VULNERABILITY OF THE NATION'S ELECTRIC SYSTEMS TO MULTISITE TERRORIST ATTACK

THURSDAY, JUNE 28, 1990

U.S. SENATE,

COMMITTEE ON GOVERNMENTAL AFFAIRS,

Washington, DC.

The Committee met, pursuant to notice, at 9:35 p.m., in room SD-342, Dirksen Senate Office Building, Hon, John Glenn, Chairman of the Committee, presiding.

Present: Senators Glenn and Lieberman.

OPENING STATEMENT OF CHAIRMAN GLENN

Chairman GLENN. The hearing will be in order.

Today, the Governmental Affairs Committee is holding its third hearing to examine the vulnerability of the Nation's electric power systems to potential terrorist activities. In particular, today's hearing will focus upon what more can and should be done by the Federal Government, in cooperation with industry, to mitigate any potential threats. It is the responsibility of the Congress to ensure that the Federal Government organization and planning are appropriate to the potential threat and vulnerability. This topic is very sensitive, obviously, but absolutely vital to public interest. While we will not specifically identify key targets, we will discuss the nature of the vulnerabilities faced by electric utilities to a carefully planned, multisite terrorist attack.

This morning, as a basis for this hearing, we are releasing a study by the Office of Technology Assessment, "Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage," 1 which discusses the nature of the vulnerability and options to reduce it. This study, a copy of which I have here, is included in the press packet as part of the information being passed out and released this morning for the first time. We are particularly interested in the differences between OTA's findings and the opinions and understandings previously expressed by witnesses on this topic during a hearing held by this Committee in February of last year. In the 16 months since that hearing, the Nation's power systems have been faced with manmade disasters, such as terrorists disabling a transmission line in northern California, which put some 92,000 households into darkness for several hours; and natural disasters, such as the San Franscisco earthquake and Hurricane Hugo.

Faced with these challenges, the Nation's utilities, with the support of Federal agencies, demonstrated their commitment to reliable service to the community and their resourcefulness in responding quickly.

There are two key questions for this hearing. First, does the past exemplary performance by responsible Federal agencies and the utility industry, working together, in coping with natural disaster indicate that sufficient action has been taken to ward off a terrorist-caused disaster? And, second, are we prepared to respond to a terrorist attack if one should occur? Unfortunately, I believe the answers are no, not necessarily. It is possible that utilities may be faced with even more damaging and debilitating events in the future. For example, could a small group of sophisticated terrorist carefully plan a multisite attack, selecting and destroying equipment with far more damaging effect than could a natural disaster or uninformed attacker? The OTA report implies that the answer to this question is yes, and that the result of such an attack could exceed anything experienced to date.

The Federal Government and the utility industry are jointly pursuing a modest program to reduce vulnerability. Obviously, more could always be done. We could do such things as placing walls and intruder detection systems around key facilities. However, whether more should be done depends on the perceived nature of the threat and, obviously, the cost of the remedy. No one is advocating a Maginot Line strategy to physically isolate and protect all such facilities. At today's hearing, we will investigate specific examples of additional low-cost steps that could be taken and examine how the Government can more effectively encourage implementation of those steps which should be taken.

There is always the concern that discussing these topics may even encourage terrorist activity, and we have been very, very careful to stay short of that line. Obviously, it is not our intent to do that, and we are extremely sensitive to the concern. We will not discuss any details which can be used as a blueprint for terrorist activities. As a precaution, I instruct the witnesses that if they believe the answer to any question is unusually senstive and should not be made in public, they should indicate such. Similarly, no specific location should be mentioned.

In this regard, let me commend OTA for its report. It is an excellent report. At the same time, however, I want to recognize the particular irony surrounding the fact that a portion will not be available to the public. The entire report was prepared from unclassified sources, including the key chapter of the report concerning the potential vulnerability of the system to multisite terrorist attack. That chapter is being withheld by OTA from the public based on objections from the Department of Energy and other security agencies that it provided too clear an analysis of how to damage the power system.

