Greg Sofran - CSSS 5120 - Research Paper

Running head: CYBER VULNERABILITY IN ELECTROMAGNETIC PULSE 1

Cyber Vulnerability in Electromagnetic Pulse

Greg Sofran

Webster University

CYBER VULNERABILITY IN ELECTROMAGNETIC PULSE 2

Abstract

Communications and information networks are vulnerable to natural disasters and physical

attacks using electromagnetic pulse (EMP). Real world problems occur in specific locations

throughout the world which interfere with parts of the information and communications networks

which are used in all sixteen critical infrastructure sectors listed and described on the Department

of Homeland Security official web site. This paper examines the vulnerability of the information

and communications networks to EMP used by the emergency services, energy and financial

sectors in the United States. This research paper aims to discuss countermeasures to mitigate the

negative impacts of an electromagnetic pulse to include the definition of EMP, electromagnetic

compatibility (EMC), electromagnetic vulnerability (EMV), electromagnetic interference (EMI)

and the electromagnetic spectrum. The purpose of this paper is to educate through research in

reference to the vulnerabilities of information and communication networks to EMP and ways to

mitigate the effects of EMP events.

Keywords: Electromagnetic pulse (EMP), electromagnetic vulnerability (EMV), electromagnetic

interference (EMI), electromagnetic compatibility (EMC) and electromagnetic spectrum.


Cyber Vulnerability in Electromagnetic Pulse

Introduction

This research explains the effects of an electromagnetic pulse (EMP) attack and the impact

on the emergency services, financial and energy sectors. The results of this research will show

the prominent cyber vulnerabilities to an EMP attack on these sectors and the use of technology

such as EMP hardening of communications and data networks and equipment to counter the

effects of an EMP attack. Several key terms must be addressed. These key terms are important

to have an understanding of the research in this paper. Electromagnet pulse (EMP) is a main

element of cyber vulnerability to EMP. EMP is the electromagnetic radiation from a nuclear

explosion caused by Compton-recoil electrons and photoelectrons from photons scattered in the

materials of the nuclear device or in a surrounding medium. Electromagnetic vulnerability

(EMV) is the characteristics of a system that cause it to suffer a definite degradation as a result of

having been subjected to a certain level of electromagnetic environmental effects.

Electromagnetic interference (EMI) is any electromagnetic disturbance that interrupts, obstructs,

or otherwise degrades or limits the effective performance of electronics and electrical equipment.

Electromagnetic compatibility (EMC) is the ability of systems, equipment, and devices that

utilize the electromagnetic spectrum to operate in their intended operational environments

without suffering unacceptable degradation or causing unintentional degradation because of

electromagnetic radiation or response (Defense Acquisition University, 2007). The

electromagnetic spectrum is the complete range of wavelengths from the longest radio waves and

extending through visible light all the way to the extremely short gamma rays (Musey, 2013).

Technology in the modern day has grown and is growing at an exponential rate making it

technically difficult to protect information and critical infrastructure which creates the potential


for cyber vulnerabilities to electromagnetic pulse. Nuclear explosions and non-nuclear

electromagnetic pulse weapons create a high energy pulse of electrical and magnetic energy that

disrupts electronics and power grids for hundreds of miles. A high altitude electromagnetic

pulse (HEMP) releases energy in the form of gamma rays. Gamma rays collide with molecules

of air and produce Compton electrons (Ullrich, 1997). These electrons interact with the earth’s

magnetic field and produce an electromagnetic pulse which propagates in the downward

direction to the earth’s surface. The initial gamma rays and EMP move at the speed of light.

The effects of the EMP encompass an area along the line of sight from the point of detonation to

the earth’s horizon. Any systems that are in view of the detonation will experience some degree

of EMP.

