A massive power failure that crippled life in Turkey for almost 10 hours on Tuesday highlights the threats facing electricity grids worldwide.
Turkey’s most extensive power failure in 15 years, which left people stranded in elevators and traffic snarled, wasn’t the result of a lack of electricity. The prime minister said all possible causes -- including a cyber-attack -- were being investigated.
While the source of the problem is still unknown, recent revelations that a 2008 oil pipeline explosion in Turkey was orchestrated via computer and the high-profile hacking last year on Sony Pictures Entertainment demonstrate the increasing ability to penetrate systems. For power grids, technology being added to make them more reliable and productive is also giving attackers an entry point into vital infrastructure.
“Every country, including the U.S., will be looking at it to see what the vulnerabilities were and learn some lessons about protection,” said Kit Konolige, a New York-based utility analyst for Bloomberg. “An electric grid is a complex system and it’s hard to ensure that it’s defended everywhere.”
Several foreign governments have hacked into U.S. energy, water and fuel distribution systems and might damage essential services, the National Security Agency said in November. A report by California-based cybersecurity company SentinelOne predicts that such attacks will disrupt U.S. electricity in 2015.
“More and more attacks are targeting the industrial control systems that run the production networks of critical infrastructure, stealing data and causing damage,” said David Emm, a principal researcher at Moscow-based security company Kaspersky Lab Inc., which advises governments and businesses.
All power use was previously measured by mechanical meters, which were inspected and read by a utility worker. Now, utilities are turning to smart meters, which communicate live data to customers and the utility company. This opens up the systems to hackers.
Turkey’s regional power grids have been investing to transform substations, transformers and circuit-breakers to smart devices since they were privatized starting in 2008, said Ugur Yuksel, coordinator of the nation’s Electricity Distributors’ Association, which governs all 21 grids in Turkey.
“The more you use telecommunication systems and Internet, the more exposed you are to cyber-attack,” Yuksel said by phone from Ankara on Wednesday, without speculating on the cause of the Turkish blackout. “The best way to minimize the threat of cyber-attacks on grids is to start using closed networks that employ Internet-based communication selectively.”
A domino effect of power plant failures that began on western Turkey’s Aegean coast caused blackouts all the way to the eastern part of the country, Energy Minister Taner Yildiz said at a conference in Istanbul on Thursday, according to state-run news Anadolu Agency. “We cannot say the reason why there were failures and a cyber-attack is not ruled out.”
Turkey’s national grid operated by the state power transmission company Turkiye Elektrik Iletim AS could be vulnerable to “decoding of encrypted information,” Yildiz said, without elaborating.
Supervisory systems used by operators are open to threats of cyber-attacks because they employ telecommunication systems, Yuksel said. In Turkey, like in many other countries, grid operators use fiber optic cabling networks and mobile services for data transmission, he said.
It is not only hostile states that target these critical infrastructures at the heart of the economy, but also “hacktivists, hooligans and criminals,” according to Kaspersky Lab. Research shows that most companies don’t invest enough in security technology -- systems are often outdated and only a third of the employees pay attention to cybersafety, said Kaspersky Lab’s Vyacheslav Borilin.
Germany, Europe’s biggest energy market, is in the midst of a push to expand and modernize its grid to integrate more renewable power. Smart meters installed in homes across Europe can communicate with a power supplier or the grid operator.
“Introducing smart meters means you install access points to the electricity grid in private homes,” said Reinhard Gruenwald, an energy expert at the Office of Technology Assessment at the German Bundestag, a scientific institution advising German lawmakers. “You can’t physically protect those. If criminals are smart enough, they may be able to manipulate them.”
Attacks on grids could cause major catastrophes globally, according to Nicholas Hanlon, project manager for critical infrastructure security at the Center for Security Policy.
“Clean water, hospitals, transportation, communications, and food storage, all depend on the electrical grid,” he said. “If the grid is down for a few days it’s no big deal. But imagine social order after two weeks.”