How the Electromagnetic Pulse Threat Changes Plant Security

On September 3, 2017, North Korea's state news agency claimed the nation is capable of an electromagnetic pulse attack against the United States, according to The Wall Street Journal. The attack would involve detonating a nuclear weapon miles above Earth to shut down the power grid. Although an op-ed in The Hill claims such an attack "could kill 90 percent of Americans," that number can actually be traced back to a line in the novel One Second After. Still, even if that outcome is fiction, the threat is fact. To protect plant security, managers must be aware of the threat and take steps to protect against, respond to, and recover rapidly from an EMP attack.

Unlike cyberattacks, which have been carried out successfully and may be the greatest threat to plant security, no one knows exactly what an EMP attack would do. Robin Manning, vice president for transmission and distribution for the Electric Power Research Institute, told the Senate Energy and Natural Resources Committee: "Much of the available information is not specifically applied to electric utilities, making it very difficult for utilities and regulators to understand effective options for protecting energy infrastructure."

All EMP Is Not Created Equal

In an attack, two primary types of EMP could impact plant security: E1 and E3 waves. E1 waves are short, high-energy bursts that can cripple long-haul electrical systems, computers, sensors, and utility and industrial control systems. These waveforms are implicated in a nuclear attack, and the first line of defense is the military and intelligence community.

E3 waves are longer, lower-energy bursts that can generate electric current in power lines and equipment, damaging or destroying transformers, generator stations, and other equipment. These waveforms are associated with localized, directed-energy EMP weapons that cause damage similar to a physical attack. Defense calls for physical protection measures, like access control and redundant systems. But either a nuclear or coordinated, directed-energy EMP attack could knock out wide areas of the grid.

Industry and Government Develop a Joint Strategy

Although all electric utilities are subject to mandatory reliability standards, no standards apply specifically to EMP—nor has the Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability Corporation (NERC) to develop any. Acting FERC Chairman Cheryl LaFleur said that the FERC should not launch a mandatory standard unless the standard would mitigate the EMP threat effectively and at a justifiable cost.

The Department of Homeland Security didn't include a high-altitude EMP attack among its 15 planning scenarios for security preparedness. But to fill the void, the Department of Energy and Electric Power Research Institute began developing an EMP resilience strategy with industry early in 2016. In July 2016, they released the Joint Electromagnetic Pulse Resilience Strategy, which contains action items for individual plant security and the entire grid. Several mitigation strategies are being considered, including the following:

• Identifying Priority Infrastructure: Although managers can best identify critical components and systems at their plants, the DOE is charged with reducing vulnerabilities on a national level. In an attack, plants may need the capability to failover to redundant or backup systems that are not powered up.


• EMP Shielding: Surrounding electronic equipment with protective metallic shielding, like that used for military vehicles and communications, reroutes damaging electromagnetic fields and can harden vulnerable plant systems. This would require EMP testing of grid components, systems, and protection.


• Stockpiling Spare Equipment: Back in 2006, the EPRI was instrumental in launching the Spare Transformer Equipment Program, which joined together more than 50 utilities to share assets in a catastrophic event.


• Islanding: To help prevent the cascading outages expected in a nuclear attack—and to speed recovery—the DOE also plans to assess the risks and benefits of dividing the grid into preplanned islands.


• Black-Start Capability: Black starts after EMP-induced damage could be daunting given damaged or destroyed electrical equipment and telecommunications. Without the external grid as a resource, plant operators need to be prepared for the lack of a load to restart generation systems.

Fundamental security practices for other threats ultimately apply to EMP attacks, as well. That means modeling the threat to develop potential attack scenarios and impacts, then prioritizing the magnitude and likelihood of the risk in your overall risk management strategy. Plant managers should also keep up with government and industry initiatives to combat EMP attacks and work with them to reduce vulnerabilities and develop the resilience to respond and recover quickly.