Chinese cyber threats underscore need for state & local action

New Chinese Cyber Threat

The discovery of Chinese malware deeply embedded in computer networks connected to U.S. military bases, which one congressional official called a “a ticking time bomb,” should be major national security wake-up call. The Chinese malware may have the ability to shut off civilian power and communications infrastructure that military bases rely upon to operate – putting the wider civilian population at risk.

Typical malware attacks are often used to hold vital personal or professional data ransom. The Chinese malware can apparently be used in a much more hostile and damaging way. Experts interviewed by the New York Times say “disruption, not surveillance, appears to be the objective” of these latest cyber penetrations.

The placement of this malware is a calculated move on the part of the Chinese Communist Party (CCP) harkening back to Sun Tzu’s admonishment that “the skillful leader subdues the enemy’s troops without any fighting.”

As a report for the U.S. Air Force Electromagnetic Defense Task Force (EDTF) explains, America’s military could be completely “subdued” in the event of a long-term outage of the electrical grid.

Unfortunately, it is very possible that malware and other forms of cyberattack can be used to create very long-term damaging effects to our life sustaining infrastructures – such as the grid.

For example, in 2007, a group of U.S. government and power industry engineers conducted an experiment at the Idaho National Laboratory to demonstrate that a large electric generator, such as those used in the grid, can be destroyed by remotely turning it off and then back on rapidly. The vulnerability was given the term “Aurora” and unfortunately – despite our own military spending time, money, and expertise to develop hardware mitigation technologies for it – our electric power industry and other critical infrastructures are still open to such an attack sixteen years later.

Worrisome Timing

The timing of these recent Chinese cyber-attacks is also strategic, and worrisome.

The CCP is ramping-up their military to prepare for a blockade or invasion of Taiwan. Recent naval drills, including a “cross sea troop transport exercise,” displayed China’s growing capability to invade either the main Taiwanese island of Formosa or its other territorial islands. The Chinese People’s Liberation Army Navy also recently conducted a dangerous naval maneuver towards the U.S. Navy that “violated the maritime ‘Rules of the Road’ of safe passage in international waters,” according to the U.S. Indo-Pacific Command.

As the New York Times noted, if the CCP is able to slow the U.S. response to a Chinese invasion of Taiwan by cutting off communications to key military bases in the Asian region and elsewhere, that could help the Chinese take Taiwan by force. Colonel (Ret.) John Mills likewise warned that the malware could be targeting American shipyards, ports, and radars to do the same.

Were the malware used to turn off power and communications, even temporarily, it would present a major escalation in terms of cyber warfare.

One way to respond to the planting of malicious cyberwarfare is through deterrence, with the U.S. conducting similar types of cyber operations to demonstrate a comparable capability. But there’s limited data available on the effectiveness of deterrence in preventing cyberwarfare because of its inherent deniability and the difficulty in attributing such attacks.

Since deterrence against cyberwarfare is unreliable at best, it is necessary to defend our systems, and our society, against this threat. Unfortunately, despite numerous petitions from grid security advocates there is still no requirement by the federal government for the electric utility industry to defend against malware.  In 2017, the Federal Energy Regulatory Commission (FERC) said it would “decline” to mandate measures to detect, mitigate and remove malware from electrical grid systems.

State and Local Action is Needed

Given the lack of will at the federal level among industry leaders and regulators, more will need to be done locally to protect our critical infrastructures and to prepare in the event of such an attack. Louisiana state Senator Barry Milligan has authored multiple forms of legislation to protect his state’s critical infrastructure from nefarious Chinese tech companies that serve as entry points for Chinese cyberwarfare – setting an example for state leaders across America.

Local and state preparedness has traditionally been central to efforts to defend, and increase the survivability of the populace, against threats to the U.S. homeland.

While the federal government has largely abandoned the effort to promote significant preparedness, there is no reason why communities cannot fill in the gap. A recent report from the Center for Security Policy argued for reestablishing the U.S. civil defense effort, which was prevalent during the early part of the Cold War, when the effectiveness of deterrence of was also untested. Civil Defense requires mobilizing the civilian population to prepare to respond in the event of attacks against the homeland. These efforts should include preparations for long-term widespread power outages such as might occur from a deliberate cyberattack.

Fortunately, the Department of Homeland Security’s Cyber Infrastructure Security Agency (CISA) formed the Resilient Power Working Group (RPWG) to assist. Consisting of members from across numerous federal agencies, state and local governments, non-profits, and private industry, the RPWG created, “Resilient Power Best Practices for Critical Facilities and Sites” a document which “supports emergency and continuity managers with guidelines, analysis, background material, and references to increase the resilience of backup and emergency power systems during all durations of power outages.”

One such community taking matters into their own hands is Rangely, Colorado. The Rangley Initiative had its roots in community education and outreach by volunteer experts and citizens working to promote grid security, including members of the EMP Task Force on National and Homeland Security and in 2021 it got a major boost of momentum in response to the Texas blackout that year.  The people of Rangely realized Washington was not going to be able to protect their grid, which their 2,300 people rely on, in the event of an EMP attack or solar superstorm, so they determined to build “redundant microgrids” and sought help from Cogency™ Power, a Colorado-based solar company. Cogency™ Power’s systems are 70% efficient compared to the industry average of 12-15% and have the ability to “store energy geothermally for a year using much less actual space.” The initiative’s goal of adding these solar power systems would decrease reliance on the grid, while providing a clean, reliable, and resilient source of electricity to support the community’s critical infrastructures, particularly its water and wastewater systems.  The blueprint developed by the Rangley community is a prime example of how community-level critical infrastructure resiliency is possible. It should therefore be supported and funded by the federal and state government and replicated across the country.

Given the increasing aggressiveness of Communist China toward kinetic warfare in the Pacific, the CCP’s rapidly increasing threats to American critical infrastructure, and the terribly slow federal response, it would be prudent for states and communities to adopt more aggressive measures to mitigate these threats and prepare their populations. Every state and community taking these steps will contribute to the overall defense of the nation.