311 Cannon House Office Building
Thank you, Chairman Perry, Ranking Member Coleman, and distinguished Members of the Committee. It is my pleasure to be here to discuss the threat posed by electromagnetic pulse events (EMP) to our Nation and its critical infrastructure, including its cyber, communications, and electric-grid assets.
Over the past several decades, the risk to digital and physical infrastructures has grown. For example, today’s power grid and information networks may be more vulnerable to EMP than those of a few decades ago, as the grid transitions from an analog system to a digital system to improve efficiency. My testimony today will focus on the Department of Homeland Security’s (DHS) preparations to respond to and assist recovery from a potential EMP attack, as well as touch on the joint DHS/Department of Energy (DOE) effort to review the EMP science and provide a peer-reviewed estimate of the potential risks.
The Federal Government plays an important role supporting the critical infrastructure community to manage risks from low-probability, high-consequence events, such as EMPs and severe geomagnetic disturbances (GMDs). DHS and its interagency partners will be using our unique resources built over the past decade to address the scale and degree of uncertainty associated with risks such as the ones I am here to discuss today.
The Department takes seriously the recent review and recommendations of the Government Accountability Office (GAO) on federal efforts to address EMP risk, as well as the recommendations issued by the 2008 EMP Commission, and welcomes further cooperation with other government agencies to ensure we are appropriately responsive on this critical topic.
Background on EMP
An EMP is the burst of electromagnetic radiation created, for instance, when a nuclear weapon is detonated or when a non-nuclear EMP weapon is used. EMPs can be high frequency, similar to a flash of lightning, or low frequency, similar to an aurora-induced phenomenon. The consequences of an EMP can range from permanent physical damage to temporary system disruptions, and can result in fires, electric shocks to people and equipment, and critical service outages.
There are two general classes of EMP of concern: (1) Nuclear sources of EMP, such as High altitude EMP (HEMP), and (2) Non-Nuclear sources of EMP (NNEP). HEMP results from a nuclear detonation typically occurring 15 or more miles above the Earth’s surface. The extent of HEMP effects depends on several factors including the altitude of the detonation, the weapon yield, and whether it was designed for EMP effects. On the ground, effects may be diminished by the electromagnetic shielding, or “hardening,” of assets. A high-altitude burst could blanket the entire continental United States and could cause widespread impacts to multiple sectors, including to lifeline sectors such as the energy and communications. HEMP threat vectors can originate from a missile, such as a sea-launched ballistic missile; a satellite asset; or a relatively low-cost balloon-borne vehicle.
Non-Nuclear EMP (NNEP) can be created by sources such as Radio Frequency Weapons or Intentional Electromagnetic Interference devices, which are designed to produce sufficient electromagnetic energy to burn out or disrupt electronic components, systems, and networks. NNEP devices can be either electrically-driven, where they create narrowband or wideband microwaves, or explosively-driven, where an explosive is used to compress a magnetic field to generate the pulse. The range of an NNEP is fairly short (typically less than 1 kilometer) and faraday casings with line filters and surge arresters can mitigate much of the EMP effects.
Potential Impacts to Critical Infrastructure from EMP
In some of its forms, EMP can cause widespread disruption and serious damage to electronic devices and networks, including those upon which many critical infrastructures rely. There is uncertainty over the magnitude and duration of an electric power outage that may result from an EMP event due to ambiguity regarding the actual damage to electric power assets from an event. Any electric power outage resulting from an EMP event would ultimately depend upon a number of unknown factors and effects to assets that are challenging to accurately model, making it difficult to provide high-specificity information to electric system planners and system operators. These variables include characteristics such as the EMP device type, the location of the blast, the height of the blast, the yield of the blast, and design and operating parameters of the electric power system subject to the blast. Secondary effects of EMP may harm people through induced fires, electric shocks, and disruptions of transportation and critical support systems, such as those at hospitals or sites like nuclear power plants and chemical facilities.
All critical infrastructure sectors are at risk from EMP, particularly those sectors that rely heavily on communications and sensor (e.g., radar) technology, information technology, the electric grid, or that use a Supervisory Control and Data Acquisition system. The complex interconnectivity among critical infrastructure sectors means that EMP incidents that affect a single sector are likely affect other sectors – potentially resulting in additional failures.
