← The Watch Floor with Sarah Adams
Loading summary
Transcript14 lines
- [00:00]
A
When you finally find your thing, you want the whole world to know about that thing. So you use a thing called canva to make it an even bigger and better thing. Whether you want to create flyers for that thing, make presentations for that thing, or design merch for that thing. You can do anything so people can see your thing, feel your thing, love your thing. The next thing you know, it's a thing. Canva, the thing that makes anything a thing.
- [00:30]
B
Welcome to the watch floor. I'm Sarah Adams. If you remember back To February of 2021, Texans went to bed just fine with the heat on. And when they woke up, the power was completely gone. Inside homes, temperatures were dropping below freezing. I mean, pipes even burst. We had hospitals that had to shift to emergency generators. They had to decide, hey, we are going to have to int, intentionally cut power to prevent a total collapse of the system. So even people who would have had working power, now it was gone. This moment is important because it's not really an outlier anymore. We have versions of the same stress happening all across the system today, and then just for different reasons. So we're going to jump into talking a little bit about the power grid and how fragile it really is. The US Electric grid is one of the most reliable large scale engineering systems ever built. But it's not one system. And this is what people kind of get confused on. It's this interconnected system where everything is synchronized. So think of it less like a machine and more like this ecosystem that's held in a balance. The real risk isn't like some sudden collapse of everything. It's this cascading disruption that puts small stresses on different domains at the same time. And so when we're saying domains, we mean like weather issues, cyber issue, supply chain problems, spikes in demand. Obviously, each of those problems you can handle individually, but when they're all happening at once, they compound. And then you can really have a catastrophic failure. So let's just quickly talk about how the grid actually works. So we have three core layers going on here. We have generation, transmission and distribution. So generation is just power is being produced. Could be at nuclear plants, natural gas facilities, hydro stations, using renewables, et cetera. Then we have transmission. That's these high voltage lines. They move electricity across long distances. Essentially it's the interstate highway of energy. Then we have distribution. And that obviously goes to your local utilities, whatever company is servicing your home, whoever services the hospitals and of course the local businesses. So a simple way to visualize it is generation is the engine, transmission is the highway. System and distribution is the neighborhood streets. So if one layer struggles, it can cause temporary effects, you know, across the board. And that then can compound across the system. As you can imagine, it's like if there's a car accident, right? How it affects different pieces of the whole puzzle. Let's just talk a little bit about the control of the system. So the grid is managed by scada, and that's called Supervisory Control and Data Acquisition Systems. So they do simple things. They monitor electricity flows in real time, they check out and make sure there's like balanced load and wattages. They control switching kind of the operations remotely within the system. And then they use this kind of mental model to do it. It's not really a software. Think of it more like the cockpit in a plane. And so the operations are constantly adjusting the system so it never shuts off. It goes based on demand and flows. You know, it's just this constantly evolving and changing process. Do you ever feel like something is off? You're hitting the gym, you're crushing your goals, you're showing up every single day? Or have you noticed a change in your partner? Slower recovery time, less focus, and a drive that used to be there that just isn't. It's subtle, but it's real. Most people don't understand that testosterone naturally decreases 1% every year over the age of 30. Think about it. That slow change really does make workouts harder. It makes the workday longer and, and it can make life more exhausting. That's where Marsman comes in. Your body produces testosterone, but sometimes it's just locked up. Think about it like this. You have money in the bank, but your debit card's not working. So you have the funds. You can't access them. Marsman helps you with that access. It helps you naturally. It uses eight clinically proven ingredients. We have Tongkat, Ali, Shilajit, vitamin D, zinc, boron, and others. What are men saying about this? Some are saying they're feeling like a stronger performance. Others are recovering faster from the gym. We're hearing about a more consistent natural energy. Not like when you have coffee. It's more of a sustained energy through the day. And many are saying they felt better than they felt in years. Marsman is made in the USA, it's third party tested, and it has a 90 day money back guarantee. There's essentially no risk to just go out and try it. 91% of