Duke Energy accused of using illegal workers

Maryland Renewable Energy Violations highlight RPS compliance gaps as facilities selling renewable energy certificates, including waste-to-energy, biomass, and paper mills, face emissions and permit issues, prompting PSC and Attorney General scrutiny of environmental standards.

Key Points

Alleged RPS noncompliance by REC-eligible plants, prompting PSC review and potential decertification under Maryland law.

✅ Complaint targets waste-to-energy, biomass plants, and paper mills

✅ Facilities risk loss of REC certification for environmental violations

✅ PSC may investigate nonreporting; AG reviewing evidence

Many facilities that supply Maryland with renewable energy have exceeded pollution limits or otherwise broken environmental rules, violating a state law, according to a complaint sent by environmental groups to state energy and law enforcement officials.

Maryland law says that any company that contributes to a state renewable energy goal — half the state’s energy portfolio must come from renewable sources by 2030 — must “substantially comply” with rules on air and water quality and waste management. The complaint says more than two dozen power generators, including paper mills and trash incinerators, have records of formal or informal enforcement actions by environmental authorities.

For years, environmental groups have criticized Maryland policy that counts power plants that produce planet-warming carbon dioxide and health-threatening pollution as “renewable” energy generation, and similar tensions have emerged in California’s reliance on fossil fuels despite ambitious targets, but lawmakers concerned about protecting industrial jobs have resisted reforms. The renewable label qualifies the companies for subsidies drawn from energy bills across the state.

In a complaint filed this week, the groups asked the attorney general and Public Service Commission to step in.

“We’re subsidizing companies to produce dirty energy, but we’re also using ratepayer money to support companies that in many instances are paying environmental fines or just flouting the law,” said Timothy Whitehouse, executive director of Public Employees for Environmental Responsibility. “There’s no one to hold them to account in Maryland.”

A spokeswoman for Attorney General Brian Frosh said his office would review the complaint, which was signed by Whitehouse and Mike Ewall, executive director of the Energy Justice Network.

Public Service Commission officials said the facilities must notify them if found out of compliance with environmental rules, while at the federal level FERC action on aggregated DERs is shaping market participation, and the commission can then revoke certification under the state renewable energy program. In a statement, commission officials said they would launch an investigation if any facility had failed to notify them of any environmental violations, and encouraged anyone with evidence of such a transgression to file a complaint.

Companies named in the document accused the groups of painting an inaccurate picture.

“This complaint is based on misleading arguments designed to halt waste-to-energy practices that have clear environmental benefits recognized by the global scientific community,” said Jim Connolly, vice president of environment, health and safety for Wheelabrator, which owns a Baltimore trash incinerator.

Maryland launched its renewable energy program in 2004, diversifying the state’s energy portfolio with more environmentally friendly sources of power, even as regional debates over a Maine-Québec transmission line highlight cross-border impacts. Under the program, separate from the electricity they generate and sell to the grid, renewable power facilities can sell what are known as renewable energy certificates. Utilities such as Baltimore Gas and Electric Co. are required to buy a growing number of the certificates each year, essentially subsidizing the renewable energy facilities with money from ratepayer bills.

A dozen types of power generation qualify to sell the certificates: Solar, wind, geothermal and hydroelectric plants, as well as “biomass” facilities that burn wood and other organic matter, waste-to-energy plants that burn household trash and paper mills that burn a byproduct known as black liquor.

The complaint focuses on waste incinerators, biomass plants and paper mills, all of which environmental groups have cast as counter to the renewable energy program’s environmental goals, even as ACORE criticized a coal and nuclear subsidy proposal in federal proceedings.

“By subsidizing these corporations, Maryland is diverting the hard-earned income of Maryland ratepayers to wealthy corporations with poor environmental compliance records and undermining the state’s transition to clean renewable energy,” Whitehouse and Ewall wrote.

For example, they note that the Wheelabrator plant in Southwest Baltimore has been fined for exceeding mercury limits in the past. That occurred in 2011, when the plant settled with state regulators for violations in 2010 and 2009.

Connolly said there is “no question” the facility complies with Maryland’s renewable energy law.

Incinerators in Montgomery County and in Fairfax County, Virginia, that are owned by Covanta and sell the energy certificates in Maryland have been cited for accidental fires inside both facilities. The Maryland incinerator violated emissions rules in 2014, the same year that New Jersey forbade the Virginia facility from selling energy certificates into that state’s renewable energy program over concerns it wasn’t following ash testing regulations.

