Amanpour and Company

>>> THE UNITED STATES WAS REMINDED OF ITS OWN WRONGDOINGS THIS WEEK AFTER SUSPECTED ATTACKS ON CAROLINE'S POWER GRID, WHICH LEFT OVER 40,000 CUSTOMERS IN THE DARK. THE FBI ARE INVESTIGATING. JULIA KIAM IS A NATIONAL SECURITY EXPERT AND THE AUTHOR OF THE DEVIL NEVER SLEEPS. SHE SPEAKS ABOUT THE SIGNIFICANCE OF THIS ATTACK AND THE BROADER SECURITY LANDSCAPE IN THE CONTEXT OF RUSSIA'S WAR IN UKRAINE. >>

Reporter

JULIETTE KAYYEM, WELCOME BACK. I WONDER, WHAT DOES THIS SAY TO YOU ABOUT THE STATE OF OUR NATIONAL POWER GRID AND BIGGER INFRASTRUCTURE? >> IT SHOWS BOTH ITS VULNERABILITY TO ANY KIND OF THREAT, WHETHER IT IS A NATURAL DISASTER, OR MORE LIKELY THAN NOT, A DOMESTIC THREAT, BUT ALSO, HOW LONG IT TAKES TO GET THESE SYSTEMS BACK UP AND RUNNING, WHETHER IT IS A DAY, TWO DAYS, OR JUST SEVERAL -- THE AREAS IN NORTH CAROLINA ARE SEVERELY IMPACTED. FROM SCHOOL CLOSURES TO PEOPLE IN SHELTERS, TO HOSPITALS NEEDING TO BRING IN EXTRA GENERATORS AND ELECTRICAL CAPACITY, MULTIPLY THAT 1 MILLION TIMES, RIGHT? NOT JUST TO THE ENERGY GRID, BUT FOR THE 16 CRITICAL INFRASTRUCTURE SECTORS IN THE UNITED STATES THAT RANGE FROM CHEMICAL FACILITIES, DAMS, TRANSPORTATION SYSTEM, SUBWAYS, TOO, OF COURSE, OUR ENERGY INFRASTRUCTURE AND PIPELINE. THE VULNERABILITIES ARE IMMEASURABLE. AND THAT IS WHY THEY WILL NEVER BE INVULNERABLE, BUT WE CAN CERTAINLY MAKE THEM SAFER FROM THE KINDS OF ATTACKS WE HAVE SEEN RECENTLY. >> THE GOVERNOR SAID --IS HE RIGHT? ABSOLUTELY. THE VULNERABILITY OF HER CRITICAL INFRASTRUCTURE AS WELL BEEN KNOWN. FOR THE LAST DECADE, WE HAVE REALLY FOCUSED ON CYBER SECURITY, WHETHER ANYTHING FROM DAMS, TRANSPORTATION SYSTEM, TO OUR ENERGY SECTOR, ALL OF THEM ARE PART OF THE CRITICAL INFRASTRUCTURE APPARATUS. WHETHER THEY COULD BE ATTACKED BY CYBER ATTACKS, RANSOMWARE FROM RUSSIA, CYBER ATTACKS FROM CHINA OR NORTH KOREA. BUT WHAT NORTH CAROLINA IS SHOWING US IS THAT THE PHYSICAL PLANTS, THE PHYSICAL STRUCTURES ARE STILL VULNERABLE. THIS WAS JUST A SHOOTING. A TARGETED SHOOTING. BUT ONE THAT HAD BROUGHT MISERY AND A LOT OF DISCOMFORT FOR LARGE AREAS OF NORTH CAROLINA. >> IS THERE SOMETHING, AND ATTACKS LIKE THIS THAT WAKES UP POWER UTILITIES THAT SERVE THE REST OF THE COUNTRY? ESPECIALLY THROAT SUBSTATIONS AND RURAL PARTS, SIDE OF THE ROAD, HOW THIS ONE WAS IN THE CAROLINA, THERE ARE SO MANY OF THESE PLACES THAT ARE PHYSICALLY ACCESSIBLE. YET, AS YOU MENTIONED, THEY HAVE A PRETTY LOW SECURITY FLOOR. >> THAT IS EXACTLY RIGHT. EVERY INCIDENT WILL BRING A FOCUS, HOPEFULLY BY THE FACILITIES. THEY WILL HAVE MORE ISOLATED AREAS OWNED BY DUKE ENERGY, THIS IS A MAJOR COMPANY. WE CANNOT ACT SURPRISED