Speaker 1: Usually when we talk about a system crashing, there is
Speaker 1: like a certain blast radius we expect, you know.
Speaker 2: Right, Yeah, like if a retail website goes down, exactly.
Speaker 1: You can't buy those shoes you wanted, and it's annoying,
Speaker 1: but it's really just an isolated digital blip.
Speaker 2: The physical world around you remains totally untouched. I mean,
Speaker 2: you just close your laptop and your day goes on.
Speaker 1: Right, But today we are doing a deep dive into
Speaker 1: a hidden, really high stakes battleground where that digital physical
Speaker 1: boundary just completely vanished.
Speaker 2: It has it entirely disappears.
Speaker 1: Yeah, we're looking at our electricity infrastructure. Historically the power
Speaker 1: grid was just pure physics, right, coal copper wires, giant
Speaker 1: metal switches.
Speaker 2: You big heavy machinery exactly.
Speaker 1: But now it's what engineers call a cyber physical system
Speaker 1: or CPS, and that means computer code can literally cause
Speaker 1: physical destruction in the real world.
Speaker 2: And the traditional rules of cybersecurity, you know, the ones
Speaker 2: protecting that shoe website we talked about, they are completely
Speaker 2: turned upside down.
Speaker 1: Here because it's not about passwords anymore.
Speaker 2: No, not at all. It's about protecting the laws of
Speaker 2: physics and understanding this is so vital because well, your home,
Speaker 2: your appliances, your most mundane daily habits are now intimately
Speaker 2: connected to this massive cyberphysical web.
Speaker 1: Okay, let's unpack this. Our grounding source for this journey
Speaker 1: is this twenty seventeen technical deep dive called Cyberphysical Security
Speaker 1: and Privacy in the Electric Smart Grid by Bruce McMillan
Speaker 1: and Thomas Roth.
Speaker 2: A fascinating read.
Speaker 1: It really is. And to understand how the grid is hacked,
Speaker 1: we first have to understand how radically the architecture has
Speaker 1: changed over the years. We are moving from this giant
Speaker 1: centralized machine to a massive distributed internet of things.
Speaker 2: Yeah, because for over a century, the bulk transmission grid
Speaker 2: was heavily centralized. Power flowed strictly.
Speaker 1: One way right top down right.
Speaker 2: Exactly from a massive generation plant like coal, nuclear, hydro,
Speaker 2: down to the substations and finally to you. The consumer
Speaker 2: control meant a central operator actually you know, manually flipping
Speaker 2: him relays, or are sending a guy in a truck
Speaker 2: to physically turn a switch.
Speaker 1: I always kind of picture the old grid like a
Speaker 1: giant megaphone, you know, the utility stands at the top
Speaker 1: just shouting power down to the masses, it's a completely
Speaker 1: one way street.
Speaker 2: That's a great analogy.
Speaker 1: Thanks, But the modern smart grid is it's more like
Speaker 1: a giant, chaotic group chat, like every single device is
Speaker 1: talking at the exact same time.
Speaker 2: And the main issue with a group chat is that
Speaker 2: everybody has a microphone. Right at the most basic level,
Speaker 2: we have what's called advanced Metering infrastructure or AMI. These
Speaker 2: are the smart meters on the side of your house.
Speaker 2: They allow two way communication, so.
Speaker 1: The utility talks to the house and the house talks
Speaker 1: back exactly.
Speaker 2: Yeah, the utility sends pricing signals and they engage in
Speaker 2: something called demand side management.
Speaker 1: Demand side management, Okay, that's when the utility actually overrides
Speaker 1: and turns off your heavy appliances, right, like an air
Speaker 1: conditioner or a water heater.
Speaker 2: Yeah, during peak usage hours to dynamically balance the load
Speaker 2: on the grid. And the architecture scals up even further
Speaker 2: into microgrids. So think of a military base or like
Speaker 2: a really forward thinking neighborhood with its own solar panels
Speaker 2: and massive battery storage.
Speaker 1: Right, so they generate their own power.
Speaker 2: Yeah, and it operates connected to the main utility, but
Speaker 2: it can actually island itself.
Speaker 1: Island itself like cut the.
Speaker 2: Cord, literally physically severing the connection and running completely independently
Speaker 2: if the main grid goes down.