James Regan, a spokesman for Covanta, said both facilities “have excellent compliance records and they operate well below their permitted limits.” He said the Virginia facility is complying with ash testing requirements, and that both facilities emit far lower levels of pollutants such as particulate matter than vehicles do.

“It’s clear to us there’s a lot of misleading and wrong information in this document," Regan said.

The Environmental Protection Agency endorsed waste-to-energy facilities under former President Barack Obama because, while burning household trash emits carbon dioxide, scientists said that still had a smaller impact on global warming than sending trash to landfills, even as industry groups have backed the EPA in a legal challenge to the ACE rule as regulatory approaches shifted.

Environmentalists and community groups say the facilities still are harmful because they emit high levels of pollutants such as mercury, nitrogen oxides and lead. The concerns prompted Baltimore City Council to pass an ordinance in February that tightened emissions limits on the Wheelabrator facility, even as the new EPA pollution limits for coal and gas plants are being proposed, so dramatically that the company said it would no longer be able to operate once the rules go into effect in 2022.

The complaint does not mention the century-old Luke paper mill in Western Maryland that long faced criticism for its participation in the renewable energy program, but which owner Verso Co. closed this year.

It does say several of paper company WestRock’s mills in North Carolina and Virginia have faced both formal and informal EPA enforcement actions for violation of the Clean Water Act, including evolving EPA wastewater limits for power plants and other facilities, and the Clean Air Act. A WestRock spokesperson could not be reached for comment.

The complaint also says a large biomass facility in South Boston, Virginia, owned by the Northern Virginia Electric Cooperative has a record of noncompliance with the Clean Air Act over three years.

John Rainey, the plant’s operations director, said it “experienced some small exceedances to its permit limits,” but that it addressed the issues with Virginia environmental officials and has installed new technology.

All those plants have sold credits in Maryland.

Whitehouse said the environmental groups’ goal is to clean up Maryland’s renewable energy program. They did not file a lawsuit because he said there was no clear cause of action to take the state to court, but said he hopes the complaint nonetheless spurs action.

“It’s not acceptable in a clean energy program that we’re subsidizing some of the most dirty sources of energy,” he said. “Those sources aren’t even in compliance with the law, and no one seems to care.”

Related News

• Electricity Forum News

• Energy Policy News

Philippines coal dependency underscores energy transition challenges, climate change risks, and air pollution, as rising electricity demand, fossil fuels, and emissions shape policy shifts toward renewable energy, grid reliability, and sustainable development.

Key Points

It is rising reliance on coal for power, driven by demand and cost, with climate, air pollution, and policy risks.

✅ Driven by rising demand, affordability, and grid reliability.

✅ Worsens emissions, air pollution, and public health burdens.

✅ Policy shifts aim at renewable energy, efficiency, and standards.

In a striking development, the Philippines has surpassed China and Indonesia to become the nation most dependent on coal-generated power in recent years. This shift highlights significant implications for the country's energy strategy, environmental policies, and its commitment to sustainable development, and comes as global power demand continues to surge worldwide.

Rising Dependency on Coal

The Philippines' increasing reliance on coal-generated power is driven by several factors, including rapid economic growth, rising electricity demand, and regional uncertainties in China's electricity sector that influence fuel markets, and the perceived affordability and reliability of coal as an energy source. Coal has historically been a key component of the Philippines' energy mix, providing a stable supply of electricity to support industrialization and urbanization efforts.

Environmental and Health Impacts

Despite its economic benefits, coal-generated power comes with significant environmental and health costs, especially as soaring electricity and coal use amplifies exposure to pollution. Coal combustion releases greenhouse gases such as carbon dioxide, contributing to global warming and climate change. Additionally, coal-fired power plants emit pollutants such as sulfur dioxide, nitrogen oxides, and particulate matter, which pose health risks to nearby communities and degrade air quality.

Policy and Regulatory Landscape

The Philippines' energy policies have evolved to address the challenges posed by coal dependency while promoting sustainable alternatives. The government has introduced initiatives to encourage renewable energy development, improve energy efficiency, and, alongside stricter emissions standards on coal-fired power plants, is evaluating nuclear power for inclusion in the energy mix to meet future demand. However, balancing economic growth with environmental protection remains a complex and ongoing challenge.

