Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 32
3 Physical Security Considerations for Electric Power Systems From its earliest days, the electric power industry has been conducted by such groups against transmission lines and able to provide, or rapidly restore, essential services during towers in various parts of the world over the past 10 years.3 various types of natural emergencies. Later, during World The (next most frequently attacked power transmission target Wars I and II and the Korean War, the industry had to deal for international terrorists has been substations, with more with the potential for sabotage. This sabotage threat contin- than 500 attacks over the same period.4 In Iraq, terrorist and ued at a reduced level through the Cold War, but the main insurgent groups have skillfully used their resources and physical security concerns during that period were domestic insider contacts to repeatedly attack national power transmis- problems with vandalism, theft, and tampering. However, sion, to cause both disruption and social unrest and also to recent international developments have created a heightened steal valuable materials such as copper conductors. Similarly, threat to the nation's infrastructure from terrorist attack, terrorists have been attacking Colombia's electrical grid at a including the electric power supply and delivery system. rate of over 100 times a year. As noted in Chapter 1, if economic damage and social disruption become primary objectives for terrorists in the THE THREAT United States, the electric power transmission and distribu- Osama bin Laden has stated that the objective of the tion system would be an attractive target. al-Qaeda Islamic terrorist movement is to "target key sec- tors of the U.S. economy."1 The so-called mastermind of POWER SYSTEM CHOKE POINTS AND the 9/11 operation, Khalid Sheik Mohammed, also stated VULNERABILITIES that al-Qaeda's goal was "to launch spectacular attacks on vulnerable symbolic targets."2 It is evident from the various Electric power transmission and distribution systems are attacks carried out by terrorists groups against power sys- susceptible to attack generally with little risk to the attacker, tems elsewhere in the world that many such groups consider a fact well recognized by saboteurs and terrorists. The remote electric power systems to be on their list of potential targets. locations of many transmission power lines, substations, Potential terrorist attacks against electric power systems communications facilities, or natural gas supplies to gen- include sabotage; physical assault; disruption of sensors, erating facilities allow attackers to conduct their operations information systems, and computer networks; tampering with little or no risk of detection. Selecting points for attack with process safety; disruption of fail-safe systems; and and estimating the consequences are within the capability indirect attacks such as disruption of water, fuel, or key of technically trained individuals in the terrorist community. personnel. High-value choke points, those facilities which, if Although al-Qaeda has received the greatest attention, the destroyed, will significantly degrade power system capabil- U.S. Department of State lists over 42 international terrorist groups operating around the world today (Department of 3From November 1, 1996, to November 1, 2006, 528 substations were State, 2006, p. 83). Approximately 2,500 attacks have been attacked worldwide. This number includes substations and switchyards collocated with substations that were attacked with rocket propelled gre- 1Statement by Usama Bin Ladin: Al-Jazirah Space Channel Television, nades (RPGs), mortars, small arms, etc., and were the targets of actual and Oct. 6, 2002, as quoted in Scheuer (2004), p.17. attempted attacks. For the same 10-year period, 2,539 transmission towers 2"Substitution for the Testimony of Khalid Sheikh Mohammed" pp. were attacked worldwide (attempted attacks). Data from The Energy Inci- 11­14, Central Intelligence Agency [no report title, number, or date], as dent Data Base, Robert K. Mullen, bezoar@earthlink.net. quoted in Lawrence Livermore National Laboratory (2006). 4Data from Mullen; see footnote 3. 32

OCR for page 32
PHYSICAL SECURITY CONSIDERATIONS FOR ELECTRIC POWER SYSTEMS 33 ity, are easily located either on the ground or from system maps. Detailed maps of U.S. power systems were once readily available in the public domain and on the Internet. BOX 3.1 Despite attempts to control access to such maps, they can still Security Criteria to Be Considered in be easily obtained. Commercially available satellite data, as Evaluating Substation Security well as direct observation on the ground, can also be used · Potential threat and probability of attack to readily update and confirm system map information for · Frequency and duration of past security breaches potential attackers. · Severity of damage Facilities and equipment can be damaged or destroyed · Cost of breaches by a variety of means well known to international terrorists, · Safety hazards in the substation surrogate agents, and special operations military forces. · Equipment types and design Physical facilities are vulnerable to mechanical intervention · Number and types of customers served or from serious physical damage from stand-off attack pro- · Substation location jectiles and explosive devices. In addition some choke points · Criticality of load on the electric systems of the modern world are vulnerable · Overall cost of facility to cyber incursion. Chapter 4 discusses the cyber threat. Any · Quality of service at existing substations attack could be considerably amplified if aided by insiders, · Exposure to vandalism, sabotage, and terrorist at- whether voluntary or coerced. The insider issue is discussed tack of control houses, control equipment, and key in Chapter 5. electrical system components Most utilities are well prepared to handle outages caused by all but the largest natural events. However, the power industry is not capable of reliable performance if major components are severely damaged on a widespread basis by deliberately planned terrorist acts or natural phenomena. Transmission Substations Virtually no utilities are equipped or staffed to mitigate the consequences of multiple attacks against major critical com- Bulk Transmission Substations have unique