Electricity Grid in U.S. Penetrated By Spies

[seemslikeadream]

http://online.wsj.com/article/SB123914805204099085.html

WASHINGTON -- Cyberspies have penetrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system, according to current and former national-security officials.

The spies came from China, Russia and other countries, these officials said, and were believed to be on a mission to navigate the U.S. electrical system and its controls. The intruders haven't sought to damage the power grid or other key infrastructure, but officials warned they could try during a crisis or war.

"The Chinese have attempted to map our infrastructure, such as the electrical grid," said a senior intelligence official. "So have the Russians."

The espionage appeared pervasive across the U.S. and doesn't target a particular company or region, said a former Department of Homeland Security official. "There are intrusions, and they are growing," the former official said, referring to electrical systems. "There were a lot last year."

Many of the intrusions were detected not by the companies in charge of the infrastructure but by U.S. intelligence agencies, officials said. Intelligence officials worry about cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet.

Authorities investigating the intrusions have found software tools left behind that could be used to destroy infrastructure components, the senior intelligence official said. He added, "If we go to war with them, they will try to turn them on."

Officials said water, sewage and other infrastructure systems also were at risk.

"Over the past several years, we have seen cyberattacks against critical infrastructures abroad, and many of our own infrastructures are as vulnerable as their foreign counterparts," Director of National Intelligence Dennis Blair recently told lawmakers. "A number of nations, including Russia and China, can disrupt elements of the U.S. information infrastructure."

[rcrush]

1. I wonder when the blackouts will start...

[chrisa]

6. They won't.

But it's a clever plan to kill the power grid in the event of war. It's one of those plans that nobody will ever use. The only problem would be if someone found out how to use the programs themselves through a backdoor, which would probably never happen.

[RUMMYisFROSTED]

2. We would never do anything like that.

:patriot:

[petronius]

12. Of course not! When he says

"many of our own infrastructures are as vulnerable as their foreign counterparts," he's just guessing - we certainly wouldn't poke our noses into foreign infrastructure... ;)

[ThomWV]

3. Patently preposterous - if we don't have a 'smart grid' then there can be no cyber attack

You see, the reason we need a "smart grid" is because we don't have one. Now if we had one it might be subject to attack, but, as the President quite correctly notes - we don't have one.

[guitar man]

4. one spy identified-exclusive photo!

:D

[chrisa]

5. Haha!

I hate that commercial. :-)

[lonestarnot]

7. I knew it! I've even seen him on TV!

:P

[Kalyke]

8. So, basically, we're admitting our SCADA system sucks.

I heard stories of the lack of a simple firewall between the SCADA and the other operating systems (I work in information security).

http://en.wikipedia.org/wiki/SCADA

[ThomWV]

9. There is no system - none at all

People really don't understand that this nations doesn't have an electric grid in any real sense. There are regions in which power plants are connected but the only control that is maintained in those "systems" is that the cyclic rate is kept within a couple of percent between plants. If a plant's generators get out of cycle (remember, we have 60 cycle power) they 'trip out' of the system. That is all the control there is. No super duper computers are involved.

[Mist]

13. That's what I thought -- a series of grids, not one over-arching grid. nt

[Kalyke]

19. But many utitilty companies have SCADAs (although they're not as

secure as they should be).

I know it's a series of grids, some interconnected, others not, but the fact that these spies were able to show up on a number of them is damning.

Obviously, utility companies are using our hard-earned money to build faux systems to install that don't perform as they should - or many aren't putting them in at all.

[ThomWV]

21. I don't think you understand - there is nothing to spy on.

You can buy maps that show where the actual wires are located, if that's what you think they are spying on but don't get the notion that there is some sort of control mechanism located somewhere that can be hacked.

