Congress: Key Findings from the EMP Commission Report

Testimony of George H. Baker

Professor Emeritus, James Madison University

Before the

House Committee on National Security and the

House Subcommittee on the Interior of the House Committee on Oversight and

Government Reform

Joint Hearing on “The EMP Threat: The State of Preparedness against the Threat of an

Electromagnetic Pulse (EMP) Event”

May 13, 2015

Key Findings from the EMP Commission Report of 2008

The Commission to Assess the threat to the United States from Electromagnetic Pulse, on which I served as principal staff, made a compelling case for protecting critical infrastructure against the nuclear electromagnetic pulse (EMP) and geomagnetic disturbances (GMD) caused by severe solar storms. Their 2008 Critical Infrastructure Report explains EMP effects, consequences, and protection means for critical infrastructure sectors. EMP and GMD are particularly challenging in that they interfere with electrical power and electronic data, control, transmission, and communication systems organic to nearly all critical infrastructures. The affected geography may be continental in scale. EMP and GMD events thus represent a class of high-consequence disasters that is unique in its coverage, ubiquity, and simultaneous system debilitation. Such disasters deserve particular attention with regard to preparedness and recovery since assistance from non-affected regions of the nation could be scarce or nonexistent. The major point I want to make to Congress is that such disasters are preventable. We have the engineering know-how and tools to protect ourselves. What is lacking is resolve.

Brief Tutorial on EMP and GMD Phenomenology

A brief tutorial on EMP and GMD phenomenology will be helpful to the discussion. The nuclear electromagnetic pulse (EMP) results from a nuclear burst high above the jet stream. A similar effect can occur naturally when an intense wave of charged particles from the sun perturbs the earth’s magnetic field, causing a solar storm GMD.

In the case of high altitude nuclear bursts, two main EMP types come into play that I will refer to as the “fast pulse” and the “slow pulse.” The fast pulse EMP field, also referred to as E1, is created by gamma ray interaction with stratospheric air molecules. It peaks at tens of kilovolts per meter in a few nanoseconds, and lasts for a few hundred nanoseconds. The broad-band frequency content of E1 (0-1000 megahertz) enables it to couple to electrical and electronic systems in general, regardless of the length of their penetrating cables and antenna lines. Induced currents range into the 1,000s of amperes. Exposed

1

systems may be upset or permanently damaged.

The “slow pulse” EMP, also referred to as E3, is caused by the distortion of the earth’s magnetic field lines due to the expanding nuclear fireball and rising of heated and ionized layers of the ionosphere. The change of the magnetic field at the earth’s surface induces currents of hundreds to thousands of amperes in long conducting lines (with lengths of a few kilometers or greater) that damage components of the electric power grid itself as well as powered systems. Long-line communication systems are also affected, including copper as well as fiber-optic lines with repeaters. Transoceanic cables are a prime example of the latter.

Solar storm GMD effects are the result of large excursions in the flux levels of charged particles from the Sun and their interactions with the Earth’s magnetic field. The electrojets from these storms, depending on their orientation, generate overvoltages in long-line systems over large regions of the earth’s surface affecting electric power and communication transmission networks in a similar fashion to EMP/E3. Note that protecting long-line systems against EMP (E1 and E3) also affords protection against GMD effects. The converse is not true. Protecting electric transmission systems against solar storm GMD/E3 does protect against EMP/E3 –but defending against the fast pulse EMP/E1requires different equipment.

A summary of the nuclear and solar environments of concern is provided in the table below.

2

Long-line connected equipment is especially vulnerable to EMP and GMD

Similar to protecting critical infrastructure against any hazard, it will be important to develop risk-based priority approach for the solar GMD and nuclear EMP threats, recognizing that it will be fiscally impracticable to protect everything. Because electromagnetic threat environments are measured in volts per meter, a given system’s vulnerability increases with the length of its connecting lines. Because the electric power grid and long-haul communications network (including telephone and Internet) deliver services on long-lines, these infrastructures are the most vulnerable to EMP and GMD. It is ironic that the infrastructures most vulnerable to EMP and GMD are arguably the most critical to society, not only for day-to-day enterprise and life support, but also for recovery were disasters to occur.

