1

The Electric Transmission and Distribution System as a Terrorist Target

Terrorists could destroy key elements of the electricity generation and delivery system, causing blackouts that are unprecedented in this country in duration and extent. The U.S. economy depends on a reliable supply of electricity, and widespread disruptions of long duration could cause enormous economic damage and suffering. Under some circumstances (e.g. a heat wave) such blackouts could also lead to significant loss of life. On the other hand, attacks on the U.S. power system would not immediately kill large numbers of people or cause massive destruction of familiar structures or facilities, and therefore probably would not be as dramatic as the September 11, 2001, attacks.

There is considerable debate over just how serious a threat terrorists pose to U.S. infrastructure such as the electric transmission and distribution system (NRC, 2002; Meade and Molander, 2006; Mueller, 2006). Electricity is ubiquitous, reliable, and taken for granted ... until the lights go out. Occasional large accidental outages caused by “cascading failures” in the high voltage transmission system (such as the Northeast blackout of August 2003) have briefly raised public concern about potential vulnerabilities, but to date such concerns have rapidly disappeared once power is restored. Power outages caused by damage to the distribution system, the lower voltage lines that carry power to customers, are far more common. Recent examples include the destruction after hurricanes in Florida and the Gulf Coast, as well as the July 2006 outage in New York City’s borough of Queens.

While the inconvenience and cost of these accidental disruptions of the nation’s transmission and distribution system have been large, they pale in comparison with the impacts that might result from a large, well planned, terrorist attack. Even if the probability of such an intentional attack were assessed to be quite low, the consequences are large enough that the nation needs to protect this essential service.

This chapter briefly reviews the electric power system and its vulnerabilities, identifies the types and motivations of potential attackers, explores the potential costs associated with the loss of power, and reviews a few of the actions that have been taken to date to reduce vulnerability.

THE ELECTRIC POWER SYSTEM AND ITS VULNERABILITY

Today in the United States, and in most of the rest of the industrialized world, power flows from large generating plants to customers through a complex, dynamic system whose structure is the result of gradual evolution over more than a century. Early power systems had small generating stations close to local distribution systems that fed power to streetlights and homes at relatively low voltage. As systems became larger and power had to be carried over longer distances, power lines were operated at ever higher voltage in order to minimize losses. Efficient high-voltage transmission lines also made it possible to locate ever larger generators in remote areas rather than close to towns and cities. By the middle of the 20th century, system operators began to connect individual high-voltage systems together so that power could be moved from region to region, both to promote economic efficiency and to increase reliability by making it possible to move power into regions suffering from temporary shortages.

Once electric power has been generated, the voltage is stepped up1 and power moves over long distances through the high-voltage transmission system, a complex network of lines, most of which are carried aboveground on tall towers. At key points throughout this system are substations that contain transformers to increase and decrease the voltage, switching gear that connects the system in desired configura-

_____________________

1The voltage of AC power can be easily increased or decreased using transformers. High voltage is used to move power long distances in order to minimize losses that result from the current heating the line. The power carried by a line is the product of the current and the voltage. However, for a given line, losses from heating go up as the square of the current. In moving a given amount of power, using a higher voltage reduces the current, and thus reduces the loss due to heating.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 7
1 The Electric Transmission and Distribution System as a Terrorist Target Terrorists could destroy key elements of the electricity with the loss of power, and reviews a few of the actions that generation and delivery system, causing blackouts that are have been taken to date to reduce vulnerability. unprecedented in this country in duration and extent. The U.S. economy depends on a reliable supply of electricity, THE ELECTRIC POWER SYSTEM AND ITS and widespread disruptions of long duration could cause VULNERABILITY enormous economic damage and suffering. Under some circumstances (e.g. a heat wave) such blackouts could also Today in the United States, and in most of the rest of lead to significant loss of life. On the other hand, attacks the industrialized world, power flows from large generating on the U.S. power system would not immediately kill large plants to customers through a complex, dynamic system numbers of people or cause massive destruction of familiar whose structure is the result of gradual evolution over more structures or facilities, and therefore probably would not be than a century. Early power systems had small generating as dramatic as the September 11, 2001, attacks. stations close to local distribution systems that fed power There is considerable debate over just how serious a threat to streetlights and homes at relatively low voltage. As terrorists pose to U.S. infrastructure such as the electric trans- systems became larger and power had to be carried over mission and distribution system (NRC, 2002; Meade and longer distances, power lines were operated at ever higher Molander, 2006; Mueller, 2006). Electricity is ubiquitous, voltage in order to minimize losses. Efficient high-voltage reliable, and taken for granted . . . until the lights go out. transmission lines also made it possible to locate ever larger Occasional large accidental outages caused by "cascading generators in remote areas rather than close to towns and failures" in the high voltage transmission system (such as the cities. By the middle of the 20th century, system operators Northeast blackout of August 2003) have briefly raised pub- began to connect individual high-voltage systems together lic concern about potential vulnerabilities, but to date such so that power could be moved from region to region, both to concerns have rapidly disappeared once power is restored. promote economic efficiency and to increase reliability by Power outages caused by damage to the distribution system, making it possible to move power into regions suffering from the lower voltage lines that carry power to customers, are temporary shortages. far more common. Recent examples include the destruction Once electric power has been generated, the voltage is after hurricanes in Florida and the Gulf Coast, as well as the stepped up1 and power moves over long distances through July 2006 outage in New York City's borough of Queens. the high-voltage transmission system, a complex network of While the inconvenience and cost of these accidental dis- lines, most of which are carried aboveground on tall towers. ruptions of the nation's transmission and distribution system At key points throughout this system are substations that have been large, they pale in comparison with the impacts contain transformers to increase and decrease the voltage, that might result from a large, well planned, terrorist attack. switching gear that connects the system in desired configura- Even if the probability of such an intentional attack were assessed to be quite low, the consequences are large enough 1The voltage of AC power can be easily increased or decreased using that the nation needs to protect this essential service. transformers. High voltage is used to move power long distances in order This chapter briefly reviews the electric power system to minimize losses that result from the current heating the line. The power and its vulnerabilities, identifies the types and motivations carried by a line is the product of the current and the voltage. However, for a of potential attackers, explores the potential costs associated given line, losses from heating go up as the square of the current. In moving a given amount of power, using a higher voltage reduces the current, and thus reduces the loss due to heating. 7