International and Domestic Pressures

Internationally, there is growing pressure on countries to reduce reliance on fossil fuels and transition towards cleaner energy sources as part of global climate commitments under the Paris Agreement, illustrated by the United Kingdom's plan to end coal power within its grid. The Philippines' status as the most coal-dependent nation underscores the urgency for policymakers to accelerate the shift towards renewable energy and reduce carbon emissions to mitigate climate impacts.

Challenges and Opportunities

Transitioning away from coal-generated power presents both challenges and opportunities for the Philippines. Challenges include overcoming entrenched interests in the coal industry, addressing energy security concerns, and navigating the economic implications of energy transition, particularly as clean energy investment in developing nations has recently declined, adding financial headwinds. However, embracing renewable energy offers opportunities to diversify the energy mix, reduce dependence on imported fuels, create green jobs, and improve energy access in remote areas.

Community and Stakeholder Engagement

Engaging communities and stakeholders is crucial in shaping the Philippines' energy transition strategy. Local residents, environmental advocates, industry leaders, and policymakers play essential roles in fostering dialogue, raising awareness about the benefits of renewable energy, and advocating for policies that promote sustainable development and protect public health.

Future Outlook

The Philippines' path towards reducing coal dependency and advancing renewable energy is critical to achieving long-term sustainability and resilience against climate change impacts. By investing in renewable energy infrastructure, enhancing energy efficiency measures, and fostering innovation in clean technologies, as renewables poised to eclipse coal indicate broader momentum, the country can mitigate environmental risks, improve energy security, and contribute to global efforts to combat climate change.

Conclusion

As the Philippines surpasses China and Indonesia in coal-generated power dependency, the nation faces pivotal decisions regarding its energy future. Balancing economic growth with environmental stewardship requires strategic investments in renewable energy, robust policy frameworks, and proactive engagement with stakeholders to achieve a sustainable and resilient energy system. By prioritizing clean energy solutions, the Philippines can pave the way towards a greener and more sustainable future for generations to come.

Related News

• Electricity Forum News

• Power Generation News

Hertel-New York Interconnection delivers Hydro-Quebec renewable energy via a cross-border transmission line to New York City by 2025, supplying 1,250 MW through underground and underwater routes under a 25-year contract.

Key Points

A cross-border line delivering 1,250 MW of Hydro-Quebec hydropower to New York City via underground routes.

✅ 1,250 MW clean power to NYC by 2025

✅ 56.1 km underground, 1.6 km underwater in Quebec

✅ 25-year contract; Mohawk partnership revenue

Hydro-Quebec announced Thursday it has chosen the route for the Hertel-New York interconnection line, which will begin construction in the spring of 2023 in Quebec.

The project will deliver 1,250 megawatts of Quebec hydroelectricity to New York City starting in 2025, even as a recent electricity shortage report warns about rising demand at home.

It's a 25-year contract for Hydro-Quebec, the largest export contract for the province-owned company, and comes as hydrogen production investments gain traction in Eastern Canada.

The Crown corporation has not disclosed potential revenues from the project, but Premier François Legault mentioned on social media last September that a deal in principle worth more than $20 billion over 25 years was in the works.

The route includes a 56.1-kilometre underground and a 1.6-kilometre underwater section, similar to the Lake Erie Connector project planned under Lake Erie.

Eight municipalities in the Montérégie region will be affected: La Prairie, Saint-Philippe, Saint-Jacques-le-Mineur, Saint-Édouard, Saint-Patrice-de-Sherrington, Saint-Cyprien-de-Napierville, Saint-Bernard-de-Lacolle and Lacolle.

Across the country, new renewables such as wind projects in Yukon are receiving federal support, reflecting broader grid decarbonization.

The last part of the route will run along Fairbanks Creek to the Richelieu River, where it will connect with the American network.

Further south, there will be a 545-kilometre link between the Canada-U.S. border and New York City, while a separate Maine transmission approval advances a New England pathway for Quebec power.

Hydro-Quebec is holding two consultations on the project, on Dec. 8 in Lacolle and Dec. 9 in Saint-Jacques-le-Mineur.

Elsewhere in Atlantic Canada, EV-to-grid integration pilots are underway to test how vehicles can support the power system.