THAT IT IS NOT JUST A RURAL COMPANY. AN ATTACK IN CALIFORNIA A DECADE AGO WAS PG&E, ALSO A MAJOR COMPANY. WE KNOW IT CHANGED GLOBALLY, THAT THESE NETWORKS ARE VERY DESIRABLE BITE NATION STATES OR BY TERRORIST ORGANIZATIONS. IN THE UNITED STATES IN 2020, THERE WAS A SIGNIFICANT INCREASE IN THE THREAT ENVIRONMENT BASED ON MATERIALS AND DOCUMENTS THAT WERE BEING CIRCULATED ON RIGHT WING WEBSITES ABOUT GOING AFTER CRITICAL INFRASTRUCTURE. THEY VIEWED IT AS A WAY TO MAKE A LOT OF NOISE, ALSO, THEY HAVE THE PERVERSE SENSE THAT IF YOU PUT THE LIGHTS OUT, THERE MIGHT BE CIVIL WAR OR RACIAL WAR. THE COMPANIES ARE UNDER NOTICE. THE FIXES ARE NOT HARD. THEY ARE ANYTHING FROM SANDBAGS TO A WALL. THESE ARE NOT SOPHISTICATED FIXES. THIS IS NOT, YOU KNOW, AN UNDERWATER PIPELINE THAT YOU HAVE TO PROTECT 1 MILLION MILES OF. THESE ARE THE ASIC MINIMUM FEATURES TO PROTECT THEM, BECAUSE WHAT WE NOW KNOW IN NORTH CAROLINA, THIS STATION WAS FULLY EXPOSED SO THAT SOMEONE FROM THE STREET COULD NOT GET AT IT. WE HAVE DIFFERENT THINGS ARE OF PERSON WOULD DO THIS. THERE WOULD BE VERY DIFFERENT CATEGORIES OF PEOPLE. >> I WILL START WITH THE LEAST LIKELY AND CAROLINA. >> I THINK IT IS UNLIKELY IN THIS CASE. THE GOVERNMENT WOULD BE MUCH MORE LIKELY TO DO A CYBER ATTACK. THE SECOND POOL OR CATEGORY THAT ONE WOULD ALWAYS LOOK AT, FOR MY PERSPECTIVE, IS WHAT WE CALL THE INSIDER TRACK. SOMEONE WITH A MOTIVATION THAT HAS ISSUES WITH THE COMPANY. THEY DO NOT LIKE THEM, THEY WANTED TARGET THEM. THIS IS A BIG ISSUE FOR ARTICLE INFRASTRUCTURE OWNERS. THERE IS A LOT OF REGULATIONS ABOUT WHO HAS ACCESS, YOU CAN WORK THERE. THE THIRD, WHICH I THINK IS HE GOING SERIES IN NORTH CAROLINA THAT THEY GET ANY THREAT ENVIRONMENT IS SOMEONE WITH AN IDEOLOGICAL DEFENSE. WHAT WE CALL EXCELERATOR IDEOLOGIES, ONES THAT WANT TO AMERICA'S DEMOCRACY OR DIVERSITY, RIGHT WING ORGANIZATIONS LIKE BOOGALOO OR OTHERS THAT HAVE TALKED ABOUT THIS. IN ANY CRITICAL INFO STRUCTURE, YOU WILL KEEP THE POSSIBILITY, BUT THERE IS A REASON WHY INVESTIGATORS ARE LOOKING AT A MORE POLITICAL, OR AT LEAST AN IDEOLOGICAL REASON FOR THIS. IN 2020, THOSE ORGANIZATIONS WERE TALKING ABOUT THIS KIND OF ATTACK. >> THE FBI, DHS, THEY HAVE TESTIFIED IN FRONT OF CONGRESS THAT THEY ARE CONCERNED ABOUT THESE RISKS OVER AND OVER AGAIN. I GUESS, WHAT DOES IT TAKE FOR MEMBERS OF CONGRESS OR LOCAL GOVERNMENTS TO SAY, YOU KNOW WHAT? THIS IS NOT SOMETHING ABSTRACT, THIS IS NOT ABOUT ATTACKING THE CAPITAL OF THE UNITED DATES, THIS COULD BE OUR SAFETY AND SECURITY HERE IN THIS SMALL TOWN. >> I THINK THAT IS RIGHT. THERE ARE TWO WAYS TO TRY TO MINIMIZE THE THREAT. ONE IS THE HOPE THAT NORTH CAROLINA CAN