on virtually any metropolitan area. This impact is more severe than that implied in the statements of some witnesses in the Committee's previous hearing in February 1989.

In reaching this conclusion, we considered the extensive efforts utilities engage in to prepare for contingencies. Because events such as occasional equipment failure are common and inevitable, utilities consider them normal and plan for them. In fact, most bulk power systems in the U.S. are designed and operated to provide uninterrupted service even following the failure of any one device. In addition, because uncontrolled outages can be so widespread and difficult to recover from, U.S. utilities make special provisions to avoid or control them even though the circumstances leading to them are viewed as extremely unlikely. Under the extreme contingencies considered, outages may occur but should be relatively local, should not cascade across a system, and should be completely recovered from in a short time.

However, a terrorist attack could cause far more severe conditions than the extreme contingencies considered by utilities. For example, the extreme contingencies planned for by utilities today are typically limited to failures at a single site. An attack or natural disaster could well affect two or more major sites, however. The simultaneous failure of any well-chosen combination of two or more large multi-unit power plants, multicircuit transmission corridors, or multicircuit substations may well lead to cascading failures that are difficult to recover from.

In our analysis, we also considered the long-term resilience and redundancy of power systems. Except during peak demand hours of the year or when several major facilities are undergoing maintenance, U.S. utilities have large amounts of both generating capacity and transmission capacity in excess of demand. Because there are these generally large reserves, it would take the isolation of a very large number of facilities to keep any system entirely down for more than the several hours required to start idle capacity and restart the system. However, even after service has been restored, at certain times such as daily peak periods or when major facilities are undergoing maintenance, rotating outages may be inevitable. Reliability would also be degraded because of the fewer options available to respond to any further equipment failure.

What level of terrorist sophistication is required? The main requirement, in addition to the will to cause harm, is some general knowledge of how power systems work and specific information about the targeted system. OTA's study did not investigate the motivations, will, or capabilities of terrorists. An ongoing OTA assessment, "Use of Technology in countering Terrorism," is addressing these issues. The general engineering information is basic and can be found in textbooks and other sources. Specific information on utility transmission systems and generating plants is also publicly available and can be supplemented with direct physical observation.

Identifying the key facilities accurately appears to be the most difficult step, but it does not appear to be beyond the means of many people. There are many facilities, however, which have a similar appearance and can be confused for the key facilities. If attacked don't select the most critical facilities, they may nonetheless

do considerable damage, including causing widespread outages. However, the time requires to restore basic service, the overall reduction in reliability, and the outage costs should all be less.

Once the facilities have been selected, there are few or no significant physical obstacles to their destruction in most cases. The time required to carry out an attack is a matter of seconds.

Many additional measures can be taken to reduce the vulnerability of power systems to terrorism. This can be done by: preventing or minimizing damage to key pieces of equipment; reducing the consequences of any damage that does occur; and preparing to recover as rapidly as possible. No measures are perfect, and some level of vulnerability will always remain. A full range of options is given in Table 2 of the Introduction and Summary which Alan Crane included with his testimony.

The utility industry, working through the North American Electric Reliability Council, NERC, has made a series of recommendations intended to reduce vulnerability. However, OTA found that the level of implementation of these steps could be increased, and some potentially useful measures are available which the industry is less likely to take on its own initiative. For example, utility planning and analysis for extreme contingencies could be expanded to include simultaneous loss of several key facilities. This planning could examine both short-term responses-for example, how to shed load rapidly enough to keep at least some part of the system operating and long-term responses-for example, where to obtain spare parts and how to transport them to the necessary sites. These planning steps need not cost much but could significantly reduce the consequences of any damage and help speed recovery. Other steps such as erecting walls and implementing remote surveillance equipment at key unmanned facilities could also be pursued, greatly increasing resistance to certain types of attack. The cost of such physical hardening could be a small fraction of one percent of a utility's total costs.

