WASHINGTON — A terrorist attack on the U.S. power grid could be more destructive than superstorm Sandy, possibly costing hundreds of billions of dollars and leading to thousands of deaths, the National Academy of Sciences says.
While such an event probably wouldn’t kill people immediately, it could cause widespread blackouts for weeks or months, according to a recently declassified report released Wednesday by the Academy. If it occurred during extreme weather, heat stress or exposure to cold may lead to “hundreds or even thousands of deaths,” the authors of the study wrote.
“An event of this magnitude and duration could lead to turmoil, widespread public fear, and an image of helplessness that would play directly into the hands of the terrorists,” they said.
While other entities have issued reports on electric-grid vulnerabilities, the study released this week provides an unusually stark picture of what may happen if hackers, extremist groups, disgruntled employees or even energy companies themselves sabotage the nation’s power network. It calls for the government to create a national inventory of portable generation equipment that can be used during such an event.
An attack “could be carried out by knowledgeable attackers with little risk of detection or interdiction,” it said.
Potential threats to the system
The U.S. electricity network consists of a complicated web of generators, high-voltage power lines, lower voltage lines that run to homes and businesses, substations and other gear to keep electricity flowing smoothly across the country. The National Academy of Engineering called the transmission and distribution system, or the grid, “the world’s largest integrated machine.”
Threats to the network include physical and cyber attacks on equipment that is often decades-old and lacks the technology to limit the effects of such an event, the study said.
While a hurricane or ice storm usually only takes down distribution lines that utility crews can put back up, terrorists can disable transformers, which may take years to replace, said Alan Crane, a senior scientist who worked on the report. A well-planned operation could take out several substations, he said.
“It’s the multiple attacks that have the really scary consequences,” Crane said. Although the probability of such a conspiracy is low, the consequences “could just be really awful.”
The report raises questions about how a blackout would affect services including medical care, the water supply and the pumping of natural gas, which uses compressors powered by electricity, he said.
“Living without electricity is one thing,” Crane said. “Living without water is something else.”
Comparing the superstorm
An attack could inflict more damage than superstorm Sandy, which roared across the Eastern U.S. at the end of October, according to a statement released with the study. The storm temporarily tripped power to three nuclear reactors and caused a fourth, owned by Exelon Corp., to declare an alert.
Tens of thousands of people are still without power. The chief operating officer of the Long Island Power Authority resigned after Gov. Andrew Cuomo of New York, where 2 million homes and businesses lost electricity, ordered an investigation into the performance of the state’s utility companies.
Insured losses from the disaster will probably exceed $20 billion, according to QBE Insurance Group Ltd., which had a 3.5 percent share of U.S. commercial property insurance during the second quarter.
“High-voltage transformers are of particular concern because they are vulnerable to attack, both from within and from outside the substation where they are located,” according to the report. Transformers are often custom-built, difficult to transport because of their size, and made outside the U.S., meaning that the industry’s inventory could be “overwhelmed by a large attack,” it said.
Restructuring adds risk
Exacerbating the risk is the restructuring of grid ownership and oversight, begun in the 1990s to introduce more competition in the electricity marketplace, according to the study. Companies in California and regions including the Northeast and Midwest have ceded power-line network operations to independent grid authorities and compete in wholesale markets to supply electricity. Other regions, such as the Southeast have not restructured, resulting in patchwork of market systems across the United States.
“The push by federal regulators to introduce competition in bulk power across the country has also resulted in the transmission network being used in ways for which it was not designed,” the study’s authors wrote.
A 2005 U.S. energy law included measures to strengthen the power grid’s reliability, and the Federal Energy Regulatory Commission now has the ability to issue fines as high as $1 million per day for each reliability violation.
Cyber attacks on the electric grid “are unlikely to cause extended outages, but if well coordinated they could magnify the damage of a physical attack,” according to the report. Hackers could manipulate computerized systems on a network that is becoming increasingly digital, disabling security, blocking signals to operators or tampering with the buying and selling of energy through markets linked by the Internet, it said.
The report released Wednesday recommends that the Homeland Security Department take the lead in overseeing electric-grid security, working with the Energy Department and private companies to create a stockpile of mobile reserve equipment, including transformers, for the network. It also calls for the security agency to work with the FERC, state regulators, utilities and grid operators to make sure they have “appropriate incentives” to upgrade the system.
The release of the report will speed the adoption of new technology that will better protect the grid, Cicerone and Vest said.
Utilities including American Electric Power Co. of Columbus, Ohio, have already been working together to share cyber-threat information learned from software developed by Lockheed Martin Corp.