WASHINGTON, D.C. – U.S. Senators Jim Risch (R-Idaho), Angus King (I-Maine), Martin Heinrich (D-N.M.), and Susan Collins (R-Maine), all members of the Senate Intelligence Committee, today introduced legislation aiming to protect critical U.S. energy infrastructure from potentially catastrophic cyber-attacks. The Securing Energy Infrastructure Act of 2016 would examine solutions to defend the U.S. energy grid by replacing key devices like computer-connected operating systems that are vulnerable to cyber-attacks with analog and human-operated systems – a “retro” approach that has shown promise as a safeguard against cyber-attacks.
“Protecting our critical energy infrastructure systems is one of the most pressing security challenges facing the United States today,” said Senator Risch. “The continual emergence of threats and vulnerabilities to digital systems has created significant weaknesses that require a large-scale, national effort to address, which is the intent of this legislation. The Idaho National Lab has the unique assets and expertise needed to drive the innovations this legislation aims to create and we are fortunate to have their leadership on this critical issue.”
Top officials within the Intelligence Community have testified that U.S. critical infrastructure are enticing targets to malicious actors. Those officials have also warned that, without action, the U.S. remains vulnerable to cyber-attacks that could result in catastrophic damage to public health and safety, economic security, and national security.
This bill would examine ways to replace automated systems with manual procedures controlled by human operators to remove vulnerabilities that could allow cyber-criminals to access the grid through holes in digital software systems. This approach seeks to thwart even the most sophisticated cyber-adversaries who, if they are intent on accessing the grid, would have to actually physically touch the equipment, thereby making cyber-attacks much more difficult.
The potential for this approach was evident in the December 2015 cyber-attack on Ukraine’s power grid during which sophisticated cyber-attack techniques were used to plunge more than 225,000 people into darkness. According to the Department of Homeland Security, the cyber-attack was coordinated to target the Ukrainian power grid’s industrial control systems, which act as the intermediary between computers and the switches that distribute electricity. The attack could have been worse if not for the fact that Ukraine relies on manual technology to operate its grid. The legislation seeks to build on this concept by studying ways to strategically use “retro” technology to isolate the grid’s most important control systems.
More specifically, the legislation would:
To read the text of the legislation, click HERE.
###
“Protecting our critical energy infrastructure systems is one of the most pressing security challenges facing the United States today,” said Senator Risch. “The continual emergence of threats and vulnerabilities to digital systems has created significant weaknesses that require a large-scale, national effort to address, which is the intent of this legislation. The Idaho National Lab has the unique assets and expertise needed to drive the innovations this legislation aims to create and we are fortunate to have their leadership on this critical issue.”
Top officials within the Intelligence Community have testified that U.S. critical infrastructure are enticing targets to malicious actors. Those officials have also warned that, without action, the U.S. remains vulnerable to cyber-attacks that could result in catastrophic damage to public health and safety, economic security, and national security.
This bill would examine ways to replace automated systems with manual procedures controlled by human operators to remove vulnerabilities that could allow cyber-criminals to access the grid through holes in digital software systems. This approach seeks to thwart even the most sophisticated cyber-adversaries who, if they are intent on accessing the grid, would have to actually physically touch the equipment, thereby making cyber-attacks much more difficult.
The potential for this approach was evident in the December 2015 cyber-attack on Ukraine’s power grid during which sophisticated cyber-attack techniques were used to plunge more than 225,000 people into darkness. According to the Department of Homeland Security, the cyber-attack was coordinated to target the Ukrainian power grid’s industrial control systems, which act as the intermediary between computers and the switches that distribute electricity. The attack could have been worse if not for the fact that Ukraine relies on manual technology to operate its grid. The legislation seeks to build on this concept by studying ways to strategically use “retro” technology to isolate the grid’s most important control systems.
More specifically, the legislation would:
- Establish a two-year pilot program within the National Laboratories to study covered entities and identify new classes of security vulnerabilities, and research and test technology – like analog devices – that could be used to isolate the most critical systems of covered entities from cyber-attacks.
- Require the establishment of a working group to evaluate the technology solutions proposed by the National Laboratories and to develop a national cyber-informed strategy to isolate the energy grid from attacks. Members of the working group would include federal government agencies, the energy industry, a state or regional energy agency, the National Laboratories, and other groups with relevant experience.
- The Secretary of Energy is required to submit a report to Congress describing the results of the program, assessing the feasibility of the techniques considered, and outlining the results of the working groups’ evaluation.
- Define “covered entities” under the bill as segments of the energy sector that have already been designated as entities where a cyber-security incident could result in catastrophic regional or national effects on public health or safety, economic security, or national security.
To read the text of the legislation, click HERE.
###
