RICHMOND, Va. (WRIC) — U.S. Senator Mark Warner, who chairs the Senate Intelligence Committee, said more needs to be done to protect the nation’s power grid.
Law enforcement officials say targeted gunshots at two substations in North Carolina knocked out power for 45,000 customers this week. It’s still unclear who is responsible for the attack, but in an interview on Wednesday, Warner called it a cautionary tale.
“There are huge vulnerabilities and the fact that someone with ‘criminal intent,’ that’s what the FBI has said, could take a couple of pot shots and literally throw a community into darkness for days, it’s one of the reasons why we need to make sure our electric grid is a lot more resilient,” Warner said.
Gaps in electric grid security have been well-documented for years.
For instance, a federal government report leaked to the Wall Street Journal after another high-profile substation attack nearly a decade ago found that the U.S. could suffer a “coast-to-coast blackout” if criminals successfully shut down just nine of the country’s 55,000 electric-transmission substations.
Warner said steps have been taken since then to improve the strength of the system.
“But how many of those [substations] is it at this point that you’d have to take out? I don’t know,” Warner said.
A recent write-up from the Government Accountability Office, Congress’s non-partisan watchdog, said the system, in some ways, is weaker today than it was in the past.
“For example, grid distribution systems—which carry electricity from transmission systems to consumers—have grown more vulnerable, in part because their operational technology increasingly allows remote access and connections to business networks. This could allow threat actors to access those systems and potentially disrupt operations,” GAO said.
The Director of National Intelligence’s 2022 Annual Threat Assessment said nations and criminal groups pose the most significant cyber threats to U.S. critical infrastructure and bad actors are increasingly capable of attacking the grid.
Warner said a law he wrote that is now being implemented will require the reporting of cyber incidents and ransomware payments. The goal is to allow the Cybersecurity and Infrastructure Security Agency (CISA) to deploy resources, render assistance and spot trends more effectively.
Warner said new federal infrastructure investments will also help build better backup systems that can serve as a safety net during outages.
“It was only in the last year and a half that we finally put some money where our mouth was in terms of both the infrastructure bill and the more recent investment in greener energy. And a lot of that also included, for example, incentives to build more transmission, to go ahead and build that kind of backup and resiliency that we need,” Warner said.
The stakes are particularly high in Virginia because the state’s infrastructure serves critical national security hubs like the Pentagon, in addition to homes and businesses.
Dominion Energy, Virginia’s largest electric utility, didn’t agree to an on-camera interview on Wednesday. Craig Carper, a spokesperson for Dominion, said information on security procedures requires extensive vetting from dozens of parties.
“We are committed to safeguarding our infrastructure to help minimize the impact of potential natural and man-made threats to protect our system. We have made focused and significant investments in both protecting our substations from physical and cyber threats while adding dedicated and professional personnel for monitoring and response,” Carper said in an email.
It’s not clear how much Dominion has invested in security and what specific measures are in place. Carper has yet to respond to follow-up questions sent on Wednesday morning.
Carper said Dominion Energy Virginia has not experienced any threats to their substation infrastructure since the Duke Energy attack in North Carolina on December 3rd.
“Dominion Energy personnel are communicating with federal, state, and local law enforcement, intelligence agencies, and industry peers to proactively assess the North Carolina incident,” Carper said. “Monitoring activities have been heightened as a precaution in response to these unfortunate events.”