DHS Efforts to Address GAO Recommendations
DHS is working collaboratively, both internally and with external stakeholders, in various arenas to address the recommendations issued by GAO on this topic. DHS has been working on the topic of EMP for a number of years, and we will continue working on it in the future. An example of our previous work on the topic of EMP includes a 2010 study on “Electromagnetic Pulse (EMP) Impacts on Extra High Voltage Power Transformers” conducted by the National Infrastructure Simulation and Analysis Center for DHS.
As part of DHS’s continuing commitment to this issue, there are resources across the Homeland Security enterprise engaged on this topic, including within the Federal Emergency Management Agency (FEMA), the National Protection and Programs Directorate (NPPD), and the Science and Technology Directorate (S&T). The scope of activity, as reviewed by GAO, falls into three areas of activity: (1) risk assessment and analysis, (2) communication and coordination of threat information, and (3) research and development to mitigate EMP risks.
NPPD’s involvement on EMP issues resides in a number of functional components including the Office of Cyber and Infrastructure Analysis (OCIA), the Office of Infrastructure Protection (IP), and the Office of Cybersecurity and Communications (CS&C). OCIA has partnered directly with the DOE’s Office of Electricity Delivery and Energy Reliability to assess the impacts of EMP and Geomagnetic disturbance events on electric power assets. This study, facilitated through DHS’s National Infrastructure Simulation and Analysis Center and DOE’s National Laboratories, is intended to develop scientifically rigorous, peer-reviewed methods for assessing electric power asset impacts to EMP events. This study will include participation of the Intelligence Community, the broader interagency, the academic community, and the private sector, when possible.
The EMP study by OCIA will leverage newly-started private sector activities that are occurring through the Electric Power Research Institute, as well as previous government investments in research which have been sponsored by DHS and DOE. The estimated completion date of this risk analysis-based study of the electric power sector is approximately mid-2017.
IP and OCIA continue to work collaboratively with the Department of Energy and the Federal Energy Regulatory Commission (FERC). As the GAO report indicates, collaboration can and should be increased with an emphasis on identification of critical infrastructure assets of the electric power sector. Once identified, this list of assets can be used to guide protection and preparedness activities at DHS and to help prioritize response and recovery actions by DOE and DHS after a large-scale event. DHS is also increasing our collaboration with DOE and FERC in the near-term, including additional collaboration between staff-level subject matter experts.
CS&C, which oversees the National Cybersecurity and Communications Integration Center (NCCIC), has been assessing the potential risks to the communications and control elements of the electric grid from EMP, as well as radio frequency weapons, solar weather, and cyber threats for several years. As part of these efforts, the NCCIC developed the “EMP Protection Guidelines for Equipment, Facilities and Data Centers” report and provided related briefings to the Continuity of Government community and to the Communications Sector, as well as other programs and sectors, to inform the community and help mitigate EMP and radio frequency weapons threats. The previously mentioned joint study by OCIA and DOE’s Office of Electricity Delivery and Energy will seek to learn and build upon the knowledge and expertise gained from the NCCIC’s previous studies on this topic.
FEMA continues to leverage the National Preparedness System to build, sustain, and deliver the capabilities needed to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk, including risks to the energy sector. The tools and processes within the National Preparedness System include, but are not limited to, plans, training, and exercises for managing a variety of risks to the nation’s infrastructure, including EMP and cyber vulnerabilities.
FEMA is also actively developing their Power Outage Incident Annex to enhance the Response and Recovery Federal Interagency Operational Plans. The Annex, developed in partnership with the federal interagency community and the private sector, will describe the process and organizational constructs through which the Federal Government will respond to and recover from the impacts of a widespread disruption in the power grid from any cause.
Lastly, S&T develops near-term solutions to bridge capability gaps, and S&T has invested in multiple research programs for increasing the electric grid’s resilience against solar weather hazards. Previous research investments, such as the Recovery Transformer (RecX) project, are available for private sector risk reduction on EMP and are available to be deployed by private sector owners and operators today.
Conclusion
DHS, for many years, has pursued a deeper understanding of the EMP threat, as well as its potential impacts, effective mitigation strategies, and a greater level of public awareness and readiness. These efforts have been undertaken in cooperation with other federal agencies and private sector owners and operators; and we are committed to continuing to expand our focus on this issue, as warranted by the risk environment.
I want to thank the Committee for the invitation to speak here today and for your ongoing support for our work in this area. I welcome your questions.