Can 2015 Ukraine power grid attack happen in PH? UP prof says possible, NGCP refutes

There is a possibility that the power grid attack in Ukraine in 2015 could happen in the Philippines, a professor from the University of the Philippines (UP) told a Senate panel Wednesday but the National Grid Corporation of the Philippines (NGCP) said the country’s system is protected.

During the continuation of the Senate energy committee’s investigation into NGCP’s operations, Senator Raffy Tulfo, panel chairman, said former National Security Adviser Hermogenes Eesperon had mentioned the “vulnerability” of the system after he conducted an inspection amid reports that China can remotely control the country’s grid system.

UP Diliman Electrical and Electronics Engineering Associate Professor Rowaldo del Mundo, who was invited in the hearing as a representative of the academe, explained that vulnerability means there is a possibility that an outsider can hack the system operations.

He mentioned the 2015 and 2016 hacking of Ukraine’s power grid as an example to expound the meaning of vulnerability of the system.

At this point, Tulfo asked Del Mundo if the incident in Ukraine could happen in the Philippines to which the latter replied: “Pwede po.”

“Sabi po sa report na nabasa ko don sa Ukraine cyberattack ng power grid na nagpadapa at SCADA (Supervisory Control and Data Acquisition) po ang pinasok no’n. Ibig sabihin the hacker outside was able to control ‘yung SCADA at in fact ang ginawa pa ng hacker dinisable—‘yung control engineer mismo na nasa sa control center hindi niya na ma-control. At isa-isa ‘yung mga circuit breaker po ay napapanood na lang niya na sini-switch off kaya one after another nagba-brownout do’n sa Ukraine,” Del Mundo said.

Citing commentaries on the incident, the professor said this kind of hacking is a “practice before the war.”

Del Mundo said it is also possible for manufacturers of NGCP equipment to install a virus to the hardware, adding that there’s a need for a security audit which will include the inspection of the source code to ensure the protection of the system.

Last week, NGCP Assistant Corporate Secretary Ronald Dylan Concepcion disclosed that the equipment used in NGCP facilities are from China—the reason why some of its manuals and instructions are written in Chinese characters.

Reacting to Del Mundo’s position, NGCP spokesperson Cynthia Alabanza said the grid system of the Philippines is protected and the country uses a different system operation.

“Ang nangyari po sa Ukraine, magkadikit po ang [system operation] nila do'n sa IT, sa corporate network. Ang NGCP po stand-alone ang [system operation] natin, Mr. Chair. Hindi po nakakabit sa internet ‘yung… operating network…sa [system operation]. So ‘yung nangyari po sa Ukraine hindi po mangyayari dito. Protected po kami among others by an air gap,” Alabanza said.

The NGCP spokesperson also said they adopted several improvements to protect NGCP’s operating network.

Further, Alabanza said the NGCP system also passed the Vulnerability Assessment and Penetration Test under the Energy Regulatory Commission.

Last week, members of the Senate energy committee expressed concern over China State Grid Corporation’s 40% ownership of the NGCP, saying this poses a national security threat to the Philippines especially now that China is claiming ownership over the West Philippine Sea.

Concepcion earlier said that China cannot remotely control NGCP’s facilities but Tulfo pointed out that NGCP cannot claim this unless it was verified through an inspection of State Grid Corporation of China.—AOL, GMA Integrated News