Speaker 1: Okay, but the holy grail of this distributed architecture is
Speaker 1: something called the Freedom system, right friedm.
Speaker 2: Yeah, the Freedom system. It's a fully distributed peer to
Speaker 2: peer energy internet. There is no central.
Speaker 1: Boss at all, So who's in charge?
Speaker 2: Well, smart solid state transformers act as brokers. They're constantly
Speaker 2: negotiating power sharing and voltage stability with each other.
Speaker 1: Okay, but if we give every single house, every solar panel,
Speaker 1: and every electric car a voice in this group chat,
Speaker 1: I mean, in a megaphone system, if someone hacks a house,
Speaker 1: they're just whispering into a void.
Speaker 2: Right, nobody hears it.
Speaker 1: But in a group chat, every house has a microphone
Speaker 1: hooked up to the main speakers, So if one house screams,
Speaker 1: it can blow out the entire neighborhood's audio. Aren't we
Speaker 1: just opening up like millions of new front doors for hackers?
Speaker 2: Well, what's fascinating here is that this cyber physical connection
Speaker 2: introduces vulnerabilities that simply didn't exist before. A single rogue
Speaker 2: cyber command can now alter the physical flow of power
Speaker 2: through these advanced power.
Speaker 1: Electronics, which are the FACTS devices right.
Speaker 2: Yes, flexible AC transmission or a FTTS devices.
Speaker 1: Let's drill into that mechanism for a second. How does
Speaker 1: a cyber command physically break the grid using a FACTS device?
Speaker 2: So AFTS devices act like giant intelligent routers for electricity.
Speaker 2: They constantly adjust the resistance and voltage on transmission lines
Speaker 2: to basically push or pull alternating current where it's needed
Speaker 2: most to stay efficient.
Speaker 1: Okay, so it's directing traffic exactly.
Speaker 2: Now. If an attacker gains control of a FACTS device,
Speaker 2: they don't even need to shut off a power plant.
Speaker 2: They can just force all the electricity and given region
Speaker 2: down a single already strain transmission line, and then the
Speaker 2: line absorbs too much current, physically overheats, SAgs into a tree,
Speaker 2: and shorts.
Speaker 1: Out, which triggers a cascading blackout.
Speaker 2: Across multiple states. And purely from a software command routing
Speaker 2: physical energy, that is terrifying.
Speaker 1: So if building a giant IoT grid creates these massive
Speaker 1: physical vulnerabilities, engineers naturally just reached for the cybersecurity tools
Speaker 1: they already had, right They tried applying military and corporate
Speaker 1: IT security models to the physical world.
Speaker 2: They did, and those models failed miserably. Why because the
Speaker 2: underlying priorities of the systems are fundamentally opposed. In standard
Speaker 2: IT security is built around the CIA triad confidentiality, integrity,
Speaker 2: and availability.
Speaker 1: Okay CIA.
Speaker 2: Yeah, And for a bank or a database, confidentiality is
Speaker 2: king you cannot let someone steal the data. But in
Speaker 2: a power grid availability, keeping the lights on has historically
Speaker 2: been the absolute top. I mean, if a control system crashes,
Speaker 2: people freeze in their homes.
Speaker 1: Right. So let's look at the first classic security model.
Speaker 1: Engineers tried to adapt the military's Bella Padula or BLP,
Speaker 1: and this model is entirely about keeping secrets.
Speaker 2: Yeah, the BLP model is based on strict security clearances
Speaker 2: top secret, secret, unclassified. The absolute rule of BLP is
Speaker 2: read down right up. A general can read a privates report,
Speaker 2: but the general can never write down to.
Speaker 1: The private because they might accidentally leak top secret information
Speaker 1: to a lower clearance level.
Speaker 2: Exactly, information only flows up the chain of command.
Speaker 1: Wait, if BLP focuses on secrecy, that doesn't help a
Speaker 1: power grid where keeping the lights on is the priority,
Speaker 1: not at all. I mean, if the highly secure system
Speaker 1: control center is the general and the power meters on
Speaker 1: our houses are the privates. The control center is strictly
Speaker 1: forbidden from sending commands down to the meters. The grid
Speaker 1: literally cannot function. If the control center can't send instructions
Speaker 1: to power.
