THIS STORY HAS BEEN FORMATTED FOR EASY PRINTING

Evidence of hacking exposes threat to electric grid

Audits show potential for catastrophe

By Jordan Robertson and Eileen Sullivan
Associated Press / April 9, 2009
  • Email|
  • Print|
  • Single Page|
  • |
Text size +

SAN JOSE, Calif. - Spies hacked into the US electric grid and left behind computer programs that would let them disrupt service, exposing potentially catastrophic vulnerabilities in key pieces of national infrastructure.

The intrusions were discovered after electric companies gave the government permission to audit their systems, a former US government official told the Associated Press. The ex-official was not authorized to discuss the matter and spoke on condition of anonymity.

The inspections of the electric grid were triggered by fears over a March 2007 video from the Idaho National Laboratory, which had staged a demonstration of what damage hackers could do if they seized control of a crucial part of the electric grid. The video showed a power turbine spinning out of control until it became a smoking hulk and shut down.

Although the resulting audits turned up evidence of spying, the former official said that the extent of the problem is unknown, because the government does not have blanket authority to examine other electric systems.

"The vulnerability may be bigger than we think," the official said, adding that the level of sophistication necessary to pull off such intrusions is so high that it is "almost without a doubt" done by state sponsors.

The Wall Street Journal, which reported the intrusions earlier, said officials believe the spies have not yet sought to damage the nation's electric grid, but that they probably would try in a war or another crisis.

Chinese and Russian officials have denied involvement in hacks of US systems.

The attacks highlight serious problems that utilities like power and water companies face as they add more technologies for remotely managing their facilities. Any system networked to the rest of the world - from financial systems to university records and retail operations - can leave openings for hackers.

Homeland Security spokeswoman Amy Kudwa said her department is "not aware of any disruptions to the power grid caused by deliberate cyber activity here in the United States." Even so, congressional investigators and intelligence officials have warned that electric utilities are vulnerable to cyber attacks, and utilities acknowledge that their computer networks are routinely under assault.

CIA analyst Tom Donahue told utility engineers at a conference last year that in other countries, hackers had broken into electric utilities and demanded payments before disrupting power - in one case turning off the lights in multiple cities.

The power grid is becoming a bigger target for hackers as more pieces of it are connected to each other or, in some cases, to the Internet.

Employees who work remotely can be a major point of weakness. If their computers can be compromised, hackers can begin working backward into a utility's central control system. One way that's done is by so-called "spear phishing," or trying to fool people into opening personalized e-mails that have malicious programs inside them. Malicious Web applications can be another route for hackers.

"The severity of what we're seeing is off the charts," said Tom Kellermann, vice president of security awareness for Core Security Technologies and a member of the Commission on Cyber Security that is advising President Obama. "Most of the critical infrastructure in the US has been penetrated to the root by state actors."

Joe Weiss, a security specialist who has testified before Congress about such threats, said the industry has failed to address these vulnerabilities.

"The human resources computer system in a utility happens to be more cyber-secure than any power plant or electric substation that we have," said Weiss, managing partner of Applied Control Solutions, a company based in Cupertino, Calif. "The fundamental problem is that we're paying more attention to the cyber security of Facebook than we are to trying to keep our lights on."

He said the long-term ramifications of such an attack would be severe: If electrical equipment were destroyed, power could be lost for six to nine months, because the replacement gear would take so long to manufacture.