Grid cybersecurity: how big is the threat & what should we do about it?

Could the US grid be brought down by Chinese hackers? To find out, I talked with Patrick Miller, who helped write the cybersecurity rules for the bulk power system and became the first person with federal authority to enforce them. We get into what's actually been hacked, why those "rogue devices" in Chinese inverters are less sinister than they sound, and why squirrels still do more damage than hackers.

Chapters:

00:00 – Introduction

02:47 – What state utility commissioners get wrong about cyber risk

04:50 – Real attacks on the grid so far: Ukraine, Poland, and the US

06:57 – IT versus OT, and why grid devices are hard to protect

10:30 – The NERC CIP standards: scope, requirements, enforcement

17:40 – Distributed resources outside the CIP perimeter

20:54 – Dropping the threshold to 20 MVA, and federal jurisdiction

29:12 – Chinese inverters and the commodity board

36:09 – Volt Typhoon, Salt Typhoon, and China's intent

39:26 – Data centers as a new attack surface

43:19 – The trade-off between security and speed

47:44 – Cyber-informed engineering and analog safeguards

54:05 – AI on offense and defense

1:02:21 – Squirrels, balloons, and physical threats

1:04:24 – CISA cuts, CIRCIA, and harmonizing the rules