After Paris, new worries over electrical grid attack

The potential for a devastating attack on the U.S. electricity grid remains high on the minds of utility and government leaders, especially in light of the deadly terrorist actions in Paris on Nov. 13.

Just days after the carnage in the French capital, the North American Electric Reliability Corporation (NERC) conducted a massive exercise simulating coordinated assaults on the grid in the U.S., Canada and Mexcio, one that involved cyber and physical attacks that left millions of people without electricity for an extended period of time.

The scheduling of the Nov. 18-19 grid-security exercise was coincidental; it had been in the works for months.

But Gerry Cauley, the president and chief executive of NERC, said the attacks on restaurants and a concert hall in Paris "heightened awareness" of the risks facing the grid and other infrastructure, including the potential for "explosive devices and shootings" bringing down power plants, substations and transmission lines.

"Those are part of our exercise in a general sense, and we're very much aware of and sensitive to that," Cauley said during a briefing for reporters in the midst of the drill.

The threat is hardly new. Earlier this year, a USA TODAY investigation of cyber and physical attacks on the U.S. grid over several years found that incidents occur about once every four days.

Records: Energy Department struck by cyber attacks

Bracing for a big power grid attack: 'One is too many'

"There are many serious hazards and threats facing the electric sector, and these threats continue to evolve," Liz Sherwood-Randall, the U.S. deputy secretary of energy, told reporters.

"In general, we are never satisfied with our current state," added Tom Fanning, the chairman, president and chief executive of Southern Company. "We know that as the threat changes, we've got to get better, even if we believe we're pretty good right now."

The latest test by NERC, the third of its kind since 2011, included cyberattacks on utility systems that control the generation and transmission of electricity, as well as physical attacks that left vital equipment inoperable, all of which required "a protracted period of time to recover," said Cauley, whose nonprofit agency develops and enforces reliability standards for the grid in the U.S., Canada and part of Mexico.

More than 350 utilities, government agencies and other organizations as well as 10,000 or so people participated in the so-called GridEx III.

"The event is really challenging," Cauley said of the drill. "It pushes us to our limits. It is not intended to be an easy win, but rather to evaluate what we need to learn and improve on, and what capabilities we need to add."

The earlier two tests led to new procedures for protecting the grid against incursions, including improvements in communications, inventories of critical replacement parts, and preservation of evidence and other forensic information.

The utility industry and the government also continue to sort through physical assaults, such as one involving a Pacific Gas & Electric substation in California's Silicon Valley in 2013. In that instance, unknown attackers cut six underground fiber-optic lines before firing more than 100 rounds of ammunition at the substation's transformers, causing more than $15 million in damage.

Following the attack, the Federal Energy Regulatory Commission directed the industry to prepare new rules for physical security.

While the incidents in Paris didn't involve electricity infrastructure, Fanning said he and other utility executives were talking to government officials as soon as they learned of the events in Paris of Nov. 13.

"I can tell you I was on the phone with a variety of people (at the U.S. Energy and Homeland Security departments), and throughout the weekend, the government was all over this," said Fanning, who chairs the Electricity Sub-Sector Coordinating Council, a group of 30 utility executives that consults with federal officials regarding dangers to the grid.

As for the latest tests, Cauley said NERC plans to issue a report suitable for public release "in the next couple of months."

"The likelihood of all these scenario attacks occurring at the same time in reality is very low," Cauley said. "But (the simulation) takes the grid beyond its normal operating thresholds to allow industry the opportunity to deal with a worst-case situation during the exercise."

Bill Loveless — @bill_loveless on Twitter — is a veteran energy journalist and television commentator in Washington. He is a former host of the TV program Platts Energy Week.