Group 2 Scenario, Fall 2017
Period -1 (6 hours before event)
Hackers are constantly targeting the U.S. power grid, especially after the Great North-Eastern blackout of 2003, which leads to the Energy Policy Act of 2005 [1], but despite repeated studies and proposed legislation, Little has been done to harden the US power grid against attack. “Admiral Michael Rogers, director of the National Security Agency, testified before the U.S. Congress that China and a few other countries likely had the capability to shut down the U.S. power grid” (Council on Foreign Relations, 2017). Without warning, hackers of unknown origin could trigger a power surge cyber-bomb within the firewall targeting the power grid in the Southeast US: Alabama, Georgia, Florida, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee, Maryland, Virginia, and West Virginia, affecting the nation’s largest power grid, leaving more than 40 million people without power, and causing a huge number of casualties. This kind of cyber-attack could severely harm the United States economy, society, and political system.
The Department of Energy (DOE) had developed a shared assistance program that would kick in during major power disruptions. The Electricity Subsector Coordinating Council (ESCC) has established a playbook (crisis management framework) to coordinate efforts to facilitate preparing for and responding to national-level disasters or threats to critical infrastructure. “ESCC is taking action on issues in three main areas: facilitating coordination with the government and other critical infrastructure sectors; improving information sharing capabilities, tools, and technologies; and enhancing resilience, response, and recovery efforts” (electricity subsector, 2017). The National Cybersecurity and Communications Integration Center (NCCIC) monitors cyber activity around the clock. The North American Electric Reliability Corporation (NERC) has trained representatives to intervene as quickly as possible when required to identify any malicious software. Many training sessions are conducted throughout the year to focus and test capabilities of federal, state, and local emergency mangers to deal with cyber-attacks, such as FEMA Region III (FEMA, May 2017), and Cyber Guard (DOD/NSA, June 2016).
GIS location analytics are effectively used during the planning and preparedness stage to locate areas such as hospitals, trauma facilities, assisted living facilities, chemical manufacturers and similar facilities that rely on refrigeration to stabilize dangerous substances, and other facilities similarly vulnerable to power outages, to document their readiness--what generator backups they have, their fuel requirements, etc. GIS databases also locate evacuation routes and help equip them with backup power to traffic lights. Replacement equipment (e.g. transformers) are set aside at strategic locations identified through GIS location analytics in preparation for the kind of large scale grid damage, such as would be experienced in a cyber-attack to accelerate power recovery for critical facilities.
(Cyber-attack preparation, 2017)
Period 1 (first 6 hours after event)
Monday, 23rd July 2019 at 9:20 pm. Lights flicker in the Carolinas, Georgia, and Florida and throughout the southeast states. Transformers everywhere explode into flames, and Supervisory Control and Data Acquisition (SCADA) and other control devices are destroyed, causing a blackout across the entire South-Eastern US. People everywhere, in homes, stores, restaurants, high rise buildings, streets, and hospitals are plunged into darkness. Computers and broadband Internet service are unavailable. Gas stations can’t pump fuel. Cellular services are quickly overloaded with emergency distress calls and families and friends checking on one another’s’ safety. Without warning, unidentified hackers have penetrated the Southeast US power grid, triggering a ‘logic bomb’ previously planted to cause a power surge that knocks out electricity for more than 50 million people.
A series of procedures is set in motion, as described by the ESCC playbook (crisis management framework), that helps the energy companies, federal, state, and local organizations to establish communications, so that utility Incident Command Systems and government agencies can effectively start coordinating the response and recovery effort. The NCCIC studies and identifies the attack, while NERC representatives start communications with the utility industry to identify the hacker’s software as quickly as possible. These cyber defense efforts by the NCCIC and NERC are guided by geospatial applications that help visualize the geography of global communications and IT networks to isolate the spread of malicious software and remove it from the system, before it spreads to other segments of the national power grid.
States Blockout (Wikimedia, 2017)
Period 2 (second 6 hours after event)
Loss of street and traffic lights causes transportation to come to a standstill, while widespread public panic causes spontaneous evacuation, further contributing to transportation gridlock. Multiple fires caused by exploding transformers, people trapped in elevators, building evacuations, traffic accidents and other emergencies engage first responders. Backup generators come online to support critical facilities, where they are available, but where hospitals and care facilities are without generator power, patients must be evacuated. Emergency management facilities without generators are rendered ‘blind’ without electricity to support IT and communications resources.
As the situation develops, situational awareness in the form of identifying locations both of available resources and areas of need would be an appropriate application for GIS support. A map application laying out locations of critical facilities, including the current state of those facilities (e.g. generator supported or without power), and matching resource availability to immediate needs (e.g. identifying trauma facilities still in operation to which ambulances can deliver injured) would be an important first step. The same application would directly support the response by mapping EOC and other EM facilities still in operation so that the response effort could be efficiently redistributed to generator-supported facilities. Recovering the EM capabilities for response in this way would be the first order of business. This might be an area for pre-planning of system resiliency by, for example, establishing cloud-based GIS resources and other measures designed to protect against loss of critical EM resources to such a massive power outage.
Traffic in Times Square during a massive power outage on August 14th, 2003. (AP Photo/Gregory Bull, 2017)
Period 3 (third 6 hours after event)
Public panic continues to grow, but as first responders get the immediate situation under control, resources are deployed to quell the panic and provide for immediate needs. Cities are divided into smaller divisions (three blocks), and first responder teams are assigned to start moving house-to-house, evacuating and aiding individuals with clean water and medications, using cellphone mapping applications to guide the effort.
