Energy Security Postscript and Next Chapter

Cross-posted from the Smart Grid Security Blog

Long-time readers of the SGSB might have wondered if they'd ever see another post. Me too. After producing an average of 1+ posts per week since its inception 5 years ago, I cut way back after leaving IBM in 2013 to give myself more time to focus on consulting. And now there's a new development to report.

4 month ago I shuttered my security strategy business and began my first day on the job at Idaho National Laboratory (INL). It's one of the Department of Energy's national labs, and it's the one most squarely positioned at the intersection of energy infrastructure and national security. Let's call that energy security.

My INL title: Senior Cyber & Energy Security Strategist - may sound a little pretentious, but it pretty accurately captures what I was hired to do. If you visit the lab's home page or the INL Twitter feed it seems like nuclear energy research and related nuclear work are its dominant activities. But while nuclear energy research and fuels fabrication were its origin in the 1940's and its historic mission, with the help of its massive and remote test range that includes grid-scale transmission, distribution and communications assets, the lab I just joined does a ton of research and applied work on power and industrial control systems, Smart Grid and wireless communications, cyber and physical security and resilience, renewables, microgrids, energy storage and more.

Nuclear energy R&D, and full nuclear fuel lifecycle work (including non proliferation) will always be a significant part of that nation's requirements, and the INL mission, but nuclear energy is arguably the most reliable portion of our non fossil fuel baseload, but INL is quietly becoming something much more - and more important - than its nuclear legacy might suggest.

Without going into too much detail, the lab's customers now include not just DOE's nuclear energy organizations, but also DOE's renewables, resilience and cyber-physical security components too. DHS has become a major customer, as the lab hosts the ICS-CERT cyber security overwatch function for the US grid and other critical infrastructures, and performs other leading edge cyber and physical security roles as well. DoD is a very large customer too, for energy, security and communications test functions, rounded out by direct work with utilities and energy and telecom technology suppliers.

In short, INL in 2014 is not the lab many people think it is. While it's yet to update its image online, a visit to Idaho Falls quickly confirms that this is one of the nation's preeminent Energy Security lab resources. Nuclear energy is and likely always will be a key element, but without making much noise about it, INL has become so much more, and I'm very very lucky to be a part of it.

------------------------------

Postscript to the Postscript post: Though my blogs are in suspended animation, I continue to speak in public, and albeit more frequently and tersely, on Twitter @andybochman. As the Twitter profile reveals, I continue to work out of my home office in Boston while hitting the road most often for DC, and of course, now, Idaho.

Imagining Smart Grid Adversaries, or "The Cascade Charade"

As most readers of the DOD Energy Blog can attest from direct experience, sometimes we manufacture enemies as placeholders for potential future enemies. Such was the case recently when a smart and well-intentioned student of Chinese origin, Wang Jianwei, published what he thought would be helpful findings for all students of complex, networked systems.

However, not long after its publication, in certain circles his work became known as a blueprint for Chinese attacks on the US power grid. How'd that happen? In order to understand who scrambled the info, you have to follow the path of the information to detect when and by whom it got altered.

It begins with the paper trail from Wang's article published in Safety Science: "Cascade based attack vulnerability on the US Power Grid" (which you can purchase in full for $31.50). The paper was found by a group called the US-China Economic and Security Review Commission and was presented as a threat brief to Congress where things start to simmer with certain congressmen. Ultimately, news of this reaches the New York Times in the form of this article  published on 20 March 2010. My co-blogger on the Smart Grid Security blog, Jack Danahy bought the original paper and read it in its entirety, before writing this post about the whole affair with a focus on the grid.

Of course there are plenty of reasons to keep our eyes open and our guard up. Threats to our electrical insfrastructure can take many shapes, including, as RMI's Amory Lovins points out, squirrels. However, back to the paper that started this tempest. According to Wang and others:

We usually say ‘attack’ so you can see what would happen,” he said. “My emphasis is on how you can protect this. My goal is to find a solution to make the network safer and better protected.” And independent American scientists who read his paper said it was true: Mr. Wang’s work was a conventional technical exercise that in no way could be used to take down a power grid.

Assuming everything originating in China is a threat to the US ignores our current nearly inextricable economic inter-dependency. As it attempts to maintain its very rapid climb out of the third world, China's own energy challenges are staggering. And if climate change is one of your concerns, then the linkage goes even deeper. We have so much to work on; let's not  let our insecurities get in the way of really improving our nation's energy security.

