Ghost in the machine

Cyber-attacks on Europe’s power grid – should we be worried?

In December 23, 2015, just as whole of Europe and USA was getting ready for the festive season of Christmas and New Year, totally sunk in the hectic of last minute shopping while hurrying to spend the evening with the loved ones, the operators of Prykarpattyaoblenergo’s control centre in Ivano-Frankivsk region of Western Ukraine were preparing to end their shift at 15:30 that day. But just as one worker was getting ready to log-off from the computer, the screen blinked and the cursor started moving uncontrollably across the monitor.

The operator watched with wide open eyes as the cursor was navigating towards buttons which controlled the circuit breakers at substations in the region and then clicked while taking them offline. He knew immediately that somewhere in the region thousands of residents had just lost lights and heating. The effort to regain control over the mouse cursor was in vain as if a ghost in the machine had seized power and was shutting one substation after another, 30 in total. Then he was logged off and could not log back in as the credentials appeared to have been changed. In the meantime manual power back up was disabled leaving 230,000 residents including the operators themselves stumbling in the dark.

A Sophisticated Plan
According to the experts of Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), US Department of Energy and FBI, malware known as “Black Energy” was discovered on the company’s computer networks. The cyber-attack was synchronized and coordinated with high precision and sophistication following several months of reconnaissance mission and was conducted by multiple external humans using Industrial Control System (ICS) client software and Virtual Private Network (VPN) connections. Reportedly, the malware was delivered via spear phishing emails with malicious Microsoft Office attachments. The power outage lasted some 6 to 8 hours, but the control centres were not fully operational even 2-3 months after the attack. Attackers overwrote firmware leaving the system unresponsive to remote control commands.

Widespread Implications
Primary effects of such an attack can take toll in human lives causing deaths and injuries due to road and industrial accidents. The longer they last, riots and lootings would claim people’s lives. Elderly and infirm people in nursing homes and hospitals would be the most vulnerable to these incidents. Businesses would suffer enormous financial losses from disruption in trade and production. Finance, communicate on and water supply disruption would cause widespread panic and further escalation in number of human casualties. A successful attack on a computer control or emergency system of a refinery, petrochemical or gas plant could result in estimated maximum losses as a result of fire or explosion worth hundreds of million Euros.

Cyber Insurance
Cyber is an unusual insurance risk. It is relatively young and there is not a long history of claims available to assess the likelihood of the events. It is also a dynamic risk – the technology application, software, preferred strategies and tactics of the attackers, legislation and compensation practices are rapidly changing and evolving. Cyber threat has the potential to generate claims for insurers where cyber damage is not explicitly covered or excluded, e.g. all risks (FLEXA, etc.). In some instances underwriters may not have charged (sufficient) premium for the risk. The greatest concern however, is that the cyber risk does not comply with the physical laws or geography, whilst being able to cause systemic events with catastrophic outcome. Cyber incidents can trigger different insurance covers, such as data breach or loss of data, first or third party business interruption or physical damage. In some cases cyber-attacks may be covered under dedicated cyber or D&O policies and in energy sectors even some liability policies might be responding. There is capacity to address business interruption and insurers are looking aggressively at property damage and bodily injury as well. Cyber risk is an integral part of the global risk landscape. We should be aware and active in taking effective measures towards risk management and mitigation while the energy sector adopts the use of internet technologies and Industrial Control Systems, which can be vulnerable to exploitation if not fully secured.