users have felt, you know, some change in, in their performance and thousands have been happy with the product. I mean, just go see the Reviews for yourself. And here is the best part. For a limited time, our listeners get 50% off for life, plus free shipping and three free gifts. When they go to men, go to mars.com it's literally the perfect way to to continue the gains that you kicked off at the start of New Year's. Again, that's med g o t o mars.com to get your 50% off and your three free gifts. And at checkout, let them know the watch floor sent you. So there's no like single national grid controller in this country. Instead, Instead there's thousands of utilities, there's regional transmission organizations, and then of course we have FERC oversight and that's the Federal Energy Regulatory Commission. They're essentially like air traffic control. So the rules are centralized, operations are distributed, and then this creates resilience because it's all not down to if one location in this country fails. As you can imagine though, with all these different inputs, it also can create friction across the system, especially when there's some sort of crisis or an event that stresses the entire system. One of the most important constraints is this transformer dependency. So as everybody knows, we use these large power transformers. Mine was blown up in a hurricane a few years ago. They're custom built, they're extremely heavy and they require more than 12 to 24 months or more to replace. When it gets blown up, it takes about nine days to be fixed. Just so you know, it's not like this quick thing where you're swapping out a computer server and it's closer to kind of like thinking about an industrial engine and kind of the manufacturing and shipping behind something like this. And then of course it relies and you can imagine on supply chains, logistics, et cetera. So it's not this quick swap out that a lot of people I think hope it would be. And this of course then can lead to long recovery timelines after any sort of physical damage. Now today we do want to talk about threats to the system. But of course the biggest threat, the most common threat and the one that's going to impact the majority of us is any sort of climate issues. Because that type of crisis or local emergency is really what you face the majority of the time. Of course, I live in Florida. We have hurricanes, constant stress to the system. During that we talked about the Texas storms in 2021. That was a huge winter storm and then it just quickly overwhelmed the system. We had freezing gas infrastructure, rising demand because it was very cold for Texas. Us in the south don't like to be cold. We gotta have that heat on. There was shortfalls of generation. You couldn't even make. Make enough. And then the event just kind of cascaded into this massive failure. And we had a similar situation, of course, occur across multiple locations. When it came to Hurricane Helene in 2024, there was widespread power outages across big chunks of the southeastern portion of the United States, as everybody know and witnessed. And it wasn't just something as simple as, like, downed power lines that you have in storms. There was a lot of transmission access issues. And then, because so many things came down, like trees, things got washed out. We really had road closures, massive infrastructure damage. So you had to first repair the key corridors to even get to, you know, do restoration of the power. And so that, as you can imagine, extended timelines dramatically in those areas. And then there is some sort of reality we have to be honest about. So it's not only about electricity flow, but physical access to these systems. Right. If you can't get to them, you can't fix them. And that is why, when you have some sort of, like, weather event, it's such a more difficult situation to deal with. Now, then we do have kind of this next generation of concerns. And a lot of that, of course, is some sort of cyber attack. And there is an interesting case of it here in Florida back in 2021 in Oldsmar.
- [12:15]
C
Cybersecurity experts tell us this attack is significant. And while luckily it was caught in time, they say it should raise red flags about the vulnerability of our utility systems. The safety of the water coming out of the tap, it's the last thing on the minds of Bill Cordell and his Oldsmar neighbors.
- [12:34]
D
I was totally shocked to hear the news. I mean, a small town like Oldsmar, and you wonder who would even. We're not really on the map to most places. You know, nobody's ever even heard of Oldsmar.
- [12:44]
C
But now the Pinellas sheriff is teaming up with the FBI and Secret Service to track down a hacker who they say remotely accessed the water treatment system, attempting to increase the amount of sodium hydroxide in the water from 100 parts per million to more than 11,000 parts per million.
- [13:00]
E
This is obviously a significant and potentially dangerous increase. Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners.
- [13:09]
C
In small amounts, the chemical can be used to control water acidity and remove metals from drinking water. In large amounts, it can cause severe vomiting or even death.
