POWER August 2014 - 69

SECURITY
details, which were still classified. Waxman
said he had discussed the attack with the
FBI, and the law-enforcement agency agreed
to brief the House Energy and Commerce
Committee. LaFleur also said she would
permit FERC staff to discuss the attack with
the committee staff, although she refused to
reveal details because of the possibility of
" copycat " attacks. LaFleur acknowledged
that the April attack was the most sophisticated
attempt to disrupt the electric grid that
she had ever encountered.
This time, the Metcalf event got some
public traction.
In early February, veteran electricity industry
reporter Rebecca Smith of the Wall
Street Journal outlined what had happened.
A month later, she revealed in considerable
detail the internal FERC report on the key
vulnerabilities of the high-voltage transmission
grid. She quoted Wellinghoff, now a
private citizen, that it was " the most significant
incident of domestic terrorism involving
the grid that has ever occurred " in the U.S.
Smith clearly had a copy of the FERC report,
and the newspaper had been careful not to
identify the specific interconnections that the
agency's analysis said could bring down the
entire U.S. bulk power delivery system.
FERC's regular monthly public meeting
took place just days after Smith's Wall
Street Journal article. Two commissioners-
Philip Moeller and John Norris-pushed
back against the notion that physical grid
security was a big problem and attacked the
newspaper for revealing the FERC analysis.
Moeller said the U.S. has the " world's most
advanced and robust electric transmission
system that can respond instantly to planned
and unplanned outages and even attacks.
However, highlighting any real or perceived
vulnerabilities and sharing specific security
information or responsive actions may inadvertently
promote the prospect of additional
copycat attacks. " Norris said that " many
people have jumped on this reaction train, "
and that he feared a focus on the physical
threats to the power grid would divert attention
and syphon funding from smart grid
technologies that he favors. (Still, such attacks
have also occurred outside the U.S.;
see sidebar.)
Pressure Mounts
Nonetheless, the pressure built on FERC to
take some action on the prospects that oldfashioned
bullets, bombs, and wire cutters
could bring down the grid, not just hackers
with laptops in China or Los Angeles. Senate
Majority Leader Harry Reid (D-Nev.),
Wellinghoff's political godfather, wrote
to FERC and the North American Electric
Reliability Corp. (NERC), urging action to
August 2014 | POWER
Physical Grid Attacks Outside the U.S.
The U.S. is not the only country that has
seen physical attacks on its power system.
In late 2008, according to The Guardian
newspaper in the UK, " a single person "
was able, avoiding the nation's ubiquitous
closed circuit TV system, to climb
two 10-foot-high, razor-wire-topped and
electrified fences and crash a 500-MW
steam turbine generator at the Kingsnorth
coal-fired power plant in Kent, leaving a
calling card stating, " no new coal. "
According to the newspaper, " He walked
out the same way and hopped over the
fence. " The action, which might qualify
as " ecoterrorism, " shut the plant for four
hours. No accounts of the capture of the
protect the grid, as did Sens. Mary Landrieu
(D-La.), chairman of the Senate Energy and
Natural Resources Committee, and Lisa
Murkowski (R-Alaska), the ranking minority
member.
In early March 2014, FERC ordered
NERC, FERC's private-sector reliability
police, to prepare standards within 90 days
on how to protect the grid from physical attacks.
NERC has already been charged for
many years with developing cybersecurity
standards. LaFleur, the acting FERC chair,
said, " Today's order enhances the grid's resilience
by requiring physical security for
the facilities most critical to the reliable
operation of the bulk power system. It will
complement the ongoing efforts of FERC
and facility owners and operators to ensure
the physical security of the grid. "
The order gave NERC and the electricity
industry considerable flexibility in developing
the standards. FERC told the grid operators
to implement a three-step approach to
physical protection.
First was an assessment to, in FERC's
words, " identify facilities that, if rendered
inoperable or damaged, could have a critical
impact on the operation of the interconnected
grid through instability, uncontrolled separation,
or cascading failures of the bulk power
system. "
Second, grid operators must " evaluate
potential threats and vulnerabilities to those
facilities. "
Third, they must " develop and implement
a security plan to address potential threats
and vulnerabilities. "
In late May, NERC delivered a mammoth,
800-plus-page plan to FERC, providing the
details of how the industry will respond
to physical security threats. According to
www.powermag.com
assailant can be found. Said a spokeswoman
for plant operator E.On, " It was extremely
odd indeed, quite creepy. We have
never known anything like this at all, but it
shows that if people want to do something
badly enough, they will find a way. "
In Australia last February, an overloaded
circuit breaker at a large coal-fired plant
in the state of Victoria caused a fire that
shut down the state's third-largest power
plant. Officials told the Melbourne Herald
Sun that the event was sabotage, not an
accident of nature. The newspaper noted
that the blaze " happened just hours after
the company locked out Construction Forestry
Mining and Energy Union workers. "
a NERC press release, NERC submitted
the proposed response to FERC to a ballot
among its stakeholders. It received " 86 percent
approval. "
But the other 14% had some words about
it. E&E EnergyWire reported that the " sharpest
critique " of the NERC plan came from the
giant federally owned Bonneville Power Administration
(BPA). BPA, which operates a
multi-thousand-mile, multi-state high-voltage
grid in the Pacific Northwest, commented,
" It is virtually impossible to fully protect all
critical [bulk electrical facilities] from attack
by a determined foe. " BPA has absorbed attacks
on its transmission facilities going back
decades, though none that seriously damaged
the flow of power on its massive system.
Portland, Ore.-based BPA commented
to NERC that the opportunity to attack the
transmission system " is already available
. . . and implementable regardless of what
physical hardening is implemented. " BPA
said, " The biggest general question to answer
is what will be considered adequate
protection. Will we need a 24-hour on-site
security force because the location is too remote
to augment detection technology with
fast response? "
The BPA response added, " Will we need
security walls constructed to be as impervious
as those of a maximum security prison?
The list of potential risk mitigation barriers is
endless, as is the cost of building and maintaining
elaborate barriers for facilities that
cover acres of ground. "
Much to Consider
In comments on FERC's physical security order,
the Battelle Memorial Institute, a private,
nonprofit research institution in Columbus,
Ohio, offered what it billed as a common69
http://www.powermag.com
POWER August 2014

Table of Contents for the Digital Edition of POWER August 2014