OCR for page 7
8 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM 10 Year Trend of SAIDI tions, and circuit breakers that open and close connections 160 while also acting as giant fuses to protect expensive equip- 140 ment from damage, as well as a variety of other devices. 120 Most substations sit out in the open protected only by a 100 Minutes simple chain-link fence. All but a few high voltage lines are 80 also in the open. Thus, both substations and the lines that 60 connect them are vulnerable to damage from storms and to 40 25th Percentile terrorist attack. 20 50th Percentile (Median) 75th Percentile When power reaches an area where it will be used, the 0 voltage is reduced and power is distributed to customers 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 (11) (14) (24) (25) (27) (39) (57) (57) (56) (53) over lower-voltage distribution lines. Unlike the transmis- Ye ar (# of Ut ilit ie s Re po r t ing ) sion system, which is a large interconnected network, many FIGURE 1.1a System Average Interruption Duration Index distribution systems branch out radially to deliver power to (SAIDI) indicators for U.S. utilities for the period 1992 to 2001 customers, although some older, dense urban areas, such as (excluding major events). SOURCE: EPRI (2003). New York City, use network configurations for distribution. FIGURE 1.1a. All the elements of the transmission system, and increasingly those of the distribution system, are monitored and controlled storms, earthquakes, and similar natural events, can bring by information and communication systems. down many transmission lines, and, less frequently, can Although problems in any part of the system can disrupt damage transformers, circuit breakers, and other equipment the supply of electric power, this report focuses on the trans- such as the terminal facilities for direct-current (DC) lines. mission and distribution (T&D) system, substations, and Inadequate attention to maintenance can also contribute other associated parts, discussing generation only as it relates to blackouts--as in the recent case of an improperly sized to issues involving transmission and distribution. Details on circuit breaker in London, or several instances of arcing to how the T&D system is controlled, operated, managed, and vegetation that have resulted from inadequate tree trimming regulated are given in Chapter 2. in the United States. As explained in greater detail in Chapter 2, the transmis- sion system is much more stressed, and thus more vulnerable, Non-malicious Threats to the Electricity Delivery System than it was a few decades ago, principally as a result of two By its very nature, the T&D system is not perfectly reli- factors: (1) years of underinvestment in system upgrades able. Even without terrorist activity, the power sometimes stemming from ambiguities and altered incentives that goes out, usually for just a few seconds, minutes, or hours, resulted from electric power restructuring and associated but sometimes for a few days. On very rare occasions, and in changes in the regulatory environment and (2) demands on limited locations, outages may stretch on for weeks. As the the system to move power between sellers and buyers in new duration and geographic extent of an outage increase, people competitive power markets in greater volume and in ways in become seriously inconvenienced, and economic and other which the system was not designed to operate.2 costs rise, but people generally do not experience "terror." Figures 1.1a and 1.1b show the trend in two common Keeping power flowing to customers is a continuous pro- measures of power supply disruption in the United States cess of control, recovery, and repair. Most outages are local, over the decade from 1992 to 2001--the System Average brief in duration, and caused by problems at the level of the Interruption Duration Index (SAIDI), which indicates the distribution system--such as lightning strikes, wind storms average time that customers are without power during the and tree falls, short circuits caused by wild animals such as period analyzed (Figure 1.1a), and the System Average squirrels, vehicles that crash into power poles, and similar Interruption Frequency Index (SAIFI), which indicates the events. Line crews can usually fix these outages in a matter of average number of interruptions per customer served per hours. Distribution systems that incorporate automation can year (Figure 1.1b). Both reflect principally the effects of often isolate a problem and restore service for many affected distribution system disturbances and exclude outages caused customers in a matter of seconds or minutes. by major events. Figures 1.2a and 1.2b show SAIDI and Outages caused by disruptions in the high-voltage trans- SAIFI measures of reliability internationally. Reliability in mission system are less common. When they do occur, the United States appears to be poorer, on average, than that because of faulty equipment, weather, or for other reasons, experienced by customers for electric power in some other many such outages are never noticed by customers, because automatic controls and system operators can limit their 2Much of the transmission system was originally designed to serve the impact and maintain the supply of power to the distribution needs of vertically integrated regulated utilities. Following deregulation of system. But, of course, the transmission system does occa- the power industry and the introduction of competition among generators, sionally experience problems that result in loss of service the transmission system is now being expected to move power in ways that have resulted in patterns of power flow that did not exist previously under to customers. Weather events, such as hurricanes and ice regulation.

