Cyberthreats said to be increasing against grid

Private industry and government are paying more attention to cybersecurity, but the Government Accountability Office said control systems at such critical facilities "are more vulnerable (today) to cyberattacks than in the past."

Among reasons are the extensive use of the Internet and the systems' links.

Greg Wilshusen, the agency's director of information security issues, told a House Homeland Security subcommittee that the government has improved the security of power lines, nuclear plants, refineries and power stations.

Yet, he added, "there is yet no overall strategy to coordinate the various activities across federal agencies and the private sector."

The agency and several lawmakers said the Homeland Security Department is not doing enough to spread word about adequate standards for cybersecurity and threat information.

"The cyber-risk to these systems is increasing," said Democratic Rep. James Langevin, chairman of the subcommittee on emerging threats, cybersecurity and science and technology. "If this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty."

Langevin noted the recent disclosure that government scientists at the Energy Department's Idaho National Laboratory were able to hack into a simulated power plant control system and cause an electric generator to destroy itself.

While the test was conducted on a small-scale system, experts said it showed the potential that a similar attack could disable huge generators and other equipment essential to power production.

Texas Rep. Michael McCaul, the subcommittee's top Republican, said the simulated attack last March was "a good news story" because it disclosed vulnerabilities. He said changes and improvements were made to reduce the risk. "We found it.... We fixed it," McCaul said.

Greg Garcia, assistant secretary for cybersecurity, told lawmakers that "we've known for some time that there are (cyber) vulnerabilities." He said Homeland Security is working with other agencies on standards and guidance to protect critical control systems.

Rep. Zoe Lofgren, another Democrat, pressed Garcia on what the department is doing to get more stringent standards to industry. Garcia said issuing such standards was a job for the Federal Energy Regulatory Commission.

"Our role is one of coordination," he said.

Lofgren said that was not the intent of Congress when it created the department. "We haven't made any progress in the cybersecurity side for a long, long time," she said.

The commission is considering more stringent standards for the electricity industry that a quasi-industry group, the North American Electric Reliability Corp., is developing.

Joe Weiss, a cybersecurity consultant, said private industry should have to comply with tougher standards that already apply to the government's critical infrastructure.

David Whiteley, the group's executive vice president, said its proposed standards "represent a significant improvement of cybersecurity for the electricity industry."