- [13:18]
B
An attacker briefly accessed the water treatment system and then started tweaking the chemical levels in the water right this would have completely poisoned the water. Operators luckily saw this and intervened before any sort of impact to the public. So this is a small scale, right? It was a small town, but just think of the exposure and the thought of something like this occurring. You know, this was just a small municipality. What if this was done in a large metropolitan area, right, like a Detroit, Washington, D.C. new York City. So this really raised a lot of flakes for people because you don't always think kind of at these local levels about cybersecurity. Too often you get these ransomware issues, but these systems may not be as secure as kind of the federal government might guard some of their systems because they're constantly barraged, you know, by like outside actors trying to steal, steal information or commit cyber attacks, et cetera. This episode is brought to you by Pocket Hose, the world's number one expandable hose. I used to spend more time messing with the hose than actually watering. Last summer I decided to clean off the patio because some friends were coming over and the hose kept twisting up on itself. And what should have been a 5 minute job turned into a 20 minute hose headache. That constant kinking and twisting, that's what Pocket Hose Ballistic was built to solve. It's reinforced with a liquid crystal polymer, the same used in bulletproof vests. So it makes the anti burst sleeve incredibly tough. That same fiber is actually five times stronger than steel, so it's built to last. It also features the pocket pivot that swivels 360 degrees and with a steady flow, also reducing frustration. And when you're done, there's no wrestling with the hose. It literally shrinks down to pocket size for easy storage. Plus it's backed by a 10 year warranty. And now for a limited time, when you purchase a new Pocket Hose Ballistic, you'll get a free 360 degrees pocket pivot and a a free thumb drive nozzle. Just text watch to 64,000. That's watch to 64,000 for you. Two free gifts at purchase. Watch to 64,000. Message and data rates apply. Now, when we talk about ransomware, I mean, that's one of the biggest problems any kind of local municipality or even these companies are concerned with. Of course, electric company can have the same. And when the Colonial pipeline happened in 2021, that ransomware attack disrupted business systems, not just the operational pipeline controls.
- [16:32]
E
NBC News has learned Colonial Pipeline paid nearly 5 million in ransom to hackers who infiltrated their system, which led to the shutdown that sparking panic buying and massive outages in Central Florida. This Hummer went up in flames. The driver had just filled several five gallon containers loaded in the back. Now the Colonial pipeline is servicing all of its markets. But President Biden warning will not feel
- [16:58]
D
the effects at the pump immediately. This is not like flicking on a light switch.
- [17:04]
E
We were there as a fuel truck pulled up to fill up a Charlotte gas station that had run dry.
- [17:09]
B
I had people follow me from gas stations to follow where I'm going to another gas station.
- [17:14]
E
Because of that cyber attack, President Biden signed an executive order that will lay out stricter standards for any software sold to the US Government and an incident response team to look at these major cyber attacks.
- [17:25]
B
So the company had to shut down its operations and think about it. They couldn't do billing, scheduling, they couldn't do their logistics. All of that was offline. So any kind of physical operations really were almost impossible. And this is kind of the modern problem we're dealing with it disruption and shutdowns have massive effects across any organization. But think about it. When it's related to our energy and our power grid and the tools we need to use every day, you can't supply that, there's a problem. Now I want to take a quick second and separate cyber attacks or cyber threats from just like industrial reality. When we think of cyber attacks, we think of this like reconnaissance, this long term access behavior. And we sometimes forget the entire energy grid system relies on this infrastructure of supply chains. So for example, components used in the energy infrastructure, including sensors, communication system and grid adjacent hardware, they're part of the global supply chain. They're manufactured and assembled in China and other countries. It's not like we can just easily go pick this up off the shelf in the United States. And that creates its own dependency. It causes an effect we don't even understand yet until we actually need to go get those items supplied. And we have to remember then it gives them a little bit of control of this entire supply chain. So if we really did have some sort of large catastrophic failure, we couldn't fix it immediately. We would have to turn to someone like China to increase production or to ship things out faster to get these items to us, especially big pieces of, of our infrastructure. And I think that's something important to understand because it gives them kind of this carrot stick scenario that yes, you're not playing with right now, but it doesn't mean they won't. So when we say cyber access, we're kind of talking about the systems and networks and we definitely have a fear of actors, even in China going after them. And then of course, when we say that, hey, there's actually also this supply chain exposure that's about the hardware and the manufacturing inputs of the entire system. We have a risk model kind of on both sides, sides of the coin. And it's not always thought through that way. But it's important when we talk about the state sponsored activity from our adversaries. Obviously this is a huge concern. And like I said, it's usually kind of bucketed in the cybersecurity realm. And it's this fact that, hey, at any time the enemy could go after our critical infrastructure systems. Obviously. Now when we're talking about these nation states, the countries we're really referring to are China, Russia, Iran, who we're in the middle of a crisis with right now, of course, and North Korea. Really their activity to this point has not actually been destructive, it's been exploratory. They've been mapping our systems, understanding those dependencies, the ones I've talked about in the supply chain, identifying pathways where they can make future access into our system. So a real good way to look at this is like they're not out there breaking into the building, they're quietly walking