8

Strategies for Securing Crucial Services and Critical Infrastructure in the Event of an Extended Power Outage

As discussed in Chapters 6 and 7, there are many things that can and should be done to make the nation’s electric power transmission and distribution systems more robust in the face of natural disruptions, equipment failures, or terrorist attacks. However, given the enormous complexity of the electric power system, and the fact that so much of the system is spread, unprotected, across large geographic areas, there is simply no way it can be made completely impervious to harm from natural disasters, system failures, or terrorist threats.

THE NEED FOR PLANNING FOR OUTAGES

Modern society and the digital economy have become ever more dependent on the continuous availability of electric power. For more and more applications, the need is not just for power, but for stable, highly reliable, high-quality power.1 Many organizations with especially critical needs for electric power have already made arrangements for alternate sources of generation including power-conditioning equipment and backup power supplies. These organizations range from major hospitals, most of which now have regularly tested backup generators that can power critical systems in operating rooms and critical care facilities,2 to financial institutions that must protect vital records and financial transaction data, to process industries that must keep production facilities, such as microelectronic fabrication lines or chemical plants, energized. In addition, virtually all critical air navigation systems and most of the backbone of major communication systems are highly dependent on high-quality uninterruptible power. Accordingly, most are now also protected by backup power supplies.

Yet many organizations that provide vital social services such as water, food, fuel, and communications remain vulnerable to both short- and long-term power interruptions. Indeed, some have become even more vulnerable with the widespread use of computer technology. For example, years ago telephones received their power over the same lines that carried the voice signals. In ordinary situations, an interruption of telephone service for a few hours or even a few days is an inconvenience. However, in an extended interruption of telephone and communication services during a major disaster, whether it is a terrorist attack or a natural disaster such as that experienced after Hurricane Katrina, lives may be lost if the public is unable to call 911, or if other emergency communications are disrupted.

There are many other situations in which electricity is required in order for basic services to function. These services include operating traffic signals to ensure the smooth flow of traffic in dense urban cores, pumps in the systems that provide potable water supplies and sanitary sewer systems, and compressors in natural gas supply systems that may be the fuel source for backup power systems or commercial and residential heating and/or air conditioning systems. The importance of functioning heating and cooling systems is forcefully demonstrated by the deaths that occurred from prolonged exposure to cold in the aftermath of the 1998 ice storm in Quebec, and from prolonged exposure to heat in the aftermath of Hurricane Katrina.

Under Homeland Security Presidential Directives HSPD-5 and HSPD-7, the President of the United States charged the Department of Homeland Security (DHS) with developing and implementing plans to create a framework through which the plans and activities of the federal government, state and local governments, the private sector, and nongovernmental entities could be aligned for the purpose of identifying critical infrastructure priorities and developing strategies to protect and restore critical infrastructure and preserve pub-

_____________________

1“Stable” means, among other things, that the value of both voltage and frequency are maintained within tight margins. “high quality” means that the AC voltage and current wave forms are clean sinusoids with no significant harmonics, spikes, or similar short-term disruptions that can create havoc for modern electronics.

