Questions on safety of USA nuclear stations, risks of cyber attacks

Cyber attacks target nuclear power plants. Is Oyster Creek safe? Amanda Oglesby , @OglesbyAPP APPJuly 13, 2017 LACEY – Computer hackers, not content with mucking around with U.S. commerce and elections, have trained their sights on nuclear power plants, prompting questions about cyber security at Oyster Creek.

Industry officials and federal regulators say there’s nothing to fear, but experts say there is cause for concern, including from the harm that could be caused by cyber attacks on the electrical grid upon which power plants depend.

In recent weeks, hackers tried to – and in at least one case succeeded – in penetrating the firewalls and digital protections of administration information at these nuclear facilities, according to government reports cited recently in the New York Times and Bloomberg News.

“The nuclear industry didn’t really believe that they were a target,” said Edwin Lyman, senior scientist of the Global Security Program of the Union of Concerned Scientists in Washington, D.C.

Industry executives learned otherwise when hackers worked their way into computers at Wolf Creek nuclear power plant near Burlington, Kansas, according to the Times. The Asbury Park Press asked nuclear experts if hackers could also penetrate Oyster Creek.

“A plant like Oyster Creek, it’s old. Its systems that are used to control plant functions are mostly analog based, and that’s true for most of the plants in the United States. So the scenario of some malevolent terrorist pushing a button and causing a plant to melt down, that’s far-fetched,” Lyman said.

But there are reasons hackers might want to penetrate other plant systems.

“The fact is, a successful radiological sabotage attack on a nuclear plant, or on the spent fuel pool (where radioactive waste is cooled) at the plant, could cause a devastating catastrophe,” he added. “It could essentially contaminate hundreds of square miles with long-lived radioactive material. It could require the forced resettlement of millions of people. It could cost trillions of dollars in damages, and for a plant like Oyster Creek or others in the New York City area, a densely populated area, they are even more desirable targets for a terrorist who wants to cause that kind of mass disruption event.”

Plants separate critical systems from the internet or plant business networks by physical distance or hardware, Nuclear Regulatory Commission spokesman Neil Sheehan said in an email.

The Nuclear Regulatory Commission also regulates how employees use removable media, perform vulnerability assessments and train other employees on recognizing “insider threat(s),” he added.

The systems targeted in the recent attacks are not under the Nuclear Regulatory Commission’s regulations and oversight, Sheehan said in the email.

Hackers used faked resumes crafted in Microsoft Word that were riddled with malicious computer code to try and squeeze through the network protections, according to the Times. They also inserted malicious code into legitimate websites frequented by plant employees and tried to redirect employee web traffic through company computers, according to the report………

Nuclear plant administrative networks are not regulated by the Nuclear Regulatory Commission similarly to operational systems, Lyman said.

“I think that narrow interpretation (by the Nuclear Regulatory Commission) of what needs to be protected needs to be rethought,” he added.

By not regulating how administrative information is stored and protected, Lyman said information like plant blueprints, security guard schedules, computer passwords and door security could be vulnerable to hackers.

Another outside threat

There is another way nuclear plants are vulnerable to hackers, said Paul Gunter, director of the Reactor Oversight Project at Beyond Nuclear, a Maryland-based organization that opposes nuclear energy,

“From our point of view, the biggest vulnerability comes from the electrical grid itself,” he said.

That electrical grid is a patchwork system that is more than 50 years old in many places. It is riddled with problems caused by “aging equipment, capacity bottlenecks and increased demand,” according to a report issued by the American Society of Civil Engineers. The society recently gave the nation’s energy grid a D+ rating in its 2017 Infrastructure Report Card.

If hackers attack the grid and shut it down, Oyster Creek is designed to automatically “scram,” or shut down, Gunter said.

“This is a little bit like hitting your breaks at full speed on the interstate,” he said. “It’s a violent action not to be taken lightly.”

The risk comes from power loss to the safety systems that cool the nuclear fuel and regulate the reactor, Gunter said. Those systems could be compromised when the grid loses power for an extended period of time, though the plant has emergency generators and batteries as backup, he said.

“The concern here is that a cyber attack may not necessarily be isolated to just disrupting the electrical grid to safety systems, but it could be associated with a much broader military objective,” Gunter said……..http://www.app.com/story/news/investigations/watchdog/government/2017/07/13/hackers-target-nuclear-oyster-creek-safe/469639001/