Terrorists seize control of the electric grid and natural gas distribution, using only computers. It’s only the stuff of Hollywood, so far. But state officials released a report Monday that reflects a growing concern that utilities must harden their defenses against cyber attacks.
In the Emergency Operations Center in Hartford, where Gov. Dannel P. Malloy normally is seen delivering status reports during emergencies posed by blizzards and tropical storms, officials outlined the need to regularly test the safety of crucial infrastructure in Connecticut.
“Threats against utilities providing electricity, natural gas, water and telecommunication services have grown in sophistication and in intensity. The defense against such attacks is vitally important to our ability to conduct commerce and live our lives,” Malloy said.
Executives at Northeast Utilities and United Illuminating, which provide electricity and natural gas to most of the state, said no cyber-attack has yet disrupted service, but the utilities’ computer systems are regularly probed by hackers, including some with overseas I.P. addresses.
Malloy presented a report by Arthur H. House, chairman of the Public Utilities Regulatory Authority, whose two previous jobs were at U.S. intelligence agencies, the National Geo-Spatial Intelligence Agency and the Office of Director of National Intelligence.
“There is a genuine threat,” House said. “They come both from nation-states and from individual actors. Even though there is a federal understanding of the nature of this threat, they don’t regulate the utilities, the states do.”
House said his report came about from conversations with the governor at the EOC during weather emergencies about other threats to the state’s systems for delivering electricity, natural gas and water.
The state report reflects warnings by national security and law enforcement officials that cyber attacks are likely to eclipse terrorism as a domestic danger over the next decade.
The Bipartisan Policy Center, a Washington think tank whose leadership includes a former CIA director, said in a report in February that “cyber attacks on key energy infrastructure – and on the electricity system in particular – are increasing, both in frequency and sophistication.”
House said the next step for Connecticut is to develop standards to measure the utilities’ readiness against cyber attacks, including possible security audits. He said the report is an effort to stay ahead of an evolving threat.
“The utilities didn’t wait for this report to get started on this,” House said.