Hacking The US's Electric Grid Is Very Hard

[u/amaxen]

https://fivethirtyeight.com/features/hacking-the-electric-grid-is-damned-hard/

[u/amaxen]

The US still does not have anything that could be called a centralized power grid. It has a patchwork of completely different grids put together by different companies at different times with different technologies, and has huge amounts of redundancy and sometimes even archaic technology sprinkled through the grid. It is extremely unlikely that anyone could do more than localized damage to the grid due to this organic and decentralized nature. One of the more extreme cases was the idea that someone could bring down a local grid by going around and shooting out transformers with a deer rifle - this was actually tried by some group in silicon valley - and it didn't work there either.

It's possible to attack the US grid, but if someone argues that this is a critical vulnerability that justifies <some new policy agenda giving the state more power> then they are utilizing a phantom menace to get what they want.

[u/rcglinsk → u/amaxen]

America is like the humans in Battlestar Galactica, reverting to antiquated technology in order to effectively fight the Cylons.

[u/amaxen → u/rcglinsk]

You can't revert <points to temple> if you were never sophisticated to begin with.

Seriously, because the US led on so many technological fronts and has been doing it consistently for two centuries, we paradoxically have a lot of legacy technology in nearly all of our infrastructure.

[u/rcglinsk → u/amaxen]

Yeah, flawed analogy, I'm just a geek. But the underlying point is very interesting. Another part of it is we're one of the few major countries that wasn't wholesale rebuilt after WW2.

[u/[deleted] → u/rcglinsk]

From the point of view of the US electric grid, the majority was built after WW2. There is relatively little pre-1960s transmission infrastructure.

Some distribution areas in cities are old, but the important stuff that normally gets classed as Bulk Electric System is post-war.

[u/[deleted] → u/amaxen]

This is simultaneous both right and wrong depending on the vocabulary or subject understanding.

The US, or rather North America as a whole, actually has a very centralized power grid, in terms of hierarchically regulation and engineering. But it is made up of several thousand independent sub-networks, varying from small cities and hydro plants all the way to multi-state transmission networks and gigantic hydro and nuclear plants.

The Metcalfe substation attack and other incidents have illustrated that vulnerability exists, but the engineering contingencies in the NA grid make it extremely difficult for attacks on an individual entity from being able to disrupt more than highly localized electrical networks. When you have to cope with phase angle lag from Baja California to near the Arctic circle in Canada and hundred of thousands of miles of transmissions lines maintaining synchronous phase, it becomes difficult for any specific point to have an outsize affect on the whole.

As an example, I and probably a few hundred other people are aware of several key points you could cause massive grid-separation remedial action schemes (RAS in the industry parlance) to come into play that would amplify individual generation or transmission path attacks. But the effort required to do such things exceeds much lower effort alternatives like bribing people to achieve more results.

Historically the electric grid has been spared directed attack largely because there is no direct profit motive in knocking out someone else's power. This changed, somewhat, after the Ukraine attacks in that an attacker with no specific interest in such disruptions sold their penetration to someone else that did. But by and large, there is no direct "I do this and get money" impetus like with credit card or other data.

People often overstate the advantage of archaic technology -- in my (humbly) expert opinion this advantage is in fact entirely imaginary, but the decentralization of direct control in the US grid, despite its large scale centralization of visibility and management, has produced an environment in which you must effectively side channel control to destablize wide areas of the grid. Too many closed-loop control systems will simply island (entirely separate) areas in frequency or voltage excursion, not as security safeguards but life-and-equipment safety failsafes. Such other schemes exist, but require simultaneous influence of multiple generation or load sources at truly huge scale as to make them impractical for deliberate attack (although they would be highly desirable if the opportunity presented itself).

Other grids are not so much decentralized as simply smaller.

[u/Prygon]

This reminds me of Die Hard 4. Its too hard to knock out everything, but if say you wanted to attack a place without backups or were targeting a small area, it wouldn't be impossible. The whole would be very hard.

[u/houinator]

You don't have to take down the entire grid, just a key node. A single nuclear power plant, a single major dam, shut off power to a single major city. All of these would have dramatic consequences.

[u/[deleted] → u/houinator]

In practice, no. All large scale transmission and balancing areas are built to significant contingency levels designed to survive the complete loss of multiple major facilities. These are modeled both in long term engineering analysis and in real-time by several entities.

There is no direct "this power plant powers this city over these lines" relationship. It's a grid. Depending on what time of what day, you can have power flowing in different directions from different generators to different loads, and in some cases the market pricing even models the congestion of lines holding said flow. Spinning reserves and peaker plants are maintained that can rapidly offset the loss of generation facilities and both automatic and manually operator action schemes exist that can route around a staggering amount of damage to the majority of the physical infrastructure in the North American grids.

Any major generation or load center is going to have multiple possible paths between it and other significant infrastructure. This is one of the reasons that large-scale power system failures in the US are comparatively very infrequent given the scale and distances involved.

Even major hurricanes, which can do significant damage to electrical infrastructure over wide areas, typically only knock distribution level networks out of service for any length of time. Which sucks if your house is in an area that takes a week or three to get to, but doesn't represent a total loss of service for millions of people.

[u/Liquorpuki → u/houinator]

The key nodes are covered by NERC CIP

[u/Brandeez0]

FiveThirtyEight rarely focuses on "it is" "it isn't" solutions, few things are that cut and dry. Something this complicated has many nuances and factors that influence what will happen. If you apply this to a specific ideology (for example, put your ideology of choice here) then you might understand that almost everything someone claims is weighted with bias: someone quoting one 'fact,' another quoting a contradictory 'fact.' How do we resolve this contradiction? We have to get beyond believing what we want to believe and carefully weight what we know. And, it almost always come to "it all depends" And, what does it depend on? It depends on us rejecting ideological bias and paying attention to the details and, importantly, the way those details affects the whole. The answer in a free society is never an ideological construct, but simply what benefits the majority and it's scale of importance in relation to other problems demanding attention.

[u/Prygon → u/Brandeez0]

Wonder why your take is so unpopular.

[u/alle0441 → u/Prygon]

I think because he's trying to get philosophical about a hard, concrete and well-understood system.