An electromagnetic pulse consists of three components which are E1, E2 and E3. The E1

component is a free field energy pulse that occurs in a fraction of a second. The generated

electromagnetic shock damages, disrupts and destroys electronics and electronic systems in a

near simultaneous timeframe over a very large area. Faraday cage protection and other

mechanisms designed to defend against lighting strikes will not withstand this assault. Only

specialized technology integrated into equipment can harden the equipment against EMP. When

the electromagnetic distortion is large enough the E1 shock will destroy lightly EMP shielded

equipment in addition to most consumer electronics. Devices that incorporate antennas and

accept electronic signals cannot be shielded against E1. The result will be the destruction of

trillions of dollars of electronics that will fail after an EMP assault regardless of protective

measures. The E1 component is particularly concerning since it destroys Supervisory Control

and Data Acquisition (SCADA) components that are critical to the United States’ national

infrastructures.


The E2 component covers the same area as E1 but is more geographically widespread but

has a lower amplitude than E1. The E2 component has similar effects as lightning. E2 is not a

critical threat to critical infrastructure since most systems have built in protection against

occasional lightning strikes. The E2 threat compounds the E1 component since it strikes a

fraction of a second after the E1 component has damaged or destroyed the protective devices that

would have prevented damage from the E2 component. The result is that the E2 component

typically inflicts more damage than E1 since it bypasses traditional protective measures and

greatly amplifies the damage inflicted by the EMP.

The E3 component is a longer duration pulse the lasts up to one minute. It disrupts long

electricity transmission lines and causes damage to the electrical supply and distribution systems

connected to these lines. The E3 component of EMP is not a freely propagating wave; it is a

result of the electromagnetic distortion in the earth’s atmosphere. In this way the E3 component

is similar to a massive geomagnetic storm and is particularly damaging to long line infrastructure

such as electrical cables and transformers. A moderate blast of E3 could negatively impact up to

seventy percent of the power grid in the United States.

The timing of the three components is an important part of the equation in relation to the

damage that EMP generates. The damage from each strike amplifies the damage caused by each

succeeding strike. The combination of the three components causes irreversible damage to many

electronic systems. With the combined damage from earlier E1 and E2 blasts the E3 component

of the EMP has the potential to destroy the nation’s critical communications and electrical power

grid inflicting catastrophic damage on the United States. The EMP can easily and rapidly span

continent sized areas and can affect systems on land, sea and air. The EMP pulse from a nuclear

burst extends well past the visual horizon as seen from the point of the burst.


Figure 1 depicts the EMP area of a burst at an altitude of 30, 120 and 300 miles above the

geographical center of the lower forty-eight states within the United States.

Figure 1. Electromagnetic Pulse Threats

Figure 1. EMP area by bursts at 30, 120 and 300 miles. “Electromagnetic Pulse

Threats” testimony to House National Security Committee. by: Smith, Gary. Young

Research & Publishing Inc., Naples, FL and Newport, RI. Jul 1997.

The EMP effects vary depending on numerous factors. One of the most important variables

is the altitude of the EMP blast. The most effective altitude to achieve the greatest EMP effect is

for the EMP blast to be above the visible horizon. If the detonation is to low most of the electro-

magnetic force from the EMP will be driven into the ground and create deadly nuclear fallout

that deprives the weapon of its non-casualty appeal. The damage is inversely related to the


target’s distance from the epicenter of the detonation. The further away from the EMP blast’s

epicenter the weaker the EMP effects will be. The yield of the nuclear weapon is another factor

to consider. The higher the yield of weapon the greater the effect of the EMP. Even so since the

effects travel through electric lines and waterways and have secondary spill-over impacts on

other critical infrastructure it is technically difficult to predict the full extent of damage from a

large scale EMP attack.

