Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 7
1
The Electric Transmission and Distribution
System as a Terrorist Target
Terrorists could destroy key elements of the electricity with the loss of power, and reviews a few of the actions that
generation and delivery system, causing blackouts that are have been taken to date to reduce vulnerability.
unprecedented in this country in duration and extent. The
U.S. economy depends on a reliable supply of electricity,
THE ELECTRIC POWER SYSTEM AND ITS
and widespread disruptions of long duration could cause
VULNERABILITY
enormous economic damage and suffering. Under some
circumstances (e.g. a heat wave) such blackouts could also Today in the United States, and in most of the rest of
lead to significant loss of life. On the other hand, attacks the industrialized world, power flows from large generating
on the U.S. power system would not immediately kill large plants to customers through a complex, dynamic system
numbers of people or cause massive destruction of familiar whose structure is the result of gradual evolution over more
structures or facilities, and therefore probably would not be than a century. Early power systems had small generating
as dramatic as the September 11, 2001, attacks. stations close to local distribution systems that fed power
There is considerable debate over just how serious a threat to streetlights and homes at relatively low voltage. As
terrorists pose to U.S. infrastructure such as the electric trans- systems became larger and power had to be carried over
mission and distribution system (NRC, 2002; Meade and longer distances, power lines were operated at ever higher
Molander, 2006; Mueller, 2006). Electricity is ubiquitous, voltage in order to minimize losses. Efficient high-voltage
reliable, and taken for granted . . . until the lights go out. transmission lines also made it possible to locate ever larger
Occasional large accidental outages caused by "cascading generators in remote areas rather than close to towns and
failures" in the high voltage transmission system (such as the cities. By the middle of the 20th century, system operators
Northeast blackout of August 2003) have briefly raised pub- began to connect individual high-voltage systems together
lic concern about potential vulnerabilities, but to date such so that power could be moved from region to region, both to
concerns have rapidly disappeared once power is restored. promote economic efficiency and to increase reliability by
Power outages caused by damage to the distribution system, making it possible to move power into regions suffering from
the lower voltage lines that carry power to customers, are temporary shortages.
far more common. Recent examples include the destruction Once electric power has been generated, the voltage is
after hurricanes in Florida and the Gulf Coast, as well as the stepped up1 and power moves over long distances through
July 2006 outage in New York City's borough of Queens. the high-voltage transmission system, a complex network of
While the inconvenience and cost of these accidental dis- lines, most of which are carried aboveground on tall towers.
ruptions of the nation's transmission and distribution system At key points throughout this system are substations that
have been large, they pale in comparison with the impacts contain transformers to increase and decrease the voltage,
that might result from a large, well planned, terrorist attack. switching gear that connects the system in desired configura-
Even if the probability of such an intentional attack were
assessed to be quite low, the consequences are large enough 1The voltage of AC power can be easily increased or decreased using
that the nation needs to protect this essential service. transformers. High voltage is used to move power long distances in order
This chapter briefly reviews the electric power system to minimize losses that result from the current heating the line. The power
and its vulnerabilities, identifies the types and motivations carried by a line is the product of the current and the voltage. However, for a
of potential attackers, explores the potential costs associated given line, losses from heating go up as the square of the current. In moving
a given amount of power, using a higher voltage reduces the current, and
thus reduces the loss due to heating.
7
OCR for page 8
8 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
10 Year Trend of SAIDI
tions, and circuit breakers that open and close connections 160
while also acting as giant fuses to protect expensive equip- 140
ment from damage, as well as a variety of other devices. 120
Most substations sit out in the open protected only by a 100
Minutes
simple chain-link fence. All but a few high voltage lines are 80
also in the open. Thus, both substations and the lines that 60
connect them are vulnerable to damage from storms and to 40
25th Percentile
terrorist attack. 20
50th Percentile (Median)
75th Percentile
When power reaches an area where it will be used, the 0
voltage is reduced and power is distributed to customers 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001
(11) (14) (24) (25) (27) (39) (57) (57) (56) (53)
over lower-voltage distribution lines. Unlike the transmis- Ye ar (# of Ut ilit ie s Re po r t ing )
sion system, which is a large interconnected network, many
FIGURE 1.1a System Average Interruption Duration Index
distribution systems branch out radially to deliver power to
(SAIDI) indicators for U.S. utilities for the period 1992 to 2001
customers, although some older, dense urban areas, such as (excluding major events). SOURCE: EPRI (2003).
New York City, use network configurations for distribution. FIGURE 1.1a.
All the elements of the transmission system, and increasingly
those of the distribution system, are monitored and controlled storms, earthquakes, and similar natural events, can bring
by information and communication systems. down many transmission lines, and, less frequently, can
Although problems in any part of the system can disrupt damage transformers, circuit breakers, and other equipment
the supply of electric power, this report focuses on the trans- such as the terminal facilities for direct-current (DC) lines.
mission and distribution (T&D) system, substations, and Inadequate attention to maintenance can also contribute
other associated parts, discussing generation only as it relates to blackouts--as in the recent case of an improperly sized
to issues involving transmission and distribution. Details on circuit breaker in London, or several instances of arcing to
how the T&D system is controlled, operated, managed, and vegetation that have resulted from inadequate tree trimming
regulated are given in Chapter 2. in the United States.
