Several major U.S. utilities are under constant cyberattack and havent taken precautions to protect critical systems from Iran, North Korea and other adversaries, according to a congressional survey of more than 100 companies accounting for much of the nations power system.The survey shows the nations electrical grid remains highly vulnerable to attack after four years of failed efforts to pass major cyber-security legislation, according to an accompanying report. Industry trade groups, including the Edison Electric Institute, joined by Republicans in the Senate, opposed the bill, arguing minimum cyber-security standards would be out-of-date by the time they were implemented.
Our enemies have the motive, the means, and the capacity to attack our grid with potentially catastrophic consequences, Representative Ed Markey, the Massachusetts Democrat who co-wrote the report released yesterday, said in an e-mail. The question is whether the utilities have the same determination to protect our country against these threats.
Power utilities are part of a core of critical infrastructure that U.S. intelligence agencies are warning may be targets of aggressive cyberattacks designed to cloak the East Coast in darkness or shut off the sewers in New York City during a future conflict.
Survey Questions
The report, whose other author, California Democratic Representative Henry Waxman, is the ranking member of the House Energy and Commerce Committee, is based on a 15-question survey sent to 170 electric utilities, includingExelon Corp. (EXC),Southern Co. (SO)andDuke Energy Corp. (DUK)
Theres no confirmed example of a massive infrastructure attack, and the survey was designed in part to identify whether cyber warriors are trying to breach sensitive systems or utilities know of smaller-scale attacks that might show adversaries are practicing.
In many cases, utilities simply didnt answer the questions posed by the lawmakers. Of the companies that received the letter, more than two-thirds either didnt respond at all or gave minimal responses, according to the lawmakers report.
Among those that did respond, several described a running battle to keep ahead of the hackers.
One Midwestern utility said that its computer systems were being probed constantly, in some cases by automated programs designed to detect weaknesses that can be exploited later. A utility in the Northeast reported that it was under constant attack from cyber criminals.
More than a dozen utilities reported either daily, constant or frequent attempts at computer intrusions.
Corporate Systems
The answers didnt give details on the nature of the attackers or whether they were attempting to gain access to corporate systems or the industrial computers that actually run the plants.
The reports authors found evidence that some utilities collaborated or simply cut-and-pasted answers provided by trade groups rather than addressing their unique situations.
Four small utilities in Florida and Texas gave almost identical answers to the majority of the questions, according to an analysis by the Democrats staff. Others borrowed heavily from a coaching guide produced by the North American Electric Reliability Corp., or NERC, a private body that helps regulate the industry, according to the lawmakers staff.
If you cant respond to a letter, Im guessing that you probably cant respond to a cyberattack either, said Jacob Olcott, a former cyber-security staffer for the Senate Commerce Committee, which helped draft the omnibus cyber-security bill that failed last year.
Utilities Reluctance
The reticence of some utilities reflects their reluctance to divulge even to lawmakers details of security concerns or potential vulnerabilities, the American Public Power Association said in a response to the report, which it called misleading.
Many questions were so specific and confidential in nature that for security reasons, they could not be answered, the group said.
In some cases, the utilities answers suggested they had a poor grasp of the system for alerting them to cyber-security threats or missed many of the alerts altogether, the reports authors said. Asked how many grid security alerts they had received from NERC since January 2010, the companies gave answers that ranged from one to 50. In fact, 24 alerts had been issued during that period.
Bug Fixes
Several utilities said that they failed to fix bugs in control systems and other technology that had been identified after a sophisticated attack software called Stuxnet sabotaged Irans uranium processing facility at Natanz in 2010. Stuxnet is widely believed to have been designed by hackers working for the U.S. and Israeli governments in an effort to disable the site.
The flaws used by the software are now widely known, and three years ago officials recommended 12 measures to ensure adversaries couldnt deploy a repurposed version of Stuxnet against U.S. infrastructure.
Four of 45 utilities who responded to the survey hadnt implemented the mandatory measures and 15 of 19 utilities hadnt instituted several other measures which were voluntary, according to the survey answers.
By Bloomberg
The Iran Project is not responsible for the content of quoted articles.