Once the route is in service, the Quebec line will be subject to a partnership between Hydro-Quebec and the Mohawk Council of Kahnawake, which will benefit from economic remunerations for 40 years.

To enhance reliability, grid-scale battery storage projects are also expanding in Ontario.

Related News

• Electricity Forum News

• EV Infrastructure News

CPUC Decision on San Diego Community Power directs SDG&E to use updated forecasts, stabilizing electricity rates for CCA customers and supporting clean energy in San Diego with accurate rate forecasting and reduced volatility.

Key Points

A CPUC ruling directing SDG&E to use updated forecasts to ensure accurate, stable CCA rates and limit volatility.

✅ Uses 2021 sales forecasts for rate setting

✅ Aims to prevent undercollection and bill spikes

✅ Levels changes across customer classes

The California Public Utilities Commission on Thursday sided with the soon-to-launch San Diego community energy program in a dispute it had with San Diego Gas & Electric.

San Diego Community Power — which will begin to purchase power for customers in San Diego, Chula Vista, La Mesa, Encinitas and Imperial Beach later this year — had complained to the commission that data SDG&E intended to use to calculate rates, including community choice exit fees that could make the new energy program less attractive to prospective customers.

SDG&E argued it was using numbers it was authorized to employ as part of a general rate case amid a potential rate structure revamp that is still being considered by the commission.

But in a 4-0 vote, the commission, or CPUC, sided with San Diego Community Power and directed SDG&E to use an updated forecast for energy sales.

"This was not an easy decision," said CPUC president Marybel Batjer at the meeting, held remotely due to COVID-19 restrictions. "In my mind, this outcome best accounts for the shifting realities ... in the San Diego area while minimizing the impact on ratepayers during these difficult financial times."

In filings to the commission, SDG&E predicted a rate decrease of 12.35 percent in the coming year. While that appears to be good news for customers, Californians still face soaring electricity prices statewide, Commissioner Martha Guzman Aceves said the data set SDG&E wanted to use would lead to an undercollection of $150 million to $260 million.

That would result in rates that would be "artificially low," Guzman Aceves said, and rates "would inevitably go up quite a bit after the undercollection was addressed."

San Diego Community Power, or SDCP, said the temporary reduction would make its rates less attractive than SDG&E's, especially amid SDG&E's minimum charge proposal affecting low-usage customers, just as it is about to begin serving customers. SDCP's board members wrote an open letter last month to the commission, accusing the utility of "willful manipulation of data."

Working with an administrative law judge at the CPUC, Guzman Aceves authored a proposal requiring SDG&E to use numbers based on 2021 forecasts, as regulators simultaneously weigh whether the state needs more power plants to ensure reliability. The utility argued that could result in an increase of "roughly 40 percent" for medium and large commercial and industrial customers this year.

To help reduce potential volatility, Guzman Aceves, SDCP and other community energy supporters called for using a formula that would average out changes in rates across customer classes amid debates over income-based utility charges statewide. That's what the commissioners OK'd Thursday.

"It is essential that customer commodity rates be as accurate as we can possibly get them to avoid undercollections," said Commissioner Genevieve Shiroma.

San Diego Community Power is one of 23 community choice aggregation, or CCA, energy programs that have launched in California in the past decade.

CCAs compete with traditional power companies amid California's evolving power competition landscape, in one important role — purchasing power for a given community. They were created to boost the use of cleaner energy sources, such as wind and solar, at rates equal to or lower than investor-owned utilities.

However, CCAs do not replace utilities because the incumbent power companies still perform all of the tasks outside of power purchasing, such as transmission and distribution of energy and customer billing.

When a CCA is formed, California rules stipulate the utility customers in that area are automatically enrolled in the CCA. If customers prefer to stay with their previous power company, they can opt out of joining the CCA.

The shift of customers from SDG&E to San Diego Community Power is expected to be large. The total number of accounts for SDCP is expected to be 770,000, which would make it the second-largest CCA in the state. That's why SDCP considered Thursday's CPUC decision to be so important.

"At a time when customers are choosing between sticking with San Diego Gas & Electric and migrating to a CCA, we want them to have accurate bill information," said Commissioner Clifford Rechtschaffen.

"SDCP is very happy with today's CPUC decision, and that the commissioners shared our goal of limiting rate volatility for businesses and families in the region," said SDCP interim CEO Bill Carnahan. "This is definitely a win for accurate rate forecasting, and our mutual customers, and we look forward to working with SDG&E on next steps."