2Note, however, that during the Northeast blackout of August 2003, some of these hospital backup systems failed to operate, reinforcing the importance of regular testing and maintenance.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 82
8 Strategies for Securing Crucial Services and Critical Infrastructure in the Event of an Extended Power Outage As discussed in Chapters 6 and 7, there are many things high-quality uninterruptible power. Accordingly, most are that can and should be done to make the nation's electric now also protected by backup power supplies. power transmission and distribution systems more robust in Yet many organizations that provide vital social services the face of natural disruptions, equipment failures, or terror- such as water, food, fuel, and communications remain vul- ist attacks. However, given the enormous complexity of the nerable to both short- and long-term power interruptions. electric power system, and the fact that so much of the system Indeed, some have become even more vulnerable with the is spread, unprotected, across large geographic areas, there is widespread use of computer technology. For example, years simply no way it can be made completely impervious to harm ago telephones received their power over the same lines that from natural disasters, system failures, or terrorist threats. carried the voice signals. In ordinary situations, an interrup- tion of telephone service for a few hours or even a few days is an inconvenience. However, in an extended interruption THE NEED FOR PLANNING FOR OUTAGES of telephone and communication services during a major Modern society and the digital economy have become disaster, whether it is a terrorist attack or a natural disaster ever more dependent on the continuous availability of elec- such as that experienced after Hurricane Katrina, lives may tric power. For more and more applications, the need is not be lost if the public is unable to call 911, or if other emer- just for power, but for stable, highly reliable, high-quality gency communications are disrupted. power.1 Many organizations with especially critical needs There are many other situations in which electricity is for electric power have already made arrangements for required in order for basic services to function. These ser- alternate sources of generation including power-conditioning vices include operating traffic signals to ensure the smooth equipment and backup power supplies. These organiza- flow of traffic in dense urban cores, pumps in the systems that tions range from major hospitals, most of which now have provide potable water supplies and sanitary sewer systems, regularly tested backup generators that can power critical and compressors in natural gas supply systems that may be systems in operating rooms and critical care facilities,2 to the fuel source for backup power systems or commercial financial institutions that must protect vital records and and residential heating and/or air conditioning systems. The financial transaction data, to process industries that must importance of functioning heating and cooling systems is keep production facilities, such as microelectronic fabrica- forcefully demonstrated by the deaths that occurred from tion lines or chemical plants, energized. In addition, virtually prolonged exposure to cold in the aftermath of the 1998 ice all critical air navigation systems and most of the backbone storm in Quebec, and from prolonged exposure to heat in the of major communication systems are highly dependent on aftermath of Hurricane Katrina. Under Homeland Security Presidential Directives HSPD-5 and HSPD-7, the President of the United States charged the 1"Stable" Department of Homeland Security (DHS) with developing means, among other things, that the value of both voltage and frequency are maintained within tight margins. "High quality" means that and implementing plans to create a framework through which the AC voltage and current wave forms are clean sinusoids with no sig- the plans and activities of the federal government, state and nificant harmonics, spikes, or similar short-term disruptions that can create local governments, the private sector, and nongovernmen- havoc for modern electronics. tal entities could be aligned for the purpose of identifying 2Note, however, that during the Northeast blackout of August 2003, critical infrastructure priorities and developing strategies to some of these hospital backup systems failed to operate, reinforcing the importance of regular testing and maintenance. protect and restore critical infrastructure and preserve pub- 82

OCR for page 82
STRATEGIES FOR SECURING CRUCIAL SERVICES AND CRITICAL INFRASTRUCTURE 83 lic health and safety. In response to these directives, DHS for such lights.4 In a press release announcing that program developed and released the National Incident Management in 2002, Energy Commissioner Robert Pernell noted: System, National Response Plan, and National Infrastructure Protection Plan. Together these documents create a frame- When electric power fails and signal lights go out at a busy work to facilitate government and private sector interaction corner, traffic slows to a crawl. . . . Automobile accidents to establish national priorities, goals, and requirements for increase, and pedestrians find that weaving their way through homeland security and critical infrastructure protection. the unregulated maze can be a dangerous, challenging pros- pect. But now local governments can protect critical intersec- In addition, these plans provide a framework for multi- tions from power interruptions that can threaten motorists jurisdictional and cross-sector interaction to address inter- and pedestrians alike. dependencies of critical infrastructure and key resources to ensure that federal funding and resources are applied in the Promoting such solutions on a comprehensive basis will most effective and efficient manner. require greater coordination and planning. For example, in an The enormity and complexity of identifying security vul- extended blackout, it would probably not be necessary that nerabilities, prioritizing actions, and developing executable all gas stations or cash machines have backup generators to plans at the local, regional, or national level should not be run their pumps or dispense cash, nor would it likely be cost- underestimated; nor should the challenge of aligning private effective for them to do so. Yet, private or public arrange- sector business priorities with the national security and ments could be made to ensure that at least some facilities public health and safety priorities of governments.3 These are so equipped and the public is informed about where to challenges extend well beyond the scope of this study and find them. Similarly, many water and sewer systems, or rapid have yet to be comprehensively addressed. However, having transit systems, may not find it cost-effective to install dedi- noted the more general problem, the remainder of this chap- cated backup systems. However, over time and with careful ter focuses specifically on the near- and long-term strategies planning, as local utilities need to add peaking capacity, it for securing crucial services and critical infrastructure in might be possible to locate small generating facilities so that the event of an extended power outage and provides recom- if and when the grid goes down, power can continue to be mendations on assessing and implementing these strategies. supplied to pumps or allow trains to get to stations (perhaps only a few at a time). STRATEGIES FOR SECURING CRUCIAL SERVICES Note, too, that some minimum provision of some of these services is essential to restoring the power system--service Assessing and Mitigating Vulnerabilities trucks have to be able to get through and be fueled, crews need communications, and, in some circumstances, may also In 2005, at the request of the state of Pennsylvania, inves- need police protection. Utilities have viewed ensuring access tigators at the Carnegie Mellon Electricity Industry Center to such services as an important part of their contingency undertook an assessment of the nature and extent of critical plans (see Chapter 7). However, to date most have not been social services in Pennsylvania that would be disrupted by proactive with respect to issues such as siting peaking plants power outages of a few hours to several weeks (PA DEP, close to critical loads so that, if necessary, they could be run 2005). Table 8.1 shows a slightly modified version of the independently of the grid. Nor have most worked with states taxonomy developed by that study. The study determined that and local communities to address other power needs in the with technology available today, and with careful foresight, event of a complete loss of power from conventional sources. many social vulnerabilities could be eliminated at modest In the future, if issues of critical services become more cost. For example, the study found that while conventional salient, some utilities may choose to voluntarily undertake traffic lights have electromechanical controllers and lamps initiatives to reduce the vulnerability of critical services in that require over 100 watts, modern LED traffic lamps the absence of power from the grid. However, it is probably require less than a tenth as much power and can be operated best that they maintain their primary focus on sustaining, or on solid-state controllers. Systems like this, equipped with rapidly restoring, conventional service. trickle charge battery backup, are now commercially avail- Few states and cities have conducted systematic studies to able. Indeed, several such systems that had been installed assess their vulnerabilities and develop cooperative public- in Ohio continued to operate during the August 14, 2003, private plans to reduce them. Clearly, it would be wise for Northeast blackout. The California Energy Commission has states and cities, especially those that are assessed to be par- set up a program to help pay the incremental costs of backup ticularly vulnerable (Willis et al., 2005), to undertake such studies and to involve key players from private sector service 3For example, when power and telecommunications were operated as providers, trade associations, and public agencies. Box 8.1 regulated utilities, it was relatively easy for government to request a specific summarizes an exercise conducted by various departments change (such as moving a switching center to a less vulnerable location) as the costs could simply be added to the "rate base." Today, with the introduc- tion of competition across much (but not all) of the power system, "social- 4See www.energy.ca.gov/releases/2002_releases/2002-05-20_backups. izing" such added costs becomes a great deal more difficult. html.