FIND THESE PEOPLE, PROSECUTE THEM, BECAUSE THOSE KINDS OF PROSECUTIONS WILL MAKE OTHERS REALIZED THAT THIS IS REAL, THIS IS NOT, YOU KNOW, A GOOD PLAY OF WAR. THE CALIFORNIA CASE IN 2013 AGAINST PG&E HAS NEVER BEEN SOLVED. THAT IS A CHALLENGE. IF YOU DO NOT SOLVE IT, THAT PEOPLE THINK THAT THERE IS AN OPENING. THE OTHER IS TO CLEARLY MAKE IT HURT FOR THE COMPANY. THEY KNOW WHAT THE THREAT ENVIRONMENT IS. THEY CAN EITHER TRY TO GET CONGRESS TO RELATE AND INCREASE THAT FOR, WHICH WILL COST MONEY, BUT CERTAINLY NOT PROHIBITED, BUT SANDBAGS ARE NOT EXPENSIVE, OR IF THEY DO GET ATTACKED, TO FIND THEM OR OTHER PENALTIES TO GET THE INDUSTRY TO REALIZE THERE WILL BE CONSEQUENCES FOR THESE VULNERABILITIES. LOOK, THEY ARE MONOPOLIES, RICH MONOPOLIES. THEY BENEFIT FROM PROVIDING SERVICES TO THE AMERICAN PUBLIC, BUT THERE IS A RESPONSIBILITY AS WELL THAT COMES WITH THAT COMMERCIAL MARKET. >> ONE QUESTION I THINK A GOOD NUMBER OF PEOPLE ARE ASKING RIGHT NOW IS WHAT IS THE DIFFERENCE BETWEEN WEATHER THIS IS A CRIMINAL ACT, OR WHETHER THIS IS AN ACT OF TERROR? >> THERE REALLY IS NO DIFFERENCE IN BOTH EXPOSING THE VULNERABILITY THE CRITICAL INFRASTRUCTURE, KNOWING HOW LONG IT WILL TAKE TO GET A BACKUP, AND IT PROVIDES A LESSON, WHATEVER THE MOTIVATION IS FOR US OR OTHERS, WHO MAY BE INTERESTED IN DOING THE SAME KIND OF ATTACKS WHETHER THEY ARE FOREIGN-BASED OR DOMESTIC BASED. SO A LINE HAS BEEN CROSSED. IT HAS BEEN CROSSED RARELY, WE HAVE ONLY HAD 1 TO 2 IN THE LAST DECADE, DECADE AND A HALF, IT IS NOT A GOOD LINE TO CROSS. YOU WANT TO PROSECUTE. THE DIFFERENCE ON MOTIVATION, WHETHER IT IS A CRIMINAL ACT RACIALLY IDEOLOGICALLY POLITICALLY MOTIVATED WILL BE BOTH IN WHAT FEDERAL STATUTES YOU CAN PROSECUTE AGAINST THESE PEOPLE. THEY MAY INCLUDE A CLINICAL MOTIVATION OR SOME OTHER MOTIVATION. OF COURSE, THE SECOND THING. I DO BELIEVE THAT TOUGH CRIMINAL PROSECUTIONS AGAINST PEOPLE THAT WOULD ATTACK OUR CRITICAL INFRASTRUCTURE FOR THEIR IDEOLOGICAL PURPOSES IS VERY, VERY IMPORTANT. WHAT IT SAYS TO OTHERS WHO MIGHT BE ATTRACTED TO DOING THAT, THIS IS REAL, YOU WILL GO TO JAIL FOR A VERY LONG TIME. THIS IS CONSISTENT ANY SORT OF COUNTER STRATEGY AGAINST FORCES THAT WOULD USE VIOLENCE IN THE UNITED STATES, WE SEE IT WITH THE JANUARY 6th PROSECUTION, AND WE SHOULD SEE IT AGAINST PEOPLE WHO THINK THEY ARE BEING SHOOTING AT SUBSTATIONS, BUT YOU'VE GOT LOTS OF KIDS WHO CANNOT GO TO SCHOOL RIGHT NOW, AND LOTS OF PEOPLE WHO ARE IN SHELTERS THAT ARE IMPACTED BY THIS KIND OF CONDUCT. >> THERE IS ALSO THE COMPOUNDING EFFECT OF THE ENVIRONMENT ITSELF. >> THAT IS RIGHT. LOOK, THE RISKS ARE PLENTIFUL AGAINST THESE NETWORKS. ONE WILL CLEARLY