CRITICAL INFRASTRUCTURE CRITICAL INFRASTRUCTURE Protecting Critical Infrastructure from Terrorism: A Protecting Critical Infrastructure from Terrorism: A Risk-Based Multi-Hazard Approach to Vulnerability Risk-Based Multi-Hazard Approach to Vulnerability AssessmentAssessment

Reducing the Risks and Consequences ofTerrorismCREATE ConferenceNovember 18, 2004

Professor Rae ZimmermanNew York University/Wagner Graduate

School of Public Service

Research ObjectivesResearch ObjectivesElectric Power CaseElectric Power Case

Develop Critical Infrastructure as a Focus for and Demonstration of the Assessment of Risk, Consequences, Emergency Response and Economic Impact

Provide Inputs from Electric Power Case to Risk and Economic Modeling, including:

electric power system configuration common mode failures indicators for interdependencies with other

infrastructure

Why Infrastructure?Why Infrastructure? Attention of Federal Policy: 1996-2004Attention of Federal Policy: 1996-2004 Public Concern; Contributes about 10% Public Concern; Contributes about 10%

to Gross Domestic Product to Gross Domestic Product (Henry and Dumagan (Henry and Dumagan 2004)2004)

Highly Interdependent Centralized Highly Interdependent Centralized Production Systems and Networked Production Systems and Networked Distribution SystemsDistribution Systems

Large Consequences of an Attack: Large Consequences of an Attack: Extensive Number of Users ExposedExtensive Number of Users Exposed

Proven Targets of TerrorismProven Targets of Terrorism Interconnections that Magnify ImpactsInterconnections that Magnify Impacts

Attention of Federal Policy: Attention of Federal Policy: CHRONOLOGY OF SELECTED FEDERAL CHRONOLOGY OF SELECTED FEDERAL

INITIATIVES INCORPORATING INITIATIVES INCORPORATING INFRASTRUCTUREINFRASTRUCTURE

1996 1996 Executive Order 13010Executive Order 130101997 1997 President’s Commission on Critical President’s Commission on Critical

Infrastructure Infrastructure ProtectionProtection1997 1997 U.S. Department of Commerce Critical U.S. Department of Commerce Critical

Infrastructure Assurance OfficeInfrastructure Assurance Office1998 1998 Presidential Decision Directive (PDD) 63Presidential Decision Directive (PDD) 632001 2001 USA Patriot Act Section 1016USA Patriot Act Section 10162002 2002 National Strategy for Homeland ProtectionNational Strategy for Homeland Protection2003 2003 Homeland Security Presidential DirectiveHomeland Security Presidential Directive

(HSPD)7 and 8(HSPD)7 and 82003 2003 National Strategy for the Physical Protection National Strategy for the Physical Protection

of of Critical InfrastructuresCritical Infrastructures2004 2004 National Incident Management System National Incident Management System

(NIMS)(NIMS)

Proven Targets of Terrorism Proven Targets of Terrorism or Sabotage: TRANSIT and or Sabotage: TRANSIT and WATERWATER

TRANSITTRANSIT 1900s: Hundreds of Subway 1900s: Hundreds of Subway

Attacks Outside U.S.(Mineta Attacks Outside U.S.(Mineta Institute)Institute)

1995: Tokyo Sarin Gas on 3 1995: Tokyo Sarin Gas on 3 Separate LinesSeparate Lines

1995: Subway Car Bombings - St. 1995: Subway Car Bombings - St. Michel-Notre Dame Station Michel-Notre Dame Station

1995: Derailment of Amtrak’s 1995: Derailment of Amtrak’s Sunset Limited (AZ) (vandalism)Sunset Limited (AZ) (vandalism)

2001: Destruction of Lower 2001: Destruction of Lower Manhattan Subway Lines (WTC)Manhattan Subway Lines (WTC)

2004: Madrid Subway Bombings2004: Madrid Subway Bombings

WATERWATER 2003: break-ins at water systems 2003: break-ins at water systems

in 5 states and Canadain 5 states and Canada Poisoning threats in Turkey, Poisoning threats in Turkey,

Germany and MaltaGermany and MaltaSource: R. Zimmerman, “Water” in Source: R. Zimmerman, “Water” in Digital InfrastructuresDigital Infrastructures, edited by R. , edited by R.

Zimmerman and T. Horan (Routledge 2004).Zimmerman and T. Horan (Routledge 2004).

Proven Targets of Terrorism Proven Targets of Terrorism or Sabotage: ELECTRIC or Sabotage: ELECTRIC POWERPOWER Domestic attacks on power plants: “70 Domestic attacks on power plants: “70

percent of energy and power companies percent of energy and power companies experienced at least one severe cyber experienced at least one severe cyber attack.” ( U.S. GAO 2004: 12)attack.” ( U.S. GAO 2004: 12)

Transmission Towers: Vandalism occurred Transmission Towers: Vandalism occurred in October 2004, when two bolts were in October 2004, when two bolts were removed from a transmission tower in removed from a transmission tower in Milwaukee, WI disrupting power and rail Milwaukee, WI disrupting power and rail service when the tower fell on to the lines service when the tower fell on to the lines (USA Today 2004).(USA Today 2004).

