Cybersecurity in the energy sector: are we really prepared?

Abstract

US Energy Secretary Jennifer Granholmmade an astounding – but sadly not surprising – admission in early June 2021. When asked whether US adversaries have the capability of interrupting the electricity grid she simply answered, ‘Yes they do’, adding ‘I think there are very malign actors who are trying. Even as we speak, there are thousands of attacks on all aspects of the energy sector and the private sector, generally’. Granholm’s words were astounding because the US government has known for years that cyberattacks on key infrastructure were going on. And yet they were not surprising because obviously not enough has been done to protect against such attacks. Almost exactly three years ago, a journal editorial raised the matter of prioritising cybersecurity in the energy sector. As the editorial pointed out, ‘[T]he US electricity grid, which has been referred to as the “largest interconnected machine” in the world, consists of “more than 7,000 power plants, 55,000 substations, 160,000 miles of highvoltage transmission lines and millions of miles of low-voltage distribution lines”’. While it is true that the system has not yet suffered a catastrophic attack, Granholm’s words are hardly comforting. Organisations around the world are also concerned about this issue. For example, in the World Economic Forum’s Global Risk Report 2020, cyberattacks on critical infrastructure including the energy system were rated the fifth top risk. And the International Energy Agency has said that for electricity systems in particular, ‘the threat of cyberattack is substantial and growing, and threat actors are becoming increasingly sophisticated at carrying out attacks – both in their destructive capabilities and their ability to identify vulnerabilities’. Moreover, earlier this year Reji Kumar Pillai, head of an Indian think tank that advises utilities, regulators and government on energy issues, said, ‘India’s power system is in urgent need of proper cybersecurity systems. Both the state and the central governments need to treat this with utmost urgency, without waiting for a disaster to happen’.