In the event of a high yield weapon being detonated two-hundred-fifty miles above the

United States most if not all of the lower forty-eight states would be in the line of sight of the

detonation. The frequency range of such a detonation has an EMP that ranges from below one

hertz to one gigahertz. All modern types of electronics are at risk from Chicago to New Orleans

and from Los Angeles to Boston. A nuclear atmospheric test of a 1.4 megaton device conducted

by the United States in 1962 two-hundred-forty miles above Johnston Island caused electronic

systems to fail in Hawaii seven-hundred miles away (Ullrich, 1997). Not commonly known

about the effects of a high altitude EMP burst is that of the pumping of a large number of

electrons into the Van Allen A and B belts also known as the inner and outer radiation belts

around the Earth. The bomb induced electrons remain trapped in these belts for a period of time

in excess of one year. Global Position System (GPS) and Low-Earth Orbit (LEO) satellites in

these belts that are not hardened to withstand electrons from a high altitude EMP blast would

meet their demise in a matter of days to weeks after such a blast.

Figure 2 which follows depicts the detonation of a nuclear weapon at a high altitude referred

to as a HEMP as well as the induced Gamma rays into the atmosphere along with the negative

impacts on communications networks and aircraft.


Figure 2. Nuclear weapon detonation at high altitude. Gamma rays in atmosphere,

EMP impacts geostationary satellites & communications networks &aircraft

Figure 2. Nuclear weapon detonation at high altitude. Gamma rays in

atmosphere, EMP impacts geostationary satellites & communications

networks and aircraft. Federation of American Scientists. 2014,

Retrieved from http://www.fas.org/nuke/intro/nuke/emp.htm

When Gamma and x-rays from a high altitude detonation encounter a satellite in space they

excite and release electrons when the Gamma rays penetrate the interior of the satellite system.

This is referred to as System Generated Electromagnetic Pulse (SGEMP) since the accelerated

electrons create electromagnetic transients. Systems need to be configured with aperture

protection, grounding, special cables and insulating materials to survive the EMP effects.

SGEMP impacts space systems in three ways. The first is the x-rays causing electrons to collect

http://www./


on the skin of the space system. The electron charge is not distributed uniformly over the skin of

the space system which causes current to flow on the outside of the system. The current can

penetrate into the interior of a space system such as a communications satellite by entering

through the various apertures and solar cell power transmission systems. A second way in which

Gamma and x-rays can penetrate the skin of a space system is to produce electrons on the

interior walls of various compartments. The resulting interior electron currents generate cavity

electromagnetic fields that induce voltages on the electronics which produce spurious currents

that can burnout the electronics (Ullrich, 1997). The third way in which SGEMP impact space

systems electronics is the Gamma and x-rays produce electrons that propagate directly into

power and signal cables and wiring harnesses causing extraneous cable currents.

In addition to a high altitude burst producing an EMP there is also a low altitude nuclear

burst that produces a Source Region Electromagnetic Pulse (SREMP). In a low altitude nuclear

burst a vertical electron current is formed by the asymmetric deposition of electrons in the

atmosphere and the ground. The formation and decay of the current emits a pulse of

electromagnetic radiation in directions perpendicular to the current. The asymmetry from a low

altitude nuclear detonation occurs due some of the electrons emitting downward being trapped in

the Earth’s surface. Other electrons move upward and outward and can travel long distances in

the atmosphere producing ionization and charge separation. A SREMP can produce peak

electric fields greater than 100,000 volts per meter and peak magnetic fields greater than 4,000

amperes per meter (Federation of American Scientists, 2014). These are much larger than those

from HEMP and pose a considerable threat to military and civilian systems. The surface of the

Earth is a conductor of electricity and provides a return path for electrons at the outer part of the

deposition region toward the burst point. Positively charge ions travel shorter distances than


electrons and at lower velocities and the ions remain behind and recombine with the electrons

returning through the ground. The result is very strong magnetic fields are produced in the

region of ground zero when the nuclear detonation occurs near to the surface of the Earth.

EMP whether from a high or low altitude nuclear burst does not differentiate between power

grids, telecommunication and computing systems. Systems that are not hardened against EMP

such as commercial power grids, computer and telecommunication systems remain vulnerable to

widespread prolonged outages and disruptions. The Homeland Security Science and Technology

Act of 2010 contains provisions for the establishment of a commission on the Protection of

Critical Electric and Electronic Infrastructures which will serve to ensure improvements in EMP

hardening of telecommunication and computing systems and power grids.