every hallway to see how it's constructed, who's inside each door, where is the entrance and the exit, where are the stairwells. It's an interesting thing they're using kind of like this time they have and they're able to be patient as they lay out what our entire system looks like. And of course, where are the vulnerabilities? Now when we talk about non state actors, it's all over the place. There's of course these ransomware groups, and of course some of those can be attached to the state. We did a great episode previously on the Watch Floor where we talked about how North Korea runs these to fund their missile programs. So not every one of these is exactly non state, but these actors, of course, what they're usually doing in ransomware, they go in, they maybe encrypt the system and they say, hey, you have to pay us a certain fee if you want restoration of your system. So this really does cause like an operational paralysis and it almost makes the system unusable until this issue solves. So it is a big problem that we always have to be watching. Another thing we have is like these hacktivist groups and they're a little lower in the sophistication chain than the ransomware, but they do things that end up becoming short term disruptions and they surge a lot during kind of conflicts and geopolitical events. So now is a great time because of course we do have this issue with Iran and there's definitely a lot of opinions on both sides and it is something that will bring the hacktivists out then. The part I focus the most on is we of course have terrorists who are interested in our infrastructure in a number of ways, mostly to cause economic effects to our country and also just to make Americans feel, hey, you, government can't protect you. Right? So it's kind of one of their strategic categories when they're doing targeting. Now we really don't have a direct threat on paper right now to the energy grid. Of course they're focused on infrastructure. It's not like they disclude energy. So it's always a risk. But we have to remember they also do things like they encourage followers online. So kind of they say, hey, go do this yourself. Go and do reconnaissance of these locations. Go do some of the targeting for us. Show us where the infrastructure is weak. They try to get their followers to help them figure out where they can manipulate the grid. So it's a really interesting thing. So yes, we're worried about Terrace attacking our energy infrastructure. But well before it, they have to collect a lot of information so they hit kind of the best place at the best time. And so that, as we always say, is so useful because it helps you get ahead of them too if they have to do all this prior planning. The intent to carry out attacks on critical infrastructure is well documented across pretty much every militant group and even just a lot of extremist groups, even longtime like environmental groups. So it's always like a threat, but it's not the level as obviously the climate issues are causing right now. We're going to now really wrap up and do a simple assessment. This is almost like a risk baseline. So we're going to start with the highest probability threat to our fragile energy system. And that would be of course, these weather driven outages. Then we have equipment failures because I showed you how long it could take to replace some of these items. And then ransomware attempts, they're easy to do, they're happening all the time. It should be the top of anyone's threat matrix. Then when we're talking about moderate probability, we have IT disruptions. And that might not be just a cyber attack. It can just be your computer systems go down. Things like this happen all the time. You might get some sort of virus on the system. Another thing is the fact that some sort of regional instability combined with other stresses can affect the system in some way. And so we have to keep that in mind because so many things are like plug and play. And like I said, all this is synchronized essentially to the minute. So if one piece is off, you have a problem. So when we talk then about low probability in our risk assessment, we have these large scale cyber attacks, like something that really is going to take down like mass, massive portions of the grid, like attack on the whole northeast United States. Right. Very low probability, but not impossible. And then of course we have large scale terrorist events. Now this is a large scale where it only focuses on infrastructure. As you can imagine, when you just have a large scale terrorist attack, it affects things you don't expect it to affect. So you have to kind of think of it too, like when a hurricane hits or any kind of emergency. You know, I say this all the time to people. I mean, you're likely not going to even be able to make phone calls when this happens. You need to prepare for multiple events. You know, the power might go out for a week. You know, are you prepared for that? So you just have to think through what happens in any of these events and if that can be compounded into any sort of terrace event, even if it wasn't directly on the energy grid. So the grid isn't fragile in isolation. It's highly resilient under normal conditions. Now it's defined in a way where there's a lot of interdependence. There's digitalization, there's decentralized control. It's got this layered exposure to physical and science. Cyber stresses, heat increases, demand storms, damage, transmission. Cyber responses can slow coordination. And each gets individually managed as it occurs. But together they can amplify into something so much larger. And that's what we talk through today, the risks to the system. Our modern energy grid isn't some static system. You can't go to one location and shut it all off. It's this constantly balancing network of overlapping pressures. Right. You can have pressures from the weather, from the cyber activity, clearly from the supply chain, and then of course, just demand growth. I mean, we all know it in our towns, how they're expanding, that affects the grid. And the question really isn't anymore, well, will it fail? The question is how many small disruptions can it take and interact with at the same time? And what's that margin look like? And then how do we protect it from really having an impact that takes a long time to fix? That's what we're trying to do. You're always going to have issues and problems. What can we roll through and what is going to cause a long term, two, three week months problem like we saw after Helene. So hope that was a great overview of how the system works and thanks for being here today on the watch floor.