by Bobby Akart
PROTECTING CRITICAL COMPONENTS OF THE INFRASTRUCTURE
Some components of critical infrastructures, such as large turbines, generators, and high-voltage transformers in electrical power systems, and electronic switching systems in telecommunication systems, would require long periods of time to repair or replace. These components should be configured so that even under electronic disruption and damage, such as could be produced by EMP, they do not become further damaged in the course of shutting down or attempting to restore themselves. This type of damage has occurred in the past. During the Northeast power blackout of 1965, Consolidated Edison generators, transformers, motors, and auxiliary equipment were damaged by the sudden shutdown. In particular, the #3 unit at the Ravenswood power plant in New York City suffered damage when the blackout caused loss of oil pressure to the main turbine bearing. The damage kept that unit out of service for nearly a year, and more immediately, complicated and delayed the restoration of service to New York City.
MAINTAINING THE CAPABILITY TO MONITOR AND EVALUATE THE CONDITION OF CRITICAL INFRASTRUCTURES
After an EMP attack, system operators and others in positions of authority and responsibility must have immediate access to information sufficient to characterize the state of their critical infrastructure systems. Without such system monitoring and reporting information, the system operators will not have the information required to evaluate the extent of the loss of infrastructure and know how to begin restoration of their systems. They may even induce further damage by taking inappropriate actions or failing to take necessary actions. During the time leading up to the August 14, 2003, Midwest power blackout that affected both the United States and Canada, key system operators did not have a functioning alarm system, did not recognize that the alarm system was not functioning, and had only fragmentary information on the changing configuration of the rapidly collapsing power grid for which they were responsible.
RECOGNIZING EMP ATTACK
Electronic upsets and failures occur under normal operating circumstances, even in high-reliability equipment such as that supporting critical infrastructure. EMP-induced upsets and failures, however, are different from those encountered in the normal operation of infrastructure systems, and in fact have unique aspects not encountered under any other circumstances.
EMP produces nearly simultaneous upset and damage of electronic and of other electrical equipment over wide geographic areas, determined by the altitude, character, and explosive yield of the EMP-producing nuclear explosion. Since such upset and damage is not encountered in other circumstances and particularly not remotely to the same scale, the normal experience of otherwise skilled system operators and others in positions of responsibility and authority will not have prepared them to identify what has happened to the system, what actions to take to minimize further adverse consequences, and what actions must be carried out to restore the impacted systems as swiftly and effectively as possible.
Special system capabilities and operator awareness, planning, training, and testing will be required to deal with EMP-induced system impacts. The first requirement is for the operators of critical infrastructure systems to be able to determine that a high-altitude nuclear explosion has occurred and has produced a unique set of adverse effects on their systems. That information can be provided by local electromagnetic sensors, by information from Earth satellite systems, or by other means. Whatever the means, the operators and others in positions of authority and responsibility must receive the information immediately. Therefore, the EMP event notification system must itself be highly reliable during and after an EMP attack.
Operators and others in positions of authority and responsibility must be trained to recognize that an EMP attack in fact has taken place, to understand the wide range of effects it can produce, to analyze the status of their infrastructure systems, to avoid further system degradation, to dispatch resources to begin effective system restoration, and to sustain the most critical functions while the system is being repaired and restored. Failures similar to those induced by EMP do not occur in normal system operation; therefore, the training for, and experience developed in the course of, normal system operation will not provide operators with the skills and knowledge base necessary to perform effectively after EMP-induced system disruption and failure. Training, procedures, simulations, and exercises must be developed and carried out that are specifically designed to contend with EMP-induced effects.
PLANNING TO CARRY OUT A SYSTEMATIC RECOVERY OF CRITICAL INFRASTRUCTURES
A crisis such as the immediate aftermath of an EMP attack is not the time to begin planning for an effective response. Plans to avoid causing further damage to critical infrastructures and to carry out a systematic recovery of those infrastructures must be in hand at the earliest possible time. Planning for responding to an EMP attack should begin now and should be carried out jointly by system operators, hardware and software providers, and experts in both the government and private sectors.
Individual infrastructure systems have many similar electronically based control and monitoring functions. The primary features of EMP attack mitigation in each infrastructure include elements of protection of critical functions, identifying where damage within the system is located, dispatch/allocation of resources to allow for timely restoration and development of operational procedures including simulation of both individual and interacting infrastructures, training, testing, and governance. This requires test and evaluation of both existing and future systems to identify weak spots subject to EMP damage and focus mitigation activities accordingly. EMP protection thus has a substantial aspect focused on individual functioning units within each system that contains electronic components, although not necessarily on the individual electronic subcomponents of these units themselves. These units include distributed Supervisory Control and Data Acquisition (SCADA) modules, mobile communicators, radios, embedded control computers, etc. New units can be EMP-hardened for a very small fraction of the cost of the non-hardened item, e.g., 1% to 3% of cost, if hardening is done at the time the unit is designed and manufactured. In contrast, retrofitting existing functional components is potentially an order of magnitude more expensive and should be done only for critical system units. It is important to note, however, that for protection to remain functional, it must be tested and maintained in its operational mode with rigor and discipline.