In an email, SDG&E spokeswoman Helen Gao said, "We are committed to continuing to work collaboratively with local Community Choice Aggregation programs to support their successful launch in 2021 and ensure that our mutual customers receive excellent customer service."

San Diego Community Power's case before the CPUC was joined by the California Community Choice Association, a trade group advocating for CCAs, and the Clean Energy Alliance — the North County-based CCA representing Del Mar, Solana Beach and Carlsbad that is scheduled to launch this summer.

SDCP will begin its rollout this year, folding in about 71,000 municipal, commercial and industrial accounts. The bulk of its roughly 700,000 residential accounts is expected to come in January 2022.

Related News

• Electricity Forum News

• Energy Policy News

BWI Power Outage caused flight delays, cancellations, and diversions after a downed power line near Baltimore/Washington International. BGE crews responded as terminal operations, security screening, and boarding slowed, exposing infrastructure gaps and backup power needs.

Key Points

A downed power line disrupted BWI, causing delays, diversions, and slowed operations after power was restored by noon.

✅ Downed power line near airport spurred terminal-wide disruptions

✅ 150+ delays, dozens of cancellations; diversions to nearby airports

✅ BGE response, backup power gaps highlight infrastructure resilience

On the morning of March 3, 2025, a major power outage at Baltimore/Washington International Thurgood Marshall Airport (BWI) caused significant disruptions to air travel, much like the London morning outage that upended routines, affecting both departing and incoming flights. The outage, which began around 7:40 a.m., was caused by a downed power line near the airport, according to officials from Baltimore Gas and Electric Company. Although power was restored by noon, the effects were felt for several hours, resulting in flight delays, diversions, and a temporary disruption to airport operations.

Flight Disruptions and Delays

The outage severely impacted operations at BWI, with more than 150 flights delayed and dozens more canceled. The airport, which serves as a major hub for both domestic and international travel, was thrown into chaos, similar to the Atlanta airport blackout that snarled operations, as power outages affected various critical areas, including parts of the main terminal and an adjacent parking garage. The downed power line created a ripple effect throughout the airport’s operations, delaying not only the check-in and security screening processes but also the boarding of flights. In addition to the delays, some inbound flights had to be diverted to nearby airports, further complicating an already strained travel schedule.

With the disruption affecting vital functions of the airport, passengers were advised to stay in close contact with their airlines for updated flight statuses and to prepare for longer-than-usual wait times.

Impact on Passengers

As power began to return to different parts of the terminal, airport officials reported that airlines were improvising solutions to continue the deplaning process, such as using air stairs to help passengers exit planes that were grounded due to the power outage, a reminder of how transit networks can stall during grid failures, as seen with the London Underground outage that frustrated commuters. This created further delays for passengers attempting to leave the airport or transfer to connecting flights.

Many passengers, who were left stranded in the terminal, faced long lines at ticket counters, security checkpoints, and concessions as the airport worked to recover from the loss of power, a situation mirrored during the North Seattle outage that affected thousands. The situation was compounded by the fact that while power was restored by midday, the airport still struggled to return to full operational capacity, creating significant inconvenience for travelers.

Power Restoration and Continued Delays

By around noon, officials confirmed that power had been fully restored across the main terminal. However, the full return to normalcy was far from immediate. Airport staff continued to work on clearing backlogs and assisting passengers, but the effects of the outage lingered throughout the day. Passengers were warned to expect continued delays at ticket counters, security lines, and concessions as the airport caught up with the disruption caused by the morning’s power outage.

For many travelers, the experience was a reminder of how dependent airports and airlines are on uninterrupted power to function smoothly. The disruption to BWI serves as a case study in the potential vulnerabilities of critical infrastructure that is not immune to the effects of power failure, including weather-driven events like the windstorm outages that can sever lines. Moreover, it highlights the difficulties of recovering from such incidents while managing the expectations of a large number of stranded passengers.

Investigations into the Cause of the Outage

As of the latest reports, Baltimore Gas and Electric Company (BGE) crews were still investigating the cause of the power line failure, including weather-related factors seen when strong winds in the Miami Valley knocked out power. While no definitive cause had been provided by early afternoon, BGE spokesperson Stephanie Weaver confirmed that the company was working diligently to restore service. She noted that the downed line had caused widespread disruptions to electrical service in the area, which were exacerbated by the airport’s significant reliance on a stable power supply.