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 9 10 Year Trend of SAIFI 1.8 Some terrorist groups hostile to the United States clearly 1.6 have the capability of causing massive damage--the loss # of Sustained Interruptions 1.4 of so many generating or transmission facilities that major 1.2 metropolitan areas or even multi-state regions suffer severe, 1 long-term, power shortages. The absence of such attacks has 0.8 as much to do with how terrorists view their opportunities 0.6 25th Percentile as with their ability. U.S. electric power systems are only 0.4 50th Percentile (Median) one target out of many ways of striking at America, and not 0.2 75th Percentile 0 necessarily the most attractive. 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 (12) (15) (26) (26) (28) (39) (55) (59) (55) (53) Year (# of Utilities Repor ting) More recently, the National Research Council report Making the Nation Safer (NRC, 2002. p. 178) noted that: FIGURE 1.1b System Average Interruption Frequency Index (SAIFI) indicators for U.S. utilities for the period 1992 to 2001 [a]nalysis of possible targets, weapons, and delivery systems (excluding major events). SOURCE: EPRI (2003). and of direct and indirect consequences reveals several very dangerous scenarios. The scenarios of greatest concern in- FIGURE 1.1b volve the electrical system. When service is lost, there are developed countries, although much of this difference is due immediate consequences to every person, home, and busi- to major differences in population density and power system ness. An extended outage of electricity would have profound configurations. consequences. As indicated in Figure 1.3, large outages in the United States between 1984 and 2000 were more frequent than The same report emphasized (p. 180): might have been anticipated on the basis of a simple expo- [t]he impact of a prolonged interruption in the electric power nential distribution. Although in recent years in the United supply to any region of the country would be much larger States there has been no significant change in the frequency than the economic loss to the energy sector alone. . . . The of outages (Figure 1.4), there has been a very significant nation's electric power systems must clearly be made more increase in the frequency of transmission loading relief resilient to terrorist attack. events (Figure 1.5).3 Most problems occurring in the transmission of electric Potential attackers, as shown in Figure 1.7, include the power can easily be corrected by automatic controls and following. actions taken by system operators. However, occasionally these actions are not sufficient to keep power flowing. Prob- lems or failures originating in one part of the system may Terrorists give rise to problems (such as overloads) in other parts of Most problematic are terrorist groups with significant the system, which in turn cause additional problems that may technical capabilities and resources who want to kill large ultimately result in a cascading power failure. The fact that numbers of people or cause widespread societal or economic the power system uses alternating current (AC) means that damage. Although not very likely, as noted above, such ter- the system's behavior is sometimes further complicated by rorists might view the power system as a primary target. As oscillatory or other complex dynamic behavior, as illustrated discussed later in this chapter, a sophisticated attack could in Figure 1.6. Although they are rare, such events sometimes cause a lengthy blackout over an extensive region. An attack cause a loss of power to many customers (Table 1.1 and during a period of extreme weather, such as a heat wave, Figure 1.3). might lead to the deaths of many people, albeit in a far less spectacular way than in a large explosion or a chemical or Potential Attacks on the Electric Power System biological attack. However, the drawn-out agony produced by such an attack would clearly create great public anxiety Because electricity is so essential to modern industrialized and outrage, especially if government and private responses societies, the power system has frequently been identified as were seen as inadequate, and perhaps, too, if the first attack a potential terrorist target. For example, more than 15 years were followed by other similar attacks. Public confidence ago, in a report titled Physical Vulnerability of the Electric could also be eroded, and anger heightened, if terrorists were System to Natural Disasters and Sabotage (OTA, 1990. able to hold the grid hostage by mounting limited demon- p. 14), the Office of Technology Assessment concluded: stration attacks with promises of worse to come if demands were not met. Although international terrorist groups such as al-Qaeda 3A transmission loading relief event occurs when congestion on the have been more interested in killing people that in causing transmission system prevents the transmission of electricity for which a economic damage, different groups with different motiva- transaction has been contracted. tions could emerge. An attack that brought a power system

OCR for page 7
10 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM FIGURE 1.2a System Average Interruption Duration Index (SAIDI) indicators internationally for the period 1992 to 2001 (excluding only interruptions caused by major storms and hurricanes). SOURCE: EPRI (2003). FIGURE 1.2b System Average Interruption Frequency Index (SAIFI) indicators internationally for the period 1992 to 2001 (excluding only interruptions caused by major storms and hurricanes). SOURCE: EPRI (2003). down for an extended period could cause enormous eco- ticularly if mounted by someone with detailed knowledge of nomic damage, as discussed below. the electric power system, its physical characteristics, and its Terrorists could, under some circumstances, view the vulnerabilities. transmission and distribution system as an important sec- ondary target. Hackers and Other Nonterrorist Individuals and Groups Terrorist attacks probably would involve physical destruc- tion of key system facilities. However, a combined cyber Terrorist attacks are the main focus of this report, but other attack and physical attack could be especially serious, par- types of attackers are also relevant. Not only are lower-level

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 11 1.0 0.5 0.1 0.05 0.01 0.005 1 10 100 1,000 10,000 L, size of the outage in megawatts FIGURE 1.3 Relative frequency of electrical outages in the United States between 1984 and 2000. Of the 533 transmission or genera- tion events shown, 324 involved a power loss of >1 MW (average of once every 19 days), and 46 involved a power loss of >1,000 FIGURE 1.3 MW (average of 3 per year). Dots indicate actual outage events. The dashed line is an exponential (Weibull) distribution fit to the failures below 800 MW loss. The solid line is a power law fit to the FIGURE 1.5 Annual number of transmission loading relief events NERC data over 500 MW loss. SOURCE: Data compiled by NERC since 1997. The substantial increase indicates that over the past DAWG, plotted by Jay Apt, Carnegie Mellon University, 2006. decade the level of stress on the system has grown considerably. SOURCE: NERC data plotted by Jay Apt, Carnegie Mellon Uni- versity, 2006. FIGURE 1.5 people angry at the power company, bored hunters taking pot shots at insulator strings, or individuals who view the power company as an important symbol of something they oppose. For example, the Earth Liberation Front has report- edly been involved in a plot to bring down high-voltage power lines.4 Any such attack could be serious, especially if undertaken by a current or former employee with detailed insider knowledge. Between 1984 and 2000, approximately 3 percent of major disturbances in the United States were attributed to sabotage.5 The authors of Making the Nation Safer note that sabotage of individual components has "posed a nuisance, but the impacts have generally been manageable" FIGURE 1.4 Frequency of electrical outages in the United States (NRC, 2002, p. 177). Pernicious hackers are people whose over time. Note that while there is significant year-to-year variabil- primary motivation is not to kill people or cause specific ity, there is no long-term trend. SOURCE: Data compiled by NERC damage, but rather to test limits and perhaps gain recognition DAWG, plotted by Paul Hines, FIGURE 1.4 Mellon University, 2006. Carnegie within a subculture by demonstrating technical prowess by disrupting the operation of an important and highly visible societal system. Their motivation would be similar to that of attacks more likely, but many of the steps that should be taken computer hackers who release computer viruses and worms, to strengthen the system against terrorists will help against or disrupt corporate and government computer sites. It is these attacks also. This section briefly describes the types of likely that such attacks would come from lone individuals attacks that may be encountered. or small groups. Individuals or small low-tech groups with limited Finally, harmful activity could be motivated by com- resources who want to kill people or cause widespread soci- mercial benefit. A power company seeking a competitive etal damage could pose a serious threat, but the amount of harm that one or a few such people could do to the electric system is probably limited. Individuals or groups that want 4See "11 Indicted in Eco-terror Arsons," available at http://abcnews. to harm the power system but not kill a lot of people or go.com/US/Terrorism/story?id=1526225. 5Based on NERC Disturbance Analysis Working Group (DAWG) data cause widespread societal damage or harm might include available at http://www.nerc.com/~dawg/.