security ponents or from widespread impacts of natural phenomena concerns in that they are relatively soft targets; they are vul- like Hurricane Katrina. National security planners have nerable to stand-off attack as well as penetration attacks by devoted insufficient attention to this fact or to the fact that adversaries compromising the substation's perimeter fences. electricity must be produced and delivered, through highly There is general agreement among security planners that key complex technological systems, at the instant of demand, and high-voltage substations are the most worrisome terrorist cannot be easily stored. targets within the power transmission system. They are also difficult to protect. Their replacement parts are difficult to obtain, and damage to substations can separate customers Points of Vulnerability from generation for long periods. Specific points of vulnerability can be better understood Box 3.1 lists security criteria that may be considered in by considering briefly each major element of power systems: evaluating substation security. generators, substations, transmission towers, distribution components, system control centers, and customers or users. Transmission Lines and Towers Transmission lines have been a desirable terrorist target in Generators countries suffering from insurrection or civil unrest. A circuit Although this report focuses on the power delivery sys- can be temporarily disabled by fairly simple means. Shoot- tem, it is important to note that in some parts of the world ing insulators on a tower can short a line. Severing the legs generators have been targets of terrorist attacks. In the of the tower with explosives can bring it down, shorting all United States generator units and ancillary equipment are the lines it carries. On some transmission lines, taking out a installed within a power house that is manned by operational tower can cause a domino effect, resulting in a cascade col- personnel, giving them some protection. Some are inside a lapse of several adjacent towers.5 Taking out a tower where perimeter fence with physical security equipment and trained two lines cross can disable both circuits at once. security forces, and others are being upgraded. However, most generating stations except nuclear plants have very lim- 5Transmission lines normally consist mainly of suspension towers that ited in-place security measures which could be circumvented are intended to support the conductors, which are under tension to minimize by expert saboteurs, and lack supporting contingency plans sagging. These towers are held in place by the conductors and require little to coordinate with local authorities. horizontal bracing under normal conditions. If the lines break in one direc- tion, however, the tower may be pulled down by the tension on conductors in the other direction. Thus a cascading failure of towers can occur up to a

OCR for page 32
34 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM Transmission lines are often very long and in sparsely vice. Targeting of distribution system components can cause populated areas. They make easy targets and cannot be well troublesome outages, but the magnitude of the problems protected. However, they can also be repaired quickly unless will usually be more manageable than those resulting from there is a coordinated widespread attack. Even then, the attacks on the "upstream" transmission systems or generation transmission lines can be repaired almost as soon as replace- stations, unless of course they are targeted at disrupting sup- ment towers can be delivered. Thus transmission lines are of ply to a critical facility in conjunction with some other attack. less concern than substations. Other Collective Targets System Control Center(s) Other targets, although not system choke points, can be Major electrical systems rely heavily on their primary key terrorist targets. These include: system control center. Computers, telemetry, fiber, radio, and dedicated telephone lines are continuously used to monitor · Key personnel. Hostage taking usually places the major system elements and transmit vital information to attacker at greater risk than does the mere destruc- the control center. As discussed in Chapter 6, when routine tion of facilities or equipment. However, it should not disturbances occur, the system is designed to take certain be overlooked by security planners as a tactic his- remedial measures instantly and to automatically report these torically employed when coercive control is desired. measures and conditions to the control center staff. Major Contingency plans, security awareness training, and disturbances often require quick decisions and reactions on timely threat briefings for key personnel have proven the part of the staff to prevent widespread outages. effective in these situations. System control centers contain highly technical control · Major materiel yards. Central supply points, and sites and communications equipment as well as experienced sys- where major repair vehicles and high-voltage spare tem operations personnel. Any attack, such as with a vehicle components are stored, present valuable targets. bomb that would destroy or severely damage such a center, Although such sites have a lower priority, security would also significantly impair the operation or restoration plans could include responses to the potential for of a system by eliminating vital command, control, and com- attacks on these sites. munications (C3) functions and capabilities. In most cases · Customers (Users). From heavy industries to house- there are redundant control facilities, and the system could holds, the entire North American societal infrastruc- still be operated, but C3 would be significantly degraded. ture is dependent in varying degrees on the reliable Security is very uneven across the system. Some control functioning of these electrical systems. As users' centers have been extensively hardened and have excellent demands fluctuate moment-by-moment, generation access control and other security. Other utilities provide must be increased or decreased to keep all elements nominal local security for these centers that could easily be of the system and the demand in precise balance. overcome by a determined attacker. Control centers could Attacking individual consumer electrical facilities easily be sabotaged by insiders