As explained in greater detail in Chapter 2, the transmis-
sion system is much more stressed, and thus more vulnerable,
Non-malicious Threats to the Electricity Delivery System than it was a few decades ago, principally as a result of two
By its very nature, the T&D system is not perfectly reli- factors: (1) years of underinvestment in system upgrades
able. Even without terrorist activity, the power sometimes stemming from ambiguities and altered incentives that
goes out, usually for just a few seconds, minutes, or hours, resulted from electric power restructuring and associated
but sometimes for a few days. On very rare occasions, and in changes in the regulatory environment and (2) demands on
limited locations, outages may stretch on for weeks. As the the system to move power between sellers and buyers in new
duration and geographic extent of an outage increase, people competitive power markets in greater volume and in ways in
become seriously inconvenienced, and economic and other which the system was not designed to operate.2
costs rise, but people generally do not experience "terror." Figures 1.1a and 1.1b show the trend in two common
Keeping power flowing to customers is a continuous pro- measures of power supply disruption in the United States
cess of control, recovery, and repair. Most outages are local, over the decade from 1992 to 2001--the System Average
brief in duration, and caused by problems at the level of the Interruption Duration Index (SAIDI), which indicates the
distribution system--such as lightning strikes, wind storms average time that customers are without power during the
and tree falls, short circuits caused by wild animals such as period analyzed (Figure 1.1a), and the System Average
squirrels, vehicles that crash into power poles, and similar Interruption Frequency Index (SAIFI), which indicates the
events. Line crews can usually fix these outages in a matter of average number of interruptions per customer served per
hours. Distribution systems that incorporate automation can year (Figure 1.1b). Both reflect principally the effects of
often isolate a problem and restore service for many affected distribution system disturbances and exclude outages caused
customers in a matter of seconds or minutes. by major events. Figures 1.2a and 1.2b show SAIDI and
Outages caused by disruptions in the high-voltage trans- SAIFI measures of reliability internationally. Reliability in
mission system are less common. When they do occur, the United States appears to be poorer, on average, than that
because of faulty equipment, weather, or for other reasons, experienced by customers for electric power in some other
many such outages are never noticed by customers, because
automatic controls and system operators can limit their 2Much
of the transmission system was originally designed to serve the
impact and maintain the supply of power to the distribution needs of vertically integrated regulated utilities. Following deregulation of
system. But, of course, the transmission system does occa- the power industry and the introduction of competition among generators,
sionally experience problems that result in loss of service the transmission system is now being expected to move power in ways that
have resulted in patterns of power flow that did not exist previously under
to customers. Weather events, such as hurricanes and ice regulation.
OCR for page 9
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 9
10 Year Trend of SAIFI
1.8 Some terrorist groups hostile to the United States clearly
1.6 have the capability of causing massive damage--the loss
# of Sustained Interruptions
1.4 of so many generating or transmission facilities that major
1.2 metropolitan areas or even multi-state regions suffer severe,
1
long-term, power shortages. The absence of such attacks has
0.8
as much to do with how terrorists view their opportunities
0.6
25th Percentile as with their ability. U.S. electric power systems are only
0.4 50th Percentile (Median)
one target out of many ways of striking at America, and not
0.2 75th Percentile
0
necessarily the most attractive.
1992 1993 1994 1995 1996 1997 1998 1999 2000 2001
(12) (15) (26) (26) (28) (39) (55) (59) (55) (53)
Year (# of Utilities Repor ting)
More recently, the National Research Council report Making
the Nation Safer (NRC, 2002. p. 178) noted that:
FIGURE 1.1b System Average Interruption Frequency Index
(SAIFI) indicators for U.S. utilities for the period 1992 to 2001 [a]nalysis of possible targets, weapons, and delivery systems
(excluding major events). SOURCE: EPRI (2003). and of direct and indirect consequences reveals several very
dangerous scenarios. The scenarios of greatest concern in-
FIGURE 1.1b
volve the electrical system. When service is lost, there are
developed countries, although much of this difference is due immediate consequences to every person, home, and busi-
to major differences in population density and power system ness. An extended outage of electricity would have profound
configurations. consequences.
As indicated in Figure 1.3, large outages in the United
States between 1984 and 2000 were more frequent than The same report emphasized (p. 180):
might have been anticipated on the basis of a simple expo-
[t]he impact of a prolonged interruption in the electric power
nential distribution. Although in recent years in the United
supply to any region of the country would be much larger
States there has been no significant change in the frequency
than the economic loss to the energy sector alone. . . . The
of outages (Figure 1.4), there has been a very significant nation's electric power systems must clearly be made more
increase in the frequency of transmission loading relief resilient to terrorist attack.
events (Figure 1.5).3
Most problems occurring in the transmission of electric Potential attackers, as shown in Figure 1.7, include the
power can easily be corrected by automatic controls and following.
actions taken by system operators. However, occasionally
these actions are not sufficient to keep power flowing. Prob-
lems or failures originating in one part of the system may Terrorists
give rise to problems (such as overloads) in other parts of Most problematic are terrorist groups with significant
the system, which in turn cause additional problems that may technical capabilities and resources who want to kill large
ultimately result in a cascading power failure. The fact that numbers of people or cause widespread societal or economic
the power system uses alternating current (AC) means that damage. Although not very likely, as noted above, such ter-
the system's behavior is sometimes further complicated by rorists might view the power system as a primary target. As
oscillatory or other complex dynamic behavior, as illustrated discussed later in this chapter, a sophisticated attack could
in Figure 1.6. Although they are rare, such events sometimes cause a lengthy blackout over an extensive region. An attack
cause a loss of power to many customers (Table 1.1 and during a period of extreme weather, such as a heat wave,
Figure 1.3). might lead to the deaths of many people, albeit in a far less
spectacular way than in a large explosion or a chemical or
Potential Attacks on the Electric Power System biological attack. However, the drawn-out agony produced
by such an attack would clearly create great public anxiety
Because electricity is so essential to modern industrialized and outrage, especially if government and private responses
societies, the power system has frequently been identified as were seen as inadequate, and perhaps, too, if the first attack
a potential terrorist target. For example, more than 15 years were followed by other similar attacks. Public confidence
ago, in a report titled Physical Vulnerability of the Electric could also be eroded, and anger heightened, if terrorists were
System to Natural Disasters and Sabotage (OTA, 1990. able to hold the grid hostage by mounting limited demon-
p. 14), the Office of Technology Assessment concluded: stration attacks with promises of worse to come if demands
were not met.
