Electricity Markets
Security and Resilience (Cyber and Physical)

Wailes: Risk management approach needed for EMP

The U.S. electric utility industry "takes very seriously" the threat posed by the possibility of an attack using high-altitude electromagnetic pulse, or EMP, Kevin Wailes, CEO of the Lincoln Electric System in Nebraska, told a Senate hearing on May 4. He said a risk management approach is needed to counter this threat because "We cannot protect all assets from all threats."

Wailes, who is on the American Public Power Association's board of directors, told the Senate Energy and Natural Resources Committee that while some have proposed "gold plating" the grid to protect against such an attack, there is no consensus on how successful the protections would be, and they would be very costly. Those costs would be borne by electricity customers, Wailes said. And, "assuming that EMP blocking devices could be installed, there would be other collateral damage," he noted.

"We must place more effort on the most likely risks," Wailes said. "Electric utilities are working on multiple fronts" to address this risk, he told the hearing.

Wailes is co-chair of the Electricity Subsector Coordinating Council, a public/private partnership with electric utility and trade association executives and officials from the White House, the Department of Energy, the Department of Homeland Security, the Federal Energy Regulatory Commission, and the FBI.

A high-altitude EMP attack "would be an act of war or terrorism," and therefore beyond the scope of the electric industry alone, Wailes said. Collaboration is important between experts on EMP and experts in the electric utility industry, he told the hearing.

The problem is extremely complex one "that cannot be solved with a one-size-fits all" approach, Wailes said. In his written testimony to the committee, Wailes outlined the work being done currently to increase scientific understanding of the potential impact of an EMP event. He also discussed mitigation and response options.

Murkowski: 'A matter of national security'

The threat posed by the possibility of such an attack "is a matter of national security," said committee Chairman Lisa Murkowski, R-Alaska, as she opened the May 4 hearing. It is critical that the electricity industry and government build a mutual relationship of trust on this issue, she said.

"Both camps must work together and share expertise," said the Alaska Republican.

Murkowski asked whether the appropriate federal agencies "have the authority they need" to address this threat. "Many argue, and believe, that the steps we have taken so far are not sufficient," she said.

Cheryl LaFleur, acting chairman of the Federal Energy Regulatory Commission, explained that an EMP attack could involve three distinct effects: a short, high energy radio-frequency burst called E1 that can destroy electronics; a slightly longer burst that is similar to lightning and is called E2; and a third effect, called E3, that generates electric current in power lines and equipment, which can then damage or destroy equipment such as transformers.

"There remains a significant amount of research that needs to be done on how EMP, particularly E1, affects the grid," LaFleur said.

She noted in her written testimony that geomagnetic disturbances caused by solar flares "are similar in character and effect to the final phase of EMP, termed E3, as they can affect the same equipment including transformers."

EPRI conducting studies

Another witness at the Senate hearing was Robin Manning, vice president for transmission and distribution at the Electric Power Research Institute in Palo Alto, Calif.

Manning said EPRI is in the first year of a three-year study on EMP, designed to provide utilities with more information on the nature of the threat and what could be done about it.

In the study, which started last year, "we are seeking greater characterization of the EMP threat," Manning said. "We are trying to get a more complete picture."

He noted that in a finding from that study that was announced earlier this year, EPRI looked at the potential effect of an EMP attack on 37,000 bulk power transformers in the U.S. In its report, released in February 2017, EPRI said that a limited number of bulk-power transformers would be at potential risk of thermal damage due to a single high-altitude EMP attack over the continental United States.

In its report on that study, EPRI said that additional work is needed to fully investigate the impact to the entire bulk-power system. For example, the researchers did not look at the potential impact that the loss of a dozen or so big transformers would have on the stability of the overall system, said the industry research organization.

At the May 4 hearing, Manning said that more research is needed because the impact of all three types of effects - E1, E2 and E3 - that would be created in a high-altitude EMP explosion would have to be considered.

The threats "are not well understood," noted Sen. Maria Cantwell, D-Wash., in her opening statement at the committee hearing.