OCR for page 82
84 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM TABLE 8.1 Examples of Critical Social Services That Depend on the Availability of Electric Power Service Category Specific Service Typical Existing Backup Resulting Vulnerabilities Emergency Services 911 and related dispatch centers Most have comprehensive backup power See classified version. systems. Fuel supply and reliability could be an issue in long outages. Police headquarters and station houses Varies. Some stations do not have backup. AC See classified version. power is often required for recharging hand- held radios. Fire protection services Same as above. See classified version. Emergency medical services Same as above. See classified version. Hazardous materials response teams Same as above. See classified version. Medical services Ambulance and other medical transport Limited. See classified version. services Life-critical in-hospital care (such as Full backup in most major facilities, but See classified version. emergency rooms, life support systems, some failed during the blackout of August 14, operating rooms) 2003. Some systems have inadequate testing procedures. Fuel supply and reliability could be an issue in long outages. Less-critical in-hospital services Availability of backup varies. Many smaller See classified version. (refrigeration, heating and cooling, facilities lack backup. sanitation, etc.) Clinics and pharmacies Many have no backup. See classified version. Nursing homes Same as above. See classified version. Communications and Radio broadcast media Major stations have backup systems with See classified version. cyber services several days of fuel on hand. Television broadcast media Many stations have backup power systems with See classified version. several days of fuel. Cable television and broadband services Minimal backup. Conventional telephone Conventional phone systems have backup See classified version. power systems that can power switches and conventional phones. However, many modern head-sets and PBX systems require power to operate and do not have backup. Wireless (cellular) telephone and data Modest backup. Battery backup typically See classified version. systems provides only 28 hours of service. Wired data service Many backbone systems have backup. Most local systems do not. Computer services (on and off premise) Many large data centers typically have good See classified version. backups with several days of fuel on hand and priority fuel contracts. On-site typically limited to several minutes. Water and sewer Water supply Limited backup. Most systems require pumping See classified version. in treatment plants. Many systems also require pumping for delivery. Sewer systems Very limited backup. Many systems require pumps for collection. Most require power for treatment.