Although international terrorist groups such as al-Qaeda
3A transmission loading relief event occurs when congestion on the have been more interested in killing people that in causing
transmission system prevents the transmission of electricity for which a economic damage, different groups with different motiva-
transaction has been contracted. tions could emerge. An attack that brought a power system
OCR for page 10
10 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
FIGURE 1.2a System Average Interruption Duration Index (SAIDI) indicators internationally for the period 1992 to 2001 (excluding only
interruptions caused by major storms and hurricanes). SOURCE: EPRI (2003).
FIGURE 1.2b System Average Interruption Frequency Index (SAIFI) indicators internationally for the period 1992 to 2001 (excluding only
interruptions caused by major storms and hurricanes). SOURCE: EPRI (2003).
down for an extended period could cause enormous eco- ticularly if mounted by someone with detailed knowledge of
nomic damage, as discussed below. the electric power system, its physical characteristics, and its
Terrorists could, under some circumstances, view the vulnerabilities.
transmission and distribution system as an important sec-
ondary target.
Hackers and Other Nonterrorist Individuals and Groups
Terrorist attacks probably would involve physical destruc-
tion of key system facilities. However, a combined cyber Terrorist attacks are the main focus of this report, but other
attack and physical attack could be especially serious, par- types of attackers are also relevant. Not only are lower-level
OCR for page 11
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 11
1.0
0.5
0.1
0.05
0.01
0.005
1 10 100 1,000 10,000
L, size of the outage in megawatts
FIGURE 1.3 Relative frequency of electrical outages in the United
States between 1984 and 2000. Of the 533 transmission or genera-
tion events shown, 324 involved a power loss of >1 MW (average
of once every 19 days), and 46 involved a power loss of >1,000
FIGURE 1.3
MW (average of 3 per year). Dots indicate actual outage events.
The dashed line is an exponential (Weibull) distribution fit to the
failures below 800 MW loss. The solid line is a power law fit to the FIGURE 1.5 Annual number of transmission loading relief events
NERC data over 500 MW loss. SOURCE: Data compiled by NERC since 1997. The substantial increase indicates that over the past
DAWG, plotted by Jay Apt, Carnegie Mellon University, 2006. decade the level of stress on the system has grown considerably.
SOURCE: NERC data plotted by Jay Apt, Carnegie Mellon Uni-
versity, 2006.
FIGURE 1.5
people angry at the power company, bored hunters taking
pot shots at insulator strings, or individuals who view the
power company as an important symbol of something they
oppose. For example, the Earth Liberation Front has report-
edly been involved in a plot to bring down high-voltage
power lines.4 Any such attack could be serious, especially
if undertaken by a current or former employee with detailed
insider knowledge. Between 1984 and 2000, approximately
3 percent of major disturbances in the United States were
attributed to sabotage.5 The authors of Making the Nation
Safer note that sabotage of individual components has "posed
a nuisance, but the impacts have generally been manageable"
FIGURE 1.4 Frequency of electrical outages in the United States (NRC, 2002, p. 177). Pernicious hackers are people whose
over time. Note that while there is significant year-to-year variabil- primary motivation is not to kill people or cause specific
ity, there is no long-term trend. SOURCE: Data compiled by NERC damage, but rather to test limits and perhaps gain recognition
DAWG, plotted by Paul Hines, FIGURE 1.4 Mellon University, 2006.
Carnegie within a subculture by demonstrating technical prowess by
disrupting the operation of an important and highly visible
societal system. Their motivation would be similar to that of
attacks more likely, but many of the steps that should be taken computer hackers who release computer viruses and worms,
to strengthen the system against terrorists will help against or disrupt corporate and government computer sites. It is
these attacks also. This section briefly describes the types of likely that such attacks would come from lone individuals
attacks that may be encountered. or small groups.
Individuals or small low-tech groups with limited Finally, harmful activity could be motivated by com-
resources who want to kill people or cause widespread soci- mercial benefit. A power company seeking a competitive
etal damage could pose a serious threat, but the amount of
harm that one or a few such people could do to the electric
system is probably limited. Individuals or groups that want 4See "11 Indicted in Eco-terror Arsons," available at http://abcnews.
to harm the power system but not kill a lot of people or go.com/US/Terrorism/story?id=1526225.
5Based on NERC Disturbance Analysis Working Group (DAWG) data
cause widespread societal damage or harm might include
available at http://www.nerc.com/~dawg/.
OCR for page 12
12 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
FIGURE 1.6 Illustrative analogy of electric transmission and distribution. Unlike a set of rigid drive shafts (above) that move power from
generators to loads, AC power transmission and distribution systems are more accurately thought of in terms of a series of coil springs of
varying stiffness through which power is transmitted by twisting (below). Since these links are not rigid, under some circumstances they can
exhibit complex oscillatory behavior, or even become so tangledfigthat 1-6
they can no longer transmit power.
Contrast has been increased in bottom figure to get the big arrows darker.
