With more hostile actors targeting the U.S. power grid, a representative from Exelon said in a webinar Nov. 18 that taking a “proactive” stance on security is more important than ever for electric utilities.

Speaking at ReliabilityFirst’s regular “Technical Talk with RF” webinar, Mike Melvin, Exelon’s director of corporate physical security, reminded attendees that the ongoing reliance of the U.S. economy on electricity has made power facilities increasingly attractive targets for dangerous people both abroad and at home.

“One important bullet [point] I have been emphasizing over and over with our personnel is, in [a] recent … congressional hearing … it was noted for the first time in modern history that U.S. infrastructure is considered a battle space if we’re ever engaged with a [major] adversary,” Melvin said. “It’s definitely a focus area for people who are not fans of the United States: that if they were … really looking to hurt our country, critical infrastructure is an absolute target.”

Exelon has direct experience with such threats, Melvin noted, with the company’s subsidiary Baltimore Gas and Electric having been the target of a planned attack by two white supremacists before their arrest last year. (See Feds Charge Two in Alleged Conspiracy to Attack BGE Grid.) The FBI accused neo-Nazi leader Brandon Russell and his associate Sarah Beth Clendaniel of plotting to attack electric substations in Baltimore in order to cause a race war in the city and then nationwide. Clendaniel pleaded guilty in September to conspiring to damage electric facilities and carrying an illegal firearm and was sentenced to 18 years in prison. Russell is in custody and set to go to trial next year.

While Melvin credited the “great work by the FBI” for preventing the plotters from carrying out their threat, he said the incident showed how modern technology makes the planning process for such an attack much faster. Even people like Russell and Clendaniel, with no background in electrical engineering or infrastructure planning, can easily access the information they need to develop a potentially effective plot.

“At one point in her life, [Clendaniel] thought it was a good idea to hold up a convenience store with a machete while she was several months pregnant,” Melvin said.

“I would argue that … somebody that would do something like that is not going to be of high intelligence or a sophisticated criminal,” Melvin continued. “And yet, I will tell you, due to open-source mapping that’s readily available, not just in this country but the whole world, they were able to [make] their plans, which was, basically, they wanted to lay the city of Baltimore to waste by cutting out all the power.”

Melvin acknowledged that the electric industry has a history of reacting to incidents, and said one of the biggest challenges for utilities has been working proactively to neutralize threats before they are acted on.

As an example of the progress that Exelon has made in this regard, he cited the company’s personnel security protection program (PSPP). Melvin said these programs have become more common in the industry as utilities have recognized that they “operate in some areas that unfortunately have very high violent crime rates.”

The PSPP includes programs for analyzing crime statistics and identifying “security awareness areas” where personnel are likely to require protection. Melvin said security incidents have significantly decreased since the introduction of the program.

Another threat mitigation program is the facility enhancement program (FEP), which Melvin said is Exelon’s biggest security program so far. The company began the FEP after the armed attack on Pacific Gas & Electric’s Metcalf substation in 2013, in which gunmen fired an estimated 150 rounds that caused the loss of 52,000 gallons of cooling oil. (See Substation Saboteurs ‘No Amateurs’.)

The FEP involves evaluating the utility’s transmission and distribution substations, gas plants, gas regulator stations and other facilities, and assigning each a tiered threat level. Then Exelon makes security upgrades such as fencing and cameras according to the needs of each tier.

Most important, Melvin said, is to make sure the entire organization understands the importance of security and the danger of neglecting details. He recommended ensuring clear communication across all business lines to make sure as few details are overlooked as possible.

“It’s not all about substation security. You can’t have all your eggs in one basket,” Melvin said. “Your security program really needs to be in partnership with your resiliency program, your supply program … your flood mitigation [program], etc. … It’s not a one-size-fits-all approach when it comes to security.”