OCR for page 7
12 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM FIGURE 1.6 Illustrative analogy of electric transmission and distribution. Unlike a set of rigid drive shafts (above) that move power from generators to loads, AC power transmission and distribution systems are more accurately thought of in terms of a series of coil springs of varying stiffness through which power is transmitted by twisting (below). Since these links are not rigid, under some circumstances they can exhibit complex oscillatory behavior, or even become so tangledfigthat 1-6 they can no longer transmit power. Contrast has been increased in bottom figure to get the big arrows darker. Everything is darkened everything so this is about as far as we can go. advantage might sabotage its competitor's equipment, and ing transfer rights on tie-lines between control areas in order These images are JPEGS so individual parts cannot be selected in the process compromise the integrity of the system. Until to increase congestion at those facilities and thereby maintain the pernicious actions of Enron traders were revealed, few local market power, or (2) large buyers creating transient would have given such a possibility a second thought. With disturbances on the system in an effort to reduce the number tighter oversight and greater awareness within the industry, of other buyers, thereby lowering system load and price. A plus FERC's increased emphasis on market monitoring, such simplified model illustrates how two or more small, physi- activity is probably unlikely, but the potential for it should cally separated generators acting together might have their not be ignored. The possibilities include, for example, (1) supply frequencies altered and produce resonant phenomena generators in one independent system operator (ISO) captur- that might cause protective devices on other large competi-

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 13 TABLE 1.1 Some Worldwide Examples of Cascading Power Failures with Potential or Actual Widespread Impact Date Location Notable Consequences November 9, 1965 Northeastern United States Power to 30 million customers (20,000 MW) interrupted (USFPC, 1965) (10 states), Ontario June 5, 1967 Middle Atlantic Region 4 million people affected May 1977 Miami, Florida Power to 1 million customers over 15,000 square miles interrupted July 13, 1977 New York City Power to 9 million customers (6,000 MW) interrupted for as long as 24 hours; widespread looting, chaos; police made about 3,000 arrests (DOE/FERC, 1978) December 1978 France Power in part of France interrupted due to voltage collapse January 1981 Idaho, Utah, and Wyoming Power to 1 million customers interrupted for 7 hours March 1982 Oregon Power to more than 900,000 customers interrupted for 1.5 hours 1987 Tokyo Power to 2.8 million customers interrupted 1989 Quebec Power to 9 million customers interrupted; geomagnetically induced currents from solar storm 1990 Egypt Power for entire country affected by sandstorms December 1994 Western United States Power to 2 million customers interrupted from Arizona to Washington state 1996 Malaysia Power to 20 million customers interrupted 1996 Philippines Half of country affected by power plant outages July 2, 1996 Western United States Power to 2 million customers (11,850 MW) interrupted in 14 states for approximately 6 hours (WSCC, 1996) July 3, 1996 Western United States Recurrence of July 2 disturbance; operators interrupted power supply to most of Boise, Idaho, vastly reducing the extent of the event (WSCC, 1996) August 1996 Indonesia Power to 100 million customers interrupted August 10, 1996 Western United States Power to 7.5 million customers (28,000 MW) interrupted; economic damage estimated at $1 billion to $3 billion (WSCC, 1996) 1998 North central United States/ Power to 152,000 customers interrupted by lightning central Canada January 1998 Qubec, Power to 2.3 million customers interrupted due to ice storms Northeastern United States February 1998 Auckland, New Zealand Power cables failed, central business district was without power for about 5 weeks, affecting as many as 60,000 of the 74,000 people who worked there June 25, 1998 Midwestern United States, Power to 152,000 customers (950 MW) interrupted central Canada November 1988 to June 2003 Western India 29 large cascading failures over 15 years--1.9 per year; power to millions of customers interrupted in most cases (Roy and Pentayya, 2004) 1998 to 2001 Western and midwestern United Rotating blackouts in several markets because of summer prices States December 1998 San Francisco Power to 0.5 million affected 1999 Brazil 24.5 GW of load lost short-circuit 440 KV Busbar 1999 Denmark Power to 100,000 customers interrupted by a hurricane 1999 France Power to 3.6 million customers interrupted by storms 1999 Taiwan Entire country affected by transmission tower collapse due to earthquake July 1999 New York City Power to 300,000 customers interrupted for 19 hours 2000 Portugal Power to 5 million customers interrupted by failure of protection system 2001 Nigeria Power to 20 million to 50 million customers affected 2002 Argentina Power to 2 million customers interrupted by damaged cables 2002 Colombia One-third of country affected by rebel attacks continued