Crude oil and gas pipelines: Between June Crude oil and gas pipelines: Between June 2003-September 2004, in Iraq, over one 2003-September 2004, in Iraq, over one hundred attacks on oil and gas pipelines hundred attacks on oil and gas pipelines were reported.were reported.

ENERGYENERGY

TRANSPORTATIONTRANSPORTATION WATERWATER

TELECOMMUNICATIONSTELECOMMUNICATIONS

System System Interconnectedness Interconnectedness

(Macro and Micro Effects)(Macro and Micro Effects)

Macro Interdependencies: 2003 Macro Interdependencies: 2003 Total Energy Consumption by SectorTotal Energy Consumption by Sector

Source:Source: Drawn from U.S. Department of Energy, Energy Information Drawn from U.S. Department of Energy, Energy Information

Administration, Administration, Monthly Energy ReviewMonthly Energy Review, October 2004, October 2004

22%

18%

33%

27%

Residential

Commercial

Industrial

Transportation

EBMUD

Energy Inputs

Onsite Power Generator2.6 MW

Western Area Power Authority4.16 MW

Pacific Gas and Electric

Surplus Power

Oxygenation Plant

27%

Activated Sludge Mixing

22%

Headworks

18%

Lighting, Losses, Misc.

12%

Solids Handling

10%

Activated Sludge Pumping

7%

OtherMotor Loads

4%

Micro Interdependencies: Energy use at the

East Bay Municipal Utilities DistrictOAKLAND, CA

Energy Outputs

Diagrammed from Hake, Bray and Kallal (2004)

Types of Potential Disruption Types of Potential Disruption and Vulnerability Associated and Vulnerability Associated

with Interdependencieswith InterdependenciesGENERAL EFFECTSGENERAL EFFECTS Single System EffectsSingle System Effects Multiple System Effects (e.g., Multiple System Effects (e.g., J. Peerenboom, R. Fisher, J. Peerenboom, R. Fisher,

R. Whitfield): R. Whitfield): Common-Cause; Cascading; EscalatingCommon-Cause; Cascading; Escalating

GENERIC ELECTRIC POWER CASE: Disruption by GENERIC ELECTRIC POWER CASE: Disruption by TerrorismTerrorism

Multiple modes of attack possibleMultiple modes of attack possible Numerous cascading effectsNumerous cascading effects Many second and third level consequencesMany second and third level consequences Enormous economic impacts of sustained regional Enormous economic impacts of sustained regional

electricity disruptionelectricity disruption

ILLUSTRATIVE EXAMPLE: ILLUSTRATIVE EXAMPLE: U.S. and CanadianU.S. and Canadian Blackout of August Blackout of August 14, 200314, 2003 One set of initiating events: cyber failuresOne set of initiating events: cyber failures Series of cascading failures of electrical Series of cascading failures of electrical

systemssystems Interdependencies: transportation, water, Interdependencies: transportation, water,

sanitation, communications failuressanitation, communications failures Economic and social impacts: health and Economic and social impacts: health and

recreation; job disruption; disruption and recreation; job disruption; disruption and redistribution of economic sectorsredistribution of economic sectors

Numerous analogies to consequences of a Numerous analogies to consequences of a terrorist attackterrorist attack

Selected Major Blackouts in the Selected Major Blackouts in the U.S.U.S.

Source: Graphed from North American Electric Source: Graphed from North American Electric Reliability Council (NERC) dataReliability Council (NERC) data

Number of Customers Affected

30,000

9,000

2,000

7,500

152

50,000

0

10,000

20,000

30,000

40,000

50,000

60,000

1965 1977 1996a 1996b 1998 2003

Cu

sto

me

rs (

'00

0)

Maximum Duration

13

26

3

9

19

36

0

5

10

15

20

25

30

35

40

1965 1977 1996a 1996b 1998 2003

Ho

urs

Research Approach: Research Approach: Electric Electric PowerPower1.1.Identify Event Case DatabasesIdentify Event Case Databases (“all-hazards” (“all-hazards”

approach): U.S. DOE, U.S. DHS, websites, etc.approach): U.S. DOE, U.S. DHS, websites, etc.