either to affect C3 loss or to would have limited overall impact on society, unless support a broader system attack by outsiders. those facilities constituted part of a coordinated Control centers could be a desirable terrorist target, par- attack on targets such as chemical facilities or facili- ticularly if the redundant center is also targeted. Loss of a ties providing essential community services. control center would make the continued operation of the power system difficult and might cause widespread outages. Countermeasures Countermeasures to attacks on physical infrastructure Distribution Components such as substations include improved security engineering From the transmission substation networked medium- techniques, such as calculations of blast effects; the use of voltage lines and substations carry the power to all the users hardened construction; and calculation of minimum stand- "downstream" from the transmission system. Distribution off ranges for threat weapons. Along with site hardening, components are more numerous and of lower capacity than new and improved surveillance equipment to allow rapid transmission system components, and spare parts are gener- identification of and response to attacks could be installed ally in greater supply. Storms take an annual toll on distribu- at critical facilities. These improved electronic surveillance tion systems. Utilities are prepared for such emergencies and technologies include point vibration sensors, leaky coaxial often pool their resources to aid each other in restoring ser- cable sensors, seismic disturbance and electrostatic field disturbance sensors, microphonic cable, and microstain fiber option sensing systems (a new technology for perimeter dead-end tower (which is self-supporting even under one-sided tension) or protection) that could be employed as appropriate at sites a corner tower (which is used when the transmission line must make a turn, resulting in asymmetric loadings on the tower). depending on the level of threat and risk present.

OCR for page 32
PHYSICAL SECURITY CONSIDERATIONS FOR ELECTRIC POWER SYSTEMS 35 A capability for locking and controlling manhole covers ing them can take several more months. The availability of remotely, and for monitoring at points of access to under- special transportation equipment itself could pose serious ground utility systems in urban cores, would help protect key delays. Utilities have enough skilled personnel and equip- distribution lines. Today, when underground access points ment under their control for smaller emergencies, but having are secured (e.g., for a visit of a head of state or other major the skills required to safely repair a severe multi-site attack event), it is typically by welding and/or bolting the covers on electrical equipment requires extensive planning, the shut. This current labor-intensive case-by-case approach both availability of spare equipment, and activation of already- increases the likelihood that the system will not be secured in-place mutual aid agreements. Recent regional natural as often as it should be, and increases the likelihood that key disasters have also pointed out that there is a clearly defined access points will be overlooked. need for state and federal government support and coordina- Improved and expanded security systems would be use- tion in recovery and restoration efforts. ful in protecting key underwater cable systems. This could It has taken many years to engineer and build the nation's include multi-zone motion detection, automatic alarmed electric power systems. It is likely that reconstructing them calls, live and recorded video transmission, remote control after widespread, intelligently planned damage will require via use of information technology, and simultaneous stream- many months of highly skilled effort, assuming that the ing video transmission to operation centers. Some newer capability exists to manufacture or acquire the requisite cables are now well protected, but some older cables still components. The U.S. domestic ability to manufacture these need attention. components has eroded and moved offshore over the past 30 Highly critical facilities require perimeter protection years, and is not likely to return without government action systems--including cameras, sensors, intrusion devices, to bring manufacture of critical equipment back to the United access controls, lighting, fencing, buffer zone security, and States. Chapter 8 elaborates further on system restoration so on--that are specifically tailored to the substation environ- and the need for a critical parts inventory, particularly power ment described in Box 3.1. transformers. The DHS is currently working with industry security officials to build cooperation with local law enforcement CONSEQUENCE MANAGEMENT in order to map out potential attacker approach and egress routes as part of the DHS Buffer Zone Protection Plan effort. Since our modern society is almost totally dependent on electrical systems, the widespread loss of choke points on systems that serve clusters of key defense bases, critical REPAIR AND RESTORATION infrastructure assets, and major metropolitan areas would Electric power providers in other countries have been have a very detrimental effect. Pumping of potable water, challenged to restore service, especially when transformers sewage, and irrigation water; sewage treatment; food and fuel at substations have been attacked. The availability of spare supply and storage; refrigeration; medical facilities, prisons, parts at remote areas, site access for needed repairs, and banking, communications, refineries, shipping, transporta- transportation of heavy, large-load high-voltage transformers tion, commerce, and home/commercial life-support systems to the sites all complicate the recovery process. These issues (heating, ventilation, and air conditioning) all depend on a are discussed further in Chapter 7. continuously operating power supply in an interoperable In assessing vulnerability, repair and restoration capabili- system. Should these interoperable critical infrastructures ties must also be considered. Electric utility systems have cease to function for an unacceptable length of time, the an outstanding record of reliability due to facilities' main- consequences to national security, public health and safety, tenance policies and ability to restore or