The Federal Government could do more. For example, Department of Energy could play a larger role in working with the utility industry. DOE could perform a detailed, dependent examination of the steps suggested by NERC, and review the level of voluntary implementation among NERC's member utilities. For example, during the February 1989 hearing this Committee held, NERC described one key step in its security plan: a data base they were developing of spare transformed available for us in energencies. A detailed independent analysis of the availability, electrical characteristics, location, and transportability of key spare equipment, as shown in this data base, could be useful in determining the adequacy of the existing inventory.

Other agencies could also take a greater role at low cost. For example, FEMA and Department of Energy could expand their cooperation with NERC, individual utilities, and State and local governments to analyze a wide range of disasters and help plan emergency responses. Their existing efforts could be increased. The FBI could be required to develop and maintain communication channels with utilities. NERC has recommended that utilities establish communication channels with the local FBI office, as noted in the

hearings previously. However, a utility's decision to establish such a liaison with the FBI is purely voluntary.

Should any additional steps be taken? The desirability of further action is a matter of opinion and depends on the nature of the perceived threat. If in the judgment of policymakers the threat is greater than is being recognized by industry and Government, then policy action may be justified. There are many low- and moderatecost options from which to choose.

Thank you, Mr. Chairman. That concludes my remarks.

Chairman GLENN. Thank you. Would you want to expand on those things that the Federal Government could do? You say the Federal Government could do more and that DOE could play a larger role in working with the utility industry. Is that not done now? Do we not have any meetings to assess the general vulnerability of the whole system? I thought the Government was fairly active in that area.

Dr. Roy. Well, for an example, the recommendations put together by NERC, there was a 12-point plan suggesting what utilities could do. The Department of Energy has reviewed these plans and recommendations, but there could be additional review in detail about what is included in those plans.

For example, one of the key components in NERC's suggested recommended steps is to develop this transformer data base. Now, the usefulness of existing spare transformers depends on their location, what voltage characteristics they have. For example, if there are a lot of extra high voltage transformers, the 765-kV class, held as spares by the American Electric Power Company, which is the only company that has this type of transformer, basically—it is the major one. If most of the transformers in the data base which NERC has put together are of this particular class and are located in that area of the country, the spares included are not of much value for a terrorist attack or damage occurring in California where different voltage classes exist.

Chairman GLENN. Or even a natural disaster. I don't want to tie everything just to a terrorist attack. I know that is the one that we sometimes deal with; however, even natural disasters can knock out some of these things. As I recall from our previous hearings, there were particular types of transformers that are not generally available, and, as I recall, they were very heavy. If one of them is knocked out, it is debatable whether a replacement could be transported for quite a period of time. There were only, as I recall, very few railroad cars that could accept the weight of these transformers, and they had to be specially routed to get around the country. Is that correct?

Dr. Roy. This is true. The largest power transformers can weigh up to 500 tons. They are very large, and they are difficult to transport. They also take a long time to manufacture, and they are special ordered. Some of these largest transformers may take several months, up to a year to manufacturer.

Chairman GLENN. Does DOE as a matter of routine now review NERC and industry implementation plans?

Dr. Roy. In some level of detail, there is a review of what NERC has suggested-the implementation of NERC's steps. It is not clear that they go into as much detail as they could go into. For exam

ple, looking at or performing independent analyses of the location of the transformers and the data base; following up with the utilities to find out which utilities are establishing and maintaining liaison with the FBI, following up individual utilities their level of implementation.

Chairman GLENN. Either one of you, does DOE review the plans to see whether certain classes of equipment are available in sufficient supply?

Mr. CRANE. Not to my knowledge. DOE has a good working relationship with the North American Electric Reliability Council, but they have no formal review over that. So they would not necessarily have this plan. To the best of our knowledge, they do not have an inventory of transformers, for instance. That is left to NERC.

Chairman GLENN. Well, we have Mr. Easton with us to testify in a little while. We will ask him some of those questions. He is from the Department of Energy, and perhaps, he has the answers.