Everything is darkened everything so this is about as far as we can go.
advantage might sabotage its competitor's equipment, and ing transfer rights on tie-lines between control areas in order
These images are JPEGS so individual parts cannot be selected
in the process compromise the integrity of the system. Until to increase congestion at those facilities and thereby maintain
the pernicious actions of Enron traders were revealed, few local market power, or (2) large buyers creating transient
would have given such a possibility a second thought. With disturbances on the system in an effort to reduce the number
tighter oversight and greater awareness within the industry, of other buyers, thereby lowering system load and price. A
plus FERC's increased emphasis on market monitoring, such simplified model illustrates how two or more small, physi-
activity is probably unlikely, but the potential for it should cally separated generators acting together might have their
not be ignored. The possibilities include, for example, (1) supply frequencies altered and produce resonant phenomena
generators in one independent system operator (ISO) captur- that might cause protective devices on other large competi-
OCR for page 13
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 13
TABLE 1.1 Some Worldwide Examples of Cascading Power Failures with Potential or Actual Widespread Impact
Date Location Notable Consequences
November 9, 1965 Northeastern United States Power to 30 million customers (20,000 MW) interrupted (USFPC, 1965)
(10 states), Ontario
June 5, 1967 Middle Atlantic Region 4 million people affected
May 1977 Miami, Florida Power to 1 million customers over 15,000 square miles interrupted
July 13, 1977 New York City Power to 9 million customers (6,000 MW) interrupted for as long as 24 hours;
widespread looting, chaos; police made about 3,000 arrests (DOE/FERC, 1978)
December 1978 France Power in part of France interrupted due to voltage collapse
January 1981 Idaho, Utah, and Wyoming Power to 1 million customers interrupted for 7 hours
March 1982 Oregon Power to more than 900,000 customers interrupted for 1.5 hours
1987 Tokyo Power to 2.8 million customers interrupted
1989 Quebec Power to 9 million customers interrupted; geomagnetically induced currents from
solar storm
1990 Egypt Power for entire country affected by sandstorms
December 1994 Western United States Power to 2 million customers interrupted from Arizona to Washington state
1996 Malaysia Power to 20 million customers interrupted
1996 Philippines Half of country affected by power plant outages
July 2, 1996 Western United States Power to 2 million customers (11,850 MW) interrupted in 14 states for
approximately 6 hours (WSCC, 1996)
July 3, 1996 Western United States Recurrence of July 2 disturbance; operators interrupted power supply to most of
Boise, Idaho, vastly reducing the extent of the event (WSCC, 1996)
August 1996 Indonesia Power to 100 million customers interrupted
August 10, 1996 Western United States Power to 7.5 million customers (28,000 MW) interrupted; economic damage
estimated at $1 billion to $3 billion (WSCC, 1996)
1998 North central United States/ Power to 152,000 customers interrupted by lightning
central Canada
January 1998 Québec, Power to 2.3 million customers interrupted due to ice storms
Northeastern United States
February 1998 Auckland, New Zealand Power cables failed, central business district was without power for about 5
weeks, affecting as many as 60,000 of the 74,000 people who worked there
June 25, 1998 Midwestern United States, Power to 152,000 customers (950 MW) interrupted
central Canada
November 1988 to June 2003 Western India 29 large cascading failures over 15 years--1.9 per year; power to millions of
customers interrupted in most cases (Roy and Pentayya, 2004)
1998 to 2001 Western and midwestern United Rotating blackouts in several markets because of summer prices
States
December 1998 San Francisco Power to 0.5 million affected
1999 Brazil 24.5 GW of load lost short-circuit 440 KV Busbar
1999 Denmark Power to 100,000 customers interrupted by a hurricane
1999 France Power to 3.6 million customers interrupted by storms
1999 Taiwan Entire country affected by transmission tower collapse due to earthquake
July 1999 New York City Power to 300,000 customers interrupted for 19 hours
2000 Portugal Power to 5 million customers interrupted by failure of protection system
2001 Nigeria Power to 20 million to 50 million customers affected
2002 Argentina Power to 2 million customers interrupted by damaged cables
2002 Colombia One-third of country affected by rebel attacks
continued
OCR for page 14
14 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
TABLE 1.1 Continuedt
Date Location Notable Consequences
2002 Philippines Half of country affected by power plant outages
2003 Algeria Entire country affected by power plant breakdown
2003 Denmark Power to 5 million customers interrupted by a transmission line fault
2003 Georgia, Eastern Europe Entire country affected by transmission tower collapse
2003 North Carolina, Virginia Power to 2,200,200 customers interrupted by Hurricane Isabel
August 14, 2003 Midwestern and northeastern Power to 50 million customers interrupted; estimated social costs from $4 billion
United States, southeastern to $10 billion; massive traffic jams in New York City (U.S.-Canada, 2004)
Canada
August 30, 2003 London Power to 410,000 customers interrupted by incorrect relay operation
September 18, 2003 Tidewater region, United States Power to 4 million customers interrupted
September 23, 2003 Denmark and Sweden Power to 4 million customers interrupted
August 24, 1992 Florida Power to 1 million customers interrupted
September 27, 2003 Italy Power to 57 million customers interrupted; at least 5 people died; 30,000
passengers stranded in trains for hours (BBC, 2003; CNN, 2003)
2004 Florida, Alabama Power to 5 million customers interrupted by Hurricanes Charley, Frances, Ivan,
and Jeanne over a 6-week period
2004 Kyushu, Japan Power to 1 million customers interrupted by typhoon
July 12, 2004 Southern Greece Voltage instability as a result of high power transfers into Greece; operator-
initiated load shedding unable to prevent voltage collapse; blackout a cause of
additional concern due to proximity to 2004 Olympic games
2005 Alabama, Florida, Louisiana, and Power to 2.2 million customers interrupted by Hurricane Katrina
Mississippi
2005 Moscow Power to 1.5 million to 2 million customers interrupted by explosion and fire at
substation
May 24, 2005 Moscow Power to 4 million customers (2,500 MW) interrupted
September 12, 2005 Los Angeles Large portion of city lost power because error in substation tripped several circuit
breakers
tive generators to trip off the system, or perhaps even cause In a few cases, such as in Baghdad, successful attacks
physical damage. With the instrumentation now deployed on have been mounted against generation plants. More often, as
power systems, it could be very difficult to detect and iden- in Colombia, efforts to attack generation have been prevented
tify the initiator of these events. In the now unlikely event by the high levels of security that can be provided for such
that they were to occur, competitively induced congestion, large concentrated targets. As a consequence, most of the
dynamic instabilities, or equipment disruptions could disrupt attacks that have occurred have been against transmission
the system and perhaps also render it more vulnerable to and distribution systems. These systems make more attrac-
compounding terrorist assault (DeMarco, 1998). tive targets because they are physically widely dispersed and
hence very vulnerable. Often facilities are located in remote
places, making them difficult if not impossible to defend
Precedents for Attacks on Power Systems
against explosions or bullets or other projectiles fired from
Although to date attacks on the U.S. power transmission a distance.
