Insurance and a US Electric Grid Blackout - A Compelling Read

On July 8, 2015, Lloyd's of London published an excellent report Business Blackout - The insurance implications of a cyber attack on the US power grid.  

(The same day as the United Airlines, Wall Street Journal and New York Stock Exchange cyber events...hmmm, any coincidence?)

This 65-page report is an excellent analysis of the insurance and economic impact on the US following a theoretical cyber attack on the US Northeastern corridor affecting Boston to Washington, DC.  The report is a compelling read for anyone in the cyber security or critical infrastructure domains -- at a minimum the analysis by Lloyd's and the Cambridge Center for Risk Studies Team (University of Cambridge Judge Business School) causes you to take pause to a) better understand the interdependency of infrastructures and b) better learn ways to consider economic impacts of such events.

Key sections of the report include:

• Executive Summary
• Introduction to the Scenario
• The Erebos Cyber Blackout Scenario
• Direct Impacts to the Economy**
• Macroeconomic Analysis**
• Cyber as an Emerging Insurance Risk**
• Insurance Industry Loss Estimation
• Annex A:  Cyber Attacks Against Industrial Control Systems since 1999
• Annex B:  The US Electricity Grid and Cyber Risk to Critical Infrastructure
• Annex C:  Constructing the Scenario - Threats and Vulnerabilities

** = Focus your reading here...

For some key "bullets" on the report and the scenario, the following were extracted from the Lloyd's web page:

1. The attackers are able to inflict physical damage on 50 electric generators which supply electrical power in the Northeastern USA, including New York City and Washington, DC.
2. While the attack is relatively limited in scope (nearly 700 generators supply electricity across the region) it triggers wider blackouts which leaves 93 million people without power.
3. The total impact to the US economy is estimated at $243B, rising to more than $1T in the most extreme version of the scenario.
4. Insurance claims arise in over 30 lines of insurance.  The total insured losses are estimated at $21.4B, rising to $71.1B in the most extreme version of the scenario.
5. A key requirement for an insurance response to cyber risks will be to enhance the quality of data available and to continue the development of probabilistic modelling.
6. The sharing of cyber attack data is a complex issue, but could be an important element for enabling the insurance solutions required for this key emerging risk.

Hat tip to Eireann Leverett, Senior Risk Researcher and member of the ENISA ICS Security Stakeholders Group for passing along this analysis.

CONCLUSION

If you are involved with critical infrastructure -- especially the electric grid -- take time to read this report cover-to-cover.  If you are worried about the economic impacts of cyber on your business -- read this report to understand the interdependencies.

###

Cyberwarfare and Cyberterrorism - Excellent CRS Report

In my life in security I try to monitor several topics.  Two topics I'm often checking -- usually through Google News Alerts -- are cyberwarfare and cyberterrorism.  This week I came across an excellent summary report from the Congressional Research Service on this very topic.

This 12-page summary document is an excellent overview of these topics and also provides some comparisons between cyberterrorism, cybercrime, cyberespionage, cyberwarfare, and cybervandalism.

The document can be downloaded at: http://fas.org/sgp/crs/natsec/R43955.pdf 

A high level view of the key headings in the document (below) will give you a view of the document and its contents.

• Executive Summary
• Introduction
• The Cyberwarfare Ecosystem: A Variety of Threat Actors
• Cyberwarfare
• Rules of the Road and Norm-Building in Cyberspace
• Law of Armed Conflict
• Council of Europe Convention on Cybercrime
• United Nations General Assembly Resolutions
• International Telecommunications Regulations
• Other International Law
• Cyberterrorism
• Use of the Military: Offensive Cyberspace Operations

Overall, this is an excellent and fairly rapid read on this contemporary subject and I'd recommend it be viewed by students, policy makers and all cybersecurity professionals.

###

Funding Terrorism via Poaching and Organized Crime

In early January 2014 Mr. Johan Bergenas of the Stimson Center prepared a report called Killing Animals, Buying Arms.  This brief 17-page report woke me up to the concerns of rhino and elephant poaching in East Africa and its eventual financial support for local and global terrorists.  It is a disconcerting state of affairs.

Some disturbing facts that are not well publicized include:

• Wildlife has become the 4th largest illicitly traded product in the world.  It is a $19B USD industry.  Illegal wildlife trade is larger than illicit trafficking of small arms, diamonds, gold and oil.
• Transnational criminals and terrorist organizations such as Al-Shabaab and the Lord's Resistance Army make hundreds of thousands of dollars every month by partaking directly or indirectly in the killing and sale of animal parts.  Part of their proceeds go towards buying guns and bombs, paying their members, and planning and executing terrorist attacks.
• The Elephant Action League -- an independent organization fighting elephant exploitation and poaching -- asserts that Al-Shabaab exports poached ivory via southern Somalia ports.  The tusks are cut into blocks and hidden in crates of charcoal.  Their monthly income is reported to be $200,000 to $600,000 USD per month.  The ivory sells for $3,000 per 2.2 pounds (kilogram) in China.
• A rhino horn is worth $50,000 USD per pound on the black market -- more than gold or platinum.  A rhino is killed by a poacher every 11 hours.

The United Nations Office on Drugs and Crime (UNODC) has published several studies on organized crime and its global and regional impact.  In its seminal report issued in 2010, the UNODC depicted the geographic challenges with ivory export as shown below:

In its 2013 regional report on organized crime in Eastern Africa (UNODC) the theme of money being made from ivory continued.  In the report they note "It is estimated that between 5,600 and 15,400 elephants are poached in Eastern Africa annually, producing between 56 and 154 metric tons of illicit ivory, of which two-thirds (37 tons) is destined for Asia, worth around US$30 million in 2011."  But the area is also a concentration of illegal -- and profitable -- activities such as human trafficking, heroin transportation, and piracy -- besides ivory and rhino horn poaching.

At a US Senate hearing in May 2012, Mr. Tom Cardamone of Global Financial Integrity observed in his  written testimony that ever since the terrorist attacks of 9/11 and actions taken by Congress/Administration to target terrorist financing has nearly eliminated shell banks and decapitated Al Qaeda's central command.  As such the terrorists are cash-starved and looking for new sources of funding.  Hence, illicit trafficking of wildlife is one way the Al Qaeda affiliates have chosen to raise money.  As an example, two Bangladesh-based Islamic terrorist groups affiliated with Al Qaeda are raising funds for their operations via illegal poaching of ivory, tiger pelts and Rhino horns in the jungles of northeastern India.  And, during its years of war with Northern Sudan, the Sudan People’s Liberation Army  is alleged to have poached “...elephants with grenades and rocket‐propelled guns.”

And...when it comes to Al-Shabaab, the same 2013 report notes,  "Members of Al-Shabaab have been linked to ivory poaching in Kenya and to a Tanzanian Islamist group reportedly linked to heroin trafficking. They have also allegedly taxed pirates working from the ports they control..."

Conclusion

The Elephant Action League says it best, "If you buy ivory, you kill people."  But as noted in all three of the reports cited above, each one says that the task at hand is difficult and requires money and resources to even slow the poaching and subsequently the flow of money to the terrorists.  Border security needs to be stronger, needs to be enforced and the markets for the ivory and illicit items need to be closed.  Also, oversight of cash transfers need to be tightly regulated in the more "suspicious" parts of the world.

Sadly, this sounds daunting and challenging.  I hope this blog raises awareness and guides some action.

###