Lights Out: A Cyberattack, a Nation Unprepared, Surviving the Aftermath
by Ted Koppel
One night in 1945, when Ted Koppel was about five years old, his German Jewish refugee father, a member of the British Home Guard, "took me out onto the street to show me a sight I had never seen before: lighted street lamps....There was a popular song at the time: 'When the Lights Go On Again All Over the World.'... Much of Britain's civilian population had faced infinitely more harrowing circumstances than ours. What lingers, after all these years, is the sense of preparedness, of having a plan, of being ready for whatever might come."
Koppel (Off Camera) is a broadcast news icon. Among other accomplishments, he was the trusted face of Nightline for 26 years, and has won scores of major journalism awards. In Lights Out, his first book of investigative journalism, he builds a strong case that a cyber attack on the US electrical power grids is likely, potentially devastating, and that the U.S. government has failed to adequately prepare for it.
Cyber attacks may come from nations or small groups, and are deniable in ways that a nuclear attack is not, which means that attackers need not fear immediate retaliation. Koppel refers to a Federal Energy Regulatory Commission (FERC) analysis "which found that if nine of the country's most critical substations were knocked out at the same time, it could cause a blackout encompassing most of the United States." He tells how "on April 13, 2010, a bipartisan group of ten former national security, intelligence and energy officials... sent a confidential letter, not previously released, to the Chairman and Ranking Member of the House Committee on Energy and Commerce." It concluded that "The grid is extremely vulnerable to disruption by a cyber- or other attack," and that "a carefully targeted attack... would result in widespread outages for at least months to two years or more." A separate congressional commission stated that "only one in ten of us would survive a year into a nationwide blackout, the rest perishing from starvation, disease and societal breakdown."
It might be tempting to dismiss these extreme scenarios as fearmongering, if it weren't for Koppel's reliance on reams of studies and reports, and interviews with top-ranking national security experts and policy makers from all levels of government and industry, including power company officials, the military, NSA, FEMA and Homeland Security. Koppel lays out the many conflicting risk assessments within the government and the power industry, and his readers are free to judge the evidence. None of the experts thinks that sabotaging the power grid would be easy, but many seem to believe it's very likely.
However, Homeland Security has no plan to deal with the aftermath of a cyber attack on the power grid, and neither does FEMA. Koppel summarizes FEMA's attitude as, "there is no clear answer, nor is there a specific plan, and there is no plan... because they don't think it will happen."
Thanks to 1980s deregulation, as of 2015 the U.S. has about 3,000 power companies, a highly complex power grid kept in balance by a computerized system. Koppel explains simply and clearly how the system is scheduled and monitored to prevent overloads. But the power industry is largely self-regulating, and small privately owned companies often have weak security. Koppel compares this situation to Ebola infection: one tiny exposed spot may be all that is required to take the entire system down.
Industry officials point to "air gaps," physical space between networks, as a rock-solid security measure. But these gaps can be compromised whenever a worker connects a personal device to the network. And FERC tests have consistently found connections between public access, administrative and operational networks.
In addition to air gaps, some officials cite CRISP, or Cyber Risk Information Sharing Program, as an effective defense. CRISP is meant to warn companies about potentially dangerous network traffic in real time. But as of 2015 it operates in "near-real time" and shares information with only 15 out of 3,000 companies, a number that may increase to 40 or 50 by the end of 2015. Koppel emphasizes the power industry's opposition to information sharing as one of the greatest obstacles to effective cyber defense.
He also looks at the potential for both EMP (electromagnetic pulse) and physical attacks on substations and large power transformers. These transformers' age averages around 40 years, most are custom built, and most must be built overseas. Replacing one can cost up to $10 million, and take six months to two years. He examines the lack of sufficient emergency food supplies, the institutional incompetence of the Red Cross, the potential for violence and "preppers" who think they can survive a major disaster by barricading themselves with their stockpiles. He devotes three chapters to a study of the Mormons, who are required by their faith to be prepared for any disaster. They have a complete and contained system of food storage, transportation and communication, a system of total community preparation that might act as a model for the rest of the nation.
Lights Out is suffused with the anxiety that comes with trying to predict an uncertain future. Readers may be tempted to retreat from this mass of alarming facts and figures. However, Koppel offers the British WWII civil defense measures of his childhood as an example of national training that put "an organized structure in place. There was a level of civilian discipline that served the country well." No matter what disasters come our way, he believes we could only benefit from building prepared communities and a national emergency plan to hold society together until the lights come back on. --Sara Catterall