Hurricanes are trial run for cyberattacks, energy leaders say

Power utilities are better prepared for cyberattacks aimed at energy companies and the electric grid because of their responses to hurricanes and other natural disasters, but better planning and coordination are needed, executives said Thursday.

Lessons learned in the aftermath of hurricanes in Florida and after superstorm Sandy devastated the Northeast last year can be brought to bear in the next disaster, whether it is man-made or from Mother Nature, the business leaders told IHS CERAWeek.

“We’ll leverage our history of dealing with unpredictable events like storms and translate these capabilities to cyber threats,” said Florida Power & Light Co.’s chief operating officer, Deborah Caplan. Still, she noted, “we can do all the preparation in the world, but we always have to be ready for the unexpected.”

The energy industry is a major target of cyberattacks, having drawn 40 percent of the attempts made last year. Some analysts have warned that it’s not a matter of whether — but when — a cyberattack will affect the nation’s energy infrastructure.

Any attack could spread across several sectors and companies, requiring a broad response, Caplan noted. “When or if we have a cyberattack, it could happen across multiple industries,” she said. “Each them having a plan and all of us having a plan is going to become very important.”

From CERAWeek: GM’s Akerson calls for national energy policy

Deputy Secretary of Energy Daniel Poneman said it is critical that we shift away from thinking of cybersecurity as solely maintaining a tough perimeter that must be defended. The risk, he said, is developing an “M&M” approach, where the exterior is hard, but the inside is soft (and vulnerable, once penetrated).

Recent natural disasters illustrate the vulnerability of energy infrastructure in the United States and around the world. When superstorm Sandy hit the Northeast last year, it caused electrical outages that left much of Manhattan in the dark and disrupted the flow of gasoline to the region. And the tsunami that hit Japan two years ago set off a partial meltdown at the Fukushima nuclear plant, prompting the country to look for other power supplies.

Responding to those disasters — and dealing with the ones to come — requires adding resiliency to energy infrastructure, ensuring an inventory of readily accessible emergency equipment and lots of advanced planning, Poneman and business executives said.

Having tackled seven hurricanes over the span of 15 months in the early 1990s, Florida Power & Light now has ready-made kits full of critical equipment, such as transformers and fuses, that can be deployed after storms to get power flowing again.

The utility has already used advanced analytics to help determine which transmission poles might fail in big storms, Caplan said.

“We learn a lot as a company with each storm,” she said. “Practice helps make you get better.”

It’s critical that response equipment and supplies be readily available said Poneman, who recalled that after Fukushima, the United States sent “tons and tons worth of ground and aerial monitoring equipment” to Japan.

“You need to have some baseline capabilities to throw at the problem,” he said. “Every one of these crises is a lesson on how to do better next time.”

But it’s important not to fight the last war, cautioned Sergej Mahnovski, director of energy policy for New York City Mayor Michael Bloomberg. The destruction caused by Sandy might not be mirrored in the case of a devastating heat wave or other natural disaster, Mahnovski said.

“We were both lucky and unlucky in different aspects of this storm,” he said. “If you just look at what happened in Sandy, it’s going to be different next time.”

Sandy revealed the vulnerability of energy infrastructure in New Jersey and New York, where roughly two thirds of the city’s generation fleet is in the flood plain, along with every wastewater plant, Mahnovski said.

A major gasoline supply pipeline was briefly shut down, and even when fuel flowed into the region, many filling stations did not have power or emergency generators to keep their pumps going. The city established a refueling operation aimed at ensuring private ambulances, nurses, doctors and government vehicles had gasoline, even as officials started rationing supplies for others.

Sandy also showed that some U.S. laws may hinder a response, Poneman suggested. Some groups declined to help restore power in the region, citing anti-trust laws, he said.