Speaker 2: It totally breaks the system. Yeah, there has to be
Speaker 2: a model that focuses on data trust instead of data secrecy.
Speaker 1: Okay, so what did they try next?
Speaker 2: That brings us to the Biba model. It's a commercial
Speaker 2: approach focused entirely on integrity. Can we trust the data?
Speaker 2: The rule for Biba flips BLP upside down, write down readout.
Speaker 2: High integrity systems can send data down to low integrity systems,
Speaker 2: but they can never accept data.
Speaker 1: From them write down read out.
Speaker 2: Yeah, Biba uses a low watermark policy. If a high
Speaker 2: integrity system reads data from a low integrity source, its
Speaker 2: own integrity is instantly downgraded to match that lower level.
Speaker 1: I love the analogy the book uses for this, the
Speaker 1: reality television analogy. It's perfect for understanding this.
Speaker 2: Oh yeah, the reality TV one.
Speaker 1: Yeah, like watching a poorly produced reality show lowers your
Speaker 1: intelligence to match the show.
Speaker 2: It's so true.
Speaker 1: In the utility wheel, if a highly secure, high integrity
Speaker 1: physical control center accepts a message from a less secure
Speaker 1: corporate business network, the control center is mathematic compromised, it
Speaker 1: washed reality TV.
Speaker 2: And that logic dictates why utilities build these incredibly rigid
Speaker 2: firewalls that only let data flow out to the business
Speaker 2: side for billing, but never into the control room. The
Speaker 2: control room must maintain its high integrity to keep the
Speaker 2: physical grid stable.
Speaker 1: But here's where it gets really interesting. That firewall works
Speaker 1: perfectly for separating the control room from the corporate accountants.
Speaker 2: But what about the customer, right the consumer?
Speaker 1: If the utility needs to control my smart thermostat for
Speaker 1: that demand side management we talked about earlier, my home
Speaker 1: network is inherently low integrity. It is full of hackable
Speaker 1: smart TVs, tablets, light bulbs.
Speaker 2: It's a mess.
Speaker 1: Yeah. So how does the high integrity control room accept
Speaker 1: data from my low integrity smart meter without instantly breaking
Speaker 1: the beta security model?
Speaker 2: Well it can't. The mathematical model shatters traditional firewalls, and
Speaker 2: it models cannot cleanly separate the utility from the customer
Speaker 2: without severing the very two two way functionality that makes
Speaker 2: the smart grids smart in the first place.
Speaker 1: Wow. So if the security models fundamentally clash with the
Speaker 1: grid's architecture. Attackers are just handed this terrifying loophole. They
Speaker 1: realize they don't have to brute force a massive firewall,
Speaker 1: They just have to spoof the physical reality.
Speaker 2: Exactly. Because the modern grid is far too vast and
Speaker 2: complex to monitor manually, utilities have relied on state estimation
Speaker 2: algorithms since the nineteen sixties.
Speaker 1: State estimation, Yeah, they.
Speaker 2: Use bad data detection to automatically filter out sensors that
Speaker 2: physically break or drift out of calibration or just glitch. Okay,
Speaker 2: makes sense, But intelligent attackers bypass this entirely by feeding
Speaker 2: the system lies that perfectly obey the laws of physics.
Speaker 1: Wait, how do you lie to a physics algorithm?
Speaker 2: By calculating the grid's exact physical topology. If an attacker
Speaker 2: compromises the substation sensors, they don't send random chaotic numbers.
Speaker 1: Because the bad data algorithm would catch that immediately as
Speaker 1: physically impossible.
Speaker 2: Exactly INSTEA, the attackers run the same Newton rafts and
Speaker 2: powerflow equations that the utility uses.
Speaker 1: Newton rafts and equations, yeah.
Speaker 2: They calculate exactly what a normal alternating current state should
Speaker 2: look like. Across that specific web of copper wires and
Speaker 2: they inject those mathematically flawless false numbers. Oh wow, the
Speaker 2: bad data detection algorithm runs the math, sees that the
Speaker 2: simulated physics check out perfectly, and just accepts the lie
Speaker 2: as objective truth.
Speaker 1: Wait. If the bad data detection algorithm just rubber stamps
Speaker 1: mathematically perfect lies, then the human operators are essentially.