2.2.Case Diagnosis of FailuresCase Diagnosis of Failures: Identify and code-: Identify and code-– characteristics of failures characteristics of failures – Interdependencies with other infrastructureInterdependencies with other infrastructure– vulnerable components and consequencesvulnerable components and consequences

3.3.Develop and Apply Indicators of Infrastructure Develop and Apply Indicators of Infrastructure InterdependencyInterdependency

4.4.Identify Risk Reduction OptionsIdentify Risk Reduction Options

Number of IncidentsNumber of Incidents(U.S. DOE Database)(U.S. DOE Database)

Source: New York University Critical Infrastructure Source: New York University Critical Infrastructure Project, CREATE Project, CREATE

0

10

20

30

40

50

60

1990

1991

1992

1993

1994

1995

1996

1997

1998

1999

2000

2001

2002

No

. of

inc

ide

nts

Indicator Application and Indicator Application and Preliminary Analysis of Preliminary Analysis of Interdependencies and Interdependencies and FailuresFailuresType of InfrastructureType of Infrastructure Ratio of # Times Ratio of # Times

Infrastructure Causes Infrastructure Causes Failures Failures

vs. is Affected by Failurevs. is Affected by FailureWater mainsWater mains 3.43.4RoadsRoads 1.41.4Gas linesGas lines 0.50.5Electric LinesElectric Lines 0.90.9Fiber Optic/TelephoneFiber Optic/Telephone 0.50.5Sewers/ sewage treatmentSewers/ sewage treatment 1.31.3

Source: R. Zimmerman, “Decision-making and the Vulnerability of Critical Infrastructure,” Source: R. Zimmerman, “Decision-making and the Vulnerability of Critical Infrastructure,” Proceedings of IEEE International Conference on Systems, Man and Cybernetics, 2004. Proceedings of IEEE International Conference on Systems, Man and Cybernetics, 2004. Based on an illustrative data set of approximately 100 cases.Based on an illustrative data set of approximately 100 cases.

Risk and Consequence Risk and Consequence Reduction Options for Reduction Options for Electricity: Post 9/11 (WTC) Electricity: Post 9/11 (WTC) ExamplesExamples Redundancy/Service AlternativesRedundancy/Service Alternatives

– Spare transformer vaults at the South Spare transformer vaults at the South Street Seaport provided energy to Street Seaport provided energy to damaged areasdamaged areas

Use of Slack ResourcesUse of Slack Resources– Ability to access portable generators Ability to access portable generators

provided temporary powerprovided temporary power Decentralization and DecouplingDecentralization and Decoupling

– Alternative, portable energy sources Alternative, portable energy sources usedused

Decentralize/De-Couple Energy: Renewable Decentralize/De-Couple Energy: Renewable Energy - Trends Compared With Other Energy - Trends Compared With Other Resources, 1973-2001 Resources, 1973-2001 (Quadrillion Btu)(Quadrillion Btu)

Source: Department of Energy, Energy Information Administration; Monthly Energy Review Source: Department of Energy, Energy Information Administration; Monthly Energy Review September 2002; September 2002; http://www.eia.doe.gov/emeu/mer/pdf/pages/sec10_2.pdfhttp://www.eia.doe.gov/emeu/mer/pdf/pages/sec10_2.pdf; (Accessed 30 ; (Accessed 30 October 2002).October 2002).

ConclusionsConclusions Electric power is a key driver of other Electric power is a key driver of other

infrastructure and impacts other infrastructure and impacts other infrastructure in extreme eventsinfrastructure in extreme events

Grid configurations, common component Grid configurations, common component failures and their consequences guide failures and their consequences guide risk estimates of terrorist attacksrisk estimates of terrorist attacks

Risk reduction alternatives exist that Risk reduction alternatives exist that can alter vulnerability of energy service can alter vulnerability of energy service configurations to attackconfigurations to attack

Outputs of case-based diagnostic Outputs of case-based diagnostic methods and indicators provide inputs methods and indicators provide inputs to risk and economic modelsto risk and economic models

ACKNOWLEDGMENT AND ACKNOWLEDGMENT AND DISCLAIMERDISCLAIMER

This work is supported by the U.S. Department of This work is supported by the U.S. Department of Homeland Security (DHS) through the University Homeland Security (DHS) through the University of Southern California for CREATE and several of Southern California for CREATE and several grants from the National Science Foundation grants from the National Science Foundation (NSF). Any opinions, findings, and conclusions or (NSF). Any opinions, findings, and conclusions or recommendations expressed in this document are recommendations expressed in this document are those of the author(s) and do not necessarily those of the author(s) and do not necessarily reflect the views of the U.S. DHS or the NSFreflect the views of the U.S. DHS or the NSF..

The staff at NYU-Wagner are also acknowledged for The staff at NYU-Wagner are also acknowledged for their valuable assistance with the data, namely their valuable assistance with the data, namely Carlos Restrepo, Nicole Dooskin, Ray Hartwell, Carlos Restrepo, Nicole Dooskin, Ray Hartwell, Justin Miller, and Wendy Remington.Justin Miller, and Wendy Remington.