bypass common and the economy would be huge. outages quickly. The pooling of equipment and manpower The federal government is concerned about the existing contributes greatly to this record. Experience has proven level of domestic electric power system vulnerability primar- that a vulnerability-risk analysis is applicable to any power ily because of the threat posed by international terrorists. system. The degree of risk is balanced against past ability to The White House has provided briefings to industry on its repair equipment and restore service in an acceptable length concerns. The DHS has been organizing relationships with of time. Personnel and equipment inventories for making industry. Efforts to integrate national security considerations repairs are maintained to meet historic requirements. Many into electrical system reliability planning continue to evolve, of these issues are discussed at greater length in Chapter 7. and the utility industry is integrating low-cost security mea- Replacement of damaged equipment following a multi- sures to strengthen bulk power supply systems, particularly site coordinated attack on major components could take those that serve key national defense or critical infrastruc- many months or, in absolute worst cases, several years. For ture assets. These efforts are coordinated through the North example, substation and generator step-up transformers can American Electric Reliability Council (NERC) or the newly require as much as 12 to 16 months to manufacture even created Electric Reliability Organization (ERO). under ideal conditions. Transporting, installing, and test-

OCR for page 32
36 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM Various organizations and agencies involved in homeland defense have been in the process of identifying the thousands of critical infrastructure assets across the nation that must BOX 3.2 be protected. An objective is to develop plans to ensure Examples of Security Protocols and that critical infrastructure assets have adequate security for Mitigation Measures Intended to continued functioning. Planners must realize that no matter Provide Protection Against Current how well protection plans for critical infrastructure perform, Terrorist Threats when the day of emergency arrives, all of those infrastructure · U tility coordination and information exchange assets are dependent on electric energy. programs in place at the North American Electric A new dimension of "national security reliability" is being Reliability Council and the Edison Electric Institute used in the planning for reliability of the electric power · Development of new risk assessment methodologies industry. The North American Electric Reliability Council, · Risk-awareness management principles and prac- with the Federal Energy Regulatory Commission (FERC) tices in use by utility consultants providing the regulatory support stipulated in the reliabil- · Security vulnerability assessments ity provision of the Energy Policy Act of 2005, is leading · Implementation of security upgrades and transition- the effort. Additional support is provided through industry ing from security enhancements to comprehensive groups, such as the Electric Power Research Institute (EPRI) programs and the Edison Electric Institute (EEI). Industry is also work- · Recovery planning · Security outreach programs including exchanges of ing closely with various federal government agencies, such best practices as the Department of Homeland Security (DHS), Department · Top-to-bottom emergency plan reviews and updates of Energy (DOE), Department of Defense (DOD), Depart- · Review and updating of mutual support agreements ment of Justice (DOJ), Department of Transportation (DOT), · Improvement of security engineering of substations Federal Bureau of Investigation (FBI), DOD's Technical and control centers Support Working Group (TSWG), and the National Security Council (NSC). It is important that these efforts be well coor- dinated to avoid conflicts in recovery and restorations efforts. New security protocols and mitigation measures are cur- rently being developed and adopted through cooperation between government and industry to provide protection against the current terrorist threat. Examples of these are provided in Box 3.2. Pilot projects involve advanced security BOX 3.3 technologies that include digital CCTV, fiber optics, smart Steps Taken by Most U.S. Utilities cards, and biometric IDs and card keys, as well as fencing to Limit Access to Facilities and design and manufacturing improvements. Information Efforts have also been made toward understanding interdependencies, and how the power industry fits into the · Requiring positive ID for all personnel visiting national critical infrastructure framework. Regional inter- facilities dependency exercises have been conducted to consider the · Instituting access controls for all pedestrians and resiliency of utilities, the water supply, telecommunications, vehicles passing through entrance gates oil and gas, banking, financial services, and so on. · Hiring additional security officers · Increasing the frequency of facility security checks · Increasing aircraft patrols of transmission lines POST 9/11 POWER INDUSTRY PHYSICAL SECURITY · Increasing liaison relationships among local law ENHANCEMENTS enforcement, the FBI, and the National Guard · Upgrading security policy and procedures Many physical changes have been made and security · Updating employee security and emergency re- enhancements implemented since the attacks on the World sponse guides Trade Center. These include an increased awareness of the · Developing new gate designs and standards need to be more cautious with regard to access to informa- · D eveloping industry-wide baseline of security tion and facilities as well as to ensure that employees and standards contractors are not likely collaborators with terrorists. Box · Conducting employee security awareness training 3.3 lists the steps that most utilities have now taken to limit · Instituting a "no tours of the facility" policy access to facilities and information. In addition, electric · Reviewing all internal and external Web pages and power industry security personnel have begun to develop a materials for information that could be used by set of technical physical security skills and practices of the terrorists kind listed in Box 3.4.