GovEnergy's Upcoming Energy Security Game

A few weeks ago the National Defense University sponsored the first DOD "Grid Game" to test how different agencies would react to scenarios of greater and lesser impact to the electric grid. Some observations and lessons learned are forthcoming, I believe.

Next, however, the upcoming GovEnergy conference will feature a 90-minute game to examine energy challenges and options more broadly and in more domains (energy is just one of them, others that impact energy such as: the economy, society, ecology, technology are also included ... and wait till you see the wild cards!) And the scope is across the Federal Government. Participants have the opportunity to apply their energy security knowledge through a series of energy security games based on "real world" scenarios.

These are the early days of energy war gaming, but with these two events in close succession, we're off to a pretty good start in 2009. Will be at the conference and will post the results here when ready. Click here for a 1-page overview ... and please try to attend if you can.

Navy ID's Trouble with Grid Reliance

A recent Navy IG report on facilities energy security took a surprising twist ... surprising to the IG, that is:

The report was commissioned to recommend a privatization strategy that would allow the U.S. Navy to “get out of the energy business” by selling its substantial network of power-generation facilities to firms in the private sector.  Ironically, the principal conclusion the IG reached was that privatization would be a disaster and that the whole policy supporting privatization erroneously presumed that the private sector’s management of the power sector was superior to the public sector. 

Readers of this blog should be less surprised.

You Sure You Want a Smart Grid?

Just one question for you. If this is how grid operators deal with risk pre-smart grid, how the heck are they going to secure the web enabled, bi-directional communications world coming at us with a gathering head of steam?

The North American Electric Reliability Corporation (NERC):

... is asking operators to take another look at their risk assessment methodologies and conduct a new evaluation of critical assets and associated cyber assets. Too many organizations are starting their evaluations with the assumption that no system is critical until it is proved to be so. [NERC CSO] Assante suggested that they reverse the process and assume that every system is critical until it can be demonstrated otherwise.

You don't have to be a security expert to smell several rotten things in these few pages. More on this to follow ...

Energy Security Wars: Grids vs. Hackers

According to this Washington Post article, the grid doesn't always win, especially in some ambiguous foreign countries. Tom Donahue, the CIA's top cyber security analyst, made some news when he disclosed that cyber attackers have breached the electrical systems of multiple countries and have gone as far as powering down entire cities when their demands weren't met.

Of course, it's not business as usual for the CIA to speak out so publicly:

The CIA wouldn't have changed its policy on disclosure if it wasn't important. Donahue wouldn't have said it publicly if he didn't think the threat was very large and that companies needed to fix things right now.

But it's not just that hackers are getting more organized and more powerful. Grid breaches are occurring because new IT and communications technologies are making life easier for operators ... and at the same time, more dangerous for customers.  According to security specialist Ralph Logan:

In the past, if they wanted to go out and read a gauge on a gas well, for example, they would have to send a technician in his vehicle; he would drive 100 miles and physically read the gauge and get back in his truck. Now they can read it from headquarters. But it allows attackers a gateway into the system.

All I can say is get ready for the Smart Grid, DOD. I'd recommend more diesel generators on the base ... and lots of candles in the home.

Photo: Wikipedia Commons

Potential Solution to DOD's Grid Dependency Problem

If I told you there was an interesting new renewable energy company with an office on Trinity Drive in Los Alamos, could you guess what kind of technology we'd be talking about? Nuclear would be a good start, but this time with important differences:

• Small in size
  
• About 25 MW in capacity - enough for 20,000 homes
  
• Inherently safe design, built to work underground
  
• $25-30M for each unit
• Almost ready for production
  

Here's another new company to keep an eye on: New Mexico-based Hyperion Power Generation. If they can execute their plan, we may have an affordable response to one of the DSB's Feb 2008 report's key recommendations about DOD bases needing to break their dependency on the fragile, vulnerable, national grid. Stay tuned.

Meanwhile, have a safe and happy Thanksgiving. I'm going to take a few days off and come back with new posts starting 1 Dec.

Smart Grid 2.0

This may be more than you want to know about what's being done to bring our electrical grid out of the stone age, but I'm optimistic that some will give it a shot. Rob Day at @Ventures and Greentech Media lays out the current and evolving state of grid automation tech on the demand and supply sides. Will these developments make DOD bases' dependency on the brittle grid less of a problem in the short term? No. The mid term, then? I don't think so. 