Since a simple measure of risk is the multiplicative product of vulnerability and criticality, the electric power and the long-haul telecommunications networks sit at the top of the risk ranking hierarchy. Thus, attention to the electric power grid and long-haul communications infrastructures would bring major benefits to national resiliency. Of these two, the electric power grid is the arguably the most important – all other infrastructures ride on the electric power system. And the grid is the most essential infrastructure for sustaining population life-support services. And the electric power system operation is brittle and binary, and fails fast and hard. Some essential heavy-duty electric power grid components take months to replace – or years if large numbers are damaged. A primary example is high voltage transformers which are known to irreparably fail during major solar storms and are thus likely to fail during an EMP event. Protection of these large transformers will buy valuable time in restoring the grid and the lifeline services it enables. By contrast, communications networks are more malleable due to their technological diversity and the relative ease of component replacement and repair.

DoD has adopted protective priorities using commercial protective equipment

We have much to learn from the Department of Defense (DoD) experience in prioritizing and protecting systems since the 1960s. The DoD has prioritized and has protected selected systems against EMP (and, by similitude to E3, GMD effects). DoD places emphasis on protecting its strategic triad and associated command, control, communications, computer, and intelligence (C4I) systems.

Although DoD has been successful in protecting its high priority systems dating back to the Minuteman system procurement in the 1960s, our civilian enterprise remain unprotected. In my experience, the lack of progress in protecting civilian infrastructures to EMP and GMD is due to three main factors:

3

1. There are prevalent misconceptions about EMP and GMD threats and consequences.

2. Stakeholders are reluctant to act.

3. No single organization is the designated executive agent.

I shall address these factors in order.

1. EMP/GMD Misconceptions.

There are many misconceptions about EMP and GMD that are circulating among both technical and policy experts, in press reports, on preparedness websites, and even embedded in technical journals. Because many aspects of the EMP and GMD generation and system interaction physics are non-intuitive, misconceptions are inevitable. Uneasiness about the wide-area, ubiquitous effects of EMP and the diversity of systems affected make it convenient to adopt misconceptions that avoid the need for action. Denying the seriousness of the effect appears perfectly responsible to many stakeholder groups. Misconceptions involving consequence minimization or hyperbole have served to deter action in the past. Downplaying the threats places EMP/GMD preparedness on the back-burner compared to other effects. Exaggeration of the threats causes policy-makers to dismiss arguments, ascribing them to tin foil hat conspiracy theories.

I will address what are perhaps the most harmful misconceptions, viz:

1. Nuclear EMP will burn out every exposed electronic system.

2. Alternatively, EMP/GMD effects will be very limited and only result in “nuisance” effects in critical infrastructure systems.

3. Megaton class weapons are needed to cause any serious EMP effects – low yield, “entry-level” weapons will not cause serious EMP effects.

4. To protect our critical national infrastructure against EMP and GMD would cost a large fraction of the GNP

Misconception A: Nuclear EMP will burn out every exposed electronic system.

Based on DoD and Congressional EMP Commission’s EMP test data bases we know that smaller, self-contained systems that are not connected to long-lines tend not to be affected by EMP fields. Examples of such systems include vehicles, hand-held radios, and disconnected portable generators. If there is an effect on these systems, it is more often temporary upset rather than component burnout.

On the other hand, threat-level EMP testing also reveals that systems connected to long lines are highly vulnerable to component damage, necessitating repair or replacement. Because the strength of EMP fields is measured in volts per meter, to first order, the longer

4

the line, the more EMP energy will be coupled into the system and the higher the probability of EMP damage. Because of their organic long lines, the electrical power grid network and long-haul landline communication systems are almost certain to experience component damage when exposed to EMP with cascading effects to most other (dependent) infrastructure systems.

Misconception B: EMP effects will be very limited and cause only easily recoverable “nuisance” type effects in critical infrastructure systems.

Although EMP does not affect every system, widespread failure of limited numbers of systems will cause large-scale cascading failures of critical infrastructure systems and system networks because of the interdependencies among the failed subsystems and the interlinked electrical/electronic systems not directly affected by the EMP.