OCR for page 32
PHYSICAL SECURITY CONSIDERATIONS FOR ELECTRIC POWER SYSTEMS 37 distributed, it is very difficult to completely protect all key components, or to harden them against pos- BOX 3.4 sible attack. Examples of Technical Physical · However, there are steps that could be taken to reduce Security Skills and Practices Being the vulnerability of critical components. These Developed and Implemented by include: Electric Power Industry Security -- A variety of design and engineering steps to Personnel harden substation sites and make key compo- nents less vulnerable to physical attack. These · Protecting system technical operations include further hardening of control facilities; · Gaining familiarity with the latest risk and vulner- selective use of walls and roofs at substations ability analysis systems (especially in built-up areas and at high-conse- · Ensuring the physical security of equipment and quence facilities in remote areas); and hardened systems enclosures for key transformers. · Providing perimeter protection including fences, -- Improved integrated electronic surveillance that lights, gates and access controls, entrance and uses sensor and monitoring equipment, along equipments locks, protection force fencing, elec- with information-processing equipment, to allow tronic security systems, video surveillance systems, rapid identification of and response to multi-site and building alarm systems attacks. · Physically protecting telecommunications systems --System tools that can identify and localize physi- · S treamlining security command-and-control cal and control system problems and potential systems incidents. These are further discussed in Chapter · Working with the National Incident Management 6. System -- Greater use of robust self-supporting towers for · Conducting contingency planning both transmission lines and communication sys- · Accessing intelligence sources and sharing local tems. This includes more frequent use of dead- information end towers in transmission lines that use guide · F orming liaisons with local law enforcement towers, as well as integrated communication and organizations power towers and self-supporting microwave · Initiating tactical planning of response operations towers. · Planning for exercise/implementation of defensive · Substations are the most critical choke points, fol- operations during heightened alert periods lowed by control centers. For these facilities there is a need to develop specific physical security equipment such as cameras, sensors, intrusion devices, access controls, improved lighting and perimeter security CONCLUSIONS fencing, buffer zone security, and surveillance of approaches, as well as a greater human presence and · While the electric power transmission and distri- upgrades in protection force training and response, bution systems are resilient and are designed for all of which would be used to decrease vulnerability. rapid restoration after failure caused by natural and · Improved personnel-related security measures are accidental events, they are vulnerable to intelligent needed, including better screening of employees, multi-site attacks by knowledgeable attackers intent better access control, more realistic simulations and on causing maximum physical damage to key com- security training, programs to reduce the threat to ponents on a wide geographical scale. A few natural key workers from biological and other attacks with events, such as large hurricanes and ice storms, pose weapons of mass destruction, and upgraded capabil- similar challenges, although in those cases some of ity to deal with the insider threats. Details on these the system components, such as high-voltage trans- and other personnel issues are provided in Chapter 5. formers (that are most difficult to replace or restore), are less likely to be damaged. · Electric power transmission and distribution systems REFERENCES are vulnerable to attack generally with little risk to Lawrence Livermore National Laboratory. 2006. "The Jericho Option: Al- the attacker. As most systems are currently config- Qa'ida and Attacks on Critical Infrastructure." UCRL-SR-224072, June. ured and operated, attackers can conduct their opera- Scheuer, Michael. 2004. Imperial Hubris. London: Brassey's. tions without detection. Because the transmission and U.S. Department of State. 2006. "Country Reports on Terrorism 2005." Washington, April . distribution systems are by their nature inherently