But when enough glitches occur to generate some some serious money and national will, thanks to Day and some of the co's he calls out, it appears the technology will be more than ready to re-build it right. So DOD, keep one eye on developments that could make the grid more reliable in the future, but please keep the pedal to the metal on the NDAA 2009, Section 335 "Mitigation of Power Outage Risks for DOD Facilities and Activities" activities just getting started (see post from earlier this week).  

Photo courtesy of Wikimedia Commons

A 2nd Energy Security Gem in NDAA 2009

As called out in the DSB Task Force Report on Energy Feb 2008, and discussed on the DOD Energy Blog several times already including here, DOD bases' near total reliance on the electrical grid has been considered a major vulnerability for years. Only problem: leadership has done almost nothing to address it ... until now.

The just-signed NDAA 2009 has a Section 335 titled "Mitigation of Power Outage Risks for DOD Facilities and Activities." Here's a part of the language:

The Secretary of Defense shall conduct a comprehensive technical and operational risk assessment of the risks posed to mission critical installations, facilities, and activitiesof the Department of Defense by extended power outages resulting from failure of the commercial electricity supply or grid and related infrastructure.

And it goes on to say SECDEF will then try to figure out ways to mitigate (i.e., deal with) the risks ID'd above in a prioritized manner. As I said at the end of yesterday's post on the Fully Burdened Cost of Fuel (FBCF), I'll be taking an action item to track DOD's progress in making good on this pledge. 

DOD sure does have a lot on its energy plate these days. But that's a heck of a lot better than just a few years ago, when strategic energy issues weren't even on the menu.

Follow-up on Grid Challenges

Recent posts on the somewhat sorry state of the US power grid made this article, on the how renewables implementations will be limited by the current grid, stand out when I saw it last week.

According to the NY Times' Matthew Wald:

The grid today, according to experts, is a system conceived 100 years ago to let utilities prop each other up, reducing blackouts and sharing power in small regions. It resembles a network of streets, avenues and country roads.

Wald then cites of FERC who says, "We need an interstate transmission superhighway system.” Only problem is that you only go interstate when legislators in DC make a coordinated decision, and that's not likely to happen anytime soon. Until now, they've left power transmission issues to the states and it doesn't seem like that's about to change.

As a reader of the Powrtalk blog recently pointed out, we don't need a national super grid to achieve big gains - but we do need to connect the power generation centers to the nearest big cities. And DOD could and should get more boisterous here, by demanding and helping finance direct renewables transmission connects to its bigger bases. Nellis (photovoltaics) and China Lake (geothermal) have bypassed grid woes by building their power on the bases themselves. But for DOD installastions not ready or able to build their own large renewable generators yet, solid connections to renewable power might be the next best thing*.

* Note: I'm sure I'm missing something here. How does a base take advantage of intermittent renewable power when it's available but retain the ability to switch over when it needs to draw from traditional sources? And how does it do this without depending on the local utility provider or providers?

2 Types of Energy Dependence for DOD

It's a marginal analogy, but as the US could improve its fuels-energy security through increased independence from (often hostile) foreign oil suppliers, DOD installations could achieve greater electrical-energy security by reducing their near total dependence on the (decidedly fragile) US electrical grid.

The 2005 DOD Energy Manager's Handbook, PDF linked here, is an epic work of 250 pages, and it is the master energy measurement and management guide, albeit on an installation/base level, that the DSB said is sorely lack at the DOD enterprise level.

I haven't made my way through it entirely, and it's hard to imagine a beleaguered mission support group commander or his chief civil engineer having the bandwidth to assimilate it either. But if they're selective, it's all here: organizing for energy management, starting a program, monitoring and metering, analyzing projects, energy efficiency, conservation of water and electricity, and on and on. All good stuff.

So unless I missed these sections, I have only 2 critiques: (1) that renewables only merit a 11 page discussion and it's a light treatment at best. Maybe that seemed right in 2005, but it sure seems wrong in 2008. And (2) that dependency on the fragile grid isn't discussed in more detail, and that moves to add more local generation via on-site renewables and/or on-site clean(er) coal or gas (or other) power aren't discussed, let alone incentivized in some way. This was written four years ago however, so I'll be checking to see if a revision is in the works, as well as whether an enterprise level equivalent is on the way.

Energy Security Alarm

From National Review's Clifford May, a stark assessment of damage caused if a high altitude nuke was exploded over continental USA. Among many negative outcomes, massive, sustained power outages. This makes a strong supporting argument, if you will, for highly distributed power generation, such as renewables deployed on bases and other Fed installations to make those sites far less dependent on the very fragile grid.