US warns of Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure

The U.S. Department of Homeland Security has warned that for at least two years, Russian government cyber actors have targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.

In a joint Technical Alert issued March 15, 2018 by the Department of Homeland Security's U.S. Computer Emergency Readiness Team (US-CERT) and the Federal Bureau of Investigation, the agencies warned of a "multi-stage intrusion campaign by Russian government cyber actors." The report follows an October 2017 alert by computer security firm Symantec of a re-emergence of a sophisticated cyber espionage group known as "Dragonfly."

According to the government agencies' report, the Russian cyber threat actors seem to have deliberately targeted specific organizations, as opposed to pursuing targets of opportunity. In an initial "staging" phase, the campaign used tools like malware, watering holes, and spear phishing to gain access to small commercial facilities' networks -- typically peripheral organizations like trusted third-party suppliers whose networks may be less secure. For example, the threat actors sent emails with malicious attachments appearing to be personnel resumes or contract documents. Clicking on links in the attachments exposed the victims to malware or data harvesting. In a subsequent phase, the threat actors made further use of the staging targets' networks as "pivot points and malware repositories" for use in targeting their final intended victims.

The report says that these Russian government cyber actors used this hacked access for network reconnaissance and collection of information pertaining to Industrial Control Systems (ICS). It describes multiple instances of threat actors accessing workstations and servers on corporate networks that contained data output from control systems within energy generation facilities.

Cyber security is now a significant concern, both domestically and abroad. A February 2018 report by the U.S. intelligence community described the targeting of national security information and proprietary information from US companies and research institutions involved with defense, energy, finance, dual-use technology, and other areas as "a persistent threat to US interests." Last month, U.S. electric grid reliability regulators imposed a $2.7 million penalty on an unidentified utility for its violations of mandatory reliability standards in connection with a data security breach -- the largest fine to date associated with U.S. utility cybersecurity regulation. In that case, a third-party contractor hired by the utility allegedly copied protected data from the utility's network to the contractor's unsecured network -- where it was accessible online without the need to enter a user ID or password, and where it was in fact accessed by one or more unknown outside entities.

In 2014, reports emerged that Russian hackers had found flaws in solar panel monitoring software that, if left unfixed, could allow malicious actors to damage the electric grid. Foreign state-sponsored cyber attacks in 2016 and 2017 against Ukraine and Saudi Arabia targeted multiple sectors across critical infrastructure, government, and commercial networks, causing disruption to Ukrainian energy distribution networks.

House subcommittee considers reliability draft

A congressional committee is considering legislation to assure reliability and security of the U.S. electricity grid.  The House Subcommittee on Energy and Power's discussion draft includes a series of provisions designed to harden the grid against disturbance.

To understand the discussion draft, you must first understand its context.  2015 is a time of great change for the U.S. electricity system.  The grid continues to shift away from coal-fired generation and towards use of natural gas and renewable energy sources.  New environmental regulations affecting power plants are taking effect.  Smart grid technology now enables real-time communication and coordination between supply and demand for electricity, but creates millions of potential access points for hackers to target the grid.  Meanwhile utilities plan to invest more than $60 billion in transmission infrastructure over the next decade. 

Faced with these shifts, the House Subcommittee on Energy and Power held a hearing today on a "discussion draft" of proposed measures to strengthen grid reliability, security and readiness to survive disturbance.  The discussion draft includes measures that would:

• Resolve conflicts between choosing whether to comply with an emergency order from the Department of Energy or violate environmental obligations;
• Require the Federal Energy Regulatory Commission to complete an independent reliability analysis of any proposed or final major federal rule that affects electric generating units;
• Direct the Secretary of Energy to develop and adopt procedures to enhance communication and coordination between governmental entities and the private sector to improve emergency response and recovery;
• Give the Secretary of Energy powers to address grid security emergencies, and facilitate information sharing;
• Require the Energy Department to submit a plan to Congress evaluating the feasibility of establishing a Strategic Transformer Reserve for the storage, in strategically-located facilities, of spare large power transformers in sufficient numbers to temporarily replace critically damaged large power transformers;
• Direct DOE to create a voluntary Cyber Sense program to identify cyber-secure products and technologies intended for use in the bulk-power system, like controls and SCADA systems;
• Directs state public utility commissions and utilities to improve grid resilience and promote investments in energy analytics technology to increase efficiencies and lower costs for ratepayers while strengthening reliability and security; and
• Require FERC to work with each regional transmission organization to encourage a diverse generation portfolio, long-term reliability and price certainty for customers, and enhanced performance assurance during peak period.

As noted in the opening statements of Chairmen Ed Whitfield and Fred Upton, elements from this discussion draft may be included in a bipartisan energy bill expected to emerge from the House committee later this session.

Yellowstone park proposes utility upgrades

The U.S. National Park Service manages over 84 million acres of land for both conservation and visitor use.  For wilderness parks, these joint objectives lead to the challenge of providing park facilities with electricity despite their remote location.  The Park Service has launched energy efficiency and sustainability programs, but many visitor and administrative facilities still need electricity for safety and comfort.  How should the Park Service balance conservation and development?

Old Faithful geyser erupts in Yellowstone National Park.

Yellowstone National Park, the nation's first park, highlights the difficulty.  Most facilities in the park receive electricity from transmission and distribution lines owned by utility NorthWestern Energy, but the park's rugged environment, challenging climate, and relatively old electrical infrastrucutre lead to frequent power outages - over 250 in 2012.  Unlike much of the electric grid outside the park, facilities in Yellowstone lack modern communication infrastructure - a Supervisory Control and Data Acquisition or SCADA system - that would let the utility diagnose and correct the cause of power outages from the utility's central offices in Montana.

As a result, Yellowstone and NorthWestern Energy have proposed to update the park's electrical distribution system.  Proposed upgrades include an automated, remote monitoring and control system, the installation of equipment buildings, back-up power generators and propane fuel tanks.  The proposed communication system would require the construction of seven towers for radio equipment within the park, generally located at existing electrical substation sites.

Under the National Environmental Policy Act, the Park Service cannot approve the plan without conducting an environmental assessment of the impacts of the proposed development.  The Park Service has released its Environmental Assessment (10.5 megabyte PDF), which is open for public comment until December 6.

The use of national park lands for energy infrastructure can be controversial due to differing philosophies on the level of development desirable in parks.  At the same time, the Park Service notes that the Yellowstone outages have had negative effects on park operations and visitor experience, creating health and safety concerns and lost revenue for concessioners.  How will this balance play out in Yellowstone?