and distribution system have been limited to small-scale While there is a growing internationalization of some ter-
vandalism by a few individuals or small groups with limited rorist activity, most attacks in the past have been mounted
technical sophistication, elsewhere in the world the electric by indigenous groups bent on damaging or destabilizing
power system in general, and particularly the transmission established ruling power structures. For example, in the
and distribution system, have been a focus of considerable past the Irish Republican Army mounted bomb attacks on
terrorist activity. power substations in the United Kingdom. More recently
OCR for page 15
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 15
"Insider(s)" with substantial
Pernicious "hackers" who want to knowledge of the system
demonstrate their technical
knowledge and skill and don't
much care about, or even relish,
negative consequences.
Outsider(s)
Attacking the power system "Insider(s)" with substantial
Disgruntled individuals or groups because of some grudge against the knowledge of the system
who want to harm the power power company or as an act of simple
system but not kill a vandalism.
lot of people or cause wide
societal damage or harm. Attacking the power system for some Outsider(s)
symbolic reason (e.g. eco-terroists).
Individuals or small low-tech
groups with limited resources
who do want to kill a lot of
people or cause wide societal
damage or harm.
Power system is a secondary target
intended to compound the impact of a
Terrorist groups with significant major attack such as September 11, 2001.
capabilities and resources who
do want to kill a lot of people
or cause wide societal Power system is a primary target:
damage or harm. - in extreme weather
- shake public confidence (e.g., blackout) in
several major cities over and over again)
- impose major economic costs.
Knowledgeable employee of the attacked firm
assisting the attacking entity.
Participants in power markets
seeking a predatory Knowledgeable employee of the ISO or RTO
competitive economic assisting the attacking entity.
advantage by disrupting the
operations of other market
players. Knowledgeable outsider(s) working for or
assisting the attacking entity.
FIGURE 1.7 Simple classification of potential power system attackers.
in Columbia, FARC (Fuerzas Armadas Revolucionarias de ings, or radiological, chemical, or biological attacks, there
Colombia) has mounted hundreds of attacks on a monthly are enough examples of attacks elsewhere around the world,
FIGURE
basis against 1.7
transmission and distribution systems with the and enough plausible circumstance under which an attack
objective of diminishing the power and standing of the cen- might occur in the United States, to warrant serious attention
tral government authority and strengthening FARC's hand and careful planning and preparedness.
in any possible future political settlement. Twenty years The Department of Homeland Security (DHS) has devel-
previously, Sendero Luminoso mounted similar attacks in oped a range of worst-case terrorist attack scenarios for use
Peru. With the capture and imprisonment of almost all of in gaming, in consequence assessment and management,
the senior leadership of that organization, such attacks have and in supporting the development of detailed plans and
now largely ceased. response strategies (Lipton, 2005). Most of these scenarios
There have been frequent attacks on transmission and deal with weapons of mass destruction which would not be
distribution facilities in Iraq by insurgent groups intent particularly appropriate for attacks on the power systems,
on contributing to general social disruption, embarrassing and in particular on the transmission and distribution system.
central authorities, and preventing the normalization of Nevertheless, the power industry itself has conducted
daily life. scenario-based tabletop exercises to examine possible attack
Many such attacks have occurred across Asia. For scenarios and their consequences. These have included a
example, terrorist groups in Thailand have recently increased variety of exercises involving attacks against the transmis-
the size and numbers of their attacks against electric power sion and distribution system. Individual power companies,
facilities as part of a broader campaign to bring down the as well as reliability organizations and trade and research
central government in Bangkok. Many parts of Africa have organizations, have also conducted detailed power system
also witnessed such attacks. attack simulation studies and threat assessments in order to
Although in the United States attacking the power system identify vulnerable assets and to develop protective actions
may not be as attractive to serious terrorist groups as bomb- as well as response and recovery strategies.
OCR for page 16
16 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
IMPACTS OF WIDESPREAD, LONG-LASTING as gas prices have risen, often more rapidly than the price of
BLACKOUTS electricity (half of which is generated from coal), many gas
pipelines have begun to convert their compressor stations
Electricity is essential to the U.S. economy and to this
from gas to electricity -- thus creating a coupled vulnerabil-
country's way of life. Annual sales in 2006 were $326 bil-
ity between what were once two independent energy supply
lion, approximately the same size as telecommunications
systems. Similar coupling vulnerabilities can occur with oil
(DOE/EIA, 2007). Moreover, the value of electricity is far
delivery systems, communication systems, railways, and
greater than the price that consumers pay multiplied by the
other critical infrastructure.
amount they consume. Economists refer to this extra value
Power disruptions also put people out of work. For exam-
as "consumer surplus."
