Security: Modernizing and Securing US Infrastructure with Open Source Software and Firmware

The aging utility infrastructure in the US is in crisis. A lack of major investment in infrastructure over the last few decades in the US has led to overall decay in infrastructure across the board. Major bridges are decaying and the electric grid is maxed out. Storms and huricanes, floods, and wildfires — all of these stresses from a changing climate have just made things worse. The United States’ latest report card on infrastructure from the American Society of Civil Engineers gave it a C-.

The US needs to rebuild and rearchitect its infrastructure. It’s not just the tangible wires and pipes that are at risk of decay. The software and systems used to control our electric grid and water are aging and vulnerable to attack and cyberhacking.

Last year, after the Ransomware attack on Colonial Pipeline, Energy Secretary Jennifer Granholm said that “I think that there are very malign actors who are trying. Even as we speak, there are thousands of attacks on all aspects of the energy sector and the private sector generally.”

One example is a report from the US Department of Energy which found that “the government of (the) People’s Republic of China is equipped and actively planning to undermine the electric power system in the United States.

Open Source control software for utilities may be part of the solution. The use of Open Source firmware and software could speed up modernization of US utilities and help us secure our utility infrastructure. Shuli Goodman, LF Energy’s executive director, said that “we’re using a brute-strength approach to producing electricity now. Software-defined infrastructure is a reality. It abstracts complexity, and the cost of using it eventually goes to zero.”

Goodman said that “A more targeted and long-term solution would be to open-source the entire stack. In essence, this means outlawing black boxes on the grid whether at high-medium-or low voltage. And, because any device attached to the grid can be a security vulnerability, we need to create a path towards complete transparency. A wiser course would be to recognize that any hardware with embedded, proprietary software (sic that cannot be accessed or reviewed) is the real threat to the grid.”

Antonello Monti, professor at RWTH Aachen University and Group Leader at Fraunhofer Center for Digital Energy, said that “we need to move at unprecedented speed. Open Source is the only way to reach this speed. Other sectors already showed the way, and it is now time for energy to do the same.”