The Register Citizen (Torrington, CT)
Addressing the gap in our cyber defense
U.S. Intelligence Community leaders have a stark message: Enemies have breached the ramparts.
In addition to ransom attacks and election interference is potential devastation national leaders describe in plain language: Foreign nations have penetrated our critical infrastructure and threaten our national security.
American utilities can’t find the implanted malware in generation, transmission and distribution systems. Most state regulatory authorities, which oversee distribution of electricity, natural gas and water, have neither the capability nor necessary security clearances for meaningful contribution. The result is vulnerability we refuse to confront.
We’ve been warned. The Department of Homeland Security, in July 2018, reported hundreds of Russian military intelligence infiltrations of power plant control rooms and parts of the electricity grid. The Director of National Intelligence in his January 2019 Worldwide Threat Assessment stated that adversary nation state capabilities include activities “to collect intelligence and target our critical infrastructure to hold it at risk.” A former National Security Agency leader describes extensive malware implantations in electricity transmission.
Some states are paying attention. Connecticut has conducted three extensive annual reviews including its large electricity and natural gas operations. Utilities have invested in cybersecurity capacity and augmented in-house talent with former intelligence officers and nationally recognized cybersecurity consultants conducting penetration tests. They have not found operational malware implantations.
What gives? Intelligence officials explain that detecting nation state malware implantations takes sophisticated know-how and access to sensitive, top-secret “sources and methods.” At the same time, they say that they must keep that intelligence “close hold” to protect the sources and methods. So, they cannot grant a large number of utilities full security clearances and find it understandably compromising to help 200 or so generators, transmitters and distributors to find the penetrations.
The logic is rational but circular, leaving the nation aware of and not acting to defend against cyber penetration.
There are industry organizations making efforts to rally their members and constructively probe the consequences of cyber compromise. The Electric Subsector Coordinating Council seeks to tie utility CEOs with federal authorities to prepare for and respond to critical infrastructure disasters. The North American Electric Reliability Corporation and utilities participate in biennial “Gridex” exercises to raise awareness of cyber attack consequences. Still, these organizations, our utilities and our states connect only tangentially to our national security apparatus.
A sense of security derived from thinking that at least we’re woke to the capabilities of Russia and China is foolhardy. The United States and Iran have used cyber weaponry against each other, with Iran attacking U.S. financial institutions, the Sands Casino in Nevada and critical infrastructure — a dam in New York. North Korea and cyber mercenaries are entering the arena. Offense is profoundly easier than defense in cyber warfare.
Until states and utilities are productively brought into the tent to share intelligence and craft a coordinated national counteroffensive, a few practical steps are necessary.
One is to make clear to penetrators that to pull the trigger and cripple us with critical infrastructure shutdown would be considered an act of war, met with significant consequences including the possibility of massive retaliation.
A second is to strengthen vital utility services to key government operations and military bases to enhance “mission assurance” and preserve the ability to strike back. National security facilities in Washington, D.C., northern Virginia and Maryland are obvious priorities.
The third is to make sure that states understand the devastation and panic that would ensue without electricity and potable water. Some national authorities are rightfully worried, noting that most states have no clue about what they would face in a cyber shutdown. States do not rehearse realistic drills addressing the consequences of outages lasting more than a month. They need to do so.
More basically, the federal government, the Intelligence Community and our 50 states cannot act like separate stovepipes when it comes to critical services and cyber aggression. The states must be robustly included in national security planning, recognizing their exclusive responsibilities for overseeing essential services and their strategic roles in managing emergency response. Without federal help, states and utilities working in good faith cannot root out the infections. They need training and practiced responses to public utility shutdowns.
We can’t continue this shadow dance with top-level intelligence officials warning of penetration that could bring our country to its knees with no consequent action, remediation or legislation. Weapons invented tend to be used at some point; we are on notice that cyber weaponry is planted within our vital public services.
Let’s not try to demonstrate once again how strong America can be after disaster strikes. Let’s hear the message and address the danger with appropriate defenses that include our states and utilities.
A sense of security derived from thinking that at least we’re woke to the capabilities of Russia and China is foolhardy.