Report says spies compromised US electric grid

April 8, 2009 - Jordan Robertson - The Associated Press

SAN JOSE - Spies hacked into the U.S. electric grid and left behind computer programs that would let them disrupt service, exposing potentially catastrophic vulnerabilities in key pieces of national infrastructure, a former U.S. government official said Wednesday.

The intrusions were discovered after electric companies gave the government permission to audit their systems, the ex-official said. The official was not authorized to discuss the matter and spoke to The Associated Press on condition of anonymity.

The inspections of the electric grid were triggered by fears over a March 2007 video from the Idaho National Laboratory, which had staged a demonstration of what damage hackers could do if they seized control of a crucial part of the electric grid. The video showed a power turbine spinning out of control until it became a smoking hulk and shut down.

Although the resulting audits turned up evidence of spying sometime earlier, the former official told the AP that the extent of the problem is unknown, because the government does not have blanket authority to examine other electric systems.

"The vulnerability may be bigger than we think," the official said, adding that the level of sophistication necessary to pull off such intrusions is so high that it is "almost without a doubt" done by state sponsors.

The Wall Street Journal, which reported the intrusions earlier, said officials believe the spies have not yet sought to damage the nation's electric grid, but that they likely would try in a war or another crisis.

Chinese and Russian officials have denied involvement in hacks on U.S. systems.

The malicious programs were probably purged immediately from the utilities' networks after their discovery.

Intrusions are generally much harder to detect than to clean up, though purging malicious programs from mission-critical systems poses a special challenge, since computers often have to be running around the clock and can't be shut down to be scrubbed clean. If that's the case, proper backups need to be in place to make sure an infection is fully neutralized.

The attacks highlight serious problems that utilities like power and water companies face as they add more technologies for remotely managing their facilities. Any system networked to the rest of the world - from financial systems to university records to retail operations - can leave openings for hackers.

Homeland Security spokeswoman Amy Kudwa said her department is "not aware of any disruptions to the power grid caused by deliberate cyber activity here in the United States." Even so, congressional investigators and intelligence officials have warned that electric utilities are vulnerable to cyber attacks, and utilities acknowledge that their computer networks are routinely under assault.

CIA analyst Tom Donahue told utility engineers at a conference last year that in other countries, hackers had broken into electric utilities and demanded payments before disrupting power - in one case turning off the lights in multiple cities.

The power grid is becoming a bigger target for hackers as more pieces of it are connected to each other or, in some cases, to the Internet.

Employees who work remotely can be a major point of weakness. If their computers can be compromised, hackers can begin working backward into a utility's central control system. One way that's done is by so-called "spear phishing," or trying to fool people into opening personalized e-mails that have malicious programs inside them. Malicious Web applications can be another route for hackers.

"The severity of what we're seeing is off the charts," said Tom Kellermann, vice president of security awareness for Core Security Technologies and a member of the Commission on Cyber Security that is advising President Barack Obama. "Most of the critical infrastructure in the U.S. has been penetrated to the root by state actors."

Joe Weiss, a security expert who has testified before Congress about such threats, said the industry has failed to address these vulnerabilities.

"The human resources computer system in a utility happens to be more cyber-secure than any power plant or electric substation that we have," said Weiss, managing partner of Applied Control Solutions, a company based in Cupertino, Calif. "The fundamental problem is that we're paying more attention to the cybersecurity of Facebook than we are to trying to keep our lights on."

He said the long-term ramifications of such an attack would be severe: If electrical equipment were destroyed, power could be lost for six to nine months, because the replacement gear would take so long to manufacture.

Power grid operators acknowledged Wednesday that they have been the target of frequent computer attacks and said they are working closely with authorities to lock down their networks.

James Fama, the Edison Electric Institute's executive director of energy delivery, said in a statement that "protecting the electrical grid and keeping the power flowing is our industry's top priority."

Members of Congress and government agencies have sought to increase oversight of the industry. A bipartisan bill introduced last week in Congress would let the president declare a "cybersecurity emergency" if necessary and shut down Internet traffic to a compromised piece of critical infrastructure such as the power grid.

Securing power systems against cyber attacks might get even more complicated with the development of so-called "smart grids." Smarter grids are being built to make electricity delivery far more efficient, saving precious resources. But they require the extension of two-way digital communications down to "smart meters" at homes and new digital sensors to track real-time power usage. Extra nodes on a network can become new openings for spies.

"The more you push communications, intelligence (across the grid) ... you're adding some level of risk," said Brian Seal, a senior project manager involved in power delivery at the Electric Power Research Institute, an industry-sponsored research group.

Kudwa, the Homeland Security spokeswoman, said the government is "working to ensure that security is built in as we develop the next generation of smart grid networks."

And Seal noted that smart grids will give the power transmission system greater resilience and flexibility to reduce the impact of a disruptive event - such as a cyber attack.

Eileen Sullivan reported from Washington. Associated Press Writers David Nowak in Moscow, Mark Williams in Columbus, Ohio, and H. Josef Hebert in Washington contributed to this report.