OCR for page 7
14 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM TABLE 1.1 Continuedt Date Location Notable Consequences 2002 Philippines Half of country affected by power plant outages 2003 Algeria Entire country affected by power plant breakdown 2003 Denmark Power to 5 million customers interrupted by a transmission line fault 2003 Georgia, Eastern Europe Entire country affected by transmission tower collapse 2003 North Carolina, Virginia Power to 2,200,200 customers interrupted by Hurricane Isabel August 14, 2003 Midwestern and northeastern Power to 50 million customers interrupted; estimated social costs from $4 billion United States, southeastern to $10 billion; massive traffic jams in New York City (U.S.-Canada, 2004) Canada August 30, 2003 London Power to 410,000 customers interrupted by incorrect relay operation September 18, 2003 Tidewater region, United States Power to 4 million customers interrupted September 23, 2003 Denmark and Sweden Power to 4 million customers interrupted August 24, 1992 Florida Power to 1 million customers interrupted September 27, 2003 Italy Power to 57 million customers interrupted; at least 5 people died; 30,000 passengers stranded in trains for hours (BBC, 2003; CNN, 2003) 2004 Florida, Alabama Power to 5 million customers interrupted by Hurricanes Charley, Frances, Ivan, and Jeanne over a 6-week period 2004 Kyushu, Japan Power to 1 million customers interrupted by typhoon July 12, 2004 Southern Greece Voltage instability as a result of high power transfers into Greece; operator- initiated load shedding unable to prevent voltage collapse; blackout a cause of additional concern due to proximity to 2004 Olympic games 2005 Alabama, Florida, Louisiana, and Power to 2.2 million customers interrupted by Hurricane Katrina Mississippi 2005 Moscow Power to 1.5 million to 2 million customers interrupted by explosion and fire at substation May 24, 2005 Moscow Power to 4 million customers (2,500 MW) interrupted September 12, 2005 Los Angeles Large portion of city lost power because error in substation tripped several circuit breakers tive generators to trip off the system, or perhaps even cause In a few cases, such as in Baghdad, successful attacks physical damage. With the instrumentation now deployed on have been mounted against generation plants. More often, as power systems, it could be very difficult to detect and iden- in Colombia, efforts to attack generation have been prevented tify the initiator of these events. In the now unlikely event by the high levels of security that can be provided for such that they were to occur, competitively induced congestion, large concentrated targets. As a consequence, most of the dynamic instabilities, or equipment disruptions could disrupt attacks that have occurred have been against transmission the system and perhaps also render it more vulnerable to and distribution systems. These systems make more attrac- compounding terrorist assault (DeMarco, 1998). tive targets because they are physically widely dispersed and hence very vulnerable. Often facilities are located in remote places, making them difficult if not impossible to defend Precedents for Attacks on Power Systems against explosions or bullets or other projectiles fired from Although to date attacks on the U.S. power transmission a distance. and distribution system have been limited to small-scale While there is a growing internationalization of some ter- vandalism by a few individuals or small groups with limited rorist activity, most attacks in the past have been mounted technical sophistication, elsewhere in the world the electric by indigenous groups bent on damaging or destabilizing power system in general, and particularly the transmission established ruling power structures. For example, in the and distribution system, have been a focus of considerable past the Irish Republican Army mounted bomb attacks on terrorist activity. power substations in the United Kingdom. More recently

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 15 "Insider(s)" with substantial Pernicious "hackers" who want to knowledge of the system demonstrate their technical knowledge and skill and don't much care about, or even relish, negative consequences. Outsider(s) Attacking the power system "Insider(s)" with substantial Disgruntled individuals or groups because of some grudge against the knowledge of the system who want to harm the power power company or as an act of simple system but not kill a vandalism. lot of people or cause wide societal damage or harm. Attacking the power system for some Outsider(s) symbolic reason (e.g. eco-terroists). Individuals or small low-tech groups with limited resources who do want to kill a lot of people or cause wide societal damage or harm. Power system is a secondary target intended to compound the impact of a Terrorist groups with significant major attack such as September 11, 2001. capabilities and resources who do want to kill a lot of people or cause wide societal Power system is a primary target: damage or harm. - in extreme weather - shake public confidence (e.g., blackout) in several major cities over and over again) - impose major economic costs. Knowledgeable employee of the attacked firm assisting the attacking entity. Participants in power markets seeking a predatory Knowledgeable employee of the ISO or RTO competitive economic assisting the attacking entity. advantage by disrupting the operations of other market players. Knowledgeable outsider(s) working for or assisting the attacking entity. FIGURE 1.7 Simple classification of potential power system attackers. in Columbia, FARC (Fuerzas Armadas Revolucionarias de ings, or radiological, chemical, or biological attacks, there Colombia) has mounted hundreds of attacks on a monthly are enough examples of attacks elsewhere around the world, FIGURE basis against 1.7 transmission and distribution systems with the and enough plausible circumstance under which an attack objective of diminishing the power and standing of the cen- might occur in the United States, to warrant serious attention tral government authority and strengthening FARC's hand and careful planning and preparedness. in any possible future political settlement. Twenty years The Department of Homeland Security (DHS) has devel- previously, Sendero Luminoso mounted similar attacks in oped a range of worst-case terrorist attack scenarios for use Peru. With the capture and imprisonment of almost all of in gaming, in consequence assessment and management, the senior leadership of that organization, such attacks have and in supporting the development of detailed plans and now largely ceased. response strategies (Lipton, 2005). Most of these scenarios There have been frequent attacks on transmission and deal with weapons of mass destruction which would not be distribution facilities in Iraq by insurgent groups intent particularly appropriate for attacks on the power systems, on contributing to general social disruption, embarrassing and in particular on the transmission and distribution system. central authorities, and preventing the normalization of Nevertheless, the power industry itself has conducted daily life. scenario-based tabletop exercises to examine possible attack Many such attacks have occurred across Asia. For scenarios and their consequences. These have included a example, terrorist groups in Thailand have recently increased variety of exercises involving attacks against the transmis- the size and numbers of their attacks against electric power sion and distribution system. Individual power companies, facilities as part of a broader campaign to bring down the as well as reliability organizations and trade and research central government in Bangkok. Many parts of Africa have organizations, have also conducted detailed power system also witnessed such attacks. attack simulation studies and threat assessments in order to Although in the United States attacking the power system identify vulnerable assets and to develop protective actions may not be as attractive to serious terrorist groups as bomb- as well as response and recovery strategies.