Paul Erdos’ “small world” network theory applies to EMP failure analysis.1 The graph above illustrates that the average fraction of nodes in any network that are connected to any single network node changes suddenly when the average number of links per node exceeds one. For example, a failed node, where the average links per node is 2, can affect ~ 50% of the remaining network nodes.

Moreover, for many systems, especially computer controlled machinery and unmanned systems, upset is tantamount to permanent damage – and may cause permanent damage including structural damage in some cases, to systems due to interruption of control. Examples include:

 Upset of generator controls in electric power plants

 Upset of robotic machine process controllers in manufacturing plants  Lockup (and need for reboot) of long-haul communication repeaters  Upset of remote pipeline pressure control SCADA system

1 Duncan Watts, Six Degrees: The Science of the Connected Age, 2004.

5

Misconception C: Megaton-class nuclear weapons are required to cause serious EMP effects. “Entry-level,” kiloton-class weapons will not produce serious effects.

Due to a limiting atmospheric saturation effect in the EMP generation process, low yield weapons produce peak E1 fields of the same order of magnitude as large yield weapons if they are detonated at altitudes in the 50-80 km range. The advantage of high yield weapons is that their field on the ground is attenuated less significantly at larger heights of burst (that expose larger areas of the Earth’s surface.

The first graph above illustrates that nominal weapons with yields ranging from 3 kilotons to 3 megatons (a 3 order of magnitude difference in yield), exhibit a range of peak E1 fields on the ground with only a factor of 3 difference, i.e. 15kV/meter vs. 50 kV/meter. Although E3 fields vs. yield and height of burst are not illustrated above, a 30 kiloton nuclear weapon detonated above 100 km can cause magnetic field disturbances as large as solar superstorms, although over smaller regions.

The second graph above indicates that megavolt levels and kiloampere-level currents are induced in long overhead lines by E1 from kiloton-class weapons, such as those that might be produced by an emerging nuclear power.

Misconception D: to protect our critical national infrastructure against EMP and GMD would cost a large fraction of the U.S. Gross National Product.

Among the critical infrastructure sectors, EMP risk is highest for electric power grid and telecommunication grids – attention to these infrastructures alone would bring major benefits to national resiliency and enhance deterrent effects. These infrastructures are the most vulnerable due to their organic long lines. And they are also the most critical to the operation and recovery of the other critical infrastructure sectors. As mentioned

6

previously, if we have to pick one infrastructure to protect, the top choice would be the electric power grid.

The Foundation for Resilient Societies, a non-profit organization on which I serve as a member of the Board of Directors, has developed a comprehensive cost estimate for grid protection that includes costs for protecting the grid and the portions of other sectors required for grid operation, viz. fuel supply and communication. Resiliency of the electric grid depends upon concurrent protection of key telecommunications, Class 1 railroad systems that transport coal to generation plants, and interstate natural gas pipeline systems. The combined costs, summarized here, are in the range of $30 Billion.

The costs to protect roughly the transmission and distribution system and half of the U.S. generation capacity are provided in the table below:

Resilient Societies Cost Projections

Electric Generation Plants	$23,0000M
Electricity Transmission & Distribution	$2,300M
Electric Grid Control Centers	$1,390.M
Telecommunications	$1,480M
Natural Gas System	$640M
Railroads	$1,380M
Blackstart Plant Resiliency	$80M
	$30,270M

Using the $30,270 bottom line EMP and GMD protection cost estimate and a levelized annual revenue requirement of 20% ($6B), assuming there are ~150 million rate payers in the United States, the estimated annual cost per rate payer would be $3.30 per month.

There are strong arguments for protecting selected subsets of the grid. For example, a top priority to ensure situational awareness following a GMD or EMP event would be to protect major grid control centers. Estimates to protect these are in the $1.4 billion ballpark. If a Phase 1 EMP/GMD program operated in 2016-2020 at a five year cost of $1.4 billion, or $280 million per year, and all the extra costs were passed through to retail customers, the extra cost would be approximately $0.16 per electric customer per month.