EMP Vulnerabilities in Emergency Services Sector

The emergency services sector consists of interacting national, regional, state and local

communications and network systems interconnected over large geographical areas. The

emergency services sector systems are under the control of national, regional and state control

centers. These systems depend upon wireless and fixed communications, broadband, radio

frequencies and fiber optics. Communications and data networks are vulnerable to natural

disasters such as hurricanes, floods, earthquakes and physical attacks such as an electromagnetic

pulse attack. The natural disasters occur in specific geographical areas and disrupt and/or

disables specific parts of the network. An EMP attack on the other hand not only disrupts and

disables communications and data networks it also destroys them permanently over a large

geographical are unless the equipment is hardened to withstand an EMP. Hardening of

equipment used in communications and data networks is not an absolute guarantee that the

equipment will not be damaged in some manner by an EMP (Cohen, Modiano, Neumayer,


Zussman, 2011, p1610). Since an EMP is an intense energy field it can instantaneously

overload, disrupt and/or disable numerous circuits over a large geographic area depending upon

the height of the detonation of the nuclear weapon. An EMP attack would have disastrous

effects on the U.S. telecommunication capabilities which are used by the emergency services

sector. Hardening emergency services systems is a solid countermeasure to an EMP; however,

there is not a countermeasure that can achieve one-hundred percent protection from an EMP.

Emergency services use personal type computer systems especially at the local governmental

level which often do not possess the financial resources to purchase computers which are

hardened against EMP. Computers in use in this sector that contain an 8088 processor based

system up to current 2016 computer processors are extremely vulnerable to fast transient

electromagnetic pulses and double exponential pulse shapes from EMP. The susceptibility to

EMP increases significantly with each computer generation (Camp, Garbe, 2006). The

countermeasure to this issue is for the federal government to either provide EMP hardened

equipment directly to state and local governments or to provide the financial resources to enable

the state and local governments to make purchases of EMP hardened equipment. The state and

local governments and the federal government would be well served by using federal

government contracts to purchase EMP hardened computer systems since the federal government

contract already contain the specifications for the EMP hardened computing systems. Doing so

would eliminate each state and local governments from using federal financial grants to purchase

a myriad of computing systems that may not be able to interconnect with emergency service

systems at the regional and federal levels and may not meet required standards for EMP

hardening for computing systems. The interconnectivity throughout the network for the

emergency services sector and ensuring all of the computing systems meet EMP hardening


specifications takes priority over each state and local governments from acquiring their own

EMP hardened computing systems.

EMP Vulnerabilities in Energy Sector

Depending on the yield of the nuclear weapon and the height of the burst a nuclear EMP can

destroy large portions of the U.S. power infrastructure. An EMP attack would destroy the

electronics and digital circuitry in a large geographic area denying electrical power to homes,

businesses and military facilities that are not hardened against EMP. The United States is

dependent on electricity to power our health, financial, transportation, and business systems. If

the electrical power grid in the United States was ever lost over a large for an extended period of

time it would have catastrophic and lethal consequences for the population and the economy. It

would also degrade our military defenses. The United States’ digital dependence grows every

year and along with the dependence so does the vulnerability to EMP.

Computer simulations carried out in March 2010 at the Oak Ridge National Laboratories

demonstrated that an electromagnetic pulse from a nuclear device detonated at high attitude

could destroy or permanently damage major sections of the National power grid. According to

this Oak Ridge Study, the collapse of the power system could impact 130 million Americans,

and require four to ten years to fully recover and impose economic costs of $1 to $2 trillion

(Graham, 2012). The National electrical power grid has almost no backup capability in the event

of a power collapse from an EMP attack. Existing bulk power reliability standards don't address

EMP vulnerabilities. In addition, with most of the Nation's electrical power system under private

ownership who view an EMP attack as highly unlikely there has been little preparation for a

long-term electrical power collapse by private industry. Some progress has been made though

by the U.S. federal government in mitigating the EMP threat. The United States has conducted


numerous exercises to test readiness against natural events such as hurricanes there has not been

a nationwide exercise to help prepare for severe consequences of a National power outage from

an EMP attack. The Grid Reliability and Infrastructure Defense (GRID) Act amends the Federal

Power Act to permit the Federal Energy Regulatory Commission (FERC) to issue new industry

standards to protect critical infrastructure from cyber and EMP attacks.

