When Hackers Get to the Grid

Drills on a high-security island show the potential devastation of a cyberattack on U.S. power infrastructure

- Michael Riley, with Jordan Robertson and William Turton

Five times over three years, a desperate scenario has played out on Plum Island, an isolated spit of land just off the northeastern tip of New York’s Long Island. A large part of the power grid has gone down, leaving the population in the dark and critical facilities such as hospitals growing desperate. A team of utility operators and cybersecurity experts scrambles to get the grid back up, while hackers try to keep it down.

Each emergency was a drill held by the Defense Advanced Research Projects Agency (Darpa), the Pentagon’s moonshot research arm. Its goal was to expose utilities accustomed to dealing with hurricanes, blizzards, and other challenges to the reality of a successful cyberattack on the U.S. electrical grid.

Concern about such an event has been mounting within the U.S. government for years. Darpa began laying the groundwork for its drills in mid-2015, part of a five-year, $118 million project called Rapid Attack Detection, Isolation and Characterization Systems—or Radics—after chilling congressional testimony the previous year from then-National Security Agency Director Mike Rogers. Rogers told lawmakers that hackers had been breaking into U.S. power utilities to probe for weaknesses and that Russia had been caught planting malware in the same kind of industrial computers used by power utilities. “All of that leads me to believe it is only a matter of when, not if, we are going to see something dramatic,” he said.