OCR for page 82
STRATEGIES FOR SECURING CRUCIAL SERVICES AND CRITICAL INFRASTRUCTURE 85 TABLE 8.1 Continued Service Category Specific Service Typical Existing Backup Resulting Vulnerabilities Food Retail groceries (cash registers, lighting, Backup varies with location, local power See classified version. refrigeration, security) reliability, and firm preferences. Wholesale grocery and distribution Same as above. networks Food production facilities (farms, animal Same as above. See classified version. facilities, processing, packaging, etc.) Financial Cash machines Typically no backup. See classified version. Credit card systems Little or no backup at most retail outlets. Most See classified version. central credit facilities do have backup. If communications systems also go down, then credit checking is not possible. Banks Little or no backup at smaller banks except for See classified version. security systems. Fuel Bulk fuel delivery Backup varies. Some natural gas pipe lines are See classified version. now using electric pumps. Some barge and port operations could be disrupted. Local storage infrastructure Backup varies. Some locations can switch from See classified version. pump to gravity feed. Retail gasoline sales Most have no backup. See classified version. Non-emergency Information service offices Same as above. See classified version. government services Operations units Many have no backup. See classified version. Prisons and other detention facilities Many have some backup but may not be able to See classified version. operate for extended periods. Schools Most have no backup. See classified version. Transportation systems Traffic lights With few exception, no backup (although the See classified version. Transportation and mobility technology is commercially available). Tunnels In many cases no backup for ventilation. In See classified version. some cases lighting has limited battery backup. Light rail systems and subways Typically no backup except short-term See classified version. emergency lighting. Conventional rail systems, including Grade crossings have backup batteries. Backup See classified version. railroad crossings for system operations is uneven. Air traffic control, navigation, landing FAA rules require backup power systems for all See classified version. aids, and airport operations and services. flight-critical systems. However, many terminal operations (such as ramp movement) have no backup. River lock and dam operations Probably partial backup but specifics are See classified version. unclear. Buses Backup depends on system. Many have ability See classified version. to fuel buses without off-site power. Drawbridge operations Probably partial backup but specifics are See classified version. unclear. continued

OCR for page 82
86 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM TABLE 8.1 Continued Service Category Specific Service Typical Existing Backup Resulting Vulnerabilities Lighting Building evacuation and stairwell Battery-operated emergency lighting (only lasts See classified version. lighting a few hours) is required by building codes. Residential lighting In most cases only backup is flashlights, See classified version. candles, lanterns. Indoor commercial and industrial Backup is minimal in most buildings. See classified version. lighting Security lighting Varies, but if there is backup it is typically See classified version. short-lived batteries. Street lighting Typically no backup. See classified version. Building operations Building elevators Backup varies with local building codes, height See classified version. (other than lighting) and age of building. Space heating and cooling Backup is minimal in most buildings. See classified version. NOTE: Some of these services, such as 911, emergency medical services, and en-route air traffic control, already have substantial backup. Many others, such as water and sewer systems, gas pumps, and cash machines, currently have no provisions for backup. SOURCE: This table is a modified and elaborated presentation that is based on a taxonomy developed by researchers at Carnegie Mellon for the state of Pennsylvania (PA DEP, 2005). at Carnegie Mellon University to assess options for sustain- in the event of an extended blackout. Political leaders need ing the city of Pittsburgh's vital services if grid power is not to analyze the data security and privacy protection laws of available. their agencies with an eye to minimizing and overcoming The importance of the private sector in the event of a obstacles that can impede local and regional planning, as well terrorist attack cannot be overstated. Most major electricity as determine how interagency communication will function and communications infrastructure facilities are in private in a national or more localized emergency. hands, and their workers will necessarily function as first responders. Critical health care, transportation, banking, and Improving the Reliability of Services fuel supply facilities are also mostly privately owned. Col- laborative advance planning with such entities is absolutely Obviously, planning costs and resources, as well as fed- necessary to ensure consideration of all contingencies. For eral grants to the private sector or to local and state agen- example, a hospital administrator may know that he or she cies, may be necessary to fund risk assessments and risk can plan for 24 hours of on-site generation, but for longer mitigation and restoration plans. Whether in the form of periods of time, fuel supplies will be needed to keep the grants, incentive regulations, or tax- or fee-based subsidies, hospital functioning. Having plans in advance for prioritizing action needs to be taken to ensure that the private sector first who gets scarce fuel supplies will reduce chaos and add to the responders undertake planning and restoration exercises. resilience of a given community in responding to a disaster. Again, the Pennsylvania study (PA DEP, 2005) suggested Public policy and legal barriers to collaborative planning a variety of options that state or local governments might also need to be addressed. Significantly, the Pennsylvania pursue, in appropriate circumstances, to encourage or require study found a lack of transparency and trust across various private parties to improve the reliability of important social levels of governments. For example, when, at the request of services. The report's suggestions include (PA DEP, 2005, the Pennsylvania Department of Environmental Protection pp. 91-92): (DEP), the Carnegie Mellon Electricity Industry Center con- ducted its study for the state of Pennsylvania (PA DEP, 2005), Provide information and suggestions to private parties neither investigators at Carnegie Mellon nor senior officials to help them see how they might benefit from strategies in the DEP were able to obtain critical data from the State that would make the services they provide more robust in Office of Emergency Preparedness or the U.S. Army Corps the face of power outages. For example, once they think about it, a multistory retirement home that installs back- of Engineers on topics such as whether the locks through up power for its elevator might find that advertising this which barges carrying diesel fuel into the state did or did not fact provides it with a comparative advantage. have backup power and would be able to continue to operate