OCR for page 7
16 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM IMPACTS OF WIDESPREAD, LONG-LASTING as gas prices have risen, often more rapidly than the price of BLACKOUTS electricity (half of which is generated from coal), many gas pipelines have begun to convert their compressor stations Electricity is essential to the U.S. economy and to this from gas to electricity -- thus creating a coupled vulnerabil- country's way of life. Annual sales in 2006 were $326 bil- ity between what were once two independent energy supply lion, approximately the same size as telecommunications systems. Similar coupling vulnerabilities can occur with oil (DOE/EIA, 2007). Moreover, the value of electricity is far delivery systems, communication systems, railways, and greater than the price that consumers pay multiplied by the other critical infrastructure. amount they consume. Economists refer to this extra value Power disruptions also put people out of work. For exam- as "consumer surplus." ple, Statistics Canada reported that "an estimated 2.4 million Estimating the economic cost of large-scale or long-dura- workers in Ontario and Gatineau, Quebec, lost 26.4 million tion blackouts is difficult. The Wall Street Journal reported hours of work time in the second half of August because that the economic costs of the massive blackout that struck of the [2003] Ontario-U.S. power outage and subsequent the Midwest, the Northeast, and parts of Canada in August conservation period."7 2003 could have been as high as $4 billion to $6 billion Several models have been used to estimate the eco- (Hilsenrath, 2003). North American Reliability Council nomic impacts of hypothetical local and regional blackouts. data indicate that the amount of power not delivered during Greenberg et al. (2007) used a regional econometric model that blackout was approximately 920,000 megawatt-hours to examine the economic impacts of a variety of outage sce- (MWh). Together, these two numbers suggest that the eco- narios involving blackouts of one New Jersey utility (Public nomic cost of the 2003 blackout came to approximately $5 Service Electric and Gas, PSE&G, which serves about half per forgone kilowatt-hour,6 a figure that is roughly 50 times the state) and estimated statewide impacts. The most severe greater than the average retail cost of a kilowatt-hour in the scenario studied involved the loss of 95 percent of power dur- United States. However, many of the affected industries ing the first day with 10 percent of power not restored until appear to have made up for much of the lost output once the end of the second month. Assuming the attack occurred power was restored. In a disruption of longer duration and in the summer of 2005, the worst case resulted in a loss of greater geographic extent, a post-blackout rebound could be 3.4 percent of the gross state product during that year ($389 much more modest. billion year in 2000 dollars) followed by a positive rebound Lecomte et al. (1998) estimated that the 1998 ice storm of 2 percent the following year. Since the simulated event is that disrupted power to 1,673,000 customers, of whom assumed to be localized, one of the more interesting issues 1,393,000 were in Quebec, resulted in economic losses of explored is the extent to which businesses would choose to $1.6 billion in Canada and $1 billion in repair costs to the move to other regions thought to be less at risk of future Hydro-Quebec and Ontario Hydro systems. A significant attack. fraction of the 28 deaths in Canada and 17 deaths in the Despite the difficulty of producing precise numbers, it United States also resulted from the lack of power. is clear that blackouts of large scale or long duration can Large-scale disruption caused by damage to the high- easily result in economic costs of many billions of dollars. voltage transmission system garners wide attention, but Other infrastructure and services are also lost or are seriously widespread damage in the distribution system, such as that degraded, further disrupting the lives of people who find caused by recent Florida and Gulf Coast hurricanes, can be themselves in dangerous situations, without work, and with- more expensive. Schuler (2005) notes that Florida Power out conventional services such as operating bank machines and Light incurred repair costs of $890 million from damage and gas stations. done by hurricanes in August and September of 2004, largely A systematically designed and executed terrorist attack to distribution systems, and estimates that "the societal costs could cause disruptions considerably more widespread and were probably even greater than those incurred in the 2003 of much longer duration than the largest power system dis- Northeast blackout." ruptions experienced to date. Since those disruptions have Loss of power can have profound impacts on other criti- entailed economic impacts approaching 10 billion dollars, cal infrastructures, as illustrated in an analysis by Chang et it appears possible that terrorist attacks could lead to costs al. (2005) of a January 20, 1993, windstorm in the Pacific of hundreds of billions of dollars--that is, perhaps as much Northwest with documented impacts on emergency services, as a few percent of the U.S. gross domestic product, which transportation, health care, building support, the food supply, is currently about $12.5 trillion. If large, extended outages and government. Losses included 2.5 million customer-hours were to occur during times of extreme weather, they could of power outages disruptions for up to 3.5 days in some areas. also result in hundreds or even thousands of deaths due to In the past, the pumping stations on natural gas pipelines heat stress or extended exposure to extreme cold. were powered by the gas they were transporting. However, 6OTA (1990) estimated in 1990 that disruptions of similar duration would 7As cited at http://www.ontariotenants.ca/electricity/articles/2003/cp- impose costs of $1 to $5 per kilowatt-hour. 03j31.phtml.

