Dichotomy (Part one)

In the first edition of this blog in May 2023, I noted that “the electric sector underpins every other essential industry sector, and it also relies on many of them. I…think of the overlaps like the Olympic rings – all interlinked, with some overlapping more than others.”

In the past 11 months, I’ve focused on each critical infrastructure (CI) sector in relation to the electric sector because electricity – which began to be deployed as a service close to 150 years ago – has enabled the progress, convenience, and abundance that are hallmarks of modern life. I’m now moving on to discuss in more detail the policy-related matters that I touched on at the end of each of the previous editions. I’ve identified nine of them, but there may be others that become obvious along the way.

First out of the gate – visualize me physically leaning in for this one with a drumroll in the background – cybersecurity. I’ve been working in the cybersecurity arena in some form or fashion since 2006. To sum up what I’ve learned in those 18 years: ensuring cybersecurity is like fighting a Hydra, the mythical beast with several heads that multiply when chopped off. This statement is true across CI sectors.

Now let me explain. We have a cybersecurity concern because we have enabled computers and other “smart” (digitized/computerized/sensor-imbued) devices to talk to each other via connected digital communications networks. As I discussed in the last edition of the blog on Electricity/IT and also the fourth edition on Electricity/Communications, communications networks, computers/computational devices, and electricity have come together over the last 30 years to enable a digital revolution.

What this means in practical terms is that computerized devices and sensors can be used in myriad ways to analyze, assess, control/manage, and monitor almost anything. For example, a smart refrigerator can monitor and control the temperature in the fridge. It can monitor and ratchet the amount of ice in the icemaker, it can synch with your smartphone to analyze what food you have in the fridge for ease in planning and managing your purchases, and the list goes on (is it a coincidence that I’m writing this just before lunchtime and chose the refrigerator as an example?). This is one example of what we have deemed the “Internet of Things'' (IoT).

To make all this work, electricity is needed to run the basic refrigerator functions as well as those of the smart, or computerized, elements I just listed. Communications networks are required for the smart fridge to speak to itself internally and then to communicate out to its owners’ smartphones or computers. Such communications networks extend to “backbone” carrier networks (AT&T, Verizon, etc.). The communications networks, in turn, require electricity to function. The data collected by the smart phones or computers is likely hosted in the “Cloud” – a euphemism for off-site data centers that gather and host this type of data so that it doesn’t have to be kept in a computer device or phone (which have limited capacity and can more easily get damaged, lost, or stolen). You guessed it, that data center also needs electricity.

Now let’s turn to the digital, or “smart," devices that are deployed throughout CI sectors for greater operational efficiency, enhanced situational awareness, operations and maintenance, etc. Every single CI sector uses digital capabilities in some way, shape, or form. Within each sector, there may be individual outliers that have not yet moved into the digital age, but they are the exceptions rather than the rule at this point. For the electric sector, without digital enhancements to create much more granular situational awareness in real time, the operational consequences of integrating intermittent resources, such as wind, at significant levels would have been impossible. Digital communications and components have enabled us to use our grids more flexibly and efficiently and are essential to enabling “behind-the-meter” energy sources in homes and businesses (such as solar panels on rooftops or battery storage) to interface with distribution grids. Digitalization underpins the energy transition.

In my experience, there’s almost always a cost to something good – otherwise my diet would consist exclusively of French fries and chips and salsa. Such is the case with digitalization of our CI sectors. Ensuring cybersecurity is the cost. Or maybe this is better couched as a risk/reward situation. I’ve just listed many of the “rewards” enabled by digitalization. The risk we must contend with is that of cyber attacks that could result in negative operational consequences. A couple of examples of such consequences: a cyber attack that causes a critical manufacturing facility to go offline for unknown reasons or a telecommunications network to intentionally become overloaded such that it cannot support regular use.

To be clear, individual CI companies and utilities often get millions of cyber-attacks a day – yes, a day – without any problems. To their credit, CI has come up to speed on cyber defense over the last 15 years in a big way. But the risk is always there, and it must be managed over time, as the cyber attackers’ “methods” are ever changing and evolving. The CI sectors have also come to understand that preventing a cyber attack with an operational consequence may not always be possible. While some CI sectors are still unscathed, others have already experienced such attacks – Colonial Pipeline being the most prominent. To respond to this uncertainty, CI works often on how to respond when such attacks do occur. How quickly and effectively can the sector or sectors understand what is happening, mitigate the problem, and come back online is a measure of their “resilience.”

I’ve often referred to this risk and reward of digitalization and cybersecurity as the “yin and the yang” – we can’t have one without the other. I can’t emphasize enough how important it is to transparently acknowledge both elements when we evaluate policies and the costs and benefits of those policies. In Part II of this edition of The Essentials, I’ll get into some of those policy debates and approaches.