OCR for page 82
STRATEGIES FOR SECURING CRUCIAL SERVICES AND CRITICAL INFRASTRUCTURE 87 BOX 8.1 The Pittsburgh Study To develop specific data on sustaining services if the electric grid fails, the Carnegie Mellon Electricity Industry Center assigned the students in a 2004 engineering project course run jointly by the Carnegie Mellon University Department of Engineering and Public Policy, the H. John Heinz III School of Public Policy and Management, and the Department of Social and Decision Sciences the task of assessing options for sustaining Pittsburgh's vital services if grid power is not available. The team of 20 undergraduates, two Ph.D. students, and four faculty members was assisted by a review panel with members from Duquesne Light Company, Allegheny Energy, the Pittsburgh Emergency Management Agency, Pittsburgh Department of City Planning, Pittsburgh Police, Dominion Peoples Gas, Pittsburgh Water and Sewer Authority, Pittsburgh International Airport, and the University of Pittsburgh Medical Center. Additional information was provided by PNC, Citizens Bank, Chevron, Guttman Oil, the Allegheny County Airport Authority, and the Allegheny County Sanitary Authority. Since some of the data when compiled could potentially be misused, the following summary has been approved for public distribution. Potentially critical services were classified into the following categories: (1) emergency services, (2) private services, (3) utilities, and (4) ground and air transportation. Three reference blackout events were determined for which the robustness of each service was evaluated. The reference events were designed to vary in duration and size of the affected area. The diesel fuel supply available in Pittsburgh and the interactions between the services under different blackout scenarios were assessed. While some important services, such as hospitals and 911 emergency response, have taken measures to ensure that service will continue during a blackout, there are several vital services (e.g., police zone stations and traffic control) that are highly sensitive to electricity outages. Results from the assessment conducted include the following: 1. Three of the five Pittsburgh police zone stations were found not to have backup generation installed on site. 2. Important private services (e.g., grocery stores, gas stations, and cellular phone service) are vulnerable. Although the social benefits from keeping these services running during an outage are large, these benefits are dispersed among individuals, whereas the capital costs are concentrated in the hands of the service provider. There is little incentive for the private service providers to change. 3.Traffic networks are vulnerable, as all traffic lights would fail during a blackout. Tunnel ventilation fans would also become inoperable. Installing LED lights with backup batteries would reduce congestion in the event of a blackout and save money for the city in terms of annual electricity and maintenance costs. Backups for fans in heavily used tunnels were found to have a positive benefit-cost value. 4.Liquid fuel pipelines and storage tanks rely on electricity to pump fuel and generally have no backup. Some fuel can be released from storage tanks via gravity flow, but the switch over from pump to gravity flow can be time consuming. 5. An outage during extreme hot or cold weather could have significant health and economic impacts. If the outage occurs during very cold weather, forced-air heaters and auto-pilot boilers would fail; during hot weather, air conditioners would fail. In either event, some people could be at risk, and it is important to ensure that emergency shelters would be available and that information regarding such emergency services is disseminated through an effective information campaign. In addition to health effects, an extended outage during the winter could cause pipes in homes to freeze, putting even more stress on emergency management personnel. While some plans do exist for handling such emergencies, it is important that such plans be regularly reviewed and updated to ensure that the region is well prepared for an extended power outage. 6.The natural gas system is highly reliable, possibly more so than the diesel supply chain. Although natural gas generators are typically more expensive than diesel, natural-gas-powered backup might be an option worth considering for high-value services, especially if the generators are used to produce electricity and heat during normal operating conditions. 7. While air traffic control is fully backed up and the Pittsburgh International Airport has substantial backup, the latter is not sufficient to operate the ramps at gates. This would introduce significant delays that could then propagate through other parts of the system. SOURCE: Sustaining Pittsburgh's Vital Service when the Power Goes Out, Report of a Student Project Course, Department of Engineering and Public Policy , Carnegie Mellon University, 2004, 108 pp. This is a sensitive document with limited circulation. A summary version is available at www.andrew.cmu.edu/ user/phines/pdfs/executive_summary_when_the_power_goes_out.pdf.

