Natural disasters are a bigger threat to the grid – cyber impact is limited

When it comes to disaster, reach is far less important than physical impact. Lewis noted that mass physical damage from cyber events hasn’t been realized, and the contrary is observably true for natural disasters. Reversibility is an important and often overlooked aspect of physical impact, as it defines the longevity of damage. Small-arms damage, for example, is generally reversible, while nuclear attacks are not. Cyber attacks have been demonstrably reversible, given their transitory nature. U.S. institutions and communities have become quite adept at reversing the damage from natural disasters, but their widespread physical impact makes the process much slower and labor-intensive than remediation after cyber attacks. A comparison of two events makes this clear.

In 2015, a cyber attack on the power grid affected 230,000 people in Ukraine. Due to what has often been characterized as an act of cyber war (a questionable use of that expression at best), the lights were out for as long as six hours. This came as part of a wave of cyber attacks on the grid in 2015 and 2016, none of which had any further meaningful impact. The 2015 cyber attack-induced blackout tends to be seen as the “success story” for offensive cyber against power grids, even despite the lack of sustained impact. Natural catastrophes, on the other hand, have had no trouble depriving millions of people of access to electricity for days at a time. One of the most interesting cases for closer study, though, is Hurricane Ida.

Hurricane Ida challenges the belief that natural catastrophes, due to geographical constraint, are limited in their potential impacts. First, the storm was hardly limited by geography. It made landfall in Louisiana and ultimately affected more than a dozen states directly or indirectly before leaving the northeastern United States in its wake. The overall economic loss from the storm exceeded $65 billion, according to Munich Re NatCatSERVICE. Yet, you don’t need to view the storm as a whole to understand the challenges associated with reversibility.

Let’s go back to Louisiana, where 1.1 million people went without power for more than a week. Compared to the 2015 cyber attack in Ukraine, the depth and breadth of the outage is incredible. However, the week-long outage should be seen as brief, given the effort required to bring the lights back. Hurricane Ida “destroyed more than 22,000 power poles, 26,000 spans of wire and 5,261 transformers — that’s more poles damaged or destroyed than hurricanes Katrina, Zeta and Delta combined.” Cyber catastrophes could thus be seen as more geographically constrained than natural catastrophes, when viewed from the perspective of remediation efforts. The need to engage directly with what has been damaged is far more concentrated. The relative speed and ease with which cyber catastrophe damage can be reversed appears to have created an upper limit for economic effect, while the need to go out and fix broken equipment after a natural disaster necessarily takes more time, people, and expense.