ple, Statistics Canada reported that "an estimated 2.4 million
Estimating the economic cost of large-scale or long-dura-
workers in Ontario and Gatineau, Quebec, lost 26.4 million
tion blackouts is difficult. The Wall Street Journal reported
hours of work time in the second half of August because
that the economic costs of the massive blackout that struck
of the [2003] Ontario-U.S. power outage and subsequent
the Midwest, the Northeast, and parts of Canada in August
conservation period."7
2003 could have been as high as $4 billion to $6 billion
Several models have been used to estimate the eco-
(Hilsenrath, 2003). North American Reliability Council
nomic impacts of hypothetical local and regional blackouts.
data indicate that the amount of power not delivered during
Greenberg et al. (2007) used a regional econometric model
that blackout was approximately 920,000 megawatt-hours
to examine the economic impacts of a variety of outage sce-
(MWh). Together, these two numbers suggest that the eco-
narios involving blackouts of one New Jersey utility (Public
nomic cost of the 2003 blackout came to approximately $5
Service Electric and Gas, PSE&G, which serves about half
per forgone kilowatt-hour,6 a figure that is roughly 50 times
the state) and estimated statewide impacts. The most severe
greater than the average retail cost of a kilowatt-hour in the
scenario studied involved the loss of 95 percent of power dur-
United States. However, many of the affected industries
ing the first day with 10 percent of power not restored until
appear to have made up for much of the lost output once
the end of the second month. Assuming the attack occurred
power was restored. In a disruption of longer duration and
in the summer of 2005, the worst case resulted in a loss of
greater geographic extent, a post-blackout rebound could be
3.4 percent of the gross state product during that year ($389
much more modest.
billion year in 2000 dollars) followed by a positive rebound
Lecomte et al. (1998) estimated that the 1998 ice storm
of 2 percent the following year. Since the simulated event is
that disrupted power to 1,673,000 customers, of whom
assumed to be localized, one of the more interesting issues
1,393,000 were in Quebec, resulted in economic losses of
explored is the extent to which businesses would choose to
$1.6 billion in Canada and $1 billion in repair costs to the
move to other regions thought to be less at risk of future
Hydro-Quebec and Ontario Hydro systems. A significant
attack.
fraction of the 28 deaths in Canada and 17 deaths in the
Despite the difficulty of producing precise numbers, it
United States also resulted from the lack of power.
is clear that blackouts of large scale or long duration can
Large-scale disruption caused by damage to the high-
easily result in economic costs of many billions of dollars.
voltage transmission system garners wide attention, but
Other infrastructure and services are also lost or are seriously
widespread damage in the distribution system, such as that
degraded, further disrupting the lives of people who find
caused by recent Florida and Gulf Coast hurricanes, can be
themselves in dangerous situations, without work, and with-
more expensive. Schuler (2005) notes that Florida Power
out conventional services such as operating bank machines
and Light incurred repair costs of $890 million from damage
and gas stations.
done by hurricanes in August and September of 2004, largely
A systematically designed and executed terrorist attack
to distribution systems, and estimates that "the societal costs
could cause disruptions considerably more widespread and
were probably even greater than those incurred in the 2003
of much longer duration than the largest power system dis-
Northeast blackout."
ruptions experienced to date. Since those disruptions have
Loss of power can have profound impacts on other criti-
entailed economic impacts approaching 10 billion dollars,
cal infrastructures, as illustrated in an analysis by Chang et
it appears possible that terrorist attacks could lead to costs
al. (2005) of a January 20, 1993, windstorm in the Pacific
of hundreds of billions of dollars--that is, perhaps as much
Northwest with documented impacts on emergency services,
as a few percent of the U.S. gross domestic product, which
transportation, health care, building support, the food supply,
is currently about $12.5 trillion. If large, extended outages
and government. Losses included 2.5 million customer-hours
were to occur during times of extreme weather, they could
of power outages disruptions for up to 3.5 days in some areas.
also result in hundreds or even thousands of deaths due to
In the past, the pumping stations on natural gas pipelines
heat stress or extended exposure to extreme cold.
were powered by the gas they were transporting. However,
6OTA (1990) estimated in 1990 that disruptions of similar duration would 7As cited at http://www.ontariotenants.ca/electricity/articles/2003/cp-
impose costs of $1 to $5 per kilowatt-hour. 03j31.phtml.
OCR for page 17
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 17
Even without intentional attacks, power systems are In the area of detection, several activities are ongoing,
always undergoing damage and recovery. While system such as:
owners and operators should do all that they reasonably can
to ensure that their systems are able to withstand anticipated · Training system operators to consider sabotage and
assaults from natural and human sources, there are practical terrorism as a possible explanation for disturbances,
limits to how much such systems can be "hardened" because · Implementing a real-time data collection process
of its highly distributed nature. The complete elimination of for reporting indicators of potential physical and
all possible modes of failure is simply not a feasible objec- cyber-events to DHS (such as the presence of strange
tive. Thus, even in the absence of threats from terrorists, vehicles and aircraft near critical facilities),
an important design objective should be resilience, i.e., the · Holding conferences sponsored by industry and
ability to rapidly restore the power system after a problem government, conducting dialogs, holding scheduled
occurs and the ability to sustain critical social services while conference calls, and exchanging security-related
the problem persists. alerts, brochures, and newsletters.
Restoration activities include:
ACTIONS TAKEN SO FAR TO REDUCE
VULNERABILITY
· Preparing contingency plans for restoring service,
The need to reduce the vulnerability of the U.S. electric · Stocking equipment needed for service restoration,
power system is well recognized in the government and · Cataloging and agreeing to share spare transformers
industry. Although related action has been somewhat slow following an attack.
and limited, many improvements made behind the scenes are
rarely reported in detail to the media. Reducing the vulner-
Actions by Government
ability of electric power systems is becoming a top priority
of utility management. In addition, the Energy Policy Act of The most relevant provision of EPAct is establishment of
2005 (EPAct) includes provisions to strengthen the system the Electric Reliability Organization to develop and enforce
and make temporary improvements permanent. Under autho- reliability standards for the bulk transmission system. Before
rization provided by EPAct, the North American Electric it was designated as the ERO in July 2006, NERC could only
Reliability Council (NERC) is now moving to improve U.S. recommend upgrades as needed to maintain reliability. Now,
electric power system performance through the creation of those standards will be mandatory, but they must also be
the national Electric Reliability Organization (ERO), which approved by FERC. NERC will base its standards in part on
has the authority to develop mandatory reliability standards. existing data and experience with past operating incidents.