OCR for page 82
88 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM Encourage firms to offer "preferred customer" services dollars per intersection over the cost of an LED conver- that assure continued availability of services to those sion without back-up, but this may be justified for critical customers who have paid a fee which allows the compa- urban corridors. nies to make the necessary additional investments. For Offer selective state subsidy programs, or lobby for the example, customers of some fuel companies are now creation of selective Federal subsidy programs, to cover offered preferential delivery positions during emergen- just the incremental cost of making systems more robust. cies in exchange for a fee. The Commonwealth of Penn- To continue with the traffic light example above, such a sylvania may be able to create a supportive environment program might cover only the trickle-charge battery back- for preferential service agreements in other industries up portion of the costs of conversion. Since this would by increasing the awareness of potential blackouts. dramatically improve the access of emergency vehicles Entities such as gas stations have no incentive to install during power blackouts, it might be a program that the emergency power systems unless they are permitted to DHS should support. Federal funding already exists for recover their cost through surcharges during emergencies. emergency power for air navigation. Restricted funds Such surcharges would be in the public interest, and the may be available from the DHS for increased security, the Commonwealth should consider studying whether barri- Airport Trust Fund for hub and reliever airports, and the ers exist to fostering back-up power installations funded Highway Trust Fund for tunnels. Use of state and local through peak charges. general tax revenue may be justified for survivable mis- Require organizations to post public information on the sions, such as police precinct back-up power. Water and presence or absence of back-up or other solutions to keep sewer system back-up should be studied as systems are specific services such as elevators or gasoline pumps run- repaired and upgraded. A formal investigation of funding ning in the event of a power disruption. In much the same sources such as these is warranted. way that the publication of EPA's toxic release inventory has induced many companies to cut emissions, such post- One issue that the Pennsylvania report does not address is ings might induce companies to take steps to make their the range of actions that individuals can take to reduce their critical services more robust. own vulnerabilities. These include such simple precautions Make changes in building codes and other legal require- as stocking basic supplies such as extra batteries and storing ments for business practice. For example, a decade ago a supply of drinking water (as well as understanding that Pittsburgh adopted a building code that requires eleva- tors in newly constructed buildings of more than seven hot water heaters contain such a supply); owning hand crank stories to have back-up power. Similarly, a community radios and cell-phone chargers; stocking fuel for camp stoves could require, as a condition of doing business, that firms and portable generators, and so on. While a few citizens, par- operating gasoline pumps, ATM machines, or similar de- ticularly in rural areas, have long taken such actions, many vices must work together to arrange that some percentage more would be wise to do so. Local governments could do of them will remain operational in the event of a power much to raise citizen awareness of the value of such precau- outage. tionary preparation. Provide tax incentives, subsidies, or grant programs The United States and its political subdivisions vary to support the development of needed facilities. Given greatly in terms of demographics, political culture, geogra- limited resources, this option should be used sparingly, phy, and attractiveness as a terrorist target. For that reason, no but there might be some circumstances, such as certain one strategy can be expected to meet the needs of all regions upgrades in the emergency rooms of private hospitals, that warrant modest assistance. or all situations. However, the committee believes that the Pass laws or change regulations to facilitate the construc- need to do systematic public and private planning applies tion, interconnection, and operation of distributed genera- to every community. The committee also believes that the tion systems, and the operation of competitive micro-grid very fact that communities have prevention and restoration systems. plans for critical services and infrastructure could serve as a deterrent to terrorist attack. The Pennsylvania study also suggested the following Many studies have looked at the potential reliability options, which might be pursued to encourage or require benefits of distributed generation resources and micro-grids public and nonprofit parties to improve the reliability of (Galvin Electricity Initiative, 2006; King, 2006; Lovins important social services (PA DEP, 2005, pp. 92-93): and Lovins, 1982; Zerriffi, 2004; Zerriffi et al., 2005). The stochastic simulations conducted by Zerriffi suggest that Provide information and suggestions to local govern- massive use of distributed resources can achieve reliability ments and non-profit organizations, such as hospitals, improvements over conventional power system architectures to help them see how they might benefit from strategies of several orders of magnitude. However, the regional reli- that would make the services they provide more robust ability benefits that could be achieved with more modest use in the face of power outages. For example, LED traffic of distributed resources are less clear. To achieve full benefits lights require far less power than conventional traffic from such systems, changes would need to be made in the lights. Cities and towns could be encouraged to covert to LED systems and add trickle charge battery back-up. standards and operating strategies of distribution systems, Such systems have capital expenses of several thousand which, because they lack intelligent real-time control, typi-

