The European Centre of Excellence for Countering Hybrid Threats Assessing Energy Dependency in the Age of Hybrid Threats Duane Verner, Agnia Grigas, and Frederic Pet, Energy and Global Security Directorate Argonne Naonal Laboratory January 2019 This report reflects the views of the authors only, and does not necessarily represent the views of the U.S. government. 1 Assessing Energy Dependency in the Age of Hybrid Threats Contents Introducon 3 Dependency-Related Policies and Iniaves 4 Geopolics of Energy Dependencies 9 Classes of Dependencies 11 Case Studies 12 Recommendaons 18 2 Assessing Energy Dependency in the Age of Hybrid Threats Introducon Many naons including The European Centre of nologies, have increased the potenal vulnerabil- Excellence for Countering Hybrid Threats (Hy- ies to physical and cyber threats and potenal brid CoE) member naons face significant chal- consequences resulng from the compromise of lenges from hybrid threats involving the energy underlying systems or networks. In an increas- sector. The October 4, 2018, Federal Bureau of ingly interconnected world, where energy infras- Invesgaon (FBI) indictments of Russians in the tructure crosses naonal borders and global sup- hacking of Wesnghouse computer systems in ply chains, the potenal impacts increase with Pisburgh emphasizes the ongoing global nature these dependencies and the ability of adversaries of these challenges.1 Halng Russian gas supply to exploit them.4 In addion, the geopolics of to Ukraine, on mulple occasions, has affected energy, including global market and security con- the gas supplies of European Union (EU) states, sideraons, is becoming more complex, which including during a cold 2008-2009 winter, which underscores the need to analyze and understand caused widespread hardship and contributed to energy dependencies. Based on these factors, it casuales. These acons demonstrate the real is essenal to integrate energy dependency con- risks of Russia’s use of energy coercion. 2 sideraons into hybrid threat, risk, and resilience assessments and strategies. Therefore, enhancing the protecon and re- silience of member naons’ energy systems is The goal of this paper is to enhance Hybrid CoE an urgent goal—a goal made more challeng- member naons’ and allied organizaons’ under- ing by the inherent dependencies and interde- standing of energy dependencies in the context pendencies3 within infrastructure systems and of today’s hybrid threat security environment. between energy-producing, -imporng, and - transing countries. Dependencies influence all components of risk: threat, vulnerability, re- • Provides an overview of dependency-related silience, and consequence. They can themselves policies and iniaves, be a threat, affect the resilience and protec- • Explains the geopolics of energy dependen- on of crical infrastructure, and lead to cascad- cies, ing and escalang failures. Growing dependen- • Describes the classes of dependencies, and cies across infrastructure systems, parcularly re- • Presents a general approach and recommenda- liance on informaon and communicaons tech- ons for integrang energy dependency con- sideraons into hybrid threat analysis and re- silience assessments and strategies. 1Lynch, Sarah N., Lisa Lambert, and Christopher Bing (2018) “U.S. indicts Russians in hacking of nuclear company Wesnghouse.” Available at hps://www.reuters.com/arcle/us-usa-russia-cyber/u-s- indicts-seven-russians-for-hacking-nuclear-company- wesnghouse-idUSKCN1ME1U6. Accessed October 4, 2018. 2Harding, Luke, and Dan McLaughlin (2009) “Deal to resume Russian gas eludes EU as 11 people die in big freeze-up,” Guardian, January 11. Available at hps://www.theguardian.com/world/2009/jan/11/russia- ukraine-gas-supplies-dispute. Accessed October 4, 2018. 3A dependency is a unidireconal relaonship between two assets or enes where the operaons of one affect the operaons of the other. An interdependency is a bidireconal relaonship between two assets or enes where the operaons of both affect each other. An interdependency is effecvely a combinaon of two dependencies—therefore, understanding an interdependency requires analysis of the one-way dependencies that comprise it. (Source: Pet et al. [2015] Analysis of Crical Infrastructure Dependencies and 4Pet, F., et al. (2015) Analysis of Crical Infrastructure Interdependencies, ANL/GSS-15/4, Argonne Naonal Dependencies and Interdependencies, ANL/GSS-15/4, Laboratory, Global Security Sciences Division, Argonne, Ill., Argonne Naonal Laboratory, Global Security Sciences USA. Available at Division, Argonne, Ill, USA. Available at hp://www.ipd.anl.gov/anlpubs/2015/06/111906.pdf. hps://publicaons.anl.gov/anlpubs/2015/06/111906.pdf. Accessed October 3, 2018.) Accessed September 28, 2018. 3 Assessing Energy Dependency in the Age of Hybrid Threats Dependency-Related Policies and Iniaves The definion, classificaon, protecon, and ure or exploitaon of interdependent systems resilience of crical infrastructure tradionally generates cascading and escalang effects. As comprise a naonal competency. For example, highlighted in the 2013 NIPP, “growing [depen- in the United States, Presidenal Policy Direc- dencies and] interdependencies across crical ve 21 (PPD-21) and the Naonal Infrastruc- infrastructure systems, parcularly reliance on ture Protecon Plan (NIPP) guide the strategy for informaon and communicaons technologies, enhancing the protecon and resilience of cri- have increased the potenal vulnerabilies to cal infrastructure. PPD-21 establishes the need physical and cyber threats and potenal conse- for operaonal and strategic analysis to idenfy quences resulng from the compromise of un- infrastructure dependencies and to incorporate derlying systems or networks. In an increasingly them into risk assessment and management pro- interconnected world, where crical infrastruc- cedures.5 The 2013 edion of the NIPP rein- ture crosses naonal borders and global supply forces the need to understand and address risks chains, the potenal impacts increase with these from cross-sector dependencies to enhance in- [dependencies and] interdependencies and the frastructure security and resilience. 6 ability of a diverse set of threats to exploit them.” 8 The need for strategic risk analysis of crical in- frastructure dependencies is also a regional and The following pages present recent dependency- global consideraon. A Joint Declaraon be- related policies and iniaves by region or inter- tween the United States and Poland on Energy naonal organizaon. Security, signed in September 2018, empha- sizes the need to address energy dependency- related challenges facing Poland as well as the broader internaonal community. The Declara- on promotes the development of the infrastruc- ture necessary to increase regional energy secu- rity and diversificaon of sources and promotes the need to counter projects driven by malign ac- tors, which use energy as a means of polical and economic coercion. 7 Energy infrastructure systems are highly inter- connected. For example, Figure 1 shows the interdependencies associated with the electric- ity subsector. Although such interdependence has significantly benefited society in terms of efficiency, it can be a weakness when the fail- 5The White House (2013) Presidenal Policy Direcve 21: Crical Infrastructure Security and Resilience. Available at hps://www.dhs.gov/sites/default/files/publicaons/naonal- infrastructure-protecon-plan-2013-508.pdf. Accessed September 28, 2018. 6DHS (2013) Naonal Infrastructure Protecon Plan: Partnering for Crical Infrastructure Security and Resilience. Available at hps://www.dhs.gov/sites/default/files/publicaons/naonal- infrastructure-protecon-plan-2013-508.pdf. Accessed September 28, 2018. 7DOE (2018) Joint Declaraon between the United States Department of Energy and the Ministry of Energy of the Republic of Poland Concerning Enhanced Cooperaon On 8DHS (2013) Naonal Infrastructure Protecon Plan: Energy Security. Available at Partnering for Crical Infrastructure Security and hps://www.energy.gov/sites/prod/files/2018/11/f57/US- Resilience. Available at Poland%20Declaraon%20for%20Enhanced%20Cooperaon hps://www.dhs.gov/sites/default/files/publicaons/naonal- %20on%20Energy%20Security.pdf. infrastructure-protecon-plan-2013-508.pdf. Accessed January 2, 2019. Accessed September 28, 2018. 4 Assessing Energy Dependency in the Age of Hybrid Threats Figure 1: Electricity Interdependencies9 9Source: Argonne Naonal Laboratory 5 Assessing Energy Dependency in the Age of Hybrid Threats North America 11, 2001, in the United States, to the upsurge of terrorism-related events in Europe in 2016 and 2017. Following the Northeast blackout in 2003, the U.S. and Canadian governments created a task Similar to North America, the EU developed spe- force to analyze the causes and make recom- cific supranaonal programs for the protecon mendaons to prevent or migate future dis- of crical infrastructure. In December 2004, 10 rupons. Since the work of this task force, the Commission established a European Program plans and strategies developed between the for Crical Infrastructure Protecon (EPCIP) and United States and Canada have reiterated the a warning system for crical infrastructure, the importance of considering dependencies in risk- Crical Infrastructure Warning Informaon Net- management processes. work (CIWIN).13 The objecves of EPCIP were to ensure adequate and uniform levels of safety The Canada-United States Acon Plan for Cri- for crical infrastructure, to minimize disrupon, cal Infrastructure, in parcular, presents a