BWI officials remained in close contact with BGE to monitor the situation and ensure that necessary precautions were taken to prevent further disruptions. With power largely restored by midday, focus turned to the logistical challenges of clearing the resulting delays and assisting passengers in resuming their travel plans.

Response from the Airport and Airlines

In response to the power outage, BWI officials encouraged travelers to remain patient, a familiar message during prolonged events like Houston's extended outage in recent months, and continue checking their flight statuses. Although flight tracking websites and social media posts provided timely updates, passengers were urged to expect long delays throughout the day as the airport struggled to return to full capacity.

Airlines, for their part, worked swiftly to accommodate affected passengers, although the situation created a ripple effect across the airport's operations. With delayed flights and diverted planes, air traffic control and ground crews had to adjust flight schedules accordingly, resulting in even more congestion at the airport. Airlines coordinated with the airport to prioritize urgent cases, and some flights were re-routed to other nearby airports to mitigate the strain on the terminal.

Long-Term Effects on Airport Infrastructure

This incident underscores the importance of maintaining resilient infrastructure at key transportation hubs like BWI. Airports are vital nodes in the air travel network, and any disruption, whether from power failure or other factors, can have far-reaching consequences on both domestic and international travel. Experts suggest that BWI and other major airports should consider implementing backup power systems and other safeguards to ensure that they can continue to function smoothly during unforeseen disruptions.

While BWI officials were able to resolve the situation relatively quickly, the power outage left many passengers frustrated and inconvenienced. This incident serves as a reminder of the need for airports and utilities to have robust contingency plans in place to handle emergencies and prevent delays from spiraling into more significant disruptions.

The power outage at Baltimore/Washington International Airport highlights the vulnerability of critical infrastructure to power failures and the cascading effects such disruptions can have on travel. Although power was restored by noon, the delays, diversions, and logistical challenges faced by passengers underscore the need for greater resilience in airport operations. With travel back on track, BWI and other airports will likely revisit their contingency plans to ensure that they are better prepared for future incidents that could affect air travel.

Related News

• Electricity Forum News

• Utility Operations News

Infrastructure Security Algorithm prioritizes cyber defense for power grids and critical infrastructure, mitigating ransomware, blackout risks, and cascading failures by guiding utilities, regulators, and cyber insurers on optimal security investment allocation.

Key Points

An algorithm that optimizes security spending to cut ransomware and blackout risks across critical infrastructure.

✅ Guides utilities on optimal security allocation

✅ Uses incentives to correct human risk biases

✅ Prioritizes assets to prevent cascading outages

Millions of people could suddenly lose electricity if a ransomware attack just slightly tweaked energy flow onto the U.S. power grid, as past US utility intrusions have shown.

No single power utility company has enough resources to protect the entire grid, but maybe all 3,000 of the grid's utilities could fill in the most crucial security gaps if there were a map showing where to prioritize their security investments.

Purdue University researchers have developed an algorithm to create that map. Using this tool, regulatory authorities or cyber insurance companies could establish a framework for protecting the U.S. power grid that guides the security investments of power utility companies to parts of the grid at greatest risk of causing a blackout if hacked.

Power grids are a type of critical infrastructure, which is any network - whether physical like water systems or virtual like health care record keeping - considered essential to a country's function and safety. The biggest ransomware attacks in history have happened in the past year, affecting most sectors of critical infrastructure in the U.S. such as grain distribution systems in the food and agriculture sector and the Colonial Pipeline, which carries fuel throughout the East Coast, prompting increased military preparation for grid hacks in the U.S.

With this trend in mind, Purdue researchers evaluated the algorithm in the context of various types of critical infrastructure in addition to the power sector, including electricity-sector IoT devices that interface with grid operations. The goal is that the algorithm would help secure any large and complex infrastructure system against cyberattacks.

"Multiple companies own different parts of infrastructure. When ransomware hits, it affects lots of different pieces of technology owned by different providers, so that's what makes ransomware a problem at the state, national and even global level," said Saurabh Bagchi, a professor in the Elmore Family School of Electrical and Computer Engineering and Center for Education and Research in Information Assurance and Security at Purdue. "When you are investing security money on large-scale infrastructures, bad investment decisions can mean your power grid goes out, or your telecommunications network goes out for a few days."

