grid. Similarly, DHS planning efforts to develop the power outage incident annex and space weather strategy are also steps that could help to mitigate the negative effects of an electromagnetic threat to the electric grid by improving critical planning and response efforts.

While DHS has taken several positive steps to address electromagnetic threats to the electric grid since the EMP Commission issued its recommendations in 2008, our preliminary analysis indicates that these actions may fall short of the expectations for DHS regarding overall responsibilities to oversee and coordinate national efforts to protect critical electrical infrastructure, consistent with PPD-21 and the NIPP. For example, DHS’s efforts to clearly identify agency roles and responsibilities to date have been limited. Specifically, DHS has had difficulty identifying the relevant DHS components, officials, or ongoing internal DHS activities with an EMP nexus. For example, DHS officials were unable to determine internally which component would serve as the lead—S&T or NPPD—in regards to addressing EMP threats. In addition, NPPD has not yet identified its specific roles and activities in addressing electromagnetic threats even though it has been identified by the DHS Office of Policy as the proposed risk analysis “owner” relative to space weather threats.

We recognize that DHS does not have a statutory obligation to address the specific recommendations of the EMP Commission and many of these recommendations were also directed to DOE. Nevertheless, we believe that implementation of them could help mitigate electromagnetic impacts to the electric grid, such as helping to assure the protection of high-value transmission assets. Moreover, PPD-21 articulates DHS’s roles and responsibilities to safeguard the nation’s critical infrastructure, which are consistent with such recommendations. For example, PPD-21 states that DHS, in carrying out its responsibilities under the Homeland Security Act of 2002, as amended, is to, among other things, evaluate national capabilities, opportunities, and challenges in protecting critical infrastructure; analyze threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure; identify security and resilience functions that are necessary for effective stakeholder engagement with all critical infrastructure sectors; integrate and coordinate federal cross-sector security and resilience activities; and identify and analyze key interdependencies among critical infrastructure sectors. Moreover, PPD-21 calls for DHS to specifically consider sector dependencies on energy and communications systems, and identify pre- event and mitigation measures or alternate capabilities during disruptions to those systems in updating the NIPP. To date, our preliminary analysis suggests that DHS has not fully addressed some key responsibilities related to effectively preparing for and responding to electromagnetic threats to the electric grid, in conjunction with DOE as the sector-specific agency for the energy sector, which is responsible for critical electrical infrastructure. Specifically, DHS did not identify any efforts it conducted to support the identification of key electrical infrastructure assets or assess cross-sector dependencies on these assets, for which DHS would be expected to play a key role. According to officials within NPPD and the DHS Office of Policy, factors such as competing priorities and a focus on all hazards may contribute to limited efforts being taken by DHS to specifically address electromagnetic threats. We will continue to assess the extent to which DHS’s efforts align with the EMP Commission recommendations as well as the extent to which DHS’s current and planned actions align with its own risk management framework, as identified in the NIPP, as we complete our work. We will report our final results later this year.

Preliminary Analysis Indicates DHS Has Not Fully Coordinated with Stakeholders to Address some Risks to the Electric Grid

Our preliminary analysis indicates that since the EMP Commission issued its recommendations in 2008, DHS has coordinated with federal and industry stakeholders to address some, but not all risks to the electric grid. Specifically, DHS has not fully coordinated with stakeholders in certain areas such as identifying critical assets or collecting information necessary to assess electromagnetic risks. Our preliminary work has identified eight projects in which DHS coordinated with other federal agencies or industry to help protect the electric grid. These projects encompass a range of different protective efforts, including the development of plans to address long term power outages, participation in exercises, and research and development activities which address the resiliency of electrical infrastructure (See Appendix II for a list of projects we identified.)

Four of the eight projects we identified were initiated within the past 2 years and three specifically address the risks associated with an EMP or GMD event. The three EMP or GMD-related projects include 1) participation in a White House Task Force to support development of an interagency space weather action plan; 2) collaboration with NASA to develop precise, localized forecasts that can help utilities better respond to solar weather events; and 3) development of EMP protection guidelines for critical equipment, facilities, and communications/data centers.

In addition to the specific projects identified above, DHS also coordinates with sector stakeholders through the Energy Sector Government Coordinating Council (EGCC)—which it co-chairs with DOE—and the Electricity Subsector Coordinating Council (ESCC) through the Critical Infrastructure Partnership Advisory Council. While federal officials generally identified that EMP and GMD issues have been discussed via these groups in recent years, they noted that the EMP threat has not been an area of particular focus.

Although DHS participation in the identified projects is a positive step to help mitigate some potential impacts of electromagnetic threats, our preliminary work suggests that DHS has not fully coordinated with stakeholders in other areas to help facilitate EMP and GMD protective efforts. Specifically, our preliminary analysis indicates that DHS has not fully coordinated with stakeholders to address electromagnetic threats to the electric grid in the following areas: Providing threat information. DHS has not identified any efforts to specifically provide EMP-related threat information to industry stakeholders. Industry officials we spoke with generally stated that they do not have sufficient threat information to determine the extent to which specific actions should be taken to mitigate the effects of an EMP event. Whereas industry officials reported having a greater understanding of the potential likelihood of a major GMD caused by solar weather, they noted that applicable EMP threat briefings by DOD or DHS could help them to better justify to their management or stockholders the level of investment required to take protective actions. According to the Quadrennial Energy Review, incomplete or ambiguous threat information may lead to inconsistency in physical security among grid owners, inefficient spending on security measures, or deployment of security measures against the wrong threat.

