Electricity grid cybersecurity will be expensive – who will pay, and how much?

Recently, a neighbor asked one of us whether Russia, China, North Korea and Iran really are capable of hacking into the computers that control^[1] the U.S. electricity grid. The answer, based on available evidence^[2], is “Yes.” The follow-up question was, “How expensive will it be to prevent, and who will end up paying for it?”

The answers are: Likely tens of billions of dollars, and probably us, the electricity customers. This is a major – and, in our view, vital – investment in community and national security. But as scholars of grid cybersecurity^[3], we understand it’s not very clear what consumers will be getting for their money, nor whether utility companies themselves should bear some share of the cost.

Paying for reliability

In the U.S., the electricity grid is a ubiquitous system that’s highly reliable. Most consumers expect the lights to turn on when they flip the switch, and don’t think much more about it – except when paying the monthly bill.

Electric power companies’ high levels of performance depend on interconnected computer systems, which are vulnerable to cyberattacks. Hackers took down^[5] portions of Ukraine’s electricity grid in 2015 and 2016^[6], cutting power to hundreds of thousands of people. U.S. officials regularly report that foreign agents are working to infiltrate^[7] critical infrastructure systems, like computers that control the power grid. An as-yet-unspecified “cyber event^[8]” affected the power grid^[9] in California and Wyoming in March 2019, according to the U.S. Department of Energy.

While media coverage and neighborly conversations have increased public awareness of the risks to the grid, most people’s thinking hasn’t changed much. People regularly evaluate how much they pay for car insurance^[10], whether they need to buy life insurance, what the risks are of a recommended medical procedure^[11] or whether they feel safe flying in a Boeing 737 Max 8 airliner^[12]. But they rarely consider whether they’re paying the right amount to ensure that the lights come on when they’re needed.

But what about protection?

It can be difficult even for experts to keep track of all the potential risks^[14] to the grid, an interconnected set of industrial control systems. There are big threats from very rare events^[15], like massive solar flares^[16]. And there are relatively minor threats from nearly certain incidents, like trees falling on wires. In between are cybersecurity concerns – which themselves can range from one individual hacker playing around^[17] to a national government orchestrating intrusion attempts^[18] into the national grid.

Now consider how much we, as consumers of utility service, might be willing to pay to protect against those dangers. Making a system more secure and reliable costs money, but often the economic benefits are hard to quantify^[19]. How much was saved by preventing a citywide blackout? Was it worth millions – or billions – of dollars invested in protection? Even if that could be calculated, it’s not easy to communicate effectively to the public, who regularly face many difficult choices about where to spend their limited money.

Recouping the costs

Collectively, utility companies in the U.S. are already planning to spend billions of dollars a year^[20] on grid cyber defenses. Those investments will include securing locations and equipment, improving the security of the utility supply chain^[21], and continuous training and workforce development. This spending in turn brings up another complication: Most electricity utilities are highly regulated by the government^[22], so they have to provide a certain level of service and spend money on required compliance activities. In return, those utilities are permitted to recover a certain return on their investment.

When utility companies’ costs rise, they typically ask for permission from regulators to raise the prices they charge customers^[23]. What those customers can ask for, and in our view what regulators should insist on, is clear information about what those charges will be paying for.

Right now there is ongoing research exploring what the best practices are for cyber defense of public utilities^[24], but there is only limited useful information about what those measures should cost. Ultimately, consumers can reasonably expect to shoulder some of the cost – but should get as much information as possible about the benefits that will result from the rates they’re paying.

This article was written in collaboration with Wei Chen Lin^[25] of the Illinois Commerce Commission.

References

1. ^{^} computers that control (www.eenews.net)
2. ^{^} available evidence (www.wired.com)
3. ^{^} grid cybersecurity (scholar.google.com)
4. ^{^} sharpshutter/Shutterstock.com (www.shutterstock.com)
5. ^{^} Hackers took down (www.wired.com)
6. ^{^} in 2015 and 2016 (www.bbc.com)
7. ^{^} foreign agents are working to infiltrate (www.dni.gov)
8. ^{^} cyber event (www.eenews.net)
9. ^{^} affected the power grid (www.eenews.net)
10. ^{^} pay for car insurance (www.nerdwallet.com)
11. ^{^} risks are of a recommended medical procedure (www.cancer.org)
12. ^{^} flying in a Boeing 737 Max 8 airliner (www.pbs.org)
13. ^{^} DejaVuDesigns/Shutterstock.com (www.shutterstock.com)
14. ^{^} keep track of all the potential risks (www.npr.org)
15. ^{^} big threats from very rare events (doi.org)
16. ^{^} massive solar flares (theconversation.com)
17. ^{^} individual hacker playing around (www.utilitydive.com)
18. ^{^} national government orchestrating intrusion attempts (theconversation.com)
19. ^{^} hard to quantify (www.energy.gov)
20. ^{^} billions of dollars a year (www.greentechmedia.com)
21. ^{^} security of the utility supply chain (theconversation.com)
22. ^{^} highly regulated by the government (www.raponline.org)
23. ^{^} charge customers (www.eia.gov)
24. ^{^} cyber defense of public utilities (fortnightly.com)
25. ^{^} Wei Chen Lin (www.linkedin.com)