Is government prepared for the pulse?

An electromagnetic pulse is a high-intensity burst of energy that can disrupt and in some cases permanently disable electronic systems spread over hundreds of miles. Lightning strikes are a common, highly localized example of EMPs, but the real risks come from solar storms and man-made disruptions. Nuclear weapons detonated at high altitudes can cause widespread destruction of the electrical grid, and non-nuclear EMP-producing weapons can cause similar damage on a smaller scale. 

A powerful solar storm set telegraph wires ablaze in 1859, and the threat of a deliberate EMP attack on the U.S. power grid has been a concern since at least the George W. Bush administration.  Given how dependent all critical infrastructure sectors are on electronic controls and the nation’s power grid, some experts estimate that if a large-scale EMP knocked out electrical power in the United States for a significant amount of time, two-thirds of the population could die within a year.

Social services, wastewater systems police and emergency response personnel and systems, as well as implanted medical devices would all be seriously impacted by a massive EMP attack. Air traffic control systems would go down with hundreds of flights still in the air, and the electrical systems of those in flight would be in jeopardy.  Hospitals could lose power, threatening the lives of millions that need machines to keep them stable.

Critics contend government agencies have neglected to prepare for such a catastrophe, and on May 16, legislators held a hearing to explore what can be done.

According to a recent Government Accountability Office report, the Department of Homeland Security has developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. However, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. And state and local governments have largely been left to address (or ignore) the risk on their own.

At a May 17 House Homeland Security Committee hearing, legislators asked Brandon Wales, the director of DHS' Office of Cyber and Infrastructure Analysis, how many nations could actually execute an EMP attack.

Wales did not mince words. “Any country that has a nuclear capability has the capacity to generate an electromagnetic pulse from the explosion of a nuclear weapon,” he said, and many others could create a non-nuclear EMP.

Judson Freed, the director of the Emergency Management & Homeland Security division in Ramsey County, Minn., was asked if local governments had been given guidance on how to respond to an EMP.

“The short answer is not really,” he told the committee. “Not one that has been moved down to us at the local level. Where there are best practices is in prioritizing critical infrastructure and key resources and prioritizing what is energized by which substation.”

And coordination at every level of government would be critical. Once federal agencies prioritize critical infrastructure, state agencies can develop methods to bring emergency response units together and communicate with them once they go out into the field. Government at the local level can work with energy companies to improve local infrastructure and meet regularly to review and revise emergency plans to make sure services go to the right areas.

Chris Currie, GAO's director of Homeland Security and Justice Issues, told the committee that some steps have been taken to protect the grid against EMP, but there is more to do.

“DHS and DOE have invested in research to study the vulnerability of large high voltage transformers to EMPs... and other natural disasters,” Currie told the committee. And the Federal Emergency Management Agency is developing a specific plan to deal with long-term power outages.  While that plan is not specific to EMPs, he said, it could help to develop critical response capabilities.

Some of the plans Currie mentioned align with those outlined in the GAO’s report. However, there hasn’t been a comprehensive effort to execute those plans to their fullest extent. There are still pieces of those recommendations that have yet to be implemented. Currie added that there is confusion at the federal level as to what agency is responsible for specific EMP risks and the issue lacks a leader to bring different levels of government together.

One of the biggest reasons coordination and response to the threat of EMP is lacking, hearing witnesses said, is that most energy companies are privately owned and thus do not have to comply with recommendations made by DHS.  But Wales told the panel that some efforts have been made to enhance public-private partnerships.

“Our work benefits from the activities of the National Cybersecurity and Communications Integration Center,” said Joseph McClelland, the director of the Office of Energy Infrastructure Security at the Department of Energy. He described NCCIC as “a conduit within DHS to share information between the interagency community and the private sector on risks to the communication and control elements of our infrastructure systems.”

McClelland added that the Office of Infrastructure Protection has also worked with the private sector to enhance electric grid security and resilience.

Even with these efforts, however, Currie acknowledged that there are simply too many electrical substations across the country to protect them all against an attack.  Yet with the right coordination, he said, the effect of an attack can be minimized.

“The first order of business would be to prioritize the assets, and DHS has done work in that area,” Currie told the committee. “With 55,000 substations across the U.S., the argument that would be backed by industry is that we can’t protect all of them, it’s too difficult and too expensive.”

“However if the assets were prioritized around functionality, for instance what do you need to provide service to major urban areas and what facilities would DOD absolutely have to have in service in order to remain mission ready?” he added.  “If you can identify those criticalities, it just ends up being a few hundred stations.”

The next steps, Currie said, would include providing threat briefings and critical intelligence to the owners of those facilities.

Government agencies themselves, meanwhile, can improve their own resiliency by creating a specific plan detailing the most important steps to take in the event of an EMP attack. A resilient method of communication would be one of the top priorities, the experts said.

Congress has also taken steps to research and better plan for EMP attacks, but those efforts are incomplete as well.  Last year the House passed the Critical Infrastructure Protection Act, but the bill has not moved through the Senate.