EPAct also provides incentives for both expanding the trans- According to Section 236 of the ERO certification order:
mission system and removing barriers to siting transmission
lines, and it addresses the problem of relieving areas of NERC states that the purpose of a Reliability Standard, or
critical congestion on the transmission system. Improving its reliability objective, should derive from one or more of
the resilience of the transmission system to relatively routine the following eight general objectives: (1) the Bulk-Power
failures will also reduce vulnerability to deliberately caused System should be planned and operated to perform reliably
under normal and abnormal conditions; (2) the frequency
failures.
and voltage of the Bulk-Power System should be controlled
within defined limits by balancing real and reactive power
Actions by the Utility Industry supply and demand; (3) information necessary for the plan-
ning and operation of the Bulk-Power System should be
Actions by the utility industry to deal with terrorism made available to those who need it; (4) emergency op-
focus on prevention, detection, and restoration. Prevention erations plans should be developed and implemented; (5)
measures that the industry has implemented include: facilities for communication, monitoring, and control should
be provided, used and maintained; (6) personnel must be
· Self-determination of the proper alert level for physi- trained, qualified and must have the authority to implement
cal and cybersecurity in conjunction with the advice actions; (7) the reliability of the Bulk-Power System should
of the DHS, be monitored on a wide-area basis; and (8) the Bulk-Power
System must be protected from malicious physical or cyber
· Security improvements such as physical barriers and
attacks. (FERC, 2006)
an increased security workforce for protecting physi-
cal facilities, and
Only the last general objective directly addresses the
· More stringent security requirements for facility
potential for terrorist attacks. Basing NERC standards on
entry.
past experience will make it difficult to ensure that they pro-
tect against effects of terrorism, as there are no data on the
OCR for page 18
18 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM
nature or results of terrorist attacks on electric power systems · Although major terrorist organizations have not
in this country. Furthermore, NERC's intention to consider attacked the U.S. power delivery system, such ter-
costs as well as benefits may work against protection against rorist attacks have occurred elsewhere in the world.
extreme but unlikely risks that cannot be quantified, includ- Simply turning off the power typically does not ter-
ing terrorist attacks. Overall, however, establishment of an rorize people. However, the United States should not
ERO with real authority is a significant step forward. In ignore the possibility of an attack that turns off the
addition, EPAct includes measures that should encourage the power before staging a large conventional terrorist
construction of new transmission lines and the development event, thus amplifying the latter's consequences. Nor
of new technologies to improve the efficiency and reliability should the possibility of a series of attacks designed
of the power grid, steps that should also provide increased to do major damage to the economy and to the pub-
resistance to terrorist attacks. DOE's report On the Road to lic's sense of security and well-being be ignored.
Energy Security describes how it is carrying out its respon- · Economic costs from a carefully designed terrorist
sibilities under EPAct (DOE, 2006). attack on the U.S. power delivery system could be as
DHS's National Infrastructure Protection Plan (NIPP) high as hundreds of billions of dollars (i.e., perhaps
provides an overall approach to protecting critical infrastruc- as much as a few percent of U.S. gross domestic
ture, including electric power systems (DHS, 2006a). DHS's product).
analysis of terrorist capabilities and motivations suggests that · Both industry and government have begun to address
infrastructure could be a prime target, especially as protec- the risks of terrorism to the power delivery system,
tion is enhanced at other targets. The plan calls for (1) strong but there is much more that can and should be done.
public-private partnerships to foster relationships and facili-
tate coordination within and across critical infrastructure and
REFERENCES
key resource sectors; (2) robust multidirectional information
sharing that will enhance the ability to assess risks, make BBC. 2003. "Italy Launches Blackout Inquiry." BBC news online. Septem-
ber 30, 2003. Available at http://news.bbc.co.uk/2/hi/europe/3150788.
prudent security investments, and take protective action; and
stm. Accessed August 2007.
(3) a risk management framework establishing processes for Chang, S.E., T.L. McDaniels, and D. Reed. 2005. "Mitigation of Extreme
combining consequence, vulnerability, and threat informa- Event Risks: Electric Power Outage and Infrastructure Failure Interac-
tion to produce a comprehensive, systematic, and rational tions." Pp. 7090 in The Economic Impacts of Terrorist Attacks, H.W.
assessment of national or sector risk. Not addressed in the Richardson, P. Gordon, and J.E. Morre II, eds. Northampton, Mass.:
Edward Elgar Publishing.
NIPP, however, is the issue of how private entities can be
CNN. 2003. "Italy Recovering from Big Blackout." CNN. Sept. 28, 2003.
expected to assume the large costs required to make the Available at http://www.cnn.com/2003/WORLD/europe/09/28/italy.
system more robust against low-probability events. blackout/index.html. Accessed August 2007.
DHS's revised National Response Plan, a broad, com- DeMarco, C.L. 1998. "Design of Predatory Generation Control in Electric
prehensive plan for preparing for a wide range of emergen- Power Systems." Pp. 3238 in Thirty-First Annual Hawaii International
Conference on System Sciences, Vol. 3. New York: IEEE.
cies, also addresses critical infrastructure, including electric
DHS (Department of Homeland Security). 2006a. National Infrastructure
power systems (DHS, 2006b). Protection Plan. Available at http://www.dhs.gov/dhspublic/interapp/
editorial/editorial_0827.xml. Accessed September 2006.