BE THE CYBER RISK. THE SECOND WE HAVE SEEN IN NORTH CAROLINA IS THE PHYSICAL RISK. THESE ARE JUST VULNERABLE SYSTEMS. THE THIRD IS THE CLIMATE RISK. THESE SYSTEMS WERE BUILT, OUR WIRES ARE ABOVE GROUND, OUR SYSTEMS GET FLOODED, ELECTRICAL SUBSTATIONS GET SURROUNDED BY WATER, HURRICANES, TORNADOES, OTHER NATURAL DISASTERS THAT ARE REOCCURRING FASTER AND MORE DEADLY, THE IMPACTING CRITICAL INFO STRUCTURE. AND THERE'S A POINT OF FAILURE. BECAUSE THESE ARE MONOPOLIES, THERE IS NO REDUNDANCY IN THE SYSTEM. IT IS NOT LIKE YOU CAN CALL YOUR WIRES IN HERE, WE HAVE BUILT NO REDUNDANCIES. YOU CAN EITHER WORRY ABOUT RIGHT WING EXTREMIST OR FOREIGN COUNTRIES, BUT WE DO NOT HAVE TO WORRY TOO MUCH ABOUT CLIMATE CHANGE THAT THESE SYSTEMS ARE GOING DOWN, AND WE NEED TO INVEST IN MAKING THEM MORE RESILIENT TO THE FREQUENCY OF DISASTERS, OR ANY THREAT THAT THEY ARE LIKELY TO FACE. AT THE BEGINNING OF THE RUSSIAN INVASION, WE HEARD A LOT ABOUT THEIR POTENTIAL FOR CYBER ATTACKS. WHY ARE WE SEEING MORE OF THE EXAMPLES THAT WE WERE STARTING TO PREPARE FOR? >> THERE ARE GENERALLY THREE EXPLANATIONS OF PEOPLE HEREABOUTS. THE FIRST IS THAT, YOU KNOW, PUTIN IS NOT AS STRONG MILITARILY OR WITH HIS CYBER WEAPONRY THAN WE THOUGHT A YEAR AGO. AS EXPERTS SUGGEST, GIVEN WHAT IS HAPPENING IN UKRAINE, THAT PUTIN CANNOT BE MORE BARK THAN BITE. THE SECOND IS THAT UKRAINE AND NATO, IN PARTICULAR, HAVE BEEN PREPARED. THEY HAVE BEEN THINKING ABOUT HOW TO PROTECT THEIR SYSTEMS, BECAUSE OF THE CYBER ATTACKS THAT HAVE BEEN OCCURRING IN THE YEARS BEFORE. IT WAS NOT LIKE THIS. THE PHYSICAL INVASION WAS THE BEGINNING OF RUSSIA'S HOSTILITIES AGAINST UKRAINE. THERE IS A LOT TO THAT. BUT WHAT I BELIEVE IS THAT NATO WAS VERY SMART AT THE BEGINNING OF THIS WAR, TO BASICALLY SAY THAT AN ATTACK, A CYBER ATTACK ON CRITICAL INFRASTRUCTURE IS THE SAME AS A PHYSICAL ATTACK AGAINST CRITICAL INFRASTRUCTURE. PUTIN PIPES --PUTIN BOMBED THE PIPELINES IN GERMANY, OR ANY OTHER NATIVE COUNTRY AND NOT ANY MORE THAN YOU COULD A CYBER ATTACK. THEY WERE CONSISTENT ON THIS MESSAGING. THAT CYBER ATTACKS WOULD INVOKE ARTICLE 5, WHICH WOULD THEN INVOKE ALL OF NATO IN A RESPONSE. THE INTERESTING THING THAT THEY DID THOUGH, OR AT LEAST THE LEADERSHIP OF NATO, THEY NEVER MADE IT THERE WHAT WOULD CONSTITUTE A SIGNIFICANT CYBER ATTACK AGAINST CRITICAL INFRASTRUCTURE. THAT WAS SMART. HE GAVE THEM A LITTLE BIT OF ROOM THAT THEY WERE NOT GOING TO GO TO WAR EVERY TIME SOME HACKER OR RANSOMWARE PERSON LOCATED FROM RUSSIA TRY TO GET INTO A BANKING OR TRANSPORTATION SYSTEM. BUT THEY LEFT IT OPEN THAT THEY WOULD BE PREPARED TO RESPOND IN KIND, WHETHER THAT WOULD BE DEFENSE OF A CYBER ATTACK