Are We Ready for a Cyber Attack?

Are We Ready for a Cyber Attack?

Published August 23, 2018

Narrator: Cyber attack scenarios against critical infrastructure have been a concern for the Department of Homeland Security at least since 2007—when the agency commissioned an experiment called Aurora. The question experts wanted to answer was a simple one. Could a purely digital cyber attack disrupt or disable a large generator connected to the power grid?

Perry Pedersen: I was the director of the control system security program at the Department of Homeland Security. And during that time, I ran the project that many people are familiar with called Aurora.

Narrator: A team of electrical engineers brought a 27-ton, heavy-duty diesel generator to a specially built testing facility at the Idaho National Lab. After connecting the generator to the power grid, they challenged a team of computer security experts to use computer code to knock the generator off line. The test was monitored via closed circuit TV.

Pederson: In the video, you’ll see it running, humming along normally. And then you see the first hit...the first jump. You see the generator shudder.

Narrator: The jump occurred almost immediately after the would-be attackers sent the first packet of malicious computer code.

Pederson: We wanted to hit it and then wait and collect data and see what was happening and then hit it again, collect some data and kind of watch the progression of the damage to the generator.

Narrator: After the second attack, the generator lurched again, belched ominous smoke and ground to a halt. Not only was it knocked off the grid – it was rendered completely inoperable.

Joe Weiss: What they found when they opened the generator was just failures with almost all parts of the generator, both mechanical and electrical. So what you’re really talking about is essentially what you would do with pieces of dynamite.

Pederson: This was a tough machine. This was heavy duty. And it was designed to run in severe conditions. If you were actually doing that attack, there’s no reason to pause and wait in between. You simply put your software on a loop, and you just keep hitting it until it breaks.

Narrator: An attack like this could take less than a minute. But leave consequences that would last for months.

Joe Weiss: If you damage or destroy these, you can't just go down to your neighborhood hardware store and buy another. It could take you maybe six to nine months to get another one of these.

Narrator: And according to a government study, a coordinated attack on fewer than a dozen power stations could cause a massive outage—far more devastating even than the historic blackout that hit the Northeast in 2003.

Female News Reporter: The brightness of car headlights is the only visible sight on 42nd Street tonight as thousands wait under a cloud of total darkness.

Kim Zetter: All you would need to do is take out about nine substations in an attack that could result in a blackout for the majority of the U.S. that could last weeks or months depending on how the attack was designed.

PRODUCTION CREDITS