Speaker 2: Flying blind, completely blind.
Speaker 1: It's like when the stuck snet malware hit those nuclear centrifuges.
Speaker 1: It didn't just alter the physical speed of the rotors
Speaker 1: to tear them apart. It actively fed flawlessly faked normal
Speaker 1: speed readings back to the operators screens.
Speaker 2: Yeah, the operators saw green lights and perfect data while
Speaker 2: the physical machines destroyed themselves right in the next room.
Speaker 2: That is wild, and that phenomenon is formally known as
Speaker 2: non deducibility. It is a cornerstone concept information flowed disruption.
Speaker 2: If an attack produces the exact same cyber readings as
Speaker 2: a normal, healthy operation, the observer can never logically deduce
Speaker 2: what actually happened. The attack is mathematically secure.
Speaker 1: From detection, unbelievable, and the problem scales up dangerously When
Speaker 1: we hit multiple security domain non deducibility or msdnd.
Speaker 2: H mis needy.
Speaker 1: Yeah. Imagine a neighborhood that shares a public leaderboard screen
Speaker 1: showing the total energy usage of the block. If an
Speaker 1: attacker disrupts the power to one specific house, someone looking
Speaker 1: at the total neighborhood usage on the leaderboard might see
Speaker 1: a slight dip, but they can't deduce which house was targeted.
Speaker 2: Right. The overlapping security domains, like the individual house's private
Speaker 2: meter versus the shared neighborhood infrastructure, create these dense layers
Speaker 2: of non deducibility.
Speaker 1: It provides a level of privacy for the homeowner.
Speaker 2: Sure yeah, but it creates an absolute nightmare for detecting
Speaker 2: coordinated surgical attacks on specific nodes in the grid.
Speaker 1: So if the control center is looking at a screen
Speaker 1: that says everything is perfectly and the math perfectly checks out,
Speaker 1: how do they ever know they are under attack?
Speaker 2: Well, this raises an important question, and answering it required
Speaker 2: a massive paradigm shift in cyber defense. Defenders realized they
Speaker 2: had to stop relying purely on software firewalls. They needed
Speaker 2: a lie detector for the smart grid, something an attacker
Speaker 2: couldn't forge with clever code.
Speaker 1: So they looked at physics exactly.
Speaker 2: They had to look outside the software entirely to the
Speaker 2: physical laws of nature.
Speaker 1: So if the software is constantly lying to the operators,
Speaker 1: they use the physical infrastructure itself as a high integrity
Speaker 1: message channel. Yes, physical attestation. You verify a cyber process
Speaker 1: by measuring its actual tangible effect on the real world.
Speaker 2: Right, and one of the primary tools for achieving this
Speaker 2: is the phaser measurement unit.
Speaker 1: Or PMU TMU.
Speaker 2: These devices are installed all across the transmission grid and
Speaker 2: they rely on GPS synchronized clocks. Because they are tied
Speaker 2: to Global positioning satellites. Pmus provide incredibly high fidelity micro
Speaker 2: grow second level measurements of the alternating current sine waves.
Speaker 1: Okay, let's break down the mechanism there. How does a
Speaker 1: GPS clock catch a hacker?
Speaker 2: Well, electricity travels it near the speed of light. If
Speaker 2: a hacker injects false data into a substation's computer, telling
Speaker 2: the control center that powerflow is normal, the PMU physically
Speaker 2: measures the actual power waves hitting that specific location at
Speaker 2: an exact microsecond. Ah I see, the GPS timestamp is
Speaker 2: so precise that if the physical wave arrives even a
Speaker 2: fraction of a millisecond differently than the software claims it should.
Speaker 2: The PMU flags the mismatch.
Speaker 1: Because the attacker can fake the software data, but they
Speaker 1: cannot fake the physical speed of light across the copper
Speaker 1: wire exactly.
Speaker 2: It is an incorruptible auditor constantly chicking the math against
Speaker 2: physical reality.
Speaker 1: That is so clever. And we also see this concept
Speaker 1: applied to hardware itself, right with physically unclonable functions or
Speaker 1: pus BUS. Yeah, they look at the unique microscopic manufacturing
Speaker 1: quirks in a microchip's silicon like affections so incredibly small
Speaker 1: they occur randomly during fabrication to.