EMP Vulnerabilities in Financial Sector

The financial sector relies extensively upon computing systems and inter-networking to

conduct daily business. Banks are connected with the Society for Worldwide Interbank

Financial Telecommunications (SWIFT) network. SWIFT provides secure network for

transmitting messages between financial institutions; a set of syntax standards and market

practices for financial messages and a set of connection software and services which enable

financial institutions to transmit messages over the SWIFT network (Hammerli, 2012, p302).

The transmission protocol over the internet used between banks and clients to place orders and

obtain information is vulnerable to an EMP attack. The vulnerability is increasing daily as the

use and dependence on electronics and automated systems continues to grow exponentially. The

impact of EMP is asymmetric in relation to potential adversaries who are not as dependent upon

modern electronics as the United States is. The efficiency of the financial sector is generated

through the use of electronics and automated systems and that is also a potential vulnerability.

The current vulnerability of the financial sector to EMP attack both invites and rewards attack.

Correcting the vulnerabilities of the financial sector are feasible and within the national

means and resources to accomplish. It will require the combined effort of private and public

sectors of the United States. The appropriate response to the EMP threat is a balance of


prevention, planning, training, maintaining situational awareness, protection and preparations for

recovery. This will reduce the incentives for the adversaries of the United States to conduct an

attack against America. Even though EMP was first considered during the Cold War as a

means of paralyzing U.S. retaliatory forces and eliminating America’s strategic deterrent of

responding in kind with an EMP attack. The risk of an EMP attack today is even greater since

several potential adversaries of the United States are seeking nuclear weapons, ballistic missiles,

and asymmetric ways to overcome the United States’ conventional superiority by using one or a

number of nuclear weapons to mount an EMP attack (Graham, 2008, p8). This would seriously

impact the financial system in the United States. Failure to take action to harden financial

communications and data networks to EMP attack will leave the critical national financial

infrastructure that are necessary for society to function at very high risk.

Recommendations

In summary, by implementing the following recommendations the effects of EMP can be

mitigated to ensure continued operation of critical infrastructure sectors: (1) harden equipment,

power grids, telecommunication and computing systems against EMP by using EMP shielding

technologies and underground facilities; (2) all levels of government from local to federal use

U.S. government federal EMP technical specifications and government contracts to acquire

EMP hardened telecommunication, power grid and computing systems and equipment; (3) local,

state and the federal government not use independent EMP specifications and contracts to

acquire EMP hardened telecommunications and computer systems and equipment to prevent

interconnectivity technical issues between telecommunications and computer systems at the

local, state and federal government levels and to avoid higher costs and duplication of effort; (4)

the U.S. federal government serve as the decision maker for all EMP technical specifications for


telecommunication, power grid and computer systems contracts; (5) that the effectiveness of

EMP hardening have a higher priority than the cost; (6) the least cost technically acceptable

EMP hardening products not be selected for acquisition by the federal government or any other

level of government; (7) the EMP products with the greatest effectiveness to withstand an EMP

be selected during the federal acquisition process; (8) Department of Homeland Security (DHS)

to “make clear its authority and responsibility to respond to an EMP attack” by developing

contingency plans in cooperation with appropriate federal, state and local agencies, and industry

(Carafano, Spring, Weitz, 2011); (9) that DHS develop response protocols for an EMP attack and

regularly practice this response through exercises with relevant government agencies and

industry groups (Carafano et al. 2011); (10) DHS work with the Department of Energy and

industry groups to address vulnerabilities in the U.S. electrical infrastructure; (11) the cost of

critical infrastructure improvement to withstand an EMP attack be divided between the U.S.

federal government and industry.