We also might put priority on ensuring the survivability of major grid components that would take months to replace –or years if large numbers suffer damage. A primary example would be high voltage transformers which are known to irreparably fail during major solar storms and are thus also vulnerable to failure during an EMP event. Protection of these large transformers would save valuable time in restoring the grid and the life-support services it enables. The unit cost for HV transformer protection is estimated to be

7

$350,000. The total number of susceptible units range from 300 – 3000 (further assessment is required to establish an exact number.) Doing the math, the protected cost for protecting 3000 of these longest replacement lead-time components of the grid is $ 1 billion – a small fraction of the value of losses (Lloyds of London estimates are in the trillions of dollars2 for GMD alone) and long-term recovery costs should they fail.

2. Stakeholder Reluctance.

Concern about costs and liabilities makes stakeholders in government and the private sector reluctant to admit vulnerabilities. A major impediment to action on protecting the grid against GMD and EMP effects has been that government and industry are (understandably) swayed by the familiar, the convenient, and the bottom line. Like it or not, familiarity and profitability are the touchstones of acceptability – strategic advantage goes to the convenient. Thus, the tendency exists to downplay the likelihood of EMP and GMD and their associated consequences. The prevalent misconceptions (factor 1) have also contributed to stakeholders’ ability to downplay the seriousness of EMP and GMD effects to avoid action.

In cases where stakeholders have decided to take action to improve infrastructure survivability, the actions have been limited and ineffective. A primary case in point is the NERC effort to set reliability standards for wide-area electromagnetic effects. Responding to FERC’s inquiries for protection standards, the NERC formed a GMD task force. When several task force participants asked why EMP could not be part of the task force deliberations, NERC leadership explained that EMP was a national defense concern and therefore not their responsibility – rather that DoD should take the lead.

The standards ultimately developed by NERC include a set of operational procedures requiring no physical protection of the electric grid and a scientifically-flawed benchmark GMD threat description that enables most U.S. utilities to avert installing physical protection based on their own paper modeling studies. The benchmark GMD threat description is based on solar storm statistics over the last 25 years during which there were no “Carrington Class” 100-year solar superstorms. The Carrington-class storm GMD levels are an order of magnitude higher than the largest storms in the NERC 25 year data window. NERC’s benchmark event is admissible only if we assume that all eleven-year solar cycles are the same, an assumption known to be incorrect. A skeptic might suspect that the NERC standard’s main objective was to avert liability rather than protect the public from serious GMD consequences.

2. Space Weather: It’s Impact on Earth and Implications for Business, Lloyds of London, 2010. In this report Lloyds advocates development of robust systems designed to operate through space weather events.

8

The outcome of the NERC operational procedures standard, now approved by FERC, is that the public will not be protected from EMP and the industry will deal with GMD effects using operational work-around procedures such as shedding load and spinning up reserve generation capacity.

The operational procedure-based solutions that have been offered by NERC in their recently adopted EOP-010-01-1 standard are ineffective for a number of reasons. A non-exhaustive list of ten pitfalls accompanying reliance on operational procedures to protect the electric power grid follows.

1. GMD operating procedures are based on the premise that operators can and will prevent large-scale grid collapse by shedding load. Due to insurance rules, grid operators will be reluctant to shed load to customers, even though load-shedding procedures reduce the probability of grid collapse and damage to EHV transformers. Utility companies know that if customer electric power is lost due to geomagnetic disturbance (GMD), they will not be liable for losses; but if customer power is lost due to intentional human action to de-energize the grid or portions of it, power companies can be held liable. (Reference the Lloyds of London report on GMD effects and liabilities and statements by insurance company representatives at 2012 Electric Infrastructure Security Summit at UK Parliament).

2. The 15-45 minute warning time earlier provided by the Advanced Composition Explorer (ACE) satellite and now supported by the Deep Space Climate Observatory (DSCOVR) successor will be inadequate for grid operators to confer while executing required operational procedures. Participants in the 2011 National Defense University-Johns Hopkins University GMD response exercise indicated that they would be hard-pressed even to get all the players to the table within such a short time interval. And, once hit, the grid would fail quickly. We note that, in 1989, during a moderate solar storm GMD, the electric power grid of the entire Province of Quebec went dark in 92 seconds. The August 2003 Northeast Blackout evolved much more slowly (1:31pm – 4:10pm) with much more time available to take action. Nonetheless, even with a span of hours available, power companies were unable to react fast enough to prevent grid collapse.