The transmission of electric power is one of those things that people just aren't well versed in but there are some basics to it that sort of stand in the way of all sorts of new-era plans. The first thing is that you can not transmit power more than about 200 miles from a power plant to point of use and that limitation alone rules out a lot. The other thing is this - and it gets to the root of this post - there is no real time monitoring of just how much power is going through the major transmission lines that do exist. It causes all sorts of problems, particularly in the west, when temperatures go up along with power use in the summers. Sometimes lines can sag badly and that can lead to big problems. Anyway the idea of the proposed "smart grid" is to take care of that kind of problem. But for now its only a proposal and we have no control system over any sort of grid. One of the best analogies to it I've seen likened what we call the grid to the US road system before the Interstates. There was no orderly connection between major cities or anywhere else, just a hodge-podge. That's what we've got now. In fact some places are artificial islands as far as power goes. The last time I looked the state of florida only had two major interconnects with the rest of the planet, I think Texas is the same way.

[seemslikeadream]

10. Congress provided US$4.5 billion for smart-grid deployment

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9131275&taxonomyId=17&intsrc=kc_top

U.S. lawmakers and some security experts have raised concerns for several years about the security of the power grid and other control systems. In a congressional hearing in March, Joseph Weiss, managing partner of control systems security consultancy Applied Control Solutions, said networks controlling U.S. industrial control systems have been breached more than 125 times in the past decade, with one resulting in U.S. deaths.

It could take the U.S. weeks to replace damaged equipment after coordinated attacks on infrastructure using control systems, Weiss said then. A coordinated attack "could be devastating to the U.S. economy and security," he said. "We're talking months to recover. We're not talking days."

Other security experts have raised concerns that the electrical grid could become more vulnerable as it moves to a two-way smart grid, potentially using the Internet for transmission. Congress provided US$4.5 billion for smart-grid deployment in an economic stimulus package passed earlier this year.

IOActive, a Seattle security consultancy, has spent the past year testing smart-grid devices for security vulnerabilities and discovered a number of flaws that could allow hackers to access the network and cut power, the company said in March.

"We're taking about extending access down into the homes over a combination of wireless networks, home-area networks," added Brian Ahern, president and CEO of Industrial Defender, a control systems security vendor. "When you think about our existing infrastructure today -- power plants, transmission distribution systems -- they all have their own security problems. That's what we're all working diligently on right now -- making sure that our existing infrastructure is secure."

Ahern, speaking before the Journal report came out, expressed concerns about the electrical grid. "One of the challenges that we have today in this country is that you've got all this critical infrastructure that has been deployed over the last 20 years, and no one was even thinking about security," he said.

[seemslikeadream]

11. Scary stuff! The story, while quite interesting, doesn't however give much direct evidence that woul

http://blog.wired.com/business/2009/04/china-and-russi.html

Scary stuff! The story, while quite interesting, doesn't however give much direct evidence that would allow us evaluate how real the threat is. All the specific quotes and information about the danger faced ("Cyberspies have penetrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system") come from unnamed officials — who could easily be hyping the threat to generate business for the companies, because they always hype the threat of Chinese hackers, or because they want to spur Congress into increasing budget outlays for their departments.

The one specific quote, from director of National Intelligence Dennis Blair, is so vague that it's essentially meaningless: "A number of nations, including Russia and China, can disrupt elements of the U.S. information infrastructure."

[Echo In Light]

14. Thanks for sourcing this

[seemslikeadream]

15. Thanks to you for noticing my fair and balanced reporting (*_*)

It's not like I am an attention getter or such :rofl:

[Echo In Light]

16. Take note when the terms and context are intentionally vague & loose

[seemslikeadream]

20. Isn't that always the M$M way

vague & loose & sometimes out right lies?

[Richard Steele]

17. The Chinese didn't "penetrate the grid", they built the computers in the first place.

They don't need to "penetrate" what they're already inside.

[hunter]

18. Lots of ways to cause trouble, and saying it's the Chinese or Russians makes this stink.

I posted my own speculation in LBN:

http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=102&topic_id=3821468&mesg_id=3821705

But really, "attempted to map our infrastructure????"

For goodness sakes, I'll bet the Chinese and Russians know exactly how every U.S. power station, substation, and power line is connected, and exactly where the weakest links are. And I'm sure we know the same about them.

The reason all the heavyweights play so nicely together is that we all know how vulnerable we are. Sophisticated technological economies are fragile.