GLOBAL GUERRILLA TARGET: The North American Power Grid

A long term target of global guerrillas in our emerging war, will be the large infrastructure networks that our national economy relies upon (as do all modern developed economies). The most critical and complex network is our power grid which contains over 1 m kilometers of high-voltage power lines between 115 -765 kVs. The network can be further subdivided into the following:

• 1,633 power plant nodes.
  
• 10,287 transmission substation nodes. These substaions provide both interconnections between the 19,657 high-voltage power line edge segments and limited end-user distribution.
  
• 2,179 disribution substation nodes. These stations distribute power to the "last mile" of low voltage consumer lines.

Network Analysis
In recent paper, "Structural Vulnerability of the North American Power Grid," Reka Albert (et. al.) analyzed the vulnerability of the power grid based on modern techniques (see "Cascading System Failure" for more on the vulnerability of scale free networks). The key to this analysis is to find those nodes that serve as "hubs" for the network. The hubs, if taken out during an attack, have the greatest likelihood to disrupt the network and create a cascade of failure. They found the following:

• Highly connected nodes are a mix. Power engineering principles correctly suggest that the majority of highly connected nodes will be power plants (see "Design Flaws: Methods of Attacking Critical Infrastructure" for more). However, contrary to expectations, a small number of transmission substation nodes serve are also highly connected -- 50 have a degree higher than 10.
  
• 1% of the transmission substations are high load nodes. These high load substations are nodes with high betweeness (a high load of shortest paths between nodes on the network). These substations aren't necessarily highly connected nodes and some are merely high load throughput for long-haul connectivity (a critical part of the US power grid since 50% of the electricity generated is allocated via the wholesale market, much of it over long distances due to NIMBY restrictions on local power production). High load nodes are best termed the "hubs" of the network.
  
• 900 of the distribution substations can potentially become isolated clusters (41% of the total). This means that these substations are only lightly connected to the grid. If the transmission substation that connects them is taken off-line via an attack, they are disconnected from power generation and go dark.

Methods of Attack
This research indicates the potential success of different modes of global guerrilla attack against a modern power grid:

• Attacks on power substations and their direct connectivity will have little impact. The high degree of redundancy at the power substation level prevents major system failure. This is in stark contrast to the simple, production limited system in Iraq (see "Iraq: Electricity Disruption" for more) where the removal of a power plant from the grid will have a major impact. A big caveat on this "finding" is: this analysis doesn't account for "base power" generation from large producers (hydro-electric and nuclear). Power production isn't homogeneous. The elimination of these large systems from the grid would result in major disruption.
  
• Attacks on transmission substations yields the greatest system impact. In general, the removal of high load substations is more important than highly connected substations. A loss of only 4% of the highest load transmission hubs disconnects 60% of the grid from power.
  
• Cascading failures can amplify the impact of high-load node removal. Cascading failure can shut down 60% of the grid with the removal of only 2% of the high-load nodes. If 1% are removed, 40% of the grid goes dark. I suspect that better analysis based on sorting the high-load nodes by the quality of their connections (based on voltage, with the high quality nodes as those with the largest number of high voltage connections) would radically reduce the number of failed nodes needed for a system-wide cascade.

End Note: The implication is that an carefully prepared simultaneous attack against 10-20 substations of the right type could take 60% of the US end-users offline for an extended period (potentially weeks). If exploited by additional well planned attacks, this damage could be extended indefinitely.

Comments

[Watching Them, Watching Us]

Is there any evidence that the transmission grid and energey pipeline companies have actually started to invest in increasing their stock holding of long lead time spare parts e.g. oil filled transformers and switch gear etc. or oil or gas valves and actuators etc. which often have a manufacturing lead time of 6 months to a year, over and above what they feel that they can get away with financially to cover "normal" storm or flood damage ?

Shouldn't some of the defence budget be used to finance strategic critical infrastructure spare parts stock holding ?

"Just in time" manufacture is of no use with regard to providing recovery from actual physical attacks, which would cause damage for months or years, rather than "cyber terrorist" or cascade failures which only trip the saftey mechanisms for a few hours or days.

[John Robb]

No. The economics aren't there for them to do that. They can't even upgrade the SCADA control systems. Although "cyber attack" isn't a typical global guerrilla method, it can cause amazing damage. The US cyber attack on the USSR's gas pipeline system caused huge damage.

[Valdis K]

Although I am a big fan of Reka Albert, we must be careful of the analysis in "Structural Vulnerability of the North American Power Grid." Electricity flows much differently than information in social and computer networks.

Their analysis is based on shortest paths[ betweenness metric is very sensitive to paths utilized ]... electricity does not flow on shortest paths but on paths of *least resistence* -- which could be on longer, often very indirect paths, and is often multiple paths concurrently.

There is also the problem that electricity is lost as it travels long distances... therefore not all generators can serve all consumers as they assume.

This analysis does improve over earlier efforts by others who focused on node degree and not flow-through, as Albert does.

[Michael]

I'm not sure, but I wonder if part of the solution isn't already in place in the interface between Quebec and the rest of the integrated North American system? Note two things: first, that during the huge blackout of 2003, Quebec was not affected though we sell electricity into Ontario and New York and other US systems. As well, when we had our famous ice storm in 1998 those catastrophic failures didn't cascade out from here AFAIK.

So what's special about the Quebec case?

The other thought I had is that this stuff starts making "green" distributed systems not only an environmental imperative but a security imperative as well.

[Jeff]

Similar patterns of concetration are seen in countless systems that America depends on. For instance, 10% of the roads carry 90% of the traffic. During the best of times this system is self-sabotaging, a dedicated attack requiring only causing several accidents simultaneously (eg: at the intersection of I270 and I495, and the intersection of I95 and I495 in the DC area) would basically eliminate the ability of traffic to move over vast distances at very little cost, or even risk of detection. We could be systematically attacked and not even realize it, the system is so close to criticality.

I believe that railroads and air traffic in the US are vulnerable in similar ways, again due to the fact that there is very little in the way of unutilized resouces.

[Low Income Energy Network]

There is a very interesting story on electricity in Ontario at http://canadafreepress.com/ontario-hydro.htm

[Brian Murphy]

This article confirmed my suspicians. I view this as the single greatest threat to our ability to survive. Do you recommend solar roof panels to provide a few kw of electricity? Do you know where to buy them?