The risk is high – actors are targeting hardware vulnerabilities in the grid and nuclear power plants

For several years, Members of Congress, executive agencies, and third-party organizations have been sounding the alarm on the potential risks caused by Chinese components and hardware embedded into U.S. energy grid. In testimony before the Senate Energy and Natural Resources Committee, Director of CESAR (the Department of Energy’s (“DOE”) Office of Cybersecurity, Energy Security, and Emergency Response) Puesh Kumar, pointed to reports from the Director of National Intelligence (“DNI”) and emphasized that cyber actors are targeting U.S. energy infrastructure, and they are posing serious threats to national security.73 Further, the 2023 Annual Threat assessment from DNI identified China as representing “the broadest, most active, and persistent cyber espionage threat to U.S. Government and private-sector networks [and that] China’s cyber pursuits and its industry’s export of related technologies increase the threats of aggressive cyber operations against the U.S. homeland.”74

Today, outsider actors are capable of exploiting hardware vulnerabilities in U.S. systems to destroy physical components of the U.S. electric grid.75 The attacks could originate from hardware within the grid itself, or the transmission of malicious code to the grid from external hardware devices, such as electric vehicles (“EV”) charging stations, large data and power storage devices, or telecommunication equipment scattered nationwide. Large attacks on the U.S. electric grid, should they occur, will have devastating impact on the United States population – leaving masses without access to electricity and heat and will cause critical service systems such as hospitals, emergency services, utility providers (water/sewer, gas), and military installations incapable of performing essential tasks.76 Attacks on military utility installations have been a particular area of concern as hostile nations could utilize preemptive blackouts to limit U.S. defensive and responsive capabilities.

Moreover, power plants and petrochemical refineries and facilities may similarly be rendered inoperable due to cyber intrusions.77 And nuclear generation facilities, in particular, pose a risk for catastrophic destruction should outside interference induce a radiological release.78 These are merely a few examples of the range of risks that exist today. These risks become all the more dangerous when coordinated cyberattacks simultaneously cripple multiple power sources across broad geographic regions.