The sun could pose the largest digital security risk to U.S. critical infrastructure, according to witnesses at a House Oversight and Management Efficiency Subcommittee on Tuesday.
“All critical infrastructure sectors are at risk from EMP [electromagnetic pulse],” said Brandon Wales, director of the Office of Cyber and Infrastructure Analysis National Protection and Programs Directorate at the U.S. Department of Homeland Security (DHS).
Electromagnetic pulses, which can stem from both cosmic and man-made events, are predicted to have a massive potential impact on the security of national infrastructure. Joseph McClelland, director of the Office of Energy Infrastructure Security at the U.S. Department of Energy, noted that a solar storm, which took place in 1921, would have damaged 300 bulk power system transformers and affected 130 million people for potentially months to years, had it happened today.
“That is going to happen. It’s just a matter of timing when it occurs and the impact when it occurs,” McClelland said. “Widespread disruption of electric service can quickly undermine the United States government, its military, and the economy.”
“EMP incidents will likely create cascading effects across sectors,” Wales agreed.
Natural EMP events are not the only electromagnetic dangers to U.S. infrastructure, as the witnesses testified that there are also nation-states that have the technological capacity to manufacture EMP disaster.
“Any country that has a nuclear capability would have the capacity to generate an electromagnetic pulse from a nuclear weapon,” Wales said.
Though Rep. Bonnie Watson Coleman, D-N.J., said that EMPs are a “high-impact but low-probability risk occurrence,” the danger of such an event arises from a lack of coordination and leadership.
“It wasn’t clear–and frankly there was a lot of confusion in DHS–who was responsible for electromagnetic risks,” said Chris Currie, director of Homeland Security and Justice Issues at the U.S. Government Accountability Office. “More needs to be done to coordinate and prioritize efforts across the departmental stovepipes.”
Yet even with full government cooperation between both Federal agencies and local administrations, the efforts to protect and repair critical infrastructure most often fall to private industries.
“The ultimate burden for preparing for that type of event on the systems that operate our grid is going to be the utilities themselves,” said Wales. Currently private systems have some level of preparation for EMP effects, but not nearly on the scale that would be necessary to protect all critical systems.
“There’s a small amount of extra transformers that are maintained by industry, and they have a program to share those in case of a disruption,” Wales explained, though he noted that was largely for small-scale problems. He noted that the DHS’s Science and Technology Directorate is piloting a modular transformer that can be moved into areas of need.
“A lot of those repairs and mitigations are expensive and extremely, extremely time consuming,” said Judson Freed, director of Emergency Management and Homeland Security in Ramsey County, Minn. He cautioned that though EMP incidents can have disastrous effects, the low likelihood of such incidents does not warrant an extreme allocation of resources.
“Diverting limited resources from highly probable threats will make our nation less prepared for the risks and disaster that have proven to be perennial visitors,” Freed said of the burden on local governments. “Requirements like this can accumulate quickly and have the potential to disrupt the ongoing process of emergency management and planning coordination.”
But when asked whether the U.S. could effectively withstand an electromagnetic incident, Wales was blunt: “Clearly the answer is no.”