Are there other types of equipment that could be knocked out that are as critical as transformers? Or are they the key items? Dr. Roy. Those are the key items, and it is particular classes of the transformers and only a certain subset of those.

Mr. CRANE. There is plenty of equipment that would have the same immediate effect if it was knocked out but will be much easier to replace.

Chairman GLENN. You mentioned that California does some particular things because they are earthquake-prone. Do we not do that in the rest of our system? I also noted in your report on page 9-it sort of jumped out at me, and you probably know what I am referring to. At the bottom of page 9, it says, "According to the American Association of Engineers, it is very likely that a destructive earthquake will occur in the Eastern United States by the year 2010." Usually earthquake predictors don't like to predict a certain date, but this is what they are predicting. "The central Mississippi valley, the southern Appalachians, and an area centered around Indiana have the highest potential for earthquake damage. An earthquake similar to the New Madrid series would seriously affect 12 million people in seven States."

Now, I also noted that the footnote refers to a study done in 1986, is that correct, December of 1986? That is just about 21⁄2 years ago. That is a fairly recent study.

Are the eastern nets and grids less prepared than California?

Mr. CRANE. In most parts of the country, seismic standards have not been included in building codes or in general practices. You need the constant reminder of many earthquakes before people will go to the extra cost.

Chairman GLENN. I believe you said that California designs their systems with regard to earthquakes. What do they do that is not being done in the East?

Mr. CRANE. It is this question of how strong do you have to build support structures. For instance, do you design the concrete pads, the steel beams to hold a transformer down, the bolts that hold it down, is the thing just beefy enough to withstand a fair amount of earth movement?

Chairman GLENN. And do they, within the State, insist on better bases for these things than we do in the East?

Mr. CRANE. Yes, because they have known all along that they were going to be hit by a major earthquake sooner or later, so it is just common sense. In areas where it only happens once every hundreds years, you just don't think about it.

Chairman GLENN. If we go back in history, we have a history in the East of earthquakes just as violent or even worse than the famous San Francisco earthquake.

Mr. CRANE. Yes.

Chairman GLENN. Because you get into the one that happened in Missouri.

Mr. CRANE. New Madrid, Missouri.

Chairman GLENN. New Madrid was the one. There was also the one in Charleston, South Carolina, back in the 1800's which pretty well leveled things. So we are not exempt from earthquake concerns in this part of the country.

In terms of geomagnetically induced currents (GIC), I believe we are on the upswing into a high solar cycle time. Are we pretty well protected against any GIC problems, or are we still vulnerable in that area?

Dr. Roy. We are on the upswing of the geomagnetically induced currents which affect long transmission lines, mainly, and can destroy transformers at the end and cause other equipment to trip out, to disconnect from the system.

It is difficult to prepare for this type of geomagnetically induced current. We don't have warning of when a solar storm is coming, when these types of currents will be induced on transmission lines. The equipment is not designed in a way to handle such currents on its. Utilities are working-for example, there are research programs through Electric Power Research Institute and others-to identify ways to protect equipment, to stop these currents from flowing through the system, these unwanted currents in the system. But, no, utility systems are generally not protected from solar storms, solar disturbances.

Chairman GLENN. Do we not have cutouts, circuit breakers that can cover that?

Dr. Roy. The nature of this problem is to induce a direct current, to superimpose a direct current on the normally 60-cycle alternating current. The equipment, the circuit breakers respond when high alternating current levels are realized-this is my understanding-but it does not behave in a way that responds to direct currents-direct currents behave in a different way than the alternating currents, and so the protected equipment is not designed to respond properly. Apparently, it is quite difficult to design ways to protect the equipment.

Chairman GLENN. And there is no way that I know of that any terrorist could induce a current like that which comes from the GIC's. Or is there?

Dr. Roy. No. There are very large forces. There are possible threats from electromagnetic pulse, from atmospheric blasts of nuclear weapons, but it is more than the casually, moderately sophisticated terrorist attack.

Chairman GLENN. If we had an EMP from a nuclear blast, would that do the same thing as a GIC?