OCR for page 82
STRATEGIES FOR SECURING CRUCIAL SERVICES AND CRITICAL INFRASTRUCTURE 89 cally now require that all distributed resources disconnect ments should be developed to facilitate access to such from distribution feeders the moment any problems develop. information that is held by government parties.6 The discussion in Chapter 9 identifies current and near-term Because some investments for better preparedness technological improvements that should be assessed in these for extended blackouts are very much in the public planning exercises. For outages of longer duration, the com- interest but may not meet the more limited investment mittee believes that local governments should consider how criteria of private firms or local municipalities, fed- the alternatives of distributed generation, portable genera- eral authorities could consider offering tax breaks or tion, and load prioritization might be employed. selected subsidies for the incremental costs of some In its deliberations, the committee tried to determine the protective systems. For example, although munici- available surge capacity for portable generation. Caterpillar palities may choose to convert from conventional Inc. has a variety of portable diesel and gas-fired generator traffic lights to LED lights because of the substantial sets that can be mobilized rapidly. For example, these sys- energy and cost savings that can result, they may not tems were installed in Lower Manhattan in the aftermath of be willing to invest in trickle charge battery backup. the attacks on September 11. However, global demand for A federal program, similar to the program developed such generation sets is large, and manufacturing is currently by the California Energy Commission that covered running at or near capacity. Thus, in the event of an outage of the incremental cost of trickle charge battery backup very wide extent and duration, the demand for large portable for traffic lights along key arteries in dense urban power sources could easily exceed supply. The committee cores, could be useful in this regard, as could a was unable to determine the status of planning for surge program that would help provide for more extended capacity for large backup power sources, for example the use backup of critically located cell towers. of naval or civilian ships as temporary sources of power for coastal cites if conversion equipment is available. Similarly, FINDINGS AND RECOMMENDATIONS diesel electric locomotives5 might be temporarily pressed into emergency service as sources of electric power. The process of assessing risks, prioritizing crucial services and critical infrastructure, aligning interests, and securing the cooperation of public and private sector stakeholders is an The Importance of Federal Leadership enormous and challenging task. Since an extended power Potential initiatives at the federal level to reduce social outage could be local, regional, or involve multiple regions, vulnerability in the face of extended loss of electric power leadership at the federal level is crucial to the development include the following: of flexible and effective plans to address a broad range of possible scenarios. Hence, the conclusions and recommenda- DHS could develop, and then publicly disseminate, tions in this chapter emphasize the need for this leadership a set of strategies and technologies that public and and the close coordination of all levels of government with private organizations and individuals might adopt the private sector to develop robust plans for meeting local in order to make critical social services of the sort and national crucial services in the event of an extended outlined in Table 8.1 less vulnerable in the event of power outage or substantial reduction of grid power. regional power outages of varying durations. Such an advisory document would be especially valuable Finding if it contained specific "best practice" examples and associated cost estimates as well as illustrations of Finding 8.1 Even if all reasonable steps are taken to ensure how market forces might be harnessed or incentives the reliability of the electric power transmission and distribu- might be structured to encourage private initiatives tion system, and to speed its rapid restoration after outages, that reduce vulnerability. there is no way that it can be made completely reliable in Congress could provide resources and other incen- the face of major disruption by natural causes or large, tives to encourage states and cities to form public- well-planned, terrorist attacks. For this reason, and because private task forces to assess the vulnerability of their modern society is increasingly dependent on electric power vital social services to disruptions in electric power for the provision of critical social services, steps should be of varying duration. In order to do this, legal arrange- taken to ensure that the most important of these services (see ments would have to be made to protect sensitive information, and legal and administrative arrange- 6For example, the Census Bureau has arrangements under which serious researchers can gain access to detailed census track data, although it is very 5The committee learned from a discussion with a representative of Burl- sensitive, by providing training and then making those researchers sworn ington Northern Santa Fe that it does have conversion kits that can allow DC census officers who are legally bound to conform to certain rules to protect diesel electric locomotives to be used as 60 Hz AC power sources. However, sensitive data. To the committee's knowledge, neither DHS nor any state as one might expect, the number of such kits is quite limited, at least within homeland security organization has developed equivalent arrangements to Burlington Northern Santa Fe. facilitate access to data they hold.