Meanwhile, utility companies across the country mobilize for mutual assistance, and the remaining operational EOCs must plan logistics for mutual assistance resources. Given the scope of damage to power distribution infrastructure, it can be assumed power recovery will take considerable time. Under these circumstances, keeping generators supporting critical facilities, with life-saving/threatening responsibilities, supplied with fuel to continue operation is paramount. Likewise, supporting first responder access and mobility across the transportation system is equally important. Between the loss of traffic control devices, spontaneous mass evacuation from the area, and the attendant vehicular accidents, routing of fuel tankers and emergency vehicles would be critical.
A GIS application for identifying and tracking transportation blockages and congestion and routing around them, as well as routing emergency vehicles and tow trucks to clear critical routes and junctions, could address the needs of emergency response during this period and going forward. The application could include real-time reporting from social media sources, and remote sensing imagery, both aerial and satellite, for situation awareness, converting this data into network analysis barriers and impedances for analyzing and recommending routes to first responders.
Period 4 (after 18 hours)
Mutual assistance crews from the Northeast, Midwest, and Central South start to roll into the Southeast, but are impeded by increasing transportation gridlock. Local Damage Assessment teams are also impeded by transportation gridlock, and location and assessment of damage slows to a crawl. Local recovery crews are largely confined to staging areas due to lack of knowledge about damage locations and equipment recovery requirements. NCCIC, and NERC engineers have identified the software, and used government-developed tools to eliminate the cyber threat. GIS systems at operational EOCs help relocate EOC resources, and establish shelters to which power can be supplied.
As recovery of the power grid kicks in to high gear, the advanced routing capabilities mentioned above would need to be integrated with workforce management systems to manage and track individual damage assessment (DA) teams and work crews, and to efficiently convert damage reports into accurate work orders and specialized crew dispatch. These systems must pick up where Outage Management Systems (OMSs) and Asset Management Systems leave off, geo-enabling asset information and OMS damage detection to efficiently guide the DA teams to the most likely areas of need, bundling prospective damage sites into optimal routes for dispatching the teams. Once there, geospatial mobile apps assist DA teams in locating and documenting the damage, including replacement equipment and skill requirements, preferably with capabilities to record images/video, or even for remote expert assistance via smart glasses or similar technology. Similarly, assessed damage needs to be converted into work orders and dispatched through a map-enabled work management system that can track crew availability, assign work orders to the nearest available crews, provide the crews with routing instructions, and tracking work performance to know when each crew is available again.
Dragonfly’s activities (Symantec, 2017)
Cyber-attack workflow (Business, Data Security and Protection, malware, security, Technology, viruses, 30 Aug, 2017, 2017)
References:
AP Photo/Gregory Bull (2017). Traffic in Times Square during a massive power outage on August 14th, 2003.. [image] Available at: https://www.irishtimes.com/business/financial-services/city-war-games-the-ultimate-cyber-attack-on-east-coast-us-1.2958494 [2] [Accessed 3 Oct. 2017].
Business, Data Security and Protection, malware, security, Technology, viruses, 30 Aug, 2017 (2017). cyber-attack workflow. [image] Available at: http://www.northstarbusinessessentials.com/nist-security-framework/ [3] [Accessed 3 Oct. 2017].
Council on Foreign Relations. (2017). A Cyberattack on the U.S. Power Grid. [online] Available at: https://www.cfr.org/report/cyberattack-us-power-grid [4] [Accessed 1 Oct. 2017].
Cyber-attack preparation. (2017). [image] Available at: http://www.americatalks.com/news/trump-orders-preparation-for-electric-grid-cyber-attacks/ [5] [Accessed 3 Oct. 2017].
Ed Goings , KPMG (2017). Protecting against external attacks doesn’t reduce the risk of internal breaches, which can be just as damaging. [image] Available at: https://www.forbes.com/sites/kpmg/2017/05/24/a-rapid-response-weapon-against-cyber-attacks/#601581f15544 [6] [Accessed 3 Oct. 2017].
electricity subsector. (2017). ESCC. [online] Available at: http://www.electricitysubsector.org/ESCCInitiatives.pdf [7] [Accessed 2 Oct. 2017].
Symantec (2017). Dragonfly’s activities. [image] Available at: https://www.hackread.com/hackers-have-reportedly-infiltrated-the-us-power-grids [8] [Accessed 3 Oct. 2017].
Wikimedia (2017). blockout. [image] Available at: http://www.offthegridnews.com/grid-threats/new-report-us-power-grid-attacked-every-4-days-nationwide-blackout-more-likely-than-we-thought [9] [Accessed 3 Oct. 2017].
Links
[1] https://en.wikipedia.org/wiki/Energy_Policy_Act_of_2005
[2] https://www.irishtimes.com/business/financial-services/city-war-games-the-ultimate-cyber-attack-on-east-coast-us-1.2958494
[3] http://www.northstarbusinessessentials.com/nist-security-framework/
[4] https://www.cfr.org/report/cyberattack-us-power-grid
[5] http://www.americatalks.com/news/trump-orders-preparation-for-electric-grid-cyber-attacks/
[6] https://www.forbes.com/sites/kpmg/2017/05/24/a-rapid-response-weapon-against-cyber-attacks/#601581f15544
[7] http://www.electricitysubsector.org/ESCCInitiatives.pdf
[8] https://www.hackread.com/hackers-have-reportedly-infiltrated-the-us-power-grids
[9] http://www.offthegridnews.com/grid-threats/new-report-us-power-grid-attacked-every-4-days-nationwide-blackout-more-likely-than-we-thought