On the Feasibility of Load-Changing Attacks in Power Systems during the COVID-19 Pandemic

The electric power grid is a complex cyberphysical energy system (CPES) in which information and communication technologies (ICT) are integrated into the operations, markets, devices, and services of the power grid infrastructure. The growing number of internet-of-things (IoT) high-wattage appliances such as air conditioners, water heaters, and electric vehicles being connected to the power grid, together with the high dependence of ICT and control interfaces, make CPES vulnerable to high-impact, low-probability load-changing cyberattacks. Moreover, the side-effects of the COVID-19 pandemic demonstrated a modification of electricity consumption patterns with utilities experiencing significant peak load and net-load reductions. The unusual sustained low load demand conditions could be leveraged by adversaries in order to cause frequency instabilities in the CPES by compromising hundreds of thousands of IoT-connected high-wattage loads. This paper presents a feasibility study of the impacts of load-changing attacks on CPES during the low net-load demand conditions caused by the lockdown measures implemented during the COVID-19 pandemic, specifically, during the state-at-home orders (SAHO) declared by different states in the United States. We analyze the load demand reductions caused by the lockdown measures using dynamic mode decomposition (DMD), focusing on the March-to-July 2020 period and the New York region as the most impacted time period and location in terms of load reduction due to the SAHO being in full execution. Our feasibility study evaluates load-changing attack scenarios using real load consumption data from the New York Independent System Operator and shows that an attacker with sufficient knowledge and resources could be capable of producing frequency stability problems, with frequency excursions going up to 60.5 Hz and 63.4 Hz, when no mitigation measures are taken.