OCR for page 82
90 TERRORISM AND THE ELECTRIC POWER DELIVERY SYSTEM Table 8.1) can continue to be sustained if power from the handling long-term outages. Political leaders of the jurisdic- grid is not available. tions involved should analyze the data security and privacy protection laws of their agencies with an eye to easing obstacles to collective planning and to facilitating smooth Recommendations communication in a national or more localized emergency. Recommendation 8.1 The Department of Homeland Security and/or the Department of Energy should initiate Recommendation 8.6 DHS should perform, or assist other and fund several model demonstration assessments each at federal agencies to perform, additional systematic assess- the level of cities, counties, and states. These assessments ment of the vulnerability of national infrastructure such as should examine systematically the region's vulnerability to telecommunications and air traffic control in the face of extended power outages and develop cost-effective strategies extended and widespread loss of electric power, and then that can be adopted to reduce or, over time, eliminate such develop and implement strategies to reduce or eliminate vul- vulnerabilities. These model assessments should involve all nerabilities. Part of this work should include an assessment relevant public and private participants, including public of the available surge capacity for large mobile generation and private parties providing law enforcement, water, gas, sources. Such an assessment should include an examina- sewerage, health care, communications, transportation, fuel tion of the feasibility of utilizing alternative sources of supply, banking, and food supply. These assessments should temporary power generation to meet emergency generation include a consideration of outages of long duration (> sev- requirements (as identified by state, territorial, and local eral weeks) and large geographic extent (over several states) governments, the private sector, and nongovernmental orga- since such outages would require a response different from nizations) in the event of a large-scale power outage of long those needed to deal with shorter-duration events (hours to duration. Such assessment should also include an examina- a few days). tion of equipment availability, sources of power generation (mobile truck-mounted generators, naval and commercial Recommendation 8.2 Building on the results of these ships, power barges, locomotives, and so on), transporta- model assessments, DHS should develop, test, and dissemi- tion logistics, and system interconnection. When areas of nate guidelines and tools to assist cities, counties, states, and potential shortages have been identified, plans should be regions to conduct their own assessments and develop plans developed and implemented to take corrective action and to reduce their vulnerabilities to extended power outages. develop needed resource inventories, stockpiles, and mobi- DHS should also develop guidance for individuals to help lization plans. them understand steps they can take to better prepare for and reduce their vulnerability in the event of extended blackouts. On a longer time scale, urban planners could include the potential for blackouts and other security issues in their Recommendation 8.3 State and local regions should use the activities. tools provided by DHS as discussed in Recommendation 8.2 to undertake assessments of regional and local vulnerability REFERENCES to long-term outages, develop plans to collaboratively imple- ment key strategies to reduce vulnerability, and assist private Galvin Electricity Initiative. 2006. Available at http://www.galvinpower.org/ resources/listall.php?sct=14. sector parties and individuals to identify steps they can take King, D.E. 2006. "Electric Power Micro-grids: Opportunities and Chal- to reduce their vulnerabilities. lenges for an Emerging Distributed Energy Architecture." Ph.D. Thesis. Department of Engineering and Public Policy, Carnegie Mellon Univer- Recommendation 8.4 Congress, DHS, and the states should sity, Pittsburgh, Pa. provide resources and incentives to cover incremental costs Lovins, A.B., and L.H. Lovins. 1982. Brittle Power: Energy Strategy for National Security. Andover, Mass.: Brick House Pub. Co. associated with private and public sector risk prevention PA DEP (Pennsylvania Department of Environmental Protection). 2005. and mitigation efforts to reduce the societal impact of an Critical Electric Power Issues in Pennsylvania: Transmission, Distrib- extended grid outage. Such incentives could include incre- uted Generation and Continuing Services when the Grid Fails. Report mental funding for those aspects of systems that provide a prepared for the PA DEP by the Carnegie Mellon Electricity Industry public good but little private benefit, R&D support for new Center, Carnegie Mellon University, Pittsburgh, Pa., February. Willis, H.H., A.R. Morral, T.K. Kelly, and J.J. Medby. 2005. Estimating and emerging technology that will enhance the resiliency and Terrorism Risk. Arlington, Va.: RAND Center for Terrorism Risk Man- restoration of the grid, and the development and implementa- agement Policy. tion of building codes or ordinances that require alternate or Zerriffi, H. 2004. "Electric Power Systems Under Stress: An Evaluation of backup sources of electric power for key facilities. Centralized Versus Distributed System Architectures." Ph.D. Thesis. Department of Engineering and Public Policy, Carnegie Mellon Uni- versity, Pittsburgh, Pa. Recommendation 8.5 Federal and state agencies should Zerriffi, H., H. Dowlatabadi, and A. Farrell. 2005. "Incorporating Stress identify legal barriers to data access, communications, in Electric Power Systems Reliability Models." Energy Policy 35(1): and collaborative planning that could impede appropriate 6175. regional and local assessment and contingency planning for