DHS. 2006b. National Response Plan. Available at http://www.dhs.gov/
CONCLUSIONS xprepresp/committees/editorial_0566.shtm. Accessed October 2006.
DOE (U.S. Department of Energy). 2006. On the Road to Energy Security:
· By their very nature, electric power transmission
Implementing a Comprehensive Energy Strategy: A Status Report. Avail-
and distribution systems are not perfectly reliable. able at http://www.energy.gov/media/FINAL_8-14_DOE_booklet_
Keeping power flowing to customers is a continuous copy_sep.pdf. Accessed September 2006.
process of control, recovery, and repair. Most out- DOE/EIA (Energy Information Administration). 2007. Revenue from Re-
ages involve only the distribution system. However, tail Sales of Electricity to Ultimate Customers by Sector, by Provider .
Available at http://www.eia.doe.gov/cneaf/electricity/epa/epat7p3.html.
occasionally storms, accidents, or other events cause
Accessed October 2007.
disruption of the high-voltage transmission system. DOE/FERC (Federal Energy Regulatory Commission). 1978. The Con
Power systems are designed and operated to cope Edison Power Failure of July 13 and 14, 1977. Washington, D.C.: U.S.
with such disturbances and to restore service as rap- Government Printing Office.
idly as possible. EPRI (Electric Power Research Institute). 2003. Distribution Reliability
Indices Tracking Within the United States. Report No. 1008459. Palo
· Well-planned attacks on the power system, under-
Alto, Calif.: EPRI.
taken by informed terrorists, could result in power FERC. 2006. Order Certifying North American Electric Reliability Cor-
outages with extents and durations that are much poration as the Electric Reliability Organization and Ordering Compli-
larger than those produced by all but the largest ance Filing. Available at ftp://www.nerc.com/pub/sys/all_updl/docs/
natural events. Damage to critical, difficult-to-replace ferc/20060720_ERO_certification.pdf. Accessed September 2006.
system components could be extensive, making res-
toration of power slow and extremely difficult.
OCR for page 19
THE ELECTRIC TRANSMISSION AND DISTRIBUTION SYSTEM AS A TERRORIST TARGET 19
Greenberg, M., N. Mantell, M. Lahr, N. Felder, and R. Zimmerman. 2007. Rose, A., S-Y Liao, and G. Oladosu. 2005. "Regional Economic Impacts
"Short and Intermediate Economic Impacts of a Terrorist Initiated Loss of Terrorist Attacks on the Electric Power System of Los Angeles: A
of Electric Power: Case Study of New Jersey." Energy Policy 35(1): Computable General Disequilibrium Analysis." Paper presented at the
722733. Second Annual Symposium of the DHS Center for Risk and Economic
Hilsenrath, J. 2003. "The 2003 Blackout: Economy Won't Likely Be Analysis of Terrorism Events, University of Southern California, Los
Derailed--Cost Could Hit $6 Billion as Major Sectors Are Hurt; a Few Angeles, Calif., August 20.
Reaped Benefits." Wall Street Journal, August 18. Roy, A., and P. Pentayya. 2004. "Experience of Blackouts and Restoration
Lecomte, E.L., with A.W. Pang and J.W. Russell. 1998. Ice Storm '98, ICLR Practices in the Western Region of India." Slides presented at the IEEE
Research Paper Series No. 1. Institute for Catastrophic Loss Reduction, Power Engineering Society General Meeting, Denver, Colo., July.
Toronto, Canada. Available at www.iclr.org/pdf/icestorm98_english.pdf. Schuler, R.E. 2005. "Float Together/Sink Together? The Effect of Con-
Accessed August 2007. nectivity on Power Systems." Pp. 91118 in The Economic Impacts of
Lipton, E. 2005. "U.S. Report Lists Possibilities for Terrorist Attacks and Terrorist Attacks, H.W. Richardson, P. Gordon, and J.E. Morre II, eds.
Likely Toll." New York Times, March 16. Northampton, Mass.: Edward Elgar Publishing.
Meade, C., and R.C. Molander. 2006. "Considering the Effects of a Cata- U.S.-Canada (U.S.-Canada Power System Outage Task Force). 2004. Fi-
strophic Terrorist Attack." RAND Technical Report. Available at www. nal Report on the August 14, 2003 Blackout in the United States and
rand.org/pubs/technical_reports/TR391/. Accessed August 2007. Canada: Causes and Recommendations. Available at http://www2.
Mueller, J. 2006. "Is There Still a Terrorist Threat?" Foreign Affairs 85(5): nrcan.gc.ca/es/erb/erb/english/View.asp?x=690&oid=1221. Accessed
28. August 2007.
NRC (National Research Council). 2002. Making the Nation Safer: The USFPC (U.S. Federal Power Commission). 1965. Northeast Power Fail-
Role of Science and Technology in Countering Terrorism. Washington, ure: November 9 and 10, 1965. Washington, D.C.: U.S. Government
D.C.: The National Academies Press. Printing Office.
OTA (Office of Technology Assessment). 1990. Physical Vulnerability of WSCC (Western Systems Coordination Council) Operations Committee.
Electric System to Natural Disasters and Sabotage. OTA-E-453. Wash- 1996. Western Systems Coordinating Council Disturbance Report .
ington, D.C.: U.S. Government Printing Office. Butte, Mont.: WSCC.
Rose, A., and S-Y Liao. 2005. "Modeling Regional Economic Resilience to
Disasters: A Computable General Equilibrium Analysis of Water Service
Disruptions." Journal of Regional Science 45(1): 75112.
