Electricity is fundamental to modern life. It fuels our government, the military, our hospitals, businesses, and homes. In the future it may power significant parts of our transportation fleet. Glancing at the figure, it's hard to imagine social continuity without a reliable supply of electricity.

Concern about grid security is nothing new. There has long been a danger from terrorists blowing up key substations and taking out large blocks of electricity consumers. The US federal government admits that the legacy grid is also susceptible to electronic attacks from cyberspace. In 2009, reports surfaced that unidentified assailants had infiltrated the U.S. electrical grid and left behind programs that could be used to disrupt the system.

The vulnerability of the grid represents a threat to national security and business continuity. Maintaining electrical service in the event of a crisis is crucial. Major military bases can isolate themselves from the grid and run off their own private generators and microgrids. But even the military would experience disruptions from civilian supply breakdowns in the event of regional blackouts. Businesses are the lifeblood of the economy and need to be able to continue operations. The economic impact of a grid failure can be enormous. The economic losses attributed to the 2003 blackout were at least $10 billion.

Given its reliance on digital networks, there is concern that smart grid will be even more vulnerable to cyber attack. Massive power outages caused by a cyber attack, could disrupt the economy, camouflage a military attack, or spread fear and panic. Bruce Willis' movie Die Hard 4 brought the specter of grid hijacking to the mass Hollywood audience. When designed properly, nothing like the movie will ever happen.

The Energy Independence and Security Act of 2007 directs federal agencies to support the modernization of the grid, including cyber security. The Department of Homeland Security (DHS) works with the utility industry to identify and minimize grid vulnerabilities. They are also working to ensure that security is built into the smart grid as it develops. The top-level regulator, Federal Energy Regulatory Commission (FERC), coordinates work across agencies. The Department of Energy (DOE) specifically requires all smart grid projects funded with stimulus dollars to include privacy and security measures in their proposals. The Electric Power Research Institute (EPRI) is working with the National Institute for Standards and Technology (NIST) to set standards for smart grid development. Together, they are responsible for leading the effort to establish electronic security standards.

The building blocks of smart grid include advanced meter infrastructure (AMI), transmission and distribution automation, distributed generation, electric vehicle charging, and dispatchable renewable energy generation.
AMI ties together the meters on the smart grid for a given utility and a given service territory. One of the things that makes a new digital meters “smart” is the ability to transmit and receive information from its (private) digital network connection. The network connection is used to read the meter remotely. In older designs, utility meter readers would drive down the street with a digital receiver automatically recording data from each meter. In the smart grid, these readings will be sent upstream through the grid's digital overlay network for permanent recording at the utility operation center. Data capture, transmission, and recording leads to concerns about privacy.

Privacy. Smart Grid technology potentially lets your utility know who, what, when, where, how much electrical stuff you are doing inside your home. Instead of simply logging a running total for electricity usage, smart meters will log data with a date, time, and usage every 15 to 60 minutes. They will also collect power quality data such as voltage, phase, and frequency. They can also gather detailed operating information from networked thermostats, smart appliances, vehicle chargers, and anything else on the home area network.

This is all for the good. The utility can use this information to help its customers reduce their energy use and save money. Appliance manufacturers will be able to remotely diagnose problems so they can send a repair professional with the right parts. Medical device manufacturers will do the same. Over time, the scope and scale of organizations wanting access to meter data will grow (think law enforcement, public safety, social services, insurance companies, etc.). But where there is light, there is dark. And it's the bad guys we worry about.

Smart grid surveillance will be a concern to consumers wishing to maintain a high degree of privacy. But it should be a concern to anyone who might not want the bad guys to know when they are away from home. Access to meter data gives potential burglars an electronic profile of daily activities otherwise hidden inside the home. The bad guys would be able to “case the joint” remotely. In competitive electricity markets, competing utilities could try to get this data for industrial espionage to attract and retain the most profitable customers. Just as the Internet enabled new threats such as identity-theft, the future will bring new ways to exploit meter data.

Security. Going beyond privacy, the current generation of smart meters have much more functionality than old ones. Burglars, terrorists, and others with political agendas could use unauthorized access to AMI command and control systems to disrupt the delivery of services, create blackouts, disrupt load balancing commands, or create fear and panic. Crackers may be interested in breaking into command and control systems for personal satisfaction and/or bragging rights.

Some utilities will use the meter network connection to connect and disconnect electrical service. It's a money-saving extension to meter reading. This leads to speculation about the potential for “drive-by blackouts” in which a vehicle-mounted device could break into a wireless meter network and send commands to shut-off service. Since the meter network is localized at the neighborhood level, these would be relatively small-scale problems. If the attackers were to break into the network at the utility operations center, disconnect commands could (theoretically) be issued system-wide. Even still, electricity distribution is highly decentralized across thousands of utilities. So an attack on one utility will not necessarily take out other utilities.

With proper security in place, smart meter deployments and grid optimization should make the grid stronger and more resilient. Much of the grid is already automated but with older technology that may not be able to withstand new types of electronic threats. The smart grid's advanced capabilities will allow utilities to anticipate problems and mitigate its effects on the system. It will support broad use of distributed generation and storage. These will give some customers the capability to operate in island mode, isolating themselves from the public grid.

There is a lot of work to do in the area of grid security and privacy. It is crucial to confront and solve problems during the development phase. It won't be easy, but given that we successfully run our government, the military, our hospitals, and businesses on computer and communications technology, we have the intelligence and the technology to surmount similar challenges on the smart grid.