A video produced for the Homeland Security Department and obtained by The
Associated Press yesterday shows the potential destruction caused by hackers
gaining control of a crucial section of the US electric grid and causing an
industrial turbine to spin out of control until it belches black-and-white and
flies into pieces, shutting down power.
"They've taken a theoretical attack and they've shown in a very demonstrable
way the impact you can have using cyber means and cyber techniques against this
type of infrastructure," said Amit Yoran, former U.S. cybersecurity chief for
the Bush administration. Yoran is chief executive for NetWitness Corp., which
sells sophisticated network monitoring software.
"It's so graphic," Yoran said. "Talking about bits and bytes doesn't have the
same impact as seeing something catch fire."
The recorded demonstration, called the "Aurora Generator Test," was conducted
in March by government researchers investigating a dangerous vulnerability in
computers at U.S. utility companies known as supervisory control and data
acquisition systems. The programming flaw was quietly fixed, and
equipment-makers urged utilities to take protective measures.
There was no evidence any U.S. utility company suffered damage from hackers
or terrorists using this technique, U.S. officials said. But these officials
cautioned that affected systems are not routinely monitored as closely as many
modern corporate computer networks, so there would be little forensic evidence
to study after such a break-in.
"The video is not a realistic representation of how the power system would
operate," said Stan Johnson, a manager at the North American Electric
Reliability Corp., the Princeton, N.J.-based organization charged with
overseeing the power grid.
A top Homeland Security Department official, Robert Jamison, said companies
are working to limit such attacks.
"Is this something we should be concerned about? Yes," said Jamison, who
oversees the department's cybersecurity division. "But we've taken a lot of risk
off the table."
President Bush's top telecommunications advisers concluded years ago that an
organization such as a foreign intelligence service or a well-funded terror
group "could conduct a structured attack on the electric power grid
electronically, with a high degree of anonymity, and without having to set foot
in the target nation."