Are Manchurian Candidates Lurking in the Electric System?

There are worries afoot in the electric utility world.

The issue is the integrity of the grid and the possibility that foreign suppliers of bulk power equipment (BPE) may have introduced the technical equivalent of Manchurian candidates into the hardware that manages the system.

This represents a departure from previous concerns that have emphasized software and paid more attention to attacks aimed at the computer systems of electric utilities than to their hardware. They get millions of these attacks every day and have worked relentlessly to protect against them.

Now a new front has opened.

The battle has moved from the world of internet technology to the hardware itself, to BPE. Leading the charge to draw attention to systems whose vulnerability may have been overlooked is Joe Weiss, a professional engineer, a veteran of the Electric Power Research Institute in Palo Alto, California, and now an independent consultant.

Weiss said in a blog, which went viral in the world of utility engineers last week, “Why would attackers hit defenses head-on when they can simply bypass them?” And that is exactly what they’re doing, he believes.

On May 1, President Trump issued the far-reaching Executive Order 13920, which prohibits the purchase of major BPE from potential adversaries, later named by the Department of Energy as China and Russia, among others.

China is the primary supplier of BPE to American utilities.

Then, on July 8, the department issued a request for information about what the electric utilities purchase and from where. It appears the government is attempting to scope the problem.

Initially, many in the industry thought the executive order was just another shot in the Trump administration’s trade war with China. But not so. It signaled what may be a big vulnerability not only in installed equipment but also equipment that is on order.

China has become the primary supplier of heavy equipment for utilities, particularly big transformers. While these have no moving parts, Weiss believes they can have “backdoors” through which an adversary could catastrophically alter their operation.

The key, he says, may be the sensors that can send false readings and bring about major disruption, and send parts of the grid haywire.

Transformers are critical to the distribution of current. They boost voltage to compensate for line losses and ultimately step down the voltage for local distribution.

This vulnerability story began after the terrorist attacks of 9/11, when a trend to look at the security of the electric grid turned to a greater concentration on IT and, some argue, away from the old regime of operational technology, where engineers took responsibility for the security of their equipment.

A cultural division opened, as I was told by the one of the nation’s top computer experts in academia.

Underlying this shift in responsibility are the workhorses of modern industry, programmable controllers, part of the larger Industrial Control Systems. These are the automated systems that do the work of managing operations in modern industry, including utilities.

The worry for the electric utility industry is that these devices that manage the grid could be manipulated without showing up as an attack.

There is precedent for this kind of attack: The Stuxnet virus that disabled centrifuges at Iran’s Natanz nuclear facility in 2010. The United States and Israel didn’t go after the facility’s computer system — an attack that would’ve been detected — but rather after the controllers governing the centrifuges.

Last year, something big was discovered, and details are sketchy: A Chinese-made transformer at a large investor-owned utility was found to have counterfeit parts and, perhaps, backdoors through which the integrity of the grid could’ve been compromised.

Alarm bells rang at the departments of Homeland Security and Energy.

A similar or identical transformer made by JiangSu HuaPeng Transformer Company Ltd., a family owned company with a small office in San Jose, California, was seized by agents of the DHS and DOE and hustled straight to Sandia National Laboratory in Albuquerque, New Mexico, upon its arrival at the Port of Houston.

This transformer had been destined for the Western Area Power Administration’s Aluit Station, near Denver. WAPA is one of the power distribution systems owned by the government through the Department of Energy.

What, if anything, has been discovered in the transformer hasn’t been disclosed.

Everything is cloaked in secrecy, my sources tell me.