Conclusion

In conclusion, this research provided a thorough review of cyber vulnerabilities in EMP

attacks. It addressed high altitude EMP (HEMP), low altitude nuclear bursts that produce Source

Region Electromagnetic Pulse (SREMP) and System Generated Electromagnetic Pulse

(SGEMP), cyber vulnerabilities to EMP in the emergency services, energy and financial sectors

and countermeasures. This project also summarized the key issues and provided

recommendations to resolve the issues. Some of the methods discussed include the Department

of Homeland Security working with private industry and the Department of Energy to

conducting nationwide exercises to assess preparedness for an EMP attack; EMP hardening of

telecommunication, power grid and computer systems to ensure their continued survivability


during and after an EMP attack. The framework of a combined effort by the Department of

Homeland Security, Department of Defense, Department of Energy, state governments and

private industry going forward serves to ensure the critical infrastructure of the United States

continues to successfully function in the event of an EMP attack.


References

Assessing the Vulnerability of the Fiber Infrastructure to Disasters. by: Cohen, Reuven;

Modiano, Eytan; Nuemayer, Sebastian; Zussman, Gil. IEEE/ACM Transactions On

Networking. Dec 2011, Vol. 19, No. 6, p1610-1617, 8p.

Before the Lights Go Out: A Survey of EMP Preparedness Reveals Significant Shortfalls. By:

Dr. Carafano, James; Spring, Baker; Dr. Weitz, Richard. Department of Homeland Security.

Aug 2011.

Electromagnetic Compatibility. Defense Acquisition University. 2007, Retrieved from

https://acc.dau.mil/CommunityBrowser.aspx?id=152110&lang=en-US

Electromagnetic Interference. Defense Acquisition University. 2007, Retrieved from


Electromagnetic Pulse. Defense Acquisition University. 2007, Retrieved from


Electromagnetic Pulse (EMP): Threat to Critical Infrastructure (2nd ed.). ISBN:13: 978-

1503140257. by: Infrastra Subcommittee on Cybersecurity. 2014. CreateSpace Publishing,

7290 Investment Drive, Unit B, North Carolina, South Carolina 29418.

Electromagnetic Vulnerability. Defense Acquisition University. 2007, Retrieved from


“Electromagnetic Pulse Threats” testimony to House National Security Committee. by: Smith,

Gary. Young Research & Publishing Inc., Naples, FL and Newport, RI. Jul 1997.

Financial Services Industry. by: Hammerli, Bernhard. Critical Infrastructure Protection. 2012,



p301-329, 28p.

Nuclear Weapons Detonation at High and Low Altitudes and EMP Effects. Federation of

American Scientists. 2014, Retrieved from http://www.fas.org

Special Weapons Nuclear, Chemical, Biological and Missile. by: Dr. Ullrich, George.

Congressional Hearings. 1997, Retrieved from

http://fas.org/spp/starwars/congress/1997_h/h970716u.htm

Susceptibility of Personal Computer Systems to Fast Transient Electromagnetic Pulses. by:

Camp, Michael; Garbe, Heyno. IEEE Transactions on Electromagnetic Compatibility. Nov

2006, Vol. 48, Issue 4, p829-833, 5p.

The EMP Threat: Examining the Consequences. by: Dr. Graham, William. Hearing before the

Subcommittee on Cybersecurity Infrastructure Protection and Security Technologies of the

Committee on Homeland Security House of Representatives. Sep 2012, Serial No. 112-115.

The Spectrum Handbook 2013. ISBN13: 978-0989296205. by: Musey, Armond. July 2013.

Summit Ridge Group, LLC. 535 Fifth Avenue, 4th Floor, New York, N.Y. 10017

Threats Posed by Electromagnetic Pulse (EMP) Attack. by: Dr. Graham, William. Committee

on Armed Services House of Representatives. July 2008, p1-47, 47p.

Greg Sofran - CSSS 5120 - Research Paper

Documents

Transcript of Greg Sofran - CSSS 5120 - Research Paper