When the largest power blackout in U.S. history began rolling through the Northeast Thursday, Carnegie Mellon University computer scientist Roy Maxion quickly dismissed the fear that terrorism was to blame.
"If terrorists wanted to do this," said the director of CMU's Dependable Systems Laboratory, "they probably could have done a lot more."
What scares Maxion most is his belief that a larger attack on the nation's power grids could still happen and that the disruption caused by this week's power failures might serve as inspiration.
"You could imagine that anybody who was out to do harm might be watching this whole scenario with great interest," said Maxion, who also serves on a U.S. Department of Defense advisory group known as the Defense Science Board. "Whatever it was that happened, if that same thing could be instigated, why not give it a shot, if that is what your goal is?"
Since the attacks of 9/11, Maxion has been at the fore of a national movement to shore up the country's critical infrastructure, arguing that electrical power, finance, telecommunications, transportation, water and the Internet are all vulnerable to cyber attack. In fact, he and cybersecurity expert Sami Saydjari wrote a letter last year to President Bush warning that "our nation is at grave risk of a cyber attack that could devastate the national psyche and economy more broadly than did the September 11th attack."
The letter, cosigned by CMU colleague John McHugh and more than 50 of the country's top computer scientists, laid out a nightmarish scenario involving the sudden shutdown of electric power grids, telecommunications "trunks," air traffic control systems and the crippling of e-commerce and credit card systems with the use of several hundred thousand stolen identities. "We would wonder how, as a nation, we could have let this happen," the letter said.
Maxion and his fellow cosigners asked that the president initiate a five-year cyber warfare effort modeled after the Manhattan Project, requiring an investment ranging from $500 million to $1 billion per year. "The clock is ticking," the letter said.
A year and a half later, the chaos of a blackout affecting 50 million people proves to Maxion how vulnerable the country's electrical power systems still are. He is concerned, a few days after the incident, that the country will not learn critical lessons from the outage, especially if it can be tied to an innocuous technical malfunction.
"I personally don't have much confidence that things will change much," he said. "There will be a lot of lip service. It is part of American culture. Americans don't react to stuff until there is a crisis." Regarding the blackout, "it is just a question of whether somebody, somewhere regards this as a crisis."
For people looking to harm the United States, Maxion said, electrical power grids are effective tools of terror because they control the things that people rely on for daily life, including water and transportation.
Power systems are also particularly vulnerable to attacks, perhaps more so than banks and other forms of critical infrastructure. Maxion said part of that has to do with the age of the grid systems, their interconnectedness and the culture of an industry not used to thinking about security issues.
What's more, many power systems are run by digital control systems that some cybersecurity experts believe can be easily accessed and manipulated from afar. Those systems -- "Supervisory Control and Data Acquisition Systems" known in the computer industry as SCADA -- are connected to the Internet and often run on Microsoft operating systems, meaning that their vulnerabilities are well known.
From his position on the Defense Science Board, which advises the Defense Department and is privy to homeland security discussions, Maxion said "based on what I have seen, I would say that we are not doing enough" to secure critical infrastructure such as electrical grids. "The extent to which the nation as a whole can depend on critical infrastructure is in question. A lot of people assume it is all going to be OK. Everything is not always going to be OK."