Day Pitney remains committed to providing quality legal counsel, while protecting our clients and employees, and transforming our communities into more just, equal and equitable spaces. For more information, please visit our COVID-19 Resource Center | Racial Justice and Equity Task Force.
Sophisticated offensive cyber capabilities can be directed against major critical infrastructure, and very recently just such a potential "cyber weapon" has been discovered. Malware developed over years has been uncovered; it has the potential for catastrophic disruption of a variety of infrastructure, most immediately, the electric grid. Those many businesses relying on the internet for their operations would do well to ensure they understand and work to defend against this malware.
Last week, the Maryland-based cybersecurity firm Dragos (a leading firm created by former Department of Defense cyber experts) issued a report titled CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations. The report details Dragos' finding of a new, tailored malware. Although related to the malware employed in the 2016 Ukraine electric cyber attack, this new malware is of particular concern, according to Dragos, because "there is no simple fix to the capability…. It cannot just be patched or architected away." The malware, which Dragos calls CRASHOVERRIDE, appears to be the "first ever malware framework designed and deployed to attack electric grids."
A copy of the full Dragos report, which is currently being reported on by the media, is available on the Dragos website or by clicking here.
Although the report is somewhat technical, the basics are clear. Infrastructural elements, such as the electric grid, are managed through a digital network, often called the Industrial Internet of Things (IIoT). The IIoT, like its cousin the Internet of Things, is based on networked communications, which allow various physical devices to talk to each other, respond to data from sensors and obey human commands. Many people are familiar with home items such as digitally networked thermostats that can respond to temperature sensors, electric load and user preferences, or refrigerators that can tell when the milk spoils. The IIoT is that, but on a national scale, and instead of your home heater or fridge, the network controls huge switching stations and key parts of power generator stations. Bad things can happen if the Internet of Things is hacked or damaged (your milk may spoil, or your identity may be stolen), but potentially catastrophic results could flow from disruption of the IIoT: We may lose power for hours or days, oil rigs may shut down, and generating plants could be shut down or, worse, damaged beyond repair. The Dragos report, although still preliminary, indicates the significance of these risks.
Day Pitney's Cybersecurity and Data Protection practice group has been particularly focused on the IIoT and will continue to monitor this matter. If you need help understanding or navigating the evolving risks associated with the IIoT, please contact Steven Cash or Daniel Wenner.
Day Pitney Alert
On March 23, Day Pitney Partner Joseph Fagan served on the panel, "FERC Enforcement and Compliance," for the Connecticut Power and Energy Society (CPES).
On February 10, Joseph Fagan spoke at the Northeast Energy and Commerce Association (NECA) webinar, "Natural Gas: The Next Phase."
On February 3, partner Joseph Fagan served as a panelist for the Energy Bar Association webinar, "Rumble in the Regulatory Jungle: Rockefeller v. Hart, A Comparison of the NGA and ICA."
Day Pitney successfully represented Exelon before a New Jersey state appellate panel on Friday, where it upheld the New Jersey Board of Public Utilities' approval of a $300 million ratepayer subsidy for three Public Service Enterprise Group Inc.
Day Pitney Press Release
Day Pitney Press Release
Day Pitney Press Release
This website may use cookies, pixel tags and other passive tracking technologies, including Google Analytics, to improve functionality and performance. For more information, see our Privacy Policy. By using our website, you are consenting to our use of these tracking technologies. You can alter the configuration of your browser to refuse to accept cookies, but if you do so, it is possible that some areas of web sites that use cookies will not function properly when you view them. To learn more about how to delete and manage cookies, refer to the support instructions for each browser (e.g., see AllAboutCookies.org). You may locate Google Analytics' currently available opt-outs for the web here.
This website may use cookies, pixel tags and other passive tracking technologies, including Google Analytics, to improve functionality and performance. For more information, see our Privacy Policy. By using our website, you are consenting to our use of these tracking technologies. You can alter the configuration of your browser to refuse to accept cookies, but if you do so, it is possible that some areas of web sites that use cookies will not function properly when you view them. To learn more about how to delete and manage cookies, refer to the support instructions for each browser (e.g., see AllAboutCookies.org). You may locate Google Analytics' currently available opt-outs for the web here.