Speaker 2: Ensure a device isn't a counterfeit replacement. You can't forge
Speaker 2: random atomic level manufacturing errors.
Speaker 1: It is an elegant use of physical imperfection to guarantee security.
Speaker 1: And this philosophy extends beyond hardware checks into algorithmic behavior too,
Speaker 1: using reputation based security.
Speaker 2: Oh absolutely yeah. As the smart grid becomes fully distributed
Speaker 2: like that peer to peer freedom system where smart transformers
Speaker 2: constantly negotiate with each other, the network starts judging devices
Speaker 2: on their past.
Speaker 1: Behavior, and there are even sociological methods for building this reputation,
Speaker 1: which blew my mind.
Speaker 2: Oh yeah, using demographic data.
Speaker 1: Right, like household income, square footage, neighborhood averages. Using all
Speaker 1: that to predict an expected power usage baseline. If a
Speaker 1: house's behavior suddenly and wildly deviates from what is socially
Speaker 1: and physically expected, its reputation drops. Yeah.
Speaker 2: Algorithmic reputation functions similarly to Byzantine agreement protocols in distributing computing.
Speaker 1: Byzantine agreement.
Speaker 2: Yeah. In a Byzantine system, a network of nodes has
Speaker 2: to reach a consensus, even if some nodes are secretly
Speaker 2: compromised and sending conflicting information.
Speaker 1: Oh like a group of generals trying to coordinate an
Speaker 1: attack on a city, but they know some of their
Speaker 1: messengers are secretly enemy spies trying to scramble the orders.
Speaker 2: That's the exact concept. So if a solar panel or
Speaker 2: a smart transformer gets hacked and starts sending erratic data
Speaker 2: that threatens to destabilize the voltage, its reputation score drops
Speaker 2: below a certain threshold, and then what the rest of
Speaker 2: the peer to peer network effectively votes it off the
Speaker 2: island They refuse to trust its inputs. Or share power
Speaker 2: with it until its physical state can be verified by
Speaker 2: a human technician.
Speaker 1: Wow, so what does this all mean? The power grid
Speaker 1: is essentially building a credit score for my home appliances
Speaker 1: based on how reliably they follow the laws of physics.
Speaker 2: Pretty much.
Speaker 1: It is an incredibly robust defense mechanism against those Stuxnet
Speaker 1: style non deducible attacks. But to use physic as a
Speaker 1: light detector to build that behavioral credit score, there is
Speaker 1: a massive catch.
Speaker 2: A huge catch. The grid has to monitor the physical
Speaker 2: flow of power into your home with microscopic precision, and
Speaker 2: that level of precision fundamentally destroys personal privacy.
Speaker 1: Yeah, because in the past, to know what you were
Speaker 1: doing inside your house, someone would have to physically bug
Speaker 1: your oven, your fridge, your television. That is obviously intrusive, right,
Speaker 1: But the modern grid relies on non intrusive load monitoring
Speaker 1: or NIM.
Speaker 2: Right. With NILM, nobody needs to install individual bugs in
Speaker 2: your house. The smart meter simply analyzes the raw combined
Speaker 2: power line entering your home, just the one wire, just
Speaker 2: the one Using advanced mathematics, specifically hidden Markov models, the
Speaker 2: system disaggregates that single, messy stream of data.
Speaker 1: Okay, But how does a hidden Markov model actually separate
Speaker 1: my toaster from my error conditioner when they are all
Speaker 1: drawing power from the same exact line.
Speaker 2: Well, it's a statistical model that looks at sequences of
Speaker 2: observable events to guess hidden states based on probability. Every
Speaker 2: single appliance has a completely unique power signature, like a fingerprint. Exactly,
Speaker 2: the initial massive spike when a refrigerator compressor kicks on
Speaker 2: looks entirely different from the steady, continuous draw of a
Speaker 2: heating element in an oven.
Speaker 1: Oh I see.
Speaker 2: The Markov model analyzes the total power draw over time,
Speaker 2: identifies the probabilities of those distinct spikes, steady states, and decays,
Speaker 2: and mathematically untangles them. It acts like an audio engineer
Speaker 2: isolating the sound of a single violin from a dense
Speaker 2: recording of an entire symphony.