TRAINING, EVALUATING, RED TEAMING, AND PERIODICALLY REPORTING TO THE CONGRESS
Identifying an EMP attack, understanding the state of the system after attack, developing and implementing plans for system restoration, and having operators and others in positions of authority and responsibility trained to recognize and respond effectively are elements of strategy that are common to managing the effects of EMP for each of the Nation’s critical infrastructure components. Conducting and evaluating the results of training, simulations, tests, and Red Team activities, and periodically reporting the results to senior executive branch leaders, the Congress, and the public are important elements of being well-prepared for EMP attack, which in turn will sharply reduce the incentives for conduct of such an attack.
DEFINING THE FEDERAL GOVERNMENT’S RESPONSIBILITY AND AUTHORITY TO ACT
Governance of the critical infrastructures such as electrical power systems and communications is presently distributed among statutory governmental entities at the federal, state, regional, and municipal levels, as well as among a variety of non-governmental entities. A multiplicity of statutory bodies, private companies, associations, and individual owners also participate in determining decisions and actions. Nevertheless, the process is coordinated, albeit loosely, to produce normal efficient, reliable, and high quality service that is the envy of the world—in a peacetime environment.
A terrorist threat—let alone a terrorist attack—is outside the ambit of normal governance of the key national infrastructures. In dealing with such threats, the Department of Homeland Security has the unique and sole responsibility a
nd authority to govern the specific actions and involved parties within the US, including requesting enabling Congressional funding as appropriate and necessary. DHS must interact with other governmental institutions and the private sector in defining liability, responsibility and funding in order to enable private and government facilities, such as independent power plants, to contribute their capability in a time of national need, yet not interfere with market creation and operation to the maximum extent practical.
Industry associations, system owners/providers, private consultants, and universities all will be able to contribute useful levels of knowledge and skills. DHS is responsible for making the prudent trade-offs within each mitigation activity between performance, risk, schedule, and cost in relation to consequent system protection and then-expected risk in order to achieve maximum protection. For example, some actions taken to protect a system from an EMP attack may diminish the reliability or quality of that system’s normal commercial performance, while other actions may improve the performance.
As an example of resources readily available to DHS with respect to the electric system, the North American Reliability Counsel (NERC) and the Electric Power Research Institute are well-positioned to provide much of the support needed in regard to the EMP threat. Working closely with industry and these institutions, the DHS should provide for the necessary capability to control the national bulk electricity supply system in order to protect critical services, minimize its self-destruction in the event of an EMP attack, and recover its normal capabilities as rapidly and effectively as possible thereafter.
RECOGNIZING THE OPPORTUNITIES FOR SHARED BENEFITS
Most of the following initiatives and actions the Commission recommends militate against more than an EMP attack. The protection and/or rapid restoration of critical infrastructures in the civilian sector from an EMP attack also will be effective against other types of infrastructure disruptions, such as attacks aimed at directly damaging or destroying key components of the electrical system, and natural or accidental large-scale disruptions are also significantly mitigated by these same initiatives. Some of these steps also enhance reliability and quality of critical infrastructures, which is a major direct benefit to the US economy and to our way of life.
CONDUCTING RESEARCH AND DEVELOPMENT
Very little research and development addressing EMP-related system response protection and recovery issues has been done for more than a decade. Conducting research to better understand infrastructure system effects and developing cost-effective solutions to manage these effects will be important to understanding the implications of the rapid evolution of electronics and electrical systems, and their growing role in controlling and operating modern critical infrastructure.
ELECTRIC POWER INFRASTRUCTURE
NATURE OF THE PROBLEM
Electric power is integral to the functioning of electronic components. For highly reliable systems such as commercial and military telecommunications, electric power usually comes from batteries (in the short term), local emergency power supplies (generally over time-intervals of less then 72 hours), and electricity delivered through the local electrical utility (“power” lines in the home, office and factory). Local emergency power supplies are limited by supplies of stored fuel. Increasingly, locally stored fuel in buildings and cities is being reduced for fire safety and environmental pollution reasons, so that the emergency generation availability without refueling is limited.
Geomagnetic storms, a natural phenomenon driven by the solar wind, may, by a different physical mechanism, produce ground-induced currents (GIC) that can affect the electrical system in a manner similar to the E3 component of EMP. Disruptions caused by geomagnetic storms, such as the collapse of Quebec Hydro grid during the geomagnetic storm of 1989, have occurred many times
Depending on the explosive yield of the nuclear weapon used, EMP-induced GIC may be several times larger than that produced by the average geomagnetic storm, and may even be comparable to those expected to arise in the largest geomagnetic storm ever observed. It may also occur over an area not normally affected by historic geomagnetic storms.