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 17 Even without intentional attacks, power systems are In the area of detection, several activities are ongoing, always undergoing damage and recovery. While system such as: owners and operators should do all that they reasonably can to ensure that their systems are able to withstand anticipated Training system operators to consider sabotage and assaults from natural and human sources, there are practical terrorism as a possible explanation for disturbances, limits to how much such systems can be "hardened" because Implementing a real-time data collection process of its highly distributed nature. The complete elimination of for reporting indicators of potential physical and all possible modes of failure is simply not a feasible objec- cyber-events to DHS (such as the presence of strange tive. Thus, even in the absence of threats from terrorists, vehicles and aircraft near critical facilities), an important design objective should be resilience, i.e., the Holding conferences sponsored by industry and ability to rapidly restore the power system after a problem government, conducting dialogs, holding scheduled occurs and the ability to sustain critical social services while conference calls, and exchanging security-related the problem persists. alerts, brochures, and newsletters. Restoration activities include: ACTIONS TAKEN SO FAR TO REDUCE VULNERABILITY Preparing contingency plans for restoring service, The need to reduce the vulnerability of the U.S. electric Stocking equipment needed for service restoration, power system is well recognized in the government and Cataloging and agreeing to share spare transformers industry. Although related action has been somewhat slow following an attack. and limited, many improvements made behind the scenes are rarely reported in detail to the media. Reducing the vulner- Actions by Government ability of electric power systems is becoming a top priority of utility management. In addition, the Energy Policy Act of The most relevant provision of EPAct is establishment of 2005 (EPAct) includes provisions to strengthen the system the Electric Reliability Organization to develop and enforce and make temporary improvements permanent. Under autho- reliability standards for the bulk transmission system. Before rization provided by EPAct, the North American Electric it was designated as the ERO in July 2006, NERC could only Reliability Council (NERC) is now moving to improve U.S. recommend upgrades as needed to maintain reliability. Now, electric power system performance through the creation of those standards will be mandatory, but they must also be the national Electric Reliability Organization (ERO), which approved by FERC. NERC will base its standards in part on has the authority to develop mandatory reliability standards. existing data and experience with past operating incidents. EPAct also provides incentives for both expanding the trans- According to Section 236 of the ERO certification order: mission system and removing barriers to siting transmission lines, and it addresses the problem of relieving areas of NERC states that the purpose of a Reliability Standard, or critical congestion on the transmission system. Improving its reliability objective, should derive from one or more of the resilience of the transmission system to relatively routine the following eight general objectives: (1) the Bulk-Power failures will also reduce vulnerability to deliberately caused System should be planned and operated to perform reliably under normal and abnormal conditions; (2) the frequency failures. and voltage of the Bulk-Power System should be controlled within defined limits by balancing real and reactive power Actions by the Utility Industry supply and demand; (3) information necessary for the plan- ning and operation of the Bulk-Power System should be Actions by the utility industry to deal with terrorism made available to those who need it; (4) emergency op- focus on prevention, detection, and restoration. Prevention erations plans should be developed and implemented; (5) measures that the industry has implemented include: facilities for communication, monitoring, and control should be provided, used and maintained; (6) personnel must be Self-determination of the proper alert level for physi- trained, qualified and must have the authority to implement cal and cybersecurity in conjunction with the advice actions; (7) the reliability of the Bulk-Power System should of the DHS, be monitored on a wide-area basis; and (8) the Bulk-Power System must be protected from malicious physical or cyber Security improvements such as physical barriers and attacks. (FERC, 2006) an increased security workforce for protecting physi- cal facilities, and Only the last general objective directly addresses the More stringent security requirements for facility potential for terrorist attacks. Basing NERC standards on entry. past experience will make it difficult to ensure that they pro- tect against effects of terrorism, as there are no data on the

OCR for page 7
18 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM nature or results of terrorist attacks on electric power systems Although major terrorist organizations have not in this country. Furthermore, NERC's intention to consider attacked the U.S. power delivery system, such ter- costs as well as benefits may work against protection against rorist attacks have occurred elsewhere in the world. extreme but unlikely risks that cannot be quantified, includ- Simply turning off the power typically does not ter- ing terrorist attacks. Overall, however, establishment of an rorize people. However, the United States should not ERO with real authority is a significant step forward. In ignore the possibility of an attack that turns off the addition, EPAct includes measures that should encourage the power before staging a large conventional terrorist construction of new transmission lines and the development event, thus amplifying the latter's consequences. Nor of new technologies to improve the efficiency and reliability should the possibility of a series of attacks designed of the power grid, steps that should also provide increased to do major damage to the economy and to the pub- resistance to terrorist attacks. DOE's report On the Road to lic's sense of security and well-being be ignored. Energy Security describes how it is carrying out its respon- Economic costs from a carefully designed terrorist sibilities under EPAct (DOE, 2006). attack on the U.S. power delivery system could be as DHS's National Infrastructure Protection Plan (NIPP) high as hundreds of billions of dollars (i.e., perhaps provides an overall approach to protecting critical infrastruc- as much as a few percent of U.S. gross domestic ture, including electric power systems (DHS, 2006a). DHS's product). analysis of terrorist capabilities and motivations suggests that Both industry and government have begun to address infrastructure could be a prime target, especially as protec- the risks of terrorism to the power delivery system, tion is enhanced at other targets. The plan calls for (1) strong but there is much more that can and should be done. public-private partnerships to foster relationships and facili- tate coordination within and across critical infrastructure and REFERENCES key resource sectors; (2) robust multidirectional information sharing that will enhance the ability to assess risks, make BBC. 2003. "Italy Launches Blackout Inquiry." BBC news online. Septem- ber 30, 2003. Available at http://news.bbc.co.uk/2/hi/europe/3150788. prudent security investments, and take protective action; and stm. Accessed August 2007. (3) a risk management framework establishing processes for Chang, S.E., T.L. McDaniels, and D. Reed. 2005. "Mitigation of Extreme combining consequence, vulnerability, and threat informa- Event Risks: Electric Power Outage and Infrastructure Failure Interac- tion to produce a comprehensive, systematic, and rational tions." Pp. 7090 in The Economic Impacts of Terrorist Attacks, H.W. assessment of national or sector risk. Not addressed in the Richardson, P. Gordon, and J.E. Morre II, eds. Northampton, Mass.: Edward Elgar Publishing. NIPP, however, is the issue of how private entities can be CNN. 2003. "Italy Recovering from Big Blackout." CNN. Sept. 28, 2003. expected to assume the large costs required to make the Available at http://www.cnn.com/2003/WORLD/europe/09/28/italy. system more robust against low-probability events. blackout/index.html. Accessed August 2007. DHS's revised National Response Plan, a broad, com- DeMarco, C.L. 1998. "Design of Predatory Generation Control in Electric prehensive plan for preparing for a wide range of emergen- Power Systems." Pp. 3238 in Thirty-First Annual Hawaii International Conference on System Sciences, Vol. 3. New York: IEEE. cies, also addresses critical infrastructure, including electric DHS (Department of Homeland Security). 2006a. National Infrastructure power systems (DHS, 2006b). Protection Plan. Available at http://www.dhs.gov/dhspublic/interapp/ editorial/editorial_0827.xml. Accessed September 2006. DHS. 2006b. National Response Plan. Available at http://www.dhs.gov/ CONCLUSIONS xprepresp/committees/editorial_0566.shtm. Accessed October 2006. DOE (U.S. Department of Energy). 2006. On the Road to Energy Security: By their very nature, electric power transmission Implementing a Comprehensive Energy Strategy: A Status Report. Avail- and distribution systems are not perfectly reliable. able at http://www.energy.gov/media/FINAL_8-14_DOE_booklet_ Keeping power flowing to customers is a continuous copy_sep.pdf. Accessed September 2006. process of control, recovery, and repair. Most out- DOE/EIA (Energy Information Administration). 2007. Revenue from Re- ages involve only the distribution system. However, tail Sales of Electricity to Ultimate Customers by Sector, by Provider . Available at http://www.eia.doe.gov/cneaf/electricity/epa/epat7p3.html. occasionally storms, accidents, or other events cause Accessed October 2007. disruption of the high-voltage transmission system. DOE/FERC (Federal Energy Regulatory Commission). 1978. The Con Power systems are designed and operated to cope Edison Power Failure of July 13 and 14, 1977. Washington, D.C.: U.S. with such disturbances and to restore service as rap- Government Printing Office. idly as possible. EPRI (Electric Power Research Institute). 2003. Distribution Reliability Indices Tracking Within the United States. Report No. 1008459. Palo Well-planned attacks on the power system, under- Alto, Calif.: EPRI. taken by informed terrorists, could result in power FERC. 2006. Order Certifying North American Electric Reliability Cor- outages with extents and durations that are much poration as the Electric Reliability Organization and Ordering Compli- larger than those produced by all but the largest ance Filing. Available at ftp://www.nerc.com/pub/sys/all_updl/docs/ natural events. Damage to critical, difficult-to-replace ferc/20060720_ERO_certification.pdf. Accessed September 2006. system components could be extensive, making res- toration of power slow and extremely difficult.

