Burning transformer. Photo by Gene Wolf.

Better Include Physical Security With Cybersecurity

Jan. 5, 2023
After the North Carolina attack, it’s going to be more difficult to adequately define criticality.

I had just settled down at my computer to start the February “Charging Ahead” editorial. I had decided on the subject that fit nicely with the topic of my February article. As I entered the topic in my browser, a breaking news headline flashed across the screen diverting my attention. It said some cretins attacked a couple of substations in North Carolina, which resulted in a blackout for the entire county the substations served. What got my attention was the fact it was a planned physical attack, using gunfire.

Of course you will be reading this a couple of months from now, and the events will be old history at that point. The news coverage, however, did bring back a flood of memories concerning attacks on substations that I experienced in my substation engineering career. When I was a new substation engineer there wasn’t much emphasis on any type of substation security. We installed a ten foot chain-link fence topped with three strands of barbed-wire around the station, put a lock on the gate and called it good. The amazing thing was this approached worked in those days!

Attractive Nuisance

It wasn’t long until I had my first vandalism encounter proving we needed to improve that approach. My utility was hit with large scale copper theft problem. Thieves were breaking into substations to steal copper, but many were being hurt or killed in the process of stealing. They didn’t understand clearance issues. That resulted in lawsuits, with large awards to the thieves or their next-of-kin. The juries considered a substation to be an attractive nuisance and a simple fence with barbed-wire wasn’t enough deterrent to protect people from themselves.

The one thing I learned as a substation designer, there’s no way to keep determined people out of a substation, but there is a lot that can be done to minimize any intrusion. In the case of the copper thieves, the problem had a simple solution. Replace the solid copper cable grounding jumpers with something that had no scrap value. Copper-clad aluminum jumper cables did that. In retrospect that problem seems trivial compared to today’s more sinister attacks.

Several years later, I took part in meetings with other utilities and sometimes regulatory groups like NERC (North American Electric Corporation) to discuss the rising numbers of physical attacks on substations. No one wanted to call these happenings a physical attack, but looking back in hindsight that is exactly what they were. There was also an understood policy that members should not talk about the meetings, and it seemed like a good idea at the time. There was a concern that publicity would give people ideas and encourage copycats, but still substation attacks increased.

What to Do

Then in 2013 there was a major attack on PG&E’s Metcalf Substation, and 17 out of 21 power transformers were damaged. NERC was directed to develop a physical security standard to give utilities a guideline to lessen vulnerabilities on critical facilities from physical attacks. That resulted in the CIP-014 standard, which has a great deal of helpful information. Interestingly, CIP-014 requires utilities determine what facilities on their systems are critical.

With something like 55,000 transmission substations and over 450,000 miles of high-voltage transmission lines, that is a hard task. After the North Carolina attack, it’s going to be more difficult to adequately define criticality. Criticalness is relative. Maybe another approach would be more appropriate such as treating all facilities as critical and take advantage of state-of-the-art technologies for physical protection.

Getting back to that idea about not talking about vulnerabilities made it hard to find products designed to physically protect substations. Of course there are several varieties of video cameras, intrusion alarms, and perimeter monitoring systems, but what about physical barriers. That is something that usually doesn’t come up at the morning coffee break, but there are some manufacturers who specialize in off-the-shelf military grade ballistic resistant barriers that meet UL 752 US Ballistic Standard.

A quick check turned up several manufacturers like ArmorCore and Southern States offering various sized panels and barriers that include eight individual levels of UL Standard 752 approved protection. Panels can be installed within doors, building walls, control cabinets. Detachable barriers can be installed around outdoor equipment and can be removed for maintenance. Hitachi Energy, Siemens Energy, and others offer ballistic protected transformers. It is time to consider our physical-security as thoroughly as we do cyber-security – the technology is available!

Voice your opinion!

To join the conversation, and become an exclusive member of T&D World, create an account today!