Physical security is still a problem

I was in Washington DC June 10 and 11, 2014 to be interviewed for an upcoming TV show on cyber security. We decided it would be advantageous to show actual facilities that utilize control systems and can be vulnerable to cyber threats. Consequently, we used the Internet to identify several facilities to film. The filming was done June 11^th in the Washington DC area. We did not ask the companies for permission to film as we had no intention of entering any fenced-off areas. What we encountered (or the lack thereof) I found to be extremely alarming.

Last year a physical (not cyber) attack was conducted against PG&E’s Metcalf electric substation in San Jose, CA and many transformers were damaged by gunfire. As a result, Congress and FERC demanded the utilities improve the physical security of these critical facilities. Consequently, I did not think we would be able to film directly in front of large electric substations and other critical infrastructures. I was wrong. We went to several sites with a camera crew in an “unmarked” SUV and minivan and parked directly in front of the facilities. We spent about an hour in front of each site filming from different angles with a large commercial video camera mounted on a tripod. The first site was a transmission substation. During the hour or so we spent filming, no one asked why we there or what we were doing. We then went to another location I believe was even more critical. This site had a critical infrastructure facility and utility transmission substations. Again, we spent over an hour filming and driving back and forth. No one came out to see who we were or ask what we were doing.

I know the utilities haven’t learned their lesson with cyber. I hoped they learned their lesson about physical security following the Metcalf Substation incident. The facilities we visited were truly critical facilities serving important customers. What if we were bad guys?

Joe Weiss