OCR for page 7
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 19 Greenberg, M., N. Mantell, M. Lahr, N. Felder, and R. Zimmerman. 2007. Rose, A., S-Y Liao, and G. Oladosu. 2005. "Regional Economic Impacts "Short and Intermediate Economic Impacts of a Terrorist Initiated Loss of Terrorist Attacks on the Electric Power System of Los Angeles: A of Electric Power: Case Study of New Jersey." Energy Policy 35(1): Computable General Disequilibrium Analysis." Paper presented at the 722733. Second Annual Symposium of the DHS Center for Risk and Economic Hilsenrath, J. 2003. "The 2003 Blackout: Economy Won't Likely Be Analysis of Terrorism Events, University of Southern California, Los Derailed--Cost Could Hit $6 Billion as Major Sectors Are Hurt; a Few Angeles, Calif., August 20. Reaped Benefits." Wall Street Journal, August 18. Roy, A., and P. Pentayya. 2004. "Experience of Blackouts and Restoration Lecomte, E.L., with A.W. Pang and J.W. Russell. 1998. Ice Storm '98, ICLR Practices in the Western Region of India." Slides presented at the IEEE Research Paper Series No. 1. Institute for Catastrophic Loss Reduction, Power Engineering Society General Meeting, Denver, Colo., July. Toronto, Canada. Available at www.iclr.org/pdf/icestorm98_english.pdf. Schuler, R.E. 2005. "Float Together/Sink Together? The Effect of Con- Accessed August 2007. nectivity on Power Systems." Pp. 91118 in The Economic Impacts of Lipton, E. 2005. "U.S. Report Lists Possibilities for Terrorist Attacks and Terrorist Attacks, H.W. Richardson, P. Gordon, and J.E. Morre II, eds. Likely Toll." New York Times, March 16. Northampton, Mass.: Edward Elgar Publishing. Meade, C., and R.C. Molander. 2006. "Considering the Effects of a Cata- U.S.-Canada (U.S.-Canada Power System Outage Task Force). 2004. Fi- strophic Terrorist Attack." RAND Technical Report. Available at www. nal Report on the August 14, 2003 Blackout in the United States and rand.org/pubs/technical_reports/TR391/. Accessed August 2007. Canada: Causes and Recommendations. Available at http://www2. Mueller, J. 2006. "Is There Still a Terrorist Threat?" Foreign Affairs 85(5): nrcan.gc.ca/es/erb/erb/english/View.asp?x=690&oid=1221. Accessed 28. August 2007. NRC (National Research Council). 2002. Making the Nation Safer: The USFPC (U.S. Federal Power Commission). 1965. Northeast Power Fail- Role of Science and Technology in Countering Terrorism. Washington, ure: November 9 and 10, 1965. Washington, D.C.: U.S. Government D.C.: The National Academies Press. Printing Office. OTA (Office of Technology Assessment). 1990. Physical Vulnerability of WSCC (Western Systems Coordination Council) Operations Committee. Electric System to Natural Disasters and Sabotage. OTA-E-453. Wash- 1996. Western Systems Coordinating Council Disturbance Report . ington, D.C.: U.S. Government Printing Office. Butte, Mont.: WSCC. Rose, A., and S-Y Liao. 2005. "Modeling Regional Economic Resilience to Disasters: A Computable General Equilibrium Analysis of Water Service Disruptions." Journal of Regional Science 45(1): 75112.