This hearing recognizes the importance of the vulnerability issue and addresses the opportunities for improvement. We must be sure that responsible Federal agencies are doing enough, and that while cooperation with industry in this area is maintained, the public is adequately protected from the impact. In our free and open democracy, public discussion of such issues is not merely acceptable, it is

crucial to the Nation's well-being. Conducting this hearing, which develops positive steps to reduce vulnerability and evaluates Federal agencies' response plans to terrorist attacks, is vastly preferable to conducting an investigation in the aftermath of a severely disrupting event.

Today, we have with us Mr. Alan Crane and Dr. Robin Roy from the Office of Technology Assessment to discuss their report; Mr. William F. Jones, Associate Director, National Preparedness Directorate of the Federal Emergency Management Agency, FEMA; and Mr. John Easton, Jr., Assistant Secretary for International Affairs and Energy Emergencies of DOE, Department of Energy.

Mr. Crane, Dr. Roy, if you would come to the table, please, we look forward to your testimony.

If any of the witnesses this morning have a lengthy statement that they wish to include in the record, we will do that if a summarized version is necessary, or give the total statement, whichever you deem best.

Mr. Crane, if you would lead off, we would appreciate it. We appreciate the study that you did and which OTA has published for us, which we are releasing this morning.

TESTIMONY OF ALAN TAFT CRANE, SENIOR ASSOCIATE, ENERGY AND MATERIALS PROGRAM, OFFICE OF TECHNOLOGY ASSESSMENT,1 ACCOMPANIED BY ROBIN ROY, PH.D., ANALYST

Mr. CRANE. Thank you, Mr. Chairman. It is a pleasure to be here to present the OTA report, "Physical Vulnerability of Electric Systems to Natural Disasters and Sabotage.'

You requested this study last year because of concern that utilities had not adequately prepared for disasters involving unprecedented damage in this country. This report largely confirms your concern but also notes that electric systems have considerable resiliency.

OTA was fortunate to have many sources of information for this project because of our recent completion of a study on the technical implications for the operation of generation and transmission systems if competition increases in the electric power industry. For this study, our research included meetings with utilities, electric power analytical groups, the power equipment manufacturing companies, Government agencies, experts in sabotage, and others. We also held a workshop to discuss collectively issues of vulnerability and what could be done to reduce it.

The draft report was reviewed by the workshop participants and by many others. Literally, the only critical comment we received concerned the wisdom of discussing some of these issues in public. No one questioned the accuracy or clarify of the draft. In fact, the opposite was true. Several reviewers felt strongly that the draft presented too clear and concise a handbook for terrorists seeking to cause major economic damage to utilities and to society.

Chairman GLENN. Could I interrupt? I guess I should probably save this until later, but I will interrupt right now because I think it is important. Who will control the parts of this report that were

1 See p. 37 for Mr. Crane's prepared statement.

held out of general circulation? Who will decide what circulation it gets, whether it goes to DOE for review, or to FEMA and somewhere else?

Mr. CRANE. DOE will maintain control of it. We do not have the power to classify it ourselves. We are requesting them to do the review, determine what would be the appropriate level, and to maintain it on that basis.

Chairman GLENN. Fine. Go ahead.

Mr. CRANE. Others of our reviewed noted that all this information was already in the public domain.

We finally decided to move all material on the vulnerability of specific equipment to a separate appendix that is under classification review by the Department of Energy, and this appendix will be made available under appropriate safeguards by DOE. We were not concerned with sophisticated international terrorists groups who already know how to attack electric systems, but with smaller, unsophisticated groups who, by using this report, might have been able to inflict more damage than they would have otherwise.

I shall briefly outline our major conclusions. Most electric systems are designed to accommodate one failure without interrupting service. Most of the time that is adequate. However, last year's Hurricane Hugo and other countries' experience with sabotage have shown that long-term blackouts can occur following widespread damage. Sabotage is particularly worrisom because key facilities can be targeted, and these could take months to repair while large parts of the system are incapacitated. Some of these key facilities are unguarded and in isolated areas.

