So, Hackers Have the Keys to Our Power Grid. Why Haven’t They Used Them?
Jon Stokes 09.11.17
As we watch the still-unfolding catastrophe of Hurricane Irma, which has left millions (including some AllOutdoor staff) without power, it’s worth thinking about other threats to the grid. Specifically, I’m talking about hackers. From Wired’s latest:
Security firm Symantec is warning that a series of recent hacker attacks not only compromised energy companies in the US and Europe but also resulted in the intruders gaining hands-on access to power grid operations—enough control that they could have induced blackouts on American soil at will…
“There’s a difference between being a step away from conducting sabotage and actually being in a position to conduct sabotage … being able to flip the switch on power generation,” says Eric Chien, a Symantec security analyst. “We’re now talking about on-the-ground technical evidence this could happen in the US, and there’s nothing left standing in the way except the motivation of some actor out in the world.”
“Except the motivation,” the man says. But we all know that America’s enemies have the means and the motive to do us harm, so why haven’t they turned out the lights? What’s stopping them?
I think the answer here is straightforward, and it’s a big reason that I don’t spend a ton of time (yet) worrying about this particular eventuality.
Right now, to “own” (in hacker parlance) the US power grid requires the resources of a state actor, and the list of state actors that can pull this off is pretty short. Specifically, Russia and China are capable, though I also hear North Korea has substantial cyberwarfare capabilities.
If a state actor were to bring down our entire grid, or even a substantial portion of it, and were able to figure out who did it, that would be an act of war just as surely as if they had detonated a bomb in one of our cities. This is the reason this hasn’t been done, yet. Nobody who can do it is ready to start a war.
It’s also the case that, given how central the US is in world trade, it’s not rational for any country to tank its own economy by blacking out the US. So even if our enemies could bring down our grid and not get caught, they have no incentive to shut off the power if it will harm them, as well.
The big worry, though, is that the capabilities described in the Wired piece will leak out ot non-state actors. You may recall the spate of ransomeware attacks that brought down various public transit and hospital systems in Europe earlier this year. These attacks used a set of vulnerabilities and tools that were developed by our own NSA and that had been leaked into the public domain by hackers.
If all this power grid stuff similarly finds its way into the public domain, then we face the prospect of hackers holding our entire power grid for ransom, or of terrorists causing mass mayhem in an attack that makes 9/11 look like a blown kiss.