OR SOMETHING MORE SIGNIFICANT. IF RUSSIA IMPACTED CIVILIAN LIVES IN EUROPE. YOU CANNOT ATTACK A CYBER SYSTEM, WHOSE RESULT IS THAT, YOU KNOW, A PARENT CANNOT GET WATER FOR THEIR CHILDREN, AND THINK THAT IS NOT AN ACT OF WAR. I THINK THEY MADE THAT CLEAR. WHEN YOU LOOK OUT AT THE LANDSCAPE OF TOOLS THAT IS HAD NOTE TO CONDUCT PHYSICAL ATTACKS, WE HAVE BEEN WATCHING, YOU KNOW, IMAGES FROM UKRAINE. WHERE UKRAINIAN SOLDIERS USED DRONES. SOMETIMES OFF THE SHOW, TO BE ABLE TO SPOT WHERE THE ENEMY IS, ET CETERA. WE HAVE SEEN CASES OF DRONES BEING USED IN ATTACKS. THEY ARE ACTUALLY JUST TEARING -- >> THAT IS RIGHT. THIS IS ALSO WHAT KIDS ARE ASKING FOR SOME HOLIDAYS. >>> THERE IS NO LIMIT TO WHAT YOU CAN IMAGINE WOULD BE USED AGAINST CRITICAL INFRASTRUCTURE. WE ARE JUST TALKING ABOUT ENERGY. THINK ABOUT DAMS, WATER, CHEMICAL FACILITIES. WHETHER IT IS SOPHISTICATED OR UNSOPHISTICATED DRONES, GUNS, AND IMPROVISED EXPRESSIVE DEVICES THAT COULD BE THROWN IN SOMEWHERE, HONESTLY, IN THE CALIFORNIA CASE, SCISSORS TO CUT THE WIRE. SO WE KNOW THAT THERE ARE LIMITLESS THREATS AND MEANS TO EFFECTUATE ATTACKS ON CRITICAL INFRASTRUCTURE. AND THAT IS WHY WHAT THESE COMPANIES AND REGULARS NEED TO FOCUS ON HIS WHAT WOULD HAVE THE BIGGEST IMPACT IF, IN FACT, IT WENT DOWN. WE WANT TO FOCUS ON WHAT WE CALL THOSE SINGLE POINTS OF FAILURE. THOSE SUBSTATIONS, IF SOMEONE WERE ABLE TO SHOOT, YOU WILL KNOCK OUT 30 OR 40,000 PEOPLE, AND YOU TRY TO FORTIFY THOSE BETTER. OF COURSE, ON THE OTHER SIDE, YOU TRY TO PROSECUTE OR MAKE THE COMPANY GET AT PROTECTING ITS CRITICAL INFRASTRUCTURE. WE ARE NEVER GOING TO GET THE VULNERABILITY DOWN TO 0. NOT WITH THE NETWORKS THAT WE HAVE. NOR WITH THE INCREASING TOOLS AND INSTRUMENTS THAT BAD ACTORS, OR ACTORS WITH WHATEVER IT IS LIKE CRITICAL INFRASTRUCTURES ARE TAKEN MORE SERIOUSLY IN TERMS OF CREATING SOME FORM, BUT ALSO, PROVIDING BEST PRACTICES AND TRAINING AND OTHER SERVICES TO THESE COMPANIES SO THAT THEY TAKE SERIOUSLY WHAT IS THEIR VULNERABILITY. ONE SOLUTION THROWN OUT THERE IS THAT THESE BOARDS OF THESE COMPANY'S ARE OFTEN FILLED WITH FRIENDS AND RICH FRIEND OF MAJOR CRITICAL INFO STRUCTURE COMPANIES, LIKE ENERGY COMPANIES, GAS COMPANIES, OFFSHORE DRILLING COMPANIES. SO ONE SOLUTION THAT HAS BEEN PROPOSED IS THAT THE BOARDS, ESPECIALLY OF THESE PUBLIC COMPANIES, THEY HAVE TO HAVE PEOPLE WITHIN THE LAW ENFORCEMENT OR PREPAREDNESS PHASE ON THEIR BOARD, ENSURING THAT THESE COMPANIES TAKE IT SERIOUSLY. THESE ARE NOT JUST FOR PROFIT COMPANIES. THEY SERVE A PUBLIC SERVICE. OF THE SERVICE. BUT THEY NEED TO TAKE SERIOUSLY THEIR RESPONSIBILITY TO TAKE THE MOST BASIC OF MEASURES TO PROTECT THE SYSTEM.