3. Grid operators will not have adequate information on the state of the grid to implement correct operational procedures. Because most of the grid is not monitored for Geomagnetically Induced Currents (GIC), operators will be “flying blind” with respect to the state of the grid. Operators will not know which portions need remedial action and what actions will be optimal. Information gaps will exist as in August 2003 – where operators were unaware of the initiating tree contact. Sensors needed to monitor GMD/EMP stressors on critical grid components were not required by NERC standards and have not

9

been installed. And this lack of visibility has led and will lead to errors in executing operational procedures.

4. There is no control center with large enough visibility to control operational procedure response on a national scale. Lack of information on neighboring interconnections impairs proper procedural response. A national control/coordination center does not exist. And in the Eastern Interconnection, there is no single authority over the nine American regional Reliability Coordinators. Because the geographic coverage of solar storm GMD and nuclear EMP can be continental in scale, super-regional control visibility and authority are necessary. At this point, only the federal government, using Presidential authority, can fulfill this role.

4. Operational procedures have not been adequate to address the much simpler causes of previous large-scale blackouts. For instance, operational procedures proved ineffective in preventing the 2003 Northeast blackout that was precipitated by a single failure point – tree contact with a transmission line. Recent grid models indicate that GMD and EMP will cause hundreds to thousands of failure points. The complexity and rapidity of grid failure during a Carrington-class event will overwhelm the ability of electric utilities to respond and to prevent grid failure using any suite of operational procedures, no matter how well-conceived and practiced. During Hurricane Sandy, grid physical damage outstripped the effectiveness of procedural protection efforts. Physical damage to grid components will be a factor in GMD/EMP events as well.

4. Unforeseen grid equipment malfunctions have greatly impaired grid operators’ ability to respond during major blackouts in the past. Operational procedures during the 2003 Northeast blackout were greatly impaired by computer control system malfunctions and software problems. Critical grid state monitoring, logging and alarm equipment failed. The control area’s SCADA and emergency management systems malfunctioned. The shut-down of hundreds of generators over multiple states was unanticipated as was the failure of tens of transmission lines. Confusion and inoperative control systems led to many frantic phone calls. As these events, show, any early failure of major grid components caused by the GMD or EMP environment will impede implementation of subsequent operational procedures.

4. EMP and GMD will affect the communication systems necessary for coordination of operational procedures. Long-line internet and telecommunications networks will experience large overvoltages from GMD and EMP E1/E3 environments, likely causing their debilitation. GMD and EMP also impede signal propagation of HF/VHF/UHF radio systems and GPS systems. Thus grid communication and control systems necessary to execute operational procedures cannot be relied on – just when they will be needed the most.

10

8. It is not possible to anticipate all grid failure point combinations and time sequences during GMD/EMP events in order to adequately plan, exercise, and test GMD/EMP operational procedures. Normal grid failures are not indicative of GMD/EMP failures. Operators are familiar with commonly occurring single equipment failures but when multiple points fail near simultaneously under GMD/EMP stress, and the failures interact and cascade, operators will have difficulty understanding and responding to prevent further damage.

In most complex human-machine systems, the interactions literally cannot be seen.

Prof. Charles Perrow of Yale defines ‘normal accidents’ in complex infrastructure systems as involving system interactions that are not only unexpected, but are incomprehensible for some critical period of time. For example, it took an expert NERC investigation team three months to determine the exact combination and sequence of system failures that led to the 2003 Northeast blackout.

8. In the Eastern Interconnection, Regional Transmission Organizations (RTOs) and Independent System Operators (ISO’s) don’t have cross-jurisdictional authority to enforce shutdown of neighboring grids, sometimes required to avoid large scale blackouts, as in the August 2003 Northeast Blackout. There is no overall supervisor for the Eastern Interconnection. During the 2003 Northeast blackout, First Energy was asked to shed load by its neighboring grid operators but First Energy declined. According to the NERC after-action report, load shedding would have prevented the ensuing Northeast blackout.