Protecting infrastructure from hacks by improving security investment decisions

The researchers tested the algorithm in simulations of previously reported hacks to four infrastructure systems: a smart grid, industrial control system, e-commerce platform and web-based telecommunications network. They found that use of this algorithm results in the most optimal allocation of security investments for reducing the impact of a cyberattack.

The team's findings appear in a paper presented at this year's IEEE Symposium on Security and Privacy, the premier conference in the area of computer security. The team comprises Purdue professors Shreyas Sundaram and Timothy Cason and former PhD students Mustafa Abdallah and Daniel Woods.

"No one has an infinite security budget. You must decide how much to invest in each of your assets so that you gain a bump in the security of the overall system," Bagchi said.

The power grid, for example, is so interconnected that the security decisions of one power utility company can greatly impact the operations of other electrical plants. If the computers controlling one area's generators don't have adequate security protection, as seen when Russian hackers accessed control rooms at U.S. utilities, then a hack to those computers would disrupt energy flow to another area's generators, forcing them to shut down.

Since not all of the grid's utilities have the same security budget, it can be hard to ensure that critical points of entry to the grid's controls get the most investment in security protection.

The algorithm that Purdue researchers developed would incentivize each security decision maker to allocate security investments in a way that limits the cumulative damage a ransomware attack could cause. An attack on a single generator, for instance, would have less impact than an attack on the controls for a network of generators, which sophisticated grid-disruption malware can target at scale, rather than for the protection of a single generator.

Building an algorithm that considers the effects of human behavior

Bagchi's research shows how to increase cybersecurity in ways that address the interconnected nature of critical infrastructure but don't require an overhaul of the entire infrastructure system to be implemented.

As director of Purdue's Center for Resilient Infrastructures, Systems, and Processes, Bagchi has worked with the U.S. Department of Defense, Northrop Grumman Corp., Intel Corp., Adobe Inc., Google LLC and IBM Corp. on adopting solutions from his research. Bagchi's work has revealed the advantages of establishing an automatic response to attacks, and analyses like Symantec's Dragonfly report highlight energy-sector risks, leading to key innovations against ransomware threats, such as more effective ways to make decisions about backing up data.

There's a compelling reason why incentivizing good security decisions would work, Bagchi said. He and his team designed the algorithm based on findings from the field of behavioral economics, which studies how people make decisions with money.

"Before our work, not much computer security research had been done on how behaviors and biases affect the best defense mechanisms in a system. That's partly because humans are terrible at evaluating risk and an algorithm doesn't have any human biases," Bagchi said. "But for any system of reasonable complexity, decisions about security investments are almost always made with humans in the loop. For our algorithm, we explicitly consider the fact that different participants in an infrastructure system have different biases."

To develop the algorithm, Bagchi's team started by playing a game. They ran a series of experiments analyzing how groups of students chose to protect fake assets with fake investments. As in past studies in behavioral economics, they found that most study participants guessed poorly which assets were the most valuable and should be protected from security attacks. Most study participants also tended to spread out their investments instead of allocating them to one asset even when they were told which asset is the most vulnerable to an attack.

Using these findings, the researchers designed an algorithm that could work two ways: Either security decision makers pay a tax or fine when they make decisions that are less than optimal for the overall security of the system, or security decision makers receive a payment for investing in the most optimal manner.

"Right now, fines are levied as a reactive measure if there is a security incident. Fines or taxes don't have any relationship to the security investments or data of the different operators in critical infrastructure," Bagchi said.

In the researchers' simulations of real-world infrastructure systems, the algorithm successfully minimized the likelihood of losing assets to an attack that would decrease the overall security of the infrastructure system.

Bagchi's research group is working to make the algorithm more scalable and able to adapt to an attacker who may make multiple attempts to hack into a system. The researchers' work on the algorithm is funded by the National Science Foundation, the Wabash Heartland Innovation Network and the Army Research Lab.

Cybersecurity is an area of focus through Purdue's Next Moves, a set of initiatives that works to address some of the greatest technology challenges facing the U.S. Purdue's cybersecurity experts offer insights and assistance to improve the protection of power plants, electrical grids and other critical infrastructure.

Related News

• Electricity Forum News

• Grid Technologies News