The North American economy and the functioning of the society as a whole are critically dependent on the availability of electricity, as needed, where and when needed. The electric power system in the US and interconnected areas of Canada and Mexico is outstanding in terms of its ability to meet load demands with high quality and reliable electricity at reasonable cost. However, over the last decade or two, there has been relatively little large-capacity electric transmission constructed and the generation additions that have been made, while barely adequate, have been increasingly located considerable distances from load for environmental, political, and economic reasons. As a result, the existing National electrical system not infrequently operates at or very near local limits on its physical capacity to move power from generation to load. Therefore, the slightest insult or upset to the system can cause functional collapse affecting significant numbers of people, businesses, and manufacturing. It is not surprising that a single EMP attack may well encompass and degrade at least 70% of the Nation’s electrical service, all in one instant.
The impact of such EMP is different and far more catastrophic than that effected by historic blackouts, in three primary respects:
1. The EMP impact is virtually instantaneous and occurs simultaneously over a much larger geographic area. Generally, there are neither precursors nor warning, and no opportunity for human-initiated protective action. The early-time EMP component is the “electromagnetic shock” that disrupts or damages electronics-based control systems and sensors, communication systems, protective systems, and control computers, all of which are used to control and bring electricity from generation sites to customer loads in the quantity and quality needed. The E1 pulse also causes some insulator flashovers in the lower-voltage electricity distribution systems (those found in suburban neighborhoods, in rural areas and inside cities), resulting in immediate broad-scale loss-of-load. Functional collapse of the power system is almost definite over the entire affected region, and may cascade into adjacent geographic areas.
2. The middle-time EMP component is similar to lightning in its time-dependence but is far more widespread in its character although of lower amplitude—essentially a great many lightning-type insults over a large geographic area which might obviate protection. The late-time EMP component couples very efficiently to long electrical transmission lines and forces large direct electrical currents to flow in them, although they are designed to carry only alternating currents. The energy levels thereby concentrated at the ends of these long lines can become large enough to damage major electrical power system components. The most significant risk is synergistic, because the middle and late-time pulses follow after the early-time pulse, which can impair or destroy protective and control features of the power grid. Then the energies associated with the middle and late-time EMP thus may pass into major system components and damage them. It may also pass electrical surges or fault currents into the loads connected to the system, creating damage in national assets that are not normally considered part of the infrastructure per se. Net result is recovery times of months to years, instead of days to weeks.
3. Proper functioning of the electrical power system requires communication systems, financial systems, transportation systems, and—for much of the generation—continuous or nearly continuous supply of various fuels. However, the fuel-supply, communications, transportation, and financial infrastructures would be simultaneously disabled or degraded in an EMP attack and are dependent upon electricity for proper functioning. For electrical system recovery and restoration of service, the availability of these other infrastructures is essential. The longer the outage, the more problematic, and uncertainty-fraught the recovery will be.
The recent cascading outage of August 14, 2003, is an example of a single failure compounded by system weaknesses and human mistakes. It also provides an example of the effe
ctiveness of protective equipment. However, with EMP there are multiple insults coupled with the disabling of protective devices simultaneously over an extremely broad region—damage to the system is likely and recovery slow.
RECOMMENDED MITIGATION AND RESPONSIBILITY
The electrical system is designed to break into “islands” of roughly matching generation and load when a portion of the system receives a severe electrical insult. This serves both to protect electricity supply in the non-impacted regions and to allow for the stable island-systems to be used to “restart” the island(s) that have lost functionality. With EMP, the magnitude, speed, and multi-faceted nature of the insult, its broad geographic reach, along with the number of simultaneous insults, and the adverse synergies all are likely to result in a situation where the islanding scheme will fail to perform as effectively as intended, if at all. Since the impacted geographic area is large, restoring the system from the still-functioning perimeter regions would take a great deal of time, possibly weeks to months at best. Indeed, the only practical way to restart much of the impacted electrical system may be with generation that can be started without an external power source. This is called “black start” generation and primarily includes hydroelectric (including pumped storage), geothermal, and independent diesel generators of modest capacity.
The recommended actions will substantially improve service and recovery during “normal” large-scale blackouts, and will critically enable recovery under EMP circumstances.
PROTECTION
It is impractical to protect the entire electrical power system from damage by an EMP attack. There are too many components of too many different types, manufacturers, designs, and vulnerabilities within too many jurisdictional entities, and the cost to retrofit is too great. Widespread functional collapse of the electrical power system in the area affected by EMP is possible in the face of a geographically broad EMP attack, with even a relatively few unprotected components in place. However, it is practical to reduce to low levels the probability of widespread damage to major power system components that require long times to replace. This will enable significantly improved recovery times, since it avoids the loss of long lead-time and critical components. It is important to protect the ability of the system to fragment gracefully into islands, to the extent practical in the particular EMP circumstance. This approach is cost-efficient and can leverage efforts to improve reliability of bulk electricity supply and enhance its security against the broader range of threats.