8. Draft NERC GMD operational procedures recently approved by FERC (Order No. 797, June 2014) are not comprehensive and not specific. The plans generator operators and load balancing authorities from mitigation responsibilities. The NERC operational procedures also exempt portions of the grid operating below 200kV. In the August 2003 blackout, failure of 125 kV lines played a major role in the collapse of the Northeast grid.

The GMD operational procedures and solar storm benchmark event approved by FERC are ineffective and allow the electric power industry to continue with no significant upgrades to their physical assets, leaving the grid vulnerable to 100 year solar superstorms and EMP. It is worth noting that while GMD fields are more intense at northern latitudes, E3 fields increase at more southerly latitudes relative to the locus of a high altitude EMP event. Utilities that require no protection against GMD because of their southerly latitude under the newly operative standard would be experience higher E3 fields in the event of an EMP event than their northerly counterparts. The bifurcated “stove-pipe” threat approach being pursued to protect the electric power grid is cost- and outcome-ineffective. We need to develop a unified, all-threat approach to this challenge which leads to the third and final impediment to progress:

11

3. There is no one in charge.

To a major extent, the lack of progress in protecting our most critical infrastructure to EMP and GMD is that the responsibility is distributed. There is no single point of responsibility to develop and implement a national protection plan. Nobody is in charge. When I asked the North American Electrical Reliability Corporation about EMP protection, they informed me, “we don’t do EMP, that’s a Department of Defense problem.” The Department of Defense tells me, “EMP protection of the civilian infrastructure is a DHS responsibility.” DHS explained to me that the responsibility for the electric power grid protection is within DOE since they are the designated Sector Specific Agency (SSA) for the energy infrastructure.

EMP protection has become a finger pointing, “ring around the rosey,” duck-and-cover game. Our bureaucracy has enabled gaps for addressing the difficult problems of EMP and GMD, resulting in no substantive action to protect the nation. We have the classic Washington problem of issues that span departments or fall between departments, which we’re all very familiar with, but then we add to that the involvement of the private sector, without central leadership, we’re foundering. Because these catastrophes can be continental in scale with everyone in trouble, and there’s nobody left to help, the ultimate solution, by default, has fallen to the state and local levels. States are entitled to protect the safety, reliability and adequacy” of their electric grids, but most states expect the federal government to provide leadership in protecting the bulk power system. Local level preparedness is crucial, but we still need federal top down guidance to achieve a uniform, coordinated approach to the problem – to be able to triage, to standardize protection methods across the states and localities. We know, and I’ve stressed, that we can’t protect everything. Uniform guidance is needed to determine what needs to be protected and assign responsibilities. Local jurisdictions need top-level guidance and information to understand what to do.

The current state of EMP protection is random, disoriented and uncoordinated. As we go forward, I suggest that Congress establish a responsible party or agency to be the central whip for EMP preparedness. That would change the landscape materially and make progress possible.

Recommendations for Future Progress.

We must come to grips as a nation with the EMP/GMD preparedness challenges. The consequences of these threats are preventable. The good news is that the engineering

12

tools are available to protect a meaningful set of high-priority infrastructures.3 There are a number of initiatives that would greatly aid in this endeavor.

First, a designated national executive agency and director is needed. DHS and DoD are likely candidates. Of these, DoD has the most experience. The first order of business should be a national EMP/GMD protection plan and a set of national planning scenarios.

Second, let us begin a national program to protect the electric power grid, including essential supporting infrastructures used for fuel supply and communication.

Third, Congress should address problems inherent in the regulation of electric reliability as conceived in the Energy Policy Act of 2005. Establishing a new independent commission solely focused on electric grid reliability would be helpful – a commission with the power to issue and enforce regulations, similar to the Nuclear Regulatory Commission. The present FERC-NERC arrangement has proven ineffective with respect to EMP/GMD preparedness.

___________________________________________________________________________________________________

Thank you for the opportunity to share my perspective on EMP and GMD issues and solutions.

Respectfully Submitted,

George H. Baker

Professor Emeritus

James Madison University

3. The Electric Infrastructure Security Council has recently published an Electric Infrastructure Protection Handbook and Mil-STD-188-125 provides guidance for protecting communication and data systems.

13