EPRI's work "is critical in understanding how the system and its parts would be affected," said
Caitlin Durkovich, former assistant secretary of infrastructure protection for the Department of Homeland Security, who is now director of Toffler Associates.

Risch: Risk management approach is key

Issues involving the risk of EMP "have not been ignored by the United States," but much of the discussion has taken place in closed sessions, said Sen. James Risch, R-Idaho, who is a member of the Senate Select Committee on Intelligence.

Risch said he appreciated comments made by Wailes and Durkovich regarding the importance of taking a risk management approach to this problem.

"There are a lot of people out there who want to do us harm," said Risch. "Yes, you have to address threats, but you have to do it on a risk management basis," because it is impossible to protect against every risk, he said.

Newt Gingrich, a former member of Congress who served as speaker of the House in the late 1990s, also spoke at the May 4 hearing. He warned of widespread damage to civilization that could occur as the result of an EMP attack with a nuclear warhead, and said that the U.S. electric grid is vulnerable precisely because it was designed to be efficient.

"Your statements are not overstated," Risch told Gingrich, and added that the former legislator was correct in his point that the grid's efficiency makes it more vulnerable to attack.

"The Ukraine attack wasn't as bad as it could have been" because the Ukrainian electric system "was not that efficient - it had to go through humans," Risch said. In that December 2015 incident, human operators saw that there was a problem, which kept the damage from going farther, he said.

Relative risk of EMP devices

Lawmakers asked about the relative risk posed by various types of EMP devices.

LaFleur said these could range from a handheld device that would have a limited impact, to a nuclear warhead.

"A so-called suitcase EMP is obviously much easier to build than a bomb, but it's also easier to protect against," LaFleur said. The effect of such a hand-held weapon would be relatively local in nature, she said.

That would not be the case, however, for a nuclear warhead if one should be exploded over the U.S. at high altitude. She noted that it is not very well understood what the effects of such an event would be, since this is not the kind of test one would want to conduct.

Cooper: 'I think we have to wake up'

The threat posed by EMP "is absolutely real," said Henry F. Cooper, an engineer who worked on military research for the Carter, Reagan and Bush administrations and was director of U.S. missile defense systems for President H.W. Bush.

"I think we have to wake up" and make this type of threat a high priority, said Cooper. He noted that E1 emissions from an EMP attack would be a threat to the solid-state electronics that control the natural gas and oil pipelines that supply power plants.

Nuclear power plants, in particular, need to be protected from the loss of power that could occur in an EMP attack, Cooper said. These plants provide 20 percent of US electricity - but more than that, they could be serious security threats themselves if the nation's electric supply were disrupted by a major attack, he said.

"I believe we need to island nuclear plants" to safeguard them, Cooper told the hearing. "We don't want Fukushimas all over the place," he said, referring to the reactor meltdowns that occurred in Japan in 2011.

Vermont cyber incident cited

Murkowski asked the expert witnesses how government could work better with industry and the public on protection of critical infrastructure.

"How do we build trust?" she asked.

Murkowski mentioned an incident in late December 2016 that started when the Burlington Electric Department in Vermont noticed an alert about a suspicious IP address. The Washington Post found out about it and ran a news story suggesting Russian involvement. The newspaper later issued a correction.

This kind of incident "eroded any trust that might have been there," Murkowski said.

"There is no doubt that [the Vermont incident] was a significant experience, and a learning issue for everybody," Wailes said. "There was a communication issue - we're working on fixing that."

It's very important to improve communications between government and industry, and "I think we're doing a good job" of that, Wailes said.

Five years ago, he said, there were not very many people in the electric utility sector who had government security clearances. Today, "even a utility of our size has six or seven people with security clearances," Wailes said.

At the end of the two-hour hearing, Murkowski thanked the senators and expert witnesses.

"I appreciate the urging that we really not let our guard down" on this matter, she said, and added that she is looking forward to "helping to educate Americans about our vulnerability and what we can do to reduce that."