Unless damage is extremely widespread, at least partial power could be restored in a matter of hours. If numerous kery pieces of equipment have been destroyed, full restoration might take many months. In the interim, customers would be faced with frequent short-term blackouts and voltage reductions. Economic damage can be very great. Impacts include lost production and sales, damaged equipment and data, public health and safety threats, and the much higher costs of replacement power. An extended power shortage could cost billions of dollars.

Protection of key facilities against a large, sophisticated attack would be extremely expensive, but lower level attacks might be deterred with barriers, detection systems, and alarms. The cost of these would be a few percent of the replacement cost of that facility. The key facilities are those with large, expensive equipment that could take many months to replace. However, even if you protect these, the transmission lines themselves would still be vulnerable to simple attacks such as with rifle fire. This damage can be repaird quickly, but, again, it can be repeated quickly on that line or other lines elsewhere. Many attacks such as this would have much the same effect on the system as eliminating these key facilities.

Natural disasters-in particular, hurricanes, earthquakes, and geomagnetic storms-can also have a devastating effect on power systems. Hurricanes affect mainly distribution systems, which are easier to repair than generating plants and transmission systems. However, the lingering local blackouts following Hurricane Hugo demonstrated that more advance preparation may be warranted.

Earthquakes can destroy the heavy equipment-the generating stations, the transmission equipment-that would take many months to replace. you can design these facilities to withstand earthquakes, as they do in California, but there are parts of the country that are much less prepared than California and are still vulnerable to major earthquakes some time within the next several decades. A recent concern, geomagnetically induced currents in a power system may cause transformers to overheat or other damage, resulting permanent damage to some equipment or reduced life, or they may simply take equipment out of operation during the

storm.

Many utilities have taken some steps to reduce vulnerability to the types of disasters analyzed in the OTA report. The North American Electric Reliability Council and the Edison Electric Institute have active in suggesting improvements. However, more could be done by both industry and Government, as we discuss in the report. For example, in addition to protecting key facilities, utilities could improve contingency planning for handling disasters and expediting recovery. Critical equipment could be backed up by a stockpile or by designated spares to avoid long manufacturing delays. Emergency programs at the Department of Energy have been aimed largely at assuring a reliable supply of power for key national security facilities. Some redirection of priorities could help major economic disruption.

Thank you, Mr. Chairman. That concludes my remarks. I would like to include the Introduction and Summary of the OTA report as a supplement to my testimony. That is Chapter 1. My colleague, Dr. Robin Roy, will elaborate on the technical vulnerability of electric systems and the remedial measures.

Chairman GLENN. Fine. We will accept the submission of the additional material.

Dr. Roy, proceed with your testimony. Pull that mike right up in front of you. Those mikes are pretty directional, so pull it right up in front of you.

Dr. Roy. Thank you for the opportunity to be here today. My testimony elaborates on three topics regarding the physical vulnerabilities faced by electric utilities to terrorist attack: first, the system impact of a small but sophisticated attack; second, the level of sophistication and effort required to cause this impact; and, third, possible additional steps to protect electric utility assets and the public from major power disruptions caused by terrorists.

A sophisticated terrorist attack could cause widespread, long-lasting power outages. The time and effort required for a system to recover could range from seconds to months, depending on which components are damaged, the system's basic characteristics, and the availability of spare parts. Damage caused by even a small group of attackers can be quite severe. For example, OTA found that two or three knowledgeable individuals using only readily available, off-the-shelf supplies, could destroy enough facilities to cause a blackout of up to several hours over a metropolitan area, followed by months of reduced reliability and rotating outages during peak periods. With one additional attacker using the same approach, extended blackouts lasting up to a few days, followed by months of power shortages and rotating outages, could be inflicted