Speaker 1: That is wild. Imagine sitting alone in your house. The
Speaker 1: blinds are drawn, the doors are locked, but your smart
Speaker 1: meter knows you're making toast at two am. It knows
Speaker 1: exactly what time you woke up based on the coffee
Speaker 1: maker's power signature. It knows if you left the house
Speaker 1: empty or if you're up late watching a plasma TV.
Speaker 1: It maps your intimate personal habits minute by minute, just
Speaker 1: by watching the physics of your electricity.
Speaker 2: Yeah, and if we connect this to the bigger picture,
Speaker 2: it becomes clear why standards bodies are deeply concerned. Guidelines
Speaker 2: like Nister seven six twenty eight highlight that the primary
Speaker 2: threat isn't just foreign hackers shutting down the grid. It's
Speaker 2: the fact that utilities are legally collecting this intimate lifestyle
Speaker 2: data to make the physics lie detector work. In the
Speaker 2: first place. There's a massive risk of utilities selling these
Speaker 2: behavioral profiles to third party marketers or law enforcement using
Speaker 2: the grid data to deduce activity inside a home without
Speaker 2: needing traditional surveillance warrants.
Speaker 1: And the only physical defense offered against this privacy leak
Speaker 1: is something called load masking.
Speaker 2: Load masking which.
Speaker 1: Means you install a massive home battery, the house runs
Speaker 1: entirely off the battery, and the battery charges from the
Speaker 1: grid at a constant, steady reate.
Speaker 2: Right Because to the outside world, the smart meter just
Speaker 2: sees a flat, boring line of a battery charging, It
Speaker 2: completely obscures the distinct readable spikes of your toaster or
Speaker 2: your washing machine.
Speaker 1: It hides the fingerprint exactly, but.
Speaker 2: You utility scale home batteries are incredibly expensive, making privacy
Speaker 2: a premium luxury rather than a default right.
Speaker 1: So to wrap up here, we started by looking at
Speaker 1: a grid that evolved from a massive physical megaphone into
Speaker 1: a highly vulnerable peer to peer group chat where every
Speaker 1: house has a microphone.
Speaker 2: We did.
Speaker 1: We saw how traditional military and corporate IT security like
Speaker 1: the BLPN BIBA models crumbled because you just cannot build
Speaker 1: a firewall between a utility and its customers without breaking
Speaker 1: the flow of power that.
Speaker 2: You need that two way communication. We also examine non
Speaker 2: deducible attacks where hackers perfectly spoofed the physics of the grid,
Speaker 2: flying under the radar and blinding human.
Speaker 1: Operators, and we saw defenders counterattack by turning the physical
Speaker 1: infrastructure into a massive polygraph test using GPS, synchronized PMUS,
Speaker 1: and hidden markof models to catch mathematical lies at the
Speaker 1: speed of light.
Speaker 2: But the exact physical precision required to secure the grid
Speaker 2: from nation state hackers requires our own appliances to basically
Speaker 2: snitch on our deal habits.
Speaker 1: Yeah, we are in a transitional phase right now. Regulatory
Speaker 1: standards like the enter rc CIP framework still lean heavily
Speaker 1: on old school perimeter defenses, you know, just building taller
Speaker 1: firewalls around substations.
Speaker 2: But the future is racing towards systems like open FMB,
Speaker 2: fully embracing that open peer to peer IoT grid. The
Speaker 2: technology is shifting faster than the security models can adapt.
Speaker 1: Yeah, the engineers can build the physical attestation and the
Speaker 1: mathematicians can refine the Markov models, but human psychology remains
Speaker 1: the great unknown variable in this cyber physical system. So
Speaker 1: ask yourself, what are you willing to trade?
Speaker 2: That's the real question.
Speaker 1: Would you allow a utility to mathematically monitor your private lifestyle,
Speaker 1: knowing every single time you turn on a light in
Speaker 1: exchange for a grid that is immune to national scale blackouts,
Speaker 1: Where is your personal boundary? It's tough because when a
Speaker 1: cyber physical grid crashes, the real world starts, but keeping
Speaker 1: it running might cost you the sanctuary of your own home.
Speaker 1: Something to think about next time you make toast two
Speaker 1: a m.