This concern generally aligns with previous work related to cyber threats in which we reported that federal partners’ efforts to share information did not consistently meet industry’s expectations, in part, due to restrictions on the threat information that can be shared with industry partners. generally concurred with our prior recommendations directed at strengthening its partnership and information-sharing efforts, and has since taken steps to enhance its information sharing activities, including granting security clearances, and establishing a secure mechanism to share cyber threat information. We will continue to assess DHS’s actions regarding providing threat information on EMP as part of our ongoing work.

Identifying key infrastructure assets. Our preliminary analysis indicates that DHS and DOE have not taken action to identify the most critical substations and transformers on the electric grid. According to the NIPP risk management framework, such information is important to better understand system dependencies and cascading impacts, as well as help determine priorities for collecting additional information on specific asset vulnerabilities or potential mitigation actions.

GAO, Critical Infrastructure Protection, Observations on Key Factors in DHS’s Implementation of its Partnership Approach, GAO-14-464T (Washington, D.C.: March 6, 2014). and other federal agencies regarding the identification of key infrastructure assets.

Collecting risk information. DHS has not fully leveraged existing programs or utilized collaboration opportunities with federal partners to collect additional vulnerability and consequence information related to potential impacts to the electric grid. For example, DHS-IP has not fully leveraged the Infrastructure Survey Tool and Regional Resiliency Assessment Program (RRAP) to help collect additional information related to infrastructure vulnerabilities and impacts related to electromagnetic threats. As we have concluded previously, coordination with other federal partners may also help ensure an integrated approach to vulnerability assessment activities.fully leveraged other agency efforts such as DOD’s Defense Critical Infrastructure Protection program which could provide useful information about potential consequences of electric grid failure. According to the NIPP, to assess risk effectively, critical infrastructure partners—including owners and operators, sector councils, and government agencies—need timely, reliable, and actionable information regarding threats, vulnerabilities, and consequences. As part of our ongoing work, we will continue to assess actions by DHS and other federal agencies regarding the collection of applicable risk information.

For example, DHS has also not Engaging with industry to identify research priorities and funding mechanisms. Enhanced collaboration among federal and industry partners is critical to help identify and address key research gaps and priorities, and leverage available funding mechanisms. Our preliminary analysis identified two areas—assessing transformer impacts and development of mitigation tools—where DHS has not fully pursued opportunities to collaborate with federal and industry stakeholders on research, testing and identifying funding sources that could help facilitate efforts to address electromagnetic threats to the electric grid. With respect to transformer impacts, industry and government officials identified the need for additional modeling and assessment as the most critical research gap. For example, the 2012 NERC GMD Task Force found that modeling the effects of GIC flows on transformers during a GMD event is not sufficiently developed. Stakeholders also noted that additional action is needed for evaluating and testing equipment that could help mitigate electromagnetic impacts to key infrastructure assets. Specifically, stakeholders identified that there are limited sites available for large-scale testing, and opportunities may exist to further leverage DOE research laboratories and other federal resources, including potential funding mechanisms.

In our ongoing review, we will continue to evaluate federal and industry actions to determine where specific coordination efforts could be improved and we will report the final results later this year.

Chairman Johnson, Ranking Member Carper and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

Appendix I: Summary of 2008 EMP Commission Recommendations Addressing Electrical Infrastructure

EMP Commission Recommendations 1. The Commission recommends research be conducted to better understand infrastructure system

interdependencies and interactions, along with the effects of various EMP attack scenarios. In particular, the Commission recommended that such research include a strong component of interdependency modeling. Funding could be directed through a number of avenues, including the Department of Homeland Security (DHS) and National Science Foundation. 2. Expand activities to address the vulnerability of Supervisory Control and Data Acquisition (SCADA) systems to other forms of electronic assault, such as EMP. 3. It is vital that DHS, as early as practicable, make clear its authority and responsibility to respond to an EMP attack and delineate the responsibilities and functioning interfaces with all other governmental institutions with individual jurisdictions over the broad and diverse electric power system. This is necessary for private industry and individuals to act to carry out the necessary protections assigned to them and to sort out liability and funding responsibility. 4. DHS particularly needs to interact with the Federal Energy Regulatory Commission (FERC), North American Electric Reliability Corporation (NERC), state regulatory bodies, other governmental institutions at all levels, and industry in defining liability and funding relative to private and government facilities, such as independent power plants, to contribute their capability in a time of national need, yet not interfere with market creation and operation to the maximum extent practical. 5. DHS must establish the methods and systems that allow it to know, on a continuous basis, the state of the infrastructure, its topology, and key elements. Testing standards and measurable improvement metrics should be defined as early as possible and kept up to date. 6. Working closely with industry and private institutions, DHS should provide for the necessary capability to control the system in order to minimize self-destruction in the event of an EMP attack and to recover as rapidly and effectively as possible.

GAO Contact and Staff Acknowledgments

GAO Contact

For questions about this statement, please contact Chris Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement.

Staff Acknowledgments

Individuals making key contributions to this statement include Dawn Hoff (Assistant Director), Chuck Bausell, Kendall Childers, Josh Diosomito, Ryan Lambert, Tom Lombardi, and John Rastler. Additional support was provided by Andrew Curry, Katherine Davis, Linda Miller, and Steven Putansu.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.