UNCLASSIFIED Electromagnetic Pulse (EMP) Protection and Resilience Guidelines for Critical Infrastructure and Equipment February 5th, 2019 Version 2.2 Developed by the National Coordinating Center for Communications (NCC) National Cybersecurity and Communications Integration Center Arlington, Virginia Note: These guidelines do not endorse V ersion 2.2 – 5 February 2019 any referenced product, company, Guidelines are subject to change and service, or information external to DHS. only represent the views of the NCC. EMP Protection Guidelines UNCLASSIFIED Executive Overview This document provides guidelines to assist federal, state, and local officials and critical infrastructure owners and operators to protect mission essential equipment against electromagnetic pulse (EMP) threats. It was created to help fulfill the Secretary of Homeland Security’s responsibilities to: • “… provide strategic guidance, promote a national unity of effort, and coordinate the overall Federal effort to promote the security and resilience of the Nation's critical infrastructure.” [Presidential Policy Directive 21 - Critical Infrastructure Security and Resilience] • “… ensure … the necessary combination of hardness, redundancy, … to obtain, to the maximum extent practicable, the survivability of NS/EP {national security/emergency preparedness} communications …” [Executive Order 13618, Assignment of National Security and Emergency Preparedness Communications Functions] • “… be the focal point within the Federal Government for all EMP technical data and studies concerning telecommunications.” [Title 47 Part 215 of the Code of Federal Regulations (CFR)] These guidelines also respond to the U.S. Congressional EMP Commission’s recommendation that the “Department of Homeland Security should play a leading role in spreading knowledge of the nature of prudent mitigation preparations for EMP attack to mitigate its consequences.” [Report of the Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack, Critical National Infrastructures, page 181, 2008]. The Department of Homeland Security (DHS) takes seriously the findings of this Commission, such as: “The critical national infrastructure in the United States faces a present and continuing existential threat from combined-arms warfare, including cyber and manmade electromagnetic pulse (EMP) attack, as well as from natural EMP from a solar superstorm. During the Cold War, the U.S. was primarily concerned about an EMP attack generated by a high-altitude nuclear weapon as a tactic by which the Soviet Union could suppress the U.S. national command authority and the ability to respond to a nuclear attack—and thus negate the deterrence value of assured nuclear retaliation. Within the last decade, newly- armed adversaries, including North Korea, have been developing the ability and threatening to carry out an EMP attack against the United States. Such an attack would give countries that have only a small number of nuclear weapons the ability to cause widespread, long-lasting damage to critical national infrastructures, to the United States itself as a viable country, and to the survival of a majority of its population.” [Assessing the Threat from Electromagnetic Pulse (EMP), Executive Report, July 2017] There are four EMP Protection Levels defined herein, as outlined in Table 1. These levels were initially developed at the request of the federal Continuity Communications Managers Group (CCMG), but are applicable to any organization that desires to protect its electronics and critical infrastructures. For additional background on EMP, a set of reports can be found at “www.firstempcommission.org“ that includes information about high-altitude EMP (HEMP), Source Region EMP (SREMP), and Intentional Electromagnetic Interference (IEMI) EMP. Note: These guidelines do not endorse Version 2.2 – 5 February 2019 any referenced product, company, Guidelines are subject to change and service, or information external to DHS. only represent the views of the NCC. EMP Protection Guidelines UNCLASSIFIED Table 1. Four EMP Protection Levels for Infrastructure and Equipment Level 1: Lowest cost; Level 2: Only hours Level 3: Only minutes Level 4: Only seconds longer mission of mission outages of mission outages are of mission outages outages permitted are permitted permitted permitted • Unplug power, data, In addition to Level 1 … In addition to Level 2 … In addition to Level 3 … and antenna lines • Use EMP-rated SPDs • Use International • Use Military EMP from spare equipment on power cords, Electrotechnical Standards (like MIL- where feasible. antenna lines, and Commission (IEC) EMP STD-188-125-1 and • Turn off equipment data cables to protect and IEMI protection MIL-HDBK-423), and that cannot be critical equipment. standards (IEC SC 77C 80+ dB hardening unplugged and is not • Use on-line/double- series, see Appendix F). through 10 GHz. actively being used. conversion • Shielding should be 30+ • Use EMP shielding in • Use at least a lightning uninterruptible power dB of protection rooms, racks, and rated surge protection supplies (UPS) or a through 10 GHz. buildings as needed to device (SPD) on power high quality line • Use EMP shielded racks, protect critical cords, antenna lines, interactive UPS. rooms, or facilities to equipment. and data cables; • Use fiber optic cables protect critical • Use EMP protected maintain spare SPDs. (with no metal); computers, data double-door • Have either EMP otherwise use centers, phone entryways. protected backup shielded cables, switches, industrial and • Validate per Military power or a generation ferrites, and SPDs. substation controls and guidelines, like Test source that is not Note: shielded racks, other electronics. Operations Procedure connected to the grid rooms or facilities may • Use “Recommended E3 (TOP) 01-2-620 HEMP. with one (1) week of be more cost-effective HEMP Heave Electric • Have 30+ days of on-site fuel or than hardening Field Waveform for the Military Standard equivalent (e.g., numerous cables. Critical Infrastructures” protected power and renewable source). • Use EMP protected from EMP Commission fuel, plus alternate • Wrap spare backup power that is for grid and undersea generation source electronics with not vulnerable to EMP cable protection (renewables aluminum foil or put coupled through the planning. Use 85 V/km preferred). in Faraday containers. power grid. for CONUS E3 threat. • Consider double surge • Use priority phone • Implement EMP • Use EMP tested SPDs protection on critical services like GETS, protected, high and equipment. external lines entering WPS (for cell phones), frequency (HF) voice • Institute IEC level EMP protected areas. and TSP; join SHARES and email for long- hardness maintenance • Consider using if applicable (see distance & surveillance (HM/HS). communications Appendix C). communications. • Have 30 days of EMP systems/networks that • Consider land mobile • Consider protected power/fuel. are designed to meet radios with standalone geosynchronous (GEO) • Store 30 days of food, Military EMP capabilities, HF radios, orbit satellite services, water, and critical standards, like: and FirstNet. like BGAN. Avoid low- supplies and spares. Advanced EHF (AEHF) • Store one week of earth orbit (LEO) satellite, EMP • Use time-urgent EMP food, water, and other satellite services. Use protected fiber optic resilient comms, like X, supplies for personnel. terminals that are networks, and EMP EMP resilient. Ku and Ka satellite, and protected radios. • Use battery operated either HF groundwave AM/FM/NOAA radios • Consider shortwave • Institute ongoing radio for situational or Automatic Link to receive Emergency Establishment (ALE) HF. Military Standard Alerts. awareness. HM/HS programs. Note: These guidelines do not endorse Version 2.2 – 5 February 2019 any referenced product, company, Guidelines are subject to change and service, or information external to DHS. only represent the views of the NCC. EMP Protection Guidelines UNCLASSIFIED Level 1 begins with low-cost methods and best practices to help protect critical infrastructure from severe damage. An important aspect of Level 1 protection is ensuring that personnel have backup power and the food, water, and other essential supplies needed to operate and maintain their mission-critical systems, given that normal services and supply chains are likely to be disrupted in some reasonable scenarios for a week (or longer). Level 2 guidelines are based on using EMP-capable filters and surge arresters on power cords, antenna lines, and data cables, as well as installing fiber optics and ferrites, where possible, to protect critical equipment. These will mitigate the majority of EMP equipment vulnerabilities when EMP facility shielding is not feasible and are expected to be the most cost-effective approach for hardening limited equipment in facilities. Levels 1 and 2 are for organizations where days or hours of mission interruptions can be tolerated and for which “cost to harden” is a critical factor. Level 3 guidelines are appropriate for organizations, facilities, and systems that cannot tolerate more than a few minutes of mission outage due to EMP, in order to effectively protect life, health, and security. The International Electrotechnical Commission (IEC) EMP and IEMI protection standards (IEC SC 77C series, see Appendix F), serve as the foundation for planning and protecting critical infrastructures and equipment that are in this category. For EMP Protection Levels 3 (and 4),