Kathrin Günther has a problem. It is almost 15,000 kilometers long and stretches from the North Sea to the Alps, making it the largest supra-regional power grid in Germany. More than 25 million households and companies depend on the line system of the network operator Tennet.
Günther is a member of the management team at Tennet in Germany – and her area of responsibility also includes corporate security. It is responsible for protecting power lines, substations and converter stations as best as possible against terrorist attacks and sabotage. They are part of the so-called critical infrastructure, i.e. the facilities and systems that are irreplaceable for the daily lives of citizens.
Since the increasing number of attacks on power supply facilities in Germany in recent weeks, it has become clear how vulnerable they are. There is practically no infrastructure that is as important to people's everyday lives as the power grid. And therefore not one that is such a worthwhile target for terrorists and hostile powers, especially Russia. Not much works in Germany without electricity.
But how do you protect such an extensive network with thousands of kilometers of power lines and a total of 134 substations from terrorists? And who is responsible for this – the state or do electricity companies like Tennet themselves have to be given more rights to actively protect their facilities? Some are demanding exactly that, while others see the state's monopoly on the use of force as a threat to averting danger through private companies.
Tennet manager Günther warns in an interview with the F.A.S. to hurry up. "There is no time for long fundamental discussions. We should start working on concrete measures in the next few weeks. The faster, the better," she says.
Günther and her team are at the forefront of the defensive battle. What she reports from her everyday working life sounds alarming. “We have been seeing a massive increase in such incidents for a long time,” says the Tennet manager. “From vandalism to spying and sabotage to targeted cyber attacks: practically not a day goes by without a security-related incident.”
“Crisis organization” is the name of the responsible unit in Tennet's corporate organizational chart. Energy manager Günther doesn't talk about how big it is, how it is organized and how exactly it works. She only says this much: The employees who monitor the security of the Tennet power network around the clock are under a lot of pressure and get little sleep.
The threat posed by drones has become a focal point in the public debate about protecting critical infrastructure. At the beginning of August, a drone loaded with explosives was discovered at Leipzig Airport near a Ukrainian cargo plane. The federal government accuses Russia of being behind the attempted attack, but the government in Moscow denies this. A week ago, Interior Minister Alexander Dobrindt (CSU) announced the creation of a national protective shield against “hybrid attacks” from Moscow. Details of the plans are currently unclear.
So far, drone defense in Germany has been the sole responsibility of the state. According to the current legal situation, airport operators, electricity companies and other operators of critical infrastructure systems are not allowed to deactivate the aircraft themselves if there is a fear of danger.
Tennet thinks this is no longer up to date. “We are in favor of allowing operators of critical infrastructure to fend off drones in clearly regulated exceptional cases and as a last resort,” Günther told the F.A.S. Their argument: “Anyone who is responsible for security of supply must be able to protect their systems in an emergency.” This is not trivial; clear responsibilities and clear legal rules are needed. What happens, for example, if falling parts injure people or cause property damage after a drone is shot down? “Important liability questions remain unresolved,” says Günther.
And yet the issue must be addressed quickly, demands Tennet. Drones have become “an important part of the threat,” warns the power grid manager. There have so far been no proven attacks with explosive drones like the incident at Leipzig Airport. But power lines, construction sites and Tennet company buildings are regularly flown over by suspicious drones at any time of the day or night. In some cases the aircraft come very close to the security personnel on site.
What the drone overflights are all about often remains a mystery: sometimes they are probably harmless leisure activities by private individuals with drones from the electronics store. Other incidents are believed to have a more serious background. There are fears of attempts to spy on the power grid infrastructure.
The usual process is as follows: Tennet discovers drones in the sky above its facilities and reports them to the responsible government agencies such as the Federal Office for Information Security and the joint drone defense center of the police authorities and the Bundeswehr. In Tennet's case, one of the drones considered potentially security-relevant has never been rendered harmless. If only because the police generally cannot get to the scene quickly enough if a suspicious aircraft briefly appears over an important network hub and then disappears again.
There are technical options for drone defense. For example, the use of jammers to interrupt the radio connection between the drone and the remote control - the so-called “jamming”. Ultimately, drones can be intercepted or shot down.
There is no uniform approach to dealing with airborne threats in the energy industry. When asked, Germany's largest power plant operator RWE said it was open to a debate about whether companies should be given the right to defend against drones. According to its own statements, RWE itself does not yet have a firm position on this.
"Defending drones is not the task of network operators. In my view, this falls under the state's monopoly on the use of force," said Christoph Müller, head of the electricity network operator Amprion, to the F.A.Z. The company from North Rhine-Westphalia is itself affected by the wave of sabotage. Amprion substations have been the target of attacks in recent weeks. As a result, several blocks of a lignite-fired power plant had to be taken offline for a short time. However, drones were not used in the attacks.
Other operators of critical infrastructure are also cautious about drone defense. Fraport, the operator of Germany's largest airport in Frankfurt, like Amprion, sees the state alone as responsible. "Drone defense is a means of averting danger and is therefore a sovereign task. This task is reserved for the federal and state police authorities," the company said.
However, protection against drone attacks is also easier to organize at large airports than in a decentralized and extensive power grid. Federal police specialists who can intervene quickly are stationed at Frankfurt Airport and other important airports. In the case of the German power grids, protection becomes significantly more difficult. The state cannot set up a police station next to every substation between Kiel and Rosenheim.
“We will never be able to achieve 100 percent security,” says Tennet manager Günther. A sentence that comes up again and again with regard to the power grid attacks. And the power supply also has built-in safety reserves based on the so-called “N-minus-1 principle”: the power system is designed so that it continues to function even after an important unit fails.
And yet better protection is possible. It could be financed through a new “resilience fund” that the federal government is planning to protect critical infrastructure. There are also measures that cost nothing. One of the simplest would be to make less sensitive information about the power grid publicly available on the Internet. Eon boss Leo Birnbaum spoke of “naive transparency obligations” in an interview with F.A.S. last week.
Electricity managers also cite higher fences around substations and other power infrastructure systems as a simple and effective means of better protection, even if not against drones. Tennet manager Günther thinks Germany can learn from Ukraine. The Eastern European country's electricity infrastructure is being systematically attacked by Russia. In Ukraine, for example, important transformer stations were encased in reinforced concrete bunkers and power infrastructure systems were spanned with large networks to defend against drones.
A handicap in defending against power grid terrorists is German data protection, which restricts camera surveillance of systems. "The field of vision of our surveillance cameras currently ends at the fence of the company premises. For example, we are not allowed to monitor the area surrounding a substation with cameras," says Tennet manager Günther. According to the company, seamless camera observation of power lines is currently not permitted by law.
Individual federal states are now taking action after the recent attacks on the power grid. The government in Brandenburg has announced a “lending law” that is intended to give operators more rights to actively protect critical infrastructure. However, Tennet is skeptical. She fears that a regional patchwork of different responsibilities for nationwide systems such as the power grid would ultimately do more harm than good. Günther sees a challenge from the federal government: